@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/signingEngine/session/lanes/walletExecutionLaneHydration.js

@@ -1,194 +0,0 @@
-import { mpcMaterialActivationRefsEqual, parseLaneShareEpoch } from "../../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import { resolveNearEd25519YaoCapabilityHydrationV1 } from "../material/nearEd25519YaoMaterialActivation.js";
-import { resolveEcdsaCapabilityHydration } from "../material/ecdsaCapabilityHydration.js";
-import { parseSigningLaneRecord, parseWalletKeyRecord } from "../../../../shared-ts/src/signing-lanes/recordParsers.js";
-//#region src/core/signingEngine/session/lanes/walletExecutionLaneHydration.ts
-function parseLaneEpoch(raw) {
-	const parsed = parseLaneShareEpoch(raw);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-/**
-* Parse only the durable boundary records here. Curve-specific material is
-* already parsed by its capability/Yao adapter and is consumed as an exact
-* typed projection below.
-*/
-function parseWalletExecutionLaneRecords(input) {
-	return {
-		walletKey: parseWalletKeyRecord(input.walletKey),
-		lane: parseSigningLaneRecord(input.lane)
-	};
-}
-function refusal(reason, records) {
-	return {
-		kind: "wallet_execution_lane_refused_v1",
-		reason,
-		walletId: records.walletKey.walletId,
-		walletKeyId: records.walletKey.walletKeyId,
-		laneId: records.lane.laneId
-	};
-}
-function invalidBoundaryRefusal() {
-	return {
-		kind: "wallet_execution_lane_refused_v1",
-		reason: "invalid_boundary_record"
-	};
-}
-function activeLaneReference(args) {
-	if (args.lane.lifecycle.state !== "active") throw new Error("active lane reference requires an active lane");
-	return {
-		kind: "signing_lane_reference_v1",
-		walletId: args.lane.walletId,
-		walletKeyId: args.lane.walletKeyId,
-		laneId: args.lane.laneId,
-		laneKind: args.lane.laneKind,
-		laneShareEpoch: args.lane.laneShareEpoch,
-		participantBindingDigestB64u: args.lane.participantBindingDigestB64u,
-		lifecycle: args.lane.lifecycle,
-		materialActivation: args.materialActivation
-	};
-}
-function ownerParticipantContinuityForLane(lane) {
-	switch (lane.laneKind) {
-		case "owner_passkey":
-		case "owner_email_otp":
-		case "recovery":
-		case "break_glass": return lane.ownerParticipantContinuity;
-		case "linked_device":
-		case "delegated_execution": return null;
-	}
-}
-function participantIdsMatch(ownerParticipantContinuity, materialParticipantIds) {
-	return materialParticipantIds.length === ownerParticipantContinuity.participantIds.length && materialParticipantIds.every((participantId, index) => participantId === ownerParticipantContinuity.participantIds[index]);
-}
-function commonRefusal(records, material) {
-	const { walletKey, lane } = records;
-	if (walletKey.lifecycle.state !== "active") return refusal("wallet_key_inactive", records);
-	if (lane.lifecycle.state !== "active") return refusal("lane_inactive", records);
-	if (String(walletKey.walletId) !== String(lane.walletId) || String(walletKey.walletKeyId) !== String(lane.walletKeyId)) return refusal("wallet_key_mismatch", records);
-	if (walletKey.keyFamily !== material.keyFamily) return refusal("key_family_mismatch", records);
-	if (lane.laneKind === "linked_device" || lane.laneKind === "delegated_execution") return refusal("unsupported_lane_kind", records);
-	const ownerParticipantContinuity = ownerParticipantContinuityForLane(lane);
-	if (ownerParticipantContinuity === null) return invalidBoundaryRefusal();
-	let materialEpoch;
-	try {
-		materialEpoch = parseLaneEpoch(material.laneShareEpoch);
-	} catch {
-		return invalidBoundaryRefusal();
-	}
-	if (String(materialEpoch) !== String(lane.laneShareEpoch)) return refusal("share_epoch_mismatch", records);
-	if (!String(lane.participantBindingDigestB64u) || !String(ownerParticipantContinuity.signerId) || !String(ownerParticipantContinuity.signingWorkerId) || ownerParticipantContinuity.participantIds.length !== 2) return refusal("participant_binding_mismatch", records);
-	return null;
-}
-function isActiveHydrationPlan(plan) {
-	return plan.kind === "use_live_runtime" || plan.kind === "rehydrate_material_activation";
-}
-function hydrateEd25519(records, material) {
-	const common = commonRefusal(records, material);
-	if (common) return common;
-	const walletKey = records.walletKey;
-	const lane = records.lane;
-	const ownerParticipantContinuity = ownerParticipantContinuityForLane(lane);
-	if (walletKey.keyFamily !== "ed25519" || lane.lifecycle.state !== "active") return refusal("key_family_mismatch", records);
-	if (ownerParticipantContinuity === null) return invalidBoundaryRefusal();
-	const plan = resolveNearEd25519YaoCapabilityHydrationV1(material.hydration);
-	if (!isActiveHydrationPlan(plan)) return refusal("hydration_blocked", records);
-	if (!mpcMaterialActivationRefsEqual(plan.materialActivation, material.metadata.materialActivation)) return refusal("material_activation_mismatch", records);
-	const application = material.metadata.applicationBinding;
-	const publicLocator = material.hydration.publicLocator;
-	if (publicLocator.kind !== "available" || String(publicLocator.walletId) !== String(walletKey.walletId) || publicLocator.signerSlot !== application.key_creation_signer_slot || !mpcMaterialActivationRefsEqual(publicLocator.materialActivation, material.metadata.materialActivation) || String(plan.authority.walletId) !== String(walletKey.walletId) || String(application.wallet_id) !== String(walletKey.walletId) || String(material.metadata.scope.account_id) !== String(application.wallet_id) || String(material.metadata.scope.signing_worker_id) !== String(plan.materialActivation.signingWorker) || String(application.near_ed25519_signing_key_id) !== String(walletKey.nearEd25519SigningKeyId) || application.key_creation_signer_slot !== walletKey.keyCreationSignerSlot || base64UrlEncode(material.metadata.registeredPublicKey) !== String(walletKey.registeredPublicKeyB64u)) return refusal("public_identity_mismatch", records);
-	if (String(ownerParticipantContinuity.signingWorkerId) !== String(plan.materialActivation.signingWorker) || !participantIdsMatch(ownerParticipantContinuity, material.metadata.participantIds)) return refusal("participant_binding_mismatch", records);
-	if (material.metadata.participantIds.length !== 2 || material.metadata.participantIds[0] === material.metadata.participantIds[1] || material.metadata.participantIds.some((participantId) => !Number.isSafeInteger(participantId) || participantId < 1)) return refusal("participant_binding_mismatch", records);
-	const materialActivation = plan.materialActivation;
-	return {
-		kind: "active_wallet_execution_lane_v1",
-		keyFamily: "ed25519",
-		walletKey,
-		lane: activeLaneReference({
-			lane,
-			materialActivation
-		}),
-		ownerParticipantContinuity,
-		materialActivation,
-		laneShareEpoch: lane.laneShareEpoch,
-		activationReceiptDigestB64u: lane.lifecycle.activationReceiptDigestB64u,
-		publicIdentity: {
-			keyFamily: "ed25519",
-			registeredPublicKeyB64u: walletKey.registeredPublicKeyB64u,
-			nearEd25519SigningKeyId: walletKey.nearEd25519SigningKeyId,
-			keyCreationSignerSlot: walletKey.keyCreationSignerSlot
-		}
-	};
-}
-function hydrateEcdsa(records, material) {
-	const common = commonRefusal(records, material);
-	if (common) return common;
-	const walletKey = records.walletKey;
-	const lane = records.lane;
-	const ownerParticipantContinuity = ownerParticipantContinuityForLane(lane);
-	if (walletKey.keyFamily !== "ecdsa_secp256k1" || lane.lifecycle.state !== "active") return refusal("key_family_mismatch", records);
-	if (ownerParticipantContinuity === null) return invalidBoundaryRefusal();
-	const plan = resolveEcdsaCapabilityHydration({
-		lookup: material.lookup,
-		runtime: material.runtime
-	});
-	if (!isActiveHydrationPlan(plan) || material.lookup.kind !== "active") return refusal("hydration_blocked", records);
-	const manifest = material.lookup.manifest;
-	const binding = manifest.durableMaterial;
-	const facts = binding.roleLocalPublicFacts;
-	const registered = manifest.signer.registeredPublicFacts;
-	const receipt = manifest.activation.serverActivation.serverActivationReceipt;
-	const protocolIdentity = receipt.protocolReceipt.ecdsa_activation.public_identity;
-	const expectedSlot = deriveEvmFamilySigningKeySlotId({
-		walletId: facts.walletId,
-		signingRootId: facts.signingRootId,
-		signingRootVersion: facts.signingRootVersion
-	});
-	if (!mpcMaterialActivationRefsEqual(plan.materialActivation, manifest.activation.materialActivation) || !mpcMaterialActivationRefsEqual(plan.materialActivation, binding.materialActivation) || String(plan.authority.walletId) !== String(walletKey.walletId) || String(manifest.signer.walletId) !== String(walletKey.walletId) || String(facts.walletId) !== String(walletKey.walletId) || String(walletKey.evmFamilySigningKeySlotId) !== String(expectedSlot) || String(walletKey.thresholdPublicKey33B64u) !== String(facts.groupPublicKey33B64u) || String(walletKey.thresholdPublicKey33B64u) !== String(registered.publicKeyB64u) || walletKey.evmAddress.toLowerCase() !== String(facts.ethereumAddress).toLowerCase() || walletKey.evmAddress.toLowerCase() !== String(registered.thresholdOwnerAddress).toLowerCase() || String(protocolIdentity.context_binding_b64u) !== String(binding.bindingDigest) || String(protocolIdentity.derivation_client_share_public_key33_b64u) !== String(facts.derivationClientSharePublicKey33B64u) || String(protocolIdentity.threshold_public_key33_b64u) !== String(walletKey.thresholdPublicKey33B64u) || String(receipt.activationDigest) !== String(lane.lifecycle.activationReceiptDigestB64u)) return refusal("activation_receipt_mismatch", records);
-	if (String(ownerParticipantContinuity.signingWorkerId) !== String(plan.materialActivation.signingWorker) || !participantIdsMatch(ownerParticipantContinuity, facts.participantIds)) return refusal("participant_binding_mismatch", records);
-	const materialActivation = plan.materialActivation;
-	return {
-		kind: "active_wallet_execution_lane_v1",
-		keyFamily: "ecdsa_secp256k1",
-		walletKey,
-		lane: activeLaneReference({
-			lane,
-			materialActivation
-		}),
-		ownerParticipantContinuity,
-		materialActivation,
-		laneShareEpoch: lane.laneShareEpoch,
-		activationReceiptDigestB64u: lane.lifecycle.activationReceiptDigestB64u,
-		publicIdentity: {
-			keyFamily: "ecdsa_secp256k1",
-			thresholdPublicKey33B64u: walletKey.thresholdPublicKey33B64u,
-			evmAddress: walletKey.evmAddress,
-			evmFamilySigningKeySlotId: walletKey.evmFamilySigningKeySlotId
-		}
-	};
-}
-function hydrateWalletExecutionLane(input) {
-	let records;
-	try {
-		records = parseWalletExecutionLaneRecords(input);
-	} catch {
-		return invalidBoundaryRefusal();
-	}
-	try {
-		switch (input.material.keyFamily) {
-			case "ed25519": return hydrateEd25519(records, input.material);
-			case "ecdsa_secp256k1": return hydrateEcdsa(records, input.material);
-			default:
-				input.material;
-				return invalidBoundaryRefusal();
-		}
-	} catch {
-		return invalidBoundaryRefusal();
-	}
-}
-//#endregion
-export { hydrateWalletExecutionLane };
-
-//# sourceMappingURL=walletExecutionLaneHydration.js.map

package/dist/esm/core/signingEngine/session/lifecycle/canonicalWalletSessionStatus.js

@@ -1,32 +0,0 @@
-import { createRelayerExactWalletSessionStatusPort } from "../../../rpcClients/relayer/walletSessionAuthorizationStatus.js";
-import { signingSessionStatusFromWalletSessionStatus } from "./walletSessionStatus.js";
-//#region src/core/signingEngine/session/lifecycle/canonicalWalletSessionStatus.ts
-function createCanonicalWalletSessionStatusReader(deps) {
-	return async (args) => {
-		const identity = args.authorization;
-		const authorization = await deps.readAuthorization(args.owner.walletId);
-		switch (authorization.kind) {
-			case "missing":
-			case "corrupt":
-			case "persistence_unavailable":
-			case "upgrade_required": return null;
-			case "found": break;
-			default: return authorization;
-		}
-		if (!walletSessionStatusIdentityMatchesExactAuthorization(identity, args.owner.walletId, authorization)) return null;
-		const relayerUrl = String(deps.relayerUrl || "").trim();
-		if (!relayerUrl) return null;
-		const status = await createRelayerExactWalletSessionStatusPort({
-			relayerUrl,
-			operationCredential: authorization.operationCredential
-		}).read(identity).catch(() => null);
-		return status ? signingSessionStatusFromWalletSessionStatus(status) : null;
-	};
-}
-function walletSessionStatusIdentityMatchesExactAuthorization(identity, walletId, authorization) {
-	return authorization.record.walletId === walletId && authorization.record.quotaId === identity.quotaId && authorization.operationCredential.walletSessionId === identity.walletSessionId;
-}
-//#endregion
-export { createCanonicalWalletSessionStatusReader };
-
-//# sourceMappingURL=canonicalWalletSessionStatus.js.map

package/dist/esm/core/signingEngine/session/lifecycle/walletSessionStatus.js

@@ -1,123 +0,0 @@
-import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-//#region src/core/signingEngine/session/lifecycle/walletSessionStatus.ts
-function normalizeSessionStatusRequired(value, label) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`[WalletSessionStatus] ${label} is required`);
-	return normalized;
-}
-function parseWalletSessionStatusIdentity(value) {
-	const walletSessionId = parseWalletSessionId(value.walletSessionId);
-	const quotaId = parseMpcWalletSigningQuotaId(value.quotaId);
-	if (!walletSessionId.ok || !quotaId.ok) return null;
-	return {
-		walletSessionId: walletSessionId.value,
-		quotaId: quotaId.value
-	};
-}
-function buildWalletSessionStatusCheck(args) {
-	const authorization = parseWalletSessionStatusIdentity(args.authorization);
-	if (!authorization) throw new Error("[WalletSessionStatus] canonical Wallet Session identity is invalid");
-	return {
-		kind: "wallet_session_status_check",
-		owner: args.owner,
-		authorization
-	};
-}
-function ed25519WalletSessionStatusOwner(walletId) {
-	return {
-		curve: "ed25519",
-		walletId: toWalletId(walletId)
-	};
-}
-function walletSessionStatusOwnerForLane(lane) {
-	return ed25519WalletSessionStatusOwner(lane.identity.signer.account.wallet.walletId);
-}
-function walletSessionStatusOwnerId(owner) {
-	return owner.walletId;
-}
-function walletSessionStatusOwnerKey(owner) {
-	return `${owner.curve}:${walletSessionStatusOwnerId(owner)}`;
-}
-function walletSessionStatusIdentityKey(identity) {
-	return `${identity.walletSessionId}:${identity.quotaId}`;
-}
-function signingSessionStatusFromWalletSessionStatus(status) {
-	const sessionId = String(status.walletSessionId);
-	switch (status.status) {
-		case "active": return {
-			sessionId,
-			status: "active",
-			remainingUses: status.remainingUses,
-			expiresAtMs: status.expiresAtMs
-		};
-		case "exhausted": return {
-			sessionId,
-			status: "exhausted",
-			remainingUses: 0,
-			expiresAtMs: status.expiresAtMs
-		};
-		case "expired": return {
-			sessionId,
-			status: "expired",
-			expiresAtMs: status.expiresAtMs
-		};
-		case "missing":
-		case "superseded": return {
-			sessionId,
-			status: "not_found",
-			statusCode: status.status
-		};
-		case "authority_unavailable":
-		case "method_unavailable":
-		case "capability_unavailable": return {
-			sessionId,
-			status: "unavailable",
-			statusCode: status.status,
-			expiresAtMs: status.expiresAtMs
-		};
-		case "invalid": return {
-			sessionId,
-			status: "status_unknown",
-			statusCode: "invalid_wallet_session_status"
-		};
-		default: throw new Error("[WalletSessionStatus] unsupported canonical status");
-	}
-}
-function unknownSigningSessionStatus(args) {
-	return {
-		sessionId: String(args.walletSessionId),
-		status: "status_unknown",
-		statusCode: args.reason
-	};
-}
-async function getWalletSessionStatus(deps, args) {
-	return await deps.getAvailableStatus(args).catch(() => null);
-}
-function mergeWalletSigningSessionStatus(status, sessionStatus) {
-	if (!sessionStatus) return status;
-	if (sessionStatus.status === "status_unknown") return status;
-	if (sessionStatus.status !== "active") return {
-		...status,
-		...sessionStatus,
-		sessionId: status.sessionId
-	};
-	const sessionRemainingUses = Math.max(0, Math.floor(Number(sessionStatus.remainingUses) || 0));
-	const statusExpiresAtMs = Math.floor(Number(status.expiresAtMs) || 0);
-	const sessionExpiresAtMs = Math.floor(Number(sessionStatus.expiresAtMs) || 0);
-	return {
-		...status,
-		status: "active",
-		remainingUses: sessionRemainingUses,
-		expiresAtMs: statusExpiresAtMs > 0 && sessionExpiresAtMs > 0 ? Math.min(statusExpiresAtMs, sessionExpiresAtMs) : statusExpiresAtMs || sessionExpiresAtMs,
-		...sessionStatus.authMethod ? { authMethod: sessionStatus.authMethod } : {},
-		...sessionStatus.retention ? { retention: sessionStatus.retention } : {}
-	};
-}
-function buildWalletSessionStatusCheckForSession(args) {
-	return buildWalletSessionStatusCheck(args);
-}
-//#endregion
-export { buildWalletSessionStatusCheck, buildWalletSessionStatusCheckForSession, ed25519WalletSessionStatusOwner, getWalletSessionStatus, mergeWalletSigningSessionStatus, normalizeSessionStatusRequired, signingSessionStatusFromWalletSessionStatus, unknownSigningSessionStatus, walletSessionStatusIdentityKey, walletSessionStatusOwnerForLane, walletSessionStatusOwnerKey };
-
-//# sourceMappingURL=walletSessionStatus.js.map

package/dist/esm/core/signingEngine/session/material/ecdsaCapabilityHydration.js

@@ -1,75 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { buildBlockedMpcCapabilityHydrationPlan, buildRehydrateMaterialActivationHydrationPlan, buildUseLiveRuntimeHydrationPlan } from "./mpcCapabilityHydration.js";
-import { buildRestorableMpcMaterialRefInternal } from "./restorableMpcMaterialRef.internal.js";
-//#region src/core/signingEngine/session/material/ecdsaCapabilityHydration.ts
-function buildRestorableMpcMaterialRefForHydration(durableMaterialRef) {
-	return buildRestorableMpcMaterialRefInternal(durableMaterialRef);
-}
-function blockedLookupCapability(lookup) {
-	return "selector" in lookup ? lookup.selector.capability : lookup.capability;
-}
-function blockedPlanFromLookup(lookup) {
-	switch (lookup.kind) {
-		case "retired": return buildBlockedMpcCapabilityHydrationPlan({
-			capability: lookup.manifest.signer.capability,
-			reason: "replaced"
-		});
-		case "missing": return lookup.subject === "capability" ? buildBlockedMpcCapabilityHydrationPlan({
-			capability: null,
-			reason: "missing_capability"
-		}) : buildBlockedMpcCapabilityHydrationPlan({
-			capability: blockedLookupCapability(lookup),
-			reason: "missing_material"
-		});
-		case "exact_binding_mismatch": return buildBlockedMpcCapabilityHydrationPlan({
-			capability: blockedLookupCapability(lookup),
-			reason: "binding_mismatch"
-		});
-		case "exact_record_conflict": return buildBlockedMpcCapabilityHydrationPlan({
-			capability: blockedLookupCapability(lookup),
-			reason: "exact_record_conflict"
-		});
-		case "corrupt": return buildBlockedMpcCapabilityHydrationPlan({
-			capability: blockedLookupCapability(lookup),
-			reason: "corrupt"
-		});
-		case "persistence_unavailable": return buildBlockedMpcCapabilityHydrationPlan({
-			capability: blockedLookupCapability(lookup),
-			reason: "persistence_unavailable"
-		});
-	}
-}
-function activePlanFromLookup(input) {
-	const materialActivation = input.lookup.manifest.activation.materialActivation;
-	if (!mpcMaterialActivationRefsEqual(materialActivation, input.lookup.material.binding.materialActivation) || input.lookup.manifest.signer.materialOwner !== materialActivation.materialOwner) return buildBlockedMpcCapabilityHydrationPlan({
-		capability: input.lookup.manifest.signer.capability,
-		reason: "binding_mismatch"
-	});
-	switch (input.runtime.kind) {
-		case "live":
-			if (!mpcMaterialActivationRefsEqual(materialActivation, input.runtime.materialActivation)) return buildBlockedMpcCapabilityHydrationPlan({
-				capability: input.lookup.manifest.signer.capability,
-				reason: "binding_mismatch"
-			});
-			return buildUseLiveRuntimeHydrationPlan({
-				authority: input.lookup.manifest.signer.authority,
-				runtime: input.runtime.runtime,
-				materialActivation
-			});
-		case "absent": return buildRehydrateMaterialActivationHydrationPlan({
-			authority: input.lookup.manifest.signer.authority,
-			materialActivation,
-			sealedMaterial: buildRestorableMpcMaterialRefInternal(input.lookup.material.binding.durableMaterialRef)
-		});
-	}
-}
-function resolveEcdsaCapabilityHydration(input) {
-	return input.lookup.kind === "active" ? activePlanFromLookup({
-		lookup: input.lookup,
-		runtime: input.runtime
-	}) : blockedPlanFromLookup(input.lookup);
-}
-//#endregion
-export { buildRestorableMpcMaterialRefForHydration, resolveEcdsaCapabilityHydration };
-
-//# sourceMappingURL=ecdsaCapabilityHydration.js.map

package/dist/esm/core/signingEngine/session/material/ecdsaSealedRuntime.js

@@ -1,197 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
-import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseEcdsaRoleLocalPersistedMaterialRef } from "../keyMaterialBrands.js";
-import { sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { routerAbEcdsaDerivationPublicCapabilitiesEqual } from "./ecdsaCapabilityManifest.js";
-//#region src/core/signingEngine/session/material/ecdsaSealedRuntime.ts
-function blocked(reason) {
-	return {
-		kind: "blocked",
-		reason
-	};
-}
-function authMethodForEcdsaSealedSource(source) {
-	switch (source) {
-		case "email_otp": return "email_otp";
-		case "login":
-		case "registration":
-		case "manual-bootstrap": return "passkey";
-		default: throw new Error("[SigningEngine] unsupported sealed ECDSA source");
-	}
-}
-function normalizedNonEmpty(value) {
-	return String(value ?? "").trim();
-}
-/** Exact match on stable material identity. Rotating session and grant
-* identifiers deliberately take no part: they change under a reusable Wallet
-* Session without changing which material this record describes. */
-function sealedRecordNamesManifestMaterial(args) {
-	const restore = args.record.ecdsaRestore;
-	const durable = args.manifest.durableMaterial;
-	if (normalizedNonEmpty(args.record.walletId) !== String(args.walletId)) return false;
-	if (!thresholdEcdsaChainTargetsEqual(restore.chainTarget, args.chainTarget)) return false;
-	if (!mpcMaterialActivationRefsEqual(restore.roleLocalMaterialRef.materialActivation, durable.materialActivation)) return false;
-	if (!mpcMaterialActivationRefsEqual(durable.materialActivation, args.manifest.activation.materialActivation)) return false;
-	return normalizedNonEmpty(restore.roleLocalMaterialRef.durableMaterialRef) === normalizedNonEmpty(durable.durableMaterialRef);
-}
-function participantIdsEqual(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-function authorityRefsEqual(left, right) {
-	return left.kind === right.kind && String(left.walletId) === String(right.walletId) && String(left.authorityDigest) === String(right.authorityDigest);
-}
-function manifestIncludesTarget(args) {
-	return args.manifest.signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, args.chainTarget));
-}
-function sealedRecordBindsManifestFacts(args) {
-	const restore = args.record.ecdsaRestore;
-	const durable = args.manifest.durableMaterial;
-	const binding = durable.roleLocalBinding;
-	const publicFacts = durable.roleLocalPublicFacts;
-	const normalScope = restore.routerAbEcdsaDerivationNormalSigning.scope;
-	const expectedAuthMethod = authMethodForEcdsaSealedSource(restore.source);
-	const resolvedThresholdKeyId = normalizedNonEmpty(restore.ecdsaThresholdKeyId) || normalizedNonEmpty(normalScope.ecdsa_threshold_key_id);
-	const resolvedClientVerifyingShare = "recordKind" in args.record ? normalizedNonEmpty(binding.clientVerifyingPublicKey33B64u) : normalizedNonEmpty(restore.clientVerifyingShareB64u) || normalizedNonEmpty(normalScope.public_identity.derivation_client_share_public_key33_b64u);
-	const resolvedThresholdPublicKey = normalizedNonEmpty(restore.thresholdEcdsaPublicKeyB64u) || normalizedNonEmpty(normalScope.public_identity.threshold_public_key33_b64u);
-	return String(args.manifest.signer.walletId) === String(args.walletId) && String(publicFacts.walletId) === String(args.walletId) && manifestIncludesTarget(args) && args.record.authMethod === expectedAuthMethod && authorityRefsEqual(restore.authority, args.manifest.signer.authority) && normalizedNonEmpty(restore.roleLocalMaterialRef.bindingDigest) === normalizedNonEmpty(durable.bindingDigest) && normalizedNonEmpty(restore.keyHandle) === normalizedNonEmpty(binding.keyHandle) && normalizedNonEmpty(restore.keyHandle) === normalizedNonEmpty(publicFacts.keyHandle) && resolvedThresholdKeyId === normalizedNonEmpty(binding.ecdsaThresholdKeyId) && resolvedThresholdKeyId === normalizedNonEmpty(publicFacts.ecdsaThresholdKeyId) && resolvedClientVerifyingShare === normalizedNonEmpty(binding.clientVerifyingPublicKey33B64u) && resolvedClientVerifyingShare === normalizedNonEmpty(publicFacts.derivationClientSharePublicKey33B64u) && resolvedThresholdPublicKey === normalizedNonEmpty(publicFacts.groupPublicKey33B64u) && normalizedNonEmpty(restore.relayerKeyId) === normalizedNonEmpty(binding.relayerKeyId) && participantIdsEqual(restore.participantIds, binding.participantIds) && participantIdsEqual(restore.participantIds, publicFacts.participantIds) && normalizedNonEmpty(restore.signingRootId) === normalizedNonEmpty(args.manifest.signer.signingRootId) && normalizedNonEmpty(restore.signingRootId) === normalizedNonEmpty(publicFacts.signingRootId) && normalizedNonEmpty(restore.signingRootVersion) === normalizedNonEmpty(args.manifest.signer.signingRootVersion) && normalizedNonEmpty(restore.signingRootVersion) === normalizedNonEmpty(publicFacts.signingRootVersion) && normalizedNonEmpty(restore.ethereumAddress).toLowerCase() === normalizedNonEmpty(publicFacts.ethereumAddress).toLowerCase() && routerAbEcdsaDerivationPublicCapabilitiesEqual(restore.publicCapability, publicFacts.publicCapability) && sameRouterAbEcdsaDerivationNormalSigningScopeV1(normalScope, {
-		wallet_id: String(args.walletId),
-		ecdsa_threshold_key_id: String(publicFacts.ecdsaThresholdKeyId),
-		signing_root_id: String(publicFacts.signingRootId),
-		signing_root_version: String(publicFacts.signingRootVersion),
-		context: publicFacts.publicCapability.context,
-		public_identity: publicFacts.publicCapability.public_identity,
-		signing_worker: publicFacts.publicCapability.signer_set.selected_server,
-		activation_epoch: publicFacts.publicCapability.activation_epoch,
-		material_activation: routerAbMpcMaterialActivationRefToWire(durable.materialActivation)
-	});
-}
-function authBindingFromRestore(args) {
-	const restore = args.restore;
-	if (restore.source === "email_otp") {
-		const providerSubjectId = normalizedNonEmpty(restore.providerSubjectId);
-		const emailHashHex = normalizedNonEmpty(restore.emailHashHex);
-		const sealedAuthority = restore.emailOtpAuthority;
-		const manifestAuthority = args.manifest.signer.authority;
-		if (!providerSubjectId || !emailHashHex || !sealedAuthority || String(sealedAuthority.walletId) !== String(manifestAuthority.walletId) || String(sealedAuthority.factor.providerUserId) !== providerSubjectId || String(sealedAuthority.verifier.emailHashHex) !== emailHashHex) return null;
-		return {
-			kind: "email_otp",
-			providerSubjectId,
-			emailHashHex,
-			emailOtpAuthority: {
-				walletId: sealedAuthority.walletId,
-				factor: sealedAuthority.factor,
-				verifier: sealedAuthority.verifier,
-				bindingId: manifestAuthority.walletAuthMethodId
-			}
-		};
-	}
-	const rpId = normalizedNonEmpty(restore.rpId);
-	const credentialIdB64u = normalizedNonEmpty(restore.credentialIdB64u);
-	return rpId && credentialIdB64u ? {
-		kind: "passkey",
-		rpId,
-		credentialIdB64u
-	} : null;
-}
-function exactTwoPartyParticipantIds(value) {
-	if (value.length !== 2) return null;
-	const first = value[0];
-	const second = value[1];
-	if (!Number.isSafeInteger(first) || !Number.isSafeInteger(second) || first <= 0 || second <= 0 || first === second) return null;
-	return [first, second];
-}
-function materialRuntimeFromRecord(args) {
-	const restore = args.record.ecdsaRestore;
-	const authBinding = authBindingFromRestore({
-		manifest: args.manifest,
-		restore
-	});
-	const relayerUrl = normalizedNonEmpty(args.record.relayerUrl).replace(/\/+$/g, "");
-	const relayerKeyId = normalizedNonEmpty(restore.relayerKeyId);
-	const clientVerifyingPublicKey33B64u = args.manifest.durableMaterial.roleLocalBinding.clientVerifyingPublicKey33B64u;
-	const ecdsaThresholdKeyId = normalizedNonEmpty(restore.ecdsaThresholdKeyId) || normalizedNonEmpty(restore.routerAbEcdsaDerivationNormalSigning.scope.ecdsa_threshold_key_id);
-	const thresholdEcdsaPublicKeyB64u = normalizedNonEmpty(restore.thresholdEcdsaPublicKeyB64u) || normalizedNonEmpty(restore.routerAbEcdsaDerivationNormalSigning.scope.public_identity.threshold_public_key33_b64u);
-	const keyHandle = normalizedNonEmpty(restore.keyHandle);
-	const participantIds = Array.isArray(restore.participantIds) ? exactTwoPartyParticipantIds(restore.participantIds) : null;
-	let roleLocalMaterialRef;
-	try {
-		roleLocalMaterialRef = parseEcdsaRoleLocalPersistedMaterialRef(restore.roleLocalMaterialRef);
-	} catch {
-		return null;
-	}
-	let runtimePolicyScope = null;
-	try {
-		runtimePolicyScope = normalizeRuntimePolicyScope(restore.runtimePolicyScope);
-	} catch {
-		runtimePolicyScope = null;
-	}
-	if (!authBinding || !relayerUrl || !relayerKeyId || !clientVerifyingPublicKey33B64u || !ecdsaThresholdKeyId || !thresholdEcdsaPublicKeyB64u || !keyHandle || !participantIds) return null;
-	return {
-		walletId: args.walletId,
-		chainTarget: args.chainTarget,
-		materialActivation: restore.roleLocalMaterialRef.materialActivation,
-		normalSigning: restore.routerAbEcdsaDerivationNormalSigning,
-		relayerUrl,
-		relayerKeyId,
-		clientVerifyingPublicKey33B64u,
-		participantIds,
-		ecdsaThresholdKeyId,
-		thresholdEcdsaPublicKeyB64u,
-		keyHandle,
-		runtimePolicyScope,
-		roleLocalMaterialRef,
-		authBinding
-	};
-}
-function runtimeFromSealedRecord(args) {
-	const materialRuntime = materialRuntimeFromRecord(args);
-	const expiresAtMs = Number(args.record.expiresAtMs);
-	const remainingUses = Number(args.record.remainingUses);
-	const thresholdSessionId = normalizedNonEmpty(args.record.thresholdSessionIds.ecdsa);
-	const storeKey = normalizedNonEmpty(args.record.storeKey);
-	if (!materialRuntime || !storeKey || !thresholdSessionId || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0 || !Number.isSafeInteger(remainingUses) || remainingUses < 0) return null;
-	return {
-		...materialRuntime,
-		kind: "exact_ecdsa_sealed_runtime_v1",
-		expiresAtMs,
-		remainingUses,
-		sealedRecord: {
-			storeKey,
-			thresholdSessionId,
-			authMethod: args.record.authMethod
-		}
-	};
-}
-function resolveExactEcdsaSealedRuntime(input) {
-	const matches = input.sealedRecords.filter((record) => sealedRecordNamesManifestMaterial({
-		manifest: input.manifest,
-		walletId: input.walletId,
-		chainTarget: input.chainTarget,
-		record
-	}));
-	if (matches.length === 0) return blocked("missing_material");
-	if (matches.length > 1) return blocked("exact_record_conflict");
-	const runtime = runtimeFromSealedRecord({
-		manifest: input.manifest,
-		walletId: input.walletId,
-		chainTarget: input.chainTarget,
-		record: matches[0]
-	});
-	if (!runtime) return blocked("corrupt");
-	if (!sealedRecordBindsManifestFacts({
-		manifest: input.manifest,
-		walletId: input.walletId,
-		chainTarget: input.chainTarget,
-		record: matches[0]
-	})) return blocked("binding_mismatch");
-	return {
-		kind: "resolved",
-		runtime
-	};
-}
-//#endregion
-export { resolveExactEcdsaSealedRuntime };
-
-//# sourceMappingURL=ecdsaSealedRuntime.js.map