@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/signingEngine/session/material/nearEd25519YaoMaterialActivation.js

@@ -1,80 +1,8 @@
-import { mpcMaterialActivationRefsEqual, parseMpcCapabilityRuntimeRef } from "../../../../shared-ts/src/utils/domainIds.js";
-import { buildBlockedMpcCapabilityHydrationPlan, buildReauthorizePublicAnchorHydrationPlan, buildRehydrateMaterialActivationHydrationPlan, buildUseLiveRuntimeHydrationPlan } from "./mpcCapabilityHydration.js";
 //#region src/core/signingEngine/session/material/nearEd25519YaoMaterialActivation.ts
-function requireParsedDomainId(result) {
-	if (!result.ok) throw new Error(result.error.message);
-	return result.value;
-}
 function nearEd25519YaoMaterialActivationFromMetadata(metadata) {
 	return metadata.materialActivation;
 }
-function nearEd25519YaoRuntimeRef(materialActivation) {
-	return requireParsedDomainId(parseMpcCapabilityRuntimeRef(`near-ed25519-yao:${materialActivation.activationId}`));
-}
-function blockedNearHydration(input, reason) {
-	const capability = input.sealed.kind === "available" ? input.sealed.materialActivation.capability : input.runtime.kind === "live" ? input.runtime.materialActivation.capability : input.publicLocator.kind === "available" ? input.publicLocator.materialActivation.capability : null;
-	return capability ? buildBlockedMpcCapabilityHydrationPlan({
-		capability,
-		reason
-	}) : buildBlockedMpcCapabilityHydrationPlan({
-		capability: null,
-		reason: "missing_capability"
-	});
-}
-function resolveNearEd25519YaoCapabilityHydrationV1(input) {
-	switch (input.publicLocator.kind) {
-		case "missing": return buildBlockedMpcCapabilityHydrationPlan({
-			capability: null,
-			reason: "missing_capability"
-		});
-		case "retired": return buildReauthorizePublicAnchorHydrationPlan({
-			retirement: input.publicLocator.retirement,
-			publicReauthAnchor: input.publicLocator.publicReauthAnchor
-		});
-		case "conflict": return blockedNearHydration(input, "exact_record_conflict");
-		case "corrupt": return blockedNearHydration(input, "corrupt");
-		case "unavailable": return buildBlockedMpcCapabilityHydrationPlan({
-			capability: input.publicLocator.capability,
-			reason: "persistence_unavailable"
-		});
-		case "available": break;
-		default: input.publicLocator;
-	}
-	const publicMaterialActivation = input.publicLocator.materialActivation;
-	if (String(publicMaterialActivation.materialOwner) !== input.publicLocator.walletId) return blockedNearHydration(input, "binding_mismatch");
-	switch (input.runtime.kind) {
-		case "live":
-			if (!mpcMaterialActivationRefsEqual(publicMaterialActivation, input.runtime.materialActivation)) return blockedNearHydration(input, "binding_mismatch");
-			return buildUseLiveRuntimeHydrationPlan({
-				authority: input.publicLocator.authority,
-				runtime: input.runtime.runtime,
-				materialActivation: publicMaterialActivation
-			});
-		case "absent": break;
-		default: input.runtime;
-	}
-	switch (input.sealed.kind) {
-		case "missing": return blockedNearHydration(input, "missing_material");
-		case "corrupt": return blockedNearHydration(input, "corrupt");
-		case "available": break;
-		default: input.sealed;
-	}
-	const sealed = input.sealed;
-	if (String(sealed.authority.walletId) !== input.publicLocator.walletId || String(sealed.authority.authorityDigest) !== String(input.publicLocator.authority.authorityDigest) || String(sealed.materialActivation.materialOwner) !== input.publicLocator.walletId || !mpcMaterialActivationRefsEqual(sealed.materialActivation, input.publicLocator.materialActivation)) return blockedNearHydration(input, "binding_mismatch");
-	switch (input.unlockSource.kind) {
-		case "unavailable": return blockedNearHydration(input, "missing_material");
-		case "available":
-			if (String(input.unlockSource.authority.walletId) !== String(sealed.authority.walletId) || String(input.unlockSource.authority.authorityDigest) !== String(sealed.authority.authorityDigest)) return blockedNearHydration(input, "binding_mismatch");
-			return buildRehydrateMaterialActivationHydrationPlan({
-				authority: sealed.authority,
-				materialActivation: sealed.materialActivation,
-				sealedMaterial: sealed.sealedMaterial
-			});
-		default: input.unlockSource;
-	}
-	throw new Error("Unsupported Near Ed25519 unlock-source observation");
-}
 //#endregion
-export { nearEd25519YaoMaterialActivationFromMetadata, nearEd25519YaoRuntimeRef, resolveNearEd25519YaoCapabilityHydrationV1 };
+export { nearEd25519YaoMaterialActivationFromMetadata };
 
 //# sourceMappingURL=nearEd25519YaoMaterialActivation.js.map

package/dist/esm/core/signingEngine/session/material/walletSigningStateFailure.js

@@ -1,47 +1,5 @@
 //#region src/core/signingEngine/session/material/walletSigningStateFailure.ts
-const WALLET_SIGNING_MATERIAL_INVALID = "wallet_signing_material_invalid";
-const WALLET_FULL_LOGIN_REQUIRED = "wallet_full_login_required";
-const WALLET_SIGNING_MATERIAL_TEMPORARILY_UNAVAILABLE = "wallet_signing_material_temporarily_unavailable";
 const WALLET_OPERATION_STEP_UP_CANCELLED = "wallet_operation_step_up_cancelled";
-function classifyWalletSigningMaterialBlock(reason) {
-	switch (reason) {
-		case "missing_capability":
-		case "missing_material":
-		case "authority_ambiguous":
-		case "binding_mismatch":
-		case "exact_record_conflict":
-		case "corrupt": return {
-			kind: "invalid_material",
-			reason
-		};
-		case "revoked":
-		case "replaced": return {
-			kind: "full_login_required",
-			reason
-		};
-		case "persistence_unavailable": return {
-			kind: "temporarily_unavailable",
-			reason
-		};
-		default: throw new Error("[SigningEngine] unsupported signing material block reason");
-	}
-}
-var InvalidWalletSigningMaterialError = class extends Error {
-	constructor(reason) {
-		super("Wallet signing material is invalid. Log in again or recover the wallet.");
-		this.reason = reason;
-		this.name = "InvalidWalletSigningMaterialError";
-		this.code = WALLET_SIGNING_MATERIAL_INVALID;
-	}
-};
-var WalletFullLoginRequiredError = class extends Error {
-	constructor(reason) {
-		super("A full wallet login is required before signing.");
-		this.reason = reason;
-		this.name = "WalletFullLoginRequiredError";
-		this.code = WALLET_FULL_LOGIN_REQUIRED;
-	}
-};
 var WalletOperationStepUpCancelled = class extends Error {
 	constructor() {
 		super("Request cancelled.");
@@ -49,36 +7,10 @@ var WalletOperationStepUpCancelled = class extends Error {
 		this.code = WALLET_OPERATION_STEP_UP_CANCELLED;
 	}
 };
-var WalletSigningMaterialTemporarilyUnavailableError = class extends Error {
-	constructor() {
-		super("Wallet signing material storage is temporarily unavailable. Retry the operation.");
-		this.name = "WalletSigningMaterialTemporarilyUnavailableError";
-		this.code = WALLET_SIGNING_MATERIAL_TEMPORARILY_UNAVAILABLE;
-		this.reason = "persistence_unavailable";
-	}
-};
-function invalidWalletSigningMaterial(reason) {
-	return new InvalidWalletSigningMaterialError(reason);
-}
-function fullWalletLoginRequired(reason) {
-	return new WalletFullLoginRequiredError(reason);
-}
-function walletSigningMaterialBlockError(reason) {
-	const disposition = classifyWalletSigningMaterialBlock(reason);
-	switch (disposition.kind) {
-		case "invalid_material": return invalidWalletSigningMaterial(disposition.reason);
-		case "full_login_required": return fullWalletLoginRequired(disposition.reason);
-		case "temporarily_unavailable": return new WalletSigningMaterialTemporarilyUnavailableError();
-		default: throw new Error("[SigningEngine] unsupported signing material disposition");
-	}
-}
 function walletOperationStepUpCancelled() {
 	return new WalletOperationStepUpCancelled();
 }
-function isWalletSigningStateFailure(error) {
-	return error instanceof InvalidWalletSigningMaterialError || error instanceof WalletFullLoginRequiredError || error instanceof WalletOperationStepUpCancelled;
-}
 //#endregion
-export { fullWalletLoginRequired, invalidWalletSigningMaterial, isWalletSigningStateFailure, walletOperationStepUpCancelled, walletSigningMaterialBlockError };
+export { walletOperationStepUpCancelled };
 
 //# sourceMappingURL=walletSigningStateFailure.js.map

package/dist/esm/core/signingEngine/session/operationState/preparedOperation.js

@@ -8,11 +8,8 @@ async function prepareThresholdSigningOperation(args) {
 		readiness: lifecycle.readiness.readiness,
 		expiresAtMs: lifecycle.readiness.expiresAtMs,
 		remainingUses: lifecycle.readiness.remainingUses,
-		usesNeeded: lifecycle.readiness.usesNeeded,
-		...lifecycle.readiness.trustedStatusAuth ? { trustedStatusAuth: lifecycle.readiness.trustedStatusAuth } : {},
 		forceFreshAuth: args.forceFreshAuth || lifecycle.forceFreshAuth,
-		sensitiveOperationPolicy: args.sensitiveOperationPolicy,
-		missingWhenExpiresAtMissing: args.missingWhenExpiresAtMissing
+		sensitiveOperationPolicy: args.sensitiveOperationPolicy
 	};
 	const resolved = await args.coordinator.resolveAuthPlanFromReadiness(coordinatorInput, args.onPlannerTrace);
 	return {
@@ -23,7 +20,6 @@ async function prepareThresholdSigningOperation(args) {
 		readiness: resolved.readiness,
 		expiresAtMs: resolved.expiresAtMs,
 		remainingUses: resolved.remainingUses,
-		...lifecycle.readiness.trustedStatusAuth ? { trustedStatusAuth: lifecycle.readiness.trustedStatusAuth } : {},
 		availableLanesGeneration: Math.max(0, Math.floor(Number(lifecycle.availableLanesGeneration) || 0)),
 		metadata: lifecycle.metadata || {}
 	};

package/dist/esm/core/signingEngine/session/operationState/transactionState.js

@@ -46,7 +46,6 @@ async function prepareTransactionSigningOperation(args) {
 		...args.operation ? { operation: args.operation } : {},
 		forceFreshAuth: args.forceFreshAuth,
 		sensitiveOperationPolicy: args.sensitiveOperationPolicy,
-		missingWhenExpiresAtMissing: args.missingWhenExpiresAtMissing,
 		onPlannerTrace: args.onPlannerTrace
 	});
 	if (!transactionLane) throw new Error("[SigningSession] transaction prepare did not return a transaction lane");

package/dist/esm/core/signingEngine/session/passkey/prfCache.js

@@ -1,12 +1,8 @@
-import { secureRandomId } from "../../../../shared-ts/src/utils/secureRandomId.js";
 //#region src/core/signingEngine/session/passkey/prfCache.ts
 function toNonNegativeInt(value) {
 	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return void 0;
 	return Math.floor(value);
 }
-function generateSessionId(prefix) {
-	return secureRandomId(prefix, 32, "passkey PRF cache session IDs");
-}
 function normalizeSigningSessionCacheEntry(args) {
 	const thresholdSessionId = String(args.thresholdSessionId || "").trim();
 	const prfFirstB64u = String(args.prfFirstB64u || "").trim();
@@ -55,6 +51,6 @@ async function cacheCredentialBoundarySetupExportPrfFirst(writer, args) {
 	});
 }
 //#endregion
-export { cacheCredentialBoundarySetupExportPrfFirst, generateSessionId };
+export { cacheCredentialBoundarySetupExportPrfFirst };
 
 //# sourceMappingURL=prfCache.js.map

package/dist/esm/core/signingEngine/session/persistence/durableSealedSessionCommands.js

@@ -2,14 +2,6 @@
 function assertNever(value) {
 	throw new Error(`Unhandled durable sealed-session identity: ${String(value)}`);
 }
-function createDeleteDurableSealedSessionCommand(args) {
-	return {
-		kind: "delete_durable_sealed_session",
-		durableRecord: args.durableRecord,
-		deleteReason: args.deleteReason,
-		preserveResolvedIdentity: args.preserveResolvedIdentity
-	};
-}
 function exactSealedSessionFilterForIdentity(identity) {
 	switch (identity.curve) {
 		case "ed25519": return {
@@ -25,6 +17,6 @@ function exactSealedSessionFilterForIdentity(identity) {
 	}
 }
 //#endregion
-export { createDeleteDurableSealedSessionCommand, exactSealedSessionFilterForIdentity };
+export { exactSealedSessionFilterForIdentity };
 
 //# sourceMappingURL=durableSealedSessionCommands.js.map

package/dist/esm/core/signingEngine/session/persistence/ecdsaRoleLocalRecords.js

@@ -1,12 +1,8 @@
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import { thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { toRpId } from "../identity/evmFamilyEcdsaIdentity.js";
+import { thresholdEcdsaChainTargetFromRequest, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { toEcdsaDerivationSigningRootId, toEcdsaDerivationSigningRootVersion, toEcdsaDerivationThresholdKeyId, toEmailOtpAuthSubjectId } from "../identity/emailOtpEcdsaDerivationIdentity.js";
+import { toEcdsaDerivationSigningRootId, toEcdsaDerivationSigningRootVersion, toEcdsaDerivationThresholdKeyId } from "../identity/emailOtpEcdsaDerivationIdentity.js";
 //#region src/core/signingEngine/session/persistence/ecdsaRoleLocalRecords.ts
-function assertNever(value) {
-	throw new Error(`Unhandled ECDSA role-local branch: ${String(value)}`);
-}
 function requiredString(value, field) {
 	if (typeof value !== "string" || !value.trim()) throw new Error(`[platform][ecdsa-role-local] ${field} is required`);
 	return value.trim();
@@ -41,92 +37,6 @@ function parseParticipantIds(value) {
 	if (!Array.isArray(value) || value.length !== 2 || value[0] !== 1 || value[1] !== 2) throw new Error("[platform][ecdsa-role-local] participantIds must be [1, 2]");
 	return [1, 2];
 }
-function parseReadyStateBlob(input) {
-	if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error("[platform][ecdsa-role-local] stateBlob must be an object");
-	if (Object.keys(input).sort().join(",") !== "curve,encoding,kind,producer,stateBlobB64u") throw new Error("[platform][ecdsa-role-local] stateBlob envelope is invalid");
-	const kind = requiredString(Reflect.get(input, "kind"), "stateBlob.kind");
-	const curve = requiredString(Reflect.get(input, "curve"), "stateBlob.curve");
-	const encoding = requiredString(Reflect.get(input, "encoding"), "stateBlob.encoding");
-	const producer = requiredString(Reflect.get(input, "producer"), "stateBlob.producer");
-	const stateBlobB64u = requiredString(Reflect.get(input, "stateBlobB64u"), "stateBlob.stateBlobB64u");
-	if (kind !== "ecdsa_role_local_state_blob_v1" || curve !== "secp256k1" || encoding !== "base64url" || producer !== "signer_core") throw new Error("[platform][ecdsa-role-local] stateBlob envelope is invalid");
-	try {
-		base64UrlDecode(stateBlobB64u);
-	} catch (error) {
-		throw new Error("[platform][ecdsa-role-local] stateBlob payload is not base64url", { cause: error });
-	}
-	return {
-		kind: "ecdsa_role_local_state_blob_v1",
-		curve: "secp256k1",
-		encoding: "base64url",
-		producer: "signer_core",
-		stateBlobB64u
-	};
-}
-function parseCredentialIdB64u(value, field = "credentialIdB64u") {
-	return requiredString(value, field);
-}
-function parseEcdsaRoleLocalAuthMethod(input) {
-	if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error("[platform][ecdsa-role-local] authMethod must be an object");
-	switch (requiredString(Reflect.get(input, "kind"), "authMethod.kind")) {
-		case "passkey":
-			if (Object.keys(input).sort().join(",") !== "credentialIdB64u,kind,rpId") throw new Error("[platform][ecdsa-role-local] passkey authMethod fields are invalid");
-			return {
-				kind: "passkey",
-				credentialIdB64u: parseCredentialIdB64u(Reflect.get(input, "credentialIdB64u")),
-				rpId: toRpId(Reflect.get(input, "rpId"))
-			};
-		case "email_otp":
-			if (Object.keys(input).sort().join(",") !== "authSubjectId,kind") throw new Error("[platform][ecdsa-role-local] email OTP authMethod fields are invalid");
-			return {
-				kind: "email_otp",
-				authSubjectId: toEmailOtpAuthSubjectId(Reflect.get(input, "authSubjectId"))
-			};
-		default: throw new Error("[platform][ecdsa-role-local] authMethod kind is invalid");
-	}
-}
-function buildEcdsaRoleLocalPasskeyAuthMethod(input) {
-	return {
-		kind: "passkey",
-		credentialIdB64u: parseCredentialIdB64u(input.credentialIdB64u),
-		rpId: toRpId(input.rpId)
-	};
-}
-function buildEcdsaRoleLocalEmailOtpAuthMethod(input) {
-	return {
-		kind: "email_otp",
-		authSubjectId: toEmailOtpAuthSubjectId(input.authSubjectId)
-	};
-}
-function authMethodsEqual(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "passkey":
-			if (right.kind !== "passkey") return false;
-			return String(left.rpId) === String(right.rpId) && String(left.credentialIdB64u) === String(right.credentialIdB64u);
-		case "email_otp":
-			if (right.kind !== "email_otp") return false;
-			return String(left.authSubjectId) === String(right.authSubjectId);
-		default: return assertNever(left);
-	}
-}
-function readyRecordFromParts(args) {
-	switch (args.authMethod.kind) {
-		case "passkey": return {
-			kind: "ecdsa_role_local_ready_passkey_v1",
-			stateBlob: args.stateBlob,
-			publicFacts: args.publicFacts,
-			authMethod: args.authMethod
-		};
-		case "email_otp": return {
-			kind: "ecdsa_role_local_ready_email_otp_v1",
-			stateBlob: args.stateBlob,
-			publicFacts: args.publicFacts,
-			authMethod: args.authMethod
-		};
-		default: return assertNever(args.authMethod);
-	}
-}
 function parseChainTarget(input) {
 	if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error("[platform][ecdsa-role-local] chainTarget must be an object");
 	switch (requiredString(Reflect.get(input, "kind"), "chainTarget.kind").toLowerCase()) {
@@ -201,116 +111,7 @@ function projectEcdsaRoleLocalPublicFactsToChainTarget(args) {
 		publicCapability: source.publicCapability
 	});
 }
-function parseEcdsaRoleLocalReadyRecord(input) {
-	if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error("[platform][ecdsa-role-local] ready record must be an object");
-	if (Object.keys(input).sort().join(",") !== "authMethod,kind,publicFacts,stateBlob") throw new Error("[platform][ecdsa-role-local] ready record fields are invalid");
-	const kind = requiredString(Reflect.get(input, "kind"), "readyRecord.kind");
-	if (kind !== "ecdsa_role_local_ready_passkey_v1" && kind !== "ecdsa_role_local_ready_email_otp_v1") throw new Error("[platform][ecdsa-role-local] ready record kind is invalid");
-	const publicFacts = parsePublicFacts(Reflect.get(input, "publicFacts"));
-	const parsed = readyRecordFromParts({
-		stateBlob: parseReadyStateBlob(Reflect.get(input, "stateBlob")),
-		publicFacts,
-		authMethod: parseEcdsaRoleLocalAuthMethod(Reflect.get(input, "authMethod"))
-	});
-	if (kind === "ecdsa_role_local_ready_passkey_v1" && parsed.kind !== kind || kind === "ecdsa_role_local_ready_email_otp_v1" && parsed.kind !== kind) throw new Error("[platform][ecdsa-role-local] ready record authMethod branch mismatch");
-	return parsed;
-}
-function serializeAuthMethod(authMethod) {
-	switch (authMethod.kind) {
-		case "passkey": return {
-			kind: "passkey",
-			credentialIdB64u: authMethod.credentialIdB64u,
-			rpId: authMethod.rpId
-		};
-		case "email_otp": return {
-			kind: "email_otp",
-			authSubjectId: authMethod.authSubjectId
-		};
-		default: return assertNever(authMethod);
-	}
-}
-function serializeEcdsaRoleLocalPublicFacts(facts) {
-	return {
-		walletId: facts.walletId,
-		chainTarget: facts.chainTarget,
-		keyHandle: facts.keyHandle,
-		ecdsaThresholdKeyId: facts.ecdsaThresholdKeyId,
-		signingRootId: facts.signingRootId,
-		signingRootVersion: facts.signingRootVersion,
-		applicationBindingDigestB64u: facts.applicationBindingDigestB64u,
-		clientParticipantId: 1,
-		relayerParticipantId: 2,
-		participantIds: [1, 2],
-		contextBinding32B64u: facts.contextBinding32B64u,
-		derivationClientSharePublicKey33B64u: facts.derivationClientSharePublicKey33B64u,
-		relayerPublicKey33B64u: facts.relayerPublicKey33B64u,
-		groupPublicKey33B64u: facts.groupPublicKey33B64u,
-		ethereumAddress: facts.ethereumAddress,
-		publicCapability: facts.publicCapability
-	};
-}
-function serializeEcdsaRoleLocalReadyRecord(record) {
-	const parsed = parseEcdsaRoleLocalReadyRecord(record);
-	return {
-		kind: parsed.kind,
-		stateBlob: {
-			kind: parsed.stateBlob.kind,
-			curve: parsed.stateBlob.curve,
-			encoding: parsed.stateBlob.encoding,
-			producer: parsed.stateBlob.producer,
-			stateBlobB64u: parsed.stateBlob.stateBlobB64u
-		},
-		publicFacts: serializeEcdsaRoleLocalPublicFacts(parsed.publicFacts),
-		authMethod: serializeAuthMethod(parsed.authMethod)
-	};
-}
-function keyPart(value) {
-	return encodeURIComponent(requiredString(value, "storage key part"));
-}
-function ecdsaRoleLocalReadyRecordStorageKey(input) {
-	return [
-		"ecdsa_role_local_ready_v1",
-		keyPart(input.walletId),
-		keyPart(thresholdEcdsaChainTargetKey(input.chainTarget)),
-		keyPart(input.keyHandle),
-		keyPart(input.ecdsaThresholdKeyId),
-		keyPart(input.signingRootId),
-		keyPart(input.signingRootVersion),
-		keyPart(input.participantIds.join(",")),
-		keyPart(ecdsaRoleLocalAuthMethodStorageKeyPart(input.authMethod))
-	].join(":");
-}
-function ecdsaRoleLocalReadyRecordStorageKeyFacts(record) {
-	const parsed = parseEcdsaRoleLocalReadyRecord(record);
-	const facts = parsed.publicFacts;
-	return {
-		walletId: facts.walletId,
-		chainTarget: facts.chainTarget,
-		keyHandle: facts.keyHandle,
-		ecdsaThresholdKeyId: facts.ecdsaThresholdKeyId,
-		signingRootId: facts.signingRootId,
-		signingRootVersion: facts.signingRootVersion,
-		participantIds: facts.participantIds,
-		authMethod: parsed.authMethod
-	};
-}
-function ecdsaRoleLocalAuthMethodStorageKeyPart(authMethod) {
-	switch (authMethod.kind) {
-		case "passkey": return [
-			"passkey",
-			authMethod.rpId,
-			authMethod.credentialIdB64u
-		].join(":");
-		case "email_otp": return ["email_otp", authMethod.authSubjectId].join(":");
-		default: return assertNever(authMethod);
-	}
-}
-function ecdsaRoleLocalReadyRecordMatchesInput(args) {
-	const facts = args.record.publicFacts;
-	const input = args.input;
-	return String(facts.walletId) === String(input.walletId) && thresholdEcdsaChainTargetsEqual(facts.chainTarget, input.chainTarget) && String(facts.keyHandle) === String(input.keyHandle) && String(facts.ecdsaThresholdKeyId) === String(input.ecdsaThresholdKeyId) && String(facts.signingRootId) === String(input.signingRootId) && String(facts.signingRootVersion) === String(input.signingRootVersion) && facts.participantIds[0] === input.participantIds[0] && facts.participantIds[1] === input.participantIds[1] && authMethodsEqual(args.record.authMethod, input.authMethod);
-}
 //#endregion
-export { buildEcdsaRoleLocalEmailOtpAuthMethod, buildEcdsaRoleLocalPasskeyAuthMethod, buildEcdsaRoleLocalPublicFacts, ecdsaRoleLocalReadyRecordMatchesInput, ecdsaRoleLocalReadyRecordStorageKey, ecdsaRoleLocalReadyRecordStorageKeyFacts, parseEcdsaRoleLocalReadyRecord, projectEcdsaRoleLocalPublicFactsToChainTarget, serializeEcdsaRoleLocalReadyRecord };
+export { buildEcdsaRoleLocalPublicFacts, projectEcdsaRoleLocalPublicFactsToChainTarget };
 
 //# sourceMappingURL=ecdsaRoleLocalRecords.js.map

package/dist/esm/core/signingEngine/session/persistence/sealedSessionRecords.js

@@ -1,12 +1,12 @@
-import { parseMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeInteger, normalizeOptionalNonEmptyString } from "../../../../shared-ts/src/utils/normalize.js";
 import { asRecord } from "../../../../shared-ts/src/utils/validation.js";
+import { parseMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/domainIds.js";
+import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, SIGNING_SESSION_SEAL_STORAGE_SCOPE, SIGNING_SESSION_SECRET_KIND, parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey } from "../../interfaces/ecdsaChainTarget.js";
-import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { parseEcdsaRoleLocalPersistedMaterialRef } from "../keyMaterialBrands.js";
 import { parseEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { parseEcdsaRoleLocalPersistedMaterialRef } from "../keyMaterialBrands.js";
 import { ecdsaSealedRecordStoreKey } from "./ecdsaSealedRecordKey.js";
 //#region src/core/signingEngine/session/persistence/sealedSessionRecords.ts
 const ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND = "ecdsa_inactive_sealed_material_v1";
@@ -271,14 +271,6 @@ function normalizeAuthMethod(value) {
 	const authMethod = String(value || "").trim();
 	return authMethod === "passkey" || authMethod === "email_otp" ? authMethod : void 0;
 }
-function hasStaleSealedSessionWalletIdentityFields(value) {
-	const obj = asRecord(value);
-	return Boolean(normalizeOptionalNonEmptyString(obj?.subjectId) || normalizeOptionalNonEmptyString(obj?.userId));
-}
-function hasTopLevelSigningRootFields(value) {
-	const obj = asRecord(value);
-	return Boolean(normalizeOptionalNonEmptyString(obj?.signingRootId) || normalizeOptionalNonEmptyString(obj?.signingRootVersion));
-}
 function normalizeParticipantIds(value) {
 	if (!Array.isArray(value)) return [];
 	return value.map((participantId) => Math.floor(Number(participantId))).filter((participantId) => Number.isFinite(participantId) && participantId > 0);
@@ -609,77 +601,6 @@ function logSealedSessionClassification(args) {
 	};
 	console.warn("[SigningSessionSealedStore] rejected sealed record", payload);
 }
-function buildCurrentSealedSessionRecord(args) {
-	const thresholdSessionId = String(args.thresholdSessionId || "").trim();
-	const curve = normalizeCurve(args.curve);
-	const authMethod = args.authMethod === "passkey" || args.authMethod === "email_otp" ? args.authMethod : void 0;
-	if (!curve || !authMethod) return null;
-	const thresholdSessionIds = thresholdSessionIdsForWrite({
-		thresholdSessionId,
-		curve,
-		thresholdSessionIds: args.thresholdSessionIds
-	});
-	const walletId = normalizeOptionalNonEmptyString(args.walletId);
-	const sealedSecretB64u = normalizeOptionalNonEmptyString(args.sealedSecretB64u);
-	const expiresAtMs = normalizeInteger(args.expiresAtMs);
-	const remainingUses = normalizeInteger(args.remainingUses);
-	const issuedAtMs = normalizeInteger(args.issuedAtMs);
-	const updatedAtMs = normalizeInteger(args.updatedAtMs);
-	const keyVersion = normalizeOptionalNonEmptyString(args.keyVersion);
-	if (!thresholdSessionId || !sealedSecretB64u || !keyVersion || args.groupId !== "rfc2409-group2") return null;
-	if (!thresholdSessionIds.ed25519 && !thresholdSessionIds.ecdsa) return null;
-	if (issuedAtMs == null || issuedAtMs <= 0) return null;
-	if (expiresAtMs == null || expiresAtMs <= 0) return null;
-	if (remainingUses == null || remainingUses < 0) return null;
-	if (updatedAtMs == null || updatedAtMs <= 0) return null;
-	const ecdsaRestore = normalizeEcdsaRestoreMetadata(args.ecdsaRestore);
-	const ed25519Restore = normalizeCurrentEd25519RestoreMetadata(args.ed25519Restore);
-	if (hasStaleSealedSessionWalletIdentityFields(args)) return null;
-	if (curve === "ecdsa") {
-		if (!ecdsaRestore?.chainTarget || !walletId) return null;
-		if (hasTopLevelSigningRootFields(args)) return null;
-	}
-	let signingRootIdForWrite;
-	let signingRootVersionForWrite;
-	if (args.curve === "ed25519") {
-		signingRootIdForWrite = normalizeOptionalNonEmptyString(args.signingRootId);
-		signingRootVersionForWrite = normalizeOptionalNonEmptyString(args.signingRootVersion);
-	}
-	const classification = classifyRawSealedSessionRecord({
-		...currentSealedRecordHeader(authMethod),
-		thresholdSessionIds,
-		sealedSecretB64u,
-		curve,
-		...walletId ? { walletId } : {},
-		...signingRootIdForWrite ? { signingRootId: signingRootIdForWrite } : {},
-		...signingRootVersionForWrite ? { signingRootVersion: signingRootVersionForWrite } : {},
-		...normalizeOptionalNonEmptyString(args.relayerUrl) ? { relayerUrl: normalizeOptionalNonEmptyString(args.relayerUrl) } : {},
-		keyVersion,
-		groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-		...ecdsaRestore ? { ecdsaRestore } : {},
-		...ed25519Restore ? { ed25519Restore } : {},
-		issuedAtMs,
-		expiresAtMs,
-		remainingUses,
-		updatedAtMs
-	});
-	if (classification.kind !== "current") {
-		logSealedSessionClassification({
-			operation: "build current sealed session record",
-			classification
-		});
-		return null;
-	}
-	return classification.record;
-}
-function thresholdSessionIdsForWrite(args) {
-	const explicit = normalizeThresholdSessionIds(args.thresholdSessionIds);
-	const thresholdSessionId = String(args.thresholdSessionId || "").trim();
-	if (!thresholdSessionId) return {};
-	if (args.curve === "ed25519" && explicit.ed25519 === thresholdSessionId) return explicit;
-	if (args.curve === "ecdsa" && explicit.ecdsa === thresholdSessionId) return explicit;
-	return {};
-}
 function buildEcdsaInactiveMaterialPublicRestore(restore, relayerUrlRaw) {
 	const relayerUrl = normalizeOptionalNonEmptyString(relayerUrlRaw);
 	const ecdsaThresholdKeyId = normalizeOptionalNonEmptyString(restore.ecdsaThresholdKeyId);
@@ -754,6 +675,6 @@ function requireInactiveEcdsaSealedMaterial(args) {
 	return inactiveMaterial;
 }
 //#endregion
-export { buildCurrentSealedSessionRecord, buildEcdsaInactiveMaterialPublicRestore, classifyNonCurrentRecord, classifyRawSealedSessionRecord, hasRetiredAuthorizationIdentityField, inactiveEcdsaMaterialStorageRow, logSealedSessionClassification, makeInactiveEcdsaMaterialStoreKey, normalizeSigningSessionSealedStoreRecord, normalizeThresholdSessionIdsFromStoredRecord, requireInactiveEcdsaSealedMaterial, sealedRecordStorageRow, storagePayloadFromSealedStoreRow };
+export { buildEcdsaInactiveMaterialPublicRestore, classifyNonCurrentRecord, classifyRawSealedSessionRecord, hasRetiredAuthorizationIdentityField, inactiveEcdsaMaterialStorageRow, logSealedSessionClassification, makeInactiveEcdsaMaterialStoreKey, normalizeSigningSessionSealedStoreRecord, normalizeThresholdSessionIdsFromStoredRecord, requireInactiveEcdsaSealedMaterial, sealedRecordStorageRow, storagePayloadFromSealedStoreRow };
 
 //# sourceMappingURL=sealedSessionRecords.js.map

package/dist/esm/core/signingEngine/session/persistence/sealedSessionStore.js

@@ -1,9 +1,9 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeInteger, normalizeOptionalNonEmptyString } from "../../../../shared-ts/src/utils/normalize.js";
 import { asRecord } from "../../../../shared-ts/src/utils/validation.js";
+import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
-import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
 import { secureRandomId } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
 import { signingSessionSealsRepository } from "../../../indexedDB/seamsWalletDB/signingSessionSeals.js";
 import { exactSealedSessionFilterForIdentity } from "./durableSealedSessionCommands.js";
 import { buildEcdsaInactiveMaterialPublicRestore, classifyNonCurrentRecord, classifyRawSealedSessionRecord, hasRetiredAuthorizationIdentityField, inactiveEcdsaMaterialStorageRow, logSealedSessionClassification, makeInactiveEcdsaMaterialStoreKey, normalizeSigningSessionSealedStoreRecord, normalizeThresholdSessionIdsFromStoredRecord, requireInactiveEcdsaSealedMaterial, sealedRecordStorageRow, storagePayloadFromSealedStoreRow } from "./sealedSessionRecords.js";

package/dist/esm/core/signingEngine/session/planning/planner.js

@@ -1,6 +1,6 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
 import { signingLaneAuthMethod } from "../identity/signingLaneAuthBinding.js";
-import { SigningKeyRefIntentKind, SigningSessionPlanKind, summarizeSigningLane, summarizeSigningSessionPlan } from "../operationState/types.js";
+import { SigningKeyRefIntentKind, SigningSessionPlanKind } from "../operationState/types.js";
 //#region src/core/signingEngine/session/planning/planner.ts
 function planSigningSession(input) {
 	const lane = input.lane;
@@ -76,23 +76,12 @@ function planSigningSession(input) {
 		}
 	};
 }
-function createSigningPlannerDecisionTraceEvent(input, plan) {
-	return {
-		event: "signing_planner_decision",
-		readinessStatus: input.readiness.status,
-		forceFreshAuth: Boolean(input.forceFreshAuth),
-		...input.sensitiveOperationPolicy ? { sensitiveOperationPolicy: input.sensitiveOperationPolicy } : {},
-		plan: summarizeSigningSessionPlan(plan),
-		lane: summarizeSigningLane(input.lane),
-		...plan.kind === SigningSessionPlanKind.NotReady ? { reason: plan.reason } : {}
-	};
-}
 function getPolicyBlock(input) {
 	if (signingLaneAuthMethod(input.lane.auth) !== "email_otp") return null;
 	if (input.sensitiveOperationPolicy === "deny_email_otp" || input.sensitiveOperationPolicy === "require_passkey") return "policy_blocked";
 	return null;
 }
 //#endregion
-export { createSigningPlannerDecisionTraceEvent, planSigningSession };
+export { planSigningSession };
 
 //# sourceMappingURL=planner.js.map

package/dist/esm/core/signingEngine/session/sealedRecovery/materialActivationKey.js

@@ -1,11 +1,4 @@
 //#region src/core/signingEngine/session/sealedRecovery/materialActivationKey.ts
-function ed25519DurableMaterialLocator(args) {
-	return {
-		kind: "ed25519_durable_material",
-		authMethod: args.authMethod,
-		materialActivation: args.materialActivation
-	};
-}
 function materialActivationKey(activation) {
 	return [
 		activation.activationId,
@@ -17,6 +10,6 @@ function materialActivationKey(activation) {
 	].map((part) => encodeURIComponent(String(part))).join(":");
 }
 //#endregion
-export { ed25519DurableMaterialLocator, materialActivationKey };
+export { materialActivationKey };
 
 //# sourceMappingURL=materialActivationKey.js.map