@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/signingEngine/session/availability/persistedAvailableSigningLanes.js

@@ -1,214 +0,0 @@
-import { WalletSessionStatusReadScope } from "../../../rpcClients/relayer/walletSessionAuthorizationStatus.js";
-import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
-import { thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { signingLaneAuthMethod } from "../identity/signingLaneAuthBinding.js";
-import { buildBaseEvmFamilyEcdsaKeyIdentity, buildPasskeyEcdsaAuthBinding, buildResolvedEvmFamilyEcdsaKey, toRpId } from "../identity/evmFamilyEcdsaIdentity.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { activeWalletAuthorityAvailableLaneFromProjection, ecdsaAvailableLaneIdentityKey, readAvailableSigningLanes } from "./availableSigningLanes.js";
-import { listEcdsaSealedSessionsForWallet, listExactSealedSessionsForWallet } from "../persistence/sealedSessionStore.js";
-import { resolveActiveWalletAuthorityEcdsaRuntimeV1 } from "../material/activeWalletAuthorityEcdsaRuntime.js";
-//#region src/core/signingEngine/session/availability/persistedAvailableSigningLanes.ts
-function canonicalEcdsaLaneFromCapability(args) {
-	const capability = args.available.capability;
-	const signer = capability.manifest.signer;
-	if (!signer.scope.targetMemberships.some((membership) => thresholdEcdsaChainTargetKey(membership) === thresholdEcdsaChainTargetKey(args.chainTarget))) return null;
-	const facts = signer.registeredPublicFacts;
-	const base = {
-		capability,
-		key: buildBaseEvmFamilyEcdsaKeyIdentity({
-			walletId: signer.walletId,
-			ecdsaThresholdKeyId: capability.manifest.durableMaterial.roleLocalBinding.ecdsaThresholdKeyId,
-			signingRootId: signer.signingRootId,
-			signingRootVersion: signer.signingRootVersion,
-			participantIds: facts.participantIds,
-			thresholdOwnerAddress: facts.thresholdOwnerAddress
-		}),
-		materialActivation: capability.manifest.activation.materialActivation,
-		publicFacts: facts,
-		curve: "ecdsa",
-		chainTarget: args.chainTarget,
-		source: "canonical_capability"
-	};
-	const authorization = args.available.kind === "authorized_evm_family_ecdsa_signing_capability" ? args.available.authorization : null;
-	if (isPasskeyWalletAuthAuthority(capability.authority)) {
-		const auth = {
-			kind: "passkey",
-			rpId: toRpId(capability.authority.verifier.rpId),
-			credentialIdB64u: capability.authority.factor.credentialIdB64u
-		};
-		const resolvedKey = buildResolvedEvmFamilyEcdsaKey({
-			walletId: signer.walletId,
-			publicFacts: facts,
-			authBinding: buildPasskeyEcdsaAuthBinding(auth)
-		});
-		return authorization ? {
-			...base,
-			auth,
-			resolvedKey,
-			state: "ready",
-			authorization,
-			remainingUses: authorization.runtime.remainingUses,
-			expiresAtMs: authorization.runtime.expiresAtMs
-		} : {
-			...base,
-			auth,
-			resolvedKey,
-			state: "deferred"
-		};
-	}
-	if (!isEmailOtpWalletAuthAuthority(capability.authority)) return null;
-	const auth = {
-		kind: "email_otp",
-		providerSubjectId: capability.authority.factor.providerUserId
-	};
-	return authorization ? {
-		...base,
-		auth,
-		state: "ready",
-		authorization,
-		remainingUses: authorization.runtime.remainingUses,
-		expiresAtMs: authorization.runtime.expiresAtMs
-	} : {
-		...base,
-		auth,
-		state: "deferred"
-	};
-}
-function assertNeverPersistedEd25519AuthMethod(value) {
-	throw new Error(`Unsupported persisted Ed25519 auth method: ${String(value)}`);
-}
-async function readPersistedAvailableSigningLanes(deps, args, ecdsaChainTargets) {
-	return await readPersistedAvailableSigningLanesForTargets(deps, {
-		...args,
-		ecdsaChainTargets,
-		requiredEcdsaCapability: "sign"
-	}, new WalletSessionStatusReadScope(), "all");
-}
-/**
-* Human operational read: lanes for one exact owner. The auth-method
-* narrowing and the owner filter both derive from the scope — callers supply
-* nothing the scope does not already carry.
-*/
-async function readOwnerScopedAvailableSigningLanes(deps, args, statusReads) {
-	return await readPersistedAvailableSigningLanesForTargets(deps, {
-		walletId: args.walletId,
-		authMethod: signingLaneAuthMethod(args.ownerScope.auth),
-		ownerScope: args.ownerScope,
-		ecdsaChainTargets: args.ecdsaChainTargets,
-		requiredEcdsaCapability: args.requiredEcdsaCapability,
-		...args.nowMs !== void 0 ? { nowMs: args.nowMs } : {}
-	}, statusReads, "all");
-}
-async function readPersistedAvailableSigningLanesForSigning(deps, args, defaultEcdsaChainTargets) {
-	if (args.curve === "ecdsa") {
-		const { curve, ...availableLanesArgs } = args;
-		const ecdsaChainTargetsByKey = /* @__PURE__ */ new Map();
-		for (const chainTarget of [...args.ecdsaChainTargets, ...defaultEcdsaChainTargets]) ecdsaChainTargetsByKey.set(thresholdEcdsaChainTargetKey(chainTarget), chainTarget);
-		return await readPersistedAvailableSigningLanesForTargets(deps, {
-			...availableLanesArgs,
-			ecdsaChainTargets: [...ecdsaChainTargetsByKey.values()],
-			requiredEcdsaCapability: "sign"
-		}, new WalletSessionStatusReadScope(), "ecdsa");
-	}
-	const { curve, ...availableLanesArgs } = args;
-	return await readPersistedAvailableSigningLanes(deps, availableLanesArgs, []);
-}
-function sealedRecordHasEd25519ThresholdSession(record) {
-	return String(record.thresholdSessionIds?.ed25519 || "").trim().length > 0;
-}
-function sealedEcdsaRecordMatchesAnyChainTarget(record, chainTargets) {
-	const recordChainTarget = record.ecdsaRestore?.chainTarget;
-	if (!recordChainTarget) return false;
-	const recordChainTargetKey = thresholdEcdsaChainTargetKey(recordChainTarget);
-	for (const chainTarget of chainTargets) if (recordChainTargetKey === thresholdEcdsaChainTargetKey(chainTarget)) return true;
-	return false;
-}
-function filterEmailOtpCompanionEcdsaRecords(records, chainTargets) {
-	const matchingRecords = [];
-	for (const record of records) {
-		if ("recordKind" in record) continue;
-		if (!sealedRecordHasEd25519ThresholdSession(record)) continue;
-		if (chainTargets.length > 0 && !sealedEcdsaRecordMatchesAnyChainTarget(record, chainTargets)) continue;
-		matchingRecords.push(record);
-	}
-	return matchingRecords;
-}
-async function readPersistedAvailableSigningLanesForTargets(deps, args, statusReads, curves) {
-	const walletId = String(toWalletId(args.walletId)).trim();
-	return await readAvailableSigningLanes({
-		...args,
-		walletId,
-		ecdsaChainTargets: args.ecdsaChainTargets
-	}, {
-		listPublicCapabilityReferences: curves === "all" && deps.ed25519YaoPublicCapabilityLanes ? deps.ed25519YaoPublicCapabilityLanes.listLanes.bind(deps.ed25519YaoPublicCapabilityLanes) : void 0,
-		isPublicCapabilityActive: deps.isEd25519YaoPublicCapabilityActive,
-		readActiveWalletSessionAuthorization: curves === "all" ? deps.readActiveWalletSessionAuthorization?.bind(null, statusReads) : void 0,
-		listSealedRecordsForWallet: async ({ walletId: recordWalletId, filter }) => {
-			if (curves === "ecdsa") return [];
-			const listByAuthMethod = async (authMethod) => {
-				const ed25519Records = await listExactSealedSessionsForWallet({
-					walletId: recordWalletId,
-					filter: {
-						authMethod,
-						curve: "ed25519"
-					}
-				});
-				switch (authMethod) {
-					case SIGNER_AUTH_METHODS.passkey: return ed25519Records;
-					case SIGNER_AUTH_METHODS.emailOtp: {
-						const companionEcdsaRecords = filterEmailOtpCompanionEcdsaRecords(await listEcdsaSealedSessionsForWallet({
-							walletId: recordWalletId,
-							filter: {
-								authMethod: SIGNER_AUTH_METHODS.emailOtp,
-								curve: "ecdsa"
-							}
-						}), args.ecdsaChainTargets);
-						return [...ed25519Records, ...companionEcdsaRecords];
-					}
-					default: return assertNeverPersistedEd25519AuthMethod(authMethod);
-				}
-			};
-			if (filter.authMethod) return await listByAuthMethod(filter.authMethod);
-			const [emailOtpRecords, passkeyRecords] = await Promise.all([listByAuthMethod(SIGNER_AUTH_METHODS.emailOtp), listByAuthMethod(SIGNER_AUTH_METHODS.passkey)]);
-			return [...emailOtpRecords, ...passkeyRecords];
-		},
-		listCanonicalEcdsaLanesForWallet: async ({ walletId: recordWalletId }) => {
-			const lanes = [];
-			const seen = /* @__PURE__ */ new Set();
-			const capabilities = await deps.listEcdsaSigningCapabilitiesForWallet({
-				walletId: recordWalletId,
-				chainTargets: args.ecdsaChainTargets,
-				...args.authMethod ? { authMethod: args.authMethod } : {}
-			}, statusReads);
-			for (const available of capabilities) for (const chainTarget of args.ecdsaChainTargets) {
-				const lane = canonicalEcdsaLaneFromCapability({
-					available,
-					chainTarget
-				});
-				if (!lane) continue;
-				const identityKey = ecdsaAvailableLaneIdentityKey(lane);
-				if (!identityKey || seen.has(identityKey)) continue;
-				seen.add(identityKey);
-				lanes.push(lane);
-			}
-			return lanes;
-		},
-		listActiveWalletAuthorityEcdsaLanesForWallet: async ({ walletId: recordWalletId, chainTargets }) => {
-			return (await Promise.all(chainTargets.map(async (chainTarget) => {
-				const result = await resolveActiveWalletAuthorityEcdsaRuntimeV1({
-					ports: deps.activeWalletAuthorityEcdsaRuntimeReadPorts,
-					input: {
-						walletId: toWalletId(recordWalletId),
-						chainTarget,
-						requiredCapability: args.requiredEcdsaCapability
-					}
-				});
-				return result.kind === "resolved" && result.lane ? result.lane : null;
-			}))).filter((projection) => projection !== null).map(activeWalletAuthorityAvailableLaneFromProjection);
-		}
-	});
-}
-//#endregion
-export { readOwnerScopedAvailableSigningLanes, readPersistedAvailableSigningLanes, readPersistedAvailableSigningLanesForSigning, readPersistedAvailableSigningLanesForTargets };
-
-//# sourceMappingURL=persistedAvailableSigningLanes.js.map

package/dist/esm/core/signingEngine/session/availability/readiness.js

@@ -1,464 +0,0 @@
-import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
-import { listExactSealedSessionsForWallet } from "../persistence/sealedSessionStore.js";
-import { parseExactEd25519SealedSessionRuntime } from "../warmCapabilities/ed25519SealedSessionRuntime.js";
-import { createClearVolatileWarmSessionMaterialCommand } from "../warmCapabilities/volatileWarmMaterialCommands.js";
-import { resolveWalletAuthorityOperation } from "../authority/authorityOperationResolver.js";
-import { normalizeWarmSessionReadPorts, readWarmSessionClaim, toSigningSessionStatus } from "../warmCapabilities/readModel.js";
-import { ed25519WalletSessionStatusOwner, normalizeSessionStatusRequired, walletSessionStatusIdentityKey, walletSessionStatusOwnerKey } from "../lifecycle/walletSessionStatus.js";
-//#region src/core/signingEngine/session/availability/readiness.ts
-function normalizeNonEmpty(value) {
-	return String(value || "").trim();
-}
-function warmClaimFromRecordPolicy(args) {
-	const thresholdSessionId = normalizeNonEmpty(args.thresholdSessionId);
-	const remainingUses = Math.max(0, Math.floor(Number(args.remainingUses) || 0));
-	const expiresAtMs = Math.floor(Number(args.expiresAtMs) || 0);
-	if (expiresAtMs <= Date.now()) return {
-		state: "expired",
-		thresholdSessionId
-	};
-	if (remainingUses <= 0) return {
-		state: "exhausted",
-		thresholdSessionId
-	};
-	return {
-		state: "warm",
-		thresholdSessionId,
-		remainingUses,
-		expiresAtMs
-	};
-}
-function applyWalletSessionStatusToSigningSessionReadiness(args) {
-	let status = args.status;
-	let expiresAtMs = Math.floor(Number(args.expiresAtMs) || 0);
-	let remainingUses = Math.max(0, Math.floor(Number(args.remainingUses) || 0));
-	const walletSessionStatus = args.walletSessionStatus;
-	if (walletSessionStatus) {
-		if (walletSessionStatus.status === "not_found") {
-			status = "missing_session";
-			remainingUses = 0;
-		} else if (walletSessionStatus.status === "status_unknown" && status === "ready") {
-			status = "status_unknown";
-			remainingUses = 0;
-		} else if (walletSessionStatus.status === "unavailable") {
-			status = "status_unavailable";
-			remainingUses = 0;
-		} else if (walletSessionStatus.status === "expired") {
-			status = "expired";
-			remainingUses = 0;
-		} else if (walletSessionStatus.status === "exhausted") {
-			status = "exhausted";
-			remainingUses = 0;
-		} else if (walletSessionStatus.status === "active") {
-			const sessionRemainingUses = Math.max(0, Math.floor(Number(walletSessionStatus.remainingUses) || 0));
-			const sessionExpiresAtMs = Math.floor(Number(walletSessionStatus.expiresAtMs) || 0);
-			remainingUses = sessionRemainingUses;
-			if (sessionExpiresAtMs > 0) expiresAtMs = sessionExpiresAtMs;
-			if (status === "exhausted") status = "ready";
-		}
-	}
-	const usesNeeded = Math.max(1, Math.floor(Number(args.usesNeeded) || 1));
-	if (status === "ready" && args.missingWhenExpiresAtMissing && expiresAtMs <= 0) status = "missing_session";
-	if (status === "ready" && expiresAtMs <= (args.nowMs ?? Date.now())) status = "expired";
-	if (status === "ready" && remainingUses < usesNeeded) status = "exhausted";
-	return {
-		readiness: status === "ready" || status === "exhausted" ? {
-			status,
-			curve: "ed25519",
-			thresholdSessionId: args.thresholdSessionId,
-			remainingUses,
-			expiresAtMs
-		} : status === "expired" ? {
-			status,
-			curve: "ed25519",
-			thresholdSessionId: args.thresholdSessionId,
-			expiresAtMs
-		} : {
-			status,
-			curve: "ed25519",
-			thresholdSessionId: args.thresholdSessionId
-		},
-		expiresAtMs,
-		remainingUses
-	};
-}
-function toLaneSource(runtime) {
-	switch (runtime.factor.kind) {
-		case "email_otp": return SIGNER_AUTH_METHODS.emailOtp;
-		case "passkey": return SIGNER_AUTH_METHODS.passkey;
-	}
-}
-function authMethodForSigningSessionLanes(lanes) {
-	for (const lane of lanes) {
-		const source = lane.source;
-		switch (source) {
-			case SIGNER_AUTH_METHODS.emailOtp: return SIGNER_AUTH_METHODS.emailOtp;
-			case SIGNER_AUTH_METHODS.passkey: break;
-			default: return assertNeverSigningSessionLaneAuthMethod(source);
-		}
-	}
-	return null;
-}
-function assertNeverSigningSessionLaneAuthMethod(value) {
-	throw new Error(`Unsupported signing session lane auth method: ${String(value)}`);
-}
-function resolveRuntimeWalletOwnerId(runtime) {
-	return ed25519WalletSessionStatusOwner(runtime.walletId);
-}
-function addLane(lanes, lane) {
-	if (!lane) return;
-	if (!lane.thresholdSessionId || !lane.walletSessionId) return;
-	lanes.push(lane);
-}
-function buildDiscoveredLaneForRuntime(runtime, walletSessionId, quotaId) {
-	return {
-		curve: "ed25519",
-		chain: "near",
-		source: toLaneSource(runtime),
-		thresholdSessionId: runtime.thresholdSessionId,
-		walletSessionId,
-		quotaId,
-		materialActivation: runtime.sealedRecord.ed25519Restore.materialActivation,
-		backing: "record_policy",
-		runtime
-	};
-}
-async function discoverLanesForWallet(deps, walletId) {
-	return await discoverLanesForWalletWithExactAuthorization(deps, walletId, deps.exactWalletSessionReadPorts);
-}
-function exactEd25519SignSubjectMatches(authorization, materialActivation) {
-	return authorization.capabilitySubjects.some((subject) => subject.kind === "sign" && subject.keyFamily === "ed25519" && mpcMaterialActivationRefsEqual(subject.materialActivation, materialActivation));
-}
-function selectedMethodMatchesRuntime(args) {
-	switch (args.runtime.factor.kind) {
-		case "passkey": return args.authMethod.kind === "passkey" && String(args.authMethod.rpId) === String(args.runtime.factor.rpId) && String(args.authMethod.credentialIdB64u) === String(args.runtime.factor.credentialIdB64u);
-		case "email_otp": return args.authMethod.kind === "email_otp" && args.authMethod.emailHashHex === args.runtime.factor.emailHashHex;
-	}
-}
-async function discoverLanesForWalletWithExactAuthorization(deps, walletId, resolver) {
-	const listSealed = deps.listExactSealedSessionsForWallet ?? listExactSealedSessionsForWallet;
-	const records = (await Promise.all([listSealed({
-		walletId,
-		filter: {
-			authMethod: SIGNER_AUTH_METHODS.passkey,
-			curve: "ed25519"
-		}
-	}), listSealed({
-		walletId,
-		filter: {
-			authMethod: SIGNER_AUTH_METHODS.emailOtp,
-			curve: "ed25519"
-		}
-	})])).flat();
-	let selected;
-	try {
-		selected = await resolver.resolveSelectedWalletAuthority(String(walletId));
-	} catch {
-		return [];
-	}
-	if (selected.kind !== "resolved") return [];
-	const { selection, authMethod, authority } = selected;
-	if (selection.lockState !== "unlocked" || selection.walletId !== walletId || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || authMethod.status !== "active" || authMethod.walletId !== walletId || authMethod.walletAuthorityId !== authority.authorityId || authority.state !== "active" || authority.walletId !== walletId) return [];
-	let operation;
-	try {
-		operation = await resolveWalletAuthorityOperation({
-			selected: {
-				authMethod,
-				authority
-			},
-			operation: {
-				kind: "near_sign",
-				operation: "sign",
-				keyFamily: "ed25519"
-			}
-		});
-	} catch {
-		return [];
-	}
-	if (operation.kind !== "resolved" || operation.value.walletId !== walletId || operation.value.authorityId !== authority.authorityId || operation.value.authMethodId !== authMethod.walletAuthMethodId) return [];
-	let authorizationRead;
-	try {
-		authorizationRead = await resolver.readExactWithOperationCredential({
-			walletId,
-			authorityId: authority.authorityId,
-			authMethodId: authMethod.walletAuthMethodId
-		});
-	} catch {
-		return [];
-	}
-	if (authorizationRead.kind !== "found") return [];
-	const authorization = authorizationRead.record;
-	const operationCredential = authorizationRead.operationCredential;
-	if (authorization.walletId !== walletId || authorization.authorityId !== authority.authorityId || authorization.authMethodId !== authMethod.walletAuthMethodId || authorization.authorityDigestB64u !== authority.authorityDigestB64u || authorization.authorityRevocationEpoch !== authority.revocationEpoch || authorization.expiresAtMs <= Date.now() || operationCredential.walletSessionId.length === 0 || operationCredential.token.trim().length === 0 || !exactEd25519SignSubjectMatches(authorization, operation.value.materialActivation)) return [];
-	const lanes = [];
-	const seenThresholdSessionIds = /* @__PURE__ */ new Set();
-	for (const record of records) {
-		if (record.curve !== "ed25519") continue;
-		const runtime = parseExactEd25519SealedSessionRuntime(record);
-		if (!runtime || runtime.walletId !== walletId) continue;
-		if (!selectedMethodMatchesRuntime({
-			runtime,
-			authMethod
-		}) || !mpcMaterialActivationRefsEqual(runtime.sealedRecord.ed25519Restore.materialActivation, operation.value.materialActivation)) continue;
-		if (seenThresholdSessionIds.has(runtime.thresholdSessionId)) continue;
-		seenThresholdSessionIds.add(runtime.thresholdSessionId);
-		addLane(lanes, buildDiscoveredLaneForRuntime(runtime, operationCredential.walletSessionId, authorization.quotaId));
-	}
-	return lanes;
-}
-async function getLanesForWalletSession(args) {
-	const walletSessionId = normalizeSessionStatusRequired(args.walletSessionId, "walletSessionId");
-	return (await discoverLanesForWallet(args.deps, args.walletId)).filter((lane) => lane.walletSessionId === walletSessionId && lane.quotaId === args.quotaId);
-}
-function walletScopedClaimsForLanes(args) {
-	const grouped = /* @__PURE__ */ new Map();
-	for (const lane of args.lanes) {
-		const groupKey = walletSessionStatusIdentityKey({
-			walletSessionId: lane.walletSessionId,
-			quotaId: lane.quotaId
-		});
-		const group = grouped.get(groupKey) || [];
-		group.push(lane);
-		grouped.set(groupKey, group);
-	}
-	const scoped = /* @__PURE__ */ new Map();
-	for (const group of grouped.values()) {
-		const firstLane = group[0];
-		if (!firstLane) continue;
-		const walletSessionId = firstLane.walletSessionId;
-		const quotaId = firstLane.quotaId;
-		const applicableOverride = resolveApplicableWalletSessionStatusOverrideForGroup({
-			walletSessionId,
-			quotaId,
-			lanes: group,
-			claimsByThresholdSessionId: args.claimsByThresholdSessionId,
-			statusOverrides: args.statusOverrides
-		});
-		const entries = group.map((lane) => ({
-			lane,
-			claim: args.claimsByThresholdSessionId.get(lane.thresholdSessionId) || null
-		}));
-		const applyRawScopedClaims = (rawEntries) => {
-			if (!rawEntries.length) return;
-			const terminal = rawEntries.find((entry) => entry.claim?.state === "expired")?.claim || rawEntries.find((entry) => entry.claim?.state === "exhausted")?.claim || null;
-			const warmClaims = rawEntries.map((entry) => entry.claim).filter((claim) => claim?.state === "warm");
-			const walletRemainingUses = warmClaims.length ? Math.min(...warmClaims.map((claim) => Math.floor(Number(claim.remainingUses) || 0))) : void 0;
-			const walletExpiresAtMs = warmClaims.length ? Math.min(...warmClaims.map((claim) => Math.floor(Number(claim.expiresAtMs) || 0))) : void 0;
-			for (const entry of rawEntries) {
-				if (terminal) {
-					scoped.set(entry.lane.thresholdSessionId, attachWarmClaimToThresholdSession(terminal, entry.lane.thresholdSessionId));
-					continue;
-				}
-				if (entry.claim?.state === "warm") {
-					scoped.set(entry.lane.thresholdSessionId, {
-						state: "warm",
-						thresholdSessionId: entry.lane.thresholdSessionId,
-						remainingUses: walletRemainingUses ?? entry.claim.remainingUses,
-						expiresAtMs: walletExpiresAtMs ?? entry.claim.expiresAtMs
-					});
-					continue;
-				}
-				scoped.set(entry.lane.thresholdSessionId, entry.claim);
-			}
-		};
-		if (applicableOverride) {
-			const overrideClaim = claimFromWalletSessionStatusOverride(applicableOverride);
-			const overrideEntries = entries.filter((entry) => applicableOverride.thresholdSessionIds.has(normalizeNonEmpty(entry.lane.thresholdSessionId)));
-			const rawEntries = entries.filter((entry) => !applicableOverride.thresholdSessionIds.has(normalizeNonEmpty(entry.lane.thresholdSessionId)));
-			if (overrideEntries.length === entries.length) {
-				for (const entry of entries) scoped.set(entry.lane.thresholdSessionId, overrideClaim ? attachWarmClaimToThresholdSession(overrideClaim, entry.lane.thresholdSessionId) : null);
-				continue;
-			}
-			for (const entry of overrideEntries) scoped.set(entry.lane.thresholdSessionId, overrideClaim ? attachWarmClaimToThresholdSession(overrideClaim, entry.lane.thresholdSessionId) : null);
-			applyRawScopedClaims(rawEntries);
-			continue;
-		}
-		applyRawScopedClaims(entries);
-	}
-	return scoped;
-}
-function resolveApplicableWalletSessionStatusOverrideForGroup(args) {
-	const statusOverrides = args.statusOverrides;
-	if (!statusOverrides) return null;
-	for (const owner of walletSessionStatusOverrideOwnersForLanes(args.lanes)) {
-		const override = statusOverrides.get(walletOwnerSigningSessionStatusOverrideKey(owner, args.walletSessionId, args.quotaId));
-		if (!override) continue;
-		const applicable = resolveApplicableWalletSessionStatusOverride({
-			override,
-			lanes: args.lanes,
-			claimsByThresholdSessionId: args.claimsByThresholdSessionId,
-			statusOverrides
-		});
-		if (applicable) return applicable;
-	}
-	return null;
-}
-function walletSessionStatusOverrideOwnersForLanes(lanes) {
-	const ownersByKey = /* @__PURE__ */ new Map();
-	for (const lane of lanes) {
-		const owner = resolveRuntimeWalletOwnerId(lane.runtime);
-		ownersByKey.set(walletSessionStatusOwnerKey(owner), owner);
-	}
-	return [...ownersByKey.values()];
-}
-function walletOwnerSigningSessionStatusOverrideKey(owner, walletSessionId, quotaId) {
-	return `${walletSessionStatusOwnerKey(owner)}:${walletSessionStatusIdentityKey({
-		walletSessionId,
-		quotaId
-	})}`;
-}
-function resolveApplicableWalletSessionStatusOverride(args) {
-	if (!args.lanes.length) return null;
-	if (args.lanes.find((lane) => {
-		const thresholdSessionId = normalizeNonEmpty(lane.thresholdSessionId);
-		if (args.override.thresholdSessionIds.has(thresholdSessionId)) return false;
-		if (lane.runtime.sealedRecord.updatedAtMs <= args.override.updatedAtMs) return false;
-		return (args.claimsByThresholdSessionId.get(thresholdSessionId) || null)?.state === "warm";
-	})) {
-		for (const lane of args.lanes) args.statusOverrides?.delete(walletOwnerSigningSessionStatusOverrideKey(resolveRuntimeWalletOwnerId(lane.runtime), args.override.walletSessionId, args.override.quotaId));
-		return null;
-	}
-	return args.override;
-}
-function claimFromWalletSessionStatusOverride(override) {
-	const status = override.status;
-	if (status.status === "active") {
-		if (typeof status.remainingUses !== "number" || typeof status.expiresAtMs !== "number") return {
-			state: "unavailable",
-			code: "invalid_wallet_budget_status"
-		};
-		const remainingUses = Math.max(0, Math.floor(Number(status.remainingUses) || 0));
-		const expiresAtMs = Math.floor(Number(status.expiresAtMs) || 0);
-		if (expiresAtMs <= Date.now()) return { state: "expired" };
-		if (remainingUses <= 0) return { state: "exhausted" };
-		return {
-			state: "warm",
-			remainingUses,
-			expiresAtMs
-		};
-	}
-	if (status.status === "expired") return { state: "expired" };
-	if (status.status === "exhausted") return { state: "exhausted" };
-	if (status.status === "unavailable") return {
-		state: "unavailable",
-		code: String(status.statusCode || "wallet_budget_status_override")
-	};
-	return null;
-}
-async function readClaimsForLanes(args) {
-	const claims = /* @__PURE__ */ new Map();
-	for (const lane of args.lanes) claims.set(lane.thresholdSessionId, warmClaimFromRecordPolicy({
-		thresholdSessionId: lane.thresholdSessionId,
-		remainingUses: lane.runtime.remainingUses,
-		expiresAtMs: lane.runtime.expiresAtMs
-	}));
-	return claims;
-}
-function attachWarmClaimToThresholdSession(claim, thresholdSessionId) {
-	switch (claim.state) {
-		case "warm": return {
-			state: "warm",
-			thresholdSessionId,
-			remainingUses: claim.remainingUses,
-			expiresAtMs: claim.expiresAtMs
-		};
-		case "unavailable": return {
-			state: "unavailable",
-			thresholdSessionId,
-			code: claim.code
-		};
-		case "missing": return {
-			state: "missing",
-			thresholdSessionId
-		};
-		case "expired": return {
-			state: "expired",
-			thresholdSessionId
-		};
-		case "exhausted": return {
-			state: "exhausted",
-			thresholdSessionId
-		};
-	}
-}
-async function readWalletScopedLaneClaimsForWallet(args) {
-	const lanes = await discoverLanesForWallet(args.deps, args.walletId);
-	return readWalletScopedLaneClaimsForLanes({
-		deps: args.deps,
-		lanes,
-		statusOverrides: args.statusOverrides
-	});
-}
-async function readWalletScopedLaneClaimsForLanes(args) {
-	const rawClaims = await readClaimsForLanes({
-		deps: args.deps,
-		lanes: args.lanes
-	});
-	return walletScopedClaimsForLanes({
-		lanes: args.lanes,
-		claimsByThresholdSessionId: rawClaims,
-		statusOverrides: args.statusOverrides
-	});
-}
-async function readDirectSigningSessionStatusForTargets(args) {
-	const walletSessionId = args.walletSessionId;
-	const targetThresholdSessionIds = Array.from(new Set([...args.targetThresholdSessionIds || []].map(normalizeNonEmpty).filter(Boolean)));
-	if (!targetThresholdSessionIds.length) return null;
-	const touchConfirm = normalizeWarmSessionReadPorts(args.deps.touchConfirm);
-	const claims = await Promise.all(targetThresholdSessionIds.map((thresholdSessionId) => readWarmSessionClaim(touchConfirm, thresholdSessionId)));
-	return toSigningSessionStatus({
-		sessionId: walletSessionId,
-		claim: claims.find((candidate) => candidate?.state === "expired") || claims.find((candidate) => candidate?.state === "exhausted") || claims.find((candidate) => candidate?.state === "unavailable") || claims.find((candidate) => candidate?.state === "warm") || null
-	});
-}
-function statusFromClaim(args) {
-	const hasEmailOtpLane = args.lanes.some((lane) => lane.source === SIGNER_AUTH_METHODS.emailOtp);
-	return toSigningSessionStatus({
-		sessionId: args.walletSessionId,
-		claim: args.claim,
-		authMethod: authMethodForSigningSessionLanes(args.lanes),
-		retention: hasEmailOtpLane ? "session" : null
-	});
-}
-async function clearWalletSession(args) {
-	const lanes = await getLanesForWalletSession({
-		deps: args.deps,
-		walletId: args.walletId,
-		walletSessionId: args.walletSessionId,
-		quotaId: args.quotaId
-	});
-	args.statusOverrides.delete(walletOwnerSigningSessionStatusOverrideKey(ed25519WalletSessionStatusOwner(args.walletId), args.walletSessionId, args.quotaId));
-	const cleared = /* @__PURE__ */ new Set();
-	const failures = /* @__PURE__ */ new Set();
-	for (const lane of lanes) {
-		if (lane.backing === "record_policy") continue;
-		const materialActivationId = String(lane.materialActivation.activationId);
-		if (cleared.has(materialActivationId)) continue;
-		cleared.add(materialActivationId);
-		if (lane.backing === "email_otp_worker") {
-			try {
-				await args.deps.clearEmailOtpWarmSessionMaterial?.(lane.thresholdSessionId);
-			} catch {
-				failures.add("email_otp_material");
-			}
-			continue;
-		}
-		const thresholdSessionId = parseThresholdEd25519SessionId(lane.thresholdSessionId);
-		if (!thresholdSessionId.ok) continue;
-		try {
-			await args.deps.touchConfirm?.clearVolatileWarmSessionMaterial?.(createClearVolatileWarmSessionMaterialCommand(thresholdSessionId.value));
-		} catch {
-			failures.add("touch_confirm_material");
-		}
-	}
-	if (failures.size > 0) return {
-		kind: "unavailable",
-		failures: [...failures]
-	};
-	return { kind: "cleared" };
-}
-//#endregion
-export { applyWalletSessionStatusToSigningSessionReadiness, clearWalletSession, discoverLanesForWallet, normalizeNonEmpty, readClaimsForLanes, readDirectSigningSessionStatusForTargets, readWalletScopedLaneClaimsForWallet, statusFromClaim, walletScopedClaimsForLanes, warmClaimFromRecordPolicy };
-
-//# sourceMappingURL=readiness.js.map