@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/react/core/signingEngine/walletCustody/ceremonyActiveClientMetadata.js

@@ -1,94 +0,0 @@
-import { parseMpcMaterialActivationRef } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRegistrationActivationResultV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1 } from "../threshold/ed25519/yaoClient.js";
-//#region src/core/signingEngine/walletCustody/ceremonyActiveClientMetadata.ts
-/**
-* The active-client metadata for a key set the ceremony registered.
-*
-* The PRF-derived path read this off the live client it kept. A ceremony keeps
-* no client — it seals the material and returns public facts — so the metadata
-* has to be rebuilt from the two things that produced it: the admission request
-* this run registered under, and the Router's activation result.
-*
-* **Every identity here comes from the Router's receipt, not from this side.**
-* That matters most for `materialActivation`: the boundary that mints it is the
-* Router, exactly as on the PRF path. Nothing here invents one — a locally
-* minted activation ref would give that state a second owner.
-*/
-function walletCustodyEd25519ActiveClientMetadataV1(input) {
-	let raw;
-	try {
-		raw = JSON.parse(input.activationResultJson);
-	} catch {
-		throw new Error("the Router activation result is not JSON");
-	}
-	const result = parseRouterAbEd25519YaoRegistrationActivationResultV1(raw);
-	if (!result.ok) throw new Error(`Router activation result is invalid: ${result.message}`);
-	const activation = result.value;
-	const receipt = activation.public_receipt;
-	if (activation.binding.lifecycle.lifecycle_id !== input.admissionRequest.scope.lifecycle_id) throw new Error("the Router activation result belongs to another lifecycle");
-	const wire = receipt.material_activation;
-	const materialActivation = parseMpcMaterialActivationRef({
-		kind: wire.kind,
-		activationId: wire.activation_id,
-		capability: wire.capability,
-		materialOwner: wire.material_owner,
-		keyBinding: wire.key_binding,
-		lifecycleBinding: wire.lifecycle_binding,
-		signingWorker: wire.signing_worker
-	});
-	if (!materialActivation.ok) throw new Error(`Invalid activation material reference: ${materialActivation.error.message}`);
-	const participantIds = input.admissionRequest.participant_ids;
-	if (participantIds.length !== 2) throw new Error("an Ed25519 Yao registration has exactly two participants");
-	return {
-		kind: ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1,
-		scope: input.admissionRequest.scope,
-		applicationBinding: input.admissionRequest.application_binding,
-		participantIds: [participantIds[0], participantIds[1]],
-		registeredPublicKey: Uint8Array.from(receipt.registered_public_key),
-		signingWorkerVerifyingShare: Uint8Array.from(receipt.signing_worker_verifying_share),
-		stateEpoch: BigInt(receipt.state_epoch),
-		transcript: Uint8Array.from(receipt.transcript),
-		activeCapabilityBinding: activation.binding.session_id,
-		materialActivation: materialActivation.value
-	};
-}
-function walletRecoveryEd25519ActiveClientMetadataV1(input) {
-	let raw;
-	try {
-		raw = JSON.parse(input.activationResultJson);
-	} catch {
-		throw new Error("the Router recovery result is not JSON");
-	}
-	const parsed = parseRouterAbEd25519YaoRecoveryActivationResultV1(raw);
-	if (!parsed.ok) throw new Error(`Router recovery result is invalid: ${parsed.message}`);
-	if (parsed.value.binding.lifecycle.lifecycle_id !== input.admissionRequest.scope.lifecycle_id) throw new Error("the Router recovery result belongs to another lifecycle");
-	if (input.activationReceipt.binding.lifecycle.lifecycle_id !== input.admissionRequest.scope.lifecycle_id) throw new Error("the Router recovery activation belongs to another lifecycle");
-	const receipt = input.activationReceipt.public_receipt;
-	const materialActivation = parseMpcMaterialActivationRef({
-		kind: receipt.material_activation.kind,
-		activationId: receipt.material_activation.activation_id,
-		capability: receipt.material_activation.capability,
-		materialOwner: receipt.material_activation.material_owner,
-		keyBinding: receipt.material_activation.key_binding,
-		lifecycleBinding: receipt.material_activation.lifecycle_binding,
-		signingWorker: receipt.material_activation.signing_worker
-	});
-	if (!materialActivation.ok) throw new Error(`Invalid recovery material reference: ${materialActivation.error.message}`);
-	return {
-		kind: ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1,
-		scope: input.admissionRequest.scope,
-		applicationBinding: input.admissionRequest.application_binding,
-		participantIds: [input.admissionRequest.participant_ids[0], input.admissionRequest.participant_ids[1]],
-		registeredPublicKey: Uint8Array.from(receipt.registered_public_key),
-		signingWorkerVerifyingShare: Uint8Array.from(receipt.signing_worker_verifying_share),
-		stateEpoch: BigInt(receipt.state_epoch),
-		transcript: Uint8Array.from(receipt.transcript),
-		activeCapabilityBinding: [...input.activationReceipt.active_capability_binding],
-		materialActivation: materialActivation.value
-	};
-}
-//#endregion
-export { walletCustodyEd25519ActiveClientMetadataV1, walletRecoveryEd25519ActiveClientMetadataV1 };
-
-//# sourceMappingURL=ceremonyActiveClientMetadata.js.map

package/dist/esm/react/core/signingEngine/walletCustody/ceremonyDriver.js

@@ -1,171 +0,0 @@
-import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
-//#region src/core/signingEngine/walletCustody/ceremonyDriver.ts
-function ignoreDiscardFailure() {}
-function requireNearBegunRun(begun) {
-	if (begun.keySet !== "near_ed25519_v1") throw new Error("The custody worker began an EVM run for a NEAR request");
-	return begun;
-}
-function requireEvmBegunRun(begun) {
-	if (begun.keySet !== "evm_family_ecdsa_v1") throw new Error("The custody worker began a NEAR run for an EVM request");
-	return begun;
-}
-function requireEvmCompletedRun(completed) {
-	if (completed.keySet !== "evm_family_ecdsa_v1") throw new Error("The custody worker completed a NEAR run for an EVM request");
-	return completed;
-}
-function buildNearBeginCustody(custody) {
-	switch (custody.origin) {
-		case "establish": return {
-			origin: "establish",
-			walletId: custody.walletId
-		};
-		case "join": return {
-			origin: "join",
-			custodyJson: custody.custodyJson,
-			factorSecret: custody.factorSecret
-		};
-		case "recover": return {
-			origin: "recover",
-			custodyJson: custody.custodyJson,
-			recoveryCode: custody.recoveryCode
-		};
-		case "recover_and_reseal": return {
-			origin: "recover_and_reseal",
-			custodyJson: custody.custodyJson,
-			recoveryCode: custody.recoveryCode,
-			replacementFactorJson: custody.replacementFactorJson,
-			replacementFactorSecret: custody.replacementFactorSecret
-		};
-		default: return assertNeverCustodyOrigin(custody);
-	}
-}
-function buildFinishCustody(custody) {
-	switch (custody.origin) {
-		case "establish": return {
-			kind: "establish",
-			factorJson: custody.factorJson,
-			factorSecret: custody.factorSecret,
-			recoveryCodesJson: custody.recoveryCodesJson
-		};
-		case "join":
-		case "recover": return { kind: "existing" };
-		case "recover_and_reseal": return {
-			kind: "recover_reseal",
-			replacementFactorJson: custody.replacementFactorJson,
-			replacementFactorSecret: custody.replacementFactorSecret
-		};
-		default: return assertNeverCustodyOrigin(custody);
-	}
-}
-function assertNeverCustodyOrigin(value) {
-	throw new Error(`Unsupported wallet custody origin: ${String(value)}`);
-}
-function assertEvmCompletionMatchesCommit(preActivation, completion) {
-	if (preActivation.walletId !== completion.activation.walletId) throw new Error("EVM custody activation changed the wallet identity");
-	if (preActivation.keyManifestDigestB64u !== completion.activation.keyManifestDigestB64u) throw new Error("EVM custody activation changed the key manifest digest");
-	if (preActivation.clientRootPublicKey33B64u !== completion.activation.clientRootPublicKey33B64u) throw new Error("EVM custody activation changed the client root public key");
-}
-function isRegistrationBenchmarkDiagnosticsEnabled() {
-	return Reflect.get(globalThis, "__SEAMS_REGISTRATION_BENCHMARK_DIAGNOSTICS") === true;
-}
-function recordWalletCustodyTiming(ceremonyId, stage, startedAt) {
-	if (!isRegistrationBenchmarkDiagnosticsEnabled()) return;
-	try {
-		console.info("[WalletCustody] timing " + JSON.stringify({
-			event: "wallet_custody_timing",
-			ceremonyId,
-			stage: `custody.${stage}`,
-			durationMs: Math.round((performance.now() - startedAt) * 10) / 10,
-			outcome: "success"
-		}));
-	} catch {}
-}
-async function runWalletCustodyKeySetCeremony(input) {
-	const ceremonyId = input.ceremonyId || secureRandomId("wallet-custody-ceremony", 32, "wallet custody ceremony IDs");
-	const { custody, keySetRun } = input;
-	let workerAcceptedBegin = false;
-	try {
-		if (keySetRun.keySet === "near_ed25519_v1") {
-			let stageStartedAt = performance.now();
-			let executeRequestJson;
-			if (keySetRun.checkpointJson !== void 0) {
-				if (custody.origin !== "join") throw new Error("Checkpoint restoration requires existing custody");
-				executeRequestJson = (await input.runStep("restoreNearRegistration", {
-					ceremonyId,
-					custodyJson: custody.custodyJson,
-					factorSecret: custody.factorSecret,
-					checkpointJson: keySetRun.checkpointJson
-				})).yaoExecuteRequestJson;
-			} else executeRequestJson = requireNearBegunRun(await input.runStep("beginWalletCustodyKeySetRun", {
-				ceremonyId,
-				keySet: "near_ed25519_v1",
-				custody: buildNearBeginCustody(custody),
-				protocolInputsJson: keySetRun.protocolInputsJson
-			})).yaoExecuteRequestJson;
-			recordWalletCustodyTiming(ceremonyId, "begin", stageStartedAt);
-			workerAcceptedBegin = true;
-			if (keySetRun.beforeRouterRound) {
-				stageStartedAt = performance.now();
-				const checkpoint = await input.runStep("checkpointNearRegistration", { ceremonyId });
-				recordWalletCustodyTiming(ceremonyId, "checkpoint", stageStartedAt);
-				await keySetRun.beforeRouterRound(checkpoint.checkpointJson);
-			}
-			stageStartedAt = performance.now();
-			const protocolResultJson = await keySetRun.runRouterRound(executeRequestJson);
-			recordWalletCustodyTiming(ceremonyId, "router_round", stageStartedAt);
-			stageStartedAt = performance.now();
-			await input.runStep("completeWalletCustodyKeySetRun", {
-				ceremonyId,
-				keySet: "near_ed25519_v1",
-				protocolResultJson,
-				nearEd25519SigningKeyId: keySetRun.nearEd25519SigningKeyId,
-				recordedKeyManifestDigestB64u: input.recordedKeyManifestDigestB64u
-			});
-			recordWalletCustodyTiming(ceremonyId, "complete", stageStartedAt);
-			await keySetRun.afterRouterRoundCompleted?.(protocolResultJson);
-			stageStartedAt = performance.now();
-			const finished = await input.runStep("finishWalletCustodyKeySetRun", {
-				ceremonyId,
-				finish: buildFinishCustody(custody)
-			});
-			recordWalletCustodyTiming(ceremonyId, "finish", stageStartedAt);
-			return finished;
-		}
-		const begunResult = await input.runStep("beginWalletCustodyKeySetRun", {
-			ceremonyId,
-			keySet: "evm_family_ecdsa_v1",
-			custody,
-			protocolInputsJson: keySetRun.protocolInputsJson,
-			evmFamilySigningKeySlotId: keySetRun.evmFamilySigningKeySlotId,
-			recordedKeyManifestDigestB64u: input.recordedKeyManifestDigestB64u
-		});
-		workerAcceptedBegin = true;
-		const begun = requireEvmBegunRun(begunResult);
-		await keySetRun.beforeRelayerRound();
-		const protocolResultJson = await keySetRun.runRelayerRound({
-			contextBinding32B64u: begun.ecdsaContextBinding32B64u,
-			clientSharePublicKey33B64u: begun.ecdsaClientSharePublicKey33B64u,
-			clientShareRetryCounter: begun.ecdsaClientShareRetryCounter,
-			preActivationCommitPayload: begun.preActivationCommitPayload
-		});
-		const completed = requireEvmCompletedRun(await input.runStep("completeWalletCustodyKeySetRun", {
-			ceremonyId,
-			keySet: "evm_family_ecdsa_v1",
-			protocolResultJson
-		}));
-		assertEvmCompletionMatchesCommit(begun.preActivationCommitPayload, completed);
-		return {
-			...begun.preActivationCommitPayload,
-			clientRootPublicKey33B64u: completed.activation.clientRootPublicKey33B64u,
-			ecdsaReadyStateBlobB64u: completed.activation.ecdsaReadyStateBlobB64u,
-			ecdsaPublicFacts: completed.activation.ecdsaPublicFacts
-		};
-	} catch (error) {
-		if (workerAcceptedBegin) await input.runStep("discardWalletCustodyCeremony", { ceremonyId }).catch(ignoreDiscardFailure);
-		throw error;
-	}
-}
-//#endregion
-export { isRegistrationBenchmarkDiagnosticsEnabled, recordWalletCustodyTiming, runWalletCustodyKeySetCeremony };
-
-//# sourceMappingURL=ceremonyDriver.js.map

package/dist/esm/react/core/signingEngine/walletCustody/ceremonyStepRunner.js

@@ -1,20 +0,0 @@
-//#region src/core/signingEngine/walletCustody/ceremonyStepRunner.ts
-function requestWalletCustodyCeremonyOperation(workerContext, operation) {
-	return workerContext.requestWorkerOperation(operation);
-}
-function runWalletCustodyCeremonyStep(transport, type, payload) {
-	return transport.requestOperation({
-		kind: "walletCustodyCeremony",
-		request: {
-			type,
-			payload
-		}
-	});
-}
-function walletCustodyCeremonyStepRunner(transport) {
-	return runWalletCustodyCeremonyStep.bind(void 0, transport);
-}
-//#endregion
-export { requestWalletCustodyCeremonyOperation, walletCustodyCeremonyStepRunner };
-
-//# sourceMappingURL=ceremonyStepRunner.js.map

package/dist/esm/react/core/signingEngine/walletCustody/ed25519ActiveClient.js

@@ -1,100 +0,0 @@
-//#region src/core/signingEngine/walletCustody/ed25519ActiveClient.ts
-function requireNonEmpty(value, label) {
-	const normalized = String(value ?? "").trim();
-	if (!normalized) throw new Error(`${label} is required`);
-	return normalized;
-}
-function cloneMetadata(metadata) {
-	return {
-		kind: metadata.kind,
-		scope: {
-			lifecycle_id: metadata.scope.lifecycle_id,
-			root_share_epoch: metadata.scope.root_share_epoch,
-			account_id: metadata.scope.account_id,
-			threshold_session_id: metadata.scope.threshold_session_id,
-			signer_set_id: metadata.scope.signer_set_id,
-			signing_worker_id: metadata.scope.signing_worker_id,
-			material_activation: metadata.scope.material_activation
-		},
-		applicationBinding: {
-			wallet_id: metadata.applicationBinding.wallet_id,
-			near_ed25519_signing_key_id: metadata.applicationBinding.near_ed25519_signing_key_id,
-			signing_root_id: metadata.applicationBinding.signing_root_id,
-			key_creation_signer_slot: metadata.applicationBinding.key_creation_signer_slot
-		},
-		participantIds: [metadata.participantIds[0], metadata.participantIds[1]],
-		registeredPublicKey: metadata.registeredPublicKey.slice(),
-		signingWorkerVerifyingShare: metadata.signingWorkerVerifyingShare.slice(),
-		stateEpoch: metadata.stateEpoch,
-		transcript: metadata.transcript.slice(),
-		activeCapabilityBinding: [...metadata.activeCapabilityBinding],
-		materialActivation: metadata.materialActivation
-	};
-}
-function activeHandle(lifecycle) {
-	if (lifecycle.kind === "active") return lifecycle.handle;
-	throw new Error("Wallet custody Ed25519 active client is disposed");
-}
-function scheduleDisposal(args) {
-	args.workerContext.requestWorkerOperation({
-		kind: "emailOtp",
-		request: {
-			type: "disposeEmailOtpEd25519YaoActiveClient",
-			payload: { activeClientHandle: args.handle }
-		}
-	}).catch(() => void 0);
-}
-async function disposeWalletCustodyEd25519ActiveClientV1(args) {
-	return (await args.workerContext.requestWorkerOperation({
-		kind: "emailOtp",
-		request: {
-			type: "disposeEmailOtpEd25519YaoActiveClient",
-			payload: { activeClientHandle: requireNonEmpty(args.activeClientHandle, "activeClientHandle") }
-		}
-	})).removed;
-}
-/**
-* The worker owns the opened custody material. The browser only keeps this
-* opaque handle while the active signing lane is registered.
-*/
-var WalletCustodyEd25519ActiveClientV1 = class {
-	constructor(workerContext, activeClientHandle, metadata) {
-		this.workerContext = workerContext;
-		this.lifecycle = {
-			kind: "active",
-			handle: requireNonEmpty(activeClientHandle, "activeClientHandle")
-		};
-		this.activeMetadata = cloneMetadata(metadata);
-	}
-	async createSigningShare(input) {
-		return await this.workerContext.requestWorkerOperation({
-			kind: "emailOtp",
-			request: {
-				type: "createEmailOtpEd25519YaoSigningShare",
-				payload: {
-					activeClientHandle: activeHandle(this.lifecycle),
-					input
-				}
-			}
-		});
-	}
-	metadata() {
-		return cloneMetadata(this.activeMetadata);
-	}
-	status() {
-		return this.lifecycle.kind === "active" ? { kind: "active" } : { kind: "disposed" };
-	}
-	dispose() {
-		if (this.lifecycle.kind !== "active") return;
-		const handle = this.lifecycle.handle;
-		this.lifecycle = { kind: "disposed" };
-		scheduleDisposal({
-			workerContext: this.workerContext,
-			handle
-		});
-	}
-};
-//#endregion
-export { WalletCustodyEd25519ActiveClientV1, disposeWalletCustodyEd25519ActiveClientV1 };
-
-//# sourceMappingURL=ed25519ActiveClient.js.map

package/dist/esm/react/core/signingEngine/walletCustody/ed25519Projection.js

@@ -1,32 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
-//#region src/core/signingEngine/walletCustody/ed25519Projection.ts
-function requireNonEmpty(value, field) {
-	const normalized = value.trim();
-	if (!normalized) throw new Error(`Wallet custody Ed25519 projection requires ${field}`);
-	return normalized;
-}
-/**
-* `providerSubject` is the Email OTP provider's subject id (e.g. `google:<sub>`)
-* and is passed as its own argument. It must never be read off
-* `walletSession.walletSessionUserId`: that field is a wallet-scoped identity,
-* independent of the authentication provider subject.
-*/
-async function resolveWalletCustodyEd25519ProjectionV1(deps, walletSession, providerSubjectId, expectedMaterialActivation) {
-	const walletId = String(walletSession.walletId);
-	const providerSubject = requireNonEmpty(String(providerSubjectId), "providerSubject");
-	const references = (await deps.listPublicCapabilityReferences()).filter((identity) => String(identity.walletId) === walletId && mpcMaterialActivationRefsEqual(identity.materialActivation, expectedMaterialActivation));
-	if (references.length === 0) return null;
-	if (references.length !== 1 || !references[0]) throw new Error("Wallet custody Ed25519 requires one exact public capability reference");
-	const identity = references[0];
-	const users = (await deps.listUsers()).filter((user) => String(user.walletId) === walletId && String(user.nearAccountId) === String(identity.nearAccountId));
-	if (users.length !== 1 || !users[0]) throw new Error("Wallet custody Ed25519 requires one exact persisted signer projection");
-	return {
-		identity,
-		user: users[0],
-		providerSubject
-	};
-}
-//#endregion
-export { resolveWalletCustodyEd25519ProjectionV1 };
-
-//# sourceMappingURL=ed25519Projection.js.map

package/dist/esm/react/core/signingEngine/walletCustody/ed25519SeedMaterial.js

@@ -1,92 +0,0 @@
-import { buildNearAccountRefs } from "../../accountData/near/accountRefs.js";
-import { getAccountKeyMaterial, resolveAccountKeyMaterialTarget } from "../../indexedDB/accountKeyMaterial.js";
-import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND, assertWalletCustodyEd25519MaterialBindingV1, buildWalletCustodyEd25519MaterialRecordV1 } from "../../indexedDB/walletCustodyEd25519MaterialRecord.js";
-//#region src/core/signingEngine/walletCustody/ed25519SeedMaterial.ts
-async function persistWalletCustodyEd25519MaterialV1(input) {
-	const target = await resolveAccountKeyMaterialTarget(input.store, { accountRefs: buildNearAccountRefs(input.binding.nearAccountId) });
-	if (!target) throw new Error("Wallet custody Ed25519 material requires a persisted wallet profile");
-	await input.store.storeKeyMaterial(buildWalletCustodyEd25519MaterialRecordV1({
-		target,
-		...input
-	}));
-}
-async function deleteWalletCustodyEd25519MaterialV1(input) {
-	const target = await resolveAccountKeyMaterialTarget(input.store, { accountRefs: buildNearAccountRefs(input.nearAccountId) });
-	if (!target) return;
-	await input.store.deleteKeyMaterial(target.profileId, input.signerSlot, target.chainIdKey, WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND);
-}
-/**
-* Reads the cache the ceremony wrote.
-*
-* The counterpart to `persistWalletCustodyEd25519MaterialV1`, which shipped
-* without one — the row was written at registration and never read, so every
-* unlock paid for a Router round the cache existed to avoid.
-*
-* Returns the sealed halves rather than opening them. Opening needs the cache
-* key derived from the wallet custody seed, which lives behind the ceremony's
-* wasm boundary; a loader that could open would need the seed on this side,
-* and that is the property this module exists to keep.
-*
-* The caller states which key set it expects. A row that names a different
-* registered public key is reported unusable rather than returned: it is a
-* cache entry for a key set this unlock is not performing, and importing it
-* would install material for the wrong key.
-*/
-async function loadWalletCustodyEd25519MaterialV1(input) {
-	const record = await getAccountKeyMaterial({
-		deps: {
-			clientDB: input.store,
-			keyMaterialStore: input.store
-		},
-		accountRefs: buildNearAccountRefs(input.nearAccountId),
-		signerSlot: input.signerSlot,
-		keyKind: WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND
-	});
-	if (!record) return { kind: "absent" };
-	const envelope = record.payloadEnvelope;
-	if (!envelope?.ciphertext || !envelope.nonce) return {
-		kind: "unusable",
-		reason: "cached custody material has no sealed payload"
-	};
-	if (envelope.alg !== "chacha20poly1305-hkdf-sha256-wallet-custody-seed-v1") return {
-		kind: "unusable",
-		reason: "cached custody material was sealed under another key"
-	};
-	const binding = record.payload?.binding;
-	if (!binding || typeof binding !== "object") return {
-		kind: "unusable",
-		reason: "cached custody material has no binding"
-	};
-	const candidate = binding;
-	if (candidate.kind !== "wallet_custody_ed25519_active_client_v1") return {
-		kind: "unusable",
-		reason: "cached custody material is not a wallet custody record"
-	};
-	try {
-		assertWalletCustodyEd25519MaterialBindingV1(candidate);
-	} catch (error) {
-		return {
-			kind: "unusable",
-			reason: error instanceof Error ? error.message : "cached custody binding is incomplete"
-		};
-	}
-	const expected = String(input.expectedRegisteredPublicKeyB64u || "").trim();
-	if (expected && expected !== String(candidate.registeredPublicKeyB64u || "").trim()) return {
-		kind: "unusable",
-		reason: "cached custody material is for another key set"
-	};
-	return {
-		kind: "found",
-		material: {
-			binding: candidate,
-			sealed: {
-				ciphertextB64u: envelope.ciphertext,
-				nonceB64u: envelope.nonce
-			}
-		}
-	};
-}
-//#endregion
-export { deleteWalletCustodyEd25519MaterialV1, loadWalletCustodyEd25519MaterialV1, persistWalletCustodyEd25519MaterialV1 };
-
-//# sourceMappingURL=ed25519SeedMaterial.js.map

package/dist/esm/react/core/signingEngine/walletCustody/emailOtpLink.js

@@ -1,135 +0,0 @@
-import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
-import { parsePasskeyEnvelopeId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision } from "../../../shared-ts/src/passkey-custody/primitives.js";
-import { toWalletId } from "../interfaces/ecdsaChainTarget.js";
-import { buildEmailOtpEnvelopeFactor, buildMethodBoundEnvelopeOwnership, buildPasskeyCustodyEnvelopeRecord, custodyEnvelopeBindingJsonV1, parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../../../shared-ts/src/passkey-custody/index.js";
-import { finalizeWalletAddAuthMethod, startWalletAddAuthMethod } from "../../rpcClients/relayer/walletRegistration.js";
-//#region src/core/signingEngine/walletCustody/emailOtpLink.ts
-/**
-* Sealing the wallet's existing custody seed under a newly verified
-* Email OTP factor.
-*
-* The mirror of `passkeyLink`, and deliberately the same shape: open the source
-* envelope with the factor secret the caller already collected, reseal the same
-* seed under the new factor, commit the ciphertext with the auth method in one
-* server call. No ceremony runs — nothing is derived and no key manifest is
-* verified, because the seed is the wallet's own and the envelope it came from
-* already proved that.
-*
-* The Email factor secret is generated here and never returned. It is sealed to
-* the server's enrollment key so a future OTP verification can release it back,
-* and it is used once, in the worker, to seal the new envelope.
-*/
-function requireResealedEnvelope(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Email OTP custody worker returned no resealed envelope");
-	const record = value;
-	return {
-		nonceB64u: parseEnvelopeNonceB64u(record.nonceB64u, "resealed envelope nonceB64u"),
-		sealedCustodySecretB64u: parseEnvelopeCiphertextB64u(record.sealedCustodySecretB64u, "resealed envelope sealedCustodySecretB64u"),
-		aadHashB64u: parseDigestField(record.aadHashB64u, "resealed envelope aadHashB64u"),
-		ciphertextDigestB64u: parseDigestField(record.ciphertextDigestB64u, "resealed envelope ciphertextDigestB64u")
-	};
-}
-/** Complete add-email-code custody linking from the browser boundary. */
-async function linkWalletEmailOtpCustody(input) {
-	const started = await startWalletAddAuthMethod({
-		relayerUrl: input.relayerUrl,
-		walletId: input.walletId,
-		addAuthMethodIntentGrant: input.addAuthMethodIntentGrant,
-		addAuthMethodIntentDigestB64u: input.addAuthMethodIntentDigestB64u,
-		intent: input.intent,
-		auth: input.auth,
-		authority: input.authority
-	});
-	if (!started.custodyEnvelope) throw new Error("Email OTP add-auth-method start omitted the source custody envelope");
-	const sourceEnvelope = started.custodyEnvelope;
-	const clientSecret32 = crypto.getRandomValues(new Uint8Array(32));
-	const replacementFactorSecret = clientSecret32.slice();
-	let enrollment;
-	try {
-		enrollment = await input.context.signingEngine.prepareEmailOtpRegistrationEnrollmentMaterialInternal({
-			relayUrl: input.relayerUrl,
-			walletId: toWalletId(String(input.walletId)),
-			userId: input.providerSubject,
-			clientSecret32
-		});
-	} catch (error) {
-		replacementFactorSecret.fill(0);
-		throw error;
-	} finally {
-		clientSecret32.fill(0);
-	}
-	const envelopeIdResult = parsePasskeyEnvelopeId(secureRandomId("wallet-custody-envelope", 24, "wallet custody envelope ids"));
-	if (!envelopeIdResult.ok) throw new Error(envelopeIdResult.error.message);
-	const factor = buildEmailOtpEnvelopeFactor({
-		enrollmentId: enrollment.enrollmentId,
-		enrollmentSealKeyVersion: enrollment.enrollmentSealKeyVersion
-	});
-	const ownership = buildMethodBoundEnvelopeOwnership(input.walletAuthMethodId);
-	const envelopeRevision = parseEnvelopeRevision(1);
-	const replacementBindingJson = custodyEnvelopeBindingJsonV1({
-		walletId: sourceEnvelope.walletId,
-		envelopeId: envelopeIdResult.value,
-		factor,
-		envelopeRevision,
-		binding: sourceEnvelope.binding,
-		ownership
-	});
-	const existingFactorSecret = input.existingFactorSecret.slice();
-	let resealed;
-	try {
-		resealed = requireResealedEnvelope(await input.worker.requestOperation({
-			kind: "walletCustodyCeremony",
-			request: {
-				type: "linkWalletCustodyPasskey",
-				payload: {
-					existingEnvelope: sourceEnvelope,
-					existingFactorSecret: existingFactorSecret.buffer,
-					replacementEnvelopeBindingJson: replacementBindingJson,
-					replacementFactorSecret: replacementFactorSecret.buffer
-				},
-				transfer: [existingFactorSecret.buffer, replacementFactorSecret.buffer]
-			}
-		}));
-	} finally {
-		if (existingFactorSecret.byteLength > 0) existingFactorSecret.fill(0);
-		if (replacementFactorSecret.byteLength > 0) replacementFactorSecret.fill(0);
-	}
-	const nowMs = (input.nowMs ?? Date.now)();
-	const custodyEnvelope = parsePasskeyCustodyEnvelopeRecord(buildPasskeyCustodyEnvelopeRecord({
-		envelopeId: envelopeIdResult.value,
-		walletId: sourceEnvelope.walletId,
-		ownership,
-		binding: sourceEnvelope.binding,
-		factor,
-		envelopeRevision,
-		nonceB64u: resealed.nonceB64u,
-		sealedCustodySecretB64u: resealed.sealedCustodySecretB64u,
-		ciphertextDigestB64u: resealed.ciphertextDigestB64u,
-		aadHashB64u: resealed.aadHashB64u,
-		lifecycle: {
-			state: "active",
-			activatedAtMs: nowMs
-		},
-		createdAtMs: nowMs,
-		updatedAtMs: nowMs
-	}));
-	return {
-		finalized: await finalizeWalletAddAuthMethod({
-			relayerUrl: input.relayerUrl,
-			walletId: input.walletId,
-			addAuthMethodCeremonyId: started.addAuthMethodCeremonyId,
-			custodyEnvelope,
-			emailOtpTarget: {
-				kind: "new_enrollment",
-				enrollment: enrollment.emailOtpEnrollment
-			}
-		}),
-		enrollmentId: enrollment.enrollmentId
-	};
-}
-//#endregion
-export { linkWalletEmailOtpCustody };
-
-//# sourceMappingURL=emailOtpLink.js.map