@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/signingEngine/session/emailOtp/ecdsaRecovery.js

@@ -1,264 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { buildEvmFamilyEcdsaWalletKey } from "../identity/evmFamilyEcdsaIdentity.js";
-import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { parseSigningSessionSealKeyVersion } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { buildEcdsaRoleLocalPublicFacts } from "../persistence/ecdsaRoleLocalRecords.js";
-import { parseEmailOtpWorkerIssuedSessionHandle } from "../../../platform/secretSources.js";
-import { buildEmailOtpAuthContextForWalletAuthMethod, emailOtpAuthContextProviderUserId, emailOtpAuthContextRetention } from "../identity/laneIdentity.js";
-import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
-import { buildCanonicalEvmFamilyEcdsaSigningCapability, buildExactEvmFamilyWalletSessionAuthorization } from "../material/ecdsaSigningCapability.js";
-import { buildPersistedEcdsaRoleLocalMaterial } from "../material/ecdsaRoleLocalMaterialResolver.js";
-import { requestRehydrateEmailOtpEcdsaWarmSessionMaterial } from "./workerRequests.js";
-import { emailOtpEcdsaSealAuthorizationThresholdSessionId } from "./ecdsaPublication.js";
-import { buildEmailOtpRecoveredKeyActivation } from "./ecdsaLogin.js";
-//#region src/core/signingEngine/session/emailOtp/ecdsaRecovery.ts
-var EmailOtpEcdsaSealedRestoreSupersededError = class extends Error {
-	constructor(phase) {
-		super(`Email OTP sealed refresh material activation was superseded ${phase.replace("_", " ")}`);
-		this.phase = phase;
-		this.code = "material_activation_superseded";
-		this.name = "EmailOtpEcdsaSealedRestoreSupersededError";
-	}
-};
-function sealedRecordEmailOtpSessionAuthContext(authority) {
-	return buildEmailOtpAuthContextForWalletAuthMethod({
-		policy: "session",
-		authority,
-		retention: "session",
-		reason: "login"
-	});
-}
-function emailOtpSealedRoleLocalParticipantIds(participantIds) {
-	if (participantIds.length !== 2 || participantIds[0] !== 1 || participantIds[1] !== 2) throw new Error("Email OTP sealed refresh requires participantIds [1, 2]");
-	return [1, 2];
-}
-async function emailOtpSealedExistingKey(sealedRecord) {
-	if ((await walletAuthAuthorityRef({ authority: sealedRecord.emailOtpAuthority })).walletId !== sealedRecord.authority.walletId) throw new Error("Email OTP sealed refresh route authority wallet mismatch");
-	const capability = sealedRecord.publicCapability;
-	const publicIdentity = capability.public_identity;
-	const publicFacts = buildEcdsaRoleLocalPublicFacts({
-		walletId: toWalletId(sealedRecord.walletId),
-		chainTarget: sealedRecord.chainTarget,
-		keyHandle: sealedRecord.keyHandle,
-		ecdsaThresholdKeyId: parseSdkEcdsaDerivationThresholdKeyId(sealedRecord.ecdsaThresholdKeyId),
-		signingRootId: parseSdkEcdsaDerivationSigningRootId(sealedRecord.signingRootId),
-		signingRootVersion: parseSdkEcdsaDerivationSigningRootVersion(sealedRecord.signingRootVersion),
-		applicationBindingDigestB64u: capability.context.application_binding_digest_b64u,
-		participantIds: emailOtpSealedRoleLocalParticipantIds(sealedRecord.participantIds),
-		clientParticipantId: 1,
-		relayerParticipantId: 2,
-		contextBinding32B64u: publicIdentity.context_binding_b64u,
-		derivationClientSharePublicKey33B64u: publicIdentity.derivation_client_share_public_key33_b64u,
-		relayerPublicKey33B64u: publicIdentity.server_public_key33_b64u,
-		groupPublicKey33B64u: publicIdentity.threshold_public_key33_b64u,
-		ethereumAddress: sealedRecord.ethereumAddress,
-		publicCapability: capability
-	});
-	const walletKey = buildEvmFamilyEcdsaWalletKey({
-		walletId: publicFacts.walletId,
-		keyHandle: publicFacts.keyHandle,
-		chainTarget: publicFacts.chainTarget,
-		ecdsaThresholdKeyId: publicFacts.ecdsaThresholdKeyId,
-		signingRootId: publicFacts.signingRootId,
-		signingRootVersion: publicFacts.signingRootVersion,
-		participantIds: publicFacts.participantIds,
-		thresholdOwnerAddress: publicFacts.ethereumAddress,
-		thresholdEcdsaPublicKeyB64u: publicFacts.groupPublicKey33B64u
-	});
-	return {
-		keyHandle: String(walletKey.keyHandle),
-		publicCapability: capability,
-		walletKey,
-		runtimePolicyScope: sealedRecord.runtimePolicyScope,
-		persistedRoleLocalMaterial: buildPersistedEcdsaRoleLocalMaterial({
-			authority: sealedRecord.authority,
-			materialActivation: sealedRecord.roleLocalMaterialRef.materialActivation,
-			publicFacts
-		})
-	};
-}
-function requireEmailOtpEcdsaSealedTransportSource(sealedRecord) {
-	const signingSessionSealKeyVersion = String(sealedRecord.keyVersion || "").trim();
-	const signingSessionSealGroupId = String(sealedRecord.groupId || "").trim();
-	if (!signingSessionSealKeyVersion || !signingSessionSealGroupId) throw new Error("Email OTP sealed refresh is missing normalized seal transport metadata");
-	return {
-		signingSessionSealKeyVersion,
-		signingSessionSealGroupId
-	};
-}
-function buildSealedRecordEmailOtpEcdsaRestoreSource(args) {
-	const { sealedRecord } = args;
-	const transport = requireEmailOtpEcdsaSealedTransportSource(sealedRecord);
-	if (!sealedRecord.thresholdSessionId || !sealedRecord.relayerUrl || !sealedRecord.keyHandle || !sealedRecord.relayerKeyId || !sealedRecord.participantIds.length) throw new Error("Email OTP sealed refresh is missing durable ECDSA restore metadata");
-	return {
-		kind: "sealed_record_restore",
-		sealedRecord,
-		emailOtpAuthContext: sealedRecordEmailOtpSessionAuthContext(sealedRecord.emailOtpAuthority),
-		authorization: args.authorization,
-		relayerUrl: sealedRecord.relayerUrl,
-		chainTarget: sealedRecord.chainTarget,
-		keyHandle: sealedRecord.keyHandle,
-		...transport,
-		...sealedRecord.runtimePolicyScope ? { runtimePolicyScope: sealedRecord.runtimePolicyScope } : {}
-	};
-}
-async function requireSelectedEmailOtpWalletAuthority(resolveSelectedWalletAuthority, walletId) {
-	const selected = await resolveSelectedWalletAuthority(String(walletId));
-	if (selected.kind !== "resolved" || selected.selection.lockState !== "unlocked" || selected.selection.walletId !== walletId || selected.selection.walletAuthMethodId !== selected.authMethod.walletAuthMethodId || selected.authMethod.kind !== "email_otp" || selected.authMethod.status !== "active" || selected.authMethod.walletId !== walletId || selected.authMethod.walletAuthorityId !== selected.authority.authorityId || selected.authority.state !== "active" || selected.authority.walletId !== walletId) throw new Error("Email OTP sealed refresh selected authority is invalid");
-	return {
-		kind: "resolved",
-		selection: selected.selection,
-		authMethod: selected.authMethod,
-		authority: selected.authority,
-		signerMaterials: selected.signerMaterials,
-		exportRoot: selected.exportRoot
-	};
-}
-function requireEmailOtpRuntimeAuthority(runtime) {
-	if (runtime.authBinding.kind !== "email_otp") throw new Error("Email OTP sealed refresh runtime is not Email OTP bound");
-	return runtime.authBinding.emailOtpAuthority;
-}
-function requireEmailOtpSealedRestoreAuthorization(args) {
-	if (args.authorizationRead.kind !== "found") throw new Error(`Email OTP sealed refresh requires active Wallet Session authorization: ${args.authorizationRead.kind}`);
-	const { record, operationCredential } = args.authorizationRead;
-	if (args.runtime.kind !== "exact_ecdsa_sealed_runtime_v1") throw new Error("Email OTP sealed refresh ECDSA runtime is unavailable");
-	if (args.sealedRecord.authMethod !== "email_otp" || record.walletId !== toWalletId(args.sealedRecord.walletId) || record.authorityId !== args.selected.authority.authorityId || record.authMethodId !== args.selected.authMethod.walletAuthMethodId || record.authorityDigestB64u !== args.selected.authority.authorityDigestB64u || record.authorityRevocationEpoch !== args.selected.authority.revocationEpoch || record.expiresAtMs <= args.nowMs || operationCredential.walletSessionId.trim().length === 0 || operationCredential.token.trim().length === 0 || args.runtime.walletId !== record.walletId || !thresholdEcdsaChainTargetsEqual(args.runtime.chainTarget, args.sealedRecord.chainTarget) || args.runtime.sealedRecord.thresholdSessionId !== args.sealedRecord.thresholdSessionId || args.runtime.sealedRecord.authMethod !== args.selected.authMethod.kind || args.runtime.authBinding.kind !== "email_otp" || args.runtime.authBinding.emailOtpAuthority.bindingId !== args.selected.authMethod.walletAuthMethodId || args.runtime.authBinding.emailOtpAuthority.walletId !== record.walletId) throw new Error("Email OTP sealed refresh Wallet Session authorization mismatch");
-	return buildExactEvmFamilyWalletSessionAuthorization({
-		capability: args.capability,
-		selected: args.selected,
-		session: record,
-		operationCredential,
-		runtime: args.runtime,
-		nowMs: args.nowMs
-	});
-}
-function createEmailOtpEcdsaSigningSessionMaterialRestorer(ports) {
-	return async (args) => await restoreEmailOtpEcdsaSigningSessionMaterialFromSealedRecord({
-		...ports,
-		...args
-	});
-}
-async function restoreEmailOtpEcdsaSigningSessionMaterialFromSealedRecord(args) {
-	const sealedRecord = args.sealedRecord;
-	if (sealedRecord.authMethod !== "email_otp" || sealedRecord.curve !== "ecdsa") return null;
-	const materialActivation = sealedRecord.roleLocalMaterialRef.materialActivation;
-	return await args.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdCommitQueueKey({ materialActivation }),
-		walletId: toWalletId(sealedRecord.walletId),
-		enabled: true,
-		task: async () => await restoreEmailOtpEcdsaSigningSessionMaterialFromSealedRecordInQueue(args)
-	});
-}
-async function restoreEmailOtpEcdsaSigningSessionMaterialFromSealedRecordInQueue(args) {
-	const sealedRecord = args.sealedRecord;
-	const materialActivation = sealedRecord.roleLocalMaterialRef.materialActivation;
-	const walletId = toWalletId(sealedRecord.walletId);
-	const currentBeforeRehydrate = await args.resolveCurrentEcdsaCapabilityRuntime({
-		walletId,
-		chainTarget: sealedRecord.chainTarget
-	});
-	if (currentBeforeRehydrate.kind !== "resolved" || !mpcMaterialActivationRefsEqual(currentBeforeRehydrate.runtime.materialActivation, materialActivation)) throw new EmailOtpEcdsaSealedRestoreSupersededError("before_rehydrate");
-	const selected = await requireSelectedEmailOtpWalletAuthority(args.resolveSelectedWalletAuthority, walletId);
-	const authorizationRead = await args.readExactWalletSessionAuthorization({
-		walletId,
-		authorityId: selected.authority.authorityId,
-		authMethodId: selected.authMethod.walletAuthMethodId
-	});
-	const existingKey = await emailOtpSealedExistingKey(sealedRecord);
-	const capability = await buildCanonicalEvmFamilyEcdsaSigningCapability({
-		authority: requireEmailOtpRuntimeAuthority(currentBeforeRehydrate.runtime),
-		manifest: currentBeforeRehydrate.manifest,
-		material: existingKey.persistedRoleLocalMaterial
-	});
-	const restoreSource = buildSealedRecordEmailOtpEcdsaRestoreSource({
-		sealedRecord,
-		authorization: requireEmailOtpSealedRestoreAuthorization({
-			sealedRecord,
-			authorizationRead,
-			selected,
-			runtime: currentBeforeRehydrate.runtime,
-			capability,
-			nowMs: Date.now()
-		})
-	});
-	if (restoreSource.authorization.runtime.kind !== "exact_ecdsa_sealed_runtime_v1") throw new Error("Email OTP sealed refresh requires a sealed ECDSA runtime");
-	const operationCredential = restoreSource.authorization.operationCredential;
-	if (emailOtpAuthContextRetention(restoreSource.emailOtpAuthContext) !== "session") return null;
-	const workerCtx = args.getSignerWorkerContext();
-	if (!workerCtx) throw new Error("Email OTP sealed refresh requires the dedicated emailOtp worker");
-	if (sealedRecord.expiresAtMs <= Date.now()) throw new Error("Email OTP sealed refresh expired sealed record");
-	if (sealedRecord.remainingUses <= 0) throw new Error("Email OTP sealed refresh exhausted sealed record");
-	const expectedMaterialActivation = materialActivation;
-	const thresholdSessionId = restoreSource.authorization.runtime.sealedRecord.thresholdSessionId;
-	const authorizationThresholdSessionId = emailOtpEcdsaSealAuthorizationThresholdSessionId(sealedRecord.routerAbEcdsaDerivationNormalSigning);
-	const restored = await requestRehydrateEmailOtpEcdsaWarmSessionMaterial({
-		workerCtx,
-		target: {
-			kind: "ecdsa",
-			thresholdSessionId
-		},
-		authorizationThresholdSessionId,
-		sealedSecretB64u: sealedRecord.sealedSecretB64u,
-		remainingUses: sealedRecord.remainingUses,
-		expiresAtMs: sealedRecord.expiresAtMs,
-		transport: {
-			relayerUrl: restoreSource.relayerUrl,
-			operationCredential,
-			signingSessionSealKeyVersion: parseSigningSessionSealKeyVersion(restoreSource.signingSessionSealKeyVersion),
-			groupId: restoreSource.signingSessionSealGroupId
-		},
-		restore: {
-			thresholdSessionId,
-			walletId: sealedRecord.walletId,
-			keyHandle: restoreSource.keyHandle,
-			chainTarget: restoreSource.chainTarget,
-			authSubjectId: emailOtpAuthContextProviderUserId(restoreSource.emailOtpAuthContext)
-		}
-	});
-	if (!restored.ok) throw new Error(restored.message || restored.code || "Email OTP sealed refresh failed");
-	if (!restoreSource.runtimePolicyScope) throw new Error("Email OTP sealed refresh requires runtime policy scope");
-	const emailOtpWorkerSessionHandle = parseEmailOtpWorkerIssuedSessionHandle(restored.emailOtpSessionHandle);
-	const bootstrap = await args.provisionThresholdEcdsaSession(buildEmailOtpRecoveredKeyActivation({
-		existingKey,
-		chainTarget: restoreSource.chainTarget,
-		thresholdSessionId,
-		ttlMs: Math.max(1, restored.expiresAtMs - Date.now()),
-		remainingUses: restored.remainingUses,
-		runtimePolicyScope: restoreSource.runtimePolicyScope,
-		relayerUrl: restoreSource.relayerUrl,
-		emailOtpAuthContext: restoreSource.emailOtpAuthContext,
-		emailOtpWorkerSessionHandle,
-		routeAuth: operationCredential
-	}));
-	const currentBeforeCommit = await args.resolveCurrentEcdsaCapabilityRuntime({
-		walletId: toWalletId(sealedRecord.walletId),
-		chainTarget: restoreSource.chainTarget
-	});
-	if (currentBeforeCommit.kind !== "resolved" || !mpcMaterialActivationRefsEqual(currentBeforeCommit.runtime.materialActivation, expectedMaterialActivation)) throw new EmailOtpEcdsaSealedRestoreSupersededError("before_commit");
-	const committed = await args.commitEvmFamilyThresholdEcdsaSessions({
-		walletId,
-		chainTarget: restoreSource.chainTarget,
-		bootstrap,
-		source: "email_otp",
-		authority: existingKey.persistedRoleLocalMaterial.authority,
-		emailOtpAuthContext: restoreSource.emailOtpAuthContext
-	});
-	return {
-		authorization: buildExactEvmFamilyWalletSessionAuthorization({
-			capability,
-			selected,
-			session: committed.bootstrap.session.walletSession,
-			operationCredential: committed.bootstrap.session.operationCredential,
-			runtime: currentBeforeCommit.runtime,
-			nowMs: Date.now()
-		}),
-		remainingUses: committed.bootstrap.session.remainingUses,
-		expiresAtMs: committed.bootstrap.session.expiresAtMs
-	};
-}
-//#endregion
-export { createEmailOtpEcdsaSigningSessionMaterialRestorer };
-
-//# sourceMappingURL=ecdsaRecovery.js.map

package/dist/esm/core/signingEngine/session/emailOtp/ed25519ExportContext.js

@@ -1,373 +0,0 @@
-import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { activeWalletSessionV1RecordsEqual } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
-import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { parseEd25519YaoRecoveryCapabilityV1 } from "../passkey/ed25519YaoRecoveryCapability.js";
-//#region src/core/signingEngine/session/emailOtp/ed25519ExportContext.ts
-function isEd25519YaoClientRootEnvelopeV1(envelope) {
-	return envelope.binding.kind === "ed25519_yao_client_root_v1";
-}
-function requireEd25519YaoClientRootEnvelopeV1(envelope) {
-	if (!isEd25519YaoClientRootEnvelopeV1(envelope)) throw new Error("[SigningEngine][ed25519-export] export envelope has the wrong secret kind");
-	return envelope;
-}
-function requireExactKeys(record, expected, label) {
-	const actual = Object.keys(record).sort();
-	const keys = [...expected].sort();
-	if (actual.length !== keys.length || actual.some((key, index) => key !== keys[index])) throw new Error(`${label} fields are invalid`);
-}
-function requirePositiveInteger(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new Error(`${label} is invalid`);
-	return value;
-}
-function requireParticipantIds(value) {
-	if (!Array.isArray(value) || value.length !== 2 || !Number.isSafeInteger(value[0]) || !Number.isSafeInteger(value[1]) || Number(value[0]) < 1 || Number(value[1]) < 1 || value[0] === value[1]) throw new Error("Ed25519 export bootstrap participantIds are invalid");
-	return [Number(value[0]), Number(value[1])];
-}
-async function readColdExportBootstrap(input) {
-	const operationCredential = input.authorization.operationCredential;
-	const status = input.authorization.status;
-	const authorizationId = input.authorization.record.authorizationId;
-	const signer = input.subject.signer;
-	const binding = input.source;
-	if (input.authorization.record.walletId !== signer.account.wallet.walletId || input.authorization.record.authMethodId !== input.authorization.selectedAuthMethod.walletAuthMethodId || input.authorization.factorAuthority.factor.providerUserId !== input.subject.auth.providerSubjectId || !binding.signingWorkerId || binding.participantIds.length !== 2 || !binding.registeredPublicKeyB64u) throw new Error("[SigningEngine][ed25519-export] sealed custody identity mismatch");
-	const request = parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1({
-		kind: "router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1",
-		walletId: String(signer.account.wallet.walletId),
-		nearAccountId: String(signer.account.nearAccountId),
-		nearEd25519SigningKeyId: String(signer.nearEd25519SigningKeyId),
-		signerSlot: signer.signerSlot,
-		thresholdSessionId: input.subject.thresholdSessionId,
-		signingWorkerId: binding.signingWorkerId,
-		participantIds: binding.participantIds
-	});
-	if (!request.ok) throw new Error(request.message);
-	const response = await input.fetch(`${new URL(input.relayerUrl).origin}${ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1}`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${operationCredential.token}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify(request.value)
-	});
-	const raw = await response.json().catch(() => null);
-	if (!response.ok) {
-		const failure = raw && typeof raw === "object" ? raw : null;
-		throw new Error(`[SigningEngine][ed25519-export] capability bootstrap failed (HTTP ${response.status}): ${String(failure?.message || "invalid response")}`);
-	}
-	const record = requireRecord(raw, "Ed25519 export bootstrap");
-	requireExactKeys(record, [
-		"kind",
-		"walletId",
-		"nearAccountId",
-		"nearEd25519SigningKeyId",
-		"signerSlot",
-		"thresholdSessionId",
-		"walletSessionId",
-		"quotaId",
-		"signingWorkerId",
-		"thresholdExpiresAtMs",
-		"participantIds",
-		"runtimePolicyScope",
-		"routerAbNormalSigning",
-		"capability"
-	], "Ed25519 export bootstrap");
-	if (record.kind !== "router_ab_ed25519_yao_v2_session_bootstrap_v1") throw new Error("Ed25519 export bootstrap kind is invalid");
-	const walletId = requireCanonicalString(record.walletId, "bootstrap.walletId");
-	const nearAccountId = requireCanonicalString(record.nearAccountId, "bootstrap.nearAccountId");
-	const nearEd25519SigningKeyId = requireCanonicalString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId");
-	const thresholdSessionId = parseThresholdEd25519SessionId(record.thresholdSessionId);
-	const walletSessionId = parseWalletSessionId(record.walletSessionId);
-	const quotaId = parseMpcWalletSigningQuotaId(record.quotaId);
-	const authority = input.authorization.factorAuthority;
-	const runtimePolicyScope = normalizeRuntimePolicyScope(record.runtimePolicyScope);
-	const signingRoot = signingRootScopeFromRuntimePolicyScope(runtimePolicyScope);
-	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(record.routerAbNormalSigning);
-	const capability = {
-		kind: "router_ab_ed25519_yao_active_capability_v1",
-		...parseEd25519YaoRecoveryCapabilityV1(record.capability)
-	};
-	const participantIds = requireParticipantIds(record.participantIds);
-	const registeredPublicKeyB64u = base64UrlEncode(Uint8Array.from(capability.registeredPublicKey));
-	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !signingRoot || !routerAbNormalSigning || walletId !== String(signer.account.wallet.walletId) || nearAccountId !== String(signer.account.nearAccountId) || nearEd25519SigningKeyId !== String(signer.nearEd25519SigningKeyId) || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || requireCanonicalString(record.signingWorkerId, "bootstrap.signingWorkerId") !== binding.signingWorkerId || participantIds[0] !== binding.participantIds[0] || participantIds[1] !== binding.participantIds[1] || authority.factor.providerUserId !== input.subject.auth.providerSubjectId || registeredPublicKeyB64u !== binding.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] capability bootstrap identity mismatch");
-	return {
-		emailHashHex: authority.verifier.emailHashHex,
-		bootstrap: {
-			kind: "router_ab_ed25519_yao_email_otp_recovery_v1",
-			session: {
-				walletId: signer.account.wallet.walletId,
-				nearAccountId,
-				nearEd25519SigningKeyId,
-				authorityScope: {
-					kind: "email_otp",
-					provider: authority.factor.provider,
-					providerUserId: authority.factor.providerUserId
-				},
-				thresholdSessionId: thresholdSessionId.value,
-				authorizationId,
-				walletSessionId: walletSessionId.value,
-				quotaId: quotaId.value,
-				expiresAtMs: Math.min(requirePositiveInteger(record.thresholdExpiresAtMs, "bootstrap.thresholdExpiresAtMs"), status.expiresAtMs),
-				participantIds,
-				remainingUses: status.remainingUses,
-				signingRootId: signingRoot.signingRootId,
-				signingRootVersion: runtimePolicyScope.signingRootVersion,
-				runtimePolicyScope,
-				routerAbNormalSigning
-			},
-			capability
-		}
-	};
-}
-async function resolveEmailOtpEd25519OperationRecoveryBootstrapV1(input) {
-	const authorization = resolveExactEmailOtpExportAuthorization({
-		subject: input.subject,
-		expectedMaterialActivation: input.expectedMaterialActivation,
-		result: input.authorization
-	});
-	return (await readColdExportBootstrap({
-		subject: input.subject,
-		authorization,
-		source: input.source,
-		expectedMaterialActivation: input.expectedMaterialActivation,
-		relayerUrl: input.relayerUrl,
-		fetch: input.fetch
-	})).bootstrap;
-}
-async function readLinkedExportCapability(input) {
-	const operationCredential = input.authorization.operationCredential;
-	const signer = input.subject.signer;
-	if (input.authorization.record.walletId !== signer.account.wallet.walletId || input.authorization.record.authMethodId !== input.authorization.selectedAuthMethod.walletAuthMethodId || input.authorization.factorAuthority.factor.providerUserId !== input.subject.auth.providerSubjectId) throw new Error("[SigningEngine][ed25519-export] linked Wallet Session is unavailable");
-	const request = parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1({
-		kind: "router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1",
-		walletId: String(signer.account.wallet.walletId),
-		nearAccountId: String(signer.account.nearAccountId),
-		nearEd25519SigningKeyId: String(signer.nearEd25519SigningKeyId),
-		signerSlot: signer.signerSlot,
-		thresholdSessionId: input.subject.thresholdSessionId,
-		signingWorkerId: input.source.signingWorkerId,
-		participantIds: input.source.participantIds
-	});
-	if (!request.ok) throw new Error(request.message);
-	const response = await input.fetch(`${new URL(input.relayerUrl).origin}${ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1}`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${operationCredential.token}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify(request.value)
-	});
-	const raw = await response.json().catch(() => null);
-	if (!response.ok) {
-		const failure = raw && typeof raw === "object" ? raw : null;
-		throw new Error(`[SigningEngine][ed25519-export] linked capability bootstrap failed (HTTP ${response.status}): ${String(failure?.message || "invalid response")}`);
-	}
-	const record = requireRecord(raw, "linked Ed25519 export bootstrap");
-	requireExactKeys(record, [
-		"kind",
-		"walletId",
-		"nearAccountId",
-		"nearEd25519SigningKeyId",
-		"signerSlot",
-		"thresholdSessionId",
-		"walletSessionId",
-		"quotaId",
-		"signingWorkerId",
-		"thresholdExpiresAtMs",
-		"participantIds",
-		"runtimePolicyScope",
-		"routerAbNormalSigning",
-		"capability"
-	], "linked Ed25519 export bootstrap");
-	if (record.kind !== "router_ab_ed25519_yao_v2_session_bootstrap_v1") throw new Error("linked Ed25519 export bootstrap kind is invalid");
-	const thresholdSessionId = parseThresholdEd25519SessionId(record.thresholdSessionId);
-	const walletSessionId = parseWalletSessionId(record.walletSessionId);
-	const quotaId = parseMpcWalletSigningQuotaId(record.quotaId);
-	const runtimePolicyScope = normalizeRuntimePolicyScope(record.runtimePolicyScope);
-	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(record.routerAbNormalSigning);
-	const capability = {
-		kind: "router_ab_ed25519_yao_active_capability_v1",
-		...parseEd25519YaoRecoveryCapabilityV1(record.capability)
-	};
-	const participantIds = requireParticipantIds(record.participantIds);
-	const registeredPublicKeyB64u = base64UrlEncode(Uint8Array.from(capability.registeredPublicKey));
-	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !runtimePolicyScope || !routerAbNormalSigning || requireCanonicalString(record.walletId, "bootstrap.walletId") !== String(signer.account.wallet.walletId) || requireCanonicalString(record.nearAccountId, "bootstrap.nearAccountId") !== String(signer.account.nearAccountId) || requireCanonicalString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId") !== String(signer.nearEd25519SigningKeyId) || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requireCanonicalString(record.signingWorkerId, "bootstrap.signingWorkerId") !== input.source.signingWorkerId || participantIds[0] !== input.source.participantIds[0] || participantIds[1] !== input.source.participantIds[1] || registeredPublicKeyB64u !== input.source.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] linked capability identity mismatch");
-	return capability;
-}
-function countExactEd25519ExportSubjects(subjects, expectedMaterialActivation) {
-	let matchCount = 0;
-	for (const subject of subjects) switch (subject.kind) {
-		case "export_keys":
-			if (subject.keyFamily === "ed25519" && mpcMaterialActivationRefsEqual(subject.materialActivation, expectedMaterialActivation)) matchCount += 1;
-			break;
-		case "sign":
-		case "link_devices":
-		case "revoke_devices": break;
-		default: break;
-	}
-	return matchCount;
-}
-function assertExactEmailOtpExportAuthorization(args) {
-	const { authorization } = args;
-	const selectedAuthority = authorization.selectedAuthority;
-	const selectedAuthMethod = authorization.selectedAuthMethod;
-	const factorAuthority = authorization.factorAuthority;
-	const record = authorization.record;
-	const operationCredential = authorization.operationCredential;
-	const status = authorization.status;
-	const quotaIsExact = status.status === "active" && status.quotaLifecycle === "active" && status.remainingUses > 0 || status.status === "exhausted" && status.quotaLifecycle === "exhausted" && status.remainingUses === 0;
-	if (selectedAuthority.state !== "active" || selectedAuthority.walletId !== args.subject.signer.account.wallet.walletId || selectedAuthMethod.status !== "active" || selectedAuthMethod.walletId !== args.subject.signer.account.wallet.walletId || selectedAuthMethod.walletAuthorityId !== selectedAuthority.authorityId || factorAuthority.walletId !== args.subject.signer.account.wallet.walletId || factorAuthority.bindingId !== selectedAuthMethod.walletAuthMethodId || factorAuthority.verifier.emailHashHex !== selectedAuthMethod.emailHashHex || factorAuthority.factor.providerUserId !== args.subject.auth.providerSubjectId || record.walletId !== args.subject.signer.account.wallet.walletId || record.authorityId !== selectedAuthority.authorityId || record.authMethodId !== selectedAuthMethod.walletAuthMethodId || String(record.authorityDigestB64u) !== String(selectedAuthority.authorityDigestB64u) || record.authorityRevocationEpoch !== selectedAuthority.revocationEpoch || !quotaIsExact || status.walletSessionId !== operationCredential.walletSessionId || status.quotaId !== record.quotaId || !activeWalletSessionV1RecordsEqual(status.authorization, record) || operationCredential.walletSessionId.trim().length === 0 || operationCredential.token.trim().length === 0 || status.expiresAtMs <= Date.now() || countExactEd25519ExportSubjects(record.capabilitySubjects, args.expectedMaterialActivation) !== 1) throw new Error("[SigningEngine][ed25519-export] exact Email OTP authorization identity mismatch");
-}
-function resolveExactEmailOtpExportAuthorization(args) {
-	switch (args.result.kind) {
-		case "found":
-			assertExactEmailOtpExportAuthorization({
-				subject: args.subject,
-				expectedMaterialActivation: args.expectedMaterialActivation,
-				authorization: args.result.authorization
-			});
-			return args.result.authorization;
-		case "missing": throw new Error("[SigningEngine][ed25519-export] exact Email OTP authorization is missing");
-		case "upgrade_required": throw new Error("[SigningEngine][ed25519-export] exact Email OTP authorization requires an upgrade");
-		case "corrupt": throw new Error("[SigningEngine][ed25519-export] exact Email OTP authorization is corrupt");
-		case "persistence_unavailable": throw new Error("[SigningEngine][ed25519-export] exact Email OTP authorization persistence is unavailable");
-		case "exhausted": throw new Error("[SigningEngine][ed25519-export] exact Email OTP authorization is exhausted");
-		case "expired": throw new Error("[SigningEngine][ed25519-export] exact Email OTP authorization is expired");
-		case "superseded": throw new Error("[SigningEngine][ed25519-export] exact Email OTP authorization is superseded");
-		case "authority_unavailable": throw new Error("[SigningEngine][ed25519-export] exact Email OTP authority is unavailable");
-		case "method_unavailable": throw new Error("[SigningEngine][ed25519-export] exact Email OTP method is unavailable");
-		case "capability_unavailable": throw new Error("[SigningEngine][ed25519-export] exact Email OTP export capability is unavailable");
-		default: return args.result;
-	}
-}
-function capabilityFromActiveMaterial(args) {
-	if (args.material.activeClient.status().kind !== "active") throw new Error("[SigningEngine][ed25519-export] wallet custody client is inactive");
-	const metadata = args.material.activeClient.metadata();
-	const signer = args.subject.signer;
-	if (!mpcMaterialActivationRefsEqual(metadata.materialActivation, args.expectedMaterialActivation) || args.material.facts.signer.account.wallet.walletId !== signer.account.wallet.walletId || String(args.material.facts.signer.account.nearAccountId) !== String(signer.account.nearAccountId) || args.material.facts.signer.nearEd25519SigningKeyId !== signer.nearEd25519SigningKeyId || args.material.facts.signer.signerSlot !== signer.signerSlot || metadata.applicationBinding.wallet_id !== signer.account.wallet.walletId || metadata.applicationBinding.near_ed25519_signing_key_id !== signer.nearEd25519SigningKeyId || metadata.applicationBinding.key_creation_signer_slot !== signer.signerSlot) throw new Error("[SigningEngine][ed25519-export] wallet custody client changed the exact lane");
-	const thresholdSessionId = parseThresholdEd25519SessionId(metadata.scope.threshold_session_id);
-	if (!thresholdSessionId.ok) throw new Error(`[SigningEngine][ed25519-export] threshold session id is invalid: ${thresholdSessionId.error.message}`);
-	return {
-		kind: "router_ab_ed25519_yao_active_capability_v1",
-		materialActivation: metadata.materialActivation,
-		activeCapabilityBinding: metadata.activeCapabilityBinding,
-		registeredPublicKey: [...metadata.registeredPublicKey],
-		nearAccountId: String(signer.account.nearAccountId),
-		applicationBinding: metadata.applicationBinding,
-		runtimePolicyScope: args.material.facts.runtimePolicyScope,
-		participantIds: metadata.participantIds,
-		lifecycle: {
-			lifecycleId: metadata.scope.lifecycle_id,
-			rootShareEpoch: metadata.scope.root_share_epoch,
-			accountId: metadata.scope.account_id,
-			thresholdSessionId: thresholdSessionId.value,
-			signerSetId: metadata.scope.signer_set_id,
-			signingWorkerId: metadata.scope.signing_worker_id
-		},
-		stateEpoch: Number(metadata.stateEpoch),
-		registrationContinuity: {
-			kind: "recovery",
-			activationTranscript: [...metadata.transcript]
-		}
-	};
-}
-async function resolveWalletCustodyEd25519ExportContextV1(input) {
-	const walletId = input.subject.signer.account.wallet.walletId;
-	const exactAuthorization = resolveExactEmailOtpExportAuthorization({
-		subject: input.subject,
-		expectedMaterialActivation: input.expectedMaterialActivation,
-		result: await input.readExactWalletSessionAuthorization({
-			subject: input.subject,
-			expectedMaterialActivation: input.expectedMaterialActivation
-		})
-	});
-	const material = input.resolveActiveCapability(walletId, input.subject.signer.account.nearAccountId, input.expectedMaterialActivation);
-	const activeCapability = material ? capabilityFromActiveMaterial({
-		subject: input.subject,
-		expectedMaterialActivation: input.expectedMaterialActivation,
-		material
-	}) : null;
-	const rootResolution = input.resolveEd25519YaoClientRootEnvelope ? await input.resolveEd25519YaoClientRootEnvelope({
-		subject: input.subject,
-		capability: activeCapability,
-		selectedMaterialActivation: input.expectedMaterialActivation
-	}) : null;
-	const rootEnvelope = rootResolution && "envelope" in rootResolution ? rootResolution.envelope : rootResolution;
-	let rootCapability = activeCapability;
-	if (rootResolution && "envelope" in rootResolution) rootCapability = await readLinkedExportCapability({
-		subject: input.subject,
-		authorization: exactAuthorization,
-		source: rootResolution.source,
-		expectedMaterialActivation: rootResolution.source.materialActivation,
-		relayerUrl: input.relayerUrl,
-		fetch: input.fetch
-	});
-	if (rootEnvelope) {
-		if (!rootCapability) throw new Error("[SigningEngine][ed25519-export] Ed25519 export-root capability is unavailable");
-		return {
-			kind: "wallet_custody_ed25519_export_context_v1",
-			lane: input.subject,
-			authorization: exactAuthorization,
-			material: {
-				kind: "sealed_export_root",
-				materialActivation: rootCapability.materialActivation,
-				capability: rootCapability,
-				exportRootEnvelope: requireEd25519YaoClientRootEnvelopeV1(rootEnvelope)
-			}
-		};
-	}
-	if (material) {
-		if (!activeCapability) throw new Error("[SigningEngine][ed25519-export] active Email OTP capability is unavailable");
-		return {
-			kind: "wallet_custody_ed25519_export_context_v1",
-			lane: input.subject,
-			authorization: exactAuthorization,
-			material: {
-				kind: "active_capability",
-				materialActivation: input.expectedMaterialActivation,
-				capability: activeCapability
-			}
-		};
-	}
-	const loaded = await input.loadWalletCustodyMaterial();
-	if (loaded.kind !== "found") throw new Error("[SigningEngine][ed25519-export] sealed wallet custody material is unavailable");
-	const cold = await readColdExportBootstrap({
-		subject: input.subject,
-		authorization: exactAuthorization,
-		source: loaded.material.binding,
-		expectedMaterialActivation: input.expectedMaterialActivation,
-		relayerUrl: input.relayerUrl,
-		fetch: input.fetch
-	});
-	return {
-		kind: "wallet_custody_ed25519_export_context_v1",
-		lane: input.subject,
-		authorization: exactAuthorization,
-		material: {
-			kind: "sealed_custody",
-			materialActivation: input.expectedMaterialActivation,
-			capability: cold.bootstrap.capability,
-			walletCustodyEd25519Material: loaded.material,
-			bootstrap: cold.bootstrap,
-			activateRecoveredCapability: (request) => {
-				if (request.operationCredential.walletSessionId !== exactAuthorization.operationCredential.walletSessionId || request.operationCredential.token !== exactAuthorization.operationCredential.token) throw new Error("[SigningEngine][ed25519-export] recovered capability credential does not match authorization");
-				return input.activateRecoveredCapability({
-					activation: {
-						...request.activation,
-						bootstrap: cold.bootstrap,
-						emailHashHex: cold.emailHashHex
-					},
-					operationCredential: request.operationCredential
-				});
-			}
-		}
-	};
-}
-//#endregion
-export { resolveEmailOtpEd25519OperationRecoveryBootstrapV1, resolveWalletCustodyEd25519ExportContextV1 };
-
-//# sourceMappingURL=ed25519ExportContext.js.map