@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/signingEngine/session/warmCapabilities/capabilityReaderCore.js

@@ -1,293 +0,0 @@
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { buildBaseEvmFamilyEcdsaKeyIdentity, toRpId } from "../identity/evmFamilyEcdsaIdentity.js";
-import { selectedEcdsaLane } from "../identity/laneIdentity.js";
-import { resolveExactEd25519SealedSessionRuntimeForWallet } from "./ed25519SealedSessionRuntime.js";
-import { deriveEcdsaCapabilityState, deriveEd25519CapabilityState, resolveEcdsaSealTransport } from "./readModel.js";
-import { assertWarmSessionEnvelopeInvariant } from "./types.js";
-import { warmClaimFromRecordPolicy } from "../availability/readiness.js";
-//#region src/core/signingEngine/session/warmCapabilities/capabilityReaderCore.ts
-function signingLaneAuthBindingFromEcdsaRuntime(authBinding) {
-	switch (authBinding.kind) {
-		case "passkey": return {
-			kind: "passkey",
-			rpId: toRpId(authBinding.rpId),
-			credentialIdB64u: authBinding.credentialIdB64u
-		};
-		case "email_otp": return {
-			kind: "email_otp",
-			providerSubjectId: authBinding.providerSubjectId
-		};
-		default: throw new Error("[WarmSessionStore] unsupported ECDSA runtime auth binding");
-	}
-}
-async function resolveEcdsaAuthorizationForResolution(args) {
-	if (!args.resolve || args.resolution.kind !== "resolved") return null;
-	try {
-		return await args.resolve({
-			walletId: args.walletId,
-			chainTarget: args.resolution.runtime.chainTarget,
-			materialActivation: args.resolution.manifest.activation.materialActivation
-		});
-	} catch {
-		return null;
-	}
-}
-/** The PRF claim for a resolved ECDSA capability. Correlation has already proved
-* the material, so the claim is the sealed runtime's own allowance and expiry --
-* the same facts the shared runtime-policy rule classifies. A blocked resolution
-* has no runtime and so no claim to report.
-*
-* The wallet-scoped relayer claim is not consulted here. It is read by lane, and
-* no lane was ever built for an ECDSA capability from the composite store, so
-* this reaches strictly more state than the path it replaces rather than less. */
-function ecdsaClaimForResolution(resolution) {
-	if (resolution.kind !== "resolved") return null;
-	return warmClaimFromRecordPolicy({
-		thresholdSessionId: resolution.runtime.sealedRecord.thresholdSessionId,
-		remainingUses: resolution.runtime.remainingUses,
-		expiresAtMs: resolution.runtime.expiresAtMs
-	});
-}
-function createWarmSessionCapabilityReaderCore(deps) {
-	async function resolveEd25519AuthorizationForWallet(walletId) {
-		const resolve = deps.resolveActiveEd25519WalletSessionAuthorization;
-		if (!resolve) return null;
-		try {
-			return await resolve(walletId);
-		} catch {
-			return null;
-		}
-	}
-	function buildEd25519CapabilityState(args) {
-		if (args.resolution.kind === "missing") return {
-			capability: "ed25519",
-			runtime: null,
-			auth: null,
-			prfClaim: null,
-			state: "missing"
-		};
-		if (args.resolution.kind === "conflict" || args.resolution.kind === "corrupt") return {
-			capability: "ed25519",
-			runtime: null,
-			auth: null,
-			prfClaim: null,
-			invalidReason: args.resolution.kind === "conflict" ? "exact_record_conflict" : "corrupt",
-			state: "invalid"
-		};
-		const runtime = args.resolution.runtime;
-		const state = deriveEd25519CapabilityState({
-			runtime,
-			auth: args.auth,
-			prfClaim: args.prfClaim
-		});
-		if (state === "authorization_required") return {
-			capability: "ed25519",
-			runtime,
-			auth: null,
-			prfClaim: args.prfClaim,
-			state
-		};
-		if (state === "missing" || state === "invalid") throw new Error(`[WarmSessionStore] Ed25519 capability state=${state} with resolved material`);
-		if (!args.auth) throw new Error(`[WarmSessionStore] Ed25519 capability state=${state} requires active authorization`);
-		return {
-			capability: "ed25519",
-			runtime,
-			auth: args.auth,
-			prfClaim: args.prfClaim,
-			state
-		};
-	}
-	/** Canonical ECDSA warm state. The manifest and sealed runtime prove exact
-	* material; the active reusable Wallet Session is the independent second
-	* proof. Absent authorization over resolved material is authorization_required
-	* with no lane, because a SelectedEcdsaLane embeds that authorization. */
-	function buildEcdsaCapabilityState(args) {
-		if (args.resolution.kind === "blocked") {
-			const reason = args.resolution.reason;
-			if (reason === "missing_capability" || reason === "missing_material") return {
-				capability: "ecdsa",
-				manifest: null,
-				runtime: null,
-				key: null,
-				lane: null,
-				auth: null,
-				prfClaim: null,
-				state: "missing"
-			};
-			return {
-				capability: "ecdsa",
-				manifest: null,
-				runtime: null,
-				key: null,
-				lane: null,
-				auth: null,
-				prfClaim: null,
-				invalidReason: reason,
-				state: "invalid"
-			};
-		}
-		const { manifest, runtime } = args.resolution;
-		const publicFacts = manifest.durableMaterial.roleLocalPublicFacts;
-		const key = buildBaseEvmFamilyEcdsaKeyIdentity({
-			walletId: runtime.walletId,
-			ecdsaThresholdKeyId: runtime.ecdsaThresholdKeyId,
-			signingRootId: String(publicFacts.signingRootId),
-			signingRootVersion: String(publicFacts.signingRootVersion),
-			participantIds: [...runtime.participantIds],
-			thresholdOwnerAddress: String(publicFacts.ethereumAddress)
-		});
-		const authBinding = runtime.authBinding;
-		const state = deriveEcdsaCapabilityState({
-			runtime,
-			auth: args.authorization,
-			prfClaim: args.prfClaim,
-			emailOtpAuthContext: null
-		});
-		if (state === "authorization_required") return {
-			capability: "ecdsa",
-			manifest,
-			runtime,
-			key,
-			lane: null,
-			auth: null,
-			prfClaim: args.prfClaim,
-			emailOtpAuthContext: null,
-			state
-		};
-		if (!args.authorization) throw new Error("[WarmSessionStore] ECDSA capability without authorization must be authorization_required");
-		if (state === "missing" || state === "invalid") throw new Error(`[WarmSessionStore] ECDSA capability state=${state} with resolved material`);
-		const lane = selectedEcdsaLane({
-			key,
-			materialActivation: runtime.materialActivation,
-			keyHandle: runtime.keyHandle,
-			walletId: runtime.walletId,
-			auth: signingLaneAuthBindingFromEcdsaRuntime(authBinding),
-			authorization: args.authorization,
-			chainTarget: runtime.chainTarget
-		});
-		if (state === "ready" || state === "material_pending") {
-			if (!args.prfClaim || args.prfClaim.state !== "warm") throw new Error(`[WarmSessionStore] ECDSA capability state=${state} requires a warm PRF claim`);
-			return {
-				capability: "ecdsa",
-				manifest,
-				runtime,
-				key,
-				lane,
-				auth: args.authorization,
-				prfClaim: args.prfClaim,
-				state
-			};
-		}
-		if (state === "auth_missing") return {
-			capability: "ecdsa",
-			manifest,
-			runtime,
-			key,
-			lane,
-			auth: null,
-			prfClaim: args.prfClaim,
-			state
-		};
-		return {
-			capability: "ecdsa",
-			manifest,
-			runtime,
-			key,
-			lane,
-			auth: args.authorization,
-			prfClaim: args.prfClaim,
-			state
-		};
-	}
-	async function getWarmSession(walletId) {
-		const normalizedWalletId = toWalletId(walletId);
-		const [ed25519Resolution, ed25519Authorization, evmResolution, tempoResolution] = await Promise.all([
-			resolveExactEd25519SealedSessionRuntimeForWallet(normalizedWalletId),
-			resolveEd25519AuthorizationForWallet(normalizedWalletId),
-			deps.resolveActiveEcdsaCapabilityRuntimeForChain({
-				walletId: normalizedWalletId,
-				chain: "evm"
-			}),
-			deps.resolveActiveEcdsaCapabilityRuntimeForChain({
-				walletId: normalizedWalletId,
-				chain: "tempo"
-			})
-		]);
-		const [evmAuthorization, tempoAuthorization] = await Promise.all([resolveEcdsaAuthorizationForResolution({
-			resolve: deps.resolveActiveEcdsaWalletSessionAuthorization,
-			walletId: normalizedWalletId,
-			resolution: evmResolution
-		}), resolveEcdsaAuthorizationForResolution({
-			resolve: deps.resolveActiveEcdsaWalletSessionAuthorization,
-			walletId: normalizedWalletId,
-			resolution: tempoResolution
-		})]);
-		return assertWarmSessionEnvelopeInvariant({
-			walletId: normalizedWalletId,
-			capabilities: {
-				ed25519: buildEd25519CapabilityState({
-					resolution: ed25519Resolution,
-					auth: ed25519Authorization,
-					prfClaim: ed25519Resolution.kind === "resolved" ? await deps.statusReader.readEd25519WarmSessionClaim(ed25519Resolution.runtime) : null
-				}),
-				ecdsa: {
-					evm: buildEcdsaCapabilityState({
-						resolution: evmResolution,
-						prfClaim: ecdsaClaimForResolution(evmResolution),
-						authorization: evmAuthorization
-					}),
-					tempo: buildEcdsaCapabilityState({
-						resolution: tempoResolution,
-						prfClaim: ecdsaClaimForResolution(tempoResolution),
-						authorization: tempoAuthorization
-					})
-				}
-			},
-			updatedAtMs: Date.now()
-		});
-	}
-	/** The lane names its own wallet and chain target, so material is selected by
-	* the capability it belongs to. The authorization the lane already carries is
-	* the one this capability is read under -- re-resolving it for the wallet
-	* could answer with a different Wallet Session than the caller holds. */
-	async function getEcdsaCapabilityForLane(args) {
-		const resolution = await deps.resolveActiveEcdsaCapabilityRuntime({
-			walletId: args.lane.signer.walletId,
-			chainTarget: args.lane.signer.chainTarget
-		});
-		return buildEcdsaCapabilityState({
-			resolution,
-			prfClaim: ecdsaClaimForResolution(resolution),
-			authorization: args.authorization
-		});
-	}
-	function ecdsaSealConfig() {
-		if (deps.signingSessionSeal.seal !== "configured") return { groupId: "" };
-		return { groupId: String(deps.signingSessionSeal.groupId || "").trim() };
-	}
-	/** Seal parameters come from configuration alone. The sealed record's own
-	* `keyVersion` seals that record's secret at rest and is not the signing
-	* session's transport seal; the two must not be interchanged. */
-	async function resolveEcdsaSealTransportForLane(args) {
-		const resolution = await deps.resolveActiveEcdsaCapabilityRuntime({
-			walletId: args.lane.signer.walletId,
-			chainTarget: args.lane.signer.chainTarget
-		});
-		if (resolution.kind !== "resolved") return null;
-		const seal = ecdsaSealConfig();
-		return resolveEcdsaSealTransport({
-			runtime: resolution.runtime,
-			auth: args.authorization,
-			groupId: seal.groupId
-		});
-	}
-	return {
-		getWarmSession,
-		getEcdsaCapabilityForLane,
-		resolveEcdsaSealTransportForLane
-	};
-}
-//#endregion
-export { createWarmSessionCapabilityReaderCore };
-
-//# sourceMappingURL=capabilityReaderCore.js.map

package/dist/esm/core/signingEngine/session/warmCapabilities/clearVolatileWarmSigningMaterial.js

@@ -1,44 +0,0 @@
-import { parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { listExactSealedSessionsForWallet } from "../persistence/sealedSessionStore.js";
-import { createClearAllVolatileWarmSessionMaterialCommand, createClearVolatileWarmSessionMaterialCommand } from "./volatileWarmMaterialCommands.js";
-//#region src/core/signingEngine/session/warmCapabilities/clearVolatileWarmSigningMaterial.ts
-function hasVolatileWarmSessionMaterialClearAll(value) {
-	return typeof value?.clearAllVolatileWarmSessionMaterial === "function";
-}
-function hasVolatileWarmSessionMaterialClearer(value) {
-	return typeof value?.clearVolatileWarmSessionMaterial === "function";
-}
-async function collectWarmSigningSessionIdsForWallet(walletId) {
-	const thresholdSessionIds = /* @__PURE__ */ new Set();
-	const records = await Promise.all([listExactSealedSessionsForWallet({
-		walletId,
-		filter: {
-			authMethod: "passkey",
-			curve: "ed25519"
-		}
-	}), listExactSealedSessionsForWallet({
-		walletId,
-		filter: {
-			authMethod: "email_otp",
-			curve: "ed25519"
-		}
-	})]);
-	for (const record of records.flat()) {
-		const thresholdSessionId = parseThresholdEd25519SessionId(record.thresholdSessionIds.ed25519);
-		if (thresholdSessionId.ok) thresholdSessionIds.add(thresholdSessionId.value);
-	}
-	return [...thresholdSessionIds];
-}
-async function clearVolatileWarmSigningMaterial(deps, walletId) {
-	if (walletId == null && hasVolatileWarmSessionMaterialClearAll(deps.touchConfirm)) {
-		await deps.touchConfirm.clearAllVolatileWarmSessionMaterial(createClearAllVolatileWarmSessionMaterialCommand()).catch(() => void 0);
-		return;
-	}
-	const thresholdSessionIds = walletId != null ? await collectWarmSigningSessionIdsForWallet(walletId) : [];
-	if (!hasVolatileWarmSessionMaterialClearer(deps.touchConfirm)) return;
-	await Promise.all(thresholdSessionIds.map((thresholdSessionId) => deps.clearVolatileThresholdSessionMaterial(createClearVolatileWarmSessionMaterialCommand(thresholdSessionId)).catch(() => void 0)));
-}
-//#endregion
-export { clearVolatileWarmSigningMaterial };
-
-//# sourceMappingURL=clearVolatileWarmSigningMaterial.js.map

package/dist/esm/core/signingEngine/session/warmCapabilities/ecdsaBootstrapPersistence.js

@@ -1,107 +0,0 @@
-import { SIGNER_KINDS } from "../../../../shared-ts/src/utils/signerDomain.js";
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { resolveThresholdSigningRootBindingFromRecord } from "../identity/evmFamilyEcdsaIdentity.js";
-import { normalizeIndexedDbAccountAddress, toIndexedDbChainTargetKey } from "../../../indexedDB/normalization.js";
-//#region src/core/signingEngine/session/warmCapabilities/ecdsaBootstrapPersistence.ts
-function roleLocalMaterialRefFromBootstrap(binding) {
-	if (!binding) return null;
-	switch (binding.materialKind) {
-		case "role_local_worker_handle": return binding.roleLocalMaterialRef;
-		case "role_local_durable_sealed_ref": return binding.roleLocalMaterialRef;
-		case "role_local_durable_public_anchor":
-		case "role_local_ready_state_blob":
-		case "metadata_only": return null;
-	}
-}
-function ecdsaBootstrapSignerActivation(args) {
-	const keyRef = args.bootstrap.thresholdEcdsaKeyRef;
-	const keyHandle = keyRef.keyHandle;
-	const ecdsaThresholdKeyId = keyRef.ecdsaThresholdKeyId;
-	const ecdsaRoleLocalReadyRecord = keyRef.backendBinding?.ecdsaRoleLocalReadyRecord;
-	const ecdsaRoleLocalPublicFacts = keyRef.backendBinding?.materialKind === "role_local_worker_handle" ? keyRef.backendBinding.publicFacts : ecdsaRoleLocalReadyRecord?.publicFacts;
-	if (!ecdsaRoleLocalPublicFacts) throw new Error("[SigningEngine] threshold-ecdsa bootstrap did not provide role-local public facts");
-	const signingRootBinding = resolveThresholdSigningRootBindingFromRecord({ record: {
-		signingRootId: ecdsaRoleLocalPublicFacts.signingRootId,
-		signingRootVersion: ecdsaRoleLocalPublicFacts.signingRootVersion
-	} });
-	const signingRootId = String(signingRootBinding.signingRootId);
-	const signingRootVersion = String(signingRootBinding.signingRootVersion);
-	const thresholdOwnerAddress = normalizeIndexedDbAccountAddress(keyRef.ethereumAddress);
-	if (!thresholdOwnerAddress) throw new Error("[SigningEngine] threshold-ecdsa bootstrap did not provide a threshold owner address");
-	const thresholdEcdsaPublicKeyB64u = keyRef.thresholdEcdsaPublicKeyB64u;
-	const relayerKeyId = keyRef.backendBinding.relayerKeyId;
-	const relayerVerifyingShareB64u = keyRef.relayerVerifyingShareB64u;
-	const participantIds = keyRef.participantIds;
-	const chainIdKey = toIndexedDbChainTargetKey(args.chainTarget);
-	const roleLocalMaterialRef = roleLocalMaterialRefFromBootstrap(keyRef.backendBinding);
-	const metadata = {
-		accountModel: "threshold-ecdsa",
-		accountAddress: thresholdOwnerAddress,
-		ownerAddress: thresholdOwnerAddress,
-		thresholdOwnerAddress,
-		keyScope: "evm-family",
-		keyHandle,
-		walletId: args.walletId,
-		ecdsaThresholdKeyId,
-		signingRootId,
-		signingRootVersion,
-		relayerKeyId,
-		relayerVerifyingShareB64u,
-		thresholdEcdsaPublicKeyB64u,
-		participantIds,
-		publicCapability: ecdsaRoleLocalPublicFacts.publicCapability,
-		ecdsaRoleLocalPublicFacts,
-		chainTarget: args.chainTarget,
-		targetMembership: {
-			targetKey: chainIdKey,
-			chainTarget: args.chainTarget
-		},
-		sharedEvmFamilyKey: {
-			walletId: args.walletId,
-			keyScope: "evm-family",
-			keyHandle,
-			ecdsaThresholdKeyId,
-			signingRootId,
-			signingRootVersion,
-			participantIds,
-			thresholdOwnerAddress,
-			thresholdEcdsaPublicKeyB64u
-		},
-		chainId: args.chainTarget.chainId
-	};
-	if (roleLocalMaterialRef) metadata.roleLocalMaterialRef = roleLocalMaterialRef;
-	return {
-		account: {
-			profileId: args.walletId,
-			chainIdKey,
-			accountAddress: thresholdOwnerAddress,
-			accountModel: "threshold-ecdsa"
-		},
-		signer: {
-			signerId: thresholdOwnerAddress,
-			signerType: "threshold",
-			signerKind: SIGNER_KINDS.thresholdEcdsa,
-			signerAuthMethod: args.signerAuth.authMethod,
-			signerSource: args.signerAuth.signerSource,
-			metadata
-		},
-		activationPolicy: { mode: "allocate_next_free" },
-		preferredSlot: 1,
-		selectAsActive: false,
-		mutation: { routeThroughOutbox: false }
-	};
-}
-async function persistThresholdEcdsaBootstrapForWalletTarget(args) {
-	const walletId = toWalletId(args.walletId);
-	await args.bootstrapStore.upsertProfile({ profileId: walletId });
-	await args.bootstrapStore.activateAccountSigner(ecdsaBootstrapSignerActivation({
-		walletId,
-		chainTarget: args.chainTarget,
-		bootstrap: args.bootstrap,
-		signerAuth: args.signerAuth
-	}));
-}
-//#endregion
-export { persistThresholdEcdsaBootstrapForWalletTarget };
-
-//# sourceMappingURL=ecdsaBootstrapPersistence.js.map

package/dist/esm/core/signingEngine/session/warmCapabilities/ecdsaBootstrapQueue.js

@@ -1,22 +0,0 @@
-//#region src/core/signingEngine/session/warmCapabilities/ecdsaBootstrapQueue.ts
-async function withThresholdEcdsaBootstrapQueue(queueByWallet, walletId, task) {
-	const walletKey = String(walletId);
-	const waitForPrevious = (queueByWallet.get(walletKey) || Promise.resolve()).catch(() => void 0);
-	let release;
-	const gate = new Promise((resolve) => {
-		release = resolve;
-	});
-	const next = waitForPrevious.then(() => gate);
-	queueByWallet.set(walletKey, next);
-	await waitForPrevious;
-	try {
-		return await task();
-	} finally {
-		release();
-		if (queueByWallet.get(walletKey) === next) queueByWallet.delete(walletKey);
-	}
-}
-//#endregion
-export { withThresholdEcdsaBootstrapQueue };
-
-//# sourceMappingURL=ecdsaBootstrapQueue.js.map

package/dist/esm/core/signingEngine/session/warmCapabilities/ecdsaLoginPrefill.js

@@ -1,93 +0,0 @@
-import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseEcdsaClientVerifyingShareB64u, parseEcdsaKeyHandle } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
-import { parseEcdsaThresholdKeyId } from "../keyMaterialBrands.js";
-import { MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS } from "../../workerManager/ecdsaPresignLifecycle.js";
-import { resolveRouterAbEcdsaDerivationPresignaturePoolPolicy, scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill, waitForRouterAbEcdsaDerivationClientPresignaturePoolReady } from "../../routerAb/ecdsaDerivation/presignaturePool.js";
-//#region src/core/signingEngine/session/warmCapabilities/ecdsaLoginPrefill.ts
-async function scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill(deps, args) {
-	const { runtime, session, operationCredential } = args.capability.authorization;
-	const walletSessionId = operationCredential.walletSessionId;
-	try {
-		const relayerUrl = runtime.relayerUrl;
-		const clientVerifyingPublicKey33B64u = runtime.clientVerifyingPublicKey33B64u;
-		const nowMs = Date.now();
-		const routerAbPoolFillExpiresAtMs = Math.min(runtime.expiresAtMs, session.expiresAtMs);
-		if (routerAbPoolFillExpiresAtMs <= nowMs) return {
-			status: "skipped",
-			reason: "session_expired",
-			walletSessionId
-		};
-		const policy = resolveRouterAbEcdsaDerivationPresignaturePoolPolicy(deps.routerAbEcdsaDerivationPresignaturePoolPolicy);
-		if (!policy.enabled) return {
-			status: "skipped",
-			reason: "pool_disabled",
-			walletSessionId
-		};
-		const remainingUsesBefore = runtime.remainingUses;
-		const routerAbEcdsaDerivationPoolFill = {
-			kind: "router_ab_ecdsa_derivation_signing_worker_pool",
-			scope: runtime.normalSigning.scope,
-			ceremonyExpiresAtMs: routerAbPoolFillExpiresAtMs,
-			materialExpiresAtMs: nowMs + MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS
-		};
-		const clientSigningMaterial = deps.resolveClientSigningMaterialSource({ manifest: args.capability.capability.manifest });
-		const schedule = scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill({
-			relayerUrl,
-			keyHandle: parseEcdsaKeyHandle(runtime.keyHandle),
-			ecdsaThresholdKeyId: parseEcdsaThresholdKeyId(runtime.ecdsaThresholdKeyId),
-			clientVerifyingShareB64u: parseEcdsaClientVerifyingShareB64u(clientVerifyingPublicKey33B64u),
-			clientSigningMaterial,
-			thresholdEcdsaPublicKeyB64u: runtime.thresholdEcdsaPublicKeyB64u,
-			relayerVerifyingShareB64u: runtime.normalSigning.scope.public_identity.server_public_key33_b64u,
-			credential: {
-				kind: "wallet_session_opaque",
-				walletSessionToken: operationCredential.token
-			},
-			authorization: {
-				kind: "reusable_wallet_session",
-				wallet_session_id: operationCredential.walletSessionId
-			},
-			materialActivation: routerAbMpcMaterialActivationRefToWire(runtime.materialActivation),
-			routerAbEcdsaDerivationPoolFill,
-			workerCtx: deps.getSignerWorkerContext(),
-			poolPolicy: policy
-		});
-		if (!schedule.scheduled) {
-			if (args.waitForPoolReady && schedule.reason === "in_flight_for_pool_key") await waitForRouterAbEcdsaDerivationClientPresignaturePoolReady({
-				relayerUrl,
-				scope: runtime.normalSigning.scope,
-				materialActivation: routerAbMpcMaterialActivationRefToWire(runtime.materialActivation)
-			});
-			return {
-				status: "skipped",
-				reason: "refill_not_scheduled",
-				walletSessionId,
-				remainingUses: remainingUsesBefore,
-				schedule
-			};
-		}
-		if (args.waitForPoolReady) await waitForRouterAbEcdsaDerivationClientPresignaturePoolReady({
-			relayerUrl,
-			scope: runtime.normalSigning.scope,
-			materialActivation: routerAbMpcMaterialActivationRefToWire(runtime.materialActivation)
-		});
-		return {
-			status: "scheduled",
-			reason: "scheduled",
-			walletSessionId,
-			remainingUses: remainingUsesBefore,
-			schedule
-		};
-	} catch (error) {
-		return {
-			status: "failed",
-			reason: "unexpected_error",
-			walletSessionId,
-			error: error instanceof Error ? error.message : "unexpected error"
-		};
-	}
-}
-//#endregion
-export { scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill };
-
-//# sourceMappingURL=ecdsaLoginPrefill.js.map

package/dist/esm/core/signingEngine/session/warmCapabilities/ecdsaLoginPrefillSigningMaterialSource.js

@@ -1,50 +0,0 @@
-import { thresholdEcdsaListAvailablePresignaturesWasm, thresholdEcdsaRoleLocalAdmitPresignatureWasm, thresholdEcdsaRoleLocalCommitPresignatureWasm, thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, thresholdEcdsaRoleLocalDestroyPresignatureWasm, thresholdEcdsaRoleLocalPresignSessionAbortWasm, thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, thresholdEcdsaRoleLocalPresignSessionStepWasm, thresholdEcdsaRoleLocalReservePresignatureWasm } from "../../threshold/crypto/ecdsaDerivationClientWasm.js";
-import { ecdsaRoleLocalPersistedMaterialSource, resolveEcdsaRoleLocalMaterial } from "../material/ecdsaRoleLocalMaterialResolver.js";
-//#region src/core/signingEngine/session/warmCapabilities/ecdsaLoginPrefillSigningMaterialSource.ts
-function requireResolvedLoginPrefillMaterial(resolution) {
-	switch (resolution.kind) {
-		case "rehydrated": return resolution;
-		case "device_link_required": throw new Error("ECDSA login prefill requires local role-local material");
-		case "corrupt": throw new Error(`ECDSA login prefill role-local material is corrupt (${resolution.reason}): ${resolution.message}`);
-		default: {
-			const exhaustive = resolution;
-			throw new Error(`Unsupported ECDSA login prefill material state: ${String(exhaustive)}`);
-		}
-	}
-}
-function createEcdsaLoginPrefillClientSigningMaterialSource(args) {
-	return {
-		kind: "router_ab_ecdsa_derivation_client_signing_material_source_v1",
-		initClientPresignSession: async (input) => {
-			const resolvedMaterial = requireResolvedLoginPrefillMaterial(await resolveEcdsaRoleLocalMaterial({
-				purpose: "wallet_unlock",
-				source: ecdsaRoleLocalPersistedMaterialSource({
-					authority: args.manifest.signer.authority,
-					materialActivation: args.manifest.durableMaterial.materialActivation,
-					publicFacts: args.manifest.durableMaterial.roleLocalPublicFacts
-				}),
-				workerCtx: input.workerCtx
-			}));
-			return await thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm({
-				materialHandle: resolvedMaterial.liveHandle.materialHandle,
-				material: {
-					kind: "persisted",
-					materialRef: resolvedMaterial.materialRef
-				},
-				...input
-			});
-		},
-		stepClientPresignSession: thresholdEcdsaRoleLocalPresignSessionStepWasm,
-		abortClientPresignSession: thresholdEcdsaRoleLocalPresignSessionAbortWasm,
-		admitClientPresignature: thresholdEcdsaRoleLocalAdmitPresignatureWasm,
-		destroyClientPresignature: thresholdEcdsaRoleLocalDestroyPresignatureWasm,
-		reserveClientPresignature: thresholdEcdsaRoleLocalReservePresignatureWasm,
-		commitClientPresignature: thresholdEcdsaRoleLocalCommitPresignatureWasm,
-		listAvailableClientPresignatures: thresholdEcdsaListAvailablePresignaturesWasm.bind(void 0, "role_local_derivation_handle"),
-		computeSignatureShareFromPresignatureHandle: thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm
-	};
-}
-//#endregion
-export { createEcdsaLoginPrefillClientSigningMaterialSource };
-
-//# sourceMappingURL=ecdsaLoginPrefillSigningMaterialSource.js.map

package/dist/esm/core/signingEngine/session/warmCapabilities/ecdsaProvisionPlan.js

@@ -1,9 +0,0 @@
-import { SigningSessionIds } from "../operationState/types.js";
-//#region src/core/signingEngine/session/warmCapabilities/ecdsaProvisionPlan.ts
-function buildEcdsaSessionIdentity(args) {
-	return { thresholdSessionId: SigningSessionIds.thresholdEcdsaSession(args.thresholdSessionId) };
-}
-//#endregion
-export { buildEcdsaSessionIdentity };
-
-//# sourceMappingURL=ecdsaProvisionPlan.js.map