@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/react/core/signingEngine/session/persistence/sealedSessionStore.js

@@ -1,518 +0,0 @@
-import { secureRandomId } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { normalizeInteger, normalizeOptionalNonEmptyString } from "../../../../shared-ts/src/utils/normalize.js";
-import { asRecord } from "../../../../shared-ts/src/utils/validation.js";
-import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
-import { signingSessionSealsRepository } from "../../../indexedDB/seamsWalletDB/signingSessionSeals.js";
-import { exactSealedSessionFilterForIdentity } from "./durableSealedSessionCommands.js";
-import { buildEcdsaInactiveMaterialPublicRestore, classifyNonCurrentRecord, classifyRawSealedSessionRecord, hasRetiredAuthorizationIdentityField, inactiveEcdsaMaterialStorageRow, logSealedSessionClassification, makeInactiveEcdsaMaterialStoreKey, normalizeSigningSessionSealedStoreRecord, normalizeThresholdSessionIdsFromStoredRecord, requireInactiveEcdsaSealedMaterial, sealedRecordStorageRow, storagePayloadFromSealedStoreRow } from "./sealedSessionRecords.js";
-//#region src/core/signingEngine/session/persistence/sealedSessionStore.ts
-const DEFAULT_RESTORE_LEASE_TTL_MS = 15e3;
-function createRandomId(prefix) {
-	return secureRandomId(prefix, 32, "sealed signing session restore IDs");
-}
-function restoreLeaseStorageRow(lease) {
-	return {
-		lease_key: lease.leaseKey,
-		owner_id: lease.ownerId,
-		attempt_id: lease.attemptId,
-		started_at_ms: lease.startedAtMs,
-		expires_at_ms: lease.expiresAtMs,
-		lease
-	};
-}
-function sealedRecordAccountKeys(record) {
-	const keys = /* @__PURE__ */ new Set();
-	const walletId = normalizeOptionalNonEmptyString(record.walletId);
-	if (walletId) keys.add(walletId);
-	return keys;
-}
-function sealedRecordsShareAccount(left, right) {
-	const leftKeys = sealedRecordAccountKeys(left);
-	if (!leftKeys.size) return false;
-	for (const key of sealedRecordAccountKeys(right)) if (leftKeys.has(key)) return true;
-	return false;
-}
-function sealedRecordsHaveSamePurpose(left, right) {
-	if (!sealedRecordsShareAccount(left, right)) return false;
-	if (left.authMethod !== right.authMethod || left.curve !== right.curve) return false;
-	if (left.curve === "ed25519" && right.curve === "ed25519") return mpcMaterialActivationRefsEqual(left.ed25519Restore.materialActivation, right.ed25519Restore.materialActivation);
-	if (left.curve === "ecdsa") {
-		const leftKeyHandle = normalizeOptionalNonEmptyString(left.ecdsaRestore?.keyHandle);
-		const rightKeyHandle = normalizeOptionalNonEmptyString(right.ecdsaRestore?.keyHandle);
-		if (!leftKeyHandle || !rightKeyHandle || leftKeyHandle !== rightKeyHandle) return false;
-		const leftTarget = left.ecdsaRestore?.chainTarget;
-		const rightTarget = right.ecdsaRestore?.chainTarget;
-		if (!leftTarget || !rightTarget) return false;
-		if (!thresholdEcdsaChainTargetsEqual(leftTarget, rightTarget)) return false;
-	}
-	return true;
-}
-function exactEd25519PublicIdentityKey(record) {
-	return alphabetizeStringify({
-		storeKey: record.storeKey,
-		walletId: record.walletId,
-		authMethod: record.authMethod,
-		signingRootId: record.signingRootId ?? null,
-		signingRootVersion: record.signingRootVersion ?? null,
-		restore: record.ed25519Restore
-	});
-}
-function persistedEd25519Record(entry, record) {
-	if (typeof entry.primaryKey !== "string" || !entry.primaryKey.trim()) throw new Error("[SigningSessionSealedStore] exact Ed25519 record key is invalid");
-	return {
-		primaryKey: entry.primaryKey,
-		record
-	};
-}
-function preferredExactEd25519Record(left, right) {
-	if (left.record.updatedAtMs !== right.record.updatedAtMs) return left.record.updatedAtMs > right.record.updatedAtMs ? left : right;
-	if (left.primaryKey === left.record.storeKey) return left;
-	if (right.primaryKey === right.record.storeKey) return right;
-	return left.primaryKey.localeCompare(right.primaryKey) <= 0 ? left : right;
-}
-async function compactExactEd25519Records(matches, options = { writeCanonical: false }) {
-	const first = matches[0];
-	if (!first) return null;
-	const exactIdentity = exactEd25519PublicIdentityKey(first.record);
-	for (const match of matches.slice(1)) if (exactEd25519PublicIdentityKey(match.record) !== exactIdentity) throw new Error("[SigningSessionSealedStore] exact Ed25519 material has conflicting public identity facts");
-	const selected = matches.reduce(preferredExactEd25519Record);
-	const canonicalStoreKey = selected.record.storeKey;
-	const staleStoreKeys = [...new Set(matches.map((match) => match.primaryKey))].filter((primaryKey) => primaryKey !== canonicalStoreKey);
-	if (options.writeCanonical || staleStoreKeys.length > 0 || selected.primaryKey !== canonicalStoreKey) await signingSessionSealsRepository.replaceSealedRecord({
-		row: sealedRecordStorageRow(selected.record),
-		staleStoreKeys
-	});
-	return selected.record;
-}
-async function classifyPersistedSealedRecord(entry) {
-	const payload = storagePayloadFromSealedStoreRow(entry.value);
-	const classification = classifyRawSealedSessionRecord(payload);
-	if (classification.kind !== "current") return classification;
-	const raw = asRecord(payload);
-	if (hasRetiredAuthorizationIdentityField(asRecord(entry.value)) || hasRetiredAuthorizationIdentityField(raw)) return classifyNonCurrentRecord("delete_required", raw, "invalid_identity");
-	return classification;
-}
-function rawThresholdSessionIdsFromSealedStoreRow(value) {
-	return normalizeThresholdSessionIdsFromStoredRecord(storagePayloadFromSealedStoreRow(value));
-}
-/** Logs a record that is not current, and queues it for deletion when it cannot be kept. */
-function setAsideRejectedSealedRecord(operation, classification, primaryKey, deletePrimaryKeys) {
-	logSealedSessionClassification({
-		operation,
-		classification
-	});
-	if (classification.kind === "delete_required" || classification.kind === "malformed") deletePrimaryKeys.push(primaryKey);
-}
-function normalizeSigningSessionRestoreLease(value) {
-	const obj = asRecord(value);
-	if (!obj) return null;
-	if (asRecord(obj.lease)) return normalizeSigningSessionRestoreLease(obj.lease);
-	if (Number(obj.v) !== 1) return null;
-	if (hasRetiredAuthorizationIdentityField(obj)) return null;
-	const leaseKey = normalizeOptionalNonEmptyString(obj.leaseKey);
-	const ownerId = normalizeOptionalNonEmptyString(obj.ownerId);
-	const attemptId = normalizeOptionalNonEmptyString(obj.attemptId);
-	const startedAtMs = normalizeInteger(obj.startedAtMs);
-	const expiresAtMs = normalizeInteger(obj.expiresAtMs);
-	if (!leaseKey || !ownerId || !attemptId) return null;
-	if (startedAtMs == null || startedAtMs <= 0) return null;
-	if (expiresAtMs == null || expiresAtMs <= startedAtMs) return null;
-	return {
-		v: 1,
-		leaseKey,
-		ownerId,
-		attemptId,
-		startedAtMs,
-		expiresAtMs
-	};
-}
-function makeSigningSessionRestoreLease(args) {
-	return {
-		v: 1,
-		leaseKey: args.leaseKey,
-		ownerId: args.ownerId,
-		attemptId: createRandomId("restore-attempt"),
-		startedAtMs: args.nowMs,
-		expiresAtMs: args.nowMs + args.ttlMs
-	};
-}
-function recordMatchesFilter(record, thresholdSessionId, filter) {
-	if (record.authMethod !== filter.authMethod) return false;
-	if (record.thresholdSessionIds[filter.curve] !== thresholdSessionId) return false;
-	if (filter.curve === "ecdsa" && (!record.ecdsaRestore?.chainTarget || !thresholdEcdsaChainTargetsEqual(record.ecdsaRestore.chainTarget, filter.chainTarget))) return false;
-	return true;
-}
-function requireSealedRecordPurpose(filter, operation) {
-	if (filter?.authMethod && filter.curve === "ed25519") return filter;
-	if (filter?.authMethod && filter.curve === "ecdsa" && filter.chainTarget) return filter;
-	console.warn("[SigningSessionSealedStore] rejected ambiguous sealed record access", { operation });
-	throw new Error(`[SigningSessionSealedStore] ${operation} requires an explicit authMethod, curve, and ECDSA chain target`);
-}
-async function collectRawSealedRecordEntriesByThresholdSessionId(thresholdSessionId) {
-	const entries = await signingSessionSealsRepository.collectRawSealedRecordEntriesByThresholdSessionId(thresholdSessionId);
-	if (entries.length) return entries;
-	return (await signingSessionSealsRepository.collectAllRawSealedRecordEntries()).filter((entry) => {
-		const rawThresholdSessionIds = rawThresholdSessionIdsFromSealedStoreRow(entry.value);
-		return rawThresholdSessionIds.ed25519 === thresholdSessionId || rawThresholdSessionIds.ecdsa === thresholdSessionId;
-	});
-}
-async function readRecordByThresholdSessionId(thresholdSessionId, filter, operation) {
-	const entries = await collectRawSealedRecordEntriesByThresholdSessionId(thresholdSessionId);
-	let selected = null;
-	const exactEd25519Matches = [];
-	const deletePrimaryKeys = [];
-	for (const entry of entries) {
-		const classification = await classifyPersistedSealedRecord(entry);
-		if (classification.kind === "current") {
-			if (recordMatchesFilter(classification.record, thresholdSessionId, filter)) {
-				selected = classification.record;
-				if (classification.record.curve === "ed25519") exactEd25519Matches.push(persistedEd25519Record(entry, classification.record));
-			}
-			continue;
-		}
-		setAsideRejectedSealedRecord(operation, classification, entry.primaryKey, deletePrimaryKeys);
-	}
-	await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
-	if (exactEd25519Matches.length > 0) return await compactExactEd25519Records(exactEd25519Matches);
-	return selected;
-}
-async function deleteRecordByThresholdSessionId(thresholdSessionId, filter) {
-	try {
-		const entries = await collectRawSealedRecordEntriesByThresholdSessionId(thresholdSessionId);
-		const deletePrimaryKeys = [];
-		for (const entry of entries) {
-			const classification = await classifyPersistedSealedRecord(entry);
-			const record = classification.kind === "current" ? classification.record : null;
-			if (record?.storeKey && recordMatchesFilter(record, thresholdSessionId, filter)) deletePrimaryKeys.push(entry.primaryKey);
-		}
-		await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
-	} catch {}
-}
-async function listSameScopeRecords(record) {
-	if (!sealedRecordAccountKeys(record).size || !record.authMethod) return [];
-	try {
-		const all = await signingSessionSealsRepository.collectAllRawSealedRecordEntries();
-		const records = [];
-		for (const entry of all) {
-			const classification = await classifyPersistedSealedRecord(entry);
-			const existing = classification.kind === "current" ? classification.record : null;
-			if (!existing) continue;
-			if (existing.storeKey === record.storeKey) continue;
-			if (sealedRecordsHaveSamePurpose(existing, record)) records.push(existing);
-		}
-		return records;
-	} catch {
-		return [];
-	}
-}
-function inactiveMaterialStoreKeyReplacedByCurrent(record) {
-	if (record.curve !== "ecdsa") return null;
-	const publicRestore = buildEcdsaInactiveMaterialPublicRestore(record.ecdsaRestore, record.relayerUrl);
-	if (!publicRestore) return null;
-	return makeInactiveEcdsaMaterialStoreKey({
-		walletId: record.walletId,
-		authMethod: record.authMethod,
-		restore: publicRestore
-	});
-}
-async function readExactSealedSession(thresholdSessionIdRaw, filter) {
-	const purpose = requireSealedRecordPurpose(filter, "read");
-	const thresholdSessionId = String(thresholdSessionIdRaw || "").trim();
-	if (!thresholdSessionId) return null;
-	return await readRecordByThresholdSessionId(thresholdSessionId, purpose, "read");
-}
-function recordMatchesEd25519Locator(record, locator) {
-	return record.curve === "ed25519" && record.authMethod === locator.authMethod && mpcMaterialActivationRefsEqual(record.ed25519Restore.materialActivation, locator.materialActivation);
-}
-async function readExactEd25519SealedSession(locator) {
-	const entries = await signingSessionSealsRepository.collectAllRawSealedRecordEntries();
-	const deletePrimaryKeys = [];
-	const matches = [];
-	for (const entry of entries) {
-		const classification = await classifyPersistedSealedRecord(entry);
-		if (classification.kind === "current") {
-			const record = classification.record;
-			if (recordMatchesEd25519Locator(record, locator)) matches.push(persistedEd25519Record(entry, record));
-			continue;
-		}
-		setAsideRejectedSealedRecord("read exact Ed25519 material", classification, entry.primaryKey, deletePrimaryKeys);
-	}
-	await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
-	return await compactExactEd25519Records(matches);
-}
-async function listExactSealedSessionsForWallet(args) {
-	const walletId = normalizeOptionalNonEmptyString(args.walletId);
-	if (!walletId) return [];
-	const purpose = requireSealedRecordPurpose(args.filter, "list exact account records");
-	const chainTarget = args.filter.curve === "ecdsa" ? args.filter.chainTarget : void 0;
-	const values = await signingSessionSealsRepository.collectAllRawSealedRecordEntries();
-	const deletePrimaryKeys = [];
-	try {
-		const records = [];
-		const seen = /* @__PURE__ */ new Set();
-		const ed25519RecordsByCanonicalKey = /* @__PURE__ */ new Map();
-		for (const value of values) {
-			const classification = await classifyPersistedSealedRecord(value);
-			if (classification.kind !== "current") {
-				setAsideRejectedSealedRecord("list exact account records", classification, value.primaryKey, deletePrimaryKeys);
-				continue;
-			}
-			const record = classification.record;
-			if (record.walletId !== walletId) continue;
-			if (record.authMethod !== purpose.authMethod) continue;
-			if (!record.thresholdSessionIds[purpose.curve]) continue;
-			if (chainTarget && (!record.ecdsaRestore?.chainTarget || !thresholdEcdsaChainTargetsEqual(record.ecdsaRestore.chainTarget, chainTarget))) continue;
-			if (record.curve === "ed25519") {
-				const exactRecords = ed25519RecordsByCanonicalKey.get(record.storeKey) ?? [];
-				exactRecords.push(persistedEd25519Record(value, record));
-				ed25519RecordsByCanonicalKey.set(record.storeKey, exactRecords);
-				continue;
-			}
-			if (seen.has(record.storeKey)) continue;
-			seen.add(record.storeKey);
-			records.push(record);
-		}
-		for (const exactRecords of ed25519RecordsByCanonicalKey.values()) {
-			const compacted = await compactExactEd25519Records(exactRecords);
-			if (compacted) records.push(compacted);
-		}
-		await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
-		return records;
-	} finally {
-		await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
-	}
-}
-async function listEcdsaSealedSessionsForWallet(args) {
-	const walletId = normalizeOptionalNonEmptyString(args.walletId);
-	if (!walletId) return [];
-	if (args.filter.curve !== "ecdsa") {
-		console.warn("[SigningSessionSealedStore] rejected non-ECDSA wallet-scoped list", { operation: "list wallet ecdsa records" });
-		return [];
-	}
-	const values = await signingSessionSealsRepository.collectAllRawSealedRecordEntries();
-	const deletePrimaryKeys = [];
-	try {
-		const records = [];
-		const seen = /* @__PURE__ */ new Set();
-		for (const value of values) {
-			const classification = await classifyPersistedSealedRecord(value);
-			if (classification.kind === "ecdsa_inactive_material") {
-				const record = classification.record;
-				if (record.walletId !== walletId) continue;
-				if (args.filter.authMethod && record.authMethod !== args.filter.authMethod) continue;
-				if (seen.has(record.storeKey)) continue;
-				seen.add(record.storeKey);
-				records.push(record);
-				continue;
-			}
-			if (classification.kind !== "current") {
-				setAsideRejectedSealedRecord("list wallet ecdsa records", classification, value.primaryKey, deletePrimaryKeys);
-				continue;
-			}
-			const record = classification.record;
-			if (record.walletId !== walletId) continue;
-			if (args.filter.authMethod && record.authMethod !== args.filter.authMethod) continue;
-			if (!record.thresholdSessionIds.ecdsa) continue;
-			if (!record.ecdsaRestore?.chainTarget) continue;
-			if (seen.has(record.storeKey)) continue;
-			seen.add(record.storeKey);
-			records.push(record);
-		}
-		await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
-		return records;
-	} finally {
-		await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
-	}
-}
-async function writeExactSealedSession(record) {
-	const classification = classifyRawSealedSessionRecord(record);
-	if (classification.kind !== "current") {
-		logSealedSessionClassification({
-			operation: "write exact sealed session",
-			classification
-		});
-		return;
-	}
-	const currentRecord = classification.record;
-	if (currentRecord.curve === "ed25519") {
-		const matches = [{
-			primaryKey: currentRecord.storeKey,
-			record: currentRecord
-		}];
-		const entries = await signingSessionSealsRepository.collectAllRawSealedRecordEntries();
-		for (const entry of entries) {
-			const persisted = await classifyPersistedSealedRecord(entry);
-			if (persisted.kind === "current" && persisted.record.curve === "ed25519" && persisted.record.storeKey === currentRecord.storeKey) matches.push(persistedEd25519Record(entry, persisted.record));
-		}
-		await compactExactEd25519Records(matches, { writeCanonical: true });
-		return;
-	}
-	const staleRecords = await listSameScopeRecords(currentRecord);
-	const replacedInactiveMaterialStoreKey = inactiveMaterialStoreKeyReplacedByCurrent(currentRecord);
-	await signingSessionSealsRepository.replaceSealedRecord({
-		row: sealedRecordStorageRow(currentRecord),
-		staleStoreKeys: [...staleRecords.map((record) => record.storeKey), ...replacedInactiveMaterialStoreKey ? [replacedInactiveMaterialStoreKey] : []]
-	});
-}
-function retireEcdsaSealedSession(record, retirement, updatedAtMs) {
-	return writeInactiveEcdsaSealedMaterial({
-		current: record,
-		inactive: requireInactiveEcdsaSealedMaterial({
-			record,
-			retirement,
-			updatedAtMs
-		})
-	});
-}
-async function writeInactiveEcdsaSealedMaterial(args) {
-	await signingSessionSealsRepository.replaceSealedRecordAndDeleteRestoreLease({
-		row: inactiveEcdsaMaterialStorageRow(args.inactive),
-		staleStoreKeys: [args.current.storeKey],
-		restoreLeaseKey: args.current.storeKey
-	});
-}
-async function updateExactSealedSessionPolicy(args) {
-	const purpose = requireSealedRecordPurpose(args.filter, "update policy");
-	const thresholdSessionId = String(args.thresholdSessionId || "").trim();
-	if (!thresholdSessionId) return;
-	const existing = await readExactSealedSession(thresholdSessionId, purpose);
-	if (!existing) return;
-	await writeUpdatedSealedSessionPolicy(existing, args);
-}
-async function updateExactEd25519SealedSessionPolicy(args) {
-	const existing = await readExactEd25519SealedSession(args.locator);
-	if (!existing) return;
-	await writeUpdatedSealedSessionPolicy(existing, args);
-}
-async function writeUpdatedSealedSessionPolicy(existing, args) {
-	const expiresAtMs = normalizeInteger(args.expiresAtMs ?? existing.expiresAtMs);
-	const remainingUses = normalizeInteger(args.remainingUses ?? existing.remainingUses);
-	const updatedAtMs = normalizeInteger(args.updatedAtMs);
-	if (expiresAtMs == null || expiresAtMs <= 0) return;
-	if (remainingUses == null || remainingUses < 0) return;
-	if (updatedAtMs == null || updatedAtMs <= 0) return;
-	const updatedRecord = {
-		...existing,
-		expiresAtMs,
-		remainingUses,
-		updatedAtMs
-	};
-	if (updatedRecord.curve === "ecdsa") {
-		const retirement = expiresAtMs <= Date.now() ? "expired" : remainingUses === 0 ? "exhausted" : null;
-		if (retirement) {
-			await retireEcdsaSealedSession(updatedRecord, retirement, updatedAtMs);
-			return;
-		}
-	}
-	await writeExactSealedSession(updatedRecord);
-}
-async function deleteExactSealedSession(thresholdSessionIdRaw, filter, options) {
-	const purpose = requireSealedRecordPurpose(filter, "delete");
-	const thresholdSessionId = String(thresholdSessionIdRaw || "").trim();
-	if (!thresholdSessionId) return;
-	const record = await readRecordByThresholdSessionId(thresholdSessionId, purpose, "delete");
-	await deleteRecordByThresholdSessionId(thresholdSessionId, purpose);
-	if (record && options.deleteResolvedIdentity) await signingSessionSealsRepository.deleteRestoreLease(record.storeKey);
-}
-async function deleteExactEd25519SealedSession(locator, options) {
-	const entries = await signingSessionSealsRepository.collectAllRawSealedRecordEntries();
-	const deletePrimaryKeys = [];
-	const restoreLeaseKeys = [];
-	for (const entry of entries) {
-		const classification = await classifyPersistedSealedRecord(entry);
-		if (classification.kind !== "current") {
-			logSealedSessionClassification({
-				operation: "delete exact Ed25519 material",
-				classification
-			});
-			continue;
-		}
-		const record = classification.record;
-		if (!recordMatchesEd25519Locator(record, locator)) continue;
-		deletePrimaryKeys.push(entry.primaryKey);
-		if (options.deleteResolvedIdentity) restoreLeaseKeys.push(record.storeKey);
-	}
-	await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
-	if (options.deleteResolvedIdentity) for (const leaseKey of restoreLeaseKeys) await signingSessionSealsRepository.deleteRestoreLease(leaseKey);
-}
-async function deleteDurableSealedSessionRecord(command) {
-	const options = command.preserveResolvedIdentity ? { deleteResolvedIdentity: false } : {
-		deleteResolvedIdentity: true,
-		resolvedIdentityDeleteReason: "durable_record_deleted"
-	};
-	if (command.durableRecord.curve === "ed25519") {
-		await deleteExactEd25519SealedSession({
-			kind: "ed25519_durable_material",
-			authMethod: command.durableRecord.authMethod,
-			materialActivation: command.durableRecord.materialActivation
-		}, options);
-		return;
-	}
-	const filter = exactSealedSessionFilterForIdentity(command.durableRecord);
-	const existingRecord = await readExactSealedSessionOrNull(command.durableRecord.thresholdSessionId, filter);
-	if (command.preserveResolvedIdentity && command.durableRecord.curve === "ecdsa" && existingRecord?.curve === "ecdsa" && (command.deleteReason === "expired" || command.deleteReason === "exhausted")) {
-		await retireEcdsaSealedSession(existingRecord, command.deleteReason, Date.now());
-		return;
-	}
-	await deleteExactSealedSession(command.durableRecord.thresholdSessionId, filter, options);
-}
-async function readExactSealedSessionOrNull(thresholdSessionId, filter) {
-	try {
-		return await readExactSealedSession(thresholdSessionId, filter);
-	} catch {
-		return null;
-	}
-}
-async function acquireSigningSessionRestoreLease(args) {
-	const purpose = requireSealedRecordPurpose(args, "acquire restore lease");
-	const thresholdSessionId = String(args.thresholdSessionId || "").trim();
-	if (!thresholdSessionId) return null;
-	const nowMs = normalizeInteger(args.nowMs ?? Date.now()) ?? Date.now();
-	const ttlMs = Math.max(1, normalizeInteger(args.ttlMs ?? DEFAULT_RESTORE_LEASE_TTL_MS) ?? DEFAULT_RESTORE_LEASE_TTL_MS);
-	const ownerId = normalizeOptionalNonEmptyString(args.ownerId) || createRandomId("restore-owner");
-	if (!await readRecordByThresholdSessionId(thresholdSessionId, purpose, "acquire restore lease")) return null;
-	return await signingSessionSealsRepository.withRestoreLeaseTransaction(thresholdSessionId, async (tx) => {
-		const records = [];
-		for (const entry of tx.entries) {
-			const normalized = normalizeSigningSessionSealedStoreRecord(entry.value);
-			if (normalized?.storeKey && !records.some((record) => record.storeKey === normalized.storeKey)) records.push(normalized);
-		}
-		const record = records.find((candidate) => recordMatchesFilter(candidate, thresholdSessionId, purpose)) || null;
-		if (!record) {
-			tx.abort();
-			return null;
-		}
-		const existing = normalizeSigningSessionRestoreLease(await tx.getRawRestoreLease(record.storeKey));
-		if (existing && existing.expiresAtMs > nowMs && existing.ownerId !== ownerId) {
-			tx.abort();
-			return null;
-		}
-		const lease = makeSigningSessionRestoreLease({
-			leaseKey: record.storeKey,
-			ownerId,
-			nowMs,
-			ttlMs
-		});
-		tx.putRestoreLease(restoreLeaseStorageRow(lease));
-		return {
-			...lease,
-			thresholdSessionId
-		};
-	});
-}
-async function releaseSigningSessionRestoreLease(lease) {
-	if (!lease?.leaseKey || !lease.ownerId || !lease.attemptId) return;
-	await signingSessionSealsRepository.deleteRestoreLeaseIf({
-		leaseKey: lease.leaseKey,
-		shouldDelete: (rawLease) => {
-			const existing = normalizeSigningSessionRestoreLease(rawLease);
-			return existing?.ownerId === lease.ownerId && existing.attemptId === lease.attemptId;
-		}
-	});
-}
-//#endregion
-export { acquireSigningSessionRestoreLease, deleteDurableSealedSessionRecord, listEcdsaSealedSessionsForWallet, listExactSealedSessionsForWallet, readExactEd25519SealedSession, readExactSealedSession, releaseSigningSessionRestoreLease, updateExactEd25519SealedSessionPolicy, updateExactSealedSessionPolicy, writeExactSealedSession };
-
-//# sourceMappingURL=sealedSessionStore.js.map

package/dist/esm/react/core/signingEngine/session/persistence/walletSessionAuthorizationProjection.js

@@ -1,51 +0,0 @@
-//#region src/core/signingEngine/session/persistence/walletSessionAuthorizationProjection.ts
-function exactWalletSessionAuthorityIdentity(args) {
-	return {
-		walletId: args.authority.walletId,
-		authorityId: args.authority.authorityId,
-		walletAuthMethodId: args.walletAuthMethodId,
-		authorityDigestB64u: args.authority.authorityDigestB64u,
-		authorityRevocationEpoch: args.authority.revocationEpoch
-	};
-}
-function validateExactWalletSessionAuthorization(args) {
-	const { walletSession, operationCredential } = args;
-	if (walletSession.walletId !== args.walletId || walletSession.authMethodId !== args.authority.walletAuthMethodId || walletSession.authorizationId !== args.expectedAuthorizationId || walletSession.quotaId !== args.expectedQuotaId || walletSession.expiresAtMs !== args.expectedExpiresAtMs || operationCredential.walletSessionId !== args.expectedWalletSessionId) throw new Error("ECDSA bootstrap exact Wallet Session authority does not match its request");
-	return {
-		record: walletSession,
-		operationCredential
-	};
-}
-function validateExactWalletSessionAuthorityIdentity(args) {
-	if (args.walletSession.walletId !== args.expected.walletId || args.walletSession.authorityId !== args.expected.authorityId || args.walletSession.authMethodId !== args.expected.walletAuthMethodId || args.walletSession.authorityDigestB64u !== args.expected.authorityDigestB64u || args.walletSession.authorityRevocationEpoch !== args.expected.authorityRevocationEpoch) throw new Error("ECDSA bootstrap exact Wallet Session authority identity changed");
-}
-async function persistActiveWalletSessionAuthorizationFromDirectRegistration(writer, session) {
-	return {
-		record: await writer.writeExactWithOperationCredential({
-			record: session.walletSession,
-			operationCredential: session.operationCredential
-		}),
-		operationCredential: session.operationCredential
-	};
-}
-async function persistExactWalletSessionAuthorizationFromEcdsaBootstrap(writer, args) {
-	const session = args.bootstrap.session;
-	const exact = validateExactWalletSessionAuthorization({
-		walletId: args.walletId,
-		authority: args.authority,
-		walletSession: session.walletSession,
-		operationCredential: session.operationCredential,
-		expectedAuthorizationId: session.authorizationId,
-		expectedWalletSessionId: session.walletSessionId,
-		expectedQuotaId: session.quotaId,
-		expectedExpiresAtMs: session.expiresAtMs
-	});
-	return {
-		record: await writer.writeExactWithOperationCredential(exact),
-		operationCredential: exact.operationCredential
-	};
-}
-//#endregion
-export { exactWalletSessionAuthorityIdentity, persistActiveWalletSessionAuthorizationFromDirectRegistration, persistExactWalletSessionAuthorizationFromEcdsaBootstrap, validateExactWalletSessionAuthorityIdentity, validateExactWalletSessionAuthorization };
-
-//# sourceMappingURL=walletSessionAuthorizationProjection.js.map

package/dist/esm/react/core/signingEngine/session/planning/operationFingerprint.js

@@ -1,30 +0,0 @@
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import { SigningSessionIds } from "../operationState/types.js";
-import "../../../../shared-ts/src/authorization/operationFingerprint.js";
-//#region src/core/signingEngine/session/planning/operationFingerprint.ts
-async function computeSigningOperationFingerprint(args) {
-	const digest = await sha256BytesUtf8(alphabetizeStringify({
-		kind: String(args.kind || "").trim() || "unknown",
-		payload: normalizeOperationFingerprintValue(args.payload)
-	}));
-	return SigningSessionIds.signingOperationFingerprint(`sha256:${base64UrlEncode(digest)}`);
-}
-function normalizeOperationFingerprintValue(value) {
-	if (typeof value === "bigint") return value.toString(10);
-	if (value instanceof Uint8Array) return { __bytesB64u: base64UrlEncode(value) };
-	if (ArrayBuffer.isView(value)) return { __bytesB64u: base64UrlEncode(new Uint8Array(value.buffer, value.byteOffset, value.byteLength)) };
-	if (value instanceof ArrayBuffer) return { __bytesB64u: base64UrlEncode(new Uint8Array(value)) };
-	if (Array.isArray(value)) return value.map(normalizeOperationFingerprintValue);
-	if (!value || typeof value !== "object") return value;
-	const out = {};
-	for (const key of Object.keys(value).sort()) {
-		const next = normalizeOperationFingerprintValue(value[key]);
-		if (next !== void 0) out[key] = next;
-	}
-	return out;
-}
-//#endregion
-export { computeSigningOperationFingerprint };
-
-//# sourceMappingURL=operationFingerprint.js.map

package/dist/esm/react/core/signingEngine/session/planning/operationIdBinding.js

@@ -1,36 +0,0 @@
-//#region src/core/signingEngine/session/planning/operationIdBinding.ts
-const MAX_BOUND_CALLER_OPERATION_IDS = 1024;
-function bindCallerProvidedSigningOperationIdToFingerprint(args) {
-	const operationId = String(args.operationId || "").trim();
-	const fingerprint = String(args.operationFingerprint || "").trim();
-	if (!operationId) throw new Error("[SigningEngine] signingOperationId is required");
-	if (!fingerprint) throw new Error("[SigningEngine] operation fingerprint is required");
-	const bindings = args.state.callerProvidedOperationFingerprintsById;
-	const existingFingerprint = bindings.get(operationId);
-	if (existingFingerprint && existingFingerprint !== fingerprint) throw new Error(`[SigningEngine] caller-provided signingOperationId reused for a different operation: ${operationId}`);
-	bindings.set(operationId, fingerprint);
-	trimOldestBoundCallerOperationIds(bindings);
-}
-var SigningOperationIdBindingRegistry = class {
-	constructor() {
-		this.state = { callerProvidedOperationFingerprintsById: /* @__PURE__ */ new Map() };
-	}
-	bindCallerProvidedOperationIdToFingerprint(args) {
-		bindCallerProvidedSigningOperationIdToFingerprint({
-			state: this.state,
-			operationId: args.operationId,
-			operationFingerprint: args.operationFingerprint
-		});
-	}
-};
-function trimOldestBoundCallerOperationIds(bindings) {
-	while (bindings.size > MAX_BOUND_CALLER_OPERATION_IDS) {
-		const oldest = bindings.keys().next().value;
-		if (!oldest) return;
-		bindings.delete(oldest);
-	}
-}
-//#endregion
-export { SigningOperationIdBindingRegistry };
-
-//# sourceMappingURL=operationIdBinding.js.map