@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/signingEngine/flows/recovery/stepUpAuthorization.js

@@ -1,139 +0,0 @@
-import { SigningAuthPlanKind } from "../../stepUpConfirmation/types.js";
-import { normalizeAuthenticationCredential } from "../../webauthnAuth/credentials/helpers.js";
-//#region src/core/signingEngine/flows/recovery/stepUpAuthorization.ts
-function assertNeverExportAuthorizationIdentity(value) {
-	throw new Error(`[SigningEngine][export] unsupported authorization identity: ${String(value)}`);
-}
-function assertNeverExportStepUpMethod(value) {
-	throw new Error(`[SigningEngine][export] unsupported step-up method: ${String(value)}`);
-}
-function normalizeExportAuthorizationIdentity(args) {
-	const walletSessionUserId = String(args.walletSessionUserId || "").trim();
-	if (!walletSessionUserId) throw new Error("[SigningEngine][export] missing export step-up authorization identity");
-	const publicKey = String(args.publicKey || "").trim();
-	if (!publicKey) throw new Error("[SigningEngine][export] missing export step-up authorization public key");
-	switch (args.curve) {
-		case "ecdsa": return {
-			walletSessionUserId,
-			publicKey,
-			curve: "ecdsa",
-			intent: "ecdsa_export",
-			chain: args.chain
-		};
-		case "ed25519": {
-			const identity = {
-				walletSessionUserId,
-				publicKey,
-				curve: "ed25519",
-				intent: "ed25519_export",
-				chain: "near",
-				nearAccountId: String(args.nearAccountId || "").trim(),
-				nearEd25519SigningKeyId: String(args.nearEd25519SigningKeyId || "").trim(),
-				signerSlot: Number(args.signerSlot)
-			};
-			if (!identity.nearAccountId || !identity.nearEd25519SigningKeyId || !Number.isSafeInteger(identity.signerSlot) || identity.signerSlot < 1) throw new Error("[SigningEngine][export] Ed25519 export authorization identity is invalid");
-			return identity;
-		}
-		default: return assertNeverExportAuthorizationIdentity(args);
-	}
-}
-function buildEmailOtpExportAuthorization(args) {
-	const signingAuthPlan = {
-		kind: SigningAuthPlanKind.EmailOtpReauth,
-		method: "email_otp",
-		emailOtpPrompt: args.emailOtpPrompt
-	};
-	const emailHint = args.emailOtpPrompt.emailHint;
-	switch (args.identity.curve) {
-		case "ecdsa": return {
-			kind: "email_otp",
-			signingAuthPlan,
-			challengeId: args.challengeId,
-			otpCode: args.otpCode,
-			walletSessionUserId: args.identity.walletSessionUserId,
-			publicKey: args.identity.publicKey,
-			curve: "ecdsa",
-			intent: "ecdsa_export",
-			chain: args.identity.chain,
-			...emailHint ? { emailHint } : {}
-		};
-		case "ed25519": return {
-			kind: "email_otp",
-			signingAuthPlan,
-			challengeId: args.challengeId,
-			otpCode: args.otpCode,
-			walletSessionUserId: args.identity.walletSessionUserId,
-			publicKey: args.identity.publicKey,
-			curve: "ed25519",
-			intent: "ed25519_export",
-			chain: "near",
-			nearAccountId: args.identity.nearAccountId,
-			nearEd25519SigningKeyId: args.identity.nearEd25519SigningKeyId,
-			signerSlot: args.identity.signerSlot,
-			...emailHint ? { emailHint } : {}
-		};
-		default: return assertNeverExportAuthorizationIdentity(args.identity);
-	}
-}
-function buildPasskeyExportAuthorization(args) {
-	const signingAuthPlan = {
-		kind: SigningAuthPlanKind.PasskeyReauth,
-		method: "passkey"
-	};
-	switch (args.identity.curve) {
-		case "ecdsa": return {
-			kind: "passkey",
-			signingAuthPlan,
-			credential: args.credential,
-			walletSessionUserId: args.identity.walletSessionUserId,
-			publicKey: args.identity.publicKey,
-			curve: "ecdsa",
-			intent: "ecdsa_export",
-			chain: args.identity.chain
-		};
-		case "ed25519": return {
-			kind: "passkey",
-			signingAuthPlan,
-			credential: args.credential,
-			walletSessionUserId: args.identity.walletSessionUserId,
-			publicKey: args.identity.publicKey,
-			curve: "ed25519",
-			intent: "ed25519_export",
-			chain: "near",
-			nearAccountId: args.identity.nearAccountId,
-			nearEd25519SigningKeyId: args.identity.nearEd25519SigningKeyId,
-			signerSlot: args.identity.signerSlot
-		};
-		default: return assertNeverExportAuthorizationIdentity(args.identity);
-	}
-}
-function buildExportStepUpAuthorization(args) {
-	const identity = normalizeExportAuthorizationIdentity(args);
-	switch (args.method) {
-		case "email_otp": {
-			if (!args.decision.confirmed) throw new Error(args.decision.error || "User cancelled Email OTP export request");
-			const otpCode = String(args.decision.otpCode || "").replace(/\D/g, "").slice(0, 6);
-			if (otpCode.length !== 6) throw new Error("Email OTP export requires a 6-digit code");
-			const challengeId = String(args.decision.emailOtpChallengeId || args.emailOtpPrompt.challengeId || "").trim();
-			if (!challengeId) throw new Error("Email OTP export challenge response did not include challengeId");
-			return buildEmailOtpExportAuthorization({
-				identity,
-				emailOtpPrompt: args.emailOtpPrompt,
-				challengeId,
-				otpCode
-			});
-		}
-		case "passkey":
-			if (!args.decision.confirmed) throw new Error(args.decision.error || "User cancelled export request");
-			if (!args.decision.credential) throw new Error("[SigningEngine][export] missing WebAuthn credential for export authorization");
-			return buildPasskeyExportAuthorization({
-				identity,
-				credential: normalizeAuthenticationCredential(args.decision.credential)
-			});
-		default: return assertNeverExportStepUpMethod(args);
-	}
-}
-//#endregion
-export { buildExportStepUpAuthorization };
-
-//# sourceMappingURL=stepUpAuthorization.js.map

package/dist/esm/core/signingEngine/flows/registration/nearProvisioningRegistry.js

@@ -1,79 +0,0 @@
-//#region src/core/signingEngine/flows/registration/nearProvisioningRegistry.ts
-const entries = /* @__PURE__ */ new Map();
-const listeners = /* @__PURE__ */ new Set();
-function notify(walletId, state) {
-	for (const listener of listeners) try {
-		listener(walletId, state);
-	} catch {}
-}
-function entryFor(walletId, nowMs) {
-	const key = String(walletId);
-	const existing = entries.get(key);
-	if (existing) return existing;
-	const created = {
-		state: {
-			status: "near_pending",
-			updatedAtMs: nowMs
-		},
-		inFlight: null
-	};
-	entries.set(key, created);
-	return created;
-}
-function readNearProvisioningState(walletId) {
-	return entries.get(String(walletId))?.state ?? null;
-}
-async function awaitNearProvisioningInFlight(walletId) {
-	const entry = entries.get(String(walletId));
-	if (!entry) return null;
-	return entry.inFlight ? await entry.inFlight : entry.state;
-}
-function publishNearProvisioningState(walletId, state) {
-	const entry = entryFor(walletId, state.updatedAtMs);
-	if (entry.state.status === "near_ready" && state.status !== "near_ready") return;
-	entry.state = state;
-	notify(walletId, state);
-}
-function subscribeToNearProvisioning(listener) {
-	listeners.add(listener);
-	return () => {
-		listeners.delete(listener);
-	};
-}
-/**
-* Runs `attempt` as the wallet's single provisioning attempt, or joins the one
-* already in flight. The returned promise never rejects: a thrown attempt
-* becomes a published `near_failed_retryable`, because the ECDSA wallet is
-* already durable and must not be faulted by this.
-*/
-function runSingleFlightNearProvisioning(args) {
-	const entry = entryFor(args.walletId, args.nowMs());
-	if (entry.inFlight) return entry.inFlight;
-	if (entry.state.status === "near_ready") return Promise.resolve(entry.state);
-	publishNearProvisioningState(args.walletId, {
-		status: "near_provisioning",
-		updatedAtMs: args.nowMs()
-	});
-	const inFlight = (async () => {
-		try {
-			return await args.attempt();
-		} catch (error) {
-			return {
-				status: "near_failed_retryable",
-				updatedAtMs: args.nowMs(),
-				error: error instanceof Error ? error.message : String(error),
-				errorCode: "near_provisioning_failed"
-			};
-		}
-	})().then((state) => {
-		entry.inFlight = null;
-		publishNearProvisioningState(args.walletId, state);
-		return state;
-	});
-	entry.inFlight = inFlight;
-	return inFlight;
-}
-//#endregion
-export { awaitNearProvisioningInFlight, publishNearProvisioningState, readNearProvisioningState, runSingleFlightNearProvisioning, subscribeToNearProvisioning };
-
-//# sourceMappingURL=nearProvisioningRegistry.js.map

package/dist/esm/core/signingEngine/flows/registration/public.js

@@ -1,85 +0,0 @@
-import { activateAuthenticatedWalletState as activateAuthenticatedWalletState$1, finalizeWalletEcdsaRegistration as finalizeWalletEcdsaRegistration$1, finalizeWalletEd25519SignerRegistration as finalizeWalletEd25519SignerRegistration$1, getAllUsers as getAllUsers$1, getLastUser as getLastUser$1, getUserBySignerSlot as getUserBySignerSlot$1, getWalletNearProvisioningState as getWalletNearProvisioningState$1, hasPasskeyCredential as hasPasskeyCredential$1, nearAuthenticatorsByAccount as nearAuthenticatorsByAccount$1, rollbackUserRegistration as rollbackUserRegistration$1, rollbackWalletEd25519SignerRegistration as rollbackWalletEd25519SignerRegistration$1, setLastUser as setLastUser$1, setWalletNearProvisioningState as setWalletNearProvisioningState$1, storeAuthenticator as storeAuthenticator$1, storeUserData as storeUserData$1, storeWalletEcdsaRecoverySignerRecords as storeWalletEcdsaRecoverySignerRecords$1, storeWalletEcdsaSignerRecords as storeWalletEcdsaSignerRecords$1, storeWalletEd25519RecoveryRegistrationData as storeWalletEd25519RecoveryRegistrationData$1, storeWalletEd25519RegistrationData as storeWalletEd25519RegistrationData$1, storeWalletEmailOtpEcdsaRegistrationData as storeWalletEmailOtpEcdsaRegistrationData$1, storeWalletEmailOtpEcdsaSignerRecords as storeWalletEmailOtpEcdsaSignerRecords$1, storeWalletEmailOtpEd25519RegistrationData as storeWalletEmailOtpEd25519RegistrationData$1, storeWalletEmailOtpMixedRegistrationData as storeWalletEmailOtpMixedRegistrationData$1, storeWalletMixedRegistrationData as storeWalletMixedRegistrationData$1 } from "./accountLifecycle.js";
-import { getAuthenticationCredentialsSerialized as getAuthenticationCredentialsSerialized$1, requestRegistrationSessionCredentialConfirmation } from "./session.js";
-//#region src/core/signingEngine/flows/registration/public.ts
-function storeUserData(deps, userData) {
-	return storeUserData$1(deps.accountLifecycle, userData).then(() => void 0);
-}
-function getAllUsers(deps) {
-	return getAllUsers$1(deps.accountLifecycle);
-}
-function getUserBySignerSlot(deps, nearAccountId, signerSlot) {
-	return getUserBySignerSlot$1(deps.accountLifecycle, nearAccountId, signerSlot);
-}
-function getLastUser(deps) {
-	return getLastUser$1(deps.accountLifecycle);
-}
-function nearAuthenticatorsByAccount(deps, nearAccountId) {
-	return nearAuthenticatorsByAccount$1(deps.accountLifecycle, nearAccountId);
-}
-function setLastUser(deps, walletId, signerSlot) {
-	return setLastUser$1(deps.accountLifecycle, walletId, signerSlot);
-}
-function setWalletNearProvisioningState(deps, write) {
-	return setWalletNearProvisioningState$1(deps.accountLifecycle, write);
-}
-function getWalletNearProvisioningState(deps, walletId) {
-	return getWalletNearProvisioningState$1(deps.accountLifecycle, walletId);
-}
-function activateAuthenticatedWalletState(deps, args) {
-	return activateAuthenticatedWalletState$1(deps.accountLifecycle, args);
-}
-function storeAuthenticator(deps, authenticatorData) {
-	return storeAuthenticator$1(deps.accountLifecycle, authenticatorData);
-}
-function rollbackUserRegistration(deps, nearAccountId) {
-	return rollbackUserRegistration$1(deps.accountLifecycle, nearAccountId);
-}
-function hasPasskeyCredential(deps, nearAccountId) {
-	return hasPasskeyCredential$1(deps.accountLifecycle, nearAccountId);
-}
-function storeWalletEd25519RegistrationData(deps, args) {
-	return storeWalletEd25519RegistrationData$1(deps.accountLifecycle, args);
-}
-function storeWalletMixedRegistrationData(deps, args) {
-	return storeWalletMixedRegistrationData$1(deps.accountLifecycle, args);
-}
-function storeWalletEd25519RecoveryRegistrationData(deps, args) {
-	return storeWalletEd25519RecoveryRegistrationData$1(deps.accountLifecycle, args);
-}
-function storeWalletEmailOtpEd25519RegistrationData(deps, args) {
-	return storeWalletEmailOtpEd25519RegistrationData$1(deps.accountLifecycle, args);
-}
-function storeWalletEmailOtpMixedRegistrationData(deps, args) {
-	return storeWalletEmailOtpMixedRegistrationData$1(deps.accountLifecycle, args);
-}
-function finalizeWalletEd25519SignerRegistration(deps, args) {
-	return finalizeWalletEd25519SignerRegistration$1(deps.accountLifecycle, args);
-}
-function rollbackWalletEd25519SignerRegistration(deps, receipt) {
-	return rollbackWalletEd25519SignerRegistration$1(deps.accountLifecycle, receipt);
-}
-function storeWalletEcdsaSignerRecords(deps, args) {
-	return storeWalletEcdsaSignerRecords$1(deps.accountLifecycle, args);
-}
-function storeWalletEcdsaRecoverySignerRecords(deps, args) {
-	return storeWalletEcdsaRecoverySignerRecords$1(deps.accountLifecycle, args);
-}
-function storeWalletEmailOtpEcdsaSignerRecords(deps, args) {
-	return storeWalletEmailOtpEcdsaSignerRecords$1(deps.accountLifecycle, args);
-}
-function finalizeWalletEcdsaRegistration(deps, args) {
-	return finalizeWalletEcdsaRegistration$1(deps.accountLifecycle, args);
-}
-function storeWalletEmailOtpEcdsaRegistrationData(deps, args) {
-	return storeWalletEmailOtpEcdsaRegistrationData$1(deps.accountLifecycle, args);
-}
-function requestRegistrationCredentialConfirmation(deps, params) {
-	return requestRegistrationSessionCredentialConfirmation(deps.session, params);
-}
-function getAuthenticationCredentialsSerialized(deps, args) {
-	return getAuthenticationCredentialsSerialized$1(deps.session, args);
-}
-//#endregion
-export { activateAuthenticatedWalletState, finalizeWalletEcdsaRegistration, finalizeWalletEd25519SignerRegistration, getAllUsers, getAuthenticationCredentialsSerialized, getLastUser, getUserBySignerSlot, getWalletNearProvisioningState, hasPasskeyCredential, nearAuthenticatorsByAccount, requestRegistrationCredentialConfirmation, rollbackUserRegistration, rollbackWalletEd25519SignerRegistration, setLastUser, setWalletNearProvisioningState, storeAuthenticator, storeUserData, storeWalletEcdsaRecoverySignerRecords, storeWalletEcdsaSignerRecords, storeWalletEd25519RecoveryRegistrationData, storeWalletEd25519RegistrationData, storeWalletEmailOtpEcdsaRegistrationData, storeWalletEmailOtpEcdsaSignerRecords, storeWalletEmailOtpEd25519RegistrationData, storeWalletEmailOtpMixedRegistrationData, storeWalletMixedRegistrationData };
-
-//# sourceMappingURL=public.js.map

package/dist/esm/core/signingEngine/flows/registration/services/ecdsaRegistrationSessions.js

@@ -1,77 +0,0 @@
-import { thresholdEcdsaChainTargetKey, toWalletId } from "../../../interfaces/ecdsaChainTarget.js";
-import { parseEcdsaRoleLocalPersistedMaterialRef } from "../../../session/keyMaterialBrands.js";
-import { buildEcdsaRoleLocalPublicFacts } from "../../../session/persistence/ecdsaRoleLocalRecords.js";
-//#region src/core/signingEngine/flows/registration/services/ecdsaRegistrationSessions.ts
-function sessionTargetsMatchWalletKeys(args) {
-	if (args.session.chainTargets.length !== args.walletKeys.length) return false;
-	return args.walletKeys.every((walletKey, index) => {
-		const sessionTarget = args.session.chainTargets[index];
-		return sessionTarget !== void 0 && thresholdEcdsaChainTargetKey(sessionTarget) === thresholdEcdsaChainTargetKey(walletKey.chainTarget);
-	});
-}
-function storeWalletEcdsaKeyWithRoleLocalMaterial(args) {
-	const walletKey = args.walletKey;
-	return {
-		keyScope: walletKey.keyScope,
-		chainTarget: walletKey.chainTarget,
-		walletId: walletKey.walletId,
-		evmFamilySigningKeySlotId: walletKey.evmFamilySigningKeySlotId,
-		keyHandle: walletKey.keyHandle,
-		ecdsaThresholdKeyId: walletKey.ecdsaThresholdKeyId,
-		signingRootId: walletKey.signingRootId,
-		signingRootVersion: walletKey.signingRootVersion,
-		thresholdEcdsaPublicKeyB64u: walletKey.thresholdEcdsaPublicKeyB64u,
-		thresholdOwnerAddress: walletKey.thresholdOwnerAddress,
-		relayerKeyId: walletKey.relayerKeyId,
-		relayerVerifyingShareB64u: walletKey.relayerVerifyingShareB64u,
-		participantIds: walletKey.participantIds,
-		publicCapability: walletKey.publicCapability,
-		roleLocalMaterialRef: args.materialRef,
-		ecdsaRoleLocalPublicFacts: args.publicFacts
-	};
-}
-async function finalizeWalletRegistrationEcdsaSessions(input) {
-	if (!sessionTargetsMatchWalletKeys({
-		session: input.session,
-		walletKeys: input.walletKeys
-	})) throw new Error("[SigningEngine] strict ECDSA registration requires one family activation projected to every wallet target");
-	const walletId = toWalletId(input.walletId);
-	if (input.session.authority.walletId !== walletId) throw new Error("[SigningEngine] strict ECDSA registration authority does not match the target wallet");
-	const workerHandle = input.session.roleLocalMaterial;
-	const materialRef = parseEcdsaRoleLocalPersistedMaterialRef({
-		kind: "ecdsa_role_local_persisted_material_ref_v1",
-		durableMaterialRef: workerHandle.durableMaterialRef,
-		bindingDigest: workerHandle.bindingDigest,
-		materialActivation: input.session.materialActivation
-	});
-	const [firstStoredWalletKey, ...remainingStoredWalletKeys] = input.walletKeys.map((walletKey) => {
-		return storeWalletEcdsaKeyWithRoleLocalMaterial({
-			walletKey,
-			publicFacts: buildEcdsaRoleLocalPublicFacts({
-				walletId,
-				chainTarget: walletKey.chainTarget,
-				keyHandle: walletKey.keyHandle,
-				ecdsaThresholdKeyId: walletKey.ecdsaThresholdKeyId,
-				signingRootId: walletKey.signingRootId,
-				signingRootVersion: walletKey.signingRootVersion,
-				applicationBindingDigestB64u: input.session.bootstrap.applicationBindingDigestB64u,
-				clientParticipantId: 1,
-				relayerParticipantId: 2,
-				participantIds: walletKey.participantIds,
-				contextBinding32B64u: input.session.clientPublicFacts.contextBinding32B64u,
-				derivationClientSharePublicKey33B64u: input.session.clientPublicFacts.derivationClientSharePublicKey33B64u,
-				relayerPublicKey33B64u: input.session.clientPublicFacts.relayerPublicKey33B64u,
-				groupPublicKey33B64u: input.session.clientPublicFacts.groupPublicKey33B64u,
-				ethereumAddress: input.session.clientPublicFacts.ethereumAddress,
-				publicCapability: input.session.publicCapability
-			}),
-			materialRef
-		});
-	});
-	if (!firstStoredWalletKey) throw new Error("[SigningEngine] strict ECDSA registration did not persist any wallet keys");
-	return [firstStoredWalletKey, ...remainingStoredWalletKeys];
-}
-//#endregion
-export { finalizeWalletRegistrationEcdsaSessions };
-
-//# sourceMappingURL=ecdsaRegistrationSessions.js.map

package/dist/esm/core/signingEngine/flows/registration/services/passkeyEd25519YaoAddSigner.js

@@ -1,82 +0,0 @@
-import { coerceNonNullishString } from "../../../../../shared-ts/src/utils/validation.js";
-import { computeAddSignerNearEd25519SigningKeyId } from "../../../../../shared-ts/src/utils/registrationIds.js";
-import { deriveSigningRootId, normalizeRuntimePolicyScope } from "../../../../../shared-ts/src/threshold/signingRootScope.js";
-import { ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { RouterAbEd25519YaoHttpActivationTransportV1 } from "../../../threshold/ed25519/yaoClient.js";
-import { registrationNearEd25519BranchKey } from "../../../../../shared-ts/src/utils/registrationSignerPlan.js";
-//#region src/core/signingEngine/flows/registration/services/passkeyEd25519YaoAddSigner.ts
-function requireMatchingString(left, right, label) {
-	if (left !== right) throw new Error(`${label} does not match the verified add-signer intent`);
-}
-function requireMatchingParticipantIds(intended, admitted) {
-	if (intended.length !== 2 || intended[0] !== admitted[0] || intended[1] !== admitted[1]) throw new Error("Yao participant IDs do not match the verified add-signer intent");
-}
-function transportConfig(input) {
-	const bearerToken = coerceNonNullishString(input.verifiedIntent.addSignerIntentGrant, "add-signer intent grant");
-	return {
-		routerOrigin: coerceNonNullishString(input.httpTransport.routerOrigin, "Yao Router origin"),
-		authorization: {
-			kind: "bearer",
-			value: `Bearer ${bearerToken}`
-		},
-		fetch: input.httpTransport.fetch
-	};
-}
-async function prepareVerifiedPasskeyEd25519YaoAddSignerV1(input) {
-	const intent = input.verifiedIntent.intent;
-	const selection = intent.signerSelection.ed25519;
-	requireMatchingString(String(intent.walletId), String(input.verifiedAuthority.walletId), "Passkey authority wallet ID");
-	requireMatchingString(input.verifiedIntent.addSignerIntentDigestB64u, input.verifiedAuthority.addSignerIntentDigestB64u, "Passkey authority intent digest");
-	coerceNonNullishString(input.verifiedAuthority.credentialIdB64u, "passkey credential ID");
-	const runtimePolicyScope = normalizeRuntimePolicyScope(intent.runtimePolicyScope);
-	const signingRootId = deriveSigningRootId(runtimePolicyScope);
-	const parsedAdmission = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(input.admissionRequest);
-	if (!parsedAdmission.ok) throw new Error(parsedAdmission.message);
-	const admission = parsedAdmission.value;
-	const ceremonyId = coerceNonNullishString(input.verifiedIntent.addSignerCeremonyId, "add-signer ceremony ID");
-	requireMatchingString(admission.scope.lifecycle_id, ceremonyId, "Yao lifecycle ID");
-	requireMatchingString(admission.scope.threshold_session_id, ceremonyId, "Yao Threshold Session ID");
-	requireMatchingString(admission.scope.account_id, String(intent.walletId), "Yao account ID");
-	requireMatchingString(admission.scope.signer_set_id, String(registrationNearEd25519BranchKey(selection.signerSlot)), "Yao signer-set ID");
-	requireMatchingString(admission.scope.root_share_epoch, runtimePolicyScope.signingRootVersion, "Yao root-share epoch");
-	requireMatchingString(admission.application_binding.wallet_id, String(intent.walletId), "Yao application wallet ID");
-	requireMatchingString(admission.application_binding.signing_root_id, signingRootId, "Yao signing-root ID");
-	if (admission.application_binding.key_creation_signer_slot !== selection.signerSlot) throw new Error("Yao signer slot does not match the verified add-signer intent");
-	requireMatchingParticipantIds(selection.participantIds, admission.participant_ids);
-	const nearEd25519SigningKeyId = await computeAddSignerNearEd25519SigningKeyId({
-		kind: "wallet_add_signer_implicit_near_ed25519_key_v1",
-		walletId: intent.walletId,
-		signingRootId,
-		signingRootVersion: runtimePolicyScope.signingRootVersion,
-		signerSlot: selection.signerSlot,
-		participantIds: selection.participantIds,
-		keyPurpose: selection.keyPurpose,
-		keyVersion: selection.keyVersion,
-		derivationVersion: selection.derivationVersion
-	});
-	requireMatchingString(admission.application_binding.near_ed25519_signing_key_id, String(nearEd25519SigningKeyId), "Yao NEAR signing-key ID");
-	return {
-		kind: "prepared_passkey_ed25519_yao_add_signer_v1",
-		request: admission,
-		transportConfig: transportConfig(input)
-	};
-}
-async function admitVerifiedPasskeyEd25519YaoAddSignerV1(input) {
-	const prepared = await prepareVerifiedPasskeyEd25519YaoAddSignerV1(input);
-	const response = await new RouterAbEd25519YaoHttpActivationTransportV1(prepared.transportConfig).send({
-		kind: "admit",
-		path: ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1,
-		body: prepared.request
-	});
-	if (!response.ok) throw new Error(response.message);
-	const receipt = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(response.value);
-	if (!receipt.ok) throw new Error(receipt.message);
-	return {
-		request: prepared.request,
-		receipt: receipt.value
-	};
-}
-//#endregion
-export { admitVerifiedPasskeyEd25519YaoAddSignerV1 };
-
-//# sourceMappingURL=passkeyEd25519YaoAddSigner.js.map

package/dist/esm/core/signingEngine/flows/registration/session.js

@@ -1,24 +0,0 @@
-//#region src/core/signingEngine/flows/registration/session.ts
-async function requestRegistrationSessionCredentialConfirmation(deps, params) {
-	return await deps.touchConfirm.requestRegistrationCredentialConfirmation({
-		walletId: params.walletId,
-		nearAccountId: params.nearAccountId,
-		signerSlot: params.signerSlot,
-		confirmerText: params.confirmerText,
-		confirmationConfigOverride: params.confirmationConfigOverride,
-		challengeB64u: params.challengeB64u,
-		registrationOptions: params.registrationOptions
-	});
-}
-async function getAuthenticationCredentialsSerialized(deps, params) {
-	return await deps.touchIdPrompt.getAuthenticationCredentialsSerializedForChallengeB64u({
-		subjectId: params.subjectId,
-		challengeB64u: params.challengeB64u,
-		allowCredentials: params.allowCredentials,
-		includeSecondPrfOutput: params.includeSecondPrfOutput ?? false
-	});
-}
-//#endregion
-export { getAuthenticationCredentialsSerialized, requestRegistrationSessionCredentialConfirmation };
-
-//# sourceMappingURL=session.js.map

package/dist/esm/core/signingEngine/flows/signEvmFamily/emailOtpPublic.js

@@ -1,123 +0,0 @@
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { buildFreshEmailOtpRoutePlan } from "../../session/emailOtp/routePlan.js";
-import { refreshEmailOtpSigningSession as refreshEmailOtpSigningSession$1, requestEmailOtpSigningSessionChallenge as requestEmailOtpSigningSessionChallenge$1, resolveEmailOtpEcdsaSigningSessionAuth } from "./emailOtpSigningSession.js";
-import { enrollEmailOtpWallet, prepareEmailOtpRegistrationEnrollmentMaterial } from "../../session/emailOtp/workerEnrollment.js";
-//#region src/core/signingEngine/flows/signEvmFamily/emailOtpPublic.ts
-function buildEmailOtpEcdsaFreshRoutePlanFromBoundary(args, freshRouteFamily) {
-	return buildFreshEmailOtpRoutePlan({
-		freshRouteFamily,
-		operation: args.operation
-	});
-}
-function emailOtpEcdsaLoginCoreArgsFromBoundary(args) {
-	return {
-		walletSession: args.walletSession,
-		authoritySelector: args.authoritySelector,
-		chainTarget: args.chainTarget,
-		otpCode: args.otpCode,
-		routePlan: buildEmailOtpEcdsaFreshRoutePlanFromBoundary(args, "login"),
-		ecdsaBootstrapAuthorization: args.ecdsaBootstrapAuthorization,
-		emailHashHex: args.emailHashHex,
-		providerIdentity: args.providerIdentity,
-		ed25519YaoRecovery: args.ed25519YaoRecovery ?? { kind: "not_requested" },
-		...args.emailOtpAuthPolicy ? { emailOtpAuthPolicy: args.emailOtpAuthPolicy } : {},
-		...args.emailOtpAuthReason ? { emailOtpAuthReason: args.emailOtpAuthReason } : {},
-		...args.relayUrl ? { relayUrl: args.relayUrl } : {},
-		...args.challengeId ? { challengeId: args.challengeId } : {},
-		...args.operation ? { operation: args.operation } : {},
-		...args.groupId ? { groupId: args.groupId } : {},
-		...args.keyHandle ? { keyHandle: args.keyHandle } : {},
-		...args.participantIds ? { participantIds: args.participantIds } : {},
-		...args.publicationChainTargets ? { publicationChainTargets: args.publicationChainTargets } : {},
-		...typeof args.ttlMs === "number" ? { ttlMs: args.ttlMs } : {},
-		...typeof args.remainingUses === "number" ? { remainingUses: args.remainingUses } : {},
-		...args.runtimePolicyScope ? { runtimePolicyScope: args.runtimePolicyScope } : {},
-		...args.onProgress ? { onProgress: args.onProgress } : {}
-	};
-}
-async function loginWithEmailOtpEcdsaCapabilityInternal(deps, args) {
-	return await deps.emailOtpSessions.loginWithEcdsaCapabilityInternal(emailOtpEcdsaLoginCoreArgsFromBoundary(args));
-}
-async function requestEmailOtpSigningSessionChallenge(deps, args) {
-	return await requestEmailOtpSigningSessionChallenge$1({
-		resolveSigningSessionAuth: (args) => resolveEmailOtpEcdsaSigningSessionAuth(args, deps.signingSessionAuthorityPorts),
-		withThresholdEcdsaSigningQueue: deps.withThresholdEcdsaSigningQueue,
-		emailOtpSessions: {
-			requestTransactionSigningChallenge: (challengeArgs) => deps.emailOtpSessions.requestTransactionSigningChallenge(challengeArgs),
-			loginWithEcdsaCapabilityInternal: ({ publicFacts, ...loginArgs }) => deps.emailOtpSessions.loginWithEcdsaCapabilityInternal({
-				...loginArgs,
-				keyHandle: String(publicFacts.keyHandle),
-				participantIds: publicFacts.participantIds.map((participantId) => Number(participantId)),
-				ecdsaBootstrapAuthorization: { kind: "route_plan_auth" },
-				ed25519YaoRecovery: { kind: "not_requested" }
-			})
-		}
-	}, {
-		walletSession: args.walletSession,
-		chainTarget: args.chainTarget
-	});
-}
-async function refreshEmailOtpSigningSession(deps, args) {
-	return {
-		...await refreshEmailOtpSigningSession$1({
-			resolveSigningSessionAuth: (args) => resolveEmailOtpEcdsaSigningSessionAuth(args, deps.signingSessionAuthorityPorts),
-			withThresholdEcdsaSigningQueue: deps.withThresholdEcdsaSigningQueue,
-			emailOtpSessions: {
-				requestTransactionSigningChallenge: (challengeArgs) => deps.emailOtpSessions.requestTransactionSigningChallenge(challengeArgs),
-				loginWithEcdsaCapabilityInternal: (loginArgs) => deps.emailOtpSessions.loginWithEcdsaCapabilityInternal({
-					...loginArgs,
-					ed25519YaoRecovery: { kind: "not_requested" }
-				})
-			}
-		}, {
-			walletSession: args.walletSession,
-			chainTarget: args.chainTarget,
-			challengeId: args.challengeId,
-			otpCode: args.otpCode,
-			...typeof args.ttlMs === "number" ? { ttlMs: args.ttlMs } : {},
-			...typeof args.remainingUses === "number" ? { remainingUses: args.remainingUses } : {}
-		}),
-		ed25519YaoRecovery: { kind: "not_requested" }
-	};
-}
-async function enrollEmailOtpInternal(deps, args) {
-	const walletId = toWalletId(args.walletId);
-	const relayUrl = String(args.relayUrl || deps.relayerUrl || "").trim();
-	if (!relayUrl) throw new Error("Missing relayer url (configs.network.relayer.url)");
-	const groupId = String(args.groupId || deps.groupId || "").trim();
-	if (!groupId) throw new Error("Missing shamir prime for Email OTP runtime");
-	return await enrollEmailOtpWallet({
-		relayUrl,
-		walletId: String(walletId),
-		userId: String(walletId),
-		challengeId: args.challengeId,
-		otpCode: args.otpCode,
-		groupId,
-		workerCtx: deps.getSignerWorkerContext(),
-		otpChannel: args.otpChannel,
-		...args.clientSecret32 ? { clientSecret32: args.clientSecret32 } : {}
-	});
-}
-async function prepareEmailOtpRegistrationEnrollmentMaterialInternal(deps, args) {
-	const walletId = toWalletId(args.walletId);
-	const relayUrl = String(args.relayUrl || deps.relayerUrl || "").trim();
-	if (!relayUrl) throw new Error("Missing relayer url (configs.network.relayer.url)");
-	const groupId = String(args.groupId || deps.groupId || "").trim();
-	if (!groupId) throw new Error("Missing shamir prime for Email OTP runtime");
-	const userId = String(args.userId).trim();
-	if (!userId) throw new Error("Email OTP registration enrollment material requires userId");
-	return await prepareEmailOtpRegistrationEnrollmentMaterial({
-		relayUrl,
-		walletId: String(walletId),
-		userId,
-		groupId,
-		workerCtx: deps.getSignerWorkerContext(),
-		otpChannel: args.otpChannel,
-		ecdsaSessionHandle: { kind: "not_requested" },
-		...args.clientSecret32 ? { clientSecret32: args.clientSecret32 } : {}
-	});
-}
-//#endregion
-export { enrollEmailOtpInternal, loginWithEmailOtpEcdsaCapabilityInternal, prepareEmailOtpRegistrationEnrollmentMaterialInternal, refreshEmailOtpSigningSession, requestEmailOtpSigningSessionChallenge };
-
-//# sourceMappingURL=emailOtpPublic.js.map