@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/signingEngine/flows/recovery/ecdsaExportFlow.js

@@ -1,660 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
-import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { activeWalletSessionV1RecordsEqual } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
-import { KeyExportEventPhase } from "../../../types/sdkSentEvents.js";
-import { thresholdEcdsaChainTargetKey, walletSessionRefFromSession } from "../../interfaces/ecdsaChainTarget.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { sameRouterAbEcdsaDerivationNormalSigningStateV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
-import { resolveThresholdCommitQueueKey } from "../../threshold/commitQueueShared.js";
-import { issueEcdsaOperationStepUpAuthorization, prepareEcdsaOperationStepUp } from "../../threshold/ecdsa/operationStepUp.js";
-import { resolveActiveWalletAuthorityEcdsaRuntimeV1 } from "../../session/material/activeWalletAuthorityEcdsaRuntime.js";
-import { ecdsaExportBoundaryChain, resolveEcdsaExportMaterialForLane, resolveFreshEmailOtpEcdsaExportMaterialForLane } from "./ecdsaExportMaterial.js";
-import { exportActiveWalletAuthorityEcdsaHolderKey, exportEcdsaDerivationKey } from "./ecdsaDerivationExport.js";
-import { buildEcdsaExportActivation } from "../../session/passkey/ecdsaSessionProvision.js";
-import { isExportViewerSessionOpen, removeExportViewerHostIfPresent } from "../../uiConfirm/ui/export-viewer-host.js";
-import { createExportUiRequestId, emitKeyExportEvent } from "./keyExportFlow.js";
-import { requestEmailOtpKeyExportAuthorization, requestThresholdEcdsaExportAuthorization, showThresholdEcdsaExportViewer } from "./keyExportConfirmation.js";
-//#region src/core/signingEngine/flows/recovery/ecdsaExportFlow.ts
-function emitEcdsaMaterialStarted(args) {
-	emitKeyExportEvent(args.onEvent, {
-		phase: KeyExportEventPhase.STEP_03_MATERIAL_PREPARE_STARTED,
-		status: "running",
-		flowId: args.flowId,
-		accountId: String(args.walletId),
-		interaction: {
-			kind: "none",
-			overlay: "none"
-		},
-		data: {
-			chain: args.chain,
-			curve: "ecdsa"
-		}
-	});
-}
-function emitEcdsaMaterialSucceeded(args) {
-	emitKeyExportEvent(args.onEvent, {
-		phase: KeyExportEventPhase.STEP_03_MATERIAL_PREPARE_SUCCEEDED,
-		status: "succeeded",
-		flowId: args.flowId,
-		accountId: String(args.walletId),
-		interaction: {
-			kind: "none",
-			overlay: "none"
-		},
-		data: {
-			chain: args.chain,
-			curve: "ecdsa",
-			...args.source ? { source: args.source } : {}
-		}
-	});
-}
-async function showEcdsaExportArtifact(deps, args) {
-	await showThresholdEcdsaExportViewer({
-		touchConfirm: deps.touchConfirm,
-		theme: deps.theme
-	}, {
-		state: "ready",
-		walletId: args.walletId,
-		chainTarget: args.exportLane.chainTarget,
-		publicKeyHex: String(args.artifact.publicKeyHex || "").trim(),
-		privateKeyHex: String(args.artifact.privateKeyHex || "").trim(),
-		ethereumAddress: String(args.artifact.ethereumAddress || "").trim(),
-		variant: args.options.variant,
-		theme: args.options.theme,
-		viewerSessionId: args.viewerSessionId,
-		flowId: args.flowId,
-		onEvent: args.onEvent
-	});
-}
-async function showEcdsaExportLoadingViewer(deps, args) {
-	await showThresholdEcdsaExportViewer({
-		touchConfirm: deps.touchConfirm,
-		theme: deps.theme
-	}, {
-		state: "loading",
-		walletId: args.walletId,
-		chainTarget: args.exportLane.chainTarget,
-		publicKeyHex: String(args.publicKey || "").trim(),
-		ethereumAddress: String(args.ethereumAddress || "").trim(),
-		variant: args.options.variant,
-		theme: args.options.theme,
-		viewerSessionId: args.viewerSessionId,
-		flowId: args.flowId,
-		onEvent: args.onEvent
-	});
-}
-async function prepareAndShowEcdsaExportArtifact(deps, args) {
-	const exportChain = ecdsaExportBoundaryChain(args.exportLane);
-	const viewerSessionId = createExportUiRequestId("export-threshold-ecdsa-viewer-session");
-	emitEcdsaMaterialStarted({
-		flowId: args.flowId,
-		walletId: args.walletId,
-		chain: exportChain,
-		onEvent: args.onEvent
-	});
-	try {
-		await showEcdsaExportLoadingViewer(deps, {
-			walletId: args.walletId,
-			exportLane: args.exportLane,
-			publicKey: args.exportPublicKey,
-			ethereumAddress: args.exportLane.publicFacts.thresholdOwnerAddress,
-			options: args.options,
-			viewerSessionId,
-			flowId: args.flowId,
-			onEvent: args.onEvent
-		});
-		const materialActivation = args.exportLane.laneIdentity.signer.materialActivation;
-		const artifact = await deps.withThresholdEcdsaSigningQueue({
-			queueKey: resolveThresholdCommitQueueKey({ materialActivation }),
-			walletId: args.exportLane.key.walletId,
-			enabled: true,
-			task: async () => {
-				if (args.exportLane.source === "active_wallet_authority") {
-					const activeRuntime = args.activeRuntime;
-					if (!activeRuntime) throw new Error("[SigningEngine][ecdsa-export] active runtime is missing");
-					await assertActiveWalletAuthorityEcdsaRuntimeStillActive({
-						ports: deps.activeWalletAuthorityEcdsaRuntimeReadPorts,
-						expectedRuntime: activeRuntime
-					});
-				} else if (args.exportLane.authMethod === "email_otp") {
-					if (!mpcMaterialActivationRefsEqual((await resolveFreshEmailOtpEcdsaExportMaterialForLane(deps.sessionStore, args.exportLane)).persistedMaterial.materialActivation, materialActivation)) throw new Error("[SigningEngine][ecdsa-export] prepared material activation was superseded");
-				} else {
-					const current = await resolveEcdsaExportMaterialForLane(deps.sessionStore, args.exportLane);
-					if (current.kind !== "fresh_passkey_needs_authorization") throw new Error("[SigningEngine][ecdsa-export] prepared export authority changed");
-					if (!mpcMaterialActivationRefsEqual(current.existingRoleLocalMaterial.materialActivation, materialActivation)) throw new Error("[SigningEngine][ecdsa-export] prepared material activation was superseded");
-				}
-				return await args.prepareArtifact();
-			}
-		});
-		emitEcdsaMaterialSucceeded({
-			flowId: args.flowId,
-			walletId: args.walletId,
-			chain: exportChain,
-			onEvent: args.onEvent
-		});
-		if (!isExportViewerSessionOpen(viewerSessionId)) return {
-			accountId: String(args.walletId),
-			exportedSchemes: ["secp256k1"]
-		};
-		await showEcdsaExportArtifact(deps, {
-			walletId: args.walletId,
-			exportLane: args.exportLane,
-			artifact,
-			options: args.options,
-			viewerSessionId,
-			flowId: args.flowId,
-			onEvent: args.onEvent
-		});
-		return {
-			accountId: String(args.walletId),
-			exportedSchemes: ["secp256k1"]
-		};
-	} catch (error) {
-		removeExportViewerHostIfPresent();
-		throw error;
-	}
-}
-function requirePasskeyEcdsaExportAuth(exportLane) {
-	const auth = exportLane.laneIdentity.auth;
-	if (auth.kind !== "passkey") throw new Error("[SigningEngine][ecdsa-export] fresh passkey export requires passkey lane");
-	return auth;
-}
-async function exportOperationDigest(value) {
-	return sha256Utf8DigestB64u(alphabetizeStringify(value));
-}
-async function prepareExplicitEcdsaExportOperationWithRuntime(args) {
-	const chainTargetKey = thresholdEcdsaChainTargetKey(args.chainTarget);
-	return await prepareEcdsaOperationStepUp({
-		walletId: args.walletId,
-		operationKind: "evm.export_key",
-		operationId: args.requestId,
-		operationDigests: {
-			laneDigest: await exportOperationDigest({
-				walletId: args.walletId,
-				chainTarget: chainTargetKey,
-				materialActivation: args.materialActivation,
-				keyHandle: args.keyHandle
-			}),
-			intentDigest: await exportOperationDigest({
-				operation: "explicit_key_export",
-				requestId: args.requestId,
-				walletId: args.walletId,
-				chainTarget: chainTargetKey
-			}),
-			displayDigest: await exportOperationDigest({
-				operation: "Export Private Key",
-				publicKey: args.displayPublicKey,
-				address: args.displayAddress
-			})
-		},
-		materialActivation: args.materialActivation,
-		normalSigningScope: args.operationRuntime.normalSigning.scope,
-		keyHandle: args.keyHandle,
-		relayerKeyId: args.operationRuntime.relayerKeyId,
-		participantIds: [Number(args.operationRuntime.participantIds[0]), Number(args.operationRuntime.participantIds[1])],
-		expiresAtMs: args.operationExpiresAtMs
-	});
-}
-async function prepareExplicitEcdsaExportOperation(args) {
-	return await prepareExplicitEcdsaExportOperationWithRuntime({
-		walletId: args.walletId,
-		chainTarget: args.chainTarget,
-		requestId: args.requestId,
-		keyHandle: args.keyHandle,
-		displayPublicKey: args.displayPublicKey,
-		displayAddress: args.displayAddress,
-		materialActivation: args.materialActivation,
-		operationRuntime: args.operationRuntime,
-		operationExpiresAtMs: args.operationExpiresAtMs
-	});
-}
-async function assertEcdsaExportMaterialStillActive(args) {
-	const current = await resolveEcdsaExportMaterialForLane(args.deps.sessionStore, args.exportLane);
-	if (current.kind !== "fresh_passkey_needs_authorization") throw new Error("[SigningEngine][ecdsa-export] passkey export authority changed");
-	if (!mpcMaterialActivationRefsEqual(current.existingRoleLocalMaterial.materialActivation, args.expectedMaterialActivation)) throw new Error("[SigningEngine][ecdsa-export] active material changed after authorization confirmation");
-}
-async function assertEmailOtpEcdsaExportMaterialStillActive(args) {
-	if (!mpcMaterialActivationRefsEqual((await resolveFreshEmailOtpEcdsaExportMaterialForLane(args.deps.sessionStore, args.exportLane)).persistedMaterial.materialActivation, args.expectedMaterialActivation)) throw new Error("[SigningEngine][ecdsa-export] active material changed after authorization confirmation");
-}
-function assertActiveWalletAuthorityEcdsaRuntimeIdentity(args) {
-	if (!activeWalletAuthorityEcdsaRuntimeIdentityMatches(args.expected, args.actual)) throw new Error("[SigningEngine][ecdsa-export] active Wallet Authority runtime was replaced after authorization");
-}
-function activeWalletAuthorityEcdsaRuntimeIdentityMatches(left, right) {
-	let authMatches;
-	switch (left.auth.kind) {
-		case "passkey":
-			authMatches = right.auth.kind === "passkey" && left.auth.rpId === right.auth.rpId && left.auth.credentialIdB64u === right.auth.credentialIdB64u;
-			break;
-		case "email_otp":
-			authMatches = right.auth.kind === "email_otp" && left.auth.providerSubjectId === right.auth.providerSubjectId;
-			break;
-		default: return left.auth;
-	}
-	return left.kind === right.kind && left.walletId === right.walletId && left.authorityId === right.authorityId && left.walletAuthMethodId === right.walletAuthMethodId && left.authorityDigestB64u === right.authorityDigestB64u && left.factorAuthorityRef.kind === right.factorAuthorityRef.kind && left.factorAuthorityRef.walletId === right.factorAuthorityRef.walletId && left.factorAuthorityRef.authorityDigest === right.factorAuthorityRef.authorityDigest && left.factorAuthorityRef.walletAuthMethodId === right.factorAuthorityRef.walletAuthMethodId && left.authorityRevocationEpoch === right.authorityRevocationEpoch && left.walletSessionId === right.walletSessionId && left.requiredCapability === right.requiredCapability && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation) && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.operationCredential.kind === right.operationCredential.kind && left.operationCredential.token === right.operationCredential.token && left.operationCredential.walletSessionId === right.operationCredential.walletSessionId && activeWalletSessionV1RecordsEqual(left.session, right.session) && sameWalletAuthMethodRecordV2(left.authMethod, right.authMethod) && authMatches && walletAuthAuthoritiesMatch(left.factorAuthority, right.factorAuthority) && left.holderRuntime.kind === right.holderRuntime.kind && left.holderRuntime.walletId === right.holderRuntime.walletId && left.holderRuntime.authorityId === right.holderRuntime.authorityId && left.holderRuntime.walletAuthMethodId === right.holderRuntime.walletAuthMethodId && walletAuthAuthoritiesMatch(left.holderRuntime.factorAuthority, right.holderRuntime.factorAuthority) && mpcMaterialActivationRefsEqual(left.holderRuntime.materialActivation, right.holderRuntime.materialActivation) && left.holderRuntime.holderHandleId === right.holderRuntime.holderHandleId && left.holderRuntime.ecdsaThresholdKeyId === right.holderRuntime.ecdsaThresholdKeyId && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.normalSigning, right.normalSigning);
-}
-async function resolveFreshActiveWalletAuthorityEcdsaRuntime(args) {
-	const resolution = await resolveActiveWalletAuthorityEcdsaRuntimeV1({
-		ports: args.ports,
-		input: {
-			walletId: args.expectedRuntime.walletId,
-			requiredCapability: "export_keys",
-			materialActivation: args.expectedRuntime.materialActivation
-		}
-	});
-	if (resolution.kind !== "resolved") throw new Error(`[SigningEngine][ecdsa-export] active Wallet Authority runtime is ${resolution.reason}`);
-	assertActiveWalletAuthorityEcdsaRuntimeIdentity({
-		expected: args.expectedRuntime,
-		actual: resolution.runtime
-	});
-	return resolution.runtime;
-}
-async function assertActiveWalletAuthorityEcdsaRuntimeStillActive(args) {
-	await resolveFreshActiveWalletAuthorityEcdsaRuntime(args);
-}
-function passkeyExportProof(args) {
-	const credential = args.credential;
-	const credentialId = String(credential.rawId || credential.id || "").trim();
-	if (!credentialId || credentialId !== args.authority.factor.credentialIdB64u) throw new Error("[SigningEngine][ecdsa-export] passkey credential does not match authority");
-	return {
-		kind: "passkey",
-		authority: args.authority,
-		webauthn_authentication: {
-			id: credential.id,
-			rawId: credential.rawId,
-			type: credential.type,
-			authenticatorAttachment: credential.authenticatorAttachment ?? null,
-			response: {
-				clientDataJSON: credential.response.clientDataJSON,
-				authenticatorData: credential.response.authenticatorData,
-				signature: credential.response.signature,
-				userHandle: credential.response.userHandle ?? null
-			},
-			clientExtensionResults: credential.clientExtensionResults ?? null
-		}
-	};
-}
-function emailOtpExportProof(args) {
-	if (!isEmailOtpWalletAuthAuthority(args.authority)) throw new Error("[SigningEngine][ecdsa-export] Email OTP material authority mismatch");
-	return {
-		kind: "email_otp",
-		authority: args.authority,
-		challenge_id: args.challengeId,
-		otp_code: args.otpCode
-	};
-}
-async function issueExplicitEcdsaExportAuthorization(args) {
-	const authorization = await issueEcdsaOperationStepUpAuthorization({
-		relayerUrl: args.relayerUrl,
-		...args.transport ? { transport: args.transport } : {},
-		request: {
-			kind: "router_ab_ecdsa_operation_step_up_v1",
-			operation: args.prepared.operation,
-			proof: args.proof
-		}
-	});
-	if (authorization.operation_kind !== "evm.export_key") throw new Error("[SigningEngine][ecdsa-export] operation step-up kind mismatch");
-	const evidenceSetDigest = authorization.authorization.evidence_set_digest;
-	const unseal = normalizeIssuedEcdsaExportUnseal({
-		proofKind: args.proof.kind,
-		unseal: authorization.authorization.unseal
-	});
-	return {
-		kind: "verified_step_up",
-		evidenceSetDigest,
-		operation: args.prepared.operation,
-		expiresAtMs: authorization.expires_at_ms,
-		quotaUse: "none",
-		unseal,
-		exportTopology: authorization.export_topology
-	};
-}
-function normalizeIssuedEcdsaExportUnseal(args) {
-	switch (args.proofKind) {
-		case "passkey":
-			if (args.unseal.kind !== "not_requested") throw new Error("[SigningEngine][ecdsa-export] passkey step-up returned Email OTP unseal material");
-			return { kind: "not_requested" };
-		case "email_otp":
-			if (args.unseal.kind !== "email_otp_grant") throw new Error("[SigningEngine][ecdsa-export] Email OTP step-up did not return an unseal grant");
-			return {
-				kind: "email_otp_grant",
-				grant: args.unseal.grant,
-				challenge_id: args.unseal.challenge_id
-			};
-		default: {
-			const exhaustive = args.proofKind;
-			throw new Error(`Unsupported ECDSA export step-up proof: ${String(exhaustive)}`);
-		}
-	}
-}
-async function prepareFreshPasskeyEcdsaExportMaterial(deps, args) {
-	requirePasskeyEcdsaExportAuth(args.exportLane);
-	const requestId = createExportUiRequestId("tecdsa-export");
-	const prepared = await prepareExplicitEcdsaExportOperation({
-		walletId: args.walletId,
-		chainTarget: args.exportLane.chainTarget,
-		requestId,
-		keyHandle: args.material.existingRoleLocalMaterial.publicFacts.keyHandle,
-		displayPublicKey: args.material.existingRoleLocalMaterial.publicFacts.groupPublicKey33B64u,
-		displayAddress: args.material.existingRoleLocalMaterial.publicFacts.ethereumAddress,
-		materialActivation: args.material.existingRoleLocalMaterial.materialActivation,
-		operationRuntime: args.material,
-		operationExpiresAtMs: Date.now() + 5 * 6e4
-	});
-	const exportCredential = await requestThresholdEcdsaExportAuthorization({
-		touchConfirm: deps.touchConfirm,
-		theme: deps.theme
-	}, {
-		walletSessionUserId: args.walletId,
-		credentialIdB64u: requirePasskeyEcdsaExportAuth(args.exportLane).credentialIdB64u,
-		publicKey: args.exportPublicKey,
-		chainTarget: args.exportLane.chainTarget,
-		challengeB64u: prepared.challengeB64u,
-		flowId: args.flowId,
-		onEvent: args.onEvent
-	});
-	await assertEcdsaExportMaterialStillActive({
-		deps,
-		exportLane: args.exportLane,
-		expectedMaterialActivation: args.material.existingRoleLocalMaterial.materialActivation
-	});
-	const authority = args.exportLane.capability.authority;
-	if (!isPasskeyWalletAuthAuthority(authority)) throw new Error("[SigningEngine][ecdsa-export] exact Passkey capability authority changed");
-	const authorization = await issueExplicitEcdsaExportAuthorization({
-		relayerUrl: args.material.relayerUrl,
-		prepared,
-		transport: { kind: "legacy_cookie" },
-		proof: passkeyExportProof({
-			authority,
-			credential: exportCredential.credential
-		})
-	});
-	return {
-		exportActivation: buildEcdsaExportActivation({
-			relayerUrl: args.material.relayerUrl,
-			existingRoleLocalMaterial: args.material.existingRoleLocalMaterial,
-			authorization
-		}),
-		credential: exportCredential.credential
-	};
-}
-async function prepareFreshEmailOtpEcdsaExportArtifact(args) {
-	const walletSession = walletSessionRefFromSession({
-		walletId: args.walletId,
-		walletSessionUserId: args.walletId
-	});
-	return await args.deps.emailOtp.exportEcdsaKeyWithDurableAuthorization({
-		walletSession,
-		chainTarget: args.material.chainTarget,
-		challengeId: args.authorization.challengeId,
-		otpCode: args.authorization.otpCode,
-		publicFacts: args.material.publicFacts,
-		runtimePolicyScope: args.material.runtimePolicyScope,
-		authority: args.material.authorization.authority,
-		persistedMaterial: args.persistedMaterial,
-		explicitExportAuthorization: args.explicitExportAuthorization
-	});
-}
-function activeEcdsaExportOperationRuntime(material) {
-	return {
-		normalSigning: material.runtime.normalSigning,
-		relayerKeyId: material.relayerKeyId,
-		participantIds: material.participantIds
-	};
-}
-function activeEcdsaExportOperationExpiry(runtime) {
-	return Math.min(Date.now() + 5 * 6e4, runtime.session.expiresAtMs);
-}
-async function prepareActiveWalletAuthorityPasskeyEcdsaExport(args) {
-	if (args.material.runtime.auth.kind !== "passkey") throw new Error("[SigningEngine][ecdsa-export] active passkey runtime auth mismatch");
-	if (!isPasskeyWalletAuthAuthority(args.material.factorAuthority)) throw new Error("[SigningEngine][ecdsa-export] active passkey factor authority mismatch");
-	const prepared = await prepareExplicitEcdsaExportOperation({
-		walletId: args.walletId,
-		chainTarget: args.exportLane.chainTarget,
-		requestId: createExportUiRequestId("tecdsa-active-passkey-export"),
-		keyHandle: args.material.runtime.publicFacts.keyHandle,
-		displayPublicKey: args.material.runtime.publicFacts.publicKeyB64u,
-		displayAddress: args.material.runtime.publicFacts.thresholdOwnerAddress,
-		materialActivation: args.material.runtime.materialActivation,
-		operationRuntime: activeEcdsaExportOperationRuntime(args.material),
-		operationExpiresAtMs: activeEcdsaExportOperationExpiry(args.material.runtime)
-	});
-	const exportCredential = await requestThresholdEcdsaExportAuthorization({
-		touchConfirm: args.deps.touchConfirm,
-		theme: args.deps.theme
-	}, {
-		walletSessionUserId: args.walletId,
-		credentialIdB64u: args.material.factorAuthority.factor.credentialIdB64u,
-		publicKey: args.exportPublicKey,
-		chainTarget: args.exportLane.chainTarget,
-		challengeB64u: prepared.challengeB64u,
-		flowId: args.flowId,
-		onEvent: args.onEvent
-	});
-	const runtime = await resolveFreshActiveWalletAuthorityEcdsaRuntime({
-		ports: args.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,
-		expectedRuntime: args.material.runtime
-	});
-	if (!isPasskeyWalletAuthAuthority(runtime.factorAuthority)) throw new Error("[SigningEngine][ecdsa-export] active passkey factor authority changed");
-	return {
-		runtime,
-		authorization: await issueExplicitEcdsaExportAuthorization({
-			relayerUrl: args.material.relayerUrl,
-			prepared,
-			transport: {
-				kind: "wallet_session_bearer",
-				token: runtime.operationCredential.token
-			},
-			proof: passkeyExportProof({
-				authority: runtime.factorAuthority,
-				credential: exportCredential.credential
-			})
-		})
-	};
-}
-async function prepareActiveWalletAuthorityEmailOtpEcdsaExport(args) {
-	if (args.material.runtime.auth.kind !== "email_otp") throw new Error("[SigningEngine][ecdsa-export] active Email OTP runtime auth mismatch");
-	if (!isEmailOtpWalletAuthAuthority(args.material.factorAuthority)) throw new Error("[SigningEngine][ecdsa-export] active Email OTP factor authority mismatch");
-	const prepared = await prepareExplicitEcdsaExportOperation({
-		walletId: args.walletId,
-		chainTarget: args.exportLane.chainTarget,
-		requestId: createExportUiRequestId("tecdsa-active-email-otp-export"),
-		keyHandle: args.material.runtime.publicFacts.keyHandle,
-		displayPublicKey: args.material.runtime.publicFacts.publicKeyB64u,
-		displayAddress: args.material.runtime.publicFacts.thresholdOwnerAddress,
-		materialActivation: args.material.runtime.materialActivation,
-		operationRuntime: activeEcdsaExportOperationRuntime(args.material),
-		operationExpiresAtMs: activeEcdsaExportOperationExpiry(args.material.runtime)
-	});
-	const authorization = await requestEmailOtpKeyExportAuthorization({
-		touchConfirm: args.deps.touchConfirm,
-		requestExportChallenge: args.deps.emailOtp.requestExportChallenge
-	}, {
-		kind: "wallet_session_export_auth",
-		walletSession: walletSessionRefFromSession({
-			walletId: args.walletId,
-			walletSessionUserId: args.walletId
-		}),
-		chain: ecdsaExportBoundaryChain(args.exportLane),
-		publicKey: args.exportPublicKey,
-		curve: "ecdsa",
-		flowId: args.flowId,
-		onEvent: args.onEvent
-	});
-	const runtime = await resolveFreshActiveWalletAuthorityEcdsaRuntime({
-		ports: args.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,
-		expectedRuntime: args.material.runtime
-	});
-	if (!isEmailOtpWalletAuthAuthority(runtime.factorAuthority)) throw new Error("[SigningEngine][ecdsa-export] active Email OTP factor authority changed");
-	return {
-		runtime,
-		authorization: await issueExplicitEcdsaExportAuthorization({
-			relayerUrl: args.material.relayerUrl,
-			prepared,
-			transport: {
-				kind: "wallet_session_bearer",
-				token: runtime.operationCredential.token
-			},
-			proof: emailOtpExportProof({
-				authority: runtime.factorAuthority,
-				challengeId: authorization.challengeId,
-				otpCode: authorization.otpCode
-			})
-		})
-	};
-}
-async function prepareActiveWalletAuthorityEcdsaExport(args) {
-	switch (args.material.kind) {
-		case "active_wallet_authority_passkey_needs_authorization": return await prepareActiveWalletAuthorityPasskeyEcdsaExport({
-			deps: args.deps,
-			walletId: args.walletId,
-			exportLane: args.exportLane,
-			material: args.material,
-			exportPublicKey: args.exportPublicKey,
-			flowId: args.flowId,
-			onEvent: args.onEvent
-		});
-		case "active_wallet_authority_email_otp_needs_authorization": return await prepareActiveWalletAuthorityEmailOtpEcdsaExport({
-			deps: args.deps,
-			walletId: args.walletId,
-			exportLane: args.exportLane,
-			material: args.material,
-			exportPublicKey: args.exportPublicKey,
-			flowId: args.flowId,
-			onEvent: args.onEvent
-		});
-		default: return assertNeverActiveWalletAuthorityEcdsaExportMaterial(args.material);
-	}
-}
-function assertNeverActiveWalletAuthorityEcdsaExportMaterial(value) {
-	throw new Error(`[SigningEngine][ecdsa-export] unsupported active wallet authority material: ${String(value)}`);
-}
-async function exportThresholdEcdsaKeyWithActiveWalletAuthority(deps, args) {
-	const exportPublicKey = String(args.material.publicFacts.publicKeyB64u);
-	const prepared = await prepareActiveWalletAuthorityEcdsaExport({
-		deps,
-		walletId: args.walletId,
-		exportLane: args.exportLane,
-		material: args.material,
-		exportPublicKey,
-		flowId: args.flowId,
-		onEvent: args.onEvent
-	});
-	return await prepareAndShowEcdsaExportArtifact(deps, {
-		walletId: args.walletId,
-		exportLane: args.exportLane,
-		activeRuntime: prepared.runtime,
-		exportPublicKey,
-		options: args.options,
-		flowId: args.flowId,
-		onEvent: args.onEvent,
-		prepareArtifact: async () => {
-			const runtime = await resolveFreshActiveWalletAuthorityEcdsaRuntime({
-				ports: deps.activeWalletAuthorityEcdsaRuntimeReadPorts,
-				expectedRuntime: prepared.runtime
-			});
-			return await exportActiveWalletAuthorityEcdsaHolderKey({ getSignerWorkerContext: deps.getSignerWorkerContext }, {
-				runtime,
-				operationAuthorization: prepared.authorization,
-				relayerUrl: args.material.relayerUrl
-			});
-		}
-	});
-}
-async function exportThresholdEcdsaKeyWithFreshEmailOtpRouteAuth(deps, args) {
-	const exportChain = ecdsaExportBoundaryChain(args.exportLane);
-	const prepared = await prepareExplicitEcdsaExportOperationWithRuntime({
-		walletId: args.walletId,
-		chainTarget: args.exportLane.chainTarget,
-		requestId: createExportUiRequestId("tecdsa-email-otp-export"),
-		keyHandle: args.material.persistedMaterial.publicFacts.keyHandle,
-		displayPublicKey: args.material.persistedMaterial.publicFacts.groupPublicKey33B64u,
-		displayAddress: args.material.persistedMaterial.publicFacts.ethereumAddress,
-		materialActivation: args.material.persistedMaterial.materialActivation,
-		operationRuntime: args.material,
-		operationExpiresAtMs: Date.now() + 5 * 6e4
-	});
-	const authorization = await requestEmailOtpKeyExportAuthorization({
-		touchConfirm: deps.touchConfirm,
-		requestExportChallenge: deps.emailOtp.requestExportChallenge
-	}, {
-		kind: "wallet_session_export_auth",
-		walletSession: walletSessionRefFromSession({
-			walletId: args.walletId,
-			walletSessionUserId: args.walletId
-		}),
-		chain: exportChain,
-		publicKey: String(args.material.publicFacts.publicKeyB64u),
-		curve: "ecdsa",
-		flowId: args.flowId,
-		onEvent: args.onEvent
-	});
-	await assertEmailOtpEcdsaExportMaterialStillActive({
-		deps,
-		exportLane: args.exportLane,
-		expectedMaterialActivation: args.material.persistedMaterial.materialActivation
-	});
-	const explicitExportAuthorization = await issueExplicitEcdsaExportAuthorization({
-		relayerUrl: args.material.relayerUrl,
-		prepared,
-		transport: { kind: "legacy_cookie" },
-		proof: emailOtpExportProof({
-			authority: args.material.authorization.authority,
-			challengeId: authorization.challengeId,
-			otpCode: authorization.otpCode
-		})
-	});
-	return await prepareAndShowEcdsaExportArtifact(deps, {
-		walletId: args.walletId,
-		exportLane: args.exportLane,
-		exportPublicKey: String(args.material.publicFacts.publicKeyB64u),
-		options: args.options,
-		flowId: args.flowId,
-		onEvent: args.onEvent,
-		prepareArtifact: prepareFreshEmailOtpEcdsaExportArtifact.bind(void 0, {
-			deps,
-			walletId: args.walletId,
-			material: args.material,
-			authorization,
-			persistedMaterial: args.material.persistedMaterial,
-			explicitExportAuthorization
-		})
-	});
-}
-async function exportThresholdEcdsaKeyWithFreshPasskeyAuthorization(deps, args) {
-	if (args.exportLane.authMethod !== "passkey") throw new Error("[SigningEngine][ecdsa-export] fresh passkey export requires passkey lane");
-	const exportPublicKey = String(args.material.publicFacts.publicKeyB64u);
-	const prepared = await prepareFreshPasskeyEcdsaExportMaterial(deps, {
-		walletId: args.walletId,
-		exportLane: args.exportLane,
-		material: args.material,
-		exportPublicKey,
-		flowId: args.flowId,
-		onEvent: args.onEvent
-	});
-	return await prepareAndShowEcdsaExportArtifact(deps, {
-		walletId: args.walletId,
-		exportLane: args.exportLane,
-		exportPublicKey,
-		options: args.options,
-		flowId: args.flowId,
-		onEvent: args.onEvent,
-		prepareArtifact: async () => {
-			const exportProvision = await deps.provisionPasskeyEcdsaExplicitExportSession(prepared.exportActivation);
-			return await exportEcdsaDerivationKey({ getSignerWorkerContext: deps.getSignerWorkerContext }, {
-				walletSessionUserId: args.walletId,
-				exportProvision,
-				factorAuthorization: {
-					kind: "passkey",
-					passkeyCredentialIdB64u: String(prepared.credential.rawId || prepared.credential.id),
-					credential: prepared.credential
-				}
-			});
-		}
-	});
-}
-//#endregion
-export { exportThresholdEcdsaKeyWithActiveWalletAuthority, exportThresholdEcdsaKeyWithFreshEmailOtpRouteAuth, exportThresholdEcdsaKeyWithFreshPasskeyAuthorization };
-
-//# sourceMappingURL=ecdsaExportFlow.js.map