@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/signingEngine/session/passkey/ed25519YaoLocalMaterial.js

@@ -1,536 +0,0 @@
-import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { asRecord } from "../../../../shared-ts/src/utils/validation.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { requireRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
-import { normalizeThresholdRuntimePolicyScope } from "../../threshold/sessionPolicy.js";
-import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1, RouterAbEd25519YaoClientV1 } from "../../threshold/ed25519/yaoClient.js";
-import { parsePasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { buildNearAccountRefs } from "../../../accountData/near/accountRefs.js";
-import { resolveAccountKeyMaterialTarget } from "../../../indexedDB/accountKeyMaterial.js";
-import { buildEnvelopeAAD } from "../../../indexedDB/keyMaterialEnvelope.js";
-import { nearEd25519YaoMaterialActivationFromMetadata, nearEd25519YaoRuntimeRef, resolveNearEd25519YaoCapabilityHydrationV1 } from "../material/nearEd25519YaoMaterialActivation.js";
-import { buildRestorableMpcMaterialRefInternal } from "../material/restorableMpcMaterialRef.internal.js";
-//#region src/core/signingEngine/session/passkey/ed25519YaoLocalMaterial.ts
-const ED25519_YAO_LOCAL_MATERIAL_KEY_KIND = "router_ab_ed25519_yao_active_client_v1";
-const ED25519_YAO_LOCAL_MATERIAL_SCHEMA_VERSION = 3;
-const ED25519_YAO_LOCAL_MATERIAL_ALGORITHM = "chacha20poly1305-hkdf-sha256-prf-first-v1";
-const ED25519_YAO_LOCAL_MATERIAL_NONCE_BYTES = 12;
-const MAX_U64 = (1n << 64n) - 1n;
-function requireNonEmpty(value, label) {
-	const parsed = String(value ?? "").trim();
-	if (!parsed) throw new Error(`${label} is required for local Ed25519 material`);
-	return parsed;
-}
-function requirePositiveSafeInteger(value, label) {
-	const parsed = Number(value);
-	if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${label} must be a positive safe integer`);
-	return parsed;
-}
-function requireThresholdSessionId(value, label) {
-	const parsed = parseThresholdEd25519SessionId(value);
-	if (!parsed.ok) throw new Error(`${label}: ${parsed.error.message}`);
-	return parsed.value;
-}
-function requireBytes32B64u(value, label) {
-	const parsed = requireNonEmpty(value, label);
-	if (base64UrlDecode(parsed).length !== 32) throw new Error(`${label} must encode 32 bytes`);
-	return parsed;
-}
-function requireParticipantIds(value) {
-	if (!Array.isArray(value) || value.length !== 2) throw new Error("participantIds must contain exactly two entries");
-	const participantIds = [requirePositiveSafeInteger(value[0], "participantIds[0]"), requirePositiveSafeInteger(value[1], "participantIds[1]")];
-	if (participantIds[0] > 65535 || participantIds[1] > 65535 || participantIds[0] === participantIds[1]) throw new Error("participantIds must contain two distinct u16 identifiers");
-	return participantIds;
-}
-function requireU64String(value, label) {
-	const parsed = requireNonEmpty(value, label);
-	if (!/^(0|[1-9][0-9]*)$/.test(parsed)) throw new Error(`${label} must be a canonical u64`);
-	if (BigInt(parsed) > MAX_U64) throw new Error(`${label} must be a canonical u64`);
-	return parsed;
-}
-function ed25519YaoLocalMaterialIdentityFromWalletSession(walletSessionState, rpId, credentialIdB64u) {
-	const signer = walletSessionState.signingLane.identity.signer;
-	return {
-		walletId: requireNonEmpty(signer.account.wallet.walletId, "walletId"),
-		nearAccountId: requireNonEmpty(signer.account.nearAccountId, "nearAccountId"),
-		nearEd25519SigningKeyId: requireNonEmpty(signer.nearEd25519SigningKeyId, "nearEd25519SigningKeyId"),
-		thresholdSessionId: requireThresholdSessionId(walletSessionState.signingLane.identity.thresholdSessionId, "thresholdSessionId"),
-		signerSlot: requirePositiveSafeInteger(signer.signerSlot, "signerSlot"),
-		rpId: requireNonEmpty(rpId, "rpId"),
-		credentialIdB64u: requireNonEmpty(credentialIdB64u, "credentialIdB64u"),
-		signingRootId: requireNonEmpty(walletSessionState.signingRootId, "signingRootId"),
-		signingRootVersion: requireNonEmpty(walletSessionState.signingRootVersion, "signingRootVersion"),
-		signingWorkerId: requireNonEmpty(walletSessionState.routerAbNormalSigning.signingWorkerId, "signingWorkerId")
-	};
-}
-function bindingFromActiveClient(args) {
-	const metadata = args.metadata;
-	if (metadata.scope.account_id !== args.identity.walletId || metadata.applicationBinding.wallet_id !== args.identity.walletId || metadata.applicationBinding.near_ed25519_signing_key_id !== args.identity.nearEd25519SigningKeyId || metadata.scope.threshold_session_id !== args.identity.thresholdSessionId || metadata.applicationBinding.key_creation_signer_slot !== args.identity.signerSlot || metadata.applicationBinding.signing_root_id !== args.identity.signingRootId || metadata.scope.root_share_epoch !== args.identity.signingRootVersion || metadata.scope.signing_worker_id !== args.identity.signingWorkerId) throw new Error("Active Ed25519 Client metadata does not match the wallet signing lane");
-	return {
-		kind: ED25519_YAO_LOCAL_MATERIAL_KEY_KIND,
-		walletId: args.identity.walletId,
-		nearAccountId: args.identity.nearAccountId,
-		nearEd25519SigningKeyId: args.identity.nearEd25519SigningKeyId,
-		signerSlot: args.identity.signerSlot,
-		rpId: args.identity.rpId,
-		credentialIdB64u: args.identity.credentialIdB64u,
-		lifecycleId: requireNonEmpty(metadata.scope.lifecycle_id, "lifecycleId"),
-		thresholdSessionId: requireThresholdSessionId(metadata.scope.threshold_session_id, "thresholdSessionId"),
-		materialActivation: nearEd25519YaoMaterialActivationFromMetadata(metadata),
-		signingRootId: args.identity.signingRootId,
-		signingRootVersion: args.identity.signingRootVersion,
-		signerSetId: requireNonEmpty(metadata.scope.signer_set_id, "signerSetId"),
-		signingWorkerId: args.identity.signingWorkerId,
-		participantIds: [metadata.participantIds[0], metadata.participantIds[1]],
-		registeredPublicKeyB64u: base64UrlEncode(metadata.registeredPublicKey),
-		signingWorkerVerifyingShareB64u: base64UrlEncode(metadata.signingWorkerVerifyingShare),
-		stateEpoch: metadata.stateEpoch.toString(10),
-		activationTranscriptB64u: base64UrlEncode(metadata.transcript),
-		activationCapabilityBindingB64u: base64UrlEncode(Uint8Array.from(metadata.activeCapabilityBinding))
-	};
-}
-function bindingBytes(binding) {
-	return new TextEncoder().encode(JSON.stringify([
-		binding.kind,
-		binding.walletId,
-		binding.nearAccountId,
-		binding.nearEd25519SigningKeyId,
-		binding.signerSlot,
-		binding.rpId,
-		binding.credentialIdB64u,
-		binding.lifecycleId,
-		binding.thresholdSessionId,
-		binding.materialActivation.kind,
-		binding.materialActivation.activationId,
-		binding.materialActivation.capability,
-		binding.materialActivation.materialOwner,
-		binding.materialActivation.keyBinding,
-		binding.materialActivation.lifecycleBinding,
-		binding.materialActivation.signingWorker,
-		binding.signingRootId,
-		binding.signingRootVersion,
-		binding.signerSetId,
-		binding.signingWorkerId,
-		binding.participantIds[0],
-		binding.participantIds[1],
-		binding.registeredPublicKeyB64u,
-		binding.signingWorkerVerifyingShareB64u,
-		binding.stateEpoch,
-		binding.activationTranscriptB64u,
-		binding.activationCapabilityBindingB64u
-	]));
-}
-function assertBindingIdentity(binding, identity) {
-	if (binding.walletId !== identity.walletId || binding.nearAccountId !== identity.nearAccountId || binding.nearEd25519SigningKeyId !== identity.nearEd25519SigningKeyId || binding.signerSlot !== identity.signerSlot || binding.rpId !== identity.rpId || binding.credentialIdB64u !== identity.credentialIdB64u || binding.signingRootId !== identity.signingRootId || binding.signingRootVersion !== identity.signingRootVersion || binding.signingWorkerId !== identity.signingWorkerId) throw new Error("Stored Ed25519 Client material does not match the wallet signing lane");
-}
-function parsePasskeyEd25519YaoLocalMaterialBindingV1(value) {
-	const record = asRecord(value);
-	if (!record || record.kind !== ED25519_YAO_LOCAL_MATERIAL_KEY_KIND) throw new Error("Stored Ed25519 Client material binding is invalid");
-	const materialActivation = parseMpcMaterialActivationRef(record.materialActivation);
-	if (!materialActivation.ok) throw new Error(materialActivation.error.message);
-	const binding = {
-		kind: ED25519_YAO_LOCAL_MATERIAL_KEY_KIND,
-		walletId: requireNonEmpty(record.walletId, "binding.walletId"),
-		nearAccountId: requireNonEmpty(record.nearAccountId, "binding.nearAccountId"),
-		nearEd25519SigningKeyId: requireNonEmpty(record.nearEd25519SigningKeyId, "binding.nearEd25519SigningKeyId"),
-		signerSlot: requirePositiveSafeInteger(record.signerSlot, "binding.signerSlot"),
-		rpId: requireNonEmpty(record.rpId, "binding.rpId"),
-		credentialIdB64u: requireNonEmpty(record.credentialIdB64u, "binding.credentialIdB64u"),
-		lifecycleId: requireNonEmpty(record.lifecycleId, "binding.lifecycleId"),
-		thresholdSessionId: requireThresholdSessionId(record.thresholdSessionId, "binding.thresholdSessionId"),
-		materialActivation: materialActivation.value,
-		signingRootId: requireNonEmpty(record.signingRootId, "binding.signingRootId"),
-		signingRootVersion: requireNonEmpty(record.signingRootVersion, "binding.signingRootVersion"),
-		signerSetId: requireNonEmpty(record.signerSetId, "binding.signerSetId"),
-		signingWorkerId: requireNonEmpty(record.signingWorkerId, "binding.signingWorkerId"),
-		participantIds: requireParticipantIds(record.participantIds),
-		registeredPublicKeyB64u: requireBytes32B64u(record.registeredPublicKeyB64u, "binding.registeredPublicKeyB64u"),
-		signingWorkerVerifyingShareB64u: requireBytes32B64u(record.signingWorkerVerifyingShareB64u, "binding.signingWorkerVerifyingShareB64u"),
-		stateEpoch: requireU64String(record.stateEpoch, "binding.stateEpoch"),
-		activationTranscriptB64u: requireBytes32B64u(record.activationTranscriptB64u, "binding.activationTranscriptB64u"),
-		activationCapabilityBindingB64u: requireBytes32B64u(record.activationCapabilityBindingB64u, "binding.activationCapabilityBindingB64u")
-	};
-	if (binding.materialActivation.materialOwner !== binding.walletId || binding.materialActivation.signingWorker !== binding.signingWorkerId) throw new Error("Stored Ed25519 Client material activation does not match its binding");
-	return binding;
-}
-function parseStoredBinding(value, identity) {
-	const binding = parsePasskeyEd25519YaoLocalMaterialBindingV1(value);
-	assertBindingIdentity(binding, identity);
-	return binding;
-}
-function parseStableServerScope(value) {
-	const record = asRecord(value);
-	if (!record) throw new Error("Stored Ed25519 Client stable server scope is invalid");
-	const runtimePolicyScope = normalizeThresholdRuntimePolicyScope(record.runtimePolicyScope);
-	if (!runtimePolicyScope) throw new Error("Stored Ed25519 Client server runtime policy scope is invalid");
-	return {
-		relayerKeyId: requireNonEmpty(record.relayerKeyId, "stableServerScope.relayerKeyId"),
-		participantIds: requireParticipantIds(record.participantIds),
-		runtimePolicyScope,
-		routerAbNormalSigning: requireRouterAbEd25519NormalSigningState(record.routerAbNormalSigning)
-	};
-}
-async function parseStoredLocalMaterialLocator(args) {
-	const value = args.stored.payload;
-	const record = asRecord(value);
-	if (!record) throw new Error("Stored Ed25519 Client local material locator is invalid");
-	const binding = parsePasskeyEd25519YaoLocalMaterialBindingV1(record.binding);
-	const expectedPublicKey = `ed25519:${base58Encode(base64UrlDecode(binding.registeredPublicKeyB64u))}`;
-	const envelope = args.stored.payloadEnvelope;
-	if (args.stored.profileId !== args.target.profileId || args.stored.chainIdKey !== args.target.chainIdKey || args.stored.accountAddress !== args.target.accountAddress || args.stored.keyKind !== ED25519_YAO_LOCAL_MATERIAL_KEY_KIND || args.stored.schemaVersion !== ED25519_YAO_LOCAL_MATERIAL_SCHEMA_VERSION || args.stored.publicKey !== expectedPublicKey || args.stored.signerId !== binding.nearEd25519SigningKeyId || envelope?.encVersion !== 1 || envelope.alg !== ED25519_YAO_LOCAL_MATERIAL_ALGORITHM) throw new Error("Stored Ed25519 Client local material record is invalid");
-	const parsedAuthority = parsePasskeyWalletAuthAuthority({
-		walletId: binding.walletId,
-		factor: {
-			kind: "passkey",
-			credentialIdB64u: binding.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: binding.rpId
-		},
-		bindingId: args.authority.walletAuthMethodId
-	});
-	if (!parsedAuthority) throw new Error("Stored Ed25519 Client local material authority is invalid");
-	const authority = await walletAuthAuthorityRef({ authority: parsedAuthority });
-	if (authority.authorityDigest !== args.authority.authorityDigest) throw new Error("Stored Ed25519 Client local material authority changed");
-	return {
-		kind: "passkey_ed25519_yao_local_material_locator_v1",
-		authority,
-		materialActivation: binding.materialActivation,
-		sealedMaterial: buildRestorableMpcMaterialRefInternal(JSON.stringify([
-			args.stored.profileId,
-			args.stored.signerSlot,
-			args.stored.chainIdKey,
-			args.stored.keyKind,
-			binding.materialActivation.activationId
-		])),
-		stableServerScope: parseStableServerScope(record.stableServerScope)
-	};
-}
-function assertStoredIdentitySubset(args) {
-	const binding = asRecord(args.stored.payload?.binding);
-	if (args.stored.profileId !== args.target.profileId || args.stored.chainIdKey !== args.target.chainIdKey || args.stored.accountAddress !== args.target.accountAddress || args.stored.signerSlot !== args.input.signerSlot || args.stored.signerId !== args.input.nearEd25519SigningKeyId || args.stored.keyKind !== ED25519_YAO_LOCAL_MATERIAL_KEY_KIND || binding?.kind !== ED25519_YAO_LOCAL_MATERIAL_KEY_KIND || binding.walletId !== args.input.walletId || binding.nearAccountId !== args.input.nearAccountId || binding.nearEd25519SigningKeyId !== args.input.nearEd25519SigningKeyId || binding.signerSlot !== args.input.signerSlot || binding.rpId !== args.input.rpId || binding.credentialIdB64u !== args.input.credentialIdB64u) throw new Error("Stored Ed25519 Client material locator does not match local custody");
-}
-function metadataFromPasskeyEd25519YaoLocalMaterialBindingV1(binding, thresholdSessionId) {
-	const resolvedThresholdSessionId = requireNonEmpty(thresholdSessionId, "thresholdSessionId");
-	return {
-		kind: ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1,
-		scope: {
-			lifecycle_id: binding.lifecycleId,
-			root_share_epoch: binding.signingRootVersion,
-			account_id: binding.walletId,
-			threshold_session_id: resolvedThresholdSessionId,
-			signer_set_id: binding.signerSetId,
-			signing_worker_id: binding.signingWorkerId,
-			material_activation: routerAbMpcMaterialActivationRefToWire(binding.materialActivation)
-		},
-		applicationBinding: {
-			wallet_id: binding.walletId,
-			near_ed25519_signing_key_id: binding.nearEd25519SigningKeyId,
-			signing_root_id: binding.signingRootId,
-			key_creation_signer_slot: binding.signerSlot
-		},
-		participantIds: binding.participantIds,
-		registeredPublicKey: base64UrlDecode(binding.registeredPublicKeyB64u),
-		signingWorkerVerifyingShare: base64UrlDecode(binding.signingWorkerVerifyingShareB64u),
-		stateEpoch: BigInt(binding.stateEpoch),
-		transcript: base64UrlDecode(binding.activationTranscriptB64u),
-		activeCapabilityBinding: Array.from(base64UrlDecode(binding.activationCapabilityBindingB64u)),
-		materialActivation: binding.materialActivation
-	};
-}
-function randomNonce() {
-	const nonce = new Uint8Array(ED25519_YAO_LOCAL_MATERIAL_NONCE_BYTES);
-	globalThis.crypto.getRandomValues(nonce);
-	return nonce;
-}
-function buildPasskeyEd25519YaoLocalMaterialRecordV1(input) {
-	const identity = input.identity;
-	const metadata = input.activeClient.metadata();
-	const binding = bindingFromActiveClient({
-		identity,
-		metadata
-	});
-	const nonce = randomNonce();
-	const sealed = input.activeClient.sealLocalMaterial({
-		ownedPasskeyPrfFirst: input.ownedPasskeyPrfFirst,
-		binding: bindingBytes(binding),
-		nonce
-	});
-	const payload = {
-		binding,
-		stableServerScope: input.stableServerScope
-	};
-	switch (input.lifecycle.kind) {
-		case "registration_or_rehydration": break;
-		case "recovery_promotion":
-			payload.lifecycleReceipt = input.lifecycle.promotionReceipt;
-			break;
-		default: input.lifecycle;
-	}
-	return {
-		profileId: input.target.profileId,
-		signerSlot: identity.signerSlot,
-		chainIdKey: input.target.chainIdKey,
-		accountAddress: input.target.accountAddress,
-		keyKind: ED25519_YAO_LOCAL_MATERIAL_KEY_KIND,
-		algorithm: "ed25519",
-		publicKey: `ed25519:${base58Encode(metadata.registeredPublicKey)}`,
-		signerId: identity.nearEd25519SigningKeyId,
-		payload,
-		payloadEnvelope: {
-			encVersion: 1,
-			alg: ED25519_YAO_LOCAL_MATERIAL_ALGORITHM,
-			nonce: base64UrlEncode(sealed.nonce),
-			ciphertext: base64UrlEncode(sealed.ciphertext),
-			aad: buildEnvelopeAAD({
-				profileId: input.target.profileId,
-				signerSlot: identity.signerSlot,
-				chainIdKey: input.target.chainIdKey,
-				accountAddress: input.target.accountAddress,
-				keyKind: ED25519_YAO_LOCAL_MATERIAL_KEY_KIND,
-				schemaVersion: ED25519_YAO_LOCAL_MATERIAL_SCHEMA_VERSION,
-				signerId: identity.nearEd25519SigningKeyId
-			})
-		},
-		timestamp: Date.now(),
-		schemaVersion: ED25519_YAO_LOCAL_MATERIAL_SCHEMA_VERSION
-	};
-}
-async function persistPasskeyEd25519YaoSignerMaterialV1(input) {
-	const target = await resolveAccountKeyMaterialTarget(input.store, { accountRefs: buildNearAccountRefs(input.identity.nearAccountId) });
-	if (!target) throw new Error("Local Ed25519 material requires a persisted wallet profile");
-	const record = buildPasskeyEd25519YaoLocalMaterialRecordV1({
-		target,
-		activeClient: input.activeClient,
-		identity: input.identity,
-		stableServerScope: input.stableServerScope,
-		ownedPasskeyPrfFirst: base64UrlDecode(input.passkeyPrfFirstB64u),
-		lifecycle: { kind: "registration_or_rehydration" }
-	});
-	await input.store.storeKeyMaterial(record);
-}
-async function readPasskeyEd25519YaoLocalMaterialLocatorV1(input) {
-	const nearAccountId = requireNonEmpty(input.nearAccountId, "nearAccountId");
-	const target = await resolveAccountKeyMaterialTarget(input.store, { accountRefs: buildNearAccountRefs(nearAccountId) });
-	if (!target) return { kind: "unavailable" };
-	const stored = await input.store.getKeyMaterial(target.profileId, requirePositiveSafeInteger(input.signerSlot, "signerSlot"), target.chainIdKey, ED25519_YAO_LOCAL_MATERIAL_KEY_KIND);
-	if (!stored) return { kind: "unavailable" };
-	assertStoredIdentitySubset({
-		stored,
-		target,
-		input
-	});
-	return {
-		kind: "available",
-		locator: await parseStoredLocalMaterialLocator({
-			stored,
-			target,
-			authority: input.authority
-		})
-	};
-}
-function publicLocatorMatchesIdentity(args) {
-	return args.publicLocator.walletId === args.identity.walletId && args.publicLocator.nearAccountId === args.identity.nearAccountId && args.publicLocator.signerSlot === args.identity.signerSlot;
-}
-async function expectedPasskeyAuthority(args) {
-	const authority = parsePasskeyWalletAuthAuthority({
-		walletId: args.identity.walletId,
-		factor: {
-			kind: "passkey",
-			credentialIdB64u: args.identity.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: args.identity.rpId
-		},
-		bindingId: args.authority.walletAuthMethodId
-	});
-	if (!authority) throw new Error("Passkey Ed25519 authority is invalid");
-	const authorityRef = await walletAuthAuthorityRef({ authority });
-	if (authorityRef.authorityDigest !== args.authority.authorityDigest) throw new Error("Passkey Ed25519 authority does not match the Wallet Session");
-	return authorityRef;
-}
-function liveRuntimeObservation(material) {
-	if (!material) return { kind: "absent" };
-	if (material.activeClient.status().kind !== "active") return { kind: "absent" };
-	const materialActivation = nearEd25519YaoMaterialActivationFromMetadata(material.activeClient.metadata());
-	return {
-		kind: "live",
-		runtime: nearEd25519YaoRuntimeRef(materialActivation),
-		materialActivation
-	};
-}
-function hydrationBlocked(plan) {
-	return {
-		kind: "blocked",
-		plan
-	};
-}
-async function observePasskeyEd25519YaoLocalMaterial(input) {
-	const expectedAuthority = await expectedPasskeyAuthority(input);
-	const publicLocator = input.publicLocator.kind === "available" && !publicLocatorMatchesIdentity({
-		publicLocator: input.publicLocator,
-		identity: input.identity
-	}) ? { kind: "conflict" } : input.publicLocator.kind === "available" ? {
-		...input.publicLocator,
-		authority: expectedAuthority
-	} : input.publicLocator;
-	let localMaterial;
-	try {
-		localMaterial = await readPasskeyEd25519YaoLocalMaterialLocatorV1({
-			store: input.store,
-			walletId: String(input.identity.walletId),
-			nearAccountId: String(input.identity.nearAccountId),
-			nearEd25519SigningKeyId: String(input.identity.nearEd25519SigningKeyId),
-			signerSlot: input.identity.signerSlot,
-			rpId: input.identity.rpId,
-			credentialIdB64u: input.identity.credentialIdB64u,
-			authority: expectedAuthority
-		});
-	} catch {
-		return {
-			expectedAuthority,
-			publicLocator,
-			sealed: { kind: "corrupt" }
-		};
-	}
-	return {
-		expectedAuthority,
-		publicLocator,
-		sealed: localMaterial.kind === "available" ? {
-			kind: "available",
-			authority: localMaterial.locator.authority,
-			materialActivation: localMaterial.locator.materialActivation,
-			sealedMaterial: localMaterial.locator.sealedMaterial
-		} : { kind: "missing" }
-	};
-}
-function blockedByCorruptMaterial(publicLocator, runtime) {
-	const plan = resolveNearEd25519YaoCapabilityHydrationV1({
-		publicLocator,
-		sealed: { kind: "corrupt" },
-		runtime,
-		unlockSource: { kind: "unavailable" }
-	});
-	if (plan.kind !== "blocked") throw new Error("Corrupt Near Ed25519 material resolved to an executable hydration plan");
-	return plan;
-}
-async function preparePasskeyEd25519YaoLocalMaterialRehydrationV1(input) {
-	const { expectedAuthority, publicLocator, sealed } = await observePasskeyEd25519YaoLocalMaterial(input);
-	if (sealed.kind === "corrupt") return {
-		kind: "blocked",
-		plan: blockedByCorruptMaterial(publicLocator, { kind: "absent" })
-	};
-	const plan = resolveNearEd25519YaoCapabilityHydrationV1({
-		publicLocator,
-		sealed,
-		runtime: { kind: "absent" },
-		unlockSource: {
-			kind: "available",
-			authority: expectedAuthority
-		}
-	});
-	switch (plan.kind) {
-		case "rehydrate_material_activation": return {
-			kind: "prepared",
-			plan
-		};
-		case "blocked": return {
-			kind: "blocked",
-			plan
-		};
-		case "use_live_runtime":
-		case "reauthorize_public_anchor": throw new Error("Sealed Near Ed25519 preparation resolved an invalid hydration plan");
-		default: throw new Error("Unsupported sealed Near Ed25519 preparation plan");
-	}
-}
-async function hydratePasskeyEd25519YaoLocalMaterialV1(input) {
-	const { expectedAuthority, publicLocator, sealed } = await observePasskeyEd25519YaoLocalMaterial(input);
-	if (sealed.kind === "corrupt") return hydrationBlocked(blockedByCorruptMaterial(publicLocator, liveRuntimeObservation(input.liveMaterial)));
-	const unlockSource = input.unlockSource.kind === "available" ? {
-		kind: "available",
-		authority: expectedAuthority
-	} : { kind: "unavailable" };
-	const plan = resolveNearEd25519YaoCapabilityHydrationV1({
-		publicLocator,
-		sealed,
-		runtime: liveRuntimeObservation(input.liveMaterial),
-		unlockSource
-	});
-	switch (plan.kind) {
-		case "use_live_runtime": {
-			const material = input.liveMaterial;
-			if (!material || material.activeClient.status().kind !== "active" || !mpcMaterialActivationRefsEqual(plan.materialActivation, nearEd25519YaoMaterialActivationFromMetadata(material.activeClient.metadata()))) throw new Error("Near Ed25519 live hydration plan lost its exact runtime");
-			return {
-				kind: "live",
-				plan
-			};
-		}
-		case "rehydrate_material_activation": {
-			if (input.unlockSource.kind !== "available") throw new Error("Near Ed25519 rehydration plan lost its unlock source");
-			const rehydrated = await rehydratePasskeyEd25519YaoLocalMaterialV1({
-				store: input.store,
-				identity: input.identity,
-				passkeyPrfFirstB64u: input.unlockSource.passkeyPrfFirstB64u
-			});
-			if (rehydrated.kind !== "rehydrated") throw new Error("Near Ed25519 rehydration plan lost its sealed material");
-			const rehydratedActivation = nearEd25519YaoMaterialActivationFromMetadata(rehydrated.activeClient.metadata());
-			if (!mpcMaterialActivationRefsEqual(plan.materialActivation, rehydratedActivation)) {
-				rehydrated.activeClient.dispose();
-				throw new Error("Near Ed25519 rehydration changed the material activation");
-			}
-			return {
-				kind: "rehydrated",
-				plan,
-				activeClient: rehydrated.activeClient
-			};
-		}
-		case "blocked": return hydrationBlocked(plan);
-		case "reauthorize_public_anchor": throw new Error("Near Ed25519 material retirement requires explicit reauthorization");
-		default: throw new Error("Unsupported Near Ed25519 hydration plan");
-	}
-}
-async function rehydratePasskeyEd25519YaoLocalMaterialV1(input) {
-	const identity = input.identity;
-	const target = await resolveAccountKeyMaterialTarget(input.store, { accountRefs: buildNearAccountRefs(identity.nearAccountId) });
-	if (!target) return { kind: "unavailable" };
-	const stored = await input.store.getKeyMaterial(target.profileId, identity.signerSlot, target.chainIdKey, ED25519_YAO_LOCAL_MATERIAL_KEY_KIND);
-	if (!stored) return { kind: "unavailable" };
-	return rehydratePasskeyEd25519YaoLocalMaterialRecordV1({
-		stored,
-		target,
-		identity,
-		ownedPasskeyPrfFirst: base64UrlDecode(input.passkeyPrfFirstB64u)
-	});
-}
-async function rehydratePasskeyEd25519YaoLocalMaterialRecordV1(input) {
-	const identity = input.identity;
-	const stored = input.stored;
-	const target = input.target;
-	const envelope = stored.payloadEnvelope;
-	if (stored.profileId !== target.profileId || stored.accountAddress !== target.accountAddress || stored.signerId !== identity.nearEd25519SigningKeyId || stored.keyKind !== ED25519_YAO_LOCAL_MATERIAL_KEY_KIND || stored.schemaVersion !== ED25519_YAO_LOCAL_MATERIAL_SCHEMA_VERSION || envelope?.encVersion !== 1 || envelope.alg !== ED25519_YAO_LOCAL_MATERIAL_ALGORITHM) throw new Error("Stored Ed25519 Client material record is invalid");
-	const binding = parseStoredBinding(stored.payload?.binding, identity);
-	const metadata = metadataFromPasskeyEd25519YaoLocalMaterialBindingV1(binding, identity.thresholdSessionId);
-	const expectedPublicKey = `ed25519:${base58Encode(metadata.registeredPublicKey)}`;
-	if (stored.publicKey !== expectedPublicKey) throw new Error("Stored Ed25519 Client public key does not match its sealed binding");
-	return {
-		kind: "rehydrated",
-		activeClient: (await RouterAbEd25519YaoClientV1.initializeBundled()).importLocalMaterial({
-			ownedPasskeyPrfFirst: input.ownedPasskeyPrfFirst,
-			binding: bindingBytes(binding),
-			sealed: {
-				kind: "router_ab_ed25519_yao_sealed_local_material_v1",
-				nonce: base64UrlDecode(envelope.nonce),
-				ciphertext: base64UrlDecode(envelope.ciphertext)
-			},
-			metadata
-		})
-	};
-}
-//#endregion
-export { ed25519YaoLocalMaterialIdentityFromWalletSession, hydratePasskeyEd25519YaoLocalMaterialV1, persistPasskeyEd25519YaoSignerMaterialV1, preparePasskeyEd25519YaoLocalMaterialRehydrationV1, readPasskeyEd25519YaoLocalMaterialLocatorV1 };
-
-//# sourceMappingURL=ed25519YaoLocalMaterial.js.map

package/dist/esm/core/signingEngine/session/passkey/ed25519YaoRecoveryCapability.js

@@ -1,94 +0,0 @@
-import { parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { requireRecord, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
-import { toAccountId } from "../../../types/accountIds.js";
-import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-//#region src/core/signingEngine/session/passkey/ed25519YaoRecoveryCapability.ts
-function requirePositiveInteger(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
-	return value;
-}
-function requireThresholdEd25519SessionId(value, label) {
-	const parsed = parseThresholdEd25519SessionId(value);
-	if (!parsed.ok) throw new Error(`${label} is invalid`);
-	return parsed.value;
-}
-function requireBytes32(value, label) {
-	if (!Array.isArray(value) || value.length !== 32) throw new Error(`${label} must contain exactly 32 bytes`);
-	const bytes = [];
-	for (const byte of value) {
-		if (typeof byte !== "number" || !Number.isInteger(byte) || byte < 0 || byte > 255) throw new Error(`${label} must contain exactly 32 bytes`);
-		bytes.push(byte);
-	}
-	return Object.freeze(bytes);
-}
-function requireBytes(value, label) {
-	if (!Array.isArray(value) || value.length === 0) throw new Error(`${label} must contain bytes`);
-	return value.map((byte) => {
-		if (typeof byte !== "number" || !Number.isInteger(byte) || byte < 0 || byte > 255) throw new Error(`${label} must contain bytes`);
-		return byte;
-	});
-}
-function requireParticipantIds(value) {
-	if (!Array.isArray(value) || value.length !== 2 || !Number.isSafeInteger(value[0]) || !Number.isSafeInteger(value[1]) || value[0] < 1 || value[1] < 1 || value[0] === value[1]) throw new Error("participantIds must contain two distinct positive integers");
-	return [Number(value[0]), Number(value[1])];
-}
-function parseRegistrationContinuity(value) {
-	const record = requireRecord(value, "capability.registrationContinuity");
-	if (record.kind === "recovery") return {
-		kind: "recovery",
-		activationTranscript: requireBytes(record.activationTranscript, "capability.registrationContinuity.activationTranscript")
-	};
-	if (record.kind !== "registration") throw new Error("capability.registrationContinuity kind is invalid");
-	const admissionRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(record.admissionRequest);
-	const admissionReceipt = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(record.admissionReceipt);
-	if (!admissionRequest.ok) throw new Error(`capability registration continuity transcript is invalid: ${admissionRequest.message}`);
-	if (!admissionReceipt.ok) throw new Error(`capability registration continuity transcript is invalid: ${admissionReceipt.message}`);
-	return {
-		kind: "registration",
-		admissionRequest: admissionRequest.value,
-		admissionReceipt: admissionReceipt.value,
-		activationTranscript: requireBytes(record.activationTranscript, "capability.registrationContinuity.activationTranscript")
-	};
-}
-function parseEd25519YaoRecoveryCapabilityV1(raw) {
-	const record = requireRecord(raw, "capability");
-	if (record.kind !== "router_ab_ed25519_yao_active_capability_v1") throw new Error("Yao recovery capability kind is invalid");
-	const application = requireRecord(record.applicationBinding, "capability.applicationBinding");
-	const lifecycle = requireRecord(record.lifecycle, "capability.lifecycle");
-	let materialActivation;
-	try {
-		materialActivation = routerAbMpcMaterialActivationRefFromWire(record.materialActivation);
-	} catch (error) {
-		throw new Error(`capability.materialActivation is invalid: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	return {
-		materialActivation,
-		activeCapabilityBinding: requireBytes32(record.activeCapabilityBinding, "capability.activeCapabilityBinding"),
-		registeredPublicKey: requireBytes32(record.registeredPublicKey, "capability.registeredPublicKey"),
-		nearAccountId: toAccountId(requireTrimmedString(record.nearAccountId, "capability.nearAccountId")),
-		applicationBinding: {
-			wallet_id: requireTrimmedString(application.wallet_id, "applicationBinding.wallet_id"),
-			near_ed25519_signing_key_id: requireTrimmedString(application.near_ed25519_signing_key_id, "applicationBinding.near_ed25519_signing_key_id"),
-			signing_root_id: requireTrimmedString(application.signing_root_id, "applicationBinding.signing_root_id"),
-			key_creation_signer_slot: requirePositiveInteger(application.key_creation_signer_slot, "applicationBinding.key_creation_signer_slot")
-		},
-		participantIds: requireParticipantIds(record.participantIds),
-		runtimePolicyScope: normalizeRuntimePolicyScope(requireRecord(record.runtimePolicyScope, "capability.runtimePolicyScope")),
-		lifecycle: {
-			lifecycleId: requireTrimmedString(lifecycle.lifecycleId, "lifecycle.lifecycleId"),
-			rootShareEpoch: requireTrimmedString(lifecycle.rootShareEpoch, "lifecycle.rootShareEpoch"),
-			accountId: requireTrimmedString(lifecycle.accountId, "lifecycle.accountId"),
-			thresholdSessionId: requireThresholdEd25519SessionId(requireTrimmedString(lifecycle.thresholdSessionId, "lifecycle.thresholdSessionId"), "lifecycle.thresholdSessionId"),
-			signerSetId: requireTrimmedString(lifecycle.signerSetId, "lifecycle.signerSetId"),
-			signingWorkerId: requireTrimmedString(lifecycle.signingWorkerId, "lifecycle.signingWorkerId")
-		},
-		stateEpoch: requirePositiveInteger(record.stateEpoch, "capability.stateEpoch"),
-		registrationContinuity: parseRegistrationContinuity(record.registrationContinuity)
-	};
-}
-//#endregion
-export { parseEd25519YaoRecoveryCapabilityV1 };
-
-//# sourceMappingURL=ed25519YaoRecoveryCapability.js.map