@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/react/core/signingEngine/flows/signEvmFamily/ecdsaLanes.js

@@ -1,102 +0,0 @@
-import { signingLaneAuthMethod } from "../../session/identity/signingLaneAuthBinding.js";
-import { requireEvmFamilyEcdsaSigner } from "../../session/identity/exactSigningLaneIdentity.js";
-import { selectedEcdsaLane } from "../../session/identity/laneIdentity.js";
-//#region src/core/signingEngine/flows/signEvmFamily/ecdsaLanes.ts
-function summarizeEvmFamilyEcdsaLane(lane) {
-	if (!lane) return { present: false };
-	const signer = requireEvmFamilyEcdsaSigner(lane.identity, "ECDSA lane summary");
-	return {
-		present: true,
-		walletId: signer.walletId,
-		authMethod: signingLaneAuthMethod(lane.auth),
-		curve: lane.curve,
-		chain: lane.chain,
-		chainFamily: "chainFamily" in lane ? lane.chainFamily : lane.chain,
-		keyKind: "keyKind" in lane ? lane.keyKind : "threshold_ecdsa_secp256k1",
-		sessionOrigin: "sessionOrigin" in lane ? lane.sessionOrigin : void 0,
-		storageSource: "storageSource" in lane ? lane.storageSource : void 0,
-		retention: "retention" in lane ? lane.retention : void 0,
-		walletSessionId: lane.authorization.operationCredential.walletSessionId,
-		materialActivationId: lane.materialActivation.activationId,
-		chainTarget: signer.chainTarget,
-		evmFamilyKeyPresent: Boolean(signer.key)
-	};
-}
-function logEvmFamilyEcdsaLaneDiagnostic(message, details) {
-	try {
-		console.warn(`[SigningEngine][ecdsa] ${message}`, JSON.stringify(details, null, 2));
-	} catch {}
-}
-function requireResolvedEvmFamilyEcdsaSigningLane(args) {
-	const lane = args.lane;
-	if (!lane) {
-		logEvmFamilyEcdsaLaneDiagnostic("missing selected signing lane", {
-			context: args.context,
-			chain: args.chain,
-			...args.diagnostics
-		});
-		throw new Error(`[SigningEngine][ecdsa] missing selected signing lane for ${args.context}`);
-	}
-	if (lane.curve !== "ecdsa" || lane.keyKind !== "threshold_ecdsa_secp256k1") {
-		logEvmFamilyEcdsaLaneDiagnostic("selected signing lane is not ECDSA", {
-			context: args.context,
-			expectedChain: args.chain,
-			lane: summarizeEvmFamilyEcdsaLane(lane),
-			...args.diagnostics
-		});
-		throw new Error(`[SigningEngine][ecdsa] ${args.context} requires an ECDSA signing lane`);
-	}
-	const identity = lane.identity;
-	const signer = requireEvmFamilyEcdsaSigner(identity, `${args.context} resolved ECDSA lane`);
-	const chainTarget = signer.chainTarget;
-	if (chainTarget.kind !== args.chain) {
-		logEvmFamilyEcdsaLaneDiagnostic("selected signing lane chain mismatch", {
-			context: args.context,
-			expectedChain: args.chain,
-			lane: summarizeEvmFamilyEcdsaLane(lane),
-			...args.diagnostics
-		});
-		throw new Error(`[SigningEngine][ecdsa] ${args.context} chain does not match selected lane`);
-	}
-	const key = signer.key;
-	if (!key?.ecdsaThresholdKeyId || !key.signingRootId || !key.signingRootVersion) {
-		logEvmFamilyEcdsaLaneDiagnostic("selected signing lane missing full ECDSA identity", {
-			context: args.context,
-			expectedChain: args.chain,
-			lane: summarizeEvmFamilyEcdsaLane(lane),
-			...args.diagnostics
-		});
-		throw new Error(`[SigningEngine][ecdsa] incomplete ECDSA lane identity for ${args.context}`);
-	}
-	if (!key || String(key.walletId) !== String(signer.walletId) || String(signer.keyHandle || "").trim() === "") {
-		logEvmFamilyEcdsaLaneDiagnostic("selected signing lane missing matching shared key identity", {
-			context: args.context,
-			expectedChain: args.chain,
-			lane: summarizeEvmFamilyEcdsaLane(lane),
-			...args.diagnostics
-		});
-		throw new Error(`[SigningEngine][ecdsa] missing shared key identity for ${args.context}`);
-	}
-	const selectedLane = selectedEcdsaLane({
-		key,
-		materialActivation: signer.materialActivation,
-		keyHandle: signer.keyHandle,
-		walletId: signer.walletId,
-		auth: identity.auth,
-		authorization: lane.authorization,
-		chainTarget
-	});
-	return {
-		...lane,
-		...selectedLane,
-		key,
-		keyHandle: signer.keyHandle,
-		chainTarget,
-		keyKind: "threshold_ecdsa_secp256k1",
-		chainFamily: signer.chainTarget.kind
-	};
-}
-//#endregion
-export { logEvmFamilyEcdsaLaneDiagnostic, requireResolvedEvmFamilyEcdsaSigningLane, summarizeEvmFamilyEcdsaLane };
-
-//# sourceMappingURL=ecdsaLanes.js.map

package/dist/esm/react/core/signingEngine/flows/signEvmFamily/ecdsaSelection.js

@@ -1,233 +0,0 @@
-import { isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
-import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
-import { exactEcdsaSigningLaneIdentityFromSelectedLane } from "../../session/identity/exactSigningLaneIdentity.js";
-import { laneCandidateAuthMethod } from "../../session/identity/laneIdentity.js";
-import { buildEvmTransactionSigningLane, buildTempoTransactionSigningLane } from "../../session/operationState/lanes.js";
-import { logEvmFamilyEcdsaLaneDiagnostic, requireResolvedEvmFamilyEcdsaSigningLane, summarizeEvmFamilyEcdsaLane } from "./ecdsaLanes.js";
-import { resolveEvmFamilyTransactionWalletAuth } from "./accountAuth.js";
-import { emailOtpEcdsaSigningSessionAuthLane } from "../../session/emailOtp/ecdsaSigningSessionAuthority.js";
-//#region src/core/signingEngine/flows/signEvmFamily/ecdsaSelection.ts
-function ecdsaLaneCandidateAuthMethod(candidate) {
-	switch (laneCandidateAuthMethod(candidate)) {
-		case SIGNER_AUTH_METHODS.emailOtp: return SIGNER_AUTH_METHODS.emailOtp;
-		case SIGNER_AUTH_METHODS.passkey: return SIGNER_AUTH_METHODS.passkey;
-	}
-	throw new Error("[SigningEngine][ecdsa] unsupported ECDSA lane auth method");
-}
-function walletAuthWithSelectedPrimary(accountAuth, authMethod) {
-	return {
-		...accountAuth,
-		primaryAuthMethod: authMethod,
-		linkedAuthMethods: Array.from(new Set([...accountAuth.linkedAuthMethods, authMethod]))
-	};
-}
-function resolvedEvmFamilyEcdsaSigningLaneFromCandidate(candidate) {
-	const buildLane = candidate.chainTarget.kind === "tempo" ? buildTempoTransactionSigningLane : buildEvmTransactionSigningLane;
-	const base = {
-		key: candidate.key,
-		materialActivation: candidate.materialActivation,
-		keyHandle: candidate.keyHandle,
-		walletId: candidate.walletId,
-		chainTarget: candidate.chainTarget,
-		authorization: candidate.authorization
-	};
-	return requireResolvedEvmFamilyEcdsaSigningLane({
-		lane: buildLane(candidate.auth.kind === "email_otp" ? {
-			...base,
-			auth: candidate.auth,
-			retention: "session",
-			sessionOrigin: "per_operation"
-		} : {
-			...base,
-			auth: candidate.auth,
-			storageSource: "manual-bootstrap"
-		}),
-		chain: candidate.chain,
-		context: "build exact ECDSA candidate signing lane"
-	});
-}
-function laneCandidateDiagnosticsBase(candidate) {
-	return {
-		authMethod: ecdsaLaneCandidateAuthMethod(candidate),
-		chain: candidate.chain,
-		chainTarget: candidate.chainTarget,
-		state: candidate.state,
-		walletSessionId: candidate.authorization.operationCredential.walletSessionId,
-		materialActivationId: candidate.materialActivation.activationId,
-		remainingUses: candidate.authorization.runtime.remainingUses,
-		expiresAtMs: candidate.authorization.runtime.expiresAtMs
-	};
-}
-function summarizeLaneCandidate(candidate) {
-	return {
-		...laneCandidateDiagnosticsBase(candidate),
-		source: "canonical_capability"
-	};
-}
-function isExactEmailOtpAuthorization(authorization) {
-	return authorization.selectedAuthMethod.kind === "email_otp" && authorization.runtime.authBinding.kind === "email_otp";
-}
-function isExactDirectEmailOtpAuthorization(authorization) {
-	return authorization.runtime.kind === "exact_ecdsa_direct_capability_runtime_v1";
-}
-function isExactSealedEmailOtpAuthorization(authorization) {
-	return authorization.runtime.kind === "exact_ecdsa_sealed_runtime_v1";
-}
-function requirePasskeyEcdsaLaneCandidate(candidate) {
-	if (candidate.auth.kind !== "passkey") throw new Error("[SigningEngine][ecdsa] passkey committed lane requires passkey candidate");
-	return {
-		...candidate,
-		auth: candidate.auth
-	};
-}
-function assertEcdsaCommittedLaneAuthorityMatchesWallet(args) {
-	const authorityWalletId = String(args.authority.walletId);
-	if (String(args.lane.key.walletId) === authorityWalletId && String(args.candidate.walletId) === authorityWalletId) return;
-	throw new Error(`[SigningEngine][ecdsa] ${args.context} committed lane authority wallet mismatch`);
-}
-function buildEcdsaSelectionDiagnostics(args) {
-	return { selectedLaneCandidate: summarizeLaneCandidate(args.candidate) };
-}
-async function commitPasskeyEcdsaLaneForSelection(args) {
-	const candidate = requirePasskeyEcdsaLaneCandidate(args.candidate);
-	const authority = (await args.deps.resolveCanonicalEcdsaSigningCapability({
-		walletId: candidate.walletId,
-		chainTarget: candidate.chainTarget,
-		materialActivation: candidate.materialActivation
-	})).authority;
-	if (!isPasskeyWalletAuthAuthority(authority) || String(authority.verifier.rpId) !== String(candidate.auth.rpId) || authority.factor.credentialIdB64u !== candidate.auth.credentialIdB64u) throw new Error("[SigningEngine][ecdsa] exact Passkey capability authority changed");
-	assertEcdsaCommittedLaneAuthorityMatchesWallet({
-		authority,
-		lane: args.lane,
-		candidate,
-		context: "Passkey"
-	});
-	return {
-		lane: args.lane,
-		authority,
-		authorization: args.lane.authorization
-	};
-}
-async function resolveEmailOtpAuthorityForSelection(args) {
-	const exactLane = exactEcdsaSigningLaneIdentityFromSelectedLane(args.lane);
-	const laneAuthority = await args.deps.resolveDurableEmailOtpEcdsaSigningSessionAuthority({
-		lane: exactLane,
-		chain: args.lane.chainTarget.kind
-	});
-	if (laneAuthority) {
-		if (!isExactEmailOtpAuthorization(laneAuthority)) return null;
-		return {
-			kind: "durable_authority_backed",
-			authorization: laneAuthority
-		};
-	}
-	logEvmFamilyEcdsaLaneDiagnostic("Email OTP exact ECDSA authority not found", {
-		lane: summarizeEvmFamilyEcdsaLane(args.lane),
-		candidate: summarizeLaneCandidate(args.candidate)
-	});
-	return null;
-}
-function requireEmailOtpSelectionAuthority(args) {
-	if (args.authority) return args.authority;
-	logEvmFamilyEcdsaLaneDiagnostic("Email OTP exact ECDSA signing-session authority missing", {
-		lane: summarizeEvmFamilyEcdsaLane(args.lane),
-		candidate: summarizeLaneCandidate(args.candidate)
-	});
-	throw new Error("Email OTP ECDSA committed lane is missing wallet-session authority; unlock wallet again");
-}
-function requireEmailOtpEcdsaSigningSessionAuthLane(args) {
-	const authLane = emailOtpEcdsaSigningSessionAuthLane(args.authority.authorization);
-	if (authLane.kind === "signing_session" && authLane.curve === "ecdsa" && thresholdEcdsaChainTargetsEqual(authLane.chainTarget, args.lane.chainTarget)) return authLane;
-	logEvmFamilyEcdsaLaneDiagnostic("Email OTP ECDSA committed lane rejected for authority shape", {
-		authorityKind: authLane.kind,
-		authorityCurve: authLane.kind === "signing_session" ? authLane.curve : null,
-		lane: summarizeEvmFamilyEcdsaLane(args.lane),
-		candidate: summarizeLaneCandidate(args.candidate)
-	});
-	throw new Error("Email OTP ECDSA committed lane authority is not an ECDSA signing session; unlock wallet again");
-}
-function requireCommittedLaneForReady(args) {
-	if (args.committedLane && args.committedLane.authority.factor.kind === args.expectedFactor) return args.committedLane;
-	logEvmFamilyEcdsaLaneDiagnostic("ECDSA committed lane missing for ready signing", {
-		expectedFactor: args.expectedFactor,
-		lane: summarizeEvmFamilyEcdsaLane(args.lane),
-		candidate: summarizeLaneCandidate(args.candidate)
-	});
-	throw new Error("[SigningEngine][ecdsa] committed lane is unavailable for ready signing");
-}
-function commitEmailOtpEcdsaLaneForSelection(args) {
-	const authorization = args.authority.authorization;
-	if (authorization.runtime.authBinding.kind !== "email_otp") throw new Error("[SigningEngine][ecdsa] Email OTP authority runtime binding is invalid");
-	const authority = authorization.runtime.authBinding.emailOtpAuthority;
-	assertEcdsaCommittedLaneAuthorityMatchesWallet({
-		authority,
-		lane: args.lane,
-		candidate: args.candidate,
-		context: "Email OTP"
-	});
-	if (isExactDirectEmailOtpAuthorization(authorization)) return {
-		lane: args.lane,
-		authority,
-		authorization
-	};
-	if (isExactSealedEmailOtpAuthorization(authorization)) return {
-		lane: args.lane,
-		authority,
-		authorization,
-		authLane: requireEmailOtpEcdsaSigningSessionAuthLane({
-			authority: args.authority,
-			lane: args.lane,
-			candidate: args.candidate
-		})
-	};
-	throw new Error("[SigningEngine][ecdsa] Email OTP authorization runtime is unsupported");
-}
-async function resolveEvmFamilyEcdsaSigningSelection(args) {
-	const lane = resolvedEvmFamilyEcdsaSigningLaneFromCandidate(args.laneCandidate);
-	const emailOtpAuthorityLane = lane;
-	const candidateAuthMethod = ecdsaLaneCandidateAuthMethod(args.laneCandidate);
-	const emailOtpAuthority = candidateAuthMethod === SIGNER_AUTH_METHODS.emailOtp ? await resolveEmailOtpAuthorityForSelection({
-		deps: args.deps,
-		lane: emailOtpAuthorityLane,
-		candidate: args.laneCandidate
-	}) : null;
-	const requiredEmailOtpAuthority = candidateAuthMethod === SIGNER_AUTH_METHODS.emailOtp ? requireEmailOtpSelectionAuthority({
-		authority: emailOtpAuthority,
-		lane: emailOtpAuthorityLane,
-		candidate: args.laneCandidate
-	}) : null;
-	const committedEmailOtpLane = candidateAuthMethod === SIGNER_AUTH_METHODS.emailOtp && requiredEmailOtpAuthority ? commitEmailOtpEcdsaLaneForSelection({
-		authority: requiredEmailOtpAuthority,
-		lane: emailOtpAuthorityLane,
-		candidate: args.laneCandidate
-	}) : null;
-	const committedPasskeyLane = candidateAuthMethod === SIGNER_AUTH_METHODS.passkey ? await commitPasskeyEcdsaLaneForSelection({
-		deps: args.deps,
-		lane,
-		candidate: args.laneCandidate
-	}) : null;
-	const committedLane = committedEmailOtpLane ?? committedPasskeyLane;
-	const committedFactor = committedLane?.authority.factor.kind;
-	const selectedAccountAuth = walletAuthWithSelectedPrimary(await resolveEvmFamilyTransactionWalletAuth({
-		senderSignatureAlgorithm: args.senderSignatureAlgorithm,
-		signerAuthMethod: committedFactor ?? candidateAuthMethod
-	}), candidateAuthMethod);
-	const diagnostics = buildEcdsaSelectionDiagnostics({ candidate: args.laneCandidate });
-	return {
-		kind: "ready",
-		accountAuth: selectedAccountAuth,
-		lane,
-		committedLane: requireCommittedLaneForReady({
-			committedLane,
-			expectedFactor: candidateAuthMethod,
-			lane,
-			candidate: args.laneCandidate
-		}),
-		diagnostics
-	};
-}
-//#endregion
-export { resolveEvmFamilyEcdsaSigningSelection };
-
-//# sourceMappingURL=ecdsaSelection.js.map

package/dist/esm/react/core/signingEngine/flows/signEvmFamily/emailOtpPublic.js

@@ -1,123 +0,0 @@
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { buildFreshEmailOtpRoutePlan } from "../../session/emailOtp/routePlan.js";
-import { refreshEmailOtpSigningSession as refreshEmailOtpSigningSession$1, requestEmailOtpSigningSessionChallenge as requestEmailOtpSigningSessionChallenge$1, resolveEmailOtpEcdsaSigningSessionAuth } from "./emailOtpSigningSession.js";
-import { enrollEmailOtpWallet, prepareEmailOtpRegistrationEnrollmentMaterial } from "../../session/emailOtp/workerEnrollment.js";
-//#region src/core/signingEngine/flows/signEvmFamily/emailOtpPublic.ts
-function buildEmailOtpEcdsaFreshRoutePlanFromBoundary(args, freshRouteFamily) {
-	return buildFreshEmailOtpRoutePlan({
-		freshRouteFamily,
-		operation: args.operation
-	});
-}
-function emailOtpEcdsaLoginCoreArgsFromBoundary(args) {
-	return {
-		walletSession: args.walletSession,
-		authoritySelector: args.authoritySelector,
-		chainTarget: args.chainTarget,
-		otpCode: args.otpCode,
-		routePlan: buildEmailOtpEcdsaFreshRoutePlanFromBoundary(args, "login"),
-		ecdsaBootstrapAuthorization: args.ecdsaBootstrapAuthorization,
-		emailHashHex: args.emailHashHex,
-		providerIdentity: args.providerIdentity,
-		ed25519YaoRecovery: args.ed25519YaoRecovery ?? { kind: "not_requested" },
-		...args.emailOtpAuthPolicy ? { emailOtpAuthPolicy: args.emailOtpAuthPolicy } : {},
-		...args.emailOtpAuthReason ? { emailOtpAuthReason: args.emailOtpAuthReason } : {},
-		...args.relayUrl ? { relayUrl: args.relayUrl } : {},
-		...args.challengeId ? { challengeId: args.challengeId } : {},
-		...args.operation ? { operation: args.operation } : {},
-		...args.groupId ? { groupId: args.groupId } : {},
-		...args.keyHandle ? { keyHandle: args.keyHandle } : {},
-		...args.participantIds ? { participantIds: args.participantIds } : {},
-		...args.publicationChainTargets ? { publicationChainTargets: args.publicationChainTargets } : {},
-		...typeof args.ttlMs === "number" ? { ttlMs: args.ttlMs } : {},
-		...typeof args.remainingUses === "number" ? { remainingUses: args.remainingUses } : {},
-		...args.runtimePolicyScope ? { runtimePolicyScope: args.runtimePolicyScope } : {},
-		...args.onProgress ? { onProgress: args.onProgress } : {}
-	};
-}
-async function loginWithEmailOtpEcdsaCapabilityInternal(deps, args) {
-	return await deps.emailOtpSessions.loginWithEcdsaCapabilityInternal(emailOtpEcdsaLoginCoreArgsFromBoundary(args));
-}
-async function requestEmailOtpSigningSessionChallenge(deps, args) {
-	return await requestEmailOtpSigningSessionChallenge$1({
-		resolveSigningSessionAuth: (args) => resolveEmailOtpEcdsaSigningSessionAuth(args, deps.signingSessionAuthorityPorts),
-		withThresholdEcdsaSigningQueue: deps.withThresholdEcdsaSigningQueue,
-		emailOtpSessions: {
-			requestTransactionSigningChallenge: (challengeArgs) => deps.emailOtpSessions.requestTransactionSigningChallenge(challengeArgs),
-			loginWithEcdsaCapabilityInternal: ({ publicFacts, ...loginArgs }) => deps.emailOtpSessions.loginWithEcdsaCapabilityInternal({
-				...loginArgs,
-				keyHandle: String(publicFacts.keyHandle),
-				participantIds: publicFacts.participantIds.map((participantId) => Number(participantId)),
-				ecdsaBootstrapAuthorization: { kind: "route_plan_auth" },
-				ed25519YaoRecovery: { kind: "not_requested" }
-			})
-		}
-	}, {
-		walletSession: args.walletSession,
-		chainTarget: args.chainTarget
-	});
-}
-async function refreshEmailOtpSigningSession(deps, args) {
-	return {
-		...await refreshEmailOtpSigningSession$1({
-			resolveSigningSessionAuth: (args) => resolveEmailOtpEcdsaSigningSessionAuth(args, deps.signingSessionAuthorityPorts),
-			withThresholdEcdsaSigningQueue: deps.withThresholdEcdsaSigningQueue,
-			emailOtpSessions: {
-				requestTransactionSigningChallenge: (challengeArgs) => deps.emailOtpSessions.requestTransactionSigningChallenge(challengeArgs),
-				loginWithEcdsaCapabilityInternal: (loginArgs) => deps.emailOtpSessions.loginWithEcdsaCapabilityInternal({
-					...loginArgs,
-					ed25519YaoRecovery: { kind: "not_requested" }
-				})
-			}
-		}, {
-			walletSession: args.walletSession,
-			chainTarget: args.chainTarget,
-			challengeId: args.challengeId,
-			otpCode: args.otpCode,
-			...typeof args.ttlMs === "number" ? { ttlMs: args.ttlMs } : {},
-			...typeof args.remainingUses === "number" ? { remainingUses: args.remainingUses } : {}
-		}),
-		ed25519YaoRecovery: { kind: "not_requested" }
-	};
-}
-async function enrollEmailOtpInternal(deps, args) {
-	const walletId = toWalletId(args.walletId);
-	const relayUrl = String(args.relayUrl || deps.relayerUrl || "").trim();
-	if (!relayUrl) throw new Error("Missing relayer url (configs.network.relayer.url)");
-	const groupId = String(args.groupId || deps.groupId || "").trim();
-	if (!groupId) throw new Error("Missing shamir prime for Email OTP runtime");
-	return await enrollEmailOtpWallet({
-		relayUrl,
-		walletId: String(walletId),
-		userId: String(walletId),
-		challengeId: args.challengeId,
-		otpCode: args.otpCode,
-		groupId,
-		workerCtx: deps.getSignerWorkerContext(),
-		otpChannel: args.otpChannel,
-		...args.clientSecret32 ? { clientSecret32: args.clientSecret32 } : {}
-	});
-}
-async function prepareEmailOtpRegistrationEnrollmentMaterialInternal(deps, args) {
-	const walletId = toWalletId(args.walletId);
-	const relayUrl = String(args.relayUrl || deps.relayerUrl || "").trim();
-	if (!relayUrl) throw new Error("Missing relayer url (configs.network.relayer.url)");
-	const groupId = String(args.groupId || deps.groupId || "").trim();
-	if (!groupId) throw new Error("Missing shamir prime for Email OTP runtime");
-	const userId = String(args.userId).trim();
-	if (!userId) throw new Error("Email OTP registration enrollment material requires userId");
-	return await prepareEmailOtpRegistrationEnrollmentMaterial({
-		relayUrl,
-		walletId: String(walletId),
-		userId,
-		groupId,
-		workerCtx: deps.getSignerWorkerContext(),
-		otpChannel: args.otpChannel,
-		ecdsaSessionHandle: { kind: "not_requested" },
-		...args.clientSecret32 ? { clientSecret32: args.clientSecret32 } : {}
-	});
-}
-//#endregion
-export { enrollEmailOtpInternal, loginWithEmailOtpEcdsaCapabilityInternal, prepareEmailOtpRegistrationEnrollmentMaterialInternal, refreshEmailOtpSigningSession, requestEmailOtpSigningSessionChallenge };
-
-//# sourceMappingURL=emailOtpPublic.js.map

package/dist/esm/react/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.js

@@ -1,227 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { isEmailOtpWalletAuthAuthority, walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
-import { buildVerifiedEcdsaPublicFacts, toEvmFamilyEcdsaKeyHandle } from "../../session/identity/evmFamilyEcdsaIdentity.js";
-import { SigningEventPhase } from "../../../types/sdkSentEvents.js";
-import { createSigningBoundaryTraceEvent, emitSigningBoundaryTrace } from "../../session/operationState/trace.js";
-import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
-import { demoEmailOtpCodeFromDelivery } from "../../session/emailOtp/challengeDelivery.js";
-import { buildEmailOtpRoutePlan } from "../../stepUpConfirmation/otpPrompt/authLane.js";
-import { emailOtpEcdsaSigningSessionAuthLane, resolveExactEmailOtpEcdsaSigningSessionAuthority } from "../../session/emailOtp/ecdsaSigningSessionAuthority.js";
-import { emitEvmFamilySigningEvent } from "./events.js";
-import { throwEmailOtpSigningSessionAuthStateError } from "../../session/emailOtp/routePlan.js";
-//#region src/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.ts
-/** The capability is the authority. Anything the caller or the confirmation
-* plan supplies must agree with it exactly, or the OTP would be sent to a
-* different mailbox than the one bound to the material being signed with. */
-function emailOtpEcdsaCapabilityStepUpAuthority(args) {
-	const capabilityAuthority = args.capability.authority;
-	if (!isEmailOtpWalletAuthAuthority(capabilityAuthority)) throw new Error("[SigningEngine] Email OTP operation step-up requires an Email OTP capability authority");
-	if (args.claimedAuthority && !walletAuthAuthoritiesMatch(capabilityAuthority, args.claimedAuthority)) throw new Error("[SigningEngine] Email OTP step-up authority does not match the selected capability");
-	if (!mpcMaterialActivationRefsEqual(args.capability.manifest.activation.materialActivation, args.materialActivation)) throw new Error("[SigningEngine] Email OTP step-up material activation does not match the selected capability");
-	const operationFingerprint = String(args.operationFingerprint || "").trim();
-	if (!operationFingerprint) throw new Error("[SigningEngine] Email OTP operation step-up requires an operation fingerprint");
-	return {
-		kind: "capability_step_up",
-		capabilityAuthority,
-		materialActivation: args.materialActivation,
-		operationFingerprint
-	};
-}
-function emailOtpEcdsaChallengeAuthority(authority) {
-	switch (authority.kind) {
-		case "live_session":
-			if (authority.committedLane.authority.factor.kind !== "email_otp") throw new Error("[SigningEngine][ecdsa] Email OTP challenge requires Email OTP authority");
-			return {
-				kind: "live_session",
-				authLane: authority.committedLane.authLane
-			};
-		case "capability_step_up": return {
-			kind: "capability_step_up",
-			capabilityAuthority: authority.capabilityAuthority,
-			materialActivation: authority.materialActivation,
-			operationFingerprint: authority.operationFingerprint
-		};
-	}
-}
-function createEmailOtpEcdsaTransactionSigningBridge(args) {
-	let mintedForOperationFingerprint = null;
-	return { challenge: async () => {
-		if (typeof args.requestEmailOtpTransactionSigningChallenge !== "function") throw new Error("[SigningEngine] Email OTP ECDSA signing step-up is not configured");
-		if (args.authority.kind === "capability_step_up") {
-			if (mintedForOperationFingerprint !== null && mintedForOperationFingerprint !== args.authority.operationFingerprint) throw new Error("[SigningEngine] Email OTP step-up challenge is bound to a different operation");
-			mintedForOperationFingerprint = args.authority.operationFingerprint;
-		}
-		emitEvmFamilySigningEvent(args.onEvent, {
-			phase: SigningEventPhase.STEP_06_AUTH_EMAIL_OTP_CHALLENGE_STARTED,
-			status: "running",
-			walletId: args.walletId,
-			interaction: {
-				kind: "none",
-				overlay: "none"
-			}
-		});
-		emitSigningBoundaryTrace("evm-family", createSigningBoundaryTraceEvent({
-			event: "auth_side_effect_started",
-			lane: args.selectedLane,
-			sideEffect: "email_otp_challenge",
-			phase: "confirmed"
-		}));
-		const challenge = await args.requestEmailOtpTransactionSigningChallenge({
-			walletSession: args.walletSession,
-			chain: args.chain,
-			authority: emailOtpEcdsaChallengeAuthority(args.authority),
-			operationFingerprintDigest: args.operationFingerprintDigest
-		});
-		const challengeId = String(challenge.challengeId || "").trim();
-		if (!challengeId) throw new Error("[SigningEngine] Email OTP challenge response did not include challengeId");
-		emitEvmFamilySigningEvent(args.onEvent, {
-			phase: SigningEventPhase.STEP_06_AUTH_EMAIL_OTP_INPUT_REQUIRED,
-			status: "waiting_for_user",
-			walletId: args.walletId,
-			interaction: {
-				kind: "otp_input",
-				overlay: "show"
-			},
-			data: {
-				emailHint: challenge.emailHint,
-				demoOtpCode: demoEmailOtpCodeFromDelivery(challenge.delivery)
-			}
-		});
-		return {
-			challengeId,
-			email: String(challenge.emailHint || "").trim()
-		};
-	} };
-}
-/** Canonical Email OTP signing-session resolution: the manifest proves exact
-* material, the sealed runtime supplies session-scoped facts and the Email OTP
-* binding, and the reusable Wallet Session is resolved independently. Refresh
-* must land on the same material activation it started from, so the caller
-* checks that before and after; nothing here invokes Yao recovery or device
-* linking. */
-async function resolveEmailOtpEcdsaSigningSessionAuth(args, authorityPorts) {
-	const resolved = await authorityPorts.resolveActiveEcdsaCapabilityRuntime({
-		walletId: args.walletId,
-		chainTarget: args.chainTarget
-	});
-	if (resolved.kind !== "resolved") throwEmailOtpSigningSessionAuthStateError({
-		kind: "auth_lane_missing",
-		source: "evm_signing_refresh",
-		expectedCurve: "ecdsa"
-	});
-	const authority = await resolveExactEmailOtpEcdsaSigningSessionAuthority(authorityPorts, {
-		walletId: args.walletId,
-		chainTarget: args.chainTarget,
-		manifest: resolved.manifest,
-		runtime: resolved.runtime
-	});
-	if (!authority) throwEmailOtpSigningSessionAuthStateError({
-		kind: "auth_lane_missing",
-		source: "evm_signing_refresh",
-		expectedCurve: "ecdsa"
-	});
-	return {
-		manifest: resolved.manifest,
-		runtime: resolved.runtime,
-		authority
-	};
-}
-async function requestEmailOtpSigningSessionChallenge(deps, args) {
-	const { authority } = await deps.resolveSigningSessionAuth({
-		walletId: args.walletSession.walletId,
-		chainTarget: args.chainTarget
-	});
-	return await deps.emailOtpSessions.requestTransactionSigningChallenge({
-		kind: "wallet_session_challenge",
-		walletSession: args.walletSession,
-		chain: args.chainTarget.kind,
-		authLane: emailOtpEcdsaSigningSessionAuthLane(authority)
-	});
-}
-async function resolveFencedEmailOtpSigningSessionAuth(input) {
-	let current;
-	try {
-		current = await input.deps.resolveSigningSessionAuth({
-			walletId: input.args.walletSession.walletId,
-			chainTarget: input.args.chainTarget
-		});
-	} catch {
-		throw new Error(`[SigningEngine][ecdsa] Email OTP signing-session refresh material was superseded ${input.phase}`);
-	}
-	if (!mpcMaterialActivationRefsEqual(current.runtime.materialActivation, input.activationBeforeRefresh)) throw new Error(`[SigningEngine][ecdsa] Email OTP signing-session refresh material was superseded ${input.phase}`);
-	return current;
-}
-async function runFencedEmailOtpSigningSessionRefresh(input) {
-	const { manifest, runtime, authority } = await resolveFencedEmailOtpSigningSessionAuth({
-		deps: input.deps,
-		args: input.args,
-		activationBeforeRefresh: input.activationBeforeRefresh,
-		phase: "before use"
-	});
-	const routePlan = buildEmailOtpRoutePlan({
-		routeFamily: "signing_session",
-		authLane: emailOtpEcdsaSigningSessionAuthLane(authority),
-		operation: WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
-	});
-	const publicFacts = buildVerifiedEcdsaPublicFacts({
-		keyHandle: toEvmFamilyEcdsaKeyHandle(String(manifest.durableMaterial.roleLocalPublicFacts.keyHandle)),
-		publicKeyB64u: runtime.thresholdEcdsaPublicKeyB64u,
-		participantIds: [...runtime.participantIds],
-		thresholdOwnerAddress: manifest.durableMaterial.roleLocalPublicFacts.ethereumAddress
-	});
-	const emailOtpBinding = runtime.authBinding;
-	if (emailOtpBinding.kind !== "email_otp") throw new Error("Email OTP signing-session refresh requires an Email OTP sealed runtime");
-	const refreshed = await input.deps.emailOtpSessions.loginWithEcdsaCapabilityInternal({
-		walletSession: input.args.walletSession,
-		authoritySelector: {
-			kind: "wallet_auth_method",
-			walletAuthMethodId: String((await walletAuthAuthorityRef({ authority: emailOtpBinding.emailOtpAuthority })).walletAuthMethodId)
-		},
-		chainTarget: input.args.chainTarget,
-		emailOtpAuthPolicy: "session",
-		emailOtpAuthReason: "sign",
-		challengeId: input.args.challengeId,
-		otpCode: input.args.otpCode,
-		operation: WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION,
-		routePlan,
-		publicFacts,
-		ecdsaBootstrapAuthorization: { kind: "route_plan_auth" },
-		providerIdentity: {
-			kind: "explicit_provider_user",
-			provider: emailOtpBinding.emailOtpAuthority.factor.provider,
-			providerUserId: emailOtpBinding.providerSubjectId
-		},
-		emailHashHex: emailOtpBinding.emailHashHex,
-		...typeof input.args.ttlMs === "number" ? { ttlMs: input.args.ttlMs } : {},
-		...typeof input.args.remainingUses === "number" ? { remainingUses: input.args.remainingUses } : {},
-		...runtime.runtimePolicyScope ? { runtimePolicyScope: runtime.runtimePolicyScope } : {}
-	});
-	await resolveFencedEmailOtpSigningSessionAuth({
-		deps: input.deps,
-		args: input.args,
-		activationBeforeRefresh: input.activationBeforeRefresh,
-		phase: "during refresh"
-	});
-	return refreshed;
-}
-async function refreshEmailOtpSigningSession(deps, args) {
-	const activationBeforeRefresh = (await deps.resolveSigningSessionAuth({
-		walletId: args.walletSession.walletId,
-		chainTarget: args.chainTarget
-	})).runtime.materialActivation;
-	return await deps.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdCommitQueueKey({ materialActivation: activationBeforeRefresh }),
-		walletId: args.walletSession.walletId,
-		enabled: true,
-		task: runFencedEmailOtpSigningSessionRefresh.bind(void 0, {
-			deps,
-			args,
-			activationBeforeRefresh
-		})
-	});
-}
-//#endregion
-export { createEmailOtpEcdsaTransactionSigningBridge, emailOtpEcdsaCapabilityStepUpAuthority, refreshEmailOtpSigningSession, requestEmailOtpSigningSessionChallenge, resolveEmailOtpEcdsaSigningSessionAuth };
-
-//# sourceMappingURL=emailOtpSigningSession.js.map