@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/react/core/signingEngine/threshold/ecdsa/activation.js

@@ -1,267 +0,0 @@
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseRouterAbEcdsaOperationStepUpPreparationV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { deriveEvmFamilyKeyFingerprint } from "../../session/identity/evmFamilyEcdsaIdentity.js";
-import { parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
-import { parseEcdsaThresholdKeyId } from "../../session/keyMaterialBrands.js";
-import { buildEcdsaRoleLocalEmailOtpAuthMethod, buildEcdsaRoleLocalPasskeyAuthMethod, buildEcdsaRoleLocalPublicFacts } from "../../session/persistence/ecdsaRoleLocalRecords.js";
-import { bootstrapEcdsaSession } from "./bootstrapSession.js";
-//#region src/core/signingEngine/threshold/ecdsa/activation.ts
-const STALE_ECDSA_KEY_IDENTITY_ERROR_CODE = "stale_ecdsa_key_identity";
-function requireStrictEcdsaRouteAuth(auth) {
-	if (!auth) throw new Error("Strict ECDSA session bootstrap requires Wallet Session authority");
-	switch (auth.kind) {
-		case "opaque_wallet_session_operation_credential_v1": return auth;
-		case "publishable_key": throw new Error("Strict ECDSA session bootstrap requires Wallet Session authority");
-	}
-	throw new Error("Strict ECDSA session bootstrap authority is invalid");
-}
-function isStaleEcdsaIntegratedKeyBootstrapFailure(args) {
-	const code = String(args.code || "").trim();
-	const message = String(args.message || "").trim().toLowerCase();
-	return code === "stale_session_state" && message.includes("threshold-ecdsa bootstrap") && message.includes("client verifying share") && message.includes("integrated key record");
-}
-function createThresholdEcdsaBootstrapFailure(args) {
-	const message = String(args.message || args.code || "threshold-ecdsa bootstrap failed").trim();
-	const code = isStaleEcdsaIntegratedKeyBootstrapFailure(args) ? STALE_ECDSA_KEY_IDENTITY_ERROR_CODE : String(args.code || "threshold_ecdsa_bootstrap_failed").trim() || "threshold_ecdsa_bootstrap_failed";
-	const error = new Error(message || "threshold-ecdsa bootstrap failed");
-	error.code = code;
-	return error;
-}
-function createStaleEcdsaKeyIdentityError(message) {
-	const error = new Error(message);
-	error.code = STALE_ECDSA_KEY_IDENTITY_ERROR_CODE;
-	return error;
-}
-function inferThresholdEcdsaBootstrapAuthMethod(args) {
-	switch (args.authKind) {
-		case "email_otp": return "email_otp";
-		case "passkey": return "passkey";
-	}
-	return "unknown";
-}
-function roleLocalAuthMethodForActivation(args) {
-	switch (args.bootstrap.secretSourceKind) {
-		case "persisted_role_local":
-			if (args.request.authKind === "email_otp") return buildEcdsaRoleLocalEmailOtpAuthMethod({ authSubjectId: args.request.emailOtpWorkerSessionHandle.authSubjectId });
-			return buildEcdsaRoleLocalPasskeyAuthMethod({
-				credentialIdB64u: args.request.passkeyCredentialIdB64u,
-				rpId: args.bootstrap.rpId
-			});
-	}
-}
-function normalizeExactActivationOwnerAddress(value, field) {
-	const normalized = String(value || "").trim().toLowerCase();
-	if (!/^0x[0-9a-f]{40}$/.test(normalized)) throw new Error(`threshold-ecdsa exact activation returned invalid ${field}`);
-	return normalized;
-}
-function resolveExactActivationOwnerAddress(args) {
-	const trustedOwnerAddress = normalizeExactActivationOwnerAddress(args.bootstrapOwnerAddress, "server owner address");
-	if (trustedOwnerAddress !== normalizeExactActivationOwnerAddress(args.key.thresholdOwnerAddress, "key owner address")) throw createStaleEcdsaKeyIdentityError("threshold-ecdsa exact activation owner address mismatches server bootstrap result");
-	return trustedOwnerAddress;
-}
-async function activateEcdsaSessionByPurpose(deps, args) {
-	const walletId = toWalletId(String(args.key.walletId));
-	const chainTarget = args.lanePolicy.chainTarget;
-	const requestedSessionId = String(args.lanePolicy.thresholdSessionId).trim();
-	if (deps.routerAbNormalSigning.mode !== "enabled") throw new Error("Router A/B ECDSA derivation normal signing must be enabled for activation");
-	const bootstrapRequestSummary = {
-		walletId,
-		chainTarget,
-		targetKey: thresholdEcdsaChainTargetKey(chainTarget),
-		operationId: requestedSessionId || null,
-		authMethod: inferThresholdEcdsaBootstrapAuthMethod(args),
-		evmFamilyKeyFingerprint: deriveEvmFamilyKeyFingerprint(args.key),
-		keyHandle: args.keyHandle,
-		chainTargetKey: thresholdEcdsaChainTargetKey(chainTarget),
-		ecdsaThresholdKeyId: String(args.key.ecdsaThresholdKeyId),
-		thresholdSessionId: requestedSessionId || null,
-		freshAuthRetrySideEffectState: "not_applicable",
-		hasRequestedEcdsaThresholdKeyId: true,
-		requestedSessionId: requestedSessionId || null,
-		authKind: args.walletSessionRouteAuth?.kind || "none",
-		passkeyCredentialBound: args.authKind === "passkey"
-	};
-	let bootstrap;
-	try {
-		bootstrap = await bootstrapEcdsaSession({
-			touchIdPrompt: deps.touchIdPrompt,
-			relayerUrl: args.relayerUrl,
-			requestId: args.requestId,
-			workerCtx: deps.workerCtx,
-			..."preauthorizedSessionActivation" in args && args.preauthorizedSessionActivation ? { sessionActivation: args.preauthorizedSessionActivation } : { bootstrapAuth: requireStrictEcdsaRouteAuth(args.walletSessionRouteAuth) },
-			keyHandle: args.keyHandle,
-			key: args.key,
-			lanePolicy: args.lanePolicy,
-			publicCapability: args.publicCapability,
-			existingRoleLocalMaterial: args.existingRoleLocalMaterial
-		});
-	} catch (error) {
-		try {
-			console.warn("[threshold-ecdsa][bootstrap][exception]", {
-				...bootstrapRequestSummary,
-				message: error instanceof Error ? error.message : String(error)
-			});
-		} catch {}
-		throw error;
-	}
-	if (!bootstrap.ok) {
-		try {
-			console.warn("[threshold-ecdsa][bootstrap][failure]", {
-				...bootstrapRequestSummary,
-				code: bootstrap.code || "",
-				message: bootstrap.message || ""
-			});
-		} catch {}
-		throw createThresholdEcdsaBootstrapFailure({
-			code: bootstrap.code,
-			message: bootstrap.message
-		});
-	}
-	const ecdsaThresholdKeyIdRaw = String(args.key.ecdsaThresholdKeyId).trim();
-	if (!ecdsaThresholdKeyIdRaw) throw new Error("threshold-ecdsa bootstrap returned empty ecdsaThresholdKeyId");
-	const ecdsaThresholdKeyId = parseEcdsaThresholdKeyId(ecdsaThresholdKeyIdRaw);
-	const keyHandle = parseEcdsaKeyHandle(String(bootstrap.keyHandle || "").trim());
-	const relayerKeyIdRaw = String(bootstrap.relayerKeyId || "").trim();
-	if (!relayerKeyIdRaw) throw new Error("threshold-ecdsa bootstrap returned empty relayerKeyId");
-	const relayerKeyId = parseEcdsaRelayerKeyId(relayerKeyIdRaw);
-	const clientVerifyingShareB64uRaw = String(bootstrap.clientVerifyingShareB64u || "").trim();
-	if (!clientVerifyingShareB64uRaw) throw new Error("threshold-ecdsa bootstrap returned empty clientVerifyingShareB64u");
-	const clientVerifyingShareB64u = parseEcdsaClientVerifyingShareB64u(clientVerifyingShareB64uRaw);
-	const thresholdSessionId = String(bootstrap.thresholdSessionId || "").trim();
-	if (!thresholdSessionId) throw new Error("threshold-ecdsa bootstrap returned empty thresholdSessionId");
-	const expiresAtMs = Number(bootstrap.expiresAtMs);
-	if (!Number.isFinite(expiresAtMs)) throw new Error("threshold-ecdsa bootstrap returned invalid expiresAtMs");
-	const remainingUses = Number(bootstrap.remainingUses);
-	if (!Number.isFinite(remainingUses)) throw new Error("threshold-ecdsa bootstrap returned invalid remainingUses");
-	const participantIds = args.key.participantIds.map((participantId) => Number(participantId));
-	if (!participantIds) throw new Error("threshold-ecdsa bootstrap returned empty participantIds");
-	const thresholdOwnerAddress = resolveExactActivationOwnerAddress({
-		key: args.key,
-		bootstrapOwnerAddress: bootstrap.ethereumAddress
-	});
-	const roleLocalPublicFacts = buildEcdsaRoleLocalPublicFacts({
-		walletId,
-		chainTarget,
-		keyHandle,
-		ecdsaThresholdKeyId,
-		signingRootId: bootstrap.signingRootId,
-		signingRootVersion: bootstrap.signingRootVersion,
-		applicationBindingDigestB64u: bootstrap.roleLocalActivation.publicCapability.context.application_binding_digest_b64u,
-		clientParticipantId: 1,
-		relayerParticipantId: 2,
-		participantIds,
-		contextBinding32B64u: bootstrap.roleLocalActivation.publicFacts.contextBinding32B64u,
-		derivationClientSharePublicKey33B64u: bootstrap.roleLocalActivation.publicFacts.derivationClientSharePublicKey33B64u,
-		relayerPublicKey33B64u: bootstrap.roleLocalActivation.publicFacts.relayerPublicKey33B64u,
-		groupPublicKey33B64u: bootstrap.roleLocalActivation.publicFacts.groupPublicKey33B64u,
-		ethereumAddress: bootstrap.roleLocalActivation.publicFacts.ethereumAddress,
-		publicCapability: bootstrap.roleLocalActivation.publicCapability
-	});
-	const routerAbEcdsaDerivationNormalSigning = bootstrap.routerAbEcdsaDerivationNormalSigning;
-	const roleLocalMaterialHandle = bootstrap.roleLocalActivation.roleLocalMaterial;
-	const roleLocalAuthMethod = roleLocalAuthMethodForActivation({
-		request: args,
-		bootstrap
-	});
-	const session = {
-		ok: true,
-		thresholdSessionId,
-		authorizationSessionId: bootstrap.authorizationSessionId,
-		authorizationId: bootstrap.authorizationId,
-		walletSessionId: bootstrap.walletSessionId,
-		quotaId: bootstrap.quotaId,
-		expiresAtMs,
-		remainingUses,
-		runtimePolicyScope: bootstrap.runtimePolicyScope,
-		walletSession: bootstrap.walletSession,
-		operationCredential: bootstrap.operationCredential,
-		clientVerifyingShareB64u
-	};
-	return {
-		thresholdEcdsaKeyRef: {
-			type: "threshold-ecdsa-secp256k1",
-			userId: walletId,
-			chainTarget,
-			relayerUrl: args.relayerUrl,
-			keyHandle,
-			ecdsaThresholdKeyId,
-			backendBinding: {
-				materialKind: "role_local_worker_handle",
-				relayerKeyId,
-				clientVerifyingShareB64u,
-				roleLocalMaterialHandle,
-				roleLocalMaterialRef: bootstrap.roleLocalActivation.roleLocalMaterialRef,
-				publicFacts: roleLocalPublicFacts,
-				authMethod: roleLocalAuthMethod
-			},
-			participantIds,
-			thresholdEcdsaPublicKeyB64u: bootstrap.thresholdEcdsaPublicKeyB64u,
-			ethereumAddress: thresholdOwnerAddress,
-			relayerVerifyingShareB64u: bootstrap.relayerVerifyingShareB64u,
-			routerAbEcdsaDerivationNormalSigning
-		},
-		session
-	};
-}
-async function activateEcdsaSession(deps, args) {
-	return await activateEcdsaSessionByPurpose(deps, args);
-}
-function normalizeEcdsaExplicitExportAuthorization(authorization) {
-	let evidenceSetDigest;
-	try {
-		evidenceSetDigest = parseDigestB64u(authorization.evidenceSetDigest);
-	} catch (error) {
-		throw new Error(error instanceof Error ? error.message : "ECDSA explicit export evidence digest is invalid");
-	}
-	const expiresAtMs = Math.floor(Number(authorization.expiresAtMs));
-	const operation = parseRouterAbEcdsaOperationStepUpPreparationV1(authorization.operation);
-	if (operation.operation_kind !== "evm.export_key") throw new Error("ECDSA explicit export operation kind is invalid");
-	if (!Number.isSafeInteger(expiresAtMs) || expiresAtMs <= Date.now()) throw new Error("ECDSA explicit export operation authorization expiry is invalid");
-	const unseal = normalizeEcdsaExplicitExportUnseal(authorization.unseal);
-	return {
-		kind: "verified_step_up",
-		evidenceSetDigest,
-		operation,
-		expiresAtMs,
-		quotaUse: "none",
-		unseal
-	};
-}
-function normalizeEcdsaExplicitExportUnseal(unseal) {
-	switch (unseal.kind) {
-		case "not_requested": return { kind: "not_requested" };
-		case "email_otp_grant": {
-			const grant = String(unseal.grant || "").trim();
-			const challengeId = String(unseal.challenge_id || "").trim();
-			if (!grant || !challengeId) throw new Error("ECDSA explicit export Email OTP unseal grant is invalid");
-			return {
-				kind: "email_otp_grant",
-				grant,
-				challenge_id: challengeId
-			};
-		}
-		default: {
-			const exhaustive = unseal;
-			throw new Error(`Unsupported ECDSA explicit export unseal state: ${String(exhaustive)}`);
-		}
-	}
-}
-async function activateExplicitKeyExportEcdsaSession(args) {
-	const relayerUrl = String(args.relayerUrl || "").trim();
-	if (!relayerUrl) throw new Error("ECDSA explicit export relayer URL is required");
-	return {
-		kind: "explicit_key_export_ecdsa_activation_result",
-		purpose: "explicit_key_export",
-		material: {
-			kind: "auth_neutral_ecdsa_export_material_v1",
-			relayerUrl,
-			persistedMaterial: args.existingRoleLocalMaterial
-		},
-		authorization: normalizeEcdsaExplicitExportAuthorization(args.authorization)
-	};
-}
-//#endregion
-export { activateEcdsaSession, activateExplicitKeyExportEcdsaSession };
-
-//# sourceMappingURL=activation.js.map

package/dist/esm/react/core/signingEngine/threshold/ecdsa/bootstrapSession.js

@@ -1,119 +0,0 @@
-import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import { secureRandomId } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { normalizeThresholdRuntimePolicyScope } from "../sessionPolicy.js";
-import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { computeEcdsaDerivationRoleLocalRelayerKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { bytesToHex } from "../../chains/evm/bytes.js";
-import { activateStrictEcdsaPostRegistrationSession, adoptStrictEcdsaCredentialFreePostRegistrationSession, adoptStrictEcdsaPostRegistrationSession, isEcdsaCredentialFreeSessionActivationAuthorization } from "./postRegistrationSessionActivation.js";
-//#region src/core/signingEngine/threshold/ecdsa/bootstrapSession.ts
-async function bootstrapStrictExistingEcdsaSession(args, rpId) {
-	const runtimePolicyScope = normalizeThresholdRuntimePolicyScope(args.lanePolicy.runtimePolicyScope);
-	if (!runtimePolicyScope) throw new Error("Strict ECDSA session activation requires runtimePolicyScope");
-	const strictInput = {
-		workerCtx: args.workerCtx,
-		publicCapability: args.publicCapability,
-		persistedRoleLocalMaterial: args.existingRoleLocalMaterial,
-		walletId: String(args.key.walletId),
-		thresholdSessionId: args.lanePolicy.thresholdSessionId,
-		ttlMs: args.lanePolicy.ttlMs,
-		remainingUses: args.lanePolicy.remainingUses,
-		runtimePolicyScope
-	};
-	const strict = args.sessionActivation ? isEcdsaCredentialFreeSessionActivationAuthorization(args.sessionActivation) ? await adoptStrictEcdsaCredentialFreePostRegistrationSession({
-		...strictInput,
-		sessionActivation: args.sessionActivation
-	}) : await adoptStrictEcdsaPostRegistrationSession({
-		...strictInput,
-		sessionActivation: args.sessionActivation
-	}) : await activateStrictEcdsaPostRegistrationSession({
-		...strictInput,
-		walletSessionMintId: requireFreshWalletSessionMintId(),
-		relayerUrl: args.relayerUrl,
-		routeAuth: args.bootstrapAuth
-	});
-	const publicIdentity = strict.sessionActivation.public_capability.public_identity;
-	const session = "authorization" in strict ? {
-		thresholdSessionId: strict.sessionActivation.session.threshold_session_id,
-		authorizationSessionId: strict.sessionActivation.session.authorization_session_id,
-		authorizationId: strict.sessionActivation.session.authorization_id,
-		walletSessionId: strict.sessionActivation.session.wallet_session_id,
-		quotaId: strict.sessionActivation.session.quota_id,
-		expiresAtMs: strict.sessionActivation.session.expires_at_ms,
-		remainingUses: strict.sessionActivation.session.remaining_uses,
-		walletSession: strict.authorization.record,
-		operationCredential: strict.authorization.operationCredential
-	} : {
-		thresholdSessionId: strict.sessionActivation.session.threshold_session_id,
-		authorizationSessionId: strict.sessionActivation.session.authorization_session_id,
-		authorizationId: strict.sessionActivation.session.authorization_id,
-		walletSessionId: strict.sessionActivation.session.wallet_session_id,
-		quotaId: strict.sessionActivation.session.quota_id,
-		expiresAtMs: strict.sessionActivation.session.expires_at_ms,
-		remainingUses: strict.sessionActivation.session.remaining_uses,
-		walletSession: strict.sessionActivation.session.wallet_session,
-		operationCredential: strict.sessionActivation.session.operation_credential
-	};
-	const relayerKeyId = await computeEcdsaDerivationRoleLocalRelayerKeyId({
-		walletId: String(args.key.walletId),
-		signingRootId: args.key.signingRootId,
-		signingRootVersion: args.key.signingRootVersion
-	});
-	return {
-		ok: true,
-		bootstrapKind: "strict_post_registration",
-		keygenSessionId: String(args.requestId || "").trim() || secureRandomId("tecdsa-keygen", 32, "threshold ECDSA session IDs"),
-		rpId,
-		keyHandle: String(args.keyHandle),
-		ecdsaThresholdKeyId: String(args.key.ecdsaThresholdKeyId),
-		clientVerifyingShareB64u: publicIdentity.derivation_client_share_public_key33_b64u,
-		thresholdEcdsaPublicKeyB64u: publicIdentity.threshold_public_key33_b64u,
-		ethereumAddress: bytesToHex(base64UrlDecode(publicIdentity.ethereum_address20_b64u)),
-		relayerKeyId,
-		relayerVerifyingShareB64u: publicIdentity.server_public_key33_b64u,
-		clientShareRetryCounter: publicIdentity.client_share_retry_counter,
-		relayerShareRetryCounter: publicIdentity.server_share_retry_counter,
-		participantIds: args.key.participantIds.map(Number),
-		chainId: args.lanePolicy.chainTarget.chainId,
-		thresholdSessionId: session.thresholdSessionId,
-		authorizationSessionId: session.authorizationSessionId,
-		authorizationId: session.authorizationId,
-		walletSessionId: session.walletSessionId,
-		quotaId: session.quotaId,
-		expiresAtMs: session.expiresAtMs,
-		remainingUses: session.remainingUses,
-		runtimePolicyScope,
-		signingRootId: String(args.key.signingRootId),
-		signingRootVersion: String(args.key.signingRootVersion),
-		walletSession: session.walletSession,
-		operationCredential: session.operationCredential,
-		roleLocalActivation: strict.roleLocalActivation,
-		routerAbEcdsaDerivationNormalSigning: strict.sessionActivation.normal_signing,
-		secretSourceKind: "persisted_role_local"
-	};
-}
-function requireFreshWalletSessionMintId() {
-	const parsed = parseWalletSessionMintId(secureRandomId("wallet-session-mint", 32, "Wallet Session mint IDs"));
-	if (!parsed.ok) throw new Error("Failed to create Wallet Session mint identity");
-	return parsed.value;
-}
-async function bootstrapEcdsaSession(args) {
-	const rpId = args.touchIdPrompt.getRpId();
-	if (!rpId) return {
-		ok: false,
-		code: "invalid_args",
-		message: "Missing rpId for WebAuthn"
-	};
-	try {
-		return await bootstrapStrictExistingEcdsaSession(args, rpId);
-	} catch (error) {
-		return {
-			ok: false,
-			code: "strict_post_registration_failed",
-			message: error instanceof Error ? error.message : String(error)
-		};
-	}
-}
-//#endregion
-export { bootstrapEcdsaSession };
-
-//# sourceMappingURL=bootstrapSession.js.map

package/dist/esm/react/core/signingEngine/threshold/ecdsa/operationStepUp.js

@@ -1,110 +0,0 @@
-import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
-import { walletSessionFailureErrorFromPayload } from "../../session/lifecycle/walletSessionFailure.js";
-//#region src/core/signingEngine/threshold/ecdsa/operationStepUp.ts
-function requireResponseRecord(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("ECDSA operation step-up response must be an object");
-	return value;
-}
-function parseEcdsaOperationStepUpAuthorizationResponse(value) {
-	try {
-		return parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1(value);
-	} catch (error) {
-		throw new Error(error instanceof Error ? error.message : "ECDSA operation step-up response is invalid");
-	}
-}
-function operationStepUpEndpoint(relayerUrl) {
-	const baseUrl = String(relayerUrl || "").trim().replace(/\/+$/g, "");
-	if (!baseUrl) throw new Error("ECDSA operation step-up relayerUrl is required");
-	return `${baseUrl}${ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH}`;
-}
-function buildEcdsaOperationStepUpPreparation(args) {
-	const walletId = String(args.walletId || "").trim();
-	const operationId = String(args.operationId || "").trim();
-	const expiresAtMs = Math.floor(Number(args.expiresAtMs));
-	if (!walletId || !operationId) throw new Error("ECDSA operation step-up identity is required");
-	if (!Number.isSafeInteger(expiresAtMs) || expiresAtMs <= Date.now()) throw new Error("ECDSA operation step-up expiry is invalid");
-	const materialActivation = routerAbMpcMaterialActivationRefToWire(args.materialActivation);
-	const normalSigningScope = parseRouterAbEcdsaDerivationNormalSigningScopeV1(args.normalSigningScope);
-	const keyHandle = String(args.keyHandle || "").trim();
-	const relayerKeyId = String(args.relayerKeyId || "").trim();
-	const participantIds = args.participantIds;
-	if (normalSigningScope.wallet_id !== walletId || normalSigningScope.signing_worker.server_id !== materialActivation.signing_worker || !keyHandle || !relayerKeyId || participantIds.length !== 2 || participantIds.some((participantId) => !Number.isSafeInteger(participantId) || participantId <= 0)) throw new Error("ECDSA operation step-up signing identity is inconsistent");
-	return {
-		wallet_id: walletId,
-		operation_kind: args.operationKind,
-		operation_id: operationId,
-		operation_digests: {
-			lane_digest_b64u: args.operationDigests.laneDigest,
-			intent_digest_b64u: args.operationDigests.intentDigest,
-			display_digest_b64u: args.operationDigests.displayDigest
-		},
-		material_activation: materialActivation,
-		normal_signing_scope: normalSigningScope,
-		signing_worker_id: materialActivation.signing_worker,
-		key_handle: keyHandle,
-		relayer_key_id: relayerKeyId,
-		participant_ids: [participantIds[0], participantIds[1]],
-		expires_at_ms: expiresAtMs
-	};
-}
-async function prepareEcdsaOperationStepUp(args) {
-	const operation = buildEcdsaOperationStepUpPreparation(args);
-	return {
-		operation,
-		challengeB64u: await computeRouterAbEcdsaOperationStepUpChallengeB64u(operation)
-	};
-}
-/**
-* User-facing copy for a step-up that failed because the wallet session is no
-* longer usable. These are the states signing in again resolves, so the message
-* says that rather than restating the transport failure. Anything else keeps the
-* server's own wording, which is aimed at the developer.
-*/
-function ecdsaOperationStepUpSessionMessage(code, serverMessage) {
-	switch (code) {
-		case WALLET_SESSION_FAILURE_CODES.expired:
-		case WALLET_SESSION_FAILURE_CODES.missing: return "Signing session expired. Sign in again to continue.";
-		case WALLET_SESSION_FAILURE_CODES.budgetExhausted: return "Signing session budget is used up. Sign in again to continue.";
-		default: return `ECDSA operation step-up failed: ${serverMessage}`;
-	}
-}
-async function issueEcdsaOperationStepUpAuthorization(args) {
-	const request = parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1(args.request);
-	const fetchImpl = args.fetchImpl ?? globalThis.fetch;
-	if (typeof fetchImpl !== "function") throw new Error("fetch is unavailable for ECDSA operation step-up");
-	if (args.transport?.kind === "wallet_session_bearer" && args.transport.token.trim().length === 0) throw new Error("Wallet Session operation credential is required for ECDSA operation step-up");
-	const response = await (args.transport?.kind === "wallet_session_bearer" ? fetchWithWalletSessionBearer(fetchImpl, args.transport.token) : fetchImpl)(operationStepUpEndpoint(args.relayerUrl), {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		credentials: "omit",
-		body: JSON.stringify(request)
-	});
-	const body = await response.json().catch(() => null);
-	if (!response.ok) {
-		const error = requireResponseRecord(body);
-		const message = String(error.message || `HTTP ${response.status}`);
-		const walletSessionError = walletSessionFailureErrorFromPayload({
-			code: error.code,
-			message: ecdsaOperationStepUpSessionMessage(error.code, message)
-		});
-		if (walletSessionError) throw walletSessionError;
-		throw new Error(`ECDSA operation step-up failed: ${message}`);
-	}
-	return parseEcdsaOperationStepUpAuthorizationResponse(body);
-}
-function fetchWithWalletSessionBearer(fetchImpl, token) {
-	return async (input, init) => {
-		const headers = new Headers(init?.headers);
-		headers.set("Authorization", `Bearer ${token}`);
-		return await fetchImpl(input, {
-			...init,
-			headers
-		});
-	};
-}
-//#endregion
-export { issueEcdsaOperationStepUpAuthorization, prepareEcdsaOperationStepUp };
-
-//# sourceMappingURL=operationStepUp.js.map

package/dist/esm/react/core/signingEngine/threshold/ecdsa/postRegistrationSessionActivation.js

@@ -1,132 +0,0 @@
-import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { routerAbEcdsaDerivationPublicCapabilitiesEqual } from "../../session/material/ecdsaCapabilityManifest.js";
-import { activateRouterAbEcdsaPostRegistrationSession } from "../../../rpcClients/relayer/thresholdEcdsa.js";
-import { bytesToHex } from "../../chains/evm/bytes.js";
-import { ecdsaRoleLocalPersistedMaterialSource, resolveEcdsaRoleLocalMaterial } from "../../session/material/ecdsaRoleLocalMaterialResolver.js";
-//#region src/core/signingEngine/threshold/ecdsa/postRegistrationSessionActivation.ts
-function isEcdsaCredentialFreeSessionActivationAuthorization(value) {
-	return value.kind === "credential_free_ecdsa_session_activation_authorization_v1";
-}
-function routeFailureMessage(result, fallback) {
-	return result.error || result.message || result.code || fallback;
-}
-function buildStrictEcdsaPostRegistrationSessionActivationRequest(input) {
-	return parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1({
-		kind: "router_ab_ecdsa_post_registration_session_activation_v1",
-		public_capability: input.publicCapability,
-		session_policy: {
-			threshold_session_id: input.thresholdSessionId,
-			wallet_session_mint_id: input.walletSessionMintId,
-			ttl_ms: input.ttlMs,
-			remaining_uses: input.remainingUses,
-			runtime_policy_scope: input.runtimePolicyScope
-		}
-	});
-}
-function roleLocalPublicFactsMatchCapability(publicFacts, capability) {
-	const identity = capability.public_identity;
-	return publicFacts.applicationBindingDigestB64u === capability.context.application_binding_digest_b64u && publicFacts.contextBinding32B64u === identity.context_binding_b64u && publicFacts.derivationClientSharePublicKey33B64u === identity.derivation_client_share_public_key33_b64u && publicFacts.relayerPublicKey33B64u === identity.server_public_key33_b64u && publicFacts.groupPublicKey33B64u === identity.threshold_public_key33_b64u && publicFacts.ethereumAddress.toLowerCase() === bytesToHex(base64UrlDecode(identity.ethereum_address20_b64u)) && routerAbEcdsaDerivationPublicCapabilitiesEqual(publicFacts.publicCapability, capability);
-}
-function normalSigningMatchesRoleLocalFacts(activation, publicFacts) {
-	const scope = activation.normal_signing.scope;
-	return scope.wallet_id === String(publicFacts.walletId) && scope.ecdsa_threshold_key_id === String(publicFacts.ecdsaThresholdKeyId) && scope.signing_root_id === String(publicFacts.signingRootId) && scope.signing_root_version === String(publicFacts.signingRootVersion);
-}
-function validateStrictSessionActivationIdentity(input) {
-	const roleLocalPublicFacts = input.persistedRoleLocalMaterial.publicFacts;
-	if (!routerAbEcdsaDerivationPublicCapabilitiesEqual(input.sessionActivation.public_capability, input.publicCapability) || input.sessionActivation.session.threshold_session_id !== input.thresholdSessionId || !normalSigningMatchesRoleLocalFacts(input.sessionActivation, roleLocalPublicFacts)) throw new Error("Strict ECDSA session activation returned a different registered key identity");
-}
-function validateCredentialFreeSessionAuthorization(input) {
-	const activation = input.sessionActivation.activation;
-	const authorization = input.sessionActivation.authorization;
-	const record = authorization.record;
-	const materialActivation = routerAbMpcMaterialActivationRefFromWire(activation.public_capability.material_activation);
-	let matchingEcdsaSubjectCount = 0;
-	for (const subject of record.capabilitySubjects) if (subject.kind === "sign" && subject.keyFamily === "ecdsa_secp256k1" && mpcMaterialActivationRefsEqual(subject.materialActivation, materialActivation)) matchingEcdsaSubjectCount += 1;
-	validateStrictSessionActivationIdentity({
-		publicCapability: input.publicCapability,
-		persistedRoleLocalMaterial: input.persistedRoleLocalMaterial,
-		thresholdSessionId: input.thresholdSessionId,
-		sessionActivation: activation
-	});
-	if (String(record.walletId) !== input.walletId || String(record.walletId) !== String(activation.public_capability.client_id) || record.authMethodId !== input.persistedRoleLocalMaterial.authority.walletAuthMethodId || record.authorizationId !== activation.session.authorization_id || record.quotaId !== activation.session.quota_id || record.expiresAtMs !== activation.session.expires_at_ms || activation.session.remaining_uses !== input.remainingUses || authorization.operationCredential.walletSessionId !== activation.session.wallet_session_id || !mpcMaterialActivationRefsEqual(materialActivation, input.persistedRoleLocalMaterial.materialActivation) || matchingEcdsaSubjectCount !== 1) throw new Error("Strict ECDSA credential-free activation authority does not match its session");
-}
-function validateStrictSessionInput(input) {
-	const publicFacts = input.persistedRoleLocalMaterial.publicFacts;
-	if (!input.walletId || !input.thresholdSessionId) throw new Error("Strict ECDSA session activation requires exact wallet and session identity");
-	if (!Number.isSafeInteger(input.ttlMs) || input.ttlMs < 1) throw new Error("Strict ECDSA session activation requires a positive ttlMs");
-	if (!Number.isSafeInteger(input.remainingUses) || input.remainingUses < 1) throw new Error("Strict ECDSA session activation requires positive remainingUses");
-	if (String(publicFacts.walletId) !== input.walletId || !roleLocalPublicFactsMatchCapability(publicFacts, input.publicCapability)) throw new Error("Strict ECDSA session activation requires exact registered role-local material");
-}
-function requireResolvedRegistrationMaterial(resolution) {
-	switch (resolution.kind) {
-		case "rehydrated": return resolution;
-		case "device_link_required": throw new Error("device_link_required: registered ECDSA role-local material is unavailable on this device");
-		case "corrupt": throw new Error(`Registered ECDSA role-local material is corrupt (${resolution.reason}): ${resolution.message}`);
-		default: {
-			const exhaustive = resolution;
-			throw new Error(`Unsupported ECDSA role-local material resolution: ${String(exhaustive)}`);
-		}
-	}
-}
-async function activateExistingEcdsaRoleLocalMaterial(input) {
-	const resolvedRoleLocalMaterial = requireResolvedRegistrationMaterial(await resolveEcdsaRoleLocalMaterial({
-		purpose: "registration_activation",
-		source: ecdsaRoleLocalPersistedMaterialSource(input.persistedRoleLocalMaterial),
-		workerCtx: input.workerCtx
-	}));
-	return {
-		kind: "existing_ecdsa_role_local_material_activated_v1",
-		roleLocalMaterial: resolvedRoleLocalMaterial.liveHandle,
-		roleLocalMaterialRef: resolvedRoleLocalMaterial.materialRef,
-		publicFacts: input.persistedRoleLocalMaterial.publicFacts,
-		publicCapability: input.publicCapability
-	};
-}
-async function activateStrictEcdsaPostRegistrationSession(input) {
-	validateStrictSessionInput(input);
-	const activated = await activateRouterAbEcdsaPostRegistrationSession(input.relayerUrl, {
-		auth: input.routeAuth,
-		request: buildStrictEcdsaPostRegistrationSessionActivationRequest(input)
-	});
-	if (!activated.ok) throw new Error(routeFailureMessage(activated, "Strict ECDSA session activation failed"));
-	return await adoptStrictEcdsaPostRegistrationSession({
-		workerCtx: input.workerCtx,
-		publicCapability: input.publicCapability,
-		persistedRoleLocalMaterial: input.persistedRoleLocalMaterial,
-		walletId: input.walletId,
-		thresholdSessionId: input.thresholdSessionId,
-		ttlMs: input.ttlMs,
-		remainingUses: input.remainingUses,
-		runtimePolicyScope: input.runtimePolicyScope,
-		sessionActivation: activated.value
-	});
-}
-async function adoptStrictEcdsaPostRegistrationSession(input) {
-	validateStrictSessionInput(input);
-	validateStrictSessionActivationIdentity({
-		publicCapability: input.publicCapability,
-		persistedRoleLocalMaterial: input.persistedRoleLocalMaterial,
-		thresholdSessionId: input.thresholdSessionId,
-		sessionActivation: input.sessionActivation
-	});
-	return {
-		sessionActivation: input.sessionActivation,
-		roleLocalActivation: await activateExistingEcdsaRoleLocalMaterial(input)
-	};
-}
-async function adoptStrictEcdsaCredentialFreePostRegistrationSession(input) {
-	validateStrictSessionInput(input);
-	validateCredentialFreeSessionAuthorization(input);
-	return {
-		sessionActivation: input.sessionActivation.activation,
-		authorization: input.sessionActivation.authorization,
-		roleLocalActivation: await activateExistingEcdsaRoleLocalMaterial(input)
-	};
-}
-//#endregion
-export { activateStrictEcdsaPostRegistrationSession, adoptStrictEcdsaCredentialFreePostRegistrationSession, adoptStrictEcdsaPostRegistrationSession, buildStrictEcdsaPostRegistrationSessionActivationRequest, isEcdsaCredentialFreeSessionActivationAuthorization };
-
-//# sourceMappingURL=postRegistrationSessionActivation.js.map