@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/signingEngine/session/emailOtp/workerEnrollment.js

@@ -1,159 +0,0 @@
-import { requireTrimmedString, toOptionalTrimmedNonEmptyString } from "../../../../shared-ts/src/utils/validation.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
-import { thresholdEcdsaChainTargetFromRequest } from "../../interfaces/ecdsaChainTarget.js";
-import { buildEmailOtpRoutePlan } from "../../stepUpConfirmation/otpPrompt/authLane.js";
-import { zeroizeBytes } from "./zeroize.js";
-//#region src/core/signingEngine/session/emailOtp/workerEnrollment.ts
-function requireObjectJson(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} returned invalid JSON`);
-	return value;
-}
-function readString(value, label) {
-	return requireTrimmedString(value, label);
-}
-function readOptionalString(value) {
-	return toOptionalTrimmedNonEmptyString(value);
-}
-function toArrayBufferCopy(bytes) {
-	const out = new ArrayBuffer(bytes.byteLength);
-	new Uint8Array(out).set(bytes);
-	return out;
-}
-function requireWorkerCtx(workerCtx) {
-	if (!workerCtx || typeof workerCtx.requestWorkerOperation !== "function") throw new Error("Email OTP secret-bearing operations require the dedicated emailOtp worker");
-	return workerCtx;
-}
-function cloneFixed32Bytes(value, label) {
-	if (!(value instanceof Uint8Array)) throw new Error(`${label} must be a Uint8Array`);
-	if (value.length !== 32) throw new Error(`${label} must contain 32 bytes`);
-	return Uint8Array.from(value);
-}
-function buildWorkerEmailOtpRoutePlan(args) {
-	if (args.routeFamily === "registration") return buildEmailOtpRoutePlan({
-		routeFamily: "registration",
-		operation: WALLET_EMAIL_OTP_REGISTRATION_OPERATION
-	});
-	return buildEmailOtpRoutePlan({
-		routeFamily: "login",
-		operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
-	});
-}
-function parseEmailOtpEnrollmentResult(value) {
-	const response = requireObjectJson(value, "Email OTP enrollment result");
-	return {
-		challengeId: readString(response.challengeId, "challengeId"),
-		otpChannel: EMAIL_OTP_CHANNEL,
-		enrollmentId: readString(response.enrollmentId, "enrollmentId"),
-		enrollmentSealKeyVersion: readString(response.enrollmentSealKeyVersion, "enrollmentSealKeyVersion"),
-		serverSealedFactorCiphertextB64u: readString(response.serverSealedFactorCiphertextB64u, "serverSealedFactorCiphertextB64u"),
-		clientUnlockPublicKeyB64u: readString(response.clientUnlockPublicKeyB64u, "clientUnlockPublicKeyB64u"),
-		unlockKeyVersion: readString(response.unlockKeyVersion, "unlockKeyVersion")
-	};
-}
-function parseEmailOtpWalletRegistrationEcdsaPrepareHandle(value) {
-	const response = requireObjectJson(value, "Email OTP registration ECDSA handle");
-	const kind = readString(response.kind, "emailOtpSessionHandle.handle.kind");
-	if (kind !== "email_otp_worker_session_handle_v1") throw new Error(`Unsupported Email OTP worker handle kind: ${kind}`);
-	const action = readString(response.action, "emailOtpSessionHandle.handle.action");
-	if (action !== "wallet_registration_ecdsa_prepare") throw new Error(`Unsupported Email OTP worker handle action: ${action}`);
-	if (readString(response.operation, "emailOtpSessionHandle.handle.operation") !== "registration") throw new Error("Email OTP registration ECDSA handle requires registration operation");
-	if (readString(response.keyScope, "emailOtpSessionHandle.handle.keyScope") !== "evm-family") throw new Error("Email OTP registration ECDSA handle requires evm-family keyScope");
-	return {
-		kind: "email_otp_worker_session_handle_v1",
-		sessionId: readString(response.sessionId, "emailOtpSessionHandle.handle.sessionId"),
-		walletId: readString(response.walletId, "emailOtpSessionHandle.handle.walletId"),
-		evmFamilySigningKeySlotId: readString(response.evmFamilySigningKeySlotId, "emailOtpSessionHandle.handle.evmFamilySigningKeySlotId"),
-		authSubjectId: readString(response.authSubjectId, "emailOtpSessionHandle.handle.authSubjectId"),
-		action: "wallet_registration_ecdsa_prepare",
-		operation: "registration",
-		keyScope: "evm-family",
-		chainTarget: parseThresholdEcdsaChainTargetForWorkerEnrollment(response.chainTarget)
-	};
-}
-function parseThresholdEcdsaChainTargetForWorkerEnrollment(value) {
-	const target = value && typeof value === "object" ? value : null;
-	if (!target) throw new Error("Email OTP registration ECDSA handle requires chainTarget");
-	return thresholdEcdsaChainTargetFromRequest(target);
-}
-function parseEmailOtpWalletRegistrationEcdsaPrepareHandleResult(value) {
-	const response = requireObjectJson(value, "Email OTP registration ECDSA handle result");
-	const kind = readString(response.kind, "emailOtpSessionHandle.kind");
-	switch (kind) {
-		case "available":
-			if (!Array.isArray(response.handles) || response.handles.length === 0) throw new Error("Email OTP registration ECDSA handle result requires handles");
-			{
-				const handles = [];
-				for (const handle of response.handles) handles.push(parseEmailOtpWalletRegistrationEcdsaPrepareHandle(handle));
-				const first = handles[0];
-				if (!first) throw new Error("Email OTP registration ECDSA handle result requires handles");
-				return {
-					kind: "available",
-					handles: [first, ...handles.slice(1)]
-				};
-			}
-		case "not_requested":
-			if ("handles" in response) throw new Error("Email OTP unrequested registration ECDSA handle result forbids handles");
-			return { kind: "not_requested" };
-		default: throw new Error(`Unsupported Email OTP registration ECDSA handle result kind: ${kind}`);
-	}
-}
-async function enrollEmailOtpWallet(args) {
-	const workerCtx = requireWorkerCtx(args.workerCtx);
-	let workerClientSecret32 = null;
-	try {
-		workerClientSecret32 = args.clientSecret32 ? cloneFixed32Bytes(args.clientSecret32, "clientSecret32") : null;
-		return parseEmailOtpEnrollmentResult(await workerCtx.requestWorkerOperation({
-			kind: "emailOtp",
-			request: {
-				type: "enrollEmailOtpWallet",
-				payload: {
-					relayUrl: readString(args.relayUrl, "relayUrl"),
-					walletId: readString(args.walletId, "walletId"),
-					userId: readString(args.userId, "userId"),
-					...readOptionalString(args.challengeId) ? { challengeId: readOptionalString(args.challengeId) } : {},
-					otpCode: readString(args.otpCode, "otpCode"),
-					groupId: readString(args.groupId, "groupId"),
-					routePlan: buildWorkerEmailOtpRoutePlan({ routeFamily: "registration" }),
-					otpChannel: args.otpChannel || "email_otp",
-					...workerClientSecret32 ? { clientSecret32: toArrayBufferCopy(workerClientSecret32) } : {}
-				}
-			}
-		}));
-	} finally {
-		zeroizeBytes(workerClientSecret32);
-	}
-}
-async function prepareEmailOtpRegistrationEnrollmentMaterial(args) {
-	const workerCtx = requireWorkerCtx(args.workerCtx);
-	let workerClientSecret32 = null;
-	try {
-		workerClientSecret32 = args.clientSecret32 ? cloneFixed32Bytes(args.clientSecret32, "clientSecret32") : null;
-		const result = await workerCtx.requestWorkerOperation({
-			kind: "emailOtp",
-			request: {
-				type: "prepareEmailOtpRegistrationEnrollmentMaterial",
-				payload: {
-					relayUrl: readString(args.relayUrl, "relayUrl"),
-					walletId: readString(args.walletId, "walletId"),
-					userId: readString(args.userId, "userId"),
-					groupId: readString(args.groupId, "groupId"),
-					routePlan: buildWorkerEmailOtpRoutePlan({ routeFamily: "registration" }),
-					otpChannel: args.otpChannel || "email_otp",
-					ecdsaSessionHandle: args.ecdsaSessionHandle,
-					...workerClientSecret32 ? { clientSecret32: toArrayBufferCopy(workerClientSecret32) } : {}
-				}
-			}
-		});
-		return {
-			...result,
-			emailOtpSessionHandle: parseEmailOtpWalletRegistrationEcdsaPrepareHandleResult(result.emailOtpSessionHandle),
-			emailOtpEnrollment: result.emailOtpEnrollment
-		};
-	} finally {
-		zeroizeBytes(workerClientSecret32);
-	}
-}
-//#endregion
-export { enrollEmailOtpWallet, prepareEmailOtpRegistrationEnrollmentMaterial };
-
-//# sourceMappingURL=workerEnrollment.js.map

package/dist/esm/core/signingEngine/session/emailOtp/workerRequests.js

@@ -1,84 +0,0 @@
-//#region src/core/signingEngine/session/emailOtp/workerRequests.ts
-async function requestSealEmailOtpWarmSessionMaterial(args) {
-	return await args.workerCtx.requestWorkerOperation({
-		kind: "emailOtp",
-		request: {
-			type: "sealEmailOtpWarmSessionMaterial",
-			timeoutMs: 3e4,
-			payload: {
-				target: args.target,
-				transport: {
-					...args.transport,
-					authorizationThresholdSessionId: args.authorizationThresholdSessionId
-				}
-			}
-		}
-	});
-}
-async function requestGetEmailOtpWarmSessionStatus(args) {
-	return await args.worker.requestWorkerOperation({
-		kind: "emailOtp",
-		request: {
-			type: "getEmailOtpWarmSessionStatus",
-			timeoutMs: 5e3,
-			payload: { target: args.target }
-		}
-	});
-}
-async function requestConsumeEmailOtpWarmSessionUses(args) {
-	return await args.worker.requestWorkerOperation({
-		kind: "emailOtp",
-		request: {
-			type: "consumeEmailOtpWarmSessionUses",
-			timeoutMs: 5e3,
-			payload: {
-				target: args.target,
-				...typeof args.uses === "number" ? { uses: args.uses } : {}
-			}
-		}
-	});
-}
-async function requestClearEmailOtpWarmSessionMaterial(args) {
-	return await args.worker.requestWorkerOperation({
-		kind: "emailOtp",
-		request: {
-			type: "clearEmailOtpWarmSessionMaterial",
-			timeoutMs: 5e3,
-			payload: { target: args.target }
-		}
-	});
-}
-async function requestRehydrateEmailOtpEcdsaWarmSessionMaterial(args) {
-	return await args.workerCtx.requestWorkerOperation({
-		kind: "emailOtp",
-		request: {
-			type: "rehydrateEmailOtpEcdsaWarmSessionMaterial",
-			timeoutMs: 6e4,
-			payload: {
-				target: args.target,
-				sealedSecretB64u: args.sealedSecretB64u,
-				remainingUses: args.remainingUses,
-				expiresAtMs: args.expiresAtMs,
-				transport: {
-					...args.transport,
-					authorizationThresholdSessionId: args.authorizationThresholdSessionId
-				},
-				restore: args.restore
-			}
-		}
-	});
-}
-async function requestRehydrateEmailOtpEd25519YaoOperationMaterial(args) {
-	return await args.workerCtx.requestWorkerOperation({
-		kind: "emailOtp",
-		request: {
-			type: "rehydrateEmailOtpEd25519YaoOperationMaterial",
-			timeoutMs: 12e4,
-			payload: args.payload
-		}
-	});
-}
-//#endregion
-export { requestClearEmailOtpWarmSessionMaterial, requestConsumeEmailOtpWarmSessionUses, requestGetEmailOtpWarmSessionStatus, requestRehydrateEmailOtpEcdsaWarmSessionMaterial, requestRehydrateEmailOtpEd25519YaoOperationMaterial, requestSealEmailOtpWarmSessionMaterial };
-
-//# sourceMappingURL=workerRequests.js.map

package/dist/esm/core/signingEngine/session/emailOtp/zeroize.js

@@ -1,9 +0,0 @@
-//#region src/core/signingEngine/session/emailOtp/zeroize.ts
-function zeroizeBytes(bytes) {
-	if (!(bytes instanceof Uint8Array)) return;
-	bytes.fill(0);
-}
-//#endregion
-export { zeroizeBytes };
-
-//# sourceMappingURL=zeroize.js.map

package/dist/esm/core/signingEngine/session/identity/exactWalletSessionCredential.js

@@ -1,104 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { isExactEcdsaSigningLaneIdentity } from "./exactSigningLaneIdentity.js";
-//#region src/core/signingEngine/session/identity/exactWalletSessionCredential.ts
-function unavailable(reason) {
-	return {
-		kind: "unavailable",
-		reason
-	};
-}
-function selectedExactWalletAuthority(args) {
-	const selected = args.selected;
-	if (selected.kind !== "resolved") switch (selected.kind) {
-		case "missing_selection": return unavailable("selected_authority_missing");
-		case "missing_auth_method":
-		case "missing_authority":
-		case "integrity_error": return unavailable("selected_authority_invalid");
-		default: return selected;
-	}
-	if (selected.selection.walletId !== args.walletId || selected.authMethod.walletId !== args.walletId || selected.authority.walletId !== args.walletId || selected.selection.walletAuthMethodId !== selected.authMethod.walletAuthMethodId || selected.authMethod.walletAuthorityId !== selected.authority.authorityId) return unavailable("authority_identity_mismatch");
-	if (selected.selection.lockState !== "unlocked") return unavailable("wallet_locked");
-	if (selected.authMethod.status !== "active") return unavailable("auth_method_inactive");
-	if (selected.authority.state !== "active") return unavailable("authority_inactive");
-	if (selected.authMethod.kind !== args.authMethod) return unavailable("auth_method_mismatch");
-	return {
-		authority: selected.authority,
-		authMethod: selected.authMethod
-	};
-}
-function authorityMaterialActivation(args) {
-	const activations = args.authority.signerActivations;
-	if (args.keyFamily === "ed25519") return activations.ed25519?.materialActivation ?? null;
-	return activations.ecdsa?.materialActivation ?? null;
-}
-function sessionAuthorizesSigningSubject(args) {
-	return args.session.capabilitySubjects.filter((subject) => subject.kind === "sign" && subject.keyFamily === args.keyFamily && mpcMaterialActivationRefsEqual(subject.materialActivation, args.materialActivation)).length === 1;
-}
-/** The signing subject an operation on this lane must find in the session. */
-function requiredSigningSubjectForExactSigningLane(identity) {
-	if (isExactEcdsaSigningLaneIdentity(identity)) return {
-		keyFamily: "ecdsa_secp256k1",
-		materialActivation: identity.signer.materialActivation
-	};
-	return { keyFamily: "ed25519" };
-}
-async function resolveExactWalletSessionOperationCredential(args) {
-	const { input, ports } = args;
-	let selectedResult;
-	try {
-		selectedResult = await ports.resolveSelectedWalletAuthority(String(input.walletId));
-	} catch {
-		return unavailable("persistence_unavailable");
-	}
-	const selected = selectedExactWalletAuthority({
-		selected: selectedResult,
-		walletId: input.walletId,
-		authMethod: input.authMethod
-	});
-	if ("kind" in selected) return selected;
-	const materialActivation = authorityMaterialActivation({
-		authority: selected.authority,
-		keyFamily: input.requiredSigningSubject.keyFamily
-	});
-	if (!materialActivation) return unavailable("signer_material_missing");
-	if (input.requiredSigningSubject.keyFamily === "ecdsa_secp256k1" && !mpcMaterialActivationRefsEqual(input.requiredSigningSubject.materialActivation, materialActivation)) return unavailable("signer_material_mismatch");
-	let read;
-	try {
-		read = await ports.readExactWithOperationCredential({
-			walletId: input.walletId,
-			authorityId: selected.authority.authorityId,
-			authMethodId: selected.authMethod.walletAuthMethodId
-		});
-	} catch {
-		return unavailable("persistence_unavailable");
-	}
-	switch (read.kind) {
-		case "found": break;
-		case "missing": return unavailable("wallet_session_missing");
-		case "upgrade_required": return unavailable("wallet_session_upgrade_required");
-	}
-	const session = read.record;
-	const operationCredential = read.operationCredential;
-	if (session.walletId !== input.walletId || session.authorityId !== selected.authority.authorityId || session.authMethodId !== selected.authMethod.walletAuthMethodId || session.authorityDigestB64u !== selected.authority.authorityDigestB64u || session.authorityRevocationEpoch !== selected.authority.revocationEpoch || session.quotaId !== input.quotaId || operationCredential.walletSessionId !== input.walletSessionId || operationCredential.token.trim().length === 0) return unavailable("wallet_session_identity_mismatch");
-	if (input.expiry.kind === "unexpired" && session.expiresAtMs <= input.expiry.nowMs) return unavailable("wallet_session_expired");
-	if (input.expiry.kind === "expired" && session.expiresAtMs > input.expiry.nowMs) return unavailable("wallet_session_not_expired");
-	if (!sessionAuthorizesSigningSubject({
-		session,
-		keyFamily: input.requiredSigningSubject.keyFamily,
-		materialActivation
-	})) return unavailable("wallet_session_capability_mismatch");
-	return {
-		kind: "resolved",
-		resolved: {
-			authMethod: selected.authMethod,
-			session,
-			operationCredential,
-			walletSessionId: operationCredential.walletSessionId,
-			materialActivation
-		}
-	};
-}
-//#endregion
-export { requiredSigningSubjectForExactSigningLane, resolveExactWalletSessionOperationCredential };
-
-//# sourceMappingURL=exactWalletSessionCredential.js.map

package/dist/esm/core/signingEngine/session/identity/exactWalletSessionReader.js

@@ -1,54 +0,0 @@
-import { WalletSessionAuthorizationUpgradeRequiredError } from "../../../indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-//#region src/core/signingEngine/session/identity/exactWalletSessionReader.ts
-function exactWalletSessionMatchesAuthorityScope(args) {
-	const { record, operationCredential, scope } = args;
-	return record.walletId === scope.walletId && record.authorityId === scope.authorityId && record.authMethodId === scope.authMethodId && record.authorityDigestB64u === scope.authorityDigestB64u && record.authorityRevocationEpoch === scope.authorityRevocationEpoch && operationCredential.kind === "opaque_wallet_session_operation_credential_v1" && operationCredential.token.trim().length > 0;
-}
-async function readExactWalletSessionAuthentication(args) {
-	const { walletId, ports } = args;
-	const selected = await ports.resolveSelectedWalletAuthority(String(walletId));
-	if (selected.kind !== "resolved") return { kind: "missing" };
-	const { selection, authMethod, authority } = selected;
-	if (selection.walletId !== walletId || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || selection.lockState !== "unlocked" || authMethod.walletId !== walletId || authMethod.walletAuthorityId !== authority.authorityId || authMethod.status !== "active" || authority.walletId !== walletId || authority.state !== "active") return { kind: "missing" };
-	const exact = await ports.readExactWithOperationCredential({
-		walletId,
-		authorityId: authority.authorityId,
-		authMethodId: authMethod.walletAuthMethodId
-	});
-	switch (exact.kind) {
-		case "found": break;
-		case "missing": return { kind: "missing" };
-		case "upgrade_required": return { kind: "upgrade_required" };
-	}
-	if (!exactWalletSessionMatchesAuthorityScope({
-		record: exact.record,
-		operationCredential: exact.operationCredential,
-		scope: {
-			walletId,
-			authorityId: authority.authorityId,
-			authMethodId: authMethod.walletAuthMethodId,
-			authorityDigestB64u: authority.authorityDigestB64u,
-			authorityRevocationEpoch: authority.revocationEpoch
-		}
-	}) || exact.record.expiresAtMs <= Date.now()) return { kind: "missing" };
-	return {
-		kind: "authenticated",
-		state: {
-			kind: "authenticated",
-			walletId,
-			authMethod: authMethod.kind
-		},
-		walletAuthMethodId: authMethod.walletAuthMethodId
-	};
-}
-function exactWalletSessionWithOperationCredentialOrThrow(result, message) {
-	switch (result.kind) {
-		case "found": return result;
-		case "missing": return null;
-		case "upgrade_required": throw new WalletSessionAuthorizationUpgradeRequiredError(message);
-	}
-}
-//#endregion
-export { exactWalletSessionWithOperationCredentialOrThrow, readExactWalletSessionAuthentication };
-
-//# sourceMappingURL=exactWalletSessionReader.js.map

package/dist/esm/core/signingEngine/session/identity/ownerLaneScope.js

@@ -1,185 +0,0 @@
-import { toRpId } from "./evmFamilyEcdsaIdentity.js";
-import { parseSignerSlot } from "../../../../shared-ts/src/utils/signerSlot.js";
-import { parseEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-//#region src/core/signingEngine/session/identity/ownerLaneScope.ts
-var OwnerLaneScopeIntegrityError = class extends Error {
-	constructor(message) {
-		super(`[OwnerLaneScope] ${message}`);
-		this.name = "OwnerLaneScopeIntegrityError";
-	}
-};
-/**
-* The active authority names a credential this device holds no active
-* canonical wallet auth method for: a pre-Phase-8 enrollment (or a device
-* whose canonical state was removed). It cannot act as a human owner until it
-* links again. Distinct from OwnerLaneScopeIntegrityError so request
-* boundaries and the UI can surface "link this device again" instead of a
-* generic integrity failure.
-*/
-var OwnerRelinkRequiredError = class extends Error {
-	constructor(walletAuthMethodId) {
-		super(`[OwnerLaneScope] relink_required: no active canonical wallet auth method (${walletAuthMethodId})`);
-		this.code = "relink_required";
-		this.reason = "missing_canonical_owner_binding";
-		this.name = "OwnerRelinkRequiredError";
-	}
-};
-function isOwnerRelinkRequiredError(error) {
-	return error instanceof OwnerRelinkRequiredError && error.name === "OwnerRelinkRequiredError" && error.code === "relink_required";
-}
-function passkeyWalletAuthAuthorityFromV2Record(record) {
-	return {
-		walletId: record.walletId,
-		factor: {
-			kind: "passkey",
-			credentialIdB64u: record.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: record.rpId
-		},
-		bindingId: record.walletAuthMethodId
-	};
-}
-/**
-* The exact Email OTP authority for an installation that holds no local factor
-* record — a linked device, whose factor record belongs to registration. The
-* V2 record carries every field but the provider identity, which the caller
-* supplies from this installation's verified lanes.
-*/
-function emailOtpWalletAuthAuthorityFromProviderSubject(args) {
-	const providerUserId = String(args.providerSubjectId || "").trim();
-	if (!providerUserId) throw new OwnerLaneScopeIntegrityError("active Email OTP method has no exact local factor");
-	const authority = parseEmailOtpWalletAuthAuthority({
-		walletId: args.authMethod.walletId,
-		factor: {
-			kind: "email_otp",
-			provider: providerUserId.startsWith("google:") ? "google" : "email",
-			providerUserId
-		},
-		verifier: {
-			kind: "email_otp_wallet_auth_method",
-			emailHashHex: args.authMethod.emailHashHex
-		},
-		bindingId: args.authMethod.walletAuthMethodId
-	});
-	if (!authority) throw new OwnerLaneScopeIntegrityError("active Email OTP method has no exact local factor");
-	return authority;
-}
-function emailOtpWalletAuthAuthorityFromLocalFactor(args) {
-	const matches = args.localMethods.filter((record) => record.kind === "email_otp" && record.status === "active" && record.walletId === args.authMethod.walletId && record.emailHashHex === args.authMethod.emailHashHex);
-	const localMethod = matches[0];
-	const authority = localMethod ? parseEmailOtpWalletAuthAuthority(localMethod.authority) : null;
-	if (matches.length !== 1 || !authority || authority.walletId !== args.authMethod.walletId || authority.bindingId !== args.authMethod.walletAuthMethodId || authority.verifier.emailHashHex !== args.authMethod.emailHashHex) throw new OwnerLaneScopeIntegrityError("active Email OTP method has no exact local factor");
-	return authority;
-}
-/**
-* Registration's local factor record first, because it is the authoritative
-* one where it exists; a linked installation falls back to the provider
-* subject its own lanes carry.
-*/
-async function resolveEmailOtpWalletAuthAuthority(args) {
-	const walletId = String(args.authMethod.walletId);
-	try {
-		return emailOtpWalletAuthAuthorityFromLocalFactor({
-			authMethod: args.authMethod,
-			localMethods: await args.stores.listWalletAuthMethodsForWallet(walletId)
-		});
-	} catch (error) {
-		if (!args.stores.readEmailOtpProviderSubjectForWallet) throw error;
-		const providerSubjectId = await args.stores.readEmailOtpProviderSubjectForWallet(walletId);
-		if (!providerSubjectId) throw error;
-		return emailOtpWalletAuthAuthorityFromProviderSubject({
-			authMethod: args.authMethod,
-			providerSubjectId
-		});
-	}
-}
-function assertExactFactorAuthorityBinding(args) {
-	if (args.authority.walletId !== args.authMethod.walletId || args.authority.bindingId !== args.authMethod.walletAuthMethodId) throw new OwnerLaneScopeIntegrityError("active wallet auth method does not have an exact factor authority binding");
-	return args.authority;
-}
-async function resolveExactWalletAuthAuthority(args) {
-	if (args.authMethod.kind === "passkey") return assertExactFactorAuthorityBinding({
-		authMethod: args.authMethod,
-		authority: passkeyWalletAuthAuthorityFromV2Record(args.authMethod)
-	});
-	return assertExactFactorAuthorityBinding({
-		authMethod: args.authMethod,
-		authority: await resolveEmailOtpWalletAuthAuthority({
-			authMethod: args.authMethod,
-			stores: args.stores
-		})
-	});
-}
-function buildExactPasskeyOwnerLaneScope(args) {
-	return {
-		auth: {
-			kind: "passkey",
-			rpId: toRpId(args.authMethod.rpId),
-			credentialIdB64u: args.authMethod.credentialIdB64u
-		},
-		signerSlot: args.signerSlot
-	};
-}
-function buildExactEcdsaPasskeyOwnerLaneScope(args) {
-	return {
-		auth: {
-			kind: "passkey",
-			rpId: toRpId(args.authMethod.rpId),
-			credentialIdB64u: args.authMethod.credentialIdB64u
-		},
-		keyFamily: "ecdsa"
-	};
-}
-function buildExactLinkedEmailOtpOwnerLaneScope(args) {
-	if (args.factorAuthority.walletId !== args.authMethod.walletId || args.factorAuthority.bindingId !== args.authMethod.walletAuthMethodId || args.factorAuthority.verifier.emailHashHex !== args.authMethod.emailHashHex || args.authorityRef.walletId !== args.authMethod.walletId || args.authorityRef.walletAuthMethodId !== args.authMethod.walletAuthMethodId) throw new OwnerLaneScopeIntegrityError("linked Email OTP authority does not match the selected V2 method");
-	return {
-		auth: {
-			kind: "email_otp",
-			providerSubjectId: String(args.factorAuthority.factor.providerUserId)
-		},
-		ownerAuthority: {
-			walletAuthMethodId: args.authorityRef.walletAuthMethodId,
-			authorityDigest: args.authorityRef.authorityDigest
-		}
-	};
-}
-async function passkeyOwnerLaneScope(args) {
-	const authenticator = await args.stores.getWalletPasskeyAuthenticator({
-		walletId: String(args.authMethod.walletId),
-		credentialId: args.authMethod.credentialIdB64u
-	});
-	if (!authenticator || authenticator.credentialId !== args.authMethod.credentialIdB64u) throw new OwnerLaneScopeIntegrityError("active Passkey auth method has no exact local authenticator");
-	const signerSlot = parseSignerSlot(authenticator.signerSlot, { min: 1 });
-	if (signerSlot === null) throw new OwnerLaneScopeIntegrityError("local authenticator signer slot is invalid");
-	return buildExactPasskeyOwnerLaneScope({
-		authMethod: args.authMethod,
-		signerSlot
-	});
-}
-async function resolveExactOwnerLaneScope(args) {
-	if (args.authMethod.kind === "passkey") return await passkeyOwnerLaneScope({
-		authMethod: args.authMethod,
-		stores: args.stores
-	});
-	const authority = await resolveEmailOtpWalletAuthAuthority({
-		authMethod: args.authMethod,
-		stores: args.stores
-	});
-	const authorityRef = await walletAuthAuthorityRef({ authority });
-	return {
-		auth: {
-			kind: "email_otp",
-			providerSubjectId: String(authority.factor.providerUserId)
-		},
-		ownerAuthority: {
-			walletAuthMethodId: authorityRef.walletAuthMethodId,
-			authorityDigest: authorityRef.authorityDigest
-		}
-	};
-}
-//#endregion
-export { buildExactEcdsaPasskeyOwnerLaneScope, buildExactLinkedEmailOtpOwnerLaneScope, buildExactPasskeyOwnerLaneScope, isOwnerRelinkRequiredError, resolveExactOwnerLaneScope, resolveExactWalletAuthAuthority };
-
-//# sourceMappingURL=ownerLaneScope.js.map