@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/platform/signerCoreCommandAdapters.js

@@ -1,122 +0,0 @@
-import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
-//#region src/core/platform/signerCoreCommandAdapters.ts
-function requireBase64UrlBytes(value, field, byteLength) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`[signer-core-command] ${field} is required`);
-	if (base64UrlDecode(normalized).length !== byteLength) throw new Error(`[signer-core-command] ${field} must decode to ${byteLength} bytes`);
-	return normalized;
-}
-function requireSignerCoreCommandObject(value, field) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`[signer-core-command] ${field} must be an object`);
-	return value;
-}
-function requireSignerCoreCommandFields(value, expectedFields, field) {
-	const actualFields = Object.keys(value).sort();
-	const expected = [...expectedFields].sort();
-	if (actualFields.length !== expected.length || actualFields.some((key, index) => key !== expected[index])) throw new Error(`[signer-core-command] ${field} fields are invalid`);
-}
-function requireSignerCoreCommandString(value, field) {
-	if (typeof value !== "string") throw new Error(`[signer-core-command] ${field} must be a string`);
-	const normalized = value.trim();
-	if (!normalized) throw new Error(`[signer-core-command] ${field} is required`);
-	return normalized;
-}
-function parseDerivationClientSharePublicKey33B64u(value) {
-	return requireBase64UrlBytes(value, "derivationClientSharePublicKey33B64u", 33);
-}
-function parseRelayerEcdsaDerivationPublicKey33B64u(value) {
-	return requireBase64UrlBytes(value, "relayerPublicKey33B64u", 33);
-}
-function parsePublicKey33B64u(value, field) {
-	return requireBase64UrlBytes(value, field, 33);
-}
-function parseEthereumAddress(value) {
-	const normalized = String(value || "").trim();
-	if (!/^0x[0-9a-fA-F]{40}$/.test(normalized)) throw new Error("[signer-core-command] ethereumAddress must be 0x-prefixed 20-byte hex");
-	return normalized;
-}
-function parsePendingStateBlob(input) {
-	const record = requireSignerCoreCommandObject(input, "ECDSA pending state blob");
-	requireSignerCoreCommandFields(record, [
-		"kind",
-		"curve",
-		"encoding",
-		"producer",
-		"stateBlobB64u"
-	], "ECDSA pending state blob");
-	if (Reflect.get(record, "kind") !== "ecdsa_role_local_pending_state_blob_v1" || Reflect.get(record, "curve") !== "secp256k1" || Reflect.get(record, "encoding") !== "base64url" || Reflect.get(record, "producer") !== "signer_core") throw new Error("[signer-core-command] invalid ECDSA pending state blob envelope");
-	return {
-		kind: "ecdsa_role_local_pending_state_blob_v1",
-		curve: "secp256k1",
-		encoding: "base64url",
-		producer: "signer_core",
-		stateBlobB64u: requireSignerCoreCommandString(Reflect.get(record, "stateBlobB64u"), "pendingStateBlob.stateBlobB64u")
-	};
-}
-function parseReadyStateBlob(input) {
-	if (input.kind !== "ecdsa_role_local_state_blob_v1" || input.curve !== "secp256k1" || input.encoding !== "base64url" || input.producer !== "signer_core") throw new Error("[signer-core-command] invalid ECDSA ready state blob envelope");
-	return input;
-}
-function toGeneratedPrepareEcdsaClientBootstrapCommand(input) {
-	return {
-		kind: input.kind,
-		algorithm: input.algorithm,
-		context: { applicationBindingDigestB64u: input.context.applicationBindingDigestB64u },
-		participants: {
-			clientParticipantId: input.participants.clientParticipantId,
-			relayerParticipantId: input.participants.relayerParticipantId,
-			participantIds: [...input.participants.participantIds]
-		},
-		secretSource: {
-			kind: "threshold_prf_x_client_base",
-			xClientBaseB64u: requireBase64UrlBytes(input.secretSource.xClientBaseB64u, "secretSource.xClientBaseB64u", 32)
-		}
-	};
-}
-function parseGeneratedPrepareEcdsaClientBootstrapOutput(input) {
-	if (input.clientBootstrap.participantId !== 1) throw new Error("[signer-core-command] ECDSA client bootstrap participantId must be 1");
-	const derivationClientSharePublicKey33B64u = parseDerivationClientSharePublicKey33B64u(input.clientBootstrap.derivationClientSharePublicKey33B64u);
-	return {
-		pendingStateBlob: parsePendingStateBlob(input.pendingStateBlob),
-		clientBootstrap: {
-			contextBinding32B64u: requireBase64UrlBytes(input.clientBootstrap.contextBinding32B64u, "contextBinding32B64u", 32),
-			derivationClientSharePublicKey33B64u,
-			clientShareRetryCounter: input.clientBootstrap.clientShareRetryCounter,
-			participantId: 1
-		},
-		publicFacts: {
-			derivationClientSharePublicKey33B64u: parseDerivationClientSharePublicKey33B64u(input.publicFacts.derivationClientSharePublicKey33B64u),
-			clientVerifyingShareB64u: parsePublicKey33B64u(input.publicFacts.clientVerifyingShareB64u, "clientVerifyingShareB64u")
-		}
-	};
-}
-function toGeneratedFinalizeEcdsaClientBootstrapCommand(input) {
-	return {
-		kind: input.kind,
-		pendingStateBlob: input.pendingStateBlob,
-		relayerPublicIdentity: {
-			relayerKeyId: input.relayerPublicIdentity.relayerKeyId,
-			relayerPublicKey33B64u: input.relayerPublicIdentity.relayerPublicKey33B64u,
-			groupPublicKey33B64u: input.relayerPublicIdentity.groupPublicKey33B64u,
-			ethereumAddress: input.relayerPublicIdentity.ethereumAddress,
-			relayerShareRetryCounter: input.relayerPublicIdentity.relayerShareRetryCounter
-		}
-	};
-}
-function parseGeneratedFinalizeEcdsaClientBootstrapOutput(input) {
-	return {
-		stateBlob: parseReadyStateBlob(input.stateBlob),
-		publicFacts: {
-			contextBinding32B64u: requireBase64UrlBytes(input.publicFacts.contextBinding32B64u, "contextBinding32B64u", 32),
-			derivationClientSharePublicKey33B64u: parseDerivationClientSharePublicKey33B64u(input.publicFacts.derivationClientSharePublicKey33B64u),
-			clientVerifyingShareB64u: parsePublicKey33B64u(input.publicFacts.clientVerifyingShareB64u, "clientVerifyingShareB64u"),
-			relayerPublicKey33B64u: parseRelayerEcdsaDerivationPublicKey33B64u(input.publicFacts.relayerPublicKey33B64u),
-			groupPublicKey33B64u: parsePublicKey33B64u(input.publicFacts.groupPublicKey33B64u, "groupPublicKey33B64u"),
-			ethereumAddress: parseEthereumAddress(input.publicFacts.ethereumAddress)
-		}
-	};
-}
-//#endregion
-export { parseGeneratedFinalizeEcdsaClientBootstrapOutput, parseGeneratedPrepareEcdsaClientBootstrapOutput, toGeneratedFinalizeEcdsaClientBootstrapCommand, toGeneratedPrepareEcdsaClientBootstrapCommand };
-
-//# sourceMappingURL=signerCoreCommandAdapters.js.map

package/dist/esm/core/rpcClients/near/rpcCalls.js

@@ -1,376 +0,0 @@
-import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { joinNormalizedUrl } from "../../../shared-ts/src/utils/normalize.js";
-import { isObject, requireTrimmedString } from "../../../shared-ts/src/utils/validation.js";
-import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
-import { requireRouterAbEd25519NormalSigningState } from "../../../shared-ts/src/utils/signingSessionSeal.js";
-import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../../../shared-ts/src/passkey-custody/index.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { redactCredentialExtensionOutputs } from "../../signingEngine/webauthnAuth/credentials/credentialExtensions.js";
-import { parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import "../../../shared-ts/src/device-linking/index.js";
-import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
-import { parseWalletSessionAlreadyCommittedResponseV1, parseWalletUnlockAlreadyCommittedResponseV1 } from "../../../shared-ts/src/authorization/walletSessionIssuance.js";
-import "../../../shared-ts/src/authorization/index.js";
-import { parseEd25519YaoRecoveryCapabilityV1 } from "../../signingEngine/session/passkey/ed25519YaoRecoveryCapability.js";
-//#region src/core/rpcClients/near/rpcCalls.ts
-function sleep(ms) {
-	return new Promise((res) => setTimeout(res, ms));
-}
-/**
-* Best-effort on-chain account existence check.
-*
-* Used to short-circuit UX flows (e.g. registration) before prompting the user.
-* Returns `false` on unknown/non-deterministic failures so that downstream flows
-* can rely on the Router API/contract for final enforcement.
-*/
-async function checkNearAccountExistsBestEffort(nearClient, nearAccountId, opts) {
-	const isNotFound = (m) => /does not exist|UNKNOWN_ACCOUNT|unknown\s+account/i.test(m);
-	const isRetryable = (m) => /server error|internal|temporar|timeout|too many requests|429|empty response|rpc request failed|failed to fetch/i.test(m);
-	const attempts = Math.max(1, Math.floor(opts?.attempts ?? 2));
-	const baseDelayMs = Math.max(50, Math.floor(opts?.delayMs ?? 150));
-	for (let i = 1; i <= attempts; i++) try {
-		await nearClient.viewAccount(nearAccountId);
-		return true;
-	} catch (err) {
-		const msg = errorMessage(err);
-		const details = err && typeof err === "object" && "details" in err ? err.details : void 0;
-		let detailsBlob = "";
-		if (details) try {
-			detailsBlob = typeof details === "string" ? details : JSON.stringify(details);
-		} catch {
-			detailsBlob = "";
-		}
-		const combined = `${msg}\n${detailsBlob}`.trim();
-		if (isNotFound(combined)) return false;
-		if (isRetryable(combined) && i < attempts) {
-			await sleep(baseDelayMs * Math.pow(2, i - 1));
-			continue;
-		}
-		console.warn(`[rpcCalls] Account existence check failed for '${nearAccountId}'; continuing:`, err);
-		return false;
-	}
-	return false;
-}
-function parsePasskeyWalletCustodyUnlockV1(raw) {
-	if (!isObject(raw) || raw.kind !== "wallet_custody_passkey_login_v1") throw new Error("Passkey wallet unlock returned invalid custody data");
-	if (!isObject(raw.ed25519)) throw new Error("Passkey wallet unlock omitted Ed25519 custody continuity");
-	if (raw.ed25519.kind === "absent") return {
-		kind: "wallet_custody_passkey_login_v1",
-		envelope: parsePasskeyCustodyEnvelopeRecord(raw.envelope),
-		storeVersion: requireTrimmedString(raw.storeVersion, "walletCustody.storeVersion"),
-		ed25519: { kind: "absent" }
-	};
-	if (raw.ed25519.kind !== "active") throw new Error("Passkey wallet unlock returned invalid Ed25519 custody state");
-	const signerSlot = Number(raw.ed25519.signerSlot);
-	const participantIds = raw.ed25519.participantIds;
-	if (!Number.isSafeInteger(signerSlot) || signerSlot < 1 || !Array.isArray(participantIds) || participantIds.length !== 2 || !participantIds.every((value) => Number.isSafeInteger(value) && Number(value) > 0) || participantIds[0] === participantIds[1]) throw new Error("Passkey wallet unlock returned invalid Ed25519 signer identity");
-	return {
-		kind: "wallet_custody_passkey_login_v1",
-		envelope: parsePasskeyCustodyEnvelopeRecord(raw.envelope),
-		storeVersion: requireTrimmedString(raw.storeVersion, "walletCustody.storeVersion"),
-		ed25519: {
-			kind: "active",
-			nearAccountId: requireTrimmedString(raw.ed25519.nearAccountId, "walletCustody.ed25519.nearAccountId"),
-			nearEd25519SigningKeyId: requireTrimmedString(raw.ed25519.nearEd25519SigningKeyId, "walletCustody.ed25519.nearEd25519SigningKeyId"),
-			signerSlot,
-			publicKey: requireTrimmedString(raw.ed25519.publicKey, "walletCustody.ed25519.publicKey"),
-			relayerKeyId: requireTrimmedString(raw.ed25519.relayerKeyId, "walletCustody.ed25519.relayerKeyId"),
-			participantIds: [Number(participantIds[0]), Number(participantIds[1])],
-			capability: parseEd25519YaoRecoveryCapabilityV1(raw.ed25519.capability)
-		}
-	};
-}
-function parseSessionEcdsaChainTarget(value) {
-	if (!isObject(value)) throw new Error("ECDSA custody chain target is invalid");
-	const kind = requireTrimmedString(value.kind, "ecdsaCustody.chainTarget.kind");
-	const chainId = Number(value.chainId);
-	const networkSlug = requireTrimmedString(value.networkSlug, "ecdsaCustody.chainTarget.networkSlug");
-	if (!Number.isSafeInteger(chainId) || chainId < 0 || !networkSlug) throw new Error("ECDSA custody chain target is invalid");
-	if (kind === "evm") {
-		if (value.namespace !== "eip155") throw new Error("ECDSA custody EVM namespace is invalid");
-		return {
-			kind: "evm",
-			namespace: "eip155",
-			chainId,
-			networkSlug
-		};
-	}
-	if (kind === "tempo") return {
-		kind: "tempo",
-		chainId,
-		networkSlug
-	};
-	throw new Error("ECDSA custody chain target kind is invalid");
-}
-function parsePasskeySessionEcdsaCustodyContinuity(raw) {
-	if (!isObject(raw) || raw.kind !== "wallet_custody_ecdsa_sync_continuity_v1") throw new Error("Passkey wallet unlock returned invalid ECDSA custody continuity");
-	if (!Array.isArray(raw.signers)) throw new Error("Passkey wallet unlock returned invalid ECDSA custody signers");
-	const signers = [];
-	for (const value of raw.signers) {
-		if (!isObject(value) || !isObject(value.walletKey)) throw new Error("Passkey wallet unlock returned invalid ECDSA custody signer");
-		const walletKey = value.walletKey;
-		const participantIds = walletKey.participantIds;
-		if (!Array.isArray(participantIds) || participantIds.length !== 2 || participantIds[0] !== 1 || participantIds[1] !== 2) throw new Error("Passkey wallet unlock returned invalid ECDSA custody participants");
-		signers.push({
-			chainTarget: parseSessionEcdsaChainTarget(value.chainTarget),
-			walletKey: {
-				walletId: requireTrimmedString(walletKey.walletId, "ecdsaCustody.walletKey.walletId"),
-				keyHandle: requireTrimmedString(walletKey.keyHandle, "ecdsaCustody.walletKey.keyHandle"),
-				ecdsaThresholdKeyId: requireTrimmedString(walletKey.ecdsaThresholdKeyId, "ecdsaCustody.walletKey.ecdsaThresholdKeyId"),
-				signingRootId: requireTrimmedString(walletKey.signingRootId, "ecdsaCustody.walletKey.signingRootId"),
-				signingRootVersion: requireTrimmedString(walletKey.signingRootVersion, "ecdsaCustody.walletKey.signingRootVersion"),
-				relayerKeyId: requireTrimmedString(walletKey.relayerKeyId, "ecdsaCustody.walletKey.relayerKeyId"),
-				contextBinding32B64u: requireTrimmedString(walletKey.contextBinding32B64u, "ecdsaCustody.walletKey.contextBinding32B64u"),
-				derivationClientSharePublicKey33B64u: requireTrimmedString(walletKey.derivationClientSharePublicKey33B64u, "ecdsaCustody.walletKey.derivationClientSharePublicKey33B64u"),
-				participantIds: [1, 2],
-				publicCapability: parseRouterAbEcdsaDerivationPublicCapabilityV1(walletKey.publicCapability)
-			},
-			activationReceipt: parseRouterAbEcdsaRegistrationActivationReceiptV1(value.activationReceipt),
-			runtimePolicyScope: normalizeRuntimePolicyScope(value.runtimePolicyScope)
-		});
-	}
-	if (signers.length === 0) throw new Error("Passkey wallet unlock omitted ECDSA custody signers");
-	return {
-		kind: "wallet_custody_ecdsa_sync_continuity_v1",
-		signers
-	};
-}
-/**
-* Resolves the response branch and validates the exact credential supplied by
-* the branch. A reused response has no new credential of its own.
-*/
-function parseEd25519SessionCredential(input) {
-	const sessionKind = input.raw.sessionKind;
-	if (sessionKind === "issued_exact_wallet_session") {
-		const issued = parseWalletSessionOperationCredentialV1(input.raw.operationCredential);
-		if (issued.walletSessionId !== input.walletSessionId) throw new Error("Wallet unlock Ed25519 credential does not identify its session");
-		return {
-			sessionKind,
-			operationCredential: issued
-		};
-	}
-	if (sessionKind !== "already_committed_exact_wallet_session") throw new Error("Wallet unlock returned an unsupported Ed25519 session kind");
-	if (input.raw.operationCredential !== void 0) throw new Error("Reused Ed25519 Wallet Session must not carry its own credential");
-	if (parseWalletSessionOperationCredentialV1(input.unlockCredential).walletSessionId !== input.walletSessionId) throw new Error("Wallet unlock Ed25519 session reuses another Wallet Session");
-	return { sessionKind };
-}
-function parsePasskeyWalletUnlockEd25519Session(raw, unlockCredential) {
-	if (raw === null) return null;
-	if (!isObject(raw)) throw new Error("Wallet unlock returned invalid Ed25519 session data");
-	const thresholdSessionId = parseThresholdEd25519SessionId(raw.thresholdSessionId);
-	const authorizationId = parseWalletSessionAuthorizationId(raw.authorizationId);
-	const walletSessionId = parseWalletSessionId(raw.walletSessionId);
-	const quotaId = parseMpcWalletSigningQuotaId(raw.quotaId);
-	const expiresAtMs = Number(raw.expiresAtMs);
-	const remainingUses = Number(raw.remainingUses);
-	const runtimePolicyScope = normalizeRuntimePolicyScope(raw.runtimePolicyScope);
-	const routerAbNormalSigning = requireRouterAbEd25519NormalSigningState(raw.routerAbNormalSigning);
-	const participantIds = raw.participantIds;
-	if (!thresholdSessionId.ok || !authorizationId.ok || !walletSessionId.ok || !quotaId.ok || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= Date.now() || !Number.isSafeInteger(remainingUses) || remainingUses < 1 || !Array.isArray(participantIds) || participantIds.length !== 2 || !participantIds.every((participantId) => Number.isSafeInteger(participantId) && participantId > 0) || participantIds[0] === participantIds[1]) throw new Error("Wallet unlock returned invalid Ed25519 session lifecycle");
-	const credential = parseEd25519SessionCredential({
-		raw,
-		walletSessionId: walletSessionId.value,
-		unlockCredential
-	});
-	return {
-		walletId: requireTrimmedString(raw.walletId, "ed25519Session.walletId"),
-		nearAccountId: requireTrimmedString(raw.nearAccountId, "ed25519Session.nearAccountId"),
-		nearEd25519SigningKeyId: requireTrimmedString(raw.nearEd25519SigningKeyId, "ed25519Session.nearEd25519SigningKeyId"),
-		relayerKeyId: requireTrimmedString(raw.relayerKeyId, "ed25519Session.relayerKeyId"),
-		participantIds: [Number(participantIds[0]), Number(participantIds[1])],
-		thresholdSessionId: thresholdSessionId.value,
-		authorizationId: authorizationId.value,
-		walletSessionId: walletSessionId.value,
-		quotaId: quotaId.value,
-		expiresAtMs,
-		remainingUses,
-		runtimePolicyScope,
-		routerAbNormalSigning,
-		...credential
-	};
-}
-function assertPasskeyCredentialFreeActivationMatchesAuthorization(input) {
-	const record = input.authorization.record;
-	const ecdsaMaterialActivation = routerAbMpcMaterialActivationRefFromWire(input.ecdsaSession.public_capability.material_activation);
-	let matchingEcdsaSubjectCount = 0;
-	for (const subject of record.capabilitySubjects) if (subject.kind === "sign" && subject.keyFamily === "ecdsa_secp256k1" && mpcMaterialActivationRefsEqual(subject.materialActivation, ecdsaMaterialActivation)) matchingEcdsaSubjectCount += 1;
-	if (record.walletId !== input.ed25519Session.walletId || record.walletId !== input.ecdsaSession.public_capability.client_id || record.authorizationId !== input.ed25519Session.authorizationId || record.authorizationId !== input.ecdsaSession.session.authorization_id || record.quotaId !== input.ed25519Session.quotaId || record.quotaId !== input.ecdsaSession.session.quota_id || record.expiresAtMs !== input.ed25519Session.expiresAtMs || record.expiresAtMs !== input.ecdsaSession.session.expires_at_ms || input.ed25519Session.walletSessionId !== input.ecdsaSession.session.wallet_session_id || input.authorization.operationCredential.walletSessionId !== input.ed25519Session.walletSessionId || input.ed25519Session.remainingUses !== input.ecdsaSession.session.remaining_uses || matchingEcdsaSubjectCount !== 1) throw new Error("Passkey ECDSA activation authority does not match its Wallet Session");
-}
-function assertPasskeyEd25519SessionMatchesAuthorization(input) {
-	const record = input.authorization.record;
-	if (record.walletId !== input.ed25519Session.walletId || record.authorizationId !== input.ed25519Session.authorizationId || record.quotaId !== input.ed25519Session.quotaId || record.expiresAtMs !== input.ed25519Session.expiresAtMs || input.authorization.operationCredential.walletSessionId !== input.ed25519Session.walletSessionId) throw new Error("Passkey Ed25519 Wallet Session authorization is inconsistent");
-}
-async function resolvePasskeyEd25519SessionAuthorization(input, statusReads) {
-	const hasWalletSession = input.data.walletSession !== void 0;
-	if (hasWalletSession !== (input.data.operationCredential !== void 0)) throw new Error("Passkey wallet unlock returned a partial Wallet Session authorization");
-	if (hasWalletSession) {
-		if (input.ed25519Session.sessionKind !== "already_committed_exact_wallet_session") throw new Error("Passkey wallet unlock returned competing Wallet Session credentials");
-		const authorization = {
-			record: parseActiveWalletSessionV1(input.data.walletSession),
-			operationCredential: parseWalletSessionOperationCredentialV1(input.data.operationCredential)
-		};
-		assertPasskeyEd25519SessionMatchesAuthorization({
-			ed25519Session: input.ed25519Session,
-			authorization
-		});
-		return authorization;
-	}
-	if (input.ed25519Session.sessionKind !== "issued_exact_wallet_session") throw new Error("Passkey wallet unlock omitted the exact Wallet Session credential");
-	const status = await statusReads.read({
-		relayerUrl: input.relayServerUrl,
-		operationCredential: input.ed25519Session.operationCredential
-	}, {
-		walletSessionId: input.ed25519Session.walletSessionId,
-		quotaId: input.ed25519Session.quotaId
-	});
-	if (status.status !== "active" || status.walletSessionId !== input.ed25519Session.walletSessionId || status.quotaId !== input.ed25519Session.quotaId || status.expiresAtMs !== input.ed25519Session.expiresAtMs || status.remainingUses !== input.ed25519Session.remainingUses) throw new Error("Passkey wallet unlock returned an inconsistent issued Wallet Session");
-	const authorization = {
-		record: status.authorization,
-		operationCredential: input.ed25519Session.operationCredential
-	};
-	assertPasskeyEd25519SessionMatchesAuthorization({
-		ed25519Session: input.ed25519Session,
-		authorization
-	});
-	return authorization;
-}
-async function resolvePasskeyCredentialFreeSessionAuthorization(input, statusReads) {
-	const authorization = await resolvePasskeyEd25519SessionAuthorization(input, statusReads);
-	assertPasskeyCredentialFreeActivationMatchesAuthorization({
-		ed25519Session: input.ed25519Session,
-		ecdsaSession: input.ecdsaSession,
-		authorization
-	});
-	return authorization;
-}
-function parseWalletUnlockAlreadyCommittedFailure(data) {
-	const response = parseWalletUnlockAlreadyCommittedResponseV1(data) ?? parseWalletSessionAlreadyCommittedResponseV1(data);
-	if (!response) return null;
-	return {
-		success: false,
-		kind: "already_committed",
-		code: response.code,
-		message: response.message,
-		next: response.next,
-		committed: response.committed
-	};
-}
-async function verifyPasskeyWalletUnlock(relayServerUrl, input, statusReads) {
-	try {
-		if (input.type !== "passkey_assertion") throw new Error("Passkey wallet unlock requires a passkey assertion");
-		const challengeId = requireTrimmedString(input.challengeId, "challengeId");
-		const webauthnAuthentication = input.webauthn_authentication;
-		const expectedOrigin = String(input.expected_origin || "").trim();
-		const body = {
-			unlockBackend: "passkey",
-			challengeId,
-			..."walletId" in input && input.walletId ? { walletId: input.walletId } : {},
-			webauthn_authentication: redactCredentialExtensionOutputs(webauthnAuthentication),
-			ed25519SessionRequest: input.ed25519SessionRequest,
-			...expectedOrigin ? { expected_origin: expectedOrigin } : {},
-			...input.ecdsaSessionPolicy ? { ecdsaSessionPolicy: parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1(input.ecdsaSessionPolicy) } : {}
-		};
-		const url = joinNormalizedUrl(relayServerUrl, "/wallet/unlock/verify");
-		const response = await fetch(url, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			credentials: "omit",
-			body: JSON.stringify(body)
-		});
-		const dataJson = await response.json().catch(() => ({}));
-		const data = isObject(dataJson) ? dataJson : {};
-		if (!response.ok) {
-			const alreadyCommitted = parseWalletUnlockAlreadyCommittedFailure(data);
-			if (alreadyCommitted) return alreadyCommitted;
-			return {
-				success: false,
-				error: typeof data.message === "string" ? data.message : `HTTP ${response.status}`
-			};
-		}
-		if (data.ok !== true) {
-			const alreadyCommitted = parseWalletUnlockAlreadyCommittedFailure(data);
-			if (alreadyCommitted) return alreadyCommitted;
-			return {
-				success: false,
-				error: typeof data.message === "string" ? data.message : "Wallet unlock verification failed"
-			};
-		}
-		const requestedEcdsaActivation = input.type === "passkey_assertion" && input.ecdsaSessionPolicy !== void 0;
-		const ed25519Session = parsePasskeyWalletUnlockEd25519Session(data.ed25519Session, data.operationCredential);
-		if (input.ed25519SessionRequest.kind === "requested" && !ed25519Session) throw new Error("Wallet unlock omitted the requested Ed25519 Wallet Session");
-		if (input.ed25519SessionRequest.kind === "not_requested" && ed25519Session) throw new Error("Wallet unlock returned an unrequested Ed25519 Wallet Session");
-		const walletCustody = parsePasskeyWalletCustodyUnlockV1(data.walletCustody);
-		let ecdsaSession;
-		let walletSessionAuthorization;
-		let ecdsaActivationReceipt;
-		let ecdsaCustody;
-		if (requestedEcdsaActivation) {
-			if (data.ecdsaSession === void 0) throw new Error("Wallet unlock omitted the requested ECDSA Wallet Session activation");
-			ecdsaSession = isObject(data.ecdsaSession) && data.ecdsaSession.kind === "router_ab_ecdsa_credential_free_session_activated_v1" ? parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1(data.ecdsaSession) : parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1(data.ecdsaSession);
-			if (data.ecdsaActivationReceipt === void 0 || data.ecdsaCustody === void 0) throw new Error("Wallet unlock omitted ECDSA custody continuity");
-			ecdsaActivationReceipt = parseRouterAbEcdsaRegistrationActivationReceiptV1(data.ecdsaActivationReceipt);
-			ecdsaCustody = parsePasskeySessionEcdsaCustodyContinuity(data.ecdsaCustody);
-			if (!walletCustody) throw new Error("Wallet unlock omitted wallet custody for ECDSA activation");
-			if (ecdsaSession.kind === "router_ab_ecdsa_credential_free_session_activated_v1") {
-				if (!ed25519Session) throw new Error("Credential-free ECDSA activation requires an Ed25519 Wallet Session");
-				walletSessionAuthorization = await resolvePasskeyCredentialFreeSessionAuthorization({
-					relayServerUrl,
-					data,
-					ed25519Session,
-					ecdsaSession
-				}, statusReads);
-			}
-		} else if (data.ecdsaSession !== void 0) throw new Error("Wallet unlock returned an unrequested ECDSA Wallet Session activation");
-		else if (ed25519Session) walletSessionAuthorization = await resolvePasskeyEd25519SessionAuthorization({
-			relayServerUrl,
-			data,
-			ed25519Session
-		}, statusReads);
-		if (ecdsaSession && ecdsaActivationReceipt && ecdsaCustody && walletCustody) {
-			if (ecdsaSession.kind === "router_ab_ecdsa_credential_free_session_activated_v1") {
-				if (!walletSessionAuthorization) throw new Error("Credential-free ECDSA activation omitted exact Wallet Session authority");
-				return {
-					success: true,
-					ecdsaSession,
-					ecdsaActivationReceipt,
-					ecdsaCustody,
-					ed25519Session,
-					walletCustody,
-					walletSessionAuthorization
-				};
-			}
-			return {
-				success: true,
-				ecdsaSession,
-				ecdsaActivationReceipt,
-				ecdsaCustody,
-				ed25519Session,
-				walletCustody
-			};
-		}
-		if (walletCustody && ed25519Session && walletSessionAuthorization) return {
-			success: true,
-			ed25519Session,
-			walletCustody,
-			walletSessionAuthorization
-		};
-		if (walletCustody && !ed25519Session) return {
-			success: true,
-			ed25519Session: null,
-			walletCustody
-		};
-		throw new Error("Passkey wallet unlock returned incomplete exact session state");
-	} catch (error) {
-		return {
-			success: false,
-			error: errorMessage(error) || "Failed to verify wallet unlock"
-		};
-	}
-}
-//#endregion
-export { checkNearAccountExistsBestEffort, verifyPasskeyWalletUnlock };
-
-//# sourceMappingURL=rpcCalls.js.map

package/dist/esm/core/rpcClients/relayer/ownerWalletExecutionLanePreflight.js

@@ -1,67 +0,0 @@
-import { parseMpcMaterialActivationRef } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
-import { parseSigningLaneRecord, parseWalletKeyRecord } from "../../../shared-ts/src/signing-lanes/recordParsers.js";
-//#region src/core/rpcClients/relayer/ownerWalletExecutionLanePreflight.ts
-const OWNER_WALLET_EXECUTION_LANE_PREFLIGHT_PATH = "/wallet/execution-lane/owner";
-async function readOwnerWalletExecutionLaneProjectionV1(input) {
-	const response = await fetch(`${normalizeRelayerBaseUrl(input.relayerUrl)}${OWNER_WALLET_EXECUTION_LANE_PREFLIGHT_PATH}`, buildRelayerJsonPostRequestInit({
-		headers: buildBearerAuthorizationHeader({
-			token: input.walletSessionToken,
-			missingMessage: "Owner execution-lane preflight requires a Wallet Session token"
-		}),
-		body: {
-			curve: input.curve,
-			expectedMaterialActivation: input.expectedMaterialActivation
-		}
-	}));
-	const raw = await response.json().catch(() => null);
-	if (!response.ok) {
-		const message = decodeOwnerExecutionLaneErrorMessage(raw);
-		throw new Error(message || `Owner execution-lane preflight returned HTTP ${response.status}`);
-	}
-	return parseOwnerWalletExecutionLaneProjectionResponseV1(raw, input.curve);
-}
-function parseOwnerWalletExecutionLaneProjectionResponseV1(value, curve) {
-	const response = decodeOwnerExecutionLaneFields(value, ["ok", "projection"], "owner execution-lane response");
-	if (response.get("ok") !== true) throw new Error("owner execution-lane response is unsuccessful");
-	const projection = decodeOwnerExecutionLaneFields(response.get("projection"), [
-		"kind",
-		"walletKey",
-		"lane",
-		"materialActivation",
-		"verifiedActivationReceiptDigestB64u"
-	], "owner execution-lane projection");
-	if (projection.get("kind") !== "active_owner_wallet_execution_lane_projection_v1") throw new Error("owner execution-lane projection kind is invalid");
-	const walletKey = parseWalletKeyRecord(projection.get("walletKey"));
-	const lane = parseSigningLaneRecord(projection.get("lane"));
-	const materialActivation = parseMpcMaterialActivationRef(projection.get("materialActivation"));
-	if (!materialActivation.ok) throw new Error(materialActivation.error.message);
-	if (walletKey.keyFamily !== curve || lane.walletId !== walletKey.walletId || lane.walletKeyId !== walletKey.walletKeyId || lane.laneKind !== "owner_passkey" && lane.laneKind !== "owner_email_otp") throw new Error("owner execution-lane projection identity is inconsistent");
-	return {
-		kind: "active_owner_wallet_execution_lane_projection_v1",
-		walletKey,
-		lane,
-		materialActivation: materialActivation.value,
-		verifiedActivationReceiptDigestB64u: parseDigestB64u(projection.get("verifiedActivationReceiptDigestB64u"))
-	};
-}
-function decodeOwnerExecutionLaneFields(value, fields, label) {
-	if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) throw new Error(`${label} must be a JSON object`);
-	const record = new Map(Object.entries(value));
-	const expected = new Set(fields);
-	if (record.size !== expected.size || [...record.keys()].some((field) => !expected.has(field))) throw new Error(`${label} fields are invalid`);
-	return record;
-}
-function decodeOwnerExecutionLaneErrorMessage(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) return null;
-	const fields = new Map(Object.entries(value));
-	if (fields.size === 0 || fields.size > 2 || [...fields.keys()].some((field) => field !== "code" && field !== "message")) return null;
-	const message = fields.get("message");
-	if (typeof message === "string" && message.trim()) return message.trim();
-	return null;
-}
-//#endregion
-export { readOwnerWalletExecutionLaneProjectionV1 };
-
-//# sourceMappingURL=ownerWalletExecutionLanePreflight.js.map