@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/SeamsWeb/assembly/browserSigningSurfaceAssembly.js

@@ -1,817 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../shared-ts/src/utils/domainIds.js";
-import { WalletSessionStatusReadScope } from "../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
-import { WALLET_AUTH_METHODS } from "../../shared-ts/src/utils/signerDomain.js";
-import { configuredThresholdEcdsaChainTargets, thresholdEcdsaChainTargetKey, toWalletId } from "../../core/signingEngine/interfaces/ecdsaChainTarget.js";
-import { readEmailOtpProviderSubjectForWalletV1 } from "../../core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../shared-ts/src/utils/walletAuthAuthority.js";
-import { IndexedDbEcdsaCapabilityManifestStore } from "../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
-import { walletSessionAuthorizations } from "../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { emitSigningSessionFlowTrace } from "../../core/signingEngine/session/operationState/trace.js";
-import { withThresholdEd25519CommitQueue } from "../../core/signingEngine/threshold/ed25519/commitQueue.js";
-import { buildActiveNearEd25519WalletSessionAuthorization } from "../../core/signingEngine/session/material/nearEd25519YaoSigningPreparation.js";
-import { listExactSealedSessionsForWallet } from "../../core/signingEngine/session/persistence/sealedSessionStore.js";
-import { ed25519SealedRuntimeAuthorityRef } from "../../core/signingEngine/session/warmCapabilities/ed25519SealedSessionRuntime.js";
-import { readOwnerWalletExecutionLaneProjectionV1 } from "../../core/rpcClients/relayer/ownerWalletExecutionLanePreflight.js";
-import { hydrateWalletExecutionLane } from "../../core/signingEngine/session/lanes/walletExecutionLaneHydration.js";
-import { IndexedDBManager } from "../../core/indexedDB/index.js";
-import { EvmFamilyEcdsaMaterialSupersededError } from "../../core/signingEngine/flows/signEvmFamily/signingFlow.js";
-import { authorizeEvmFamilyEcdsaSigningCapability, buildCanonicalEvmFamilyEcdsaSigningCapability, buildEcdsaPreprocessingCapability, buildExactEcdsaDirectCapabilityRuntime, signingAuthorizationFromPreprocessing } from "../../core/signingEngine/session/material/ecdsaSigningCapability.js";
-import { buildPersistedEcdsaRoleLocalMaterial } from "../../core/signingEngine/session/material/ecdsaRoleLocalMaterialResolver.js";
-import { resolveExactWalletAuthAuthority as resolveExactWalletAuthAuthority$1 } from "../../core/signingEngine/session/identity/ownerLaneScope.js";
-import { withThresholdEcdsaSigningQueue } from "../../core/signingEngine/threshold/ecdsa/signingQueue.js";
-import { resolveExactEcdsaSealedRuntime } from "../../core/signingEngine/session/material/ecdsaSealedRuntime.js";
-import { createActiveEcdsaCapabilityRuntimeForChainResolver, createActiveEcdsaCapabilityRuntimeResolver, resolveExactEcdsaCapabilityRuntime } from "../../core/signingEngine/session/material/activeEcdsaCapabilityRuntime.js";
-import { signEvmFamily } from "../../core/signingEngine/flows/signEvmFamily/signEvmFamily.js";
-import { provisionThresholdEcdsaSession } from "../../core/signingEngine/session/passkey/ecdsaSessionProvision.js";
-import { activateAuthenticatedWalletState } from "../../core/signingEngine/flows/registration/public.js";
-import { readPersistedAvailableSigningLanesForSigning } from "../../core/signingEngine/session/availability/persistedAvailableSigningLanes.js";
-import { persistThresholdEcdsaBootstrapForWalletTarget } from "../../core/signingEngine/session/warmCapabilities/ecdsaBootstrapPersistence.js";
-import { provisionThresholdEd25519Session } from "../../core/signingEngine/session/passkey/ed25519SessionProvision.js";
-import { createCanonicalWalletSessionStatusReader } from "../../core/signingEngine/session/lifecycle/canonicalWalletSessionStatus.js";
-import { createSigningEnginePorts } from "../../core/signingEngine/assembly/createPorts.js";
-import { readExactWalletSessionAuthorization } from "./createBrowserRecoveryPublicDeps.js";
-//#region src/SeamsWeb/assembly/browserSigningSurfaceAssembly.ts
-const ecdsaCapabilityManifestStore = new IndexedDbEcdsaCapabilityManifestStore();
-function walletSessionImmutableIdentityMatches(left, right) {
-	return left.kind === right.kind && left.walletId === right.walletId && left.authorityId === right.authorityId && left.authMethodId === right.authMethodId && left.authorizationId === right.authorizationId && left.quotaId === right.quotaId && left.issuedAtMs === right.issuedAtMs && left.expiresAtMs === right.expiresAtMs;
-}
-function walletSessionMatchesSelectedAuthority(session, selected) {
-	return session.walletId === selected.authority.walletId && session.authorityId === selected.authority.authorityId && session.authMethodId === selected.authMethod.walletAuthMethodId && session.authorityDigestB64u === selected.authority.authorityDigestB64u && session.authorityRevocationEpoch === selected.authority.revocationEpoch;
-}
-function omitPasskeyRestoreAuthMethod(input) {
-	if (input.authMethod !== "passkey") throw new Error("Passkey restore adapter received a non-Passkey request");
-	const { authMethod: _authMethod, ...passkeyRestore } = input;
-	return passkeyRestore;
-}
-const browserExactWalletAuthMethodStore = {
-	getWalletAuthMethodV2: IndexedDBManager.getWalletAuthMethodV2.bind(IndexedDBManager),
-	listWalletAuthMethodsForWallet: IndexedDBManager.listWalletAuthMethodsForWallet.bind(IndexedDBManager),
-	readEmailOtpProviderSubjectForWallet: readEmailOtpProviderSubjectForWalletV1.bind(null, IndexedDBManager)
-};
-async function noWalletPasskeyAuthenticator() {
-	return null;
-}
-/**
-* The active wallet auth-method store is the one source that resolves
-* an authority reference to its full authority. Sealed-session restores and
-* loose authenticator lists are history and hints; matching against them let
-* a stale or sibling credential answer for the active authority.
-*/
-async function resolveExactWalletAuthAuthority(authorityRef, walletAuthMethodStore) {
-	const authMethod = await walletAuthMethodStore.getWalletAuthMethodV2(String(authorityRef.walletAuthMethodId));
-	if (!authMethod || authMethod.status !== "active" || authMethod.walletId !== authorityRef.walletId) throw new Error("Exact wallet authentication authority is unavailable");
-	let authority;
-	try {
-		authority = await resolveExactWalletAuthAuthority$1({
-			authMethod,
-			stores: {
-				...walletAuthMethodStore,
-				getWalletPasskeyAuthenticator: noWalletPasskeyAuthenticator
-			}
-		});
-	} catch {
-		throw new Error("Exact wallet authentication authority is unavailable");
-	}
-	const candidateRef = await walletAuthAuthorityRef({ authority });
-	if (candidateRef.walletId === authorityRef.walletId && candidateRef.walletAuthMethodId === authorityRef.walletAuthMethodId && candidateRef.authorityDigest === authorityRef.authorityDigest) return authority;
-	throw new Error("Exact wallet authentication authority is unavailable");
-}
-function createBrowserCanonicalWalletSessionStatusReader(args) {
-	return createCanonicalWalletSessionStatusReader({
-		relayerUrl: String(args.seamsWebConfigs.network.relayer?.url || "").trim(),
-		readAuthorization: readExactWalletSessionAuthorization
-	});
-}
-function exactSelectedWalletAuthority(result, walletId) {
-	if (result.kind !== "resolved") return null;
-	if (result.selection.lockState !== "unlocked" || result.selection.walletId !== walletId || result.selection.walletAuthMethodId !== result.authMethod.walletAuthMethodId || result.authMethod.status !== "active" || result.authMethod.walletId !== walletId || result.authMethod.walletAuthorityId !== result.authority.authorityId || result.authority.state !== "active" || result.authority.walletId !== walletId) return null;
-	return {
-		kind: result.kind,
-		selection: result.selection,
-		authMethod: result.authMethod,
-		authority: result.authority,
-		signerMaterials: result.signerMaterials,
-		exportRoot: result.exportRoot
-	};
-}
-async function resolveBrowserSelectedFactorAuthority(selected) {
-	return await resolveExactWalletAuthAuthority$1({
-		authMethod: selected.authMethod,
-		stores: {
-			...browserExactWalletAuthMethodStore,
-			getWalletPasskeyAuthenticator: noWalletPasskeyAuthenticator
-		}
-	});
-}
-async function resolveBrowserSelectedPasskeyFactorAuthorityForSealedRuntime(args) {
-	let selectedResult;
-	try {
-		selectedResult = await IndexedDBManager.resolveSelectedWalletAuthority(String(args.walletId));
-	} catch {
-		throw new Error("[SigningEngine][near] exact Passkey authority is unavailable");
-	}
-	const selected = exactSelectedWalletAuthority(selectedResult, args.walletId);
-	if (!selected || selected.authMethod.kind !== WALLET_AUTH_METHODS.passkey) throw new Error("[SigningEngine][near] exact Passkey authority is unavailable");
-	if (args.runtime.walletId !== args.walletId || args.runtime.factor.kind !== WALLET_AUTH_METHODS.passkey || String(args.runtime.factor.rpId) !== String(selected.authMethod.rpId) || args.runtime.factor.credentialIdB64u !== selected.authMethod.credentialIdB64u) throw new Error("[SigningEngine][near] exact Passkey authority changed");
-	let sealedAuthority;
-	try {
-		sealedAuthority = await ed25519SealedRuntimeAuthorityRef({
-			runtime: args.runtime,
-			walletAuthMethodId: selected.authMethod.walletAuthMethodId
-		});
-	} catch {
-		throw new Error("[SigningEngine][near] exact Passkey authority changed");
-	}
-	let factorAuthority;
-	try {
-		factorAuthority = await resolveBrowserSelectedFactorAuthority(selected);
-	} catch {
-		throw new Error("[SigningEngine][near] exact Passkey authority changed");
-	}
-	const factorAuthorityRef = await walletAuthAuthorityRef({ authority: factorAuthority });
-	if (factorAuthorityRef.walletId !== sealedAuthority.walletId || factorAuthorityRef.walletAuthMethodId !== sealedAuthority.walletAuthMethodId || factorAuthorityRef.authorityDigest !== sealedAuthority.authorityDigest) throw new Error("[SigningEngine][near] exact Passkey authority changed");
-	return factorAuthorityRef;
-}
-async function resolveBrowserNearEd25519PasskeyAuthorityForMaterial(args) {
-	switch (args.authorizationRead.kind) {
-		case "expired":
-		case "exhausted": return await resolveBrowserSelectedPasskeyFactorAuthorityForSealedRuntime(args);
-		case "found": {
-			const authorization = args.authorizationRead.authorization;
-			if (authorization.selectedAuthMethod.kind !== WALLET_AUTH_METHODS.passkey || args.runtime.factor.kind !== WALLET_AUTH_METHODS.passkey || String(args.runtime.factor.rpId) !== String(authorization.selectedAuthMethod.rpId) || args.runtime.factor.credentialIdB64u !== authorization.selectedAuthMethod.credentialIdB64u) throw new Error("[SigningEngine][near] exact Passkey authority changed");
-			const authority = await ed25519SealedRuntimeAuthorityRef({
-				runtime: args.runtime,
-				walletAuthMethodId: authorization.selectedAuthMethod.walletAuthMethodId
-			});
-			const selectedFactorAuthority = await walletAuthAuthorityRef({ authority: authorization.selectedFactorAuthority });
-			if (authority.walletId !== selectedFactorAuthority.walletId || authority.walletAuthMethodId !== selectedFactorAuthority.walletAuthMethodId || authority.authorityDigest !== selectedFactorAuthority.authorityDigest) throw new Error("[SigningEngine][near] exact Passkey authority changed");
-			return authority;
-		}
-		default:
-			args.authorizationRead;
-			throw new Error("[SigningEngine][near] unsupported exact Passkey authorization read");
-	}
-}
-function nearEd25519ReadResultFromRemoteStatus(status) {
-	switch (status.status) {
-		case "missing": return { kind: "missing" };
-		case "exhausted": return { kind: "exhausted" };
-		case "expired": return { kind: "expired" };
-		case "superseded": return { kind: "superseded" };
-		case "authority_unavailable": return { kind: "authority_unavailable" };
-		case "method_unavailable": return { kind: "method_unavailable" };
-		case "capability_unavailable": return { kind: "capability_unavailable" };
-		case "invalid": return { kind: "unavailable" };
-		case "active": throw new Error("[SigningEngine][near] active status must be resolved as authorization");
-		default: throw new Error("[SigningEngine][near] unsupported Wallet Session status");
-	}
-}
-/**
-* Reads the selected authority, exact V6 session row, and authenticated
-* relayer status as one Ed25519 authorization value. The local row never
-* authorizes an operation without the status read.
-*/
-async function readBrowserExactNearEd25519WalletSessionAuthorization(relayerUrlInput, statusReads, walletIdInput) {
-	const walletId = toWalletId(walletIdInput);
-	let selectedResult;
-	try {
-		selectedResult = await IndexedDBManager.resolveSelectedWalletAuthority(String(walletId));
-	} catch {
-		return { kind: "persistence_unavailable" };
-	}
-	const selected = exactSelectedWalletAuthority(selectedResult, walletId);
-	if (!selected) return { kind: "missing" };
-	let exactRead;
-	try {
-		exactRead = await walletSessionAuthorizations.readExactActiveForWallet({
-			walletId,
-			authorityId: selected.authority.authorityId,
-			authMethodId: selected.authMethod.walletAuthMethodId
-		});
-	} catch {
-		return { kind: "persistence_unavailable" };
-	}
-	switch (exactRead.kind) {
-		case "missing":
-		case "corrupt":
-		case "persistence_unavailable":
-		case "upgrade_required": return exactRead;
-		case "found": break;
-		default: throw new Error("[SigningEngine][near] unsupported exact Wallet Session read result");
-	}
-	const relayerUrl = String(relayerUrlInput || "").trim();
-	if (!relayerUrl) return { kind: "unavailable" };
-	const nowMs = Date.now();
-	if (exactRead.record.expiresAtMs <= nowMs) return { kind: "expired" };
-	let status;
-	try {
-		status = await statusReads.read({
-			relayerUrl,
-			operationCredential: exactRead.operationCredential
-		}, {
-			walletSessionId: exactRead.operationCredential.walletSessionId,
-			quotaId: exactRead.record.quotaId
-		});
-	} catch {
-		return { kind: "unavailable" };
-	}
-	if (status.status !== "active") return nearEd25519ReadResultFromRemoteStatus(status);
-	let currentSelectedResult;
-	try {
-		currentSelectedResult = await IndexedDBManager.resolveSelectedWalletAuthority(String(walletId));
-	} catch {
-		return { kind: "persistence_unavailable" };
-	}
-	const currentSelected = exactSelectedWalletAuthority(currentSelectedResult, walletId);
-	if (!currentSelected) return { kind: "missing" };
-	const authorizationNowMs = Date.now();
-	if (status.authorization.expiresAtMs <= authorizationNowMs) return { kind: "expired" };
-	if (status.walletSessionId !== exactRead.operationCredential.walletSessionId || status.quotaId !== exactRead.record.quotaId || status.expiresAtMs !== status.authorization.expiresAtMs || !walletSessionImmutableIdentityMatches(status.authorization, exactRead.record) || !walletSessionMatchesSelectedAuthority(status.authorization, currentSelected)) return { kind: "corrupt" };
-	let replaced;
-	try {
-		replaced = await IndexedDBManager.replaceExactActiveWalletSessionFromStatus({
-			active: status.authorization,
-			operationCredential: exactRead.operationCredential
-		});
-	} catch {
-		return { kind: "persistence_unavailable" };
-	}
-	if (replaced.kind === "superseded") {
-		emitSigningSessionFlowTrace("near", {
-			event: "wallet_session_status_superseded",
-			walletSessionId: exactRead.operationCredential.walletSessionId
-		});
-		return { kind: "unavailable" };
-	}
-	let selectedFactorAuthority;
-	try {
-		selectedFactorAuthority = await resolveBrowserSelectedFactorAuthority(currentSelected);
-	} catch {
-		return { kind: "unavailable" };
-	}
-	try {
-		return {
-			kind: "found",
-			authorization: buildActiveNearEd25519WalletSessionAuthorization({
-				selectedAuthority: currentSelected.authority,
-				selectedAuthMethod: currentSelected.authMethod,
-				selectedFactorAuthority,
-				session: status.authorization,
-				operationCredential: exactRead.operationCredential,
-				status,
-				nowMs: authorizationNowMs
-			})
-		};
-	} catch {
-		return { kind: "corrupt" };
-	}
-}
-async function resolveBrowserActiveNearEd25519WalletSessionAuthorization(walletId, relayerUrl) {
-	const read = await readBrowserExactNearEd25519WalletSessionAuthorization(relayerUrl, new WalletSessionStatusReadScope(), walletId);
-	return read.kind === "found" ? read.authorization : null;
-}
-function isCurrentEcdsaSealedSessionRecord(record) {
-	return record.curve === "ecdsa";
-}
-function manifestMatchesExactEcdsaAuthorization(args) {
-	const { manifest, selected, walletId, chainTarget, materialActivation } = args;
-	return manifest.signer.walletId === walletId && manifest.signer.authority.walletId === walletId && manifest.signer.authority.walletAuthMethodId === selected.authMethod.walletAuthMethodId && mpcMaterialActivationRefsEqual(manifest.activation.materialActivation, materialActivation) && manifest.signer.scope.targetMemberships.some((membership) => thresholdEcdsaChainTargetKey(membership) === thresholdEcdsaChainTargetKey(chainTarget));
-}
-async function buildBrowserEcdsaPreprocessingCapability(args) {
-	const matchingManifests = (await listBrowserActiveEcdsaCapabilityManifestsForWallet(String(args.walletId))).filter((candidate) => manifestMatchesExactEcdsaAuthorization({
-		manifest: candidate,
-		selected: args.selected,
-		walletId: args.walletId,
-		chainTarget: args.chainTarget,
-		materialActivation: args.materialActivation
-	}));
-	if (matchingManifests.length !== 1) return {
-		kind: "inactive",
-		reason: `Expected one exact ECDSA capability manifest; found ${matchingManifests.length}`
-	};
-	const [manifest] = matchingManifests;
-	if (!manifest) return {
-		kind: "inactive",
-		reason: "Exact ECDSA capability manifest is missing"
-	};
-	const capability = await browserCanonicalEcdsaCapabilityFromManifest(manifest);
-	const sealedRecords = await args.context.sealedSigningSessionStore.listExactSealedSessionsForWallet({
-		walletId: String(args.walletId),
-		filter: {
-			authMethod: args.selected.authMethod.kind,
-			curve: "ecdsa",
-			chainTarget: args.chainTarget
-		}
-	});
-	const runtimeResolution = resolveExactEcdsaSealedRuntime({
-		manifest,
-		walletId: args.walletId,
-		chainTarget: args.chainTarget,
-		sealedRecords: sealedRecords.filter(isCurrentEcdsaSealedSessionRecord)
-	});
-	let runtime;
-	if (runtimeResolution.kind === "resolved") {
-		const sealed = runtimeResolution.runtime;
-		runtime = {
-			kind: "exact_ecdsa_sealed_runtime_v1",
-			walletId: sealed.walletId,
-			chainTarget: sealed.chainTarget,
-			materialActivation: sealed.materialActivation,
-			normalSigning: sealed.normalSigning,
-			relayerUrl: sealed.relayerUrl,
-			relayerKeyId: sealed.relayerKeyId,
-			clientVerifyingPublicKey33B64u: sealed.clientVerifyingPublicKey33B64u,
-			participantIds: sealed.participantIds,
-			ecdsaThresholdKeyId: sealed.ecdsaThresholdKeyId,
-			thresholdEcdsaPublicKeyB64u: sealed.thresholdEcdsaPublicKeyB64u,
-			keyHandle: sealed.keyHandle,
-			runtimePolicyScope: sealed.runtimePolicyScope,
-			roleLocalMaterialRef: sealed.roleLocalMaterialRef,
-			authBinding: sealed.authBinding,
-			sealedRecord: sealed.sealedRecord,
-			expiresAtMs: Math.min(sealed.expiresAtMs, args.status.expiresAtMs),
-			remainingUses: args.status.remainingUses
-		};
-	} else {
-		if (runtimeResolution.reason !== "missing_material") return {
-			kind: "inactive",
-			reason: `Exact sealed ECDSA runtime is ${runtimeResolution.reason}`
-		};
-		const capabilityRuntime = await resolveExactEcdsaCapabilityRuntime({
-			manifest,
-			chainTarget: args.chainTarget,
-			relayerUrl: args.context.seamsWebConfigs.network.relayer?.url ?? ""
-		});
-		if (capabilityRuntime.kind !== "resolved") return {
-			kind: "inactive",
-			reason: `Exact durable ECDSA capability runtime is ${capabilityRuntime.reason}`
-		};
-		try {
-			runtime = buildExactEcdsaDirectCapabilityRuntime({
-				runtime: capabilityRuntime.runtime,
-				authority: capability.authority,
-				status: args.status
-			});
-		} catch {
-			return {
-				kind: "inactive",
-				reason: "Exact durable ECDSA quota facts are invalid"
-			};
-		}
-	}
-	try {
-		return {
-			kind: "resolved",
-			capability: buildEcdsaPreprocessingCapability({
-				capability,
-				selected: args.selected,
-				session: args.session,
-				operationCredential: args.operationCredential,
-				runtime,
-				nowMs: args.nowMs
-			})
-		};
-	} catch (error) {
-		return {
-			kind: "inactive",
-			reason: error instanceof Error ? error.message : "Exact ECDSA Wallet Session authorization is invalid"
-		};
-	}
-}
-async function resolveBrowserEcdsaPreprocessingCapability(args, input, statusReads) {
-	const walletId = toWalletId(input.walletId);
-	const nowMs = Date.now();
-	const selected = exactSelectedWalletAuthority(await IndexedDBManager.resolveSelectedWalletAuthority(String(walletId)), walletId);
-	if (!selected) return {
-		kind: "inactive",
-		reason: "Selected wallet authentication authority is unavailable"
-	};
-	const relayerUrl = String(args.seamsWebConfigs.network.relayer?.url || "").trim();
-	if (!relayerUrl) throw new Error("Exact Wallet Session status requires a relayer URL");
-	const exactAuthorization = await readExactWalletSessionAuthorization(walletId);
-	if (exactAuthorization.kind !== "found") return {
-		kind: "inactive",
-		reason: `Exact Wallet Session authorization is ${exactAuthorization.kind}`
-	};
-	if (exactAuthorization.record.expiresAtMs <= nowMs) return {
-		kind: "inactive",
-		reason: "Exact Wallet Session authorization is expired"
-	};
-	const status = await statusReads.read({
-		relayerUrl,
-		operationCredential: exactAuthorization.operationCredential
-	}, {
-		walletSessionId: exactAuthorization.operationCredential.walletSessionId,
-		quotaId: exactAuthorization.record.quotaId
-	});
-	if (status.status !== "active" && status.status !== "exhausted") return {
-		kind: "inactive",
-		reason: `Exact Wallet Session is ${status.status}`
-	};
-	if (walletSessionImmutableIdentityMatches(status.authorization, exactAuthorization.record) && !walletSessionMatchesSelectedAuthority(status.authorization, selected)) try {
-		await IndexedDBManager.reconcilePendingNearRegistrationAuthority({
-			walletSession: status.authorization,
-			operationCredential: exactAuthorization.operationCredential
-		});
-	} catch {
-		return {
-			kind: "inactive",
-			reason: "NEAR authority reconciliation was superseded"
-		};
-	}
-	const currentSelected = exactSelectedWalletAuthority(await IndexedDBManager.resolveSelectedWalletAuthority(String(walletId)), walletId);
-	if (!currentSelected || status.walletSessionId !== exactAuthorization.operationCredential.walletSessionId || status.quotaId !== exactAuthorization.record.quotaId || status.expiresAtMs !== status.authorization.expiresAtMs || !walletSessionImmutableIdentityMatches(status.authorization, exactAuthorization.record) || !walletSessionMatchesSelectedAuthority(status.authorization, currentSelected)) return {
-		kind: "inactive",
-		reason: "Exact Wallet Session status identity is inconsistent"
-	};
-	const authorizationNowMs = Date.now();
-	if (status.authorization.expiresAtMs <= authorizationNowMs) return {
-		kind: "inactive",
-		reason: "Exact Wallet Session authorization is expired"
-	};
-	let replaced;
-	try {
-		replaced = await IndexedDBManager.replaceExactActiveWalletSessionFromStatus({
-			active: status.authorization,
-			operationCredential: exactAuthorization.operationCredential
-		});
-	} catch {
-		return {
-			kind: "inactive",
-			reason: "Exact Wallet Session promotion reconciliation could not be persisted"
-		};
-	}
-	if (replaced.kind === "superseded") {
-		emitSigningSessionFlowTrace("evm-family", {
-			event: "wallet_session_status_superseded",
-			walletSessionId: exactAuthorization.operationCredential.walletSessionId
-		});
-		return {
-			kind: "inactive",
-			reason: "Exact Wallet Session status was superseded by a newer wallet authority"
-		};
-	}
-	const authorizationResolution = await buildBrowserEcdsaPreprocessingCapability({
-		context: args,
-		walletId,
-		selected: currentSelected,
-		session: status.authorization,
-		operationCredential: exactAuthorization.operationCredential,
-		status,
-		chainTarget: input.chainTarget,
-		materialActivation: input.materialActivation,
-		nowMs: authorizationNowMs
-	});
-	if (authorizationResolution.kind !== "resolved") return authorizationResolution;
-	return {
-		kind: "active",
-		capability: authorizationResolution.capability
-	};
-}
-async function resolveBrowserActiveEcdsaWalletSessionAuthorization(args, input, statusReads) {
-	const resolution = await resolveBrowserEcdsaPreprocessingCapability(args, input, statusReads);
-	if (resolution.kind === "inactive") return resolution;
-	const authorization = signingAuthorizationFromPreprocessing(resolution.capability, Date.now());
-	return authorization ? {
-		kind: "active",
-		authorization
-	} : {
-		kind: "inactive",
-		reason: "Exact Wallet Session signing quota is exhausted"
-	};
-}
-async function listBrowserEcdsaPreprocessingCapabilitiesForWallet(args, input, statusReads) {
-	const capabilities = await listBrowserCanonicalEcdsaSigningCapabilitiesForWallet({
-		walletId: toWalletId(input.walletId),
-		chainTargets: input.chainTargets
-	});
-	const available = [];
-	for (const capability of capabilities) for (const chainTarget of input.chainTargets) {
-		const resolution = await resolveBrowserEcdsaPreprocessingCapability(args, {
-			walletId: capability.manifest.signer.walletId,
-			materialActivation: capability.manifest.activation.materialActivation,
-			chainTarget
-		}, statusReads);
-		if (resolution.kind === "active") {
-			available.push(resolution.capability);
-			break;
-		}
-	}
-	return available;
-}
-function createBrowserActiveEcdsaWalletSessionAuthorizationResolver(args) {
-	return async (input) => {
-		const resolution = await resolveBrowserActiveEcdsaWalletSessionAuthorization(args, input, new WalletSessionStatusReadScope());
-		return resolution.kind === "active" ? resolution.authorization : null;
-	};
-}
-/** The wallet's current active manifest covering the requested target, if one
-* exists. This is what a replacement race resolves against: the prepared
-* capability's manifest is gone or retired, but the wallet still signs for the
-* target -- through the replacement. */
-async function activeEcdsaReplacementManifestForTarget(args) {
-	for (const subject of args.subjects) {
-		const lookup = await ecdsaCapabilityManifestStore.lookup(subject);
-		if (lookup.kind === "persistence_unavailable") throw new Error("ECDSA capability persistence is unavailable");
-		if (lookup.kind !== "active") continue;
-		const manifest = lookup.manifest;
-		if (manifest.signer.walletId !== args.walletId) continue;
-		if (manifest.signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetKey(target) === thresholdEcdsaChainTargetKey(args.chainTarget))) return manifest;
-	}
-	return null;
-}
-async function resolveAmbiguousEcdsaActivationForSelectedAuthMethod(input) {
-	const selected = await IndexedDBManager.resolveSelectedWalletAuthority(String(input.walletId));
-	if (selected.kind !== "resolved") throw new Error(`ECDSA material activation is ambiguous and the wallet selection is ${selected.kind}`);
-	const chosen = input.authorities.find((authority) => authority.walletAuthMethodId === selected.selection.walletAuthMethodId);
-	if (!chosen) throw new Error("ECDSA material activation has no access projection for the selected wallet auth method");
-	return await ecdsaCapabilityManifestStore.lookupByMaterialActivation({
-		walletId: input.walletId,
-		materialActivation: input.materialActivation,
-		authority: chosen
-	});
-}
-async function resolveBrowserCanonicalEcdsaSigningCapability(_args, input) {
-	const walletId = toWalletId(input.walletId);
-	const subjects = await ecdsaCapabilityManifestStore.listActiveWalletCapabilitySubjects(walletId);
-	if (subjects.kind !== "resolved") throw new Error(`ECDSA capability subjects are ${subjects.kind}`);
-	const throwSupersededByReplacement = async (fallback) => {
-		const replacement = await activeEcdsaReplacementManifestForTarget({
-			walletId,
-			subjects: subjects.subjects,
-			chainTarget: input.chainTarget
-		});
-		if (replacement) throw new EvmFamilyEcdsaMaterialSupersededError({
-			kind: "superseded",
-			supersessionKind: "material_activation_replaced",
-			preparedMaterialActivation: input.materialActivation,
-			currentMaterialActivation: replacement.activation.materialActivation
-		});
-		return fallback();
-	};
-	let manifestLookup = await ecdsaCapabilityManifestStore.lookupByMaterialActivation({
-		walletId,
-		materialActivation: input.materialActivation
-	});
-	if (manifestLookup.kind === "ambiguous_authority") manifestLookup = await resolveAmbiguousEcdsaActivationForSelectedAuthMethod({
-		walletId,
-		materialActivation: input.materialActivation,
-		authorities: manifestLookup.authorities
-	});
-	if (manifestLookup.kind === "persistence_unavailable" || manifestLookup.kind === "exact_record_conflict" || manifestLookup.kind === "corrupt") throw new Error(`ECDSA material activation is ${manifestLookup.kind}`);
-	if (manifestLookup.kind !== "active") return await throwSupersededByReplacement(() => {
-		throw new Error("ECDSA capability manifest is missing");
-	});
-	const manifest = manifestLookup.manifest;
-	if (manifest.signer.walletId !== walletId || !manifest.signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetKey(target) === thresholdEcdsaChainTargetKey(input.chainTarget))) throw new Error("ECDSA capability manifest does not match the requested signer");
-	return {
-		capability: await browserCanonicalEcdsaCapabilityFromManifest(manifest),
-		lookup: manifestLookup
-	};
-}
-/**
-* A manifest already names its own exact authority, so build the capability
-* from it directly. Re-resolving by material activation would ask "which
-* projection covers this activation" - a question with more than one answer
-* once an added method holds its own.
-*/
-async function browserCanonicalEcdsaCapabilityFromManifest(manifest) {
-	return await buildCanonicalEvmFamilyEcdsaSigningCapability({
-		authority: await resolveExactWalletAuthAuthority(manifest.signer.authority, {
-			getWalletAuthMethodV2: (id) => IndexedDBManager.getWalletAuthMethodV2(id),
-			listWalletAuthMethodsForWallet: (walletId) => IndexedDBManager.listWalletAuthMethodsForWallet(walletId),
-			readEmailOtpProviderSubjectForWallet: (walletId) => readEmailOtpProviderSubjectForWalletV1(IndexedDBManager, walletId)
-		}),
-		manifest,
-		material: buildPersistedEcdsaRoleLocalMaterial({
-			authority: manifest.signer.authority,
-			materialActivation: manifest.activation.materialActivation,
-			publicFacts: manifest.durableMaterial.roleLocalPublicFacts
-		})
-	});
-}
-async function getBrowserCanonicalEcdsaSigningCapability(args, input) {
-	return (await resolveBrowserCanonicalEcdsaSigningCapability(args, input)).capability;
-}
-async function getBrowserEcdsaSigningCapability(args, input) {
-	const resolution = await resolveBrowserActiveEcdsaWalletSessionAuthorization(args, input, new WalletSessionStatusReadScope());
-	if (resolution.kind !== "active") throw new Error(resolution.reason);
-	const browserAuthorization = resolution.authorization;
-	const canonical = await resolveBrowserCanonicalEcdsaSigningCapability(args, input);
-	const projection = await readOwnerWalletExecutionLaneProjectionV1({
-		relayerUrl: String(args.seamsWebConfigs.network.relayer?.url || "").trim(),
-		walletSessionToken: browserAuthorization.operationCredential.token,
-		curve: "ecdsa_secp256k1",
-		expectedMaterialActivation: canonical.capability.manifest.activation.materialActivation
-	});
-	const hydrated = hydrateWalletExecutionLane({
-		walletKey: projection.walletKey,
-		lane: projection.lane,
-		material: {
-			keyFamily: "ecdsa_secp256k1",
-			laneShareEpoch: projection.lane.laneShareEpoch,
-			lookup: canonical.lookup,
-			runtime: { kind: "absent" }
-		}
-	});
-	if (hydrated.kind !== "active_wallet_execution_lane_v1") throw new Error(`Owner ECDSA execution lane is ${hydrated.reason}`);
-	return authorizeEvmFamilyEcdsaSigningCapability({
-		capability: canonical.capability,
-		authorization: browserAuthorization,
-		nowMs: Date.now()
-	});
-}
-async function listBrowserEcdsaSigningCapabilitiesForWallet(args, input, statusReads) {
-	const capabilities = await listBrowserCanonicalEcdsaSigningCapabilitiesForWallet({
-		walletId: toWalletId(input.walletId),
-		chainTargets: input.chainTargets,
-		...input.authMethod ? { authMethod: input.authMethod } : {}
-	});
-	return await Promise.all(capabilities.map(resolveBrowserEcdsaCapabilityAvailability.bind(null, args, input.chainTargets, statusReads)));
-}
-async function resolveBrowserEcdsaCapabilityAvailability(args, chainTargets, statusReads, capability) {
-	const manifest = capability.manifest;
-	const matchingTarget = chainTargets.find((target) => manifest.signer.scope.targetMemberships.some((membership) => thresholdEcdsaChainTargetKey(target) === thresholdEcdsaChainTargetKey(membership)));
-	if (!matchingTarget) return {
-		kind: "authorization_required",
-		capability
-	};
-	const resolution = await resolveBrowserActiveEcdsaWalletSessionAuthorization(args, {
-		walletId: manifest.signer.walletId,
-		chainTarget: matchingTarget,
-		materialActivation: manifest.activation.materialActivation
-	}, statusReads);
-	if (resolution.kind === "active") try {
-		return authorizeEvmFamilyEcdsaSigningCapability({
-			capability,
-			authorization: resolution.authorization,
-			nowMs: Date.now()
-		});
-	} catch {}
-	return {
-		kind: "authorization_required",
-		capability
-	};
-}
-/** Durable key facts are independent of a Wallet Session's current budget. */
-async function listBrowserCanonicalEcdsaSigningCapabilitiesForWallet(input) {
-	const subjects = await ecdsaCapabilityManifestStore.listActiveWalletCapabilitySubjects(input.walletId);
-	if (subjects.kind !== "resolved") return [];
-	const capabilities = [];
-	for (const subject of subjects.subjects) {
-		const lookup = await ecdsaCapabilityManifestStore.lookup(subject);
-		if (lookup.kind !== "active") continue;
-		const manifest = lookup.manifest;
-		if (!manifest.signer.scope.targetMemberships.some((membership) => input.chainTargets.some((target) => thresholdEcdsaChainTargetKey(target) === thresholdEcdsaChainTargetKey(membership)))) continue;
-		let capability;
-		try {
-			capability = await browserCanonicalEcdsaCapabilityFromManifest(manifest);
-		} catch {
-			continue;
-		}
-		const capabilityAuthMethod = isPasskeyWalletAuthAuthority(capability.authority) ? "passkey" : isEmailOtpWalletAuthAuthority(capability.authority) ? "email_otp" : null;
-		if (!capabilityAuthMethod || input.authMethod && capabilityAuthMethod !== input.authMethod) continue;
-		capabilities.push(capability);
-	}
-	return capabilities;
-}
-async function listBrowserActiveEcdsaCapabilityManifestsForWallet(walletIdInput) {
-	const walletId = toWalletId(walletIdInput);
-	const subjects = await ecdsaCapabilityManifestStore.listActiveWalletCapabilitySubjects(walletId);
-	if (subjects.kind !== "resolved") return [];
-	const manifests = [];
-	for (const subject of subjects.subjects) {
-		const lookup = await ecdsaCapabilityManifestStore.lookup(subject);
-		if (lookup.kind === "active") manifests.push(lookup.manifest);
-	}
-	return manifests;
-}
-const browserActiveEcdsaCapabilityRuntimeReadPorts = {
-	listActiveEcdsaCapabilityManifestsForWallet: listBrowserActiveEcdsaCapabilityManifestsForWallet,
-	listExactSealedSessionsForWallet,
-	resolveSelectedWalletAuthority: IndexedDBManager.resolveSelectedWalletAuthority.bind(IndexedDBManager)
-};
-const resolveBrowserActiveEcdsaCapabilityRuntime = createActiveEcdsaCapabilityRuntimeResolver(browserActiveEcdsaCapabilityRuntimeReadPorts);
-const resolveBrowserActiveEcdsaCapabilityRuntimeForChain = createActiveEcdsaCapabilityRuntimeForChainResolver(browserActiveEcdsaCapabilityRuntimeReadPorts);
-async function requestEmailOtpEcdsaStepUpChallenge(args) {
-	switch (args.authority.kind) {
-		case "live_session": return await args.coordinator.requestTransactionSigningChallenge({
-			kind: "wallet_session_challenge",
-			walletSession: args.walletSession,
-			chain: args.chain,
-			authLane: args.authority.authLane,
-			operationFingerprintDigest: args.operationFingerprintDigest
-		});
-		case "capability_step_up": return await args.coordinator.requestTransactionSigningChallenge({
-			kind: "wallet_login_challenge",
-			walletSession: args.walletSession,
-			chain: args.chain,
-			operationFingerprintDigest: args.operationFingerprintDigest
-		});
-	}
-}
-function createBrowserSigningSurfaceEnginePorts(args) {
-	const readCanonicalWalletSessionStatus = createBrowserCanonicalWalletSessionStatusReader(args);
-	return createSigningEnginePorts({
-		runtimePorts: args.runtimePorts,
-		stores: args.stores,
-		ed25519YaoPublicCapabilityReferences: args.ed25519YaoPublicCapabilityReferences,
-		seamsWebConfigs: args.seamsWebConfigs,
-		nearClient: args.nearClient,
-		touchIdPrompt: args.touchIdPrompt,
-		userPreferencesManager: args.userPreferencesManager,
-		nonceCoordinator: args.nonceCoordinator,
-		ensureSealedRefreshStartupParity: args.ensureSealedRefreshStartupParity,
-		touchConfirm: args.touchConfirm,
-		passkeyMpcSession: args.passkeyMpcSession,
-		passkeyMpcExport: args.passkeyMpcExport,
-		getEmailOtpWarmSessionStatus: (target) => args.emailOtpSessions.readWarmSessionStatusOnly(target),
-		consumeEmailOtpWarmSessionUses: (consumeArgs) => args.emailOtpSessions.consumeWarmSessionUses(consumeArgs),
-		clearEmailOtpWarmSessionMaterial: (thresholdSessionId) => args.emailOtpSessions.clearVolatileWarmSessionMaterial({
-			kind: "ecdsa",
-			thresholdSessionId
-		}),
-		getWalletSessionStatus: (statusArgs) => readCanonicalWalletSessionStatus(statusArgs),
-		resolveCanonicalEcdsaSigningCapability: (input) => getBrowserCanonicalEcdsaSigningCapability(args, input),
-		resolveAuthorizedEcdsaSigningCapability: (input) => getBrowserEcdsaSigningCapability(args, input),
-		resolveActiveEcdsaWalletSessionAuthorization: createBrowserActiveEcdsaWalletSessionAuthorizationResolver(args),
-		resolveOwnerLaneScope: args.resolveOwnerLaneScope,
-		signerWorkerManager: args.signerWorkerManager,
-		getWorkerBaseOrigin: args.getWorkerBaseOrigin,
-		workerWarmupPolicy: args.workerWarmupPolicy,
-		getTheme: args.getTheme,
-		signTempo: (signArgs) => signEvmFamily(args.getEnginePorts().tempoSigningDeps, signArgs),
-		activateAuthenticatedWalletState: (activationArgs) => activateAuthenticatedWalletState(args.getRegistrationPublicDeps(), {
-			walletId: activationArgs.walletId,
-			nearAccountId: activationArgs.nearAccountId,
-			signerSlot: activationArgs.signerSlot,
-			nearClient: activationArgs.nearClient
-		}),
-		persistThresholdEcdsaBootstrapForWalletTarget: (persistArgs) => persistThresholdEcdsaBootstrapForWalletTarget({
-			bootstrapStore: args.ecdsaBootstrapStore,
-			walletId: persistArgs.walletId,
-			chainTarget: persistArgs.chainTarget,
-			bootstrap: persistArgs.bootstrap,
-			signerAuth: persistArgs.signerAuth
-		}),
-		requestEmailOtpTransactionSigningChallenge: (challengeArgs) => requestEmailOtpEcdsaStepUpChallenge({
-			coordinator: args.emailOtpSessions,
-			walletSession: challengeArgs.walletSession,
-			chain: challengeArgs.chain,
-			authority: challengeArgs.authority,
-			operationFingerprintDigest: challengeArgs.operationFingerprintDigest
-		}),
-		requestEmailOtpEd25519SigningChallenge: ({ walletSession, operationFingerprintDigest }) => args.emailOtpSessions.requestTransactionSigningChallenge({
-			kind: "wallet_login_challenge",
-			walletSession,
-			chain: "near",
-			operationFingerprintDigest
-		}),
-		prepareNearEd25519YaoMaterialBoundary: args.prepareNearEd25519YaoMaterialBoundary,
-		provisionThresholdEd25519Session: (provisionArgs) => provisionThresholdEd25519Session({
-			credentialStore: args.stores.recoveryAndDeviceLinking.credentialStore,
-			touchIdPrompt: args.touchIdPrompt,
-			touchConfirm: args.passkeyMpcSession,
-			defaultRelayerUrl: args.seamsWebConfigs.network.relayer?.url || "",
-			getSignerWorkerContext: () => args.getEnginePorts().walletSessionActivationDeps.getSignerWorkerContext()
-		}, provisionArgs),
-		restorePersistedSessionForSigning: (restoreArgs) => restoreArgs.authMethod === "passkey" ? args.passkeyMpcSession.restorePersistedSessionForSigning(omitPasskeyRestoreAuthMethod(restoreArgs)) : args.emailOtpSessions.restorePersistedSessionForSigning(restoreArgs),
-		readAvailableSigningLanesForSigning: async (readArgs) => readPersistedAvailableSigningLanesForSigning({
-			activeWalletAuthorityEcdsaRuntimeReadPorts: {
-				resolveSelectedWalletAuthority: IndexedDBManager.resolveSelectedWalletAuthority.bind(IndexedDBManager),
-				readExactWithOperationCredential: walletSessionAuthorizations.readExactWithOperationCredential.bind(walletSessionAuthorizations)
-			},
-			ed25519YaoPublicCapabilityLanes: args.ed25519YaoPublicCapabilityReferences,
-			isEd25519YaoPublicCapabilityActive: (reference) => {
-				switch (reference.auth.kind) {
-					case "email_otp": return true;
-					case "passkey": return args.getEnginePorts().ed25519YaoActiveClients.resolve({
-						walletId: reference.walletId,
-						nearAccountId: reference.nearAccountId,
-						materialActivation: reference.materialActivation
-					}) !== null;
-				}
-			},
-			readActiveWalletSessionAuthorization: readBrowserExactNearEd25519WalletSessionAuthorization.bind(null, args.seamsWebConfigs.network.relayer.url),
-			listEcdsaSigningCapabilitiesForWallet: listBrowserEcdsaSigningCapabilitiesForWallet.bind(null, args)
-		}, readArgs, configuredThresholdEcdsaChainTargets(args.seamsWebConfigs.network.chains)),
-		provisionThresholdEcdsaSession: (provisionArgs) => provisionThresholdEcdsaSession({
-			queueByWallet: args.thresholdEcdsaBootstrapQueueByWallet,
-			activationDeps: args.getEnginePorts().walletSessionActivationDeps,
-			persistEcdsaRoleLocalReadyRecord: args.runtimePorts.storage.persistEcdsaRoleLocalReadyRecord
-		}, provisionArgs),
-		withThresholdEcdsaSigningQueue: (queueArgs) => withThresholdEcdsaSigningQueue({
-			queueByKey: args.thresholdEcdsaSigningQueueByKey,
-			...queueArgs,
-			walletId: toWalletId(queueArgs.walletId)
-		}),
-		withThresholdEd25519CommitQueue: (queueArgs) => withThresholdEd25519CommitQueue({
-			queueByKey: args.thresholdEd25519CommitQueueByKey,
-			...queueArgs
-		})
-	});
-}
-//#endregion
-export { createBrowserActiveEcdsaWalletSessionAuthorizationResolver, createBrowserCanonicalWalletSessionStatusReader, createBrowserSigningSurfaceEnginePorts, listBrowserActiveEcdsaCapabilityManifestsForWallet, listBrowserCanonicalEcdsaSigningCapabilitiesForWallet, listBrowserEcdsaPreprocessingCapabilitiesForWallet, listBrowserEcdsaSigningCapabilitiesForWallet, readBrowserExactNearEd25519WalletSessionAuthorization, resolveAmbiguousEcdsaActivationForSelectedAuthMethod, resolveBrowserActiveEcdsaCapabilityRuntime, resolveBrowserActiveEcdsaCapabilityRuntimeForChain, resolveBrowserActiveNearEd25519WalletSessionAuthorization, resolveBrowserNearEd25519PasskeyAuthorityForMaterial };
-
-//# sourceMappingURL=browserSigningSurfaceAssembly.js.map