@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/signingEngine/session/material/mpcCapabilityHydration.js

@@ -1,79 +0,0 @@
-//#region src/core/signingEngine/session/material/mpcCapabilityHydration.ts
-var MpcHydrationProof = class {
-	retainProof() {
-		return true;
-	}
-	constructor() {
-		this.retainProof();
-	}
-};
-var MpcUseLiveRuntimeHydrationPlanProof = class extends MpcHydrationProof {
-	constructor(fields) {
-		super();
-		this.kind = "use_live_runtime";
-		this.capability = fields.materialActivation.capability;
-		this.materialOwner = fields.materialActivation.materialOwner;
-		this.authority = fields.authority;
-		this.runtime = fields.runtime;
-		this.materialActivation = fields.materialActivation;
-	}
-};
-var MpcRehydrateMaterialActivationHydrationPlanProof = class extends MpcHydrationProof {
-	constructor(fields) {
-		super();
-		this.kind = "rehydrate_material_activation";
-		this.capability = fields.materialActivation.capability;
-		this.materialOwner = fields.materialActivation.materialOwner;
-		this.authority = fields.authority;
-		this.materialActivation = fields.materialActivation;
-		this.sealedMaterial = fields.sealedMaterial;
-	}
-};
-var MpcReauthorizePublicAnchorHydrationPlanProof = class extends MpcHydrationProof {
-	constructor(fields) {
-		super();
-		this.kind = "reauthorize_public_anchor";
-		this.capability = fields.publicReauthAnchor.capability;
-		this.materialOwner = fields.publicReauthAnchor.materialOwner;
-		this.authority = fields.publicReauthAnchor.authority;
-		this.retirement = fields.retirement;
-		this.publicReauthAnchor = fields.publicReauthAnchor;
-	}
-};
-var MpcBlockedCapabilityHydrationPlanProof = class extends MpcHydrationProof {
-	constructor(..._args) {
-		super(..._args);
-		this.kind = "blocked";
-	}
-};
-var MpcMissingCapabilityHydrationPlanProof = class extends MpcBlockedCapabilityHydrationPlanProof {
-	constructor(..._args2) {
-		super(..._args2);
-		this.capability = null;
-		this.reason = "missing_capability";
-	}
-};
-var MpcKnownCapabilityBlockedHydrationPlanProof = class extends MpcBlockedCapabilityHydrationPlanProof {
-	constructor(fields) {
-		super();
-		this.capability = fields.capability;
-		this.reason = fields.reason;
-	}
-};
-function buildUseLiveRuntimeHydrationPlan(fields) {
-	return new MpcUseLiveRuntimeHydrationPlanProof(fields);
-}
-function buildRehydrateMaterialActivationHydrationPlan(fields) {
-	return new MpcRehydrateMaterialActivationHydrationPlanProof(fields);
-}
-function buildReauthorizePublicAnchorHydrationPlan(fields) {
-	return new MpcReauthorizePublicAnchorHydrationPlanProof(fields);
-}
-function buildBlockedMpcCapabilityHydrationPlan(fields) {
-	if (fields.reason === "missing_capability") return new MpcMissingCapabilityHydrationPlanProof();
-	return new MpcKnownCapabilityBlockedHydrationPlanProof(fields);
-}
-//#endregion
-export { buildBlockedMpcCapabilityHydrationPlan, buildReauthorizePublicAnchorHydrationPlan, buildRehydrateMaterialActivationHydrationPlan, buildUseLiveRuntimeHydrationPlan };
-
-//# sourceMappingURL=mpcCapabilityHydration.js.map

package/dist/esm/core/signingEngine/session/material/nearEd25519YaoSigningPreparation.js

@@ -1,122 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { activeWalletSessionV1RecordsEqual } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-//#region src/core/signingEngine/session/material/nearEd25519YaoSigningPreparation.ts
-function classifyNearEd25519WalletSessionAuthorization(result) {
-	switch (result.kind) {
-		case "found": return {
-			kind: "authorized",
-			authorization: result.authorization
-		};
-		case "expired":
-		case "exhausted": return {
-			kind: "operation_step_up",
-			reason: result.kind
-		};
-		case "persistence_unavailable": return {
-			kind: "temporarily_unavailable",
-			reason: result.kind
-		};
-		case "missing":
-		case "corrupt":
-		case "upgrade_required":
-		case "superseded":
-		case "authority_unavailable":
-		case "method_unavailable":
-		case "capability_unavailable":
-		case "unavailable": return {
-			kind: "full_login_required",
-			reason: result.kind
-		};
-		default: throw new Error("[SigningEngine][near] unsupported Wallet Session authorization state");
-	}
-}
-function hydrationAuthority(hydration) {
-	switch (hydration.kind) {
-		case "use_live_runtime":
-		case "rehydrate_material_activation":
-		case "reauthorize_public_anchor": return hydration.authority;
-		case "blocked": return null;
-		default: throw new Error("[SigningEngine][near] unsupported MPC hydration plan");
-	}
-}
-function selectedAuthorityMatchesAuthMethod(args) {
-	const { selectedAuthority, selectedAuthMethod, selectedFactorAuthority } = args;
-	if (selectedAuthority.state !== "active" || selectedAuthority.walletId !== selectedAuthMethod.walletId || selectedAuthority.authorityId !== selectedAuthMethod.walletAuthorityId || selectedAuthority.signerActivations.ed25519 === void 0 || selectedFactorAuthority.walletId !== selectedAuthMethod.walletId || selectedFactorAuthority.bindingId !== selectedAuthMethod.walletAuthMethodId) return false;
-	if (selectedAuthMethod.kind === "passkey") return selectedFactorAuthority.factor.kind === "passkey" && selectedFactorAuthority.factor.credentialIdB64u === selectedAuthMethod.credentialIdB64u && selectedFactorAuthority.verifier.kind === "webauthn" && selectedFactorAuthority.verifier.rpId === selectedAuthMethod.rpId;
-	return selectedFactorAuthority.factor.kind === "email_otp" && selectedFactorAuthority.verifier.kind === "email_otp_wallet_auth_method" && selectedFactorAuthority.verifier.emailHashHex === selectedAuthMethod.emailHashHex && selectedFactorAuthority.factor.providerUserId.trim().length > 0;
-}
-function exactNearEd25519AuthorizationIdentityMatches(args) {
-	const { authorization, nowMs } = args;
-	const { selectedAuthority, selectedAuthMethod, session, operationCredential, status } = authorization;
-	if (!selectedAuthorityMatchesAuthMethod({
-		selectedAuthority,
-		selectedAuthMethod,
-		selectedFactorAuthority: authorization.selectedFactorAuthority
-	}) || session.kind !== "active_wallet_session_v1" || session.walletId !== selectedAuthority.walletId || session.authorityId !== selectedAuthority.authorityId || session.authMethodId !== selectedAuthMethod.walletAuthMethodId || session.authorityDigestB64u !== selectedAuthority.authorityDigestB64u || session.authorityRevocationEpoch !== selectedAuthority.revocationEpoch || operationCredential.kind !== "opaque_wallet_session_operation_credential_v1" || operationCredential.token.trim().length === 0 || operationCredential.walletSessionId.trim().length === 0 || session.authorizationId.trim().length === 0 || session.quotaId.trim().length === 0 || session.expiresAtMs <= nowMs || status.status !== "active" || status.walletSessionId !== operationCredential.walletSessionId || status.quotaId !== session.quotaId || status.remainingUses <= 0 || status.expiresAtMs <= nowMs || status.quotaLifecycle !== "active" || status.authorization.expiresAtMs !== session.expiresAtMs || !activeWalletSessionV1RecordsEqual(status.authorization, session)) return false;
-	return true;
-}
-/** A V6 session must carry exactly one Ed25519 signing subject for the lane. */
-function nearEd25519SessionMatchesMaterialActivation(args) {
-	let matchCount = 0;
-	for (const subject of args.session.capabilitySubjects) if (subject.kind === "sign" && subject.keyFamily === "ed25519" && mpcMaterialActivationRefsEqual(subject.materialActivation, args.materialActivation)) matchCount += 1;
-	return matchCount === 1;
-}
-async function assertAuthorizationMatchesHydration(args) {
-	const authority = hydrationAuthority(args.hydration);
-	if (!authority) return;
-	const selectedFactorAuthority = await walletAuthAuthorityRef({ authority: args.authorization.selectedFactorAuthority });
-	if (authority.walletId !== selectedFactorAuthority.walletId || authority.walletAuthMethodId !== selectedFactorAuthority.walletAuthMethodId || authority.authorityDigest !== selectedFactorAuthority.authorityDigest) throw new Error("[SigningEngine][near] Wallet Session authorization does not match material authority");
-}
-function assertAuthorizationMatchesRequirement(args) {
-	const { requirement, authorization } = args;
-	if (requirement.kind !== authorization.selectedAuthMethod.kind) throw new Error("[SigningEngine][near] Wallet Session authorization does not match material factor");
-	if (requirement.kind === "passkey") {
-		if (authorization.selectedAuthMethod.kind !== "passkey" || String(requirement.rpId) !== String(authorization.selectedAuthMethod.rpId) || requirement.credentialIdB64u !== authorization.selectedAuthMethod.credentialIdB64u) throw new Error("[SigningEngine][near] Wallet Session authorization does not match Passkey factor");
-		return;
-	}
-	if (authorization.selectedAuthMethod.kind !== "email_otp" || authorization.selectedFactorAuthority.factor.kind !== "email_otp" || requirement.providerSubjectId !== authorization.selectedFactorAuthority.factor.providerUserId) throw new Error("[SigningEngine][near] Wallet Session authorization does not match Email OTP factor");
-}
-function buildActiveNearEd25519WalletSessionAuthorization(args) {
-	if (!Number.isSafeInteger(args.nowMs) || args.nowMs < 0) throw new Error("[SigningEngine][near] Wallet Session authorization requires a valid timestamp");
-	const authorization = {
-		kind: "exact_near_ed25519_wallet_session_authorization_v1",
-		selectedAuthority: args.selectedAuthority,
-		selectedAuthMethod: args.selectedAuthMethod,
-		selectedFactorAuthority: args.selectedFactorAuthority,
-		session: args.session,
-		operationCredential: args.operationCredential,
-		status: args.status
-	};
-	if (!exactNearEd25519AuthorizationIdentityMatches({
-		authorization,
-		nowMs: args.nowMs
-	})) throw new Error("[SigningEngine][near] Exact Wallet Session authorization identity is invalid");
-	return authorization;
-}
-async function buildAuthorizedNearEd25519YaoSigningPreparation(args) {
-	assertAuthorizationMatchesRequirement(args);
-	await assertAuthorizationMatchesHydration(args);
-	return {
-		kind: "near_ed25519_yao_signing_preparation",
-		hydration: args.hydration,
-		authorization: {
-			kind: "authorized",
-			authorization: args.authorization
-		}
-	};
-}
-function buildAuthorizationRequiredNearEd25519YaoSigningPreparation(args) {
-	return {
-		kind: "near_ed25519_yao_signing_preparation",
-		hydration: args.hydration,
-		authorization: {
-			kind: "authorization_required",
-			requirement: args.requirement
-		}
-	};
-}
-//#endregion
-export { buildActiveNearEd25519WalletSessionAuthorization, buildAuthorizationRequiredNearEd25519YaoSigningPreparation, buildAuthorizedNearEd25519YaoSigningPreparation, classifyNearEd25519WalletSessionAuthorization, nearEd25519SessionMatchesMaterialActivation };
-
-//# sourceMappingURL=nearEd25519YaoSigningPreparation.js.map

package/dist/esm/core/signingEngine/session/material/restorableMpcMaterialRef.internal.js

@@ -1,21 +0,0 @@
-//#region src/core/signingEngine/session/material/restorableMpcMaterialRef.internal.ts
-var RestorableMpcMaterialReference = class RestorableMpcMaterialReference {
-	constructor(durableMaterialRef) {
-		this.kind = "restorable_mpc_material_ref";
-		this.protocolProof = true;
-		this.durableMaterialRef = durableMaterialRef;
-		this.protocolProof;
-	}
-	static build(durableMaterialRef) {
-		const normalized = String(durableMaterialRef || "").trim();
-		if (!normalized) throw new Error("Restorable MPC material reference is required");
-		return new RestorableMpcMaterialReference(normalized);
-	}
-};
-function buildRestorableMpcMaterialRefInternal(durableMaterialRef) {
-	return RestorableMpcMaterialReference.build(durableMaterialRef);
-}
-//#endregion
-export { buildRestorableMpcMaterialRefInternal };
-
-//# sourceMappingURL=restorableMpcMaterialRef.internal.js.map

package/dist/esm/core/signingEngine/session/passkey/ecdsaBootstrap.js

@@ -1,184 +0,0 @@
-import { SIGNER_AUTH_METHODS, SIGNER_SOURCES } from "../../../../shared-ts/src/utils/signerDomain.js";
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { toEvmFamilyEcdsaKeyHandle } from "../identity/evmFamilyEcdsaIdentity.js";
-import { walletSessionAuthorizations } from "../../../indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { isEcdsaCredentialFreeSessionActivationAuthorization } from "../../threshold/ecdsa/postRegistrationSessionActivation.js";
-import { activateEcdsaSession, activateExplicitKeyExportEcdsaSession } from "../../threshold/ecdsa/activation.js";
-import { persistExactWalletSessionAuthorizationFromEcdsaBootstrap, validateExactWalletSessionAuthorityIdentity, validateExactWalletSessionAuthorization } from "../persistence/walletSessionAuthorizationProjection.js";
-//#region src/core/signingEngine/session/passkey/ecdsaBootstrap.ts
-function resolveRelayerUrl(relayerUrlOverride, defaultRelayerUrl) {
-	const relayerUrl = String(relayerUrlOverride || defaultRelayerUrl || "").trim();
-	if (!relayerUrl) throw new Error("Missing relayer url (configs.network.relayer.url)");
-	return relayerUrl;
-}
-function hasExactEcdsaBootstrapIdentity(request) {
-	return "key" in request && Boolean(request.key) && "keyHandle" in request && Boolean(String(request.keyHandle || "").trim());
-}
-function ecdsaBootstrapWalletId(request) {
-	return hasExactEcdsaBootstrapIdentity(request) ? request.key.walletId : request.walletId;
-}
-function ecdsaBootstrapChainTarget(request) {
-	return hasExactEcdsaBootstrapIdentity(request) ? request.lanePolicy.chainTarget : request.chainTarget;
-}
-function ecdsaBootstrapSignerAuth(request) {
-	if (request.kind === "email_otp_ecdsa_bootstrap") return {
-		authMethod: SIGNER_AUTH_METHODS.emailOtp,
-		signerSource: SIGNER_SOURCES.emailOtpRegistration
-	};
-	return {
-		authMethod: SIGNER_AUTH_METHODS.passkey,
-		signerSource: SIGNER_SOURCES.passkeyRegistration
-	};
-}
-function ecdsaBootstrapAuthorizationAuthority(request) {
-	switch (request.kind) {
-		case "passkey_preauthorized_ecdsa_bootstrap":
-		case "wallet_session_reconnect_ecdsa_bootstrap": return request.authorizationAuthority;
-		case "passkey_fresh_ecdsa_bootstrap":
-		case "email_otp_ecdsa_bootstrap": return request.existingRoleLocalMaterial.authority;
-	}
-}
-function validatePreauthorizedEcdsaBootstrapAuthority(args) {
-	if (!("sessionActivation" in args.request) || !args.request.sessionActivation) return;
-	const preauthorized = args.request.sessionActivation;
-	const activation = isEcdsaCredentialFreeSessionActivationAuthorization(preauthorized) ? preauthorized.activation : preauthorized;
-	const authorization = isEcdsaCredentialFreeSessionActivationAuthorization(preauthorized) ? preauthorized.authorization : {
-		record: preauthorized.session.wallet_session,
-		operationCredential: preauthorized.session.operation_credential
-	};
-	validateExactWalletSessionAuthorization({
-		walletId: args.walletId,
-		authority: args.authority,
-		walletSession: authorization.record,
-		operationCredential: authorization.operationCredential,
-		expectedAuthorizationId: activation.session.authorization_id,
-		expectedWalletSessionId: activation.session.wallet_session_id,
-		expectedQuotaId: activation.session.quota_id,
-		expectedExpiresAtMs: activation.session.expires_at_ms
-	});
-	if (args.request.kind === "passkey_preauthorized_ecdsa_bootstrap") validateExactWalletSessionAuthorityIdentity({
-		expected: args.request.authorizationIdentity,
-		walletSession: authorization.record
-	});
-}
-function toActivateEcdsaSessionRequest(request, relayerUrl) {
-	const exactSessionRequest = (exactRequest, walletSessionRouteAuth, auth) => {
-		return {
-			kind: "session_bootstrap",
-			purpose: "transaction_signing",
-			relayerUrl,
-			keyHandle: toEvmFamilyEcdsaKeyHandle(exactRequest.keyHandle),
-			key: exactRequest.key,
-			lanePolicy: exactRequest.lanePolicy,
-			publicCapability: exactRequest.publicCapability,
-			existingRoleLocalMaterial: exactRequest.existingRoleLocalMaterial,
-			...exactRequest.requestId ? { requestId: exactRequest.requestId } : {},
-			...auth,
-			...walletSessionRouteAuth ? { walletSessionRouteAuth } : {}
-		};
-	};
-	const preauthorizedExactSessionRequest = (exactRequest) => ({
-		kind: "session_bootstrap",
-		purpose: "transaction_signing",
-		relayerUrl,
-		keyHandle: toEvmFamilyEcdsaKeyHandle(exactRequest.keyHandle),
-		key: exactRequest.key,
-		lanePolicy: exactRequest.lanePolicy,
-		publicCapability: exactRequest.publicCapability,
-		existingRoleLocalMaterial: exactRequest.existingRoleLocalMaterial,
-		...exactRequest.requestId ? { requestId: exactRequest.requestId } : {},
-		authKind: "passkey",
-		passkeyCredentialIdB64u: exactRequest.passkeyCredentialIdB64u,
-		preauthorizedSessionActivation: exactRequest.sessionActivation
-	});
-	switch (request.kind) {
-		case "passkey_fresh_ecdsa_bootstrap": return exactSessionRequest(request, request.routeAuth, {
-			authKind: "passkey",
-			passkeyCredentialIdB64u: request.passkeyCredentialIdB64u
-		});
-		case "passkey_preauthorized_ecdsa_bootstrap": return preauthorizedExactSessionRequest(request);
-		case "wallet_session_reconnect_ecdsa_bootstrap": return exactSessionRequest(request, request.routeAuth, {
-			authKind: "passkey",
-			passkeyCredentialIdB64u: request.passkeyCredentialIdB64u
-		});
-		case "email_otp_ecdsa_bootstrap": {
-			const auth = {
-				authKind: "email_otp",
-				emailOtpWorkerSessionHandle: request.emailOtpWorkerSessionHandle
-			};
-			return request.sessionActivation ? {
-				kind: "session_bootstrap",
-				purpose: "transaction_signing",
-				relayerUrl,
-				keyHandle: toEvmFamilyEcdsaKeyHandle(request.keyHandle),
-				key: request.key,
-				lanePolicy: request.lanePolicy,
-				publicCapability: request.publicCapability,
-				existingRoleLocalMaterial: request.existingRoleLocalMaterial,
-				...request.requestId ? { requestId: request.requestId } : {},
-				...auth,
-				preauthorizedSessionActivation: request.sessionActivation
-			} : exactSessionRequest(request, request.routeAuth, auth);
-		}
-	}
-	throw new Error("[SigningEngine][ecdsa] unsupported ECDSA bootstrap request");
-}
-function toActivateExplicitKeyExportEcdsaSessionRequest(request, relayerUrl) {
-	return {
-		purpose: "explicit_key_export",
-		relayerUrl,
-		existingRoleLocalMaterial: request.existingRoleLocalMaterial,
-		authorization: request.authorization
-	};
-}
-function toActivateEmailOtpExplicitExportBootstrapSessionRequest(request, relayerUrl) {
-	return {
-		purpose: "explicit_key_export",
-		relayerUrl,
-		existingRoleLocalMaterial: request.existingRoleLocalMaterial,
-		authorization: request.authorization
-	};
-}
-async function bootstrapEcdsaSessionValue(deps, request) {
-	if (request.kind === "reuse_warm_ecdsa_bootstrap") throw new Error("[SigningEngine][ecdsa] reuse_warm bootstrap must resolve an existing exact material request before activation");
-	const authority = ecdsaBootstrapAuthorizationAuthority(request);
-	const walletId = toWalletId(ecdsaBootstrapWalletId(request));
-	const chainTarget = ecdsaBootstrapChainTarget(request);
-	const relayerUrl = resolveRelayerUrl(request.relayerUrl, deps.defaultRelayerUrl);
-	const signerWorkerCtx = deps.getSignerWorkerContext();
-	const activationDeps = {
-		touchIdPrompt: deps.touchIdPrompt,
-		workerCtx: signerWorkerCtx,
-		routerAbNormalSigning: deps.routerAbNormalSigning
-	};
-	validatePreauthorizedEcdsaBootstrapAuthority({
-		request,
-		walletId,
-		authority
-	});
-	const canonicalBootstrap = await activateEcdsaSession(activationDeps, toActivateEcdsaSessionRequest(request, relayerUrl));
-	const signerAuth = ecdsaBootstrapSignerAuth(request);
-	await deps.persistThresholdEcdsaBootstrapForWalletTarget({
-		walletId,
-		chainTarget,
-		bootstrap: canonicalBootstrap,
-		signerAuth
-	});
-	await request.beforeAuthorizationPersistence?.();
-	await persistExactWalletSessionAuthorizationFromEcdsaBootstrap(walletSessionAuthorizations, {
-		walletId,
-		authority,
-		bootstrap: canonicalBootstrap
-	});
-	return canonicalBootstrap;
-}
-async function bootstrapExplicitKeyExportEcdsaSessionValue(deps, request) {
-	return await activateExplicitKeyExportEcdsaSession(toActivateExplicitKeyExportEcdsaSessionRequest(request, resolveRelayerUrl(request.relayerUrl, deps.defaultRelayerUrl)));
-}
-async function bootstrapEmailOtpExplicitExportEcdsaSessionValue(deps, request) {
-	return await activateExplicitKeyExportEcdsaSession(toActivateEmailOtpExplicitExportBootstrapSessionRequest(request, resolveRelayerUrl(request.relayerUrl, deps.defaultRelayerUrl)));
-}
-//#endregion
-export { bootstrapEcdsaSessionValue, bootstrapEmailOtpExplicitExportEcdsaSessionValue, bootstrapExplicitKeyExportEcdsaSessionValue, ecdsaBootstrapChainTarget, ecdsaBootstrapWalletId };
-
-//# sourceMappingURL=ecdsaBootstrap.js.map

package/dist/esm/core/signingEngine/session/passkey/ecdsaKeyFactsInventory.js

@@ -1,205 +0,0 @@
-import { isObject } from "../../../../shared-ts/src/utils/validation.js";
-import { SIGNER_AUTH_METHODS, SIGNER_KINDS } from "../../../../shared-ts/src/utils/signerDomain.js";
-import { thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, walletIdFromWalletProfile } from "../../interfaces/ecdsaChainTarget.js";
-import { buildEvmFamilyEcdsaWalletKey, parseThresholdSigningRootBinding, resolveThresholdEcdsaKeyIdFromRecord, toEvmFamilyEcdsaKeyHandle, toThresholdEcdsaPublicKeyB64u } from "../identity/evmFamilyEcdsaIdentity.js";
-import { parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-//#region src/core/signingEngine/session/passkey/ecdsaKeyFactsInventory.ts
-function normalizeEvmOwnerAddress(value) {
-	const candidate = String(value || "").trim().toLowerCase();
-	return /^0x[0-9a-f]{40}$/.test(candidate) ? candidate : "";
-}
-const EVM_FAMILY_ECDSA_KEY_HANDLE_PATTERN = /^ederivation-key-[A-Za-z0-9_-]+$/;
-function parseCurrentEcdsaKeyHandle(value) {
-	const normalized = String(value || "").trim();
-	if (!normalized) return { kind: "missing" };
-	if (!EVM_FAMILY_ECDSA_KEY_HANDLE_PATTERN.test(normalized)) return { kind: "invalid" };
-	return {
-		kind: "resolved",
-		keyHandle: normalized
-	};
-}
-function resolveProfileContinuityEcdsaKeyHandle(metadata) {
-	const directKeyHandle = parseCurrentEcdsaKeyHandle(metadata.keyHandle);
-	const sharedKeyHandle = isObject(metadata.sharedEvmFamilyKey) ? parseCurrentEcdsaKeyHandle(metadata.sharedEvmFamilyKey.keyHandle) : { kind: "missing" };
-	if (directKeyHandle.kind === "missing") return {
-		kind: "blocked",
-		reason: "missing_key_handle"
-	};
-	if (directKeyHandle.kind === "invalid" || sharedKeyHandle.kind === "invalid") return {
-		kind: "blocked",
-		reason: "invalid_key_handle"
-	};
-	if (sharedKeyHandle.kind === "resolved" && directKeyHandle.keyHandle !== sharedKeyHandle.keyHandle) return {
-		kind: "blocked",
-		reason: "duplicate_key_handles"
-	};
-	return {
-		kind: "resolved",
-		keyHandle: directKeyHandle.keyHandle
-	};
-}
-function parseProfileContinuityEvmFamilyEcdsaWalletKey(args) {
-	const keyFacts = (isObject(args.metadata.sharedEvmFamilyKey) ? args.metadata.sharedEvmFamilyKey : null) || args.metadata;
-	const thresholdEcdsaPublicKeyB64u = String(keyFacts.thresholdEcdsaPublicKeyB64u || args.metadata.thresholdEcdsaPublicKeyB64u || "").trim();
-	if (!thresholdEcdsaPublicKeyB64u) return null;
-	const keyWalletId = String(keyFacts.walletId || "").trim();
-	if (!keyWalletId) return null;
-	try {
-		toThresholdEcdsaPublicKeyB64u(thresholdEcdsaPublicKeyB64u);
-		const ecdsaThresholdKeyId = keyFacts.ecdsaThresholdKeyId || args.metadata.ecdsaThresholdKeyId;
-		const signingRootId = keyFacts.signingRootId || args.metadata.signingRootId;
-		const signingRootVersion = keyFacts.signingRootVersion || args.metadata.signingRootVersion;
-		const participantIds = keyFacts.participantIds || args.metadata.participantIds;
-		const thresholdOwnerAddress = keyFacts.thresholdOwnerAddress || args.metadata.thresholdOwnerAddress || args.metadata.ownerAddress;
-		return buildEvmFamilyEcdsaWalletKey({
-			walletId: keyWalletId,
-			keyHandle: args.keyHandle,
-			chainTarget: args.chainTarget,
-			ecdsaThresholdKeyId,
-			signingRootId,
-			signingRootVersion,
-			participantIds,
-			thresholdOwnerAddress,
-			thresholdEcdsaPublicKeyB64u
-		});
-	} catch {
-		return null;
-	}
-}
-function parseProfilePublicCapability(args) {
-	try {
-		const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(args.raw);
-		if (String(publicCapability.client_id) !== String(args.walletId) || publicCapability.public_identity.threshold_public_key33_b64u !== args.thresholdEcdsaPublicKeyB64u) return null;
-		return publicCapability;
-	} catch {
-		return null;
-	}
-}
-function parseProfileContinuityEcdsaWarmKey(args) {
-	const signer = args.signer;
-	if (signer.status !== "active") return { kind: "skipped" };
-	if (signer.signerKind !== SIGNER_KINDS.thresholdEcdsa) return { kind: "skipped" };
-	if (signer.signerAuthMethod !== SIGNER_AUTH_METHODS.passkey) return { kind: "skipped" };
-	const metadata = isObject(signer.metadata) ? signer.metadata : {};
-	if (!isObject(metadata.chainTarget)) return {
-		kind: "blocked",
-		targetKey: "",
-		reason: "missing_chain_target"
-	};
-	let chainTarget;
-	try {
-		chainTarget = thresholdEcdsaChainTargetFromRequest(metadata.chainTarget);
-	} catch (error) {
-		return {
-			kind: "blocked",
-			targetKey: "",
-			reason: "invalid_chain_target"
-		};
-	}
-	if (!args.configuredTargets.some((target) => thresholdEcdsaChainTargetsEqual(target, chainTarget))) return { kind: "skipped" };
-	const targetKey = thresholdEcdsaChainTargetKey(chainTarget);
-	const keyHandleResolution = resolveProfileContinuityEcdsaKeyHandle(metadata);
-	if (keyHandleResolution.kind === "blocked") return {
-		kind: "blocked",
-		targetKey,
-		reason: keyHandleResolution.reason
-	};
-	const walletKey = parseProfileContinuityEvmFamilyEcdsaWalletKey({
-		metadata,
-		keyHandle: keyHandleResolution.keyHandle,
-		chainTarget
-	});
-	if (!walletKey) return {
-		kind: "key_facts_inventory_required",
-		chainTarget,
-		targetKey,
-		keyHandle: keyHandleResolution.keyHandle,
-		reason: "missing_key_facts"
-	};
-	const publicCapability = parseProfilePublicCapability({
-		raw: metadata.publicCapability,
-		walletId: args.walletId,
-		thresholdEcdsaPublicKeyB64u: walletKey.keyFacts.thresholdEcdsaPublicKeyB64u
-	});
-	return {
-		kind: "active_wallet_key",
-		chainTarget,
-		targetKey,
-		walletKey,
-		publicCapability: publicCapability ? {
-			kind: "persisted_public_capability",
-			value: publicCapability
-		} : { kind: "missing_public_capability" }
-	};
-}
-function parseThresholdEcdsaKeyIdentityRecord(args) {
-	const { raw } = args;
-	if (!isObject(raw) || !isObject(raw.chainTarget)) return null;
-	const rawKey = isObject(raw.key) ? raw.key : raw;
-	let chainTarget;
-	try {
-		chainTarget = thresholdEcdsaChainTargetFromRequest(raw.chainTarget);
-	} catch {
-		return null;
-	}
-	const keyHandle = parseCurrentEcdsaKeyHandle(raw.keyHandle);
-	const nestedKeyHandle = parseCurrentEcdsaKeyHandle(rawKey.keyHandle);
-	const accountAddress = normalizeEvmOwnerAddress(raw.accountAddress);
-	const ownerAddress = normalizeEvmOwnerAddress(raw.ownerAddress);
-	const keyWalletId = String(rawKey.walletId || "").trim();
-	const rawKeySubjectId = String(rawKey.subjectId || "").trim();
-	const expectedKeySubjectId = String(walletIdFromWalletProfile({ walletId: args.walletId }));
-	const keyRpId = String(rawKey.rpId || "").trim();
-	const thresholdEcdsaPublicKeyB64u = String(rawKey.thresholdEcdsaPublicKeyB64u || raw.thresholdEcdsaPublicKeyB64u || "").trim();
-	const thresholdOwnerAddress = normalizeEvmOwnerAddress(rawKey.thresholdOwnerAddress || raw.ownerAddress || raw.accountAddress || raw.ethereumAddress);
-	if (keyHandle.kind !== "resolved" || nestedKeyHandle.kind !== "resolved" || nestedKeyHandle.keyHandle !== keyHandle.keyHandle || !thresholdEcdsaPublicKeyB64u || !ownerAddress || !accountAddress || !thresholdOwnerAddress || keyWalletId !== String(args.walletId) || rawKeySubjectId && rawKeySubjectId !== expectedKeySubjectId || keyRpId !== args.rpId || thresholdOwnerAddress !== ownerAddress) return null;
-	try {
-		const publicCapability = parseProfilePublicCapability({
-			raw: raw.publicCapability,
-			walletId: args.walletId,
-			thresholdEcdsaPublicKeyB64u
-		});
-		if (!publicCapability) return null;
-		const canonicalKeyHandle = toEvmFamilyEcdsaKeyHandle(keyHandle.keyHandle);
-		const ecdsaThresholdKeyId = resolveThresholdEcdsaKeyIdFromRecord({ record: { ecdsaThresholdKeyId: raw.ecdsaThresholdKeyId } });
-		const signingRootBinding = parseThresholdSigningRootBinding({
-			signingRootId: raw.signingRootId || rawKey.signingRootId,
-			signingRootVersion: raw.signingRootVersion || rawKey.signingRootVersion
-		});
-		return {
-			accountAddress,
-			ownerAddress,
-			publicCapability,
-			walletKey: buildEvmFamilyEcdsaWalletKey({
-				walletId: args.walletId,
-				keyHandle: canonicalKeyHandle,
-				chainTarget,
-				ecdsaThresholdKeyId,
-				signingRootId: signingRootBinding.signingRootId,
-				signingRootVersion: signingRootBinding.signingRootVersion,
-				participantIds: rawKey.participantIds || raw.participantIds,
-				thresholdOwnerAddress,
-				thresholdEcdsaPublicKeyB64u
-			})
-		};
-	} catch {
-		return null;
-	}
-}
-function parseThresholdEcdsaKeyIdentityTargets(args) {
-	const entries = [];
-	for (const raw of args.records) {
-		const parsed = parseThresholdEcdsaKeyIdentityRecord({
-			walletId: args.walletId,
-			rpId: args.rpId,
-			raw
-		});
-		if (!parsed) continue;
-		entries.push(parsed);
-	}
-	return entries;
-}
-//#endregion
-export { parseProfileContinuityEcdsaWarmKey, parseThresholdEcdsaKeyIdentityTargets };
-
-//# sourceMappingURL=ecdsaKeyFactsInventory.js.map