@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/react/core/signingEngine/session/persistence/sealedSessionRecords.js

@@ -1,761 +0,0 @@
-import { normalizeInteger, normalizeOptionalNonEmptyString } from "../../../../shared-ts/src/utils/normalize.js";
-import { asRecord } from "../../../../shared-ts/src/utils/validation.js";
-import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, SIGNING_SESSION_SEAL_STORAGE_SCOPE, SIGNING_SESSION_SECRET_KIND, parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { parseMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey } from "../../interfaces/ecdsaChainTarget.js";
-import { parseEcdsaRoleLocalPersistedMaterialRef } from "../keyMaterialBrands.js";
-import { ecdsaSealedRecordStoreKey } from "./ecdsaSealedRecordKey.js";
-//#region src/core/signingEngine/session/persistence/sealedSessionRecords.ts
-const ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND = "ecdsa_inactive_sealed_material_v1";
-const SEALED_RECORD_PAYLOAD_FIELD = "sealed_record";
-function normalizeThresholdSessionIds(value) {
-	const obj = asRecord(value) ?? {};
-	const ed25519 = normalizeOptionalNonEmptyString(obj.ed25519);
-	const ecdsa = normalizeOptionalNonEmptyString(obj.ecdsa);
-	return {
-		...ed25519 ? { ed25519 } : {},
-		...ecdsa ? { ecdsa } : {}
-	};
-}
-function normalizeThresholdSessionIdsFromStoredRecord(value) {
-	return normalizeThresholdSessionIds((asRecord(value) ?? {}).thresholdSessionIds);
-}
-function hasRetiredAuthorizationIdentityField(value) {
-	const obj = asRecord(value);
-	if (!obj) return false;
-	const camelCaseKey = [
-		"signing",
-		"Grant",
-		"Id"
-	].join("");
-	const snakeCaseKey = [
-		"signing",
-		"grant",
-		"id"
-	].join("_");
-	return Object.prototype.hasOwnProperty.call(obj, camelCaseKey) || Object.prototype.hasOwnProperty.call(obj, snakeCaseKey);
-}
-function normalizeCurve(value) {
-	const curve = String(value || "").trim();
-	return curve === "ed25519" || curve === "ecdsa" ? curve : void 0;
-}
-function storagePayloadFromSealedStoreRow(value) {
-	const obj = asRecord(value);
-	return obj && SEALED_RECORD_PAYLOAD_FIELD in obj ? obj[SEALED_RECORD_PAYLOAD_FIELD] : value;
-}
-function durableLaneStorageRow(record) {
-	const ecdsaChainTarget = record.ecdsaRestore?.chainTarget;
-	const ecdsaThresholdSessionId = normalizeOptionalNonEmptyString(record.thresholdSessionIds.ecdsa);
-	const ed25519ThresholdSessionId = normalizeOptionalNonEmptyString(record.thresholdSessionIds.ed25519);
-	return {
-		store_key: record.storeKey,
-		wallet_id: record.walletId,
-		auth_method: record.authMethod,
-		curve: record.curve,
-		signing_root_id: normalizeOptionalNonEmptyString("signingRootId" in record ? record.signingRootId : void 0),
-		signing_root_version: normalizeOptionalNonEmptyString("signingRootVersion" in record ? record.signingRootVersion : void 0),
-		ed25519_threshold_session_id: ed25519ThresholdSessionId,
-		ecdsa_threshold_session_id: ecdsaThresholdSessionId,
-		threshold_session_id: ecdsaThresholdSessionId || ed25519ThresholdSessionId,
-		key_handle: normalizeOptionalNonEmptyString(record.ecdsaRestore?.keyHandle),
-		chain_target_key: ecdsaChainTarget ? thresholdEcdsaChainTargetKey(ecdsaChainTarget) : void 0,
-		expires_at_ms: record.expiresAtMs,
-		updated_at: record.updatedAtMs,
-		[SEALED_RECORD_PAYLOAD_FIELD]: record
-	};
-}
-function inactiveEcdsaMaterialStorageRow(record) {
-	return {
-		store_key: record.storeKey,
-		wallet_id: record.walletId,
-		auth_method: record.authMethod,
-		curve: record.curve,
-		key_handle: record.ecdsaRestore.keyHandle,
-		chain_target_key: thresholdEcdsaChainTargetKey(record.ecdsaRestore.chainTarget),
-		updated_at: record.updatedAtMs,
-		[SEALED_RECORD_PAYLOAD_FIELD]: record
-	};
-}
-function sealedRecordStorageRow(record) {
-	return durableLaneStorageRow(record);
-}
-function normalizeEthereumAddress(value) {
-	const normalized = String(value || "").trim().toLowerCase();
-	return /^0x[0-9a-f]{40}$/.test(normalized) ? normalized : void 0;
-}
-function resolveSealedRecordCurve(args) {
-	if (args.curve) return args.curve;
-	if (args.thresholdSessionIds.ecdsa) return "ecdsa";
-	if (args.thresholdSessionIds.ed25519) return "ed25519";
-	return null;
-}
-function parseSealedEcdsaRouterAbDerivationNormalSigningState(value) {
-	try {
-		return parseRouterAbEcdsaDerivationNormalSigningStateV1(value);
-	} catch {
-		return null;
-	}
-}
-function normalizeSealedEcdsaRestoreSource(value) {
-	switch (value) {
-		case "login":
-		case "registration":
-		case "manual-bootstrap":
-		case "email_otp": return value;
-		default: return null;
-	}
-}
-function signingRootBindingFromStoredRuntimePolicyScope(value) {
-	try {
-		const scope = signingRootScopeFromRuntimePolicyScope(normalizeRuntimePolicyScope(value));
-		const signingRootId = normalizeOptionalNonEmptyString(scope.signingRootId);
-		const signingRootVersion = normalizeOptionalNonEmptyString(scope.signingRootVersion);
-		return signingRootId && signingRootVersion ? {
-			signingRootId,
-			signingRootVersion
-		} : null;
-	} catch {
-		return null;
-	}
-}
-function normalizeEcdsaRestoreMetadata(value) {
-	const obj = asRecord(value);
-	if (!obj) return void 0;
-	let chainTarget = null;
-	try {
-		chainTarget = thresholdEcdsaChainTargetFromRequest(asRecord(obj.chainTarget) ?? {});
-	} catch {
-		chainTarget = null;
-	}
-	const source = normalizeSealedEcdsaRestoreSource(obj.source);
-	const authorityRef = parseWalletAuthAuthorityRef(obj.authority);
-	const rpId = normalizeOptionalNonEmptyString(obj.rpId);
-	const runtimePolicyScope = obj.runtimePolicyScope && typeof obj.runtimePolicyScope === "object" ? obj.runtimePolicyScope : void 0;
-	const runtimeSigningRootBinding = signingRootBindingFromStoredRuntimePolicyScope(runtimePolicyScope);
-	const explicitSigningRootId = normalizeOptionalNonEmptyString(obj.signingRootId);
-	const explicitSigningRootVersion = normalizeOptionalNonEmptyString(obj.signingRootVersion);
-	if (explicitSigningRootId && runtimeSigningRootBinding?.signingRootId && explicitSigningRootId !== runtimeSigningRootBinding.signingRootId) return;
-	if (explicitSigningRootVersion && runtimeSigningRootBinding?.signingRootVersion && explicitSigningRootVersion !== runtimeSigningRootBinding.signingRootVersion) return;
-	const signingRootId = explicitSigningRootId || runtimeSigningRootBinding?.signingRootId || "";
-	const signingRootVersion = explicitSigningRootVersion || runtimeSigningRootBinding?.signingRootVersion || "";
-	const credentialIdB64u = normalizeOptionalNonEmptyString(obj.credentialIdB64u);
-	let roleLocalMaterialRef = null;
-	try {
-		roleLocalMaterialRef = parseEcdsaRoleLocalPersistedMaterialRef(obj.roleLocalMaterialRef);
-	} catch {
-		roleLocalMaterialRef = null;
-	}
-	const emailOtpAuthority = parseEmailOtpWalletAuthAuthority(obj.emailOtpAuthority);
-	const provider = obj.provider === "google" || obj.provider === "email" ? obj.provider : null;
-	const providerSubjectId = normalizeOptionalNonEmptyString(obj.providerSubjectId);
-	const emailHashHex = normalizeOptionalNonEmptyString(obj.emailHashHex);
-	const keyHandle = normalizeOptionalNonEmptyString(obj.keyHandle);
-	const ecdsaThresholdKeyId = normalizeOptionalNonEmptyString(obj.ecdsaThresholdKeyId);
-	const ethereumAddress = normalizeEthereumAddress(obj.ethereumAddress);
-	const relayerKeyId = normalizeOptionalNonEmptyString(obj.relayerKeyId);
-	const thresholdEcdsaPublicKeyB64u = normalizeOptionalNonEmptyString(obj.thresholdEcdsaPublicKeyB64u);
-	const routerAbEcdsaDerivationNormalSigning = parseSealedEcdsaRouterAbDerivationNormalSigningState(obj.routerAbEcdsaDerivationNormalSigning);
-	let publicCapability = null;
-	try {
-		publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(obj.publicCapability);
-	} catch {
-		publicCapability = null;
-	}
-	const participantIds = normalizeParticipantIds(obj.participantIds);
-	if (!chainTarget || !source || !signingRootId || !signingRootVersion || !keyHandle || !ethereumAddress || !relayerKeyId || !routerAbEcdsaDerivationNormalSigning || !publicCapability || !participantIds.length) return;
-	const authBranch = credentialIdB64u && rpId && roleLocalMaterialRef && authorityRef && source !== "email_otp" ? {
-		source,
-		authority: authorityRef,
-		roleLocalMaterialRef,
-		rpId,
-		credentialIdB64u
-	} : providerSubjectId && provider && emailHashHex && roleLocalMaterialRef && authorityRef && emailOtpAuthority && source === "email_otp" ? {
-		source,
-		provider,
-		providerSubjectId,
-		emailHashHex,
-		authority: authorityRef,
-		emailOtpAuthority,
-		roleLocalMaterialRef
-	} : null;
-	if (!authBranch) return void 0;
-	const clientVerifyingShareB64u = normalizeOptionalNonEmptyString(obj.clientVerifyingShareB64u);
-	return {
-		chainTarget,
-		signingRootId,
-		signingRootVersion,
-		...authBranch,
-		keyHandle,
-		...ecdsaThresholdKeyId ? { ecdsaThresholdKeyId } : {},
-		ethereumAddress,
-		relayerKeyId,
-		...clientVerifyingShareB64u ? { clientVerifyingShareB64u } : {},
-		...thresholdEcdsaPublicKeyB64u ? { thresholdEcdsaPublicKeyB64u } : {},
-		participantIds,
-		routerAbEcdsaDerivationNormalSigning,
-		publicCapability,
-		...runtimePolicyScope ? { runtimePolicyScope } : {}
-	};
-}
-function normalizeCurrentEd25519RestoreMetadata(value) {
-	const obj = asRecord(value);
-	if (!obj) return void 0;
-	const nearAccountId = normalizeOptionalNonEmptyString(obj.nearAccountId);
-	const nearEd25519SigningKeyId = normalizeOptionalNonEmptyString(obj.nearEd25519SigningKeyId);
-	const rpId = normalizeOptionalNonEmptyString(obj.rpId);
-	const credentialIdB64u = normalizeOptionalNonEmptyString(obj.credentialIdB64u);
-	const providerSubjectId = normalizeOptionalNonEmptyString(obj.providerSubjectId);
-	const provider = obj.provider === "google" || obj.provider === "email" ? obj.provider : null;
-	const emailHashHex = normalizeOptionalNonEmptyString(obj.emailHashHex);
-	const authSubjectId = normalizeOptionalNonEmptyString(obj.authSubjectId);
-	const relayerKeyId = normalizeOptionalNonEmptyString(obj.relayerKeyId);
-	const participantIds = normalizeParticipantIds(obj.participantIds);
-	const signerSlot = normalizeInteger(obj.signerSlot);
-	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(obj.routerAbNormalSigning);
-	const materialActivation = parseMpcMaterialActivationRef(obj.materialActivation);
-	const authBranch = credentialIdB64u && !providerSubjectId && materialActivation.ok ? {
-		credentialIdB64u,
-		materialActivation: materialActivation.value
-	} : provider && providerSubjectId && emailHashHex && !credentialIdB64u && materialActivation.ok ? {
-		provider,
-		providerSubjectId,
-		emailHashHex,
-		materialActivation: materialActivation.value
-	} : null;
-	if (!nearAccountId || !nearEd25519SigningKeyId || !rpId || !relayerKeyId || !participantIds.length || signerSlot == null || signerSlot <= 0 || !routerAbNormalSigning || !authBranch || authSubjectId) return;
-	return {
-		nearAccountId,
-		nearEd25519SigningKeyId,
-		rpId,
-		...authBranch,
-		relayerKeyId,
-		participantIds,
-		...obj.runtimePolicyScope && typeof obj.runtimePolicyScope === "object" ? { runtimePolicyScope: obj.runtimePolicyScope } : {},
-		signerSlot,
-		routerAbNormalSigning
-	};
-}
-function ed25519SealedRecordStoreKey(args) {
-	const materialActivation = args.restore.materialActivation;
-	return [
-		"ed25519-material-v2",
-		args.walletId,
-		args.authMethod,
-		"ed25519",
-		materialActivation.activationId,
-		materialActivation.capability,
-		materialActivation.materialOwner,
-		materialActivation.keyBinding,
-		materialActivation.lifecycleBinding,
-		materialActivation.signingWorker
-	].map(sealedStoreKeyPart).join(":");
-}
-function makeInactiveEcdsaMaterialStoreKey(args) {
-	const material = args.restore.roleLocalMaterialRef;
-	return [
-		"inactive-material",
-		args.walletId,
-		args.authMethod,
-		"ecdsa",
-		thresholdEcdsaChainTargetKey(args.restore.chainTarget),
-		material.materialActivation.activationId
-	].map(sealedStoreKeyPart).join(":");
-}
-function sealedStoreKeyPart(value) {
-	return encodeURIComponent(String(value || "").trim());
-}
-function normalizeAuthMethod(value) {
-	const authMethod = String(value || "").trim();
-	return authMethod === "passkey" || authMethod === "email_otp" ? authMethod : void 0;
-}
-function hasStaleSealedSessionWalletIdentityFields(value) {
-	const obj = asRecord(value);
-	return Boolean(normalizeOptionalNonEmptyString(obj?.subjectId) || normalizeOptionalNonEmptyString(obj?.userId));
-}
-function hasTopLevelSigningRootFields(value) {
-	const obj = asRecord(value);
-	return Boolean(normalizeOptionalNonEmptyString(obj?.signingRootId) || normalizeOptionalNonEmptyString(obj?.signingRootVersion));
-}
-function normalizeParticipantIds(value) {
-	if (!Array.isArray(value)) return [];
-	return value.map((participantId) => Math.floor(Number(participantId))).filter((participantId) => Number.isFinite(participantId) && participantId > 0);
-}
-function buildSealedSessionSafeSummary(obj) {
-	return {
-		authMethod: normalizeOptionalNonEmptyString(obj?.authMethod) || null,
-		curve: normalizeOptionalNonEmptyString(obj?.curve) || null,
-		storeKey: normalizeOptionalNonEmptyString(obj?.storeKey) || null,
-		walletId: normalizeOptionalNonEmptyString(obj?.walletId) || null,
-		thresholdSessionIds: normalizeThresholdSessionIdsFromStoredRecord(obj),
-		hasEcdsaRestore: Boolean(asRecord(obj?.ecdsaRestore)),
-		hasEd25519Restore: Boolean(asRecord(obj?.ed25519Restore)),
-		issuedAtMs: normalizeInteger(obj?.issuedAtMs),
-		expiresAtMs: normalizeInteger(obj?.expiresAtMs),
-		remainingUses: normalizeInteger(obj?.remainingUses),
-		updatedAtMs: normalizeInteger(obj?.updatedAtMs)
-	};
-}
-function classifyNonCurrentRecord(kind, obj, reason) {
-	return {
-		kind,
-		storeKey: normalizeOptionalNonEmptyString(obj?.storeKey) || null,
-		walletId: normalizeOptionalNonEmptyString(obj?.walletId) || null,
-		reason,
-		safeSummary: buildSealedSessionSafeSummary(obj)
-	};
-}
-/** The seal header every current record opens with, in its stored order. */
-function currentSealedRecordHeader(authMethod) {
-	return {
-		v: 2,
-		alg: SIGNING_SESSION_SEAL_ALG,
-		storageScope: SIGNING_SESSION_SEAL_STORAGE_SCOPE,
-		authMethod,
-		secretKind: SIGNING_SESSION_SECRET_KIND
-	};
-}
-function classifyRawSealedSessionRecord(raw) {
-	raw = storagePayloadFromSealedStoreRow(raw);
-	const obj = asRecord(raw);
-	if (!obj) return classifyNonCurrentRecord("malformed", null, "invalid_payload");
-	if (obj.kind === "lane_sealed_holder_record_v1") return classifyNonCurrentRecord("unrelated_record", obj, "owned_by_lane_holder_store");
-	if (hasRetiredAuthorizationIdentityField(obj)) return classifyNonCurrentRecord("delete_required", obj, "invalid_identity");
-	if (obj.recordKind === "ecdsa_reauth_anchor_v1") return classifyNonCurrentRecord("delete_required", obj, "invalid_header");
-	if (obj.recordKind === ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND) {
-		const record = normalizeEcdsaInactiveSealedMaterialRecord(obj);
-		return record ? {
-			kind: "ecdsa_inactive_material",
-			record
-		} : classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	}
-	if (Number(obj.v) === 1) return classifyNonCurrentRecord("delete_required", obj, "invalid_header");
-	if (Number(obj.v) !== 2) return classifyNonCurrentRecord("malformed", obj, "invalid_header");
-	if (String(obj.alg || "").trim() !== "shamir3pass-v2") return classifyNonCurrentRecord("malformed", obj, "invalid_header");
-	if (String(obj.storageScope || "").trim() !== "iframe_origin_indexeddb") return classifyNonCurrentRecord("malformed", obj, "invalid_header");
-	if (String(obj.secretKind || "").trim() !== "signing_session_secret32") return classifyNonCurrentRecord("malformed", obj, "invalid_header");
-	const authMethod = String(obj.authMethod || "").trim();
-	const thresholdSessionIds = normalizeThresholdSessionIdsFromStoredRecord(obj);
-	const sealedSecretB64u = normalizeOptionalNonEmptyString(obj.sealedSecretB64u);
-	const curve = normalizeCurve(obj.curve);
-	const subjectId = normalizeOptionalNonEmptyString(obj.subjectId);
-	const userId = normalizeOptionalNonEmptyString(obj.userId);
-	const walletId = normalizeOptionalNonEmptyString(obj.walletId);
-	const signingRootId = normalizeOptionalNonEmptyString(obj.signingRootId);
-	const explicitSigningRootVersion = normalizeOptionalNonEmptyString(obj.signingRootVersion);
-	const signingRootVersion = explicitSigningRootVersion || (signingRootId ? "default" : null);
-	const relayerUrl = normalizeOptionalNonEmptyString(obj.relayerUrl);
-	const keyVersion = normalizeOptionalNonEmptyString(obj.keyVersion);
-	const groupId = normalizeOptionalNonEmptyString(obj.groupId);
-	const issuedAtMs = normalizeInteger(obj.issuedAtMs);
-	const expiresAtMs = normalizeInteger(obj.expiresAtMs);
-	const remainingUses = normalizeInteger(obj.remainingUses);
-	const updatedAtMs = normalizeInteger(obj.updatedAtMs);
-	if (!sealedSecretB64u || !keyVersion || groupId !== "rfc2409-group2") return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (authMethod !== "passkey" && authMethod !== "email_otp") return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (!thresholdSessionIds.ed25519 && !thresholdSessionIds.ecdsa) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (!walletId) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	const recordCurve = resolveSealedRecordCurve({
-		curve,
-		thresholdSessionIds
-	});
-	if (!recordCurve) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (issuedAtMs == null || issuedAtMs <= 0) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (expiresAtMs == null || expiresAtMs <= 0) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (remainingUses == null || remainingUses < 0) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (updatedAtMs == null || updatedAtMs <= 0) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	const ecdsaRestoreObj = asRecord(obj.ecdsaRestore);
-	const ed25519RestoreObj = asRecord(obj.ed25519Restore);
-	const ecdsaRestore = normalizeEcdsaRestoreMetadata(obj.ecdsaRestore);
-	const ed25519Restore = normalizeCurrentEd25519RestoreMetadata(obj.ed25519Restore);
-	if (recordCurve === "ecdsa") {
-		if (!thresholdSessionIds.ecdsa) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-		if (subjectId || userId || signingRootId || explicitSigningRootVersion) return classifyNonCurrentRecord("delete_required", obj, "invalid_identity");
-		if (!ecdsaRestoreObj || !relayerUrl) return classifyNonCurrentRecord("rebuild_required", obj, "missing_restore_metadata");
-		if (!normalizeParticipantIds(ecdsaRestoreObj.participantIds).length) return classifyNonCurrentRecord("delete_required", obj, "missing_participant_ids");
-		if (!ecdsaRestore) return classifyNonCurrentRecord("rebuild_required", obj, "missing_restore_metadata");
-		const storeKey = ecdsaSealedRecordStoreKey({
-			walletId,
-			authMethod,
-			chainTarget: ecdsaRestore.chainTarget,
-			materialActivation: ecdsaRestore.roleLocalMaterialRef.materialActivation
-		});
-		const providedStoreKey = normalizeOptionalNonEmptyString(obj.storeKey);
-		if (providedStoreKey && providedStoreKey !== storeKey) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-		return {
-			kind: "current",
-			record: {
-				...currentSealedRecordHeader(authMethod),
-				storeKey,
-				thresholdSessionIds: {
-					...thresholdSessionIds.ed25519 ? { ed25519: thresholdSessionIds.ed25519 } : {},
-					ecdsa: thresholdSessionIds.ecdsa
-				},
-				sealedSecretB64u,
-				curve: "ecdsa",
-				walletId,
-				relayerUrl,
-				keyVersion,
-				groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-				ecdsaRestore,
-				...ed25519Restore ? { ed25519Restore } : {},
-				issuedAtMs,
-				expiresAtMs,
-				remainingUses,
-				updatedAtMs
-			}
-		};
-	}
-	if (!thresholdSessionIds.ed25519) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (subjectId || userId) return classifyNonCurrentRecord("delete_required", obj, "invalid_identity");
-	if (!ed25519RestoreObj || !relayerUrl) return classifyNonCurrentRecord("rebuild_required", obj, "missing_restore_metadata");
-	if (!normalizeParticipantIds(ed25519RestoreObj.participantIds).length) return classifyNonCurrentRecord("delete_required", obj, "missing_participant_ids");
-	if (!ed25519Restore) return classifyNonCurrentRecord("rebuild_required", obj, "missing_restore_metadata");
-	const storeKey = ed25519SealedRecordStoreKey({
-		walletId,
-		authMethod,
-		restore: ed25519Restore
-	});
-	const providedStoreKey = normalizeOptionalNonEmptyString(obj.storeKey);
-	if (providedStoreKey && providedStoreKey !== storeKey) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	return {
-		kind: "current",
-		record: {
-			...currentSealedRecordHeader(authMethod),
-			storeKey,
-			thresholdSessionIds: {
-				ed25519: thresholdSessionIds.ed25519,
-				...thresholdSessionIds.ecdsa ? { ecdsa: thresholdSessionIds.ecdsa } : {}
-			},
-			sealedSecretB64u,
-			curve: "ed25519",
-			walletId,
-			...signingRootId ? { signingRootId } : {},
-			...signingRootVersion ? { signingRootVersion } : {},
-			relayerUrl,
-			keyVersion,
-			groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-			...ecdsaRestore ? { ecdsaRestore } : {},
-			ed25519Restore,
-			issuedAtMs,
-			expiresAtMs,
-			remainingUses,
-			updatedAtMs
-		}
-	};
-}
-function normalizeSigningSessionSealedStoreRecord(value) {
-	const classification = classifyRawSealedSessionRecord(storagePayloadFromSealedStoreRow(value));
-	return classification.kind === "current" ? classification.record : null;
-}
-function normalizeEcdsaInactiveMaterialPublicRestore(value) {
-	const obj = asRecord(value);
-	if (!obj) return null;
-	if (obj.clientVerifyingShareB64u != null) return null;
-	let chainTarget;
-	let runtimePolicyScope;
-	let routerAbEcdsaDerivationNormalSigning;
-	let publicCapability;
-	try {
-		chainTarget = thresholdEcdsaChainTargetFromRequest(obj.chainTarget && typeof obj.chainTarget === "object" ? obj.chainTarget : {});
-		runtimePolicyScope = normalizeRuntimePolicyScope(obj.runtimePolicyScope);
-		const parsedRouterAbState = parseRouterAbEcdsaDerivationNormalSigningStateV1(obj.routerAbEcdsaDerivationNormalSigning);
-		if (!parsedRouterAbState) return null;
-		routerAbEcdsaDerivationNormalSigning = parsedRouterAbState;
-		publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(obj.publicCapability);
-	} catch {
-		return null;
-	}
-	const signingRootId = normalizeOptionalNonEmptyString(obj.signingRootId);
-	const signingRootVersion = normalizeOptionalNonEmptyString(obj.signingRootVersion);
-	let roleLocalMaterialRef = null;
-	try {
-		roleLocalMaterialRef = parseEcdsaRoleLocalPersistedMaterialRef(obj.roleLocalMaterialRef);
-	} catch {
-		roleLocalMaterialRef = null;
-	}
-	const authorityRef = parseWalletAuthAuthorityRef(obj.authority);
-	const emailOtpAuthority = parseEmailOtpWalletAuthAuthority(obj.emailOtpAuthority);
-	const keyHandle = normalizeOptionalNonEmptyString(obj.keyHandle);
-	const ecdsaThresholdKeyId = normalizeOptionalNonEmptyString(obj.ecdsaThresholdKeyId);
-	const ethereumAddress = normalizeOptionalNonEmptyString(obj.ethereumAddress);
-	const relayerKeyId = normalizeOptionalNonEmptyString(obj.relayerKeyId);
-	const thresholdEcdsaPublicKeyB64u = normalizeOptionalNonEmptyString(obj.thresholdEcdsaPublicKeyB64u);
-	const participantIds = normalizeParticipantIds(obj.participantIds);
-	if (!signingRootId || !signingRootVersion || !keyHandle || !ecdsaThresholdKeyId || !ethereumAddress || !relayerKeyId || !thresholdEcdsaPublicKeyB64u || !participantIds.length) return null;
-	const base = {
-		chainTarget,
-		signingRootId,
-		signingRootVersion,
-		keyHandle,
-		ecdsaThresholdKeyId,
-		ethereumAddress,
-		relayerKeyId,
-		thresholdEcdsaPublicKeyB64u,
-		participantIds,
-		runtimePolicyScope,
-		routerAbEcdsaDerivationNormalSigning,
-		publicCapability
-	};
-	switch (obj.source) {
-		case "email_otp": {
-			const provider = obj.provider === "google" || obj.provider === "email" ? obj.provider : null;
-			const providerSubjectId = normalizeOptionalNonEmptyString(obj.providerSubjectId);
-			const emailHashHex = normalizeOptionalNonEmptyString(obj.emailHashHex);
-			if (!provider || !providerSubjectId || !emailHashHex || !roleLocalMaterialRef || !authorityRef || !emailOtpAuthority || obj.rpId != null || obj.credentialIdB64u != null) return null;
-			return {
-				...base,
-				source: "email_otp",
-				provider,
-				providerSubjectId,
-				emailHashHex,
-				authority: authorityRef,
-				emailOtpAuthority,
-				roleLocalMaterialRef
-			};
-		}
-		case "login":
-		case "registration":
-		case "manual-bootstrap": {
-			const rpId = normalizeOptionalNonEmptyString(obj.rpId);
-			const credentialIdB64u = normalizeOptionalNonEmptyString(obj.credentialIdB64u);
-			if (!rpId || !credentialIdB64u || !roleLocalMaterialRef || !authorityRef || obj.providerSubjectId != null || obj.emailHashHex != null) return null;
-			return {
-				...base,
-				source: obj.source,
-				authority: authorityRef,
-				roleLocalMaterialRef,
-				rpId,
-				credentialIdB64u
-			};
-		}
-		default: return null;
-	}
-}
-function normalizeEcdsaInactiveSealedMaterialRecord(value) {
-	const obj = asRecord(storagePayloadFromSealedStoreRow(value));
-	if (!obj || obj.recordKind !== ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND) return null;
-	if (hasRetiredAuthorizationIdentityField(obj) || obj.thresholdSessionIds != null || obj.ed25519Restore != null) return null;
-	if (obj.curve !== "ecdsa") return null;
-	const authMethod = normalizeAuthMethod(obj.authMethod);
-	const walletId = normalizeOptionalNonEmptyString(obj.walletId);
-	const relayerUrl = normalizeOptionalNonEmptyString(obj.relayerUrl);
-	const ecdsaRestore = normalizeEcdsaInactiveMaterialPublicRestore(obj.ecdsaRestore);
-	const sealedSecretB64u = normalizeOptionalNonEmptyString(obj.sealedSecretB64u);
-	const keyVersion = normalizeOptionalNonEmptyString(obj.keyVersion);
-	const groupId = normalizeOptionalNonEmptyString(obj.groupId);
-	const updatedAtMs = normalizeInteger(obj.updatedAtMs);
-	const authorizationRetirementReason = obj.authorizationRetirementReason;
-	if (!authMethod || !walletId || !relayerUrl || !ecdsaRestore || obj.alg !== "shamir3pass-v2" || obj.storageScope !== "iframe_origin_indexeddb" || obj.secretKind !== "signing_session_secret32" || !sealedSecretB64u || !keyVersion || groupId !== "rfc2409-group2" || obj.issuedAtMs != null || obj.expiresAtMs != null || obj.remainingUses != null || updatedAtMs == null || updatedAtMs <= 0) return null;
-	if (authorizationRetirementReason !== "expired" && authorizationRetirementReason !== "exhausted") return null;
-	const storeKey = makeInactiveEcdsaMaterialStoreKey({
-		walletId,
-		authMethod,
-		restore: ecdsaRestore
-	});
-	if (normalizeOptionalNonEmptyString(obj.storeKey) !== storeKey) return null;
-	return inactiveEcdsaSealedMaterialRecord({
-		storeKey,
-		walletId,
-		relayerUrl,
-		sealedSecretB64u,
-		keyVersion,
-		updatedAtMs,
-		authorizationRetirementReason,
-		authMethod,
-		ecdsaRestore
-	});
-}
-/** Null when the auth method and the restore's source name different factors. */
-function inactiveEcdsaSealedMaterialRecord(args) {
-	const { authMethod, ecdsaRestore } = args;
-	const common = {
-		recordKind: ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND,
-		storeKey: args.storeKey,
-		curve: "ecdsa",
-		walletId: args.walletId,
-		relayerUrl: args.relayerUrl,
-		alg: SIGNING_SESSION_SEAL_ALG,
-		storageScope: SIGNING_SESSION_SEAL_STORAGE_SCOPE,
-		secretKind: SIGNING_SESSION_SECRET_KIND,
-		sealedSecretB64u: args.sealedSecretB64u,
-		keyVersion: args.keyVersion,
-		groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-		updatedAtMs: args.updatedAtMs,
-		authorizationRetirementReason: args.authorizationRetirementReason
-	};
-	if (authMethod === "email_otp" && ecdsaRestore.source === "email_otp") return {
-		...common,
-		authMethod,
-		ecdsaRestore
-	};
-	if (authMethod === "passkey" && ecdsaRestore.source !== "email_otp") return {
-		...common,
-		authMethod,
-		ecdsaRestore
-	};
-	return null;
-}
-function logSealedSessionClassification(args) {
-	if (args.classification.kind === "ecdsa_inactive_material") return;
-	if (args.classification.kind === "rebuild_required") return;
-	if (args.classification.kind === "unrelated_record") return;
-	const outcome = args.classification.kind === "malformed" ? "malformed" : "rejected";
-	const payload = {
-		operation: args.operation,
-		outcome,
-		classificationKind: args.classification.kind,
-		...args.classification
-	};
-	console.warn("[SigningSessionSealedStore] rejected sealed record", payload);
-}
-function buildCurrentSealedSessionRecord(args) {
-	const thresholdSessionId = String(args.thresholdSessionId || "").trim();
-	const curve = normalizeCurve(args.curve);
-	const authMethod = args.authMethod === "passkey" || args.authMethod === "email_otp" ? args.authMethod : void 0;
-	if (!curve || !authMethod) return null;
-	const thresholdSessionIds = thresholdSessionIdsForWrite({
-		thresholdSessionId,
-		curve,
-		thresholdSessionIds: args.thresholdSessionIds
-	});
-	const walletId = normalizeOptionalNonEmptyString(args.walletId);
-	const sealedSecretB64u = normalizeOptionalNonEmptyString(args.sealedSecretB64u);
-	const expiresAtMs = normalizeInteger(args.expiresAtMs);
-	const remainingUses = normalizeInteger(args.remainingUses);
-	const issuedAtMs = normalizeInteger(args.issuedAtMs);
-	const updatedAtMs = normalizeInteger(args.updatedAtMs);
-	const keyVersion = normalizeOptionalNonEmptyString(args.keyVersion);
-	if (!thresholdSessionId || !sealedSecretB64u || !keyVersion || args.groupId !== "rfc2409-group2") return null;
-	if (!thresholdSessionIds.ed25519 && !thresholdSessionIds.ecdsa) return null;
-	if (issuedAtMs == null || issuedAtMs <= 0) return null;
-	if (expiresAtMs == null || expiresAtMs <= 0) return null;
-	if (remainingUses == null || remainingUses < 0) return null;
-	if (updatedAtMs == null || updatedAtMs <= 0) return null;
-	const ecdsaRestore = normalizeEcdsaRestoreMetadata(args.ecdsaRestore);
-	const ed25519Restore = normalizeCurrentEd25519RestoreMetadata(args.ed25519Restore);
-	if (hasStaleSealedSessionWalletIdentityFields(args)) return null;
-	if (curve === "ecdsa") {
-		if (!ecdsaRestore?.chainTarget || !walletId) return null;
-		if (hasTopLevelSigningRootFields(args)) return null;
-	}
-	let signingRootIdForWrite;
-	let signingRootVersionForWrite;
-	if (args.curve === "ed25519") {
-		signingRootIdForWrite = normalizeOptionalNonEmptyString(args.signingRootId);
-		signingRootVersionForWrite = normalizeOptionalNonEmptyString(args.signingRootVersion);
-	}
-	const classification = classifyRawSealedSessionRecord({
-		...currentSealedRecordHeader(authMethod),
-		thresholdSessionIds,
-		sealedSecretB64u,
-		curve,
-		...walletId ? { walletId } : {},
-		...signingRootIdForWrite ? { signingRootId: signingRootIdForWrite } : {},
-		...signingRootVersionForWrite ? { signingRootVersion: signingRootVersionForWrite } : {},
-		...normalizeOptionalNonEmptyString(args.relayerUrl) ? { relayerUrl: normalizeOptionalNonEmptyString(args.relayerUrl) } : {},
-		keyVersion,
-		groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-		...ecdsaRestore ? { ecdsaRestore } : {},
-		...ed25519Restore ? { ed25519Restore } : {},
-		issuedAtMs,
-		expiresAtMs,
-		remainingUses,
-		updatedAtMs
-	});
-	if (classification.kind !== "current") {
-		logSealedSessionClassification({
-			operation: "build current sealed session record",
-			classification
-		});
-		return null;
-	}
-	return classification.record;
-}
-function thresholdSessionIdsForWrite(args) {
-	const explicit = normalizeThresholdSessionIds(args.thresholdSessionIds);
-	const thresholdSessionId = String(args.thresholdSessionId || "").trim();
-	if (!thresholdSessionId) return {};
-	if (args.curve === "ed25519" && explicit.ed25519 === thresholdSessionId) return explicit;
-	if (args.curve === "ecdsa" && explicit.ecdsa === thresholdSessionId) return explicit;
-	return {};
-}
-function buildEcdsaInactiveMaterialPublicRestore(restore, relayerUrlRaw) {
-	const relayerUrl = normalizeOptionalNonEmptyString(relayerUrlRaw);
-	const ecdsaThresholdKeyId = normalizeOptionalNonEmptyString(restore.ecdsaThresholdKeyId);
-	const thresholdEcdsaPublicKeyB64u = normalizeOptionalNonEmptyString(restore.thresholdEcdsaPublicKeyB64u);
-	if (!relayerUrl || !ecdsaThresholdKeyId || !thresholdEcdsaPublicKeyB64u) return null;
-	let runtimePolicyScope;
-	try {
-		runtimePolicyScope = normalizeRuntimePolicyScope(restore.runtimePolicyScope);
-	} catch {
-		return null;
-	}
-	const base = {
-		chainTarget: restore.chainTarget,
-		signingRootId: restore.signingRootId,
-		signingRootVersion: restore.signingRootVersion,
-		keyHandle: restore.keyHandle,
-		ecdsaThresholdKeyId,
-		ethereumAddress: restore.ethereumAddress,
-		relayerKeyId: restore.relayerKeyId,
-		thresholdEcdsaPublicKeyB64u,
-		participantIds: [...restore.participantIds],
-		runtimePolicyScope,
-		routerAbEcdsaDerivationNormalSigning: restore.routerAbEcdsaDerivationNormalSigning,
-		publicCapability: restore.publicCapability
-	};
-	switch (restore.source) {
-		case "email_otp": return {
-			...base,
-			source: "email_otp",
-			provider: restore.provider,
-			providerSubjectId: restore.providerSubjectId,
-			emailHashHex: restore.emailHashHex,
-			authority: restore.authority,
-			emailOtpAuthority: restore.emailOtpAuthority,
-			roleLocalMaterialRef: parseEcdsaRoleLocalPersistedMaterialRef(restore.roleLocalMaterialRef)
-		};
-		case "login":
-		case "registration":
-		case "manual-bootstrap": return {
-			...base,
-			source: restore.source,
-			authority: restore.authority,
-			roleLocalMaterialRef: parseEcdsaRoleLocalPersistedMaterialRef(restore.roleLocalMaterialRef),
-			rpId: restore.rpId,
-			credentialIdB64u: restore.credentialIdB64u
-		};
-	}
-}
-function buildInactiveEcdsaSealedMaterial(args) {
-	const record = args.record;
-	const publicRestore = buildEcdsaInactiveMaterialPublicRestore(record.ecdsaRestore, record.relayerUrl);
-	if (!publicRestore) return null;
-	return inactiveEcdsaSealedMaterialRecord({
-		storeKey: makeInactiveEcdsaMaterialStoreKey({
-			walletId: record.walletId,
-			authMethod: record.authMethod,
-			restore: publicRestore
-		}),
-		walletId: record.walletId,
-		relayerUrl: record.relayerUrl,
-		sealedSecretB64u: record.sealedSecretB64u,
-		keyVersion: record.keyVersion,
-		updatedAtMs: args.updatedAtMs,
-		authorizationRetirementReason: args.retirement,
-		authMethod: record.authMethod,
-		ecdsaRestore: publicRestore
-	});
-}
-function requireInactiveEcdsaSealedMaterial(args) {
-	const inactiveMaterial = buildInactiveEcdsaSealedMaterial(args);
-	if (!inactiveMaterial) throw new Error("[SigningSessionSealedStore] inactive ECDSA material requires exact public restore facts");
-	return inactiveMaterial;
-}
-//#endregion
-export { buildCurrentSealedSessionRecord, buildEcdsaInactiveMaterialPublicRestore, classifyNonCurrentRecord, classifyRawSealedSessionRecord, hasRetiredAuthorizationIdentityField, inactiveEcdsaMaterialStorageRow, logSealedSessionClassification, makeInactiveEcdsaMaterialStoreKey, normalizeSigningSessionSealedStoreRecord, normalizeThresholdSessionIdsFromStoredRecord, requireInactiveEcdsaSealedMaterial, sealedRecordStorageRow, storagePayloadFromSealedStoreRow };
-
-//# sourceMappingURL=sealedSessionRecords.js.map