@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/signingEngine/uiConfirm/PasskeyMpcSessionManager.js

@@ -1,746 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
-import { thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, toWalletId } from "../interfaces/ecdsaChainTarget.js";
-import { parseSigningSessionSealKeyVersion } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
-import { walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { walletSessionAuthorizations } from "../../indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { resolveThresholdCommitQueueKey } from "../threshold/commitQueueShared.js";
-import { materialActivationKey } from "../session/sealedRecovery/materialActivationKey.js";
-import { createDeleteDurableSealedSessionCommand } from "../session/persistence/durableSealedSessionCommands.js";
-import { acquireSigningSessionRestoreLease, deleteDurableSealedSessionRecord, listExactSealedSessionsForWallet, releaseSigningSessionRestoreLease } from "../session/persistence/sealedSessionStore.js";
-import { IndexedDBManager } from "../../indexedDB/index.js";
-import { withThresholdEcdsaSigningQueue } from "../threshold/ecdsa/signingQueue.js";
-import { parseUserConfirmWorkerResponse } from "../../types/secure-confirm-worker.js";
-import BUILD_PATHS from "../../../build-paths.js";
-import { resolveWorkerUrl } from "../../walletRuntimePaths/workers.js";
-import { warmSessionProtocolSessionId } from "../session/emailOtp/sealedRuntimePurpose.js";
-import { parseClearVolatileWarmMaterialCommand } from "../session/warmCapabilities/volatileWarmMaterialCommands.js";
-import { discoverPersistedSessionsForWalletCommand, restorePersistedSessionForSigningCommand } from "../session/sealedRecovery/restoreCoordinator.js";
-import { restorePasskeyEcdsaSealedRecordForWallet } from "../session/passkey/ecdsaRecovery.js";
-import { PasskeyMpcSessionDurableState } from "./PasskeyMpcSessionDurableState.js";
-//#region src/core/signingEngine/uiConfirm/PasskeyMpcSessionManager.ts
-const PASSKEY_MPC_SESSION_TIMEOUT_MS = 6e4;
-const PASSKEY_MPC_SESSION_STARTUP_TIMEOUT_MS = 15e3;
-const signingSessionRehydrateSingleFlight = /* @__PURE__ */ new Map();
-const signingSessionDeleteSingleFlight = /* @__PURE__ */ new Map();
-function restoreSingleFlightKey(args) {
-	return [
-		"rehydrate",
-		"passkey",
-		"ecdsa",
-		thresholdEcdsaChainTargetKey(args.chainTarget),
-		materialActivationKey(args.materialActivation),
-		String(args.thresholdSessionId || "").trim()
-	].join("|");
-}
-function requirePasskeyEcdsaRestoreOutcome(result, success) {
-	if (!result) return "deferred";
-	if (result.ok) return success;
-	if (result.code === "exhausted") return "ready";
-	if (result.code === "expired") return "deferred";
-	throw new Error(`[PasskeyMpcSession] sealed-session restore failed (${result.code}): ${result.message}`);
-}
-async function passkeyEcdsaRestoreMetadataFromRecoveryRecord(record) {
-	return {
-		chainTarget: record.chainTarget,
-		signingRootId: record.signingRootId,
-		signingRootVersion: record.signingRootVersion,
-		source: record.source,
-		authority: await walletAuthAuthorityRef({ authority: record.authority }),
-		roleLocalMaterialRef: record.roleLocalMaterialRef,
-		rpId: record.authority.verifier.rpId,
-		credentialIdB64u: record.authority.factor.credentialIdB64u,
-		keyHandle: record.keyHandle,
-		ecdsaThresholdKeyId: record.ecdsaThresholdKeyId,
-		ethereumAddress: record.ethereumAddress,
-		relayerKeyId: record.relayerKeyId,
-		clientVerifyingShareB64u: record.clientVerifyingShareB64u,
-		thresholdEcdsaPublicKeyB64u: record.thresholdEcdsaPublicKeyB64u,
-		participantIds: [...record.participantIds],
-		...record.runtimePolicyScope ? { runtimePolicyScope: record.runtimePolicyScope } : {},
-		routerAbEcdsaDerivationNormalSigning: record.routerAbEcdsaDerivationNormalSigning,
-		publicCapability: record.publicCapability
-	};
-}
-function hasExactEcdsaSigningSubject(args) {
-	return args.session.capabilitySubjects.some((subject) => subject.kind === "sign" && subject.keyFamily === "ecdsa_secp256k1" && mpcMaterialActivationRefsEqual(subject.materialActivation, args.materialActivation));
-}
-async function readExactPasskeyRestoreCredential(args) {
-	const walletId = toWalletId(args.walletId);
-	let selected;
-	try {
-		selected = await IndexedDBManager.resolveSelectedWalletAuthority(String(walletId));
-	} catch {
-		return null;
-	}
-	if (selected.kind !== "resolved") return null;
-	const { selection, authMethod, authority } = selected;
-	if (selection.lockState !== "unlocked" || selection.walletId !== walletId || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || authMethod.kind !== "passkey" || authMethod.status !== "active" || authMethod.walletId !== walletId || authMethod.walletAuthorityId !== authority.authorityId || authMethod.walletAuthMethodId !== args.factorAuthority.bindingId || authMethod.rpId !== args.factorAuthority.verifier.rpId || authMethod.credentialIdB64u !== args.factorAuthority.factor.credentialIdB64u || authority.state !== "active" || authority.walletId !== walletId) return null;
-	let read;
-	try {
-		read = await walletSessionAuthorizations.readExactWithOperationCredential({
-			walletId,
-			authorityId: authority.authorityId,
-			authMethodId: authMethod.walletAuthMethodId
-		});
-	} catch {
-		return null;
-	}
-	if (read.kind !== "found" || read.record.walletId !== walletId || read.record.authorityId !== authority.authorityId || read.record.authMethodId !== authMethod.walletAuthMethodId || read.record.authorityDigestB64u !== authority.authorityDigestB64u || read.record.authorityRevocationEpoch !== authority.revocationEpoch || read.record.expiresAtMs <= args.nowMs || !hasExactEcdsaSigningSubject({
-		session: read.record,
-		materialActivation: args.materialActivation
-	})) return null;
-	return read.operationCredential;
-}
-async function deleteInvalidPasskeyEcdsaRecord(args) {
-	const command = createDeleteDurableSealedSessionCommand({
-		durableRecord: {
-			authMethod: "passkey",
-			curve: "ecdsa",
-			thresholdSessionId: args.thresholdSessionId,
-			chainTarget: args.chainTarget
-		},
-		deleteReason: "invalid_persisted_record",
-		preserveResolvedIdentity: false
-	});
-	const key = [
-		"delete",
-		"passkey",
-		"ecdsa",
-		thresholdEcdsaChainTargetKey(args.chainTarget),
-		args.thresholdSessionId
-	].join("|");
-	const inFlight = signingSessionDeleteSingleFlight.get(key);
-	if (inFlight) return await inFlight;
-	const task = deleteDurableSealedSessionRecord(command).finally(() => {
-		signingSessionDeleteSingleFlight.delete(key);
-	});
-	signingSessionDeleteSingleFlight.set(key, task);
-	await task;
-}
-async function listPasskeySealedSessionsForWallet(args) {
-	return await listExactSealedSessionsForWallet({
-		walletId: args.walletId,
-		filter: {
-			authMethod: "passkey",
-			curve: "ecdsa",
-			chainTarget: args.chainTarget
-		}
-	});
-}
-function logPasskeyRestoreListError(args) {
-	console.warn("[PasskeyMpcSession] signing-session restore list failed", {
-		walletId: args.walletId,
-		target: args.target,
-		reason: args.reason,
-		error: args.error instanceof Error ? args.error.message : String(args.error || "unknown error")
-	});
-}
-function logPasskeyRejectedRestoreRecord(args) {
-	console.warn("[PasskeyMpcSession] signing-session restore rejected record", args);
-}
-function isObjectRecord(value) {
-	return typeof value === "object" && value !== null;
-}
-function positiveInteger(value) {
-	const parsed = Math.floor(Number(value));
-	return Number.isFinite(parsed) && parsed > 0 ? parsed : 0;
-}
-function isNonnegativeSafeInteger(value) {
-	return Number.isSafeInteger(value) && Number(value) >= 0;
-}
-function isPositiveSafeInteger(value) {
-	return Number.isSafeInteger(value) && Number(value) > 0;
-}
-function parseWarmSessionStatusResult(data) {
-	if (!isObjectRecord(data) || typeof data.ok !== "boolean") return null;
-	if (!data.ok) return {
-		ok: false,
-		code: typeof data.code === "string" ? data.code : "worker_error",
-		message: typeof data.message === "string" ? data.message : "Warm-session status read failed"
-	};
-	if (!isNonnegativeSafeInteger(data.remainingUses) || !isPositiveSafeInteger(data.expiresAtMs)) return null;
-	return {
-		ok: true,
-		remainingUses: data.remainingUses,
-		expiresAtMs: data.expiresAtMs
-	};
-}
-function parseWarmSessionStatusBatchResult(data) {
-	if (!isObjectRecord(data) || !Array.isArray(data.results)) return null;
-	const results = [];
-	for (const entry of data.results) {
-		if (!isObjectRecord(entry) || typeof entry.thresholdSessionId !== "string" || !entry.thresholdSessionId.trim()) return null;
-		const result = parseWarmSessionStatusResult(entry.result);
-		if (!result) return null;
-		results.push({
-			thresholdSessionId: entry.thresholdSessionId,
-			result
-		});
-	}
-	return { results };
-}
-function parseWarmSessionClaimResult(data) {
-	if (!isObjectRecord(data) || typeof data.ok !== "boolean") return null;
-	if (!data.ok) return {
-		ok: false,
-		code: typeof data.code === "string" ? data.code : "worker_error",
-		message: typeof data.message === "string" ? data.message : "Warm-session claim failed"
-	};
-	if (typeof data.prfFirstB64u !== "string" || !data.prfFirstB64u.trim() || !isNonnegativeSafeInteger(data.remainingUses) || !isPositiveSafeInteger(data.expiresAtMs)) return null;
-	return {
-		ok: true,
-		prfFirstB64u: data.prfFirstB64u,
-		remainingUses: data.remainingUses,
-		expiresAtMs: data.expiresAtMs
-	};
-}
-function parseWarmSessionSealAndPersistResult(data) {
-	if (!isObjectRecord(data) || typeof data.ok !== "boolean") return null;
-	if (!data.ok) return {
-		ok: false,
-		code: typeof data.code === "string" ? data.code : "worker_error",
-		message: typeof data.message === "string" ? data.message : "Signing-session seal and persist failed"
-	};
-	if (typeof data.sealedSecretB64u !== "string" || !data.sealedSecretB64u.trim() || typeof data.keyVersion !== "string" || !data.keyVersion.trim() || !isNonnegativeSafeInteger(data.remainingUses) || !isPositiveSafeInteger(data.expiresAtMs)) return null;
-	const diagnostics = isObjectRecord(data.diagnostics) ? {
-		runtimeSetupMs: positiveInteger(data.diagnostics.runtimeSetupMs),
-		clientSealMs: positiveInteger(data.diagnostics.clientSealMs),
-		serverSealRouteMs: positiveInteger(data.diagnostics.serverSealRouteMs),
-		clientUnsealMs: positiveInteger(data.diagnostics.clientUnsealMs),
-		policyUpdateMs: positiveInteger(data.diagnostics.policyUpdateMs)
-	} : void 0;
-	return {
-		ok: true,
-		sealedSecretB64u: data.sealedSecretB64u,
-		keyVersion: data.keyVersion.trim(),
-		remainingUses: data.remainingUses,
-		expiresAtMs: data.expiresAtMs,
-		...diagnostics ? { diagnostics } : {}
-	};
-}
-function requirePasskeySealTransport(transport) {
-	if (transport.authMethod === "email_otp" || transport.curve === "linked_device") throw new Error("Passkey MPC durable owner requires an owner signing-lane transport");
-	return transport;
-}
-function roundDurationMs(startedAt) {
-	return Math.max(0, Math.round(performance.now() - startedAt));
-}
-function recordDiagnosticDuration(args) {
-	args.diagnostics?.recordDuration(args.bucket, roundDurationMs(args.startedAt));
-}
-var PasskeyMpcSessionManagerImpl = class {
-	constructor(deps) {
-		this.deps = deps;
-		this.worker = null;
-		this.initializationPromise = null;
-		this.messageId = 0;
-		this.pendingRequests = /* @__PURE__ */ new Map();
-		this.boundHandleWorkerMessage = this.handleWorkerMessage.bind(this);
-		this.boundHandleWorkerError = this.handleWorkerError.bind(this);
-		this.putWarmSessionMaterial = async (args) => {
-			const { diagnostics, preparedServerSeal, ...workerPayload } = args;
-			if (preparedServerSeal && !args.transport) throw new Error("Prepared server seal requires exact persistence transport");
-			const workerReadyStartedAt = performance.now();
-			await this.ensureWorkerReady();
-			recordDiagnosticDuration({
-				diagnostics,
-				bucket: "worker_ready",
-				startedAt: workerReadyStartedAt
-			});
-			const workerPutStartedAt = performance.now();
-			const response = await this.sendMessage({
-				type: "WARM_SESSION_MATERIAL_PUT",
-				id: this.generateMessageId(),
-				payload: workerPayload
-			});
-			if (!response.success) throw new Error(String(response.error || "Failed to cache warm-session material"));
-			const parsed = parseWarmSessionStatusResult(response.data);
-			if (!parsed) throw new Error("Warm-session cache returned an invalid response");
-			if (!parsed.ok) throw new Error(`Warm-session cache failed (${parsed.code}): ${parsed.message}`);
-			recordDiagnosticDuration({
-				diagnostics,
-				bucket: "worker_put",
-				startedAt: workerPutStartedAt
-			});
-			let completedSeal;
-			if (preparedServerSeal && args.transport) {
-				const completed = await this.sendMessage({
-					type: "COMPLETE_SESSION_CLIENT_SEAL",
-					id: this.generateMessageId(),
-					payload: {
-						preparationId: preparedServerSeal.preparationId,
-						thresholdSessionId: args.thresholdSessionId,
-						transport: requirePasskeySealTransport(args.transport),
-						serverSeal: {
-							ok: true,
-							ciphertext: preparedServerSeal.ciphertext,
-							keyVersion: preparedServerSeal.keyVersion,
-							expiresAtMs: preparedServerSeal.expiresAtMs,
-							remainingUses: preparedServerSeal.remainingUses
-						}
-					}
-				});
-				const parsed = completed.success ? parseWarmSessionSealAndPersistResult(completed.data) : null;
-				if (!parsed) {
-					const message = completed.success ? "Prepared signing-session seal returned an invalid response" : completed.error || "Prepared signing-session seal failed";
-					throw new Error(message);
-				}
-				if (!parsed.ok) throw new Error(`Prepared signing-session seal failed (${parsed.code}): ${parsed.message}`);
-				completedSeal = parsed;
-			}
-			const persistStartedAt = performance.now();
-			const persisted = args.transport ? await this.durableState.persistSigningSessionSealForThresholdSession({
-				thresholdSessionId: args.thresholdSessionId,
-				transport: requirePasskeySealTransport(args.transport),
-				...diagnostics ? { diagnostics } : {},
-				...completedSeal ? { completedSeal } : {}
-			}) : null;
-			recordDiagnosticDuration({
-				diagnostics,
-				bucket: "sealed_record_persist",
-				startedAt: persistStartedAt
-			});
-			if (persisted && !persisted.ok) throw new Error(`Warm-session cache could not persist sealed refresh material (${persisted.code}): ${persisted.message}`);
-		};
-		this.getWarmSessionStatus = async (args) => await this.readWarmSessionStatus(args);
-		this.discoverPersistedSessionsForWallet = async (args) => {
-			if (this.deps.signingSessionPersistenceMode !== "sealed_refresh_v1") return {
-				listed: 0,
-				discovered: 0,
-				truncated: 0
-			};
-			return await discoverPersistedSessionsForWalletCommand({
-				...args,
-				authMethod: "passkey"
-			}, {
-				listExactSealedSessionsForWallet: async (filter) => await listExactSealedSessionsForWallet({
-					walletId: filter.walletId,
-					filter: filter.curve === "ecdsa" ? {
-						authMethod: "passkey",
-						curve: "ecdsa",
-						chainTarget: filter.chainTarget
-					} : {
-						authMethod: "passkey",
-						curve: "ed25519"
-					}
-				}),
-				onListError: ({ walletId, error }) => {
-					console.warn("[PasskeyMpcSession] persisted-session discovery list failed", {
-						walletId,
-						error: error instanceof Error ? error.message : String(error || "unknown error")
-					});
-				},
-				onRejectedRecord: ({ walletId, rejection }) => {
-					console.warn("[PasskeyMpcSession] persisted-session discovery rejected record", {
-						walletId,
-						rejection
-					});
-				}
-			});
-		};
-		this.restorePersistedSessionForSigning = async (args) => {
-			if (this.deps.signingSessionPersistenceMode !== "sealed_refresh_v1") return {
-				kind: "completed",
-				attempted: 0,
-				restored: 0,
-				deferred: 0
-			};
-			return await restorePersistedSessionForSigningCommand({
-				...args,
-				authMethod: "passkey"
-			}, {
-				listExactSealedSessionsForWallet: listPasskeySealedSessionsForWallet,
-				restoreSealedRecordForWallet: this.restorePasskeySealedRecordForWallet,
-				onListError: logPasskeyRestoreListError,
-				onRejectedRecord: logPasskeyRejectedRestoreRecord
-			});
-		};
-		this.restorePasskeySealedRecordForWallet = async (args) => {
-			const { record, purpose } = args;
-			if (purpose.authMethod !== "passkey" || record.authMethod !== "passkey") return "deferred";
-			const thresholdSessionId = String(purpose.thresholdSessionId || "").trim();
-			const chainTarget = purpose.chainTarget;
-			if (!thresholdSessionId || record.curve !== "ecdsa" || !thresholdEcdsaChainTargetsEqual(record.chainTarget, chainTarget) || !mpcMaterialActivationRefsEqual(record.roleLocalMaterialRef.materialActivation, purpose.materialActivation)) return "deferred";
-			const singleFlightKey = restoreSingleFlightKey({
-				thresholdSessionId,
-				chainTarget,
-				materialActivation: purpose.materialActivation
-			});
-			const inFlight = signingSessionRehydrateSingleFlight.get(singleFlightKey);
-			if (inFlight) return requirePasskeyEcdsaRestoreOutcome(await inFlight, "ready");
-			const task = withThresholdEcdsaSigningQueue({
-				queueByKey: this.deps.thresholdEcdsaSigningQueueByKey,
-				queueKey: resolveThresholdCommitQueueKey({ materialActivation: record.roleLocalMaterialRef.materialActivation }),
-				walletId: toWalletId(args.walletId),
-				enabled: true,
-				task: async () => await this.restorePasskeyEcdsaRecord({
-					walletId: args.walletId,
-					record,
-					purpose: {
-						...purpose,
-						authMethod: "passkey"
-					}
-				})
-			}).finally(() => {
-				signingSessionRehydrateSingleFlight.delete(singleFlightKey);
-			});
-			signingSessionRehydrateSingleFlight.set(singleFlightKey, task);
-			return requirePasskeyEcdsaRestoreOutcome(await task, "restored");
-		};
-		this.getWarmSessionStatuses = async (args) => {
-			const thresholdSessionIds = Array.from(new Set(args.thresholdSessionIds.map((value) => String(value || "").trim()).filter(Boolean)));
-			if (!thresholdSessionIds.length) return { results: [] };
-			const response = await this.sendMessage({
-				type: "WARM_SESSION_STATUS_BATCH_READ",
-				id: this.generateMessageId(),
-				payload: { thresholdSessionIds }
-			});
-			if (response.success) {
-				const parsed = parseWarmSessionStatusBatchResult(response.data);
-				if (parsed) return parsed;
-			}
-			return { results: thresholdSessionIds.map((thresholdSessionId) => ({
-				thresholdSessionId,
-				result: {
-					ok: false,
-					code: "worker_error",
-					message: String(response.success ? "Warm-session batch status read failed" : response.error)
-				}
-			})) };
-		};
-		this.claimWarmSessionMaterial = async (args) => {
-			const thresholdSessionId = warmSessionProtocolSessionId(args);
-			const response = await this.sendMessage({
-				type: "WARM_SESSION_MATERIAL_CLAIM",
-				id: this.generateMessageId(),
-				payload: {
-					thresholdSessionId,
-					...typeof args.uses === "number" ? { uses: args.uses } : {},
-					...typeof args.consume === "boolean" ? { consume: args.consume } : {},
-					curve: args.purpose.curve
-				}
-			});
-			if (!response.success) return {
-				ok: false,
-				code: "worker_error",
-				message: response.error
-			};
-			const parsed = parseWarmSessionClaimResult(response.data);
-			if (!parsed) return {
-				ok: false,
-				code: "worker_error",
-				message: "Warm-session claim failed"
-			};
-			await this.recordWarmSessionPolicyResult(args.purpose, thresholdSessionId, parsed);
-			return parsed;
-		};
-		this.consumeWarmSessionUses = async (args) => {
-			const thresholdSessionId = warmSessionProtocolSessionId(args);
-			const response = await this.sendMessage({
-				type: "WARM_SESSION_MATERIAL_CONSUME",
-				id: this.generateMessageId(),
-				payload: {
-					thresholdSessionId,
-					...typeof args.uses === "number" ? { uses: args.uses } : {},
-					curve: args.purpose.curve
-				}
-			});
-			if (!response.success) return {
-				ok: false,
-				code: "worker_error",
-				message: response.error
-			};
-			const parsed = parseWarmSessionStatusResult(response.data);
-			if (!parsed) return {
-				ok: false,
-				code: "worker_error",
-				message: "Warm-session consume failed"
-			};
-			await this.recordWarmSessionPolicyResult(args.purpose, thresholdSessionId, parsed);
-			return parsed;
-		};
-		this.clearVolatileWarmSessionMaterial = async (args) => {
-			const command = parseClearVolatileWarmMaterialCommand(args);
-			if (command?.scope.kind !== "session") return;
-			if (!this.worker && !this.initializationPromise) return;
-			const response = await this.sendMessage({
-				type: "WARM_SESSION_VOLATILE_MATERIAL_CLEAR",
-				id: this.generateMessageId(),
-				payload: command
-			});
-			if (!response.success) throw new Error(String(response.error || "Failed to clear volatile warm-session material"));
-		};
-		this.clearAllVolatileWarmSessionMaterial = async (args) => {
-			const command = parseClearVolatileWarmMaterialCommand(args);
-			if (command?.scope.kind !== "all") return;
-			if (!this.worker && !this.initializationPromise) return;
-			const response = await this.sendMessage({
-				type: "WARM_SESSION_VOLATILE_MATERIAL_CLEAR_ALL",
-				id: this.generateMessageId(),
-				payload: command
-			});
-			if (!response.success) throw new Error(String(response.error || "Failed to clear all volatile warm-session material entries"));
-		};
-		this.persistSigningSessionSealForThresholdSession = async (args) => await this.durableState.persistSigningSessionSealForThresholdSession(args);
-		this.recordWarmSessionPolicyResult = async (purpose, thresholdSessionId, result) => await this.durableState.recordPolicyResult(purpose, thresholdSessionId, result);
-		this.durableState = new PasskeyMpcSessionDurableState({
-			signingSessionPersistenceMode: deps.signingSessionPersistenceMode,
-			sealAndPersistWarmSessionMaterial: this.sealAndPersistWarmSessionMaterial.bind(this),
-			readWarmSessionStatus: this.readWarmSessionStatus.bind(this)
-		});
-	}
-	setWorkerBaseOrigin(origin) {
-		this.workerBaseOrigin = origin;
-	}
-	async prewarmShamir3Pass() {
-		try {
-			await this.sendMessage({
-				type: "PREWARM_SHAMIR3PASS",
-				id: this.generateMessageId(),
-				payload: {}
-			}, PASSKEY_MPC_SESSION_STARTUP_TIMEOUT_MS);
-		} catch {}
-	}
-	async prepareSigningSessionHydration(input) {
-		const response = await this.sendMessage({
-			type: "PREPARE_SESSION_CLIENT_SEAL",
-			id: this.generateMessageId(),
-			payload: input
-		});
-		if (!response.success) throw new Error(response.error || "Client seal preparation failed");
-	}
-	async discardSigningSessionHydration(input) {
-		const response = await this.sendMessage({
-			type: "DISCARD_SESSION_CLIENT_SEAL",
-			id: this.generateMessageId(),
-			payload: input
-		});
-		if (!response.success) throw new Error(response.error || "Client seal cleanup failed");
-	}
-	async readPreparedSigningSessionHydration(input) {
-		const response = await this.sendMessage({
-			type: "READ_SESSION_CLIENT_SEAL",
-			id: this.generateMessageId(),
-			payload: input
-		});
-		if (!response.success || !isObjectRecord(response.data) || response.data.ok !== true || typeof response.data.ciphertext !== "string" || !response.data.ciphertext.trim()) throw new Error(response.success ? "Prepared client seal is invalid" : response.error || "Client seal read failed");
-		return { ciphertext: response.data.ciphertext };
-	}
-	async restorePasskeyEcdsaRecord(args) {
-		const thresholdSessionId = args.purpose.thresholdSessionId;
-		const chainTarget = args.purpose.chainTarget;
-		const lease = await acquireSigningSessionRestoreLease({
-			thresholdSessionId,
-			authMethod: "passkey",
-			curve: "ecdsa",
-			chainTarget
-		});
-		if (!lease) return null;
-		try {
-			const operationCredential = await readExactPasskeyRestoreCredential({
-				walletId: args.walletId,
-				factorAuthority: args.record.authority,
-				materialActivation: args.purpose.materialActivation,
-				nowMs: Date.now()
-			});
-			if (!operationCredential) return null;
-			const ecdsaRestore = await passkeyEcdsaRestoreMetadataFromRecoveryRecord(args.record);
-			const walletSessionToken = operationCredential.token;
-			const restoreWalletId = String(ecdsaRestore.authority.walletId).trim();
-			if (!restoreWalletId || restoreWalletId !== String(args.walletId).trim()) return null;
-			const groupId = String(args.record.groupId || "").trim();
-			if (!groupId) return null;
-			const transport = {
-				curve: "ecdsa",
-				authMethod: "passkey",
-				walletId: restoreWalletId,
-				chainTarget,
-				relayerUrl: args.record.relayerUrl,
-				signingSessionSealKeyVersion: parseSigningSessionSealKeyVersion(args.record.keyVersion),
-				groupId,
-				walletSessionToken,
-				ecdsaRestore
-			};
-			return await restorePasskeyEcdsaSealedRecordForWallet({
-				record: args.record,
-				purpose: args.purpose,
-				transport,
-				groupId,
-				rehydrateWarmSessionMaterial: this.rehydrateWarmSessionMaterial.bind(this),
-				deletePersistedRecord: async () => await deleteInvalidPasskeyEcdsaRecord({
-					thresholdSessionId,
-					chainTarget
-				}),
-				recordSessionMaterialRestored: async (status) => await this.recordWarmSessionPolicyResult({
-					curve: "ecdsa",
-					thresholdSessionId,
-					chainTarget
-				}, thresholdSessionId, status),
-				readWarmSessionStatusFromWorker: async (thresholdSessionId) => await this.readWarmSessionStatus({ thresholdSessionId }),
-				resolveCurrentEcdsaCapabilityRuntime: this.deps.resolveCurrentEcdsaCapabilityRuntime,
-				updatePersistedPolicy: async (policy) => await this.durableState.updatePersistedPolicy({
-					thresholdSessionId,
-					purpose: {
-						curve: "ecdsa",
-						thresholdSessionId,
-						chainTarget
-					},
-					...policy
-				})
-			});
-		} finally {
-			await releaseSigningSessionRestoreLease(lease);
-		}
-	}
-	async sealAndPersistWarmSessionMaterial(args) {
-		if (this.deps.signingSessionPersistenceMode !== "sealed_refresh_v1") return {
-			ok: false,
-			code: "not_enabled",
-			message: "Passkey MPC session sealing requires sealed refresh mode"
-		};
-		const response = await this.sendMessage({
-			type: "WARM_SESSION_SEAL_AND_PERSIST",
-			id: this.generateMessageId(),
-			payload: args
-		});
-		if (response.success) {
-			const parsed = parseWarmSessionSealAndPersistResult(response.data);
-			if (parsed) return parsed;
-		}
-		return {
-			ok: false,
-			code: "worker_error",
-			message: String(response.success ? "Signing-session seal and persist failed" : response.error)
-		};
-	}
-	async rehydrateWarmSessionMaterial(args) {
-		if (this.deps.signingSessionPersistenceMode !== "sealed_refresh_v1") return {
-			ok: false,
-			code: "not_enabled",
-			message: "Passkey MPC session rehydration requires sealed refresh mode"
-		};
-		const response = await this.sendMessage({
-			type: "WARM_SESSION_REHYDRATE",
-			id: this.generateMessageId(),
-			payload: args
-		});
-		if (response.success) {
-			const parsed = parseWarmSessionStatusResult(response.data);
-			if (parsed) return parsed;
-		}
-		return {
-			ok: false,
-			code: "worker_error",
-			message: String(response.success ? "Warm-session rehydrate failed" : response.error)
-		};
-	}
-	async readWarmSessionStatus(args) {
-		const response = await this.sendMessage({
-			type: "WARM_SESSION_STATUS_READ",
-			id: this.generateMessageId(),
-			payload: args
-		});
-		if (response.success) {
-			const parsed = parseWarmSessionStatusResult(response.data);
-			if (parsed) return parsed;
-		}
-		return {
-			ok: false,
-			code: "worker_error",
-			message: String(response.success ? "Warm-session status read failed" : response.error)
-		};
-	}
-	async ensureWorkerReady() {
-		if (this.worker) return;
-		if (!this.initializationPromise) this.initializationPromise = this.createWorker().catch((error) => {
-			this.initializationPromise = null;
-			throw error;
-		});
-		await this.initializationPromise;
-		if (!this.worker) throw new Error("Passkey MPC session worker failed to initialize");
-	}
-	async createWorker() {
-		const workerUrl = resolveWorkerUrl(BUILD_PATHS.RUNTIME.PASSKEY_MPC_SESSION_WORKER, {
-			worker: "passkeyMpcSession",
-			baseOrigin: this.workerBaseOrigin
-		});
-		const worker = new Worker(workerUrl, {
-			type: "module",
-			name: "PasskeyMpcSessionWorker"
-		});
-		worker.addEventListener("message", this.boundHandleWorkerMessage);
-		worker.addEventListener("error", this.boundHandleWorkerError);
-		this.worker = worker;
-	}
-	async sendMessage(message, timeoutMs = PASSKEY_MPC_SESSION_TIMEOUT_MS) {
-		await this.ensureWorkerReady();
-		const worker = this.worker;
-		if (!worker) throw new Error("Passkey MPC session worker not available");
-		const id = String(message.id || this.generateMessageId());
-		if (this.pendingRequests.has(id)) throw new Error(`Duplicate Passkey MPC session worker request id: ${id}`);
-		return await new Promise((resolve, reject) => {
-			const timeoutId = setTimeout(() => {
-				this.rejectPendingRequest(id, /* @__PURE__ */ new Error(`Passkey MPC session worker communication timeout (${timeoutMs}ms) for ${message.type}`));
-			}, timeoutMs);
-			this.pendingRequests.set(id, {
-				id,
-				timeoutId,
-				resolve,
-				reject
-			});
-			try {
-				worker.postMessage({
-					...message,
-					id
-				});
-			} catch (error) {
-				this.rejectPendingRequest(id, error instanceof Error ? error : new Error(String(error)));
-			}
-		});
-	}
-	handleWorkerMessage(event) {
-		if (event.currentTarget !== this.worker || event.target !== this.worker) return;
-		const response = parseUserConfirmWorkerResponse(event.data);
-		if (!response) return;
-		const id = response.id || "";
-		if (!id) return;
-		const pending = this.pendingRequests.get(id);
-		if (!pending) return;
-		clearTimeout(pending.timeoutId);
-		this.pendingRequests.delete(id);
-		pending.resolve(response);
-	}
-	handleWorkerError(event) {
-		if (event.currentTarget !== this.worker || event.target !== this.worker) return;
-		const worker = this.worker;
-		this.worker = null;
-		this.initializationPromise = null;
-		worker?.removeEventListener("message", this.boundHandleWorkerMessage);
-		worker?.removeEventListener("error", this.boundHandleWorkerError);
-		worker?.terminate();
-		const errorEvent = event;
-		const error = /* @__PURE__ */ new Error(`Passkey MPC session worker failed: ${String(errorEvent.message || "unknown error")}`);
-		for (const pending of this.pendingRequests.values()) {
-			clearTimeout(pending.timeoutId);
-			pending.reject(error);
-		}
-		this.pendingRequests.clear();
-	}
-	rejectPendingRequest(id, error) {
-		const pending = this.pendingRequests.get(id);
-		if (!pending) return;
-		clearTimeout(pending.timeoutId);
-		this.pendingRequests.delete(id);
-		pending.reject(error);
-	}
-	generateMessageId() {
-		return `passkey_mpc_session_${Date.now()}_${++this.messageId}`;
-	}
-};
-function createPasskeyMpcSessionManager(deps) {
-	return new PasskeyMpcSessionManagerImpl(deps);
-}
-//#endregion
-export { createPasskeyMpcSessionManager };
-
-//# sourceMappingURL=PasskeyMpcSessionManager.js.map