@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/signingEngine/flows/recovery/keyExportConfirmation.js

@@ -1,325 +0,0 @@
-import { KeyExportEventPhase } from "../../../types/sdkSentEvents.js";
-import { thresholdEcdsaChainTargetKey } from "../../interfaces/ecdsaChainTarget.js";
-import { demoEmailOtpCodeFromDelivery } from "../../session/emailOtp/challengeDelivery.js";
-import { UserConfirmationType } from "../../stepUpConfirmation/userConfirmationType.js";
-import { requestEmailOtpExportAuthorization } from "../../stepUpConfirmation/otpPrompt/exportAuthorization.js";
-import { buildExportStepUpAuthorization } from "./stepUpAuthorization.js";
-import { removeExportViewerHostIfPresent } from "../../uiConfirm/ui/export-viewer-host.js";
-import { createExportUiRequestId, emitKeyExportEvent } from "./keyExportFlow.js";
-//#region src/core/signingEngine/flows/recovery/keyExportConfirmation.ts
-async function requestWalletSessionEcdsaExportChallenge(deps, args) {
-	return await deps.requestExportChallenge({
-		kind: "wallet_login_challenge",
-		walletSession: args.walletSession,
-		chain: args.chain
-	});
-}
-function emitEmailOtpExportChallenge(args, challenge) {
-	const accountId = args.kind === "email_otp_ed25519_export_auth" ? args.walletId : args.walletSession.walletSessionUserId;
-	emitKeyExportEvent(args.onEvent, {
-		phase: KeyExportEventPhase.STEP_02_AUTH_EMAIL_OTP_INPUT_REQUIRED,
-		status: "waiting_for_user",
-		flowId: args.flowId,
-		accountId: String(accountId),
-		authMethod: "email_otp",
-		interaction: {
-			kind: "otp_input",
-			overlay: "show"
-		},
-		data: {
-			emailHint: challenge.emailHint,
-			demoOtpCode: demoEmailOtpCodeFromDelivery(challenge.delivery)
-		}
-	});
-}
-async function requestEmailOtpKeyExportAuthorization(deps, args) {
-	const accountIdForUi = args.walletSession.walletSessionUserId;
-	const authorization = await requestEmailOtpExportAuthorization({
-		identity: {
-			kind: "wallet_session",
-			walletId: accountIdForUi
-		},
-		chain: args.chain,
-		publicKey: args.publicKey,
-		curve: args.curve,
-		challengeSource: { requestChallenge: async () => await requestWalletSessionEcdsaExportChallenge(deps, args) },
-		confirmer: { requestUserConfirmation: async (request) => await deps.touchConfirm.requestUserConfirmation(request) },
-		onChallenge: emitEmailOtpExportChallenge.bind(void 0, args)
-	});
-	const emailOtpPrompt = { challengeId: authorization.challengeId };
-	const decision = {
-		confirmed: true,
-		otpCode: authorization.otpCode,
-		emailOtpChallengeId: authorization.challengeId
-	};
-	const exportAuthorization = buildExportStepUpAuthorization({
-		method: "email_otp",
-		walletSessionUserId: accountIdForUi,
-		chain: args.chain,
-		publicKey: args.publicKey,
-		curve: "ecdsa",
-		intent: "ecdsa_export",
-		emailOtpPrompt,
-		decision
-	});
-	if (exportAuthorization.kind !== "email_otp") throw new Error("[SigningEngine][export] Email OTP export returned the wrong step-up method");
-	return exportAuthorization;
-}
-async function requestEmailOtpEd25519KeyExportAuthorization(deps, args) {
-	const authorization = await requestEmailOtpExportAuthorization({
-		identity: {
-			kind: "near_account",
-			walletId: args.walletId,
-			nearAccountId: args.nearAccountId
-		},
-		chain: "near",
-		publicKey: args.publicKey,
-		curve: "ed25519",
-		challengeSource: { requestChallenge: async () => await deps.requestExportChallenge({
-			kind: "wallet_export_challenge",
-			walletId: args.walletId,
-			chain: "near"
-		}) },
-		confirmer: { requestUserConfirmation: async (request) => await deps.touchConfirm.requestUserConfirmation(request) },
-		onChallenge: emitEmailOtpExportChallenge.bind(void 0, args)
-	});
-	const exportAuthorization = buildExportStepUpAuthorization({
-		method: "email_otp",
-		walletSessionUserId: args.walletId,
-		publicKey: args.publicKey,
-		curve: "ed25519",
-		intent: "ed25519_export",
-		chain: "near",
-		nearAccountId: args.nearAccountId,
-		nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-		signerSlot: args.signerSlot,
-		emailOtpPrompt: { challengeId: authorization.challengeId },
-		decision: {
-			confirmed: true,
-			otpCode: authorization.otpCode,
-			emailOtpChallengeId: authorization.challengeId
-		}
-	});
-	if (exportAuthorization.kind !== "email_otp" || exportAuthorization.curve !== "ed25519") throw new Error("[SigningEngine][export] Ed25519 Email OTP export authorization changed kind");
-	return exportAuthorization;
-}
-async function showEd25519ExportViewer(deps, args) {
-	const isLoading = args.state === "loading";
-	const keys = [{
-		scheme: "ed25519",
-		label: "NEAR Ed25519 private key",
-		publicKey: args.publicKey,
-		privateKey: isLoading ? "" : args.privateKey
-	}];
-	await deps.touchConfirm.requestUserConfirmation({
-		requestId: createExportUiRequestId("export-ed25519-yao-view"),
-		type: UserConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI,
-		summary: {
-			operation: "Export Private Key",
-			accountId: args.nearAccountId,
-			publicKey: args.publicKey,
-			warning: "Anyone with your private key can fully control your account. Never share it."
-		},
-		payload: {
-			subject: {
-				kind: "near_wallet",
-				nearAccountId: args.nearAccountId
-			},
-			viewerSessionId: args.viewerSessionId,
-			publicKey: args.publicKey,
-			keys,
-			variant: args.variant,
-			theme: args.theme ?? deps.theme ?? "dark",
-			loading: isLoading,
-			onLifecycle: (event) => {
-				emitKeyExportEvent(args.onEvent, {
-					phase: event === "opened" ? KeyExportEventPhase.STEP_04_VIEWER_OPENED : KeyExportEventPhase.STEP_05_VIEWER_CLOSED,
-					status: event === "opened" ? "waiting_for_user" : "succeeded",
-					flowId: args.flowId,
-					accountId: args.nearAccountId,
-					interaction: {
-						kind: "key_export_viewer",
-						overlay: event === "opened" ? "show" : "hide"
-					},
-					data: {
-						chain: "near",
-						curve: "ed25519",
-						loading: isLoading
-					}
-				});
-				if (event === "closed") emitKeyExportEvent(args.onEvent, {
-					phase: KeyExportEventPhase.STEP_06_COMPLETED,
-					status: "succeeded",
-					flowId: args.flowId,
-					accountId: args.nearAccountId,
-					interaction: {
-						kind: "none",
-						overlay: "hide"
-					},
-					data: {
-						chain: "near",
-						curve: "ed25519"
-					}
-				});
-			}
-		},
-		intentDigest: `export-keys:${args.walletId}:near:${args.nearAccountId}:ed25519`
-	});
-}
-async function requestThresholdEcdsaExportAuthorization(deps, args) {
-	const chain = args.chainTarget.kind;
-	const walletIdForUi = String(args.walletSessionUserId || "").trim();
-	if (!walletIdForUi) throw new Error("[SigningEngine][export] missing ECDSA export wallet session user id");
-	return await requestPasskeyExportAuthorization(deps, {
-		walletSessionUserId: args.walletSessionUserId,
-		intent: "ecdsa_export",
-		curve: "ecdsa",
-		chain,
-		publicKey: args.publicKey,
-		flowId: args.flowId,
-		onEvent: args.onEvent,
-		request: {
-			requestId: createExportUiRequestId("export-threshold-ecdsa-auth"),
-			type: UserConfirmationType.AUTHORIZE_KEY_EXPORT,
-			summary: {
-				operation: "Export Private Key",
-				accountId: walletIdForUi,
-				publicKey: args.publicKey,
-				warning: chain === "tempo" ? "Confirm to reveal your Tempo private key export." : "Confirm to reveal your EVM private key export."
-			},
-			payload: {
-				subject: {
-					kind: "evm_wallet",
-					walletId: walletIdForUi
-				},
-				credentialIdB64u: args.credentialIdB64u,
-				publicKey: args.publicKey,
-				...args.challengeB64u ? { challengeB64u: args.challengeB64u } : {}
-			},
-			intentDigest: `export-keys:${walletIdForUi}:${thresholdEcdsaChainTargetKey(args.chainTarget)}:secp256k1`
-		}
-	});
-}
-async function showThresholdEcdsaExportViewer(deps, args) {
-	const chain = args.chainTarget.kind;
-	const label = chain === "tempo" ? "Tempo" : "EVM";
-	const isLoading = args.state === "loading";
-	const keys = isLoading ? [{
-		scheme: "secp256k1",
-		label,
-		publicKey: args.publicKeyHex,
-		privateKey: "",
-		address: args.ethereumAddress
-	}] : [{
-		scheme: "secp256k1",
-		label,
-		publicKey: args.publicKeyHex,
-		privateKey: args.privateKeyHex,
-		address: args.ethereumAddress
-	}];
-	await deps.touchConfirm.requestUserConfirmation({
-		requestId: createExportUiRequestId("export-threshold-ecdsa-view"),
-		type: UserConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI,
-		summary: {
-			operation: "Export Private Key",
-			accountId: args.walletId,
-			publicKey: args.publicKeyHex,
-			warning: "Anyone with your private key can fully control your account. Never share it."
-		},
-		payload: {
-			subject: {
-				kind: "evm_wallet",
-				walletId: args.walletId
-			},
-			viewerSessionId: args.viewerSessionId,
-			publicKey: args.publicKeyHex,
-			keys,
-			variant: args.variant,
-			theme: args.theme ?? deps.theme ?? "dark",
-			loading: isLoading,
-			onLifecycle: (event) => {
-				emitKeyExportEvent(args.onEvent, {
-					phase: event === "opened" ? KeyExportEventPhase.STEP_04_VIEWER_OPENED : KeyExportEventPhase.STEP_05_VIEWER_CLOSED,
-					status: event === "opened" ? "waiting_for_user" : "succeeded",
-					flowId: args.flowId,
-					accountId: String(args.walletId),
-					interaction: {
-						kind: "key_export_viewer",
-						overlay: event === "opened" ? "show" : "hide"
-					},
-					data: {
-						chain,
-						curve: "ecdsa",
-						loading: isLoading
-					}
-				});
-				if (event === "closed") emitKeyExportEvent(args.onEvent, {
-					phase: KeyExportEventPhase.STEP_06_COMPLETED,
-					status: "succeeded",
-					flowId: args.flowId,
-					accountId: String(args.walletId),
-					interaction: {
-						kind: "none",
-						overlay: "hide"
-					},
-					data: {
-						chain,
-						curve: "ecdsa"
-					}
-				});
-			}
-		},
-		intentDigest: `export-keys:${args.walletId}:${thresholdEcdsaChainTargetKey(args.chainTarget)}:secp256k1`
-	});
-}
-async function requestPasskeyExportAuthorization(deps, args) {
-	const accountIdForUi = String(args.walletSessionUserId || "").trim();
-	if (!accountIdForUi) throw new Error("[SigningEngine][export] missing export account identity");
-	emitKeyExportEvent(args.onEvent, {
-		phase: KeyExportEventPhase.STEP_02_AUTH_PASSKEY_PROMPT_STARTED,
-		status: "waiting_for_user",
-		flowId: args.flowId,
-		accountId: String(accountIdForUi),
-		authMethod: "passkey",
-		interaction: {
-			kind: "passkey_assert",
-			overlay: "show"
-		},
-		data: {
-			intent: args.intent,
-			curve: args.curve
-		}
-	});
-	removeExportViewerHostIfPresent();
-	const decision = await deps.touchConfirm.requestUserConfirmation(args.request);
-	const authorization = buildExportStepUpAuthorization({
-		method: "passkey",
-		walletSessionUserId: args.walletSessionUserId,
-		publicKey: args.publicKey,
-		curve: "ecdsa",
-		intent: "ecdsa_export",
-		chain: args.chain,
-		decision
-	});
-	if (authorization.kind !== "passkey") throw new Error("[SigningEngine][export] passkey export returned the wrong step-up method");
-	emitKeyExportEvent(args.onEvent, {
-		phase: KeyExportEventPhase.STEP_02_AUTH_PASSKEY_PROMPT_SUCCEEDED,
-		status: "succeeded",
-		flowId: args.flowId,
-		accountId: String(accountIdForUi),
-		authMethod: "passkey",
-		interaction: {
-			kind: "passkey_assert",
-			overlay: "hide"
-		},
-		data: {
-			intent: args.intent,
-			curve: args.curve
-		}
-	});
-	return authorization;
-}
-//#endregion
-export { requestEmailOtpEd25519KeyExportAuthorization, requestEmailOtpKeyExportAuthorization, requestThresholdEcdsaExportAuthorization, showEd25519ExportViewer, showThresholdEcdsaExportViewer };
-
-//# sourceMappingURL=keyExportConfirmation.js.map

package/dist/esm/core/signingEngine/flows/recovery/keyExportFlow.js

@@ -1,81 +0,0 @@
-import { KeyExportEventPhase, createKeyExportFlowEvent } from "../../../types/sdkSentEvents.js";
-import { thresholdEcdsaChainTargetKey } from "../../interfaces/ecdsaChainTarget.js";
-import { secureRandomId } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { errorMessage, isUserCancellationError } from "../../../../shared-ts/src/utils/errors.js";
-//#region src/core/signingEngine/flows/recovery/keyExportFlow.ts
-function keyExportFlowContext(input) {
-	switch (input.kind) {
-		case "ecdsa": return {
-			subject: `${String(input.walletSession.walletId)}:${thresholdEcdsaChainTargetKey(input.chainTarget)}`,
-			chain: input.chainTarget.kind,
-			data: {
-				curve: "ecdsa",
-				chain: input.chainTarget.kind,
-				chainTarget: input.chainTarget
-			}
-		};
-		case "ed25519": return {
-			subject: `${String(input.walletSession.walletId)}:near:${String(input.nearAccount.accountId)}`,
-			chain: "near",
-			data: {
-				curve: "ed25519",
-				chain: "near",
-				nearAccount: input.nearAccount
-			}
-		};
-	}
-}
-function emitKeyExportEvent(onEvent, input) {
-	if (!onEvent) return;
-	try {
-		onEvent(createKeyExportFlowEvent(input));
-	} catch {}
-}
-function createExportUiRequestId(prefix) {
-	return secureRandomId(prefix, 32, "key export UI request IDs");
-}
-function createKeyExportFlowId(subjectId, chain) {
-	return `key-export:${subjectId}:${chain}:${createExportUiRequestId("flow")}`;
-}
-async function runKeyExportWithFlowEvents(input, execute) {
-	const context = keyExportFlowContext(input);
-	const flowId = createKeyExportFlowId(context.subject, context.chain);
-	const accountId = input.walletSession.walletId;
-	const eventData = context.data;
-	emitKeyExportEvent(input.options.onEvent, {
-		phase: KeyExportEventPhase.STEP_01_STARTED,
-		status: "running",
-		flowId,
-		accountId: String(accountId),
-		interaction: {
-			kind: "none",
-			overlay: "none"
-		},
-		data: eventData
-	});
-	try {
-		return await execute({
-			...input,
-			flowId
-		});
-	} catch (error) {
-		const cancelled = isUserCancellationError(error);
-		emitKeyExportEvent(input.options.onEvent, {
-			phase: cancelled ? KeyExportEventPhase.CANCELLED : KeyExportEventPhase.FAILED,
-			status: cancelled ? "cancelled" : "failed",
-			flowId,
-			accountId: String(accountId),
-			interaction: {
-				kind: "none",
-				overlay: "hide"
-			},
-			error: { message: errorMessage(error) || (cancelled ? "Key export cancelled" : "Key export failed") },
-			data: eventData
-		});
-		throw error;
-	}
-}
-//#endregion
-export { createExportUiRequestId, emitKeyExportEvent, runKeyExportWithFlowEvents };
-
-//# sourceMappingURL=keyExportFlow.js.map

package/dist/esm/core/signingEngine/flows/recovery/passkeyEd25519YaoRecovery.js

@@ -1,192 +0,0 @@
-import { mpcMaterialActivationRefsEqual, parseWalletAuthMethodId, parseWalletAuthorityId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { requireRecord, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
-import { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
-import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
-import { toAccountId } from "../../../types/accountIds.js";
-import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { normalizeRuntimePolicyScope, sameRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { toRpId } from "../../session/identity/evmFamilyEcdsaIdentity.js";
-import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../../../../shared-ts/src/passkey-custody/index.js";
-import { parseWalletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
-import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import "../../../../shared-ts/src/device-linking/index.js";
-import { buildRouterAbEd25519SigningWalletSession } from "../../session/routerAbSigningWalletSession.js";
-import { buildPasskeyRouterAbEd25519WalletSessionState } from "../../session/warmCapabilities/routerAbEd25519WalletSessionState.js";
-import { parseEd25519YaoRecoveryCapabilityV1 } from "../../session/passkey/ed25519YaoRecoveryCapability.js";
-//#region src/core/signingEngine/flows/recovery/passkeyEd25519YaoRecovery.ts
-function passkeyEd25519YaoLaneReferenceFromRecovery(args) {
-	const lane = args.walletSessionState.signingLane;
-	if (lane.auth.kind !== "passkey") throw new Error("[SigningEngine][near] Passkey recovery returned another auth lane");
-	const signer = lane.identity.signer;
-	return {
-		walletId: signer.account.wallet.walletId,
-		nearAccountId: signer.account.nearAccountId,
-		thresholdSessionId: args.walletSessionState.thresholdSessionId,
-		runtimePolicyScope: args.walletSessionState.runtimePolicyScope,
-		materialActivation: args.materialActivation,
-		auth: {
-			kind: "passkey",
-			rpId: lane.auth.rpId,
-			credentialIdB64u: lane.auth.credentialIdB64u
-		},
-		nearEd25519SigningKeyId: signer.nearEd25519SigningKeyId,
-		signerSlot: signer.signerSlot
-	};
-}
-function requirePositiveInteger(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
-	return value;
-}
-function requireParticipantIds(value) {
-	if (!Array.isArray(value) || value.length !== 2 || !Number.isSafeInteger(value[0]) || !Number.isSafeInteger(value[1]) || value[0] < 1 || value[1] < 1 || value[0] === value[1]) throw new Error("participantIds must contain two distinct positive integers");
-	return [Number(value[0]), Number(value[1])];
-}
-function isEd25519SignWalletCapabilitySubject(subject) {
-	return subject.kind === "sign" && subject.keyFamily === "ed25519";
-}
-function parseExactRecoverySession(raw, participantIds, identity, walletSession, operationCredential, expected) {
-	if ("sessionKind" in raw || "walletSessionToken" in raw) throw new Error("sync-account signer bootstrap must not carry a Wallet Session bearer");
-	if (requireTrimmedString(raw.walletId, "session.walletId") !== identity.walletId || requireTrimmedString(raw.nearAccountId, "session.nearAccountId") !== identity.nearAccountId || requireTrimmedString(raw.nearEd25519SigningKeyId, "session.nearEd25519SigningKeyId") !== identity.nearEd25519SigningKeyId) throw new Error("Yao recovery session identity does not match the verified passkey");
-	const runtimePolicyScope = normalizeRuntimePolicyScope(requireRecord(raw.runtimePolicyScope, "session.runtimePolicyScope"));
-	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(raw.routerAbNormalSigning);
-	if (!routerAbNormalSigning) throw new Error("Yao recovery session signing state is invalid");
-	const walletSessionId = parseWalletSessionId(raw.walletSessionId);
-	const quotaId = parseMpcWalletSigningQuotaId(raw.quotaId);
-	if (!walletSessionId.ok || !quotaId.ok) throw new Error("Yao recovery Wallet Session identity is invalid");
-	const expiresAtMs = requirePositiveInteger(raw.expiresAtMs, "session.expiresAtMs");
-	const remainingUses = requirePositiveInteger(raw.remainingUses, "session.remainingUses");
-	const ed25519SignSubject = walletSession.capabilitySubjects.find(isEd25519SignWalletCapabilitySubject);
-	if (walletSession.walletId !== identity.walletId || walletSession.authorityId !== expected.walletAuthorityId || walletSession.authMethodId !== expected.walletAuthMethodId || walletSession.authorityDigestB64u !== expected.authorityDigestB64u || walletSession.authorityRevocationEpoch !== expected.authorityRevocationEpoch || walletSession.expiresAtMs !== expiresAtMs || operationCredential.walletSessionId !== walletSessionId.value || !ed25519SignSubject || !mpcMaterialActivationRefsEqual(ed25519SignSubject.materialActivation, expected.materialActivation)) throw new Error("Yao recovery session does not match the exact Wallet Session");
-	return {
-		thresholdSessionId: requireTrimmedString(raw.thresholdSessionId, "session.thresholdSessionId"),
-		authorizationId: walletSession.authorizationId,
-		walletSessionId: operationCredential.walletSessionId,
-		quotaId: quotaId.value,
-		expiresAtMs,
-		remainingUses,
-		runtimePolicyScope,
-		participantIds,
-		routerAbNormalSigning,
-		walletSession,
-		operationCredential
-	};
-}
-function assertEd25519YaoRecoveryDescriptorStableIdentity(parsed) {
-	const capability = parsed.capability;
-	const session = parsed.session;
-	const signingRoot = signingRootScopeFromRuntimePolicyScope(session.runtimePolicyScope);
-	if (!signingRoot || capability.applicationBinding.wallet_id !== String(parsed.walletId) || capability.applicationBinding.near_ed25519_signing_key_id !== parsed.nearEd25519SigningKeyId || capability.applicationBinding.key_creation_signer_slot !== parsed.signerSlot || capability.nearAccountId !== parsed.nearAccountId || capability.lifecycle.accountId !== String(parsed.walletId) || capability.lifecycle.signingWorkerId !== parsed.relayerKeyId || session.routerAbNormalSigning?.signingWorkerId !== parsed.relayerKeyId || session.participantIds[0] !== capability.participantIds[0] || session.participantIds[1] !== capability.participantIds[1] || !sameRuntimePolicyScope(session.runtimePolicyScope, capability.runtimePolicyScope) || session.runtimePolicyScope.signingRootVersion !== capability.lifecycle.rootShareEpoch || capability.applicationBinding.signing_root_id !== signingRoot.signingRootId || parsed.operationalPublicKey !== `ed25519:${base58Encode(Uint8Array.from(capability.registeredPublicKey))}`) throw new Error("Yao recovery response does not preserve the registered wallet identity");
-}
-function assertEd25519YaoRecoveryDescriptorContinuity(parsed) {
-	assertEd25519YaoRecoveryDescriptorStableIdentity(parsed);
-	if (parsed.capability.lifecycle.thresholdSessionId !== parsed.session.thresholdSessionId) throw new Error("Yao recovery response does not preserve the threshold material lifecycle");
-}
-function assertEd25519YaoWarmRecoveryDescriptorStableMaterialContinuity(parsed, expectedMaterialActivation) {
-	assertEd25519YaoRecoveryDescriptorStableIdentity(parsed);
-	if (!mpcMaterialActivationRefsEqual(parsed.capability.materialActivation, expectedMaterialActivation)) throw new Error("Yao warm recovery response does not preserve exact material activation");
-}
-function walletSessionTokenForSigning(session) {
-	return "operationCredential" in session ? session.operationCredential.token : session.walletSessionToken;
-}
-function parsePasskeyEd25519YaoSyncResponseV1(raw) {
-	const response = requireRecord(raw, "sync-account response");
-	if (response.ok !== true || response.verified !== true) throw new Error("sync-account response is not verified");
-	const walletId = walletIdFromString(requireTrimmedString(response.walletId, "walletId"));
-	const nearAccountId = toAccountId(requireTrimmedString(response.nearAccountId, "nearAccountId"));
-	const nearEd25519SigningKeyId = requireTrimmedString(response.nearEd25519SigningKeyId, "nearEd25519SigningKeyId");
-	const threshold = requireRecord(response.thresholdEd25519, "thresholdEd25519");
-	const participantIds = requireParticipantIds(threshold.participantIds);
-	const recovery = requireRecord(response.ed25519YaoRecovery, "ed25519YaoRecovery");
-	if (recovery.kind !== "router_ab_ed25519_yao_sync_recovery_v1") throw new Error("sync-account recovery kind is invalid");
-	const authority = parseWalletAuthAuthorityRef(recovery.authorityRef);
-	if (!authority || String(authority.walletId) !== String(walletId)) throw new Error("sync-account recovery authority is invalid");
-	const walletAuthMethodId = parseWalletAuthMethodId(response.walletAuthMethodId);
-	const walletAuthorityId = parseWalletAuthorityId(response.walletAuthorityId);
-	const foundingAuthority = parseWalletAuthorityV1(response.foundingAuthority);
-	const foundingAuthMethod = parseWalletAuthMethodRecordV2(response.foundingAuthMethod);
-	if (!walletAuthMethodId.ok || !walletAuthorityId.ok || walletAuthMethodId.value !== authority.walletAuthMethodId || !foundingAuthority.ok || foundingAuthority.value.state !== "active" || foundingAuthority.value.provenance.kind !== "wallet_registration" || foundingAuthority.value.walletId !== walletId || foundingAuthority.value.authorityId !== walletAuthorityId.value || !foundingAuthMethod || foundingAuthMethod.kind !== "passkey" || foundingAuthMethod.status !== "active" || foundingAuthMethod.walletId !== walletId || foundingAuthMethod.walletAuthorityId !== walletAuthorityId.value || foundingAuthMethod.walletAuthMethodId !== walletAuthMethodId.value) throw new Error("sync-account exact auth-method identity is invalid");
-	const custody = requireRecord(response.walletCustody, "walletCustody");
-	if (custody.kind !== "wallet_custody_sync_bootstrap_v1") throw new Error("walletCustody kind is invalid");
-	const capability = parseEd25519YaoRecoveryCapabilityV1(recovery.capability);
-	const walletSession = parseActiveWalletSessionV1(response.walletSession);
-	const operationCredential = parseWalletSessionOperationCredentialV1(response.operationCredential);
-	const parsed = {
-		authority,
-		walletAuthMethodId: walletAuthMethodId.value,
-		walletAuthorityId: walletAuthorityId.value,
-		foundingAuthority: foundingAuthority.value,
-		foundingAuthMethod,
-		walletId,
-		nearAccountId,
-		nearEd25519SigningKeyId,
-		signerSlot: requirePositiveInteger(response.signerSlot, "signerSlot"),
-		operationalPublicKey: requireTrimmedString(response.publicKey, "publicKey"),
-		relayerKeyId: requireTrimmedString(threshold.relayerKeyId, "thresholdEd25519.relayerKeyId"),
-		keyVersion: requireTrimmedString(threshold.keyVersion, "thresholdEd25519.keyVersion"),
-		credentialIdB64u: requireTrimmedString(response.credentialIdB64u, "credentialIdB64u"),
-		credentialPublicKeyB64u: requireTrimmedString(response.credentialPublicKeyB64u, "credentialPublicKeyB64u"),
-		session: parseExactRecoverySession(requireRecord(threshold.session, "thresholdEd25519.session"), participantIds, {
-			walletId: String(walletId),
-			nearAccountId: String(nearAccountId),
-			nearEd25519SigningKeyId
-		}, walletSession, operationCredential, {
-			walletAuthorityId: walletAuthorityId.value,
-			walletAuthMethodId: walletAuthMethodId.value,
-			authorityDigestB64u: foundingAuthority.value.authorityDigestB64u,
-			authorityRevocationEpoch: foundingAuthority.value.revocationEpoch,
-			materialActivation: capability.materialActivation
-		}),
-		capability,
-		walletSession,
-		operationCredential,
-		walletCustody: {
-			envelope: parsePasskeyCustodyEnvelopeRecord(custody.envelope),
-			storeVersion: requireTrimmedString(custody.storeVersion, "walletCustody.storeVersion")
-		}
-	};
-	assertEd25519YaoRecoveryDescriptorContinuity(parsed);
-	return parsed;
-}
-function buildRecoveredWalletSessionState(input) {
-	const parsed = input.parsed;
-	const session = parsed.session;
-	const signingRoot = signingRootScopeFromRuntimePolicyScope(session.runtimePolicyScope);
-	const signingWalletSession = buildRouterAbEd25519SigningWalletSession({
-		walletId: String(parsed.walletId),
-		nearAccountId: String(parsed.nearAccountId),
-		nearEd25519SigningKeyId: parsed.nearEd25519SigningKeyId,
-		walletSessionId: session.walletSessionId,
-		authorizationId: session.authorizationId,
-		quotaId: session.quotaId,
-		thresholdSessionId: input.thresholdSessionId,
-		remainingUses: session.remainingUses,
-		expiresAtMs: session.expiresAtMs,
-		runtimePolicyScope: session.runtimePolicyScope,
-		signingRootId: signingRoot.signingRootId,
-		signingRootVersion: String(signingRoot.signingRootVersion || ""),
-		routerAbNormalSigning: session.routerAbNormalSigning,
-		walletSessionToken: walletSessionTokenForSigning(session),
-		nowMs: Math.min(Date.now(), session.expiresAtMs - 1)
-	});
-	if (!signingWalletSession.ok) throw new Error(`recovered Yao Wallet Session is unusable: ${signingWalletSession.reason}`);
-	return buildPasskeyRouterAbEd25519WalletSessionState({
-		walletId: toWalletId(parsed.walletId),
-		nearAccountId: parsed.nearAccountId,
-		nearEd25519SigningKeyId: nearEd25519SigningKeyIdFromString(parsed.nearEd25519SigningKeyId),
-		signerSlot: parsed.signerSlot,
-		rpId: toRpId(input.rpId),
-		credentialIdB64u: parsed.credentialIdB64u,
-		relayerUrl: input.relayerUrl,
-		authority: parsed.authority,
-		signingWalletSession: signingWalletSession.value
-	});
-}
-//#endregion
-export { assertEd25519YaoWarmRecoveryDescriptorStableMaterialContinuity, buildRecoveredWalletSessionState, parsePasskeyEd25519YaoSyncResponseV1, passkeyEd25519YaoLaneReferenceFromRecovery };
-
-//# sourceMappingURL=passkeyEd25519YaoRecovery.js.map

package/dist/esm/core/signingEngine/flows/recovery/public.js

@@ -1,26 +0,0 @@
-import { exportKeypairWithUI as exportKeypairWithUI$1, resolveExactKeyExportLane as resolveExactKeyExportLane$1 } from "./exportKeypairOperation.js";
-//#region src/core/signingEngine/flows/recovery/public.ts
-function exportKeypairDeps(deps) {
-	return {
-		laneSelection: deps.laneSelection,
-		sessionLifecycle: deps.sessionLifecycle,
-		ecdsa: {
-			...deps.ecdsa,
-			theme: deps.getTheme()
-		},
-		ed25519Yao: {
-			...deps.ed25519Yao,
-			theme: deps.getTheme()
-		}
-	};
-}
-async function exportKeypairWithUI(deps, input) {
-	return await exportKeypairWithUI$1(exportKeypairDeps(deps), input);
-}
-async function resolveExactKeyExportLane(deps, input) {
-	return await resolveExactKeyExportLane$1(exportKeypairDeps(deps), input);
-}
-//#endregion
-export { exportKeypairWithUI, resolveExactKeyExportLane };
-
-//# sourceMappingURL=public.js.map