@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/signingEngine/session/passkey/unlockEcdsaWarmupPlanner.js

@@ -1,247 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { thresholdEcdsaChainTargetKey } from "../../interfaces/ecdsaChainTarget.js";
-import { deriveEvmFamilyKeyFingerprint, evmFamilyEcdsaWalletKeyToIdentity } from "../identity/evmFamilyEcdsaIdentity.js";
-import { sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { parseProfileContinuityEcdsaWarmKey } from "./ecdsaKeyFactsInventory.js";
-//#region src/core/signingEngine/session/passkey/unlockEcdsaWarmupPlanner.ts
-function walletUnlockSelectionIncludesEcdsa(selection) {
-	switch (selection.mode) {
-		case "ed25519_only": return false;
-		case "ecdsa_only":
-		case "ed25519_and_ecdsa": return true;
-	}
-	return false;
-}
-function mapProfileBlockedReason(result) {
-	switch (result.reason) {
-		case "missing_chain_target":
-		case "missing_key_handle":
-		case "invalid_key_handle":
-		case "duplicate_key_handles": return result.reason;
-		case "invalid_chain_target": return "invalid_signer_record";
-	}
-	result.reason;
-	return "invalid_signer_record";
-}
-function parseActiveEcdsaSignerRecordForUnlock(args) {
-	const signer = args.signer;
-	const parsed = parseProfileContinuityEcdsaWarmKey({
-		walletId: args.walletId,
-		configuredTargets: args.configuredTargets,
-		signer: args.signer
-	});
-	const signerId = typeof signer.signerId === "string" && signer.signerId.trim() ? signer.signerId.trim() : void 0;
-	switch (parsed.kind) {
-		case "active_wallet_key": return {
-			kind: "active_ecdsa_signer_record",
-			targetKey: parsed.targetKey,
-			chainTarget: parsed.chainTarget,
-			walletKey: parsed.walletKey,
-			publicCapability: parsed.publicCapability,
-			source: "profile_continuity",
-			...signerId ? { signerId } : {}
-		};
-		case "key_facts_inventory_required": return {
-			kind: "key_facts_inventory_required",
-			targetKey: parsed.targetKey,
-			chainTarget: parsed.chainTarget,
-			keyHandle: parsed.keyHandle,
-			reason: parsed.reason,
-			...signerId ? { signerId } : {}
-		};
-		case "blocked": return {
-			kind: "blocked",
-			targetKey: parsed.targetKey,
-			reason: mapProfileBlockedReason(parsed),
-			...signerId ? { signerId } : {}
-		};
-		case "skipped": return { kind: "skipped" };
-	}
-	return { kind: "skipped" };
-}
-function activeTargetRecordsByTarget(records) {
-	const byTarget = /* @__PURE__ */ new Map();
-	for (const record of records) {
-		const existing = byTarget.get(record.targetKey);
-		if (!existing) {
-			byTarget.set(record.targetKey, record);
-			continue;
-		}
-		if (existing.kind !== "active_ecdsa_signer_record") continue;
-		const existingFingerprint = deriveEvmFamilyKeyFingerprint(evmFamilyEcdsaWalletKeyToIdentity(existing.walletKey));
-		const nextFingerprint = deriveEvmFamilyKeyFingerprint(evmFamilyEcdsaWalletKeyToIdentity(record.walletKey));
-		if (String(existing.walletKey.keyHandle) !== String(record.walletKey.keyHandle) || existingFingerprint !== nextFingerprint) byTarget.set(record.targetKey, {
-			kind: "blocked",
-			targetKey: record.targetKey,
-			reason: "duplicate_key_handles",
-			...record.signerId ? { signerId: record.signerId } : {}
-		});
-	}
-	return byTarget;
-}
-function configuredTargetThresholdEcdsaWarmKey(args) {
-	const keyHandle = String(args.keyHandle || "").trim();
-	if (!keyHandle) throw new Error("[login] configured-target ECDSA warm key requires keyHandle");
-	const passkeyCredentialIdB64u = String(args.passkeyCredentialIdB64u || "").trim();
-	if (args.key && args.publicCapability && String(args.publicCapability.client_id) !== String(args.key.walletId)) throw new Error("[login] configured-target ECDSA public capability wallet mismatch");
-	return {
-		chainTarget: args.chainTarget,
-		targetKey: thresholdEcdsaChainTargetKey(args.chainTarget),
-		keyHandle,
-		...args.key ? { key: args.key } : {},
-		...passkeyCredentialIdB64u ? { passkeyCredentialIdB64u } : {},
-		...args.existingRoleLocalMaterial ? { existingRoleLocalMaterial: args.existingRoleLocalMaterial } : {},
-		publicCapability: args.publicCapability ? {
-			kind: "persisted_public_capability",
-			value: args.publicCapability
-		} : { kind: "missing_public_capability" }
-	};
-}
-function collectConfiguredTargetThresholdEcdsaWarmKeys(args) {
-	const byTarget = /* @__PURE__ */ new Map();
-	for (const key of args.keys) {
-		const targetKey = thresholdEcdsaChainTargetKey(key.chainTarget);
-		const keyHandle = String(key.keyHandle || "").trim();
-		if (!keyHandle) continue;
-		const existing = byTarget.get(targetKey);
-		const existingKeyHandle = String(existing?.keyHandle || "").trim();
-		if (existingKeyHandle && keyHandle && existingKeyHandle !== keyHandle) throw new Error(`[login] threshold ECDSA warm-up received ambiguous ${args.source} key handles for ${targetKey}`);
-		if (existing?.key && key.key && deriveEvmFamilyKeyFingerprint(existing.key) !== deriveEvmFamilyKeyFingerprint(key.key)) throw new Error(`[login] threshold ECDSA warm-up received ambiguous ${args.source} key fingerprints for ${targetKey}`);
-		const existingPublicCapability = existing?.publicCapability.kind === "persisted_public_capability" ? existing.publicCapability.value : null;
-		const incomingPublicCapability = key.publicCapability.kind === "persisted_public_capability" ? key.publicCapability.value : null;
-		if (existingPublicCapability && incomingPublicCapability && !sameRouterAbEcdsaDerivationPublicCapabilityV1(existingPublicCapability, incomingPublicCapability)) throw new Error(`[login] threshold ECDSA warm-up received ambiguous ${args.source} public capabilities for ${targetKey}`);
-		const publicCapability = incomingPublicCapability || existingPublicCapability;
-		const passkeyCredentialIdB64u = String(key.passkeyCredentialIdB64u || existing?.passkeyCredentialIdB64u || "").trim();
-		const existingRoleLocalMaterial = key.existingRoleLocalMaterial || existing?.existingRoleLocalMaterial;
-		if (key.existingRoleLocalMaterial && existing?.existingRoleLocalMaterial && !mpcMaterialActivationRefsEqual(key.existingRoleLocalMaterial.materialActivation, existing.existingRoleLocalMaterial.materialActivation)) throw new Error(`[login] threshold ECDSA warm-up received ambiguous ${args.source} role-local material for ${targetKey}`);
-		byTarget.set(targetKey, {
-			chainTarget: key.chainTarget,
-			targetKey,
-			keyHandle: keyHandle || existingKeyHandle,
-			...key.key || existing?.key ? { key: key.key || existing?.key } : {},
-			...passkeyCredentialIdB64u ? { passkeyCredentialIdB64u } : {},
-			...existingRoleLocalMaterial ? { existingRoleLocalMaterial } : {},
-			publicCapability: publicCapability ? {
-				kind: "persisted_public_capability",
-				value: publicCapability
-			} : { kind: "missing_public_capability" }
-		});
-	}
-	return [...byTarget.values()];
-}
-function mergeCanonicalThresholdEcdsaWarmSessionContexts(stored, relay) {
-	return {
-		ecdsaKeys: collectConfiguredTargetThresholdEcdsaWarmKeys({
-			source: "stored/relay",
-			keys: [...stored.ecdsaKeys, ...relay?.ecdsaKeys || []]
-		}),
-		...relay?.runtimePolicyScope ? { runtimePolicyScope: relay.runtimePolicyScope } : stored.runtimePolicyScope ? { runtimePolicyScope: stored.runtimePolicyScope } : {}
-	};
-}
-function buildConfiguredTargetKeyCompletion(args) {
-	if (!args.configuredTargets.length) return {
-		kind: "complete_configured_target_keys",
-		context: args.context
-	};
-	const byTarget = /* @__PURE__ */ new Map();
-	for (const key of args.context.ecdsaKeys) byTarget.set(key.targetKey, key);
-	const missingTargetKeys = args.configuredTargets.map((target) => thresholdEcdsaChainTargetKey(target.chainTarget)).filter((targetKey) => !byTarget.has(targetKey));
-	if (missingTargetKeys.length) return {
-		kind: "missing_configured_target_keys",
-		missingTargets: missingTargetKeys
-	};
-	const context = {
-		ecdsaKeys: collectConfiguredTargetThresholdEcdsaWarmKeys({
-			source: "configured ECDSA target completion",
-			keys: [...byTarget.values()]
-		}),
-		...args.context.runtimePolicyScope ? { runtimePolicyScope: args.context.runtimePolicyScope } : {}
-	};
-	const remainingMissingTargets = args.configuredTargets.filter((target) => !context.ecdsaKeys.some((key) => key.targetKey === thresholdEcdsaChainTargetKey(target.chainTarget)));
-	if (remainingMissingTargets.length) return {
-		kind: "missing_configured_target_keys",
-		missingTargets: remainingMissingTargets.map((target) => thresholdEcdsaChainTargetKey(target.chainTarget))
-	};
-	return {
-		kind: "complete_configured_target_keys",
-		context
-	};
-}
-function requireCompleteConfiguredTargetKeyContext(args) {
-	switch (args.completion.kind) {
-		case "complete_configured_target_keys": return args.completion.context;
-		case "missing_configured_target_keys": throw new Error(`[login] threshold ECDSA warm-up could not resolve configured target key facts from ${args.source} for ${args.completion.missingTargets.join(", ")}`);
-	}
-	args.completion;
-	throw new Error("[login] unsupported ECDSA warm-up key completion state");
-}
-function dedupeKeyFactsInventoryTargets(records) {
-	const byTarget = /* @__PURE__ */ new Map();
-	for (const record of records) {
-		const key = `${record.targetKey}:${record.keyHandle}`;
-		byTarget.set(key, {
-			keyHandle: record.keyHandle,
-			chainTarget: record.chainTarget
-		});
-	}
-	return [...byTarget.values()];
-}
-function planUnlockEcdsaWarmup(args) {
-	if (!walletUnlockSelectionIncludesEcdsa(args.selection) || args.configuredTargets.length === 0) return { kind: "no_configured_ecdsa_targets" };
-	const blockedRecords = [...args.blockedRecords || []];
-	const activeByTarget = activeTargetRecordsByTarget(args.activeSignerRecords);
-	for (const value of activeByTarget.values()) if (value.kind === "blocked") blockedRecords.push(value);
-	if (blockedRecords.length) return {
-		kind: "blocked",
-		blockedRecords
-	};
-	const keyFactsInventoryRequiredByTarget = /* @__PURE__ */ new Map();
-	for (const record of args.keyFactsInventoryRequiredRecords || []) keyFactsInventoryRequiredByTarget.set(record.targetKey, record);
-	const keyFactsInventoryRequiredRecords = [];
-	const readyTargets = [];
-	for (const chainTarget of args.configuredTargets) {
-		const targetKey = thresholdEcdsaChainTargetKey(chainTarget);
-		const active = activeByTarget.get(targetKey);
-		if (active?.kind === "active_ecdsa_signer_record") {
-			readyTargets.push({
-				targetKey,
-				chainTarget,
-				walletKey: active.walletKey,
-				publicCapability: active.publicCapability
-			});
-			continue;
-		}
-		const keyFactsInventoryRequiredRecord = keyFactsInventoryRequiredByTarget.get(targetKey);
-		if (keyFactsInventoryRequiredRecord) {
-			keyFactsInventoryRequiredRecords.push(keyFactsInventoryRequiredRecord);
-			continue;
-		}
-		keyFactsInventoryRequiredRecords.push({
-			kind: "key_facts_inventory_required",
-			targetKey,
-			chainTarget,
-			keyHandle: "",
-			reason: "missing_key_facts"
-		});
-	}
-	if (keyFactsInventoryRequiredRecords.length === 0) return {
-		kind: "ready",
-		readyTargets
-	};
-	const inventoryRecordsWithKeyHandles = keyFactsInventoryRequiredRecords.filter((record) => String(record.keyHandle || "").trim());
-	const explicitKeyFactsInventoryMode = args.runtimeConfig?.explicitKeyFactsInventoryMode ?? args.explicitKeyFactsInventoryMode;
-	const allowAuthenticatedKeyFactsInventory = args.runtimeConfig?.allowAuthenticatedKeyFactsInventory ?? args.allowAuthenticatedKeyFactsInventory;
-	if (explicitKeyFactsInventoryMode === true && allowAuthenticatedKeyFactsInventory === true && inventoryRecordsWithKeyHandles.length === keyFactsInventoryRequiredRecords.length) return {
-		kind: "awaiting_authenticated_key_facts_inventory",
-		keyFactsInventoryRequiredRecords: inventoryRecordsWithKeyHandles,
-		keyTargets: dedupeKeyFactsInventoryTargets(inventoryRecordsWithKeyHandles)
-	};
-	return {
-		kind: "key_facts_inventory_required",
-		keyFactsInventoryRequiredRecords
-	};
-}
-//#endregion
-export { buildConfiguredTargetKeyCompletion, collectConfiguredTargetThresholdEcdsaWarmKeys, configuredTargetThresholdEcdsaWarmKey, mergeCanonicalThresholdEcdsaWarmSessionContexts, parseActiveEcdsaSignerRecordForUnlock, planUnlockEcdsaWarmup, requireCompleteConfiguredTargetKeyContext };
-
-//# sourceMappingURL=unlockEcdsaWarmupPlanner.js.map

package/dist/esm/core/signingEngine/session/persistence/clientSessionPersistence.js

@@ -1,135 +0,0 @@
-import { exactSigningLaneWalletId } from "../identity/exactSigningLaneIdentity.js";
-import { parseWalletSessionAuthorizationBoundary } from "../identity/clientSessionPersistenceState.js";
-//#region src/core/signingEngine/session/persistence/clientSessionPersistence.ts
-async function readEd25519ClientWalletSessionAuthorization(deps, request) {
-	const identity = request.laneIdentity;
-	const source = {
-		kind: "ed25519",
-		laneIdentity: identity
-	};
-	const walletId = exactSigningLaneWalletId(identity);
-	let selected;
-	try {
-		selected = await deps.resolveSelectedWalletAuthority(String(walletId));
-	} catch {
-		return parseWalletSessionAuthorizationBoundary({
-			observation: {
-				kind: "unavailable",
-				source
-			},
-			nowMs: request.nowMs
-		});
-	}
-	if (selected.kind !== "resolved") return parseWalletSessionAuthorizationBoundary({
-		observation: selected.kind === "integrity_error" ? {
-			kind: "invalid",
-			source
-		} : {
-			kind: "missing",
-			source
-		},
-		nowMs: request.nowMs
-	});
-	if (!selectedAuthorityMatchesEd25519Lane(selected, identity)) return parseWalletSessionAuthorizationBoundary({
-		observation: {
-			kind: "invalid",
-			source
-		},
-		nowMs: request.nowMs
-	});
-	let authorization;
-	try {
-		authorization = await deps.readExactActiveForWallet({
-			walletId,
-			authorityId: selected.authority.authorityId,
-			authMethodId: selected.authMethod.walletAuthMethodId
-		});
-	} catch {
-		return parseWalletSessionAuthorizationBoundary({
-			observation: {
-				kind: "unavailable",
-				source
-			},
-			nowMs: request.nowMs
-		});
-	}
-	switch (authorization.kind) {
-		case "missing": return parseWalletSessionAuthorizationBoundary({
-			observation: {
-				kind: "missing",
-				source
-			},
-			nowMs: request.nowMs
-		});
-		case "corrupt":
-		case "upgrade_required": return parseWalletSessionAuthorizationBoundary({
-			observation: {
-				kind: "invalid",
-				source
-			},
-			nowMs: request.nowMs
-		});
-		case "persistence_unavailable": return parseWalletSessionAuthorizationBoundary({
-			observation: {
-				kind: "unavailable",
-				source
-			},
-			nowMs: request.nowMs
-		});
-		case "found": break;
-	}
-	if (authorization.record.walletId !== walletId || authorization.record.authorityId !== selected.authority.authorityId || authorization.record.authMethodId !== selected.authMethod.walletAuthMethodId || authorization.operationCredential.walletSessionId !== identity.walletSessionId || authorization.record.quotaId !== identity.quotaId) return parseWalletSessionAuthorizationBoundary({
-		observation: {
-			kind: "invalid",
-			source
-		},
-		nowMs: request.nowMs
-	});
-	if (authorization.record.authorityDigestB64u !== selected.authority.authorityDigestB64u || authorization.record.authorityRevocationEpoch !== selected.authority.revocationEpoch) return parseWalletSessionAuthorizationBoundary({
-		observation: {
-			kind: "invalid",
-			source
-		},
-		nowMs: request.nowMs
-	});
-	return parseWalletSessionAuthorizationBoundary({
-		observation: {
-			kind: "found",
-			source,
-			expiresAtMs: authorization.record.expiresAtMs
-		},
-		nowMs: request.nowMs
-	});
-}
-function selectedAuthorityMatchesEd25519Lane(selected, identity) {
-	const walletId = exactSigningLaneWalletId(identity);
-	if (selected.selection.lockState !== "unlocked" || selected.selection.walletId !== walletId || selected.selection.walletAuthMethodId !== selected.authMethod.walletAuthMethodId || selected.authMethod.walletId !== walletId || selected.authMethod.walletAuthorityId !== selected.authority.authorityId || selected.authMethod.status !== "active" || selected.authority.walletId !== walletId || selected.authority.state !== "active") return false;
-	switch (identity.auth.kind) {
-		case "passkey": return selected.authMethod.kind === "passkey" && String(selected.authMethod.rpId) === String(identity.auth.rpId) && selected.authMethod.credentialIdB64u === identity.auth.credentialIdB64u;
-		case "email_otp": return selected.authMethod.kind === "email_otp";
-	}
-}
-function readEcdsaClientWalletSessionAuthorization(request) {
-	return parseWalletSessionAuthorizationBoundary({
-		observation: {
-			kind: "found",
-			source: {
-				kind: "ecdsa",
-				laneIdentity: request.laneIdentity,
-				authorization: request.authorization
-			},
-			expiresAtMs: request.authorization.session.expiresAtMs
-		},
-		nowMs: request.nowMs
-	});
-}
-async function readClientWalletSessionAuthorization(deps, request) {
-	switch (request.kind) {
-		case "ed25519": return await readEd25519ClientWalletSessionAuthorization(deps, request);
-		case "ecdsa": return readEcdsaClientWalletSessionAuthorization(request);
-	}
-}
-//#endregion
-export { readClientWalletSessionAuthorization };
-
-//# sourceMappingURL=clientSessionPersistence.js.map

package/dist/esm/core/signingEngine/session/persistence/walletSessionAuthorizationProjection.js

@@ -1,51 +0,0 @@
-//#region src/core/signingEngine/session/persistence/walletSessionAuthorizationProjection.ts
-function exactWalletSessionAuthorityIdentity(args) {
-	return {
-		walletId: args.authority.walletId,
-		authorityId: args.authority.authorityId,
-		walletAuthMethodId: args.walletAuthMethodId,
-		authorityDigestB64u: args.authority.authorityDigestB64u,
-		authorityRevocationEpoch: args.authority.revocationEpoch
-	};
-}
-function validateExactWalletSessionAuthorization(args) {
-	const { walletSession, operationCredential } = args;
-	if (walletSession.walletId !== args.walletId || walletSession.authMethodId !== args.authority.walletAuthMethodId || walletSession.authorizationId !== args.expectedAuthorizationId || walletSession.quotaId !== args.expectedQuotaId || walletSession.expiresAtMs !== args.expectedExpiresAtMs || operationCredential.walletSessionId !== args.expectedWalletSessionId) throw new Error("ECDSA bootstrap exact Wallet Session authority does not match its request");
-	return {
-		record: walletSession,
-		operationCredential
-	};
-}
-function validateExactWalletSessionAuthorityIdentity(args) {
-	if (args.walletSession.walletId !== args.expected.walletId || args.walletSession.authorityId !== args.expected.authorityId || args.walletSession.authMethodId !== args.expected.walletAuthMethodId || args.walletSession.authorityDigestB64u !== args.expected.authorityDigestB64u || args.walletSession.authorityRevocationEpoch !== args.expected.authorityRevocationEpoch) throw new Error("ECDSA bootstrap exact Wallet Session authority identity changed");
-}
-async function persistActiveWalletSessionAuthorizationFromDirectRegistration(writer, session) {
-	return {
-		record: await writer.writeExactWithOperationCredential({
-			record: session.walletSession,
-			operationCredential: session.operationCredential
-		}),
-		operationCredential: session.operationCredential
-	};
-}
-async function persistExactWalletSessionAuthorizationFromEcdsaBootstrap(writer, args) {
-	const session = args.bootstrap.session;
-	const exact = validateExactWalletSessionAuthorization({
-		walletId: args.walletId,
-		authority: args.authority,
-		walletSession: session.walletSession,
-		operationCredential: session.operationCredential,
-		expectedAuthorizationId: session.authorizationId,
-		expectedWalletSessionId: session.walletSessionId,
-		expectedQuotaId: session.quotaId,
-		expectedExpiresAtMs: session.expiresAtMs
-	});
-	return {
-		record: await writer.writeExactWithOperationCredential(exact),
-		operationCredential: exact.operationCredential
-	};
-}
-//#endregion
-export { exactWalletSessionAuthorityIdentity, persistActiveWalletSessionAuthorizationFromDirectRegistration, persistExactWalletSessionAuthorizationFromEcdsaBootstrap, validateExactWalletSessionAuthorityIdentity, validateExactWalletSessionAuthorization };
-
-//# sourceMappingURL=walletSessionAuthorizationProjection.js.map

package/dist/esm/core/signingEngine/session/planning/operationIdBinding.js

@@ -1,36 +0,0 @@
-//#region src/core/signingEngine/session/planning/operationIdBinding.ts
-const MAX_BOUND_CALLER_OPERATION_IDS = 1024;
-function bindCallerProvidedSigningOperationIdToFingerprint(args) {
-	const operationId = String(args.operationId || "").trim();
-	const fingerprint = String(args.operationFingerprint || "").trim();
-	if (!operationId) throw new Error("[SigningEngine] signingOperationId is required");
-	if (!fingerprint) throw new Error("[SigningEngine] operation fingerprint is required");
-	const bindings = args.state.callerProvidedOperationFingerprintsById;
-	const existingFingerprint = bindings.get(operationId);
-	if (existingFingerprint && existingFingerprint !== fingerprint) throw new Error(`[SigningEngine] caller-provided signingOperationId reused for a different operation: ${operationId}`);
-	bindings.set(operationId, fingerprint);
-	trimOldestBoundCallerOperationIds(bindings);
-}
-var SigningOperationIdBindingRegistry = class {
-	constructor() {
-		this.state = { callerProvidedOperationFingerprintsById: /* @__PURE__ */ new Map() };
-	}
-	bindCallerProvidedOperationIdToFingerprint(args) {
-		bindCallerProvidedSigningOperationIdToFingerprint({
-			state: this.state,
-			operationId: args.operationId,
-			operationFingerprint: args.operationFingerprint
-		});
-	}
-};
-function trimOldestBoundCallerOperationIds(bindings) {
-	while (bindings.size > MAX_BOUND_CALLER_OPERATION_IDS) {
-		const oldest = bindings.keys().next().value;
-		if (!oldest) return;
-		bindings.delete(oldest);
-	}
-}
-//#endregion
-export { SigningOperationIdBindingRegistry };
-
-//# sourceMappingURL=operationIdBinding.js.map

package/dist/esm/core/signingEngine/session/postconditions/runtimePostconditions.js

@@ -1,163 +0,0 @@
-import { thresholdEcdsaChainTargetKey } from "../../interfaces/ecdsaChainTarget.js";
-import { signingLaneAuthMethod } from "../identity/signingLaneAuthBinding.js";
-import { availableEcdsaSigningLaneAuthMethod, availableEd25519SigningLaneAuthMethod } from "../availability/availableSigningLanes.js";
-//#region src/core/signingEngine/session/postconditions/runtimePostconditions.ts
-var WalletRuntimePostconditionError = class extends Error {
-	constructor(result) {
-		super(`[WalletRuntimePostcondition] ${result.code} ${JSON.stringify(result.details)}`);
-		this.name = "WalletRuntimePostconditionError";
-		this.code = result.code;
-		this.details = result.details;
-	}
-};
-function positiveInteger(value) {
-	const normalized = Math.floor(Number(value));
-	return Number.isFinite(normalized) && normalized > 0 ? normalized : null;
-}
-function futureEpochMs(value, nowMs) {
-	const normalized = Math.floor(Number(value));
-	return Number.isFinite(normalized) && normalized > nowMs ? normalized : null;
-}
-function laneRemainingUses(value) {
-	return positiveInteger(value.remainingUses ?? value.policyHint?.remainingUses);
-}
-function laneExpiresAtMs(value, nowMs) {
-	return futureEpochMs(value.expiresAtMs ?? value.policyHint?.expiresAtMs, nowMs);
-}
-function ed25519LaneMaterial(lane) {
-	if (lane.state === "missing") return null;
-	switch (lane.source) {
-		case "durable_sealed_record":
-		case "public_capability_reference": return { kind: lane.source };
-		default: return null;
-	}
-}
-function readReadyEd25519Lane(args) {
-	const lane = args.lanes.lanes.ed25519.near;
-	if (lane.state === "missing") return "ed25519_lane_missing";
-	if (availableEd25519SigningLaneAuthMethod(lane) !== args.authMethod) return "auth_method_route_mismatch";
-	if (lane.state !== "ready" && lane.state !== "restorable") return "ed25519_lane_missing";
-	const remainingSignatureUses = laneRemainingUses(lane);
-	const expiresAtMs = laneExpiresAtMs(lane, args.nowMs);
-	if (lane.authorizationState !== "authorized" || !lane.authorization.operationCredential.walletSessionId || !lane.authorization.session.quotaId || !lane.thresholdSessionId || !remainingSignatureUses || !expiresAtMs) return "lane_inventory_mismatch";
-	const material = ed25519LaneMaterial(lane);
-	if (!material) return "lane_material_missing";
-	const common = {
-		authMethod: args.authMethod,
-		target: { curve: "ed25519" },
-		walletSessionId: lane.authorization.operationCredential.walletSessionId,
-		quotaId: lane.authorization.session.quotaId,
-		thresholdSessionId: lane.thresholdSessionId,
-		remainingSignatureUses,
-		expiresAtMs,
-		material
-	};
-	return lane.state === "restorable" ? {
-		...common,
-		state: "restorable"
-	} : {
-		...common,
-		state: "ready"
-	};
-}
-function readEcdsaUseCaseReadyLane(args) {
-	const targetKey = thresholdEcdsaChainTargetKey(args.chainTarget);
-	const lane = args.lanes.ecdsa.lanesByTarget[targetKey];
-	if (!lane || lane.state === "missing") return "ecdsa_lane_missing";
-	if (availableEcdsaSigningLaneAuthMethod(lane) !== args.authMethod) return "auth_method_route_mismatch";
-	if (lane.state !== "ready") return "ecdsa_lane_missing";
-	const remainingSignatureUses = laneRemainingUses(lane);
-	const expiresAtMs = laneExpiresAtMs(lane, args.nowMs);
-	if (!lane.authorization || !remainingSignatureUses || !expiresAtMs) return "lane_inventory_mismatch";
-	return {
-		state: lane.state,
-		authMethod: args.authMethod,
-		target: {
-			curve: "ecdsa",
-			chainTarget: args.chainTarget
-		},
-		authorizationId: lane.authorization.session.authorizationId,
-		materialActivationId: String(lane.materialActivation.activationId),
-		remainingSignatureUses,
-		expiresAtMs,
-		material: { kind: "canonical_capability" }
-	};
-}
-async function readWalletRuntimePostconditions(args) {
-	const walletId = String(args.walletId || "").trim();
-	if (!walletId) return {
-		ok: false,
-		code: "wallet_missing",
-		details: { source: args.source }
-	};
-	const authMethod = signingLaneAuthMethod(args.ownerScope.auth);
-	const lanes = await args.readOwnerScopedSigningLanes({
-		walletId,
-		ownerScope: args.ownerScope
-	});
-	const nowMs = args.nowMs ?? Date.now();
-	let ed25519;
-	const ecdsaByTarget = /* @__PURE__ */ new Map();
-	for (const target of args.requiredTargets) {
-		if (target.curve === "ed25519") {
-			const readyLane = readReadyEd25519Lane({
-				lanes,
-				authMethod,
-				nowMs
-			});
-			if (typeof readyLane === "string") return {
-				ok: false,
-				code: readyLane,
-				details: {
-					source: args.source,
-					walletId,
-					authMethod,
-					curve: "ed25519",
-					state: lanes.lanes.ed25519.near.state,
-					candidateCount: lanes.candidates.ed25519.near.length
-				}
-			};
-			ed25519 = readyLane;
-			continue;
-		}
-		const readyLane = readEcdsaUseCaseReadyLane({
-			lanes,
-			chainTarget: target.chainTarget,
-			authMethod,
-			nowMs
-		});
-		if (typeof readyLane === "string") {
-			const targetKey = thresholdEcdsaChainTargetKey(target.chainTarget);
-			return {
-				ok: false,
-				code: readyLane,
-				details: {
-					source: args.source,
-					walletId,
-					authMethod,
-					curve: "ecdsa",
-					targetKey,
-					state: lanes.ecdsa.lanesByTarget[targetKey]?.state || "missing",
-					candidateCount: lanes.ecdsa.candidatesByTarget[targetKey]?.length || 0
-				}
-			};
-		}
-		ecdsaByTarget.set(thresholdEcdsaChainTargetKey(target.chainTarget), readyLane);
-	}
-	return {
-		ok: true,
-		inventory: {
-			...ed25519 ? { ed25519 } : {},
-			ecdsaByTarget
-		}
-	};
-}
-async function assertWalletRuntimePostconditions(args) {
-	const result = await readWalletRuntimePostconditions(args);
-	if (!result.ok) throw new WalletRuntimePostconditionError(result);
-	return result.inventory;
-}
-//#endregion
-export { assertWalletRuntimePostconditions };
-
-//# sourceMappingURL=runtimePostconditions.js.map

package/dist/esm/core/signingEngine/session/public.js

@@ -1,44 +0,0 @@
-import { SIGNER_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
-import { toWalletId } from "../interfaces/ecdsaChainTarget.js";
-import { readOwnerScopedAvailableSigningLanes, readPersistedAvailableSigningLanes as readPersistedAvailableSigningLanes$1 } from "./availability/persistedAvailableSigningLanes.js";
-import "./authority/authorityOperationResolver.js";
-//#region src/core/signingEngine/session/public.ts
-const EMPTY_DISCOVER_PERSISTED_SESSIONS_FOR_WALLET_RESULT = {
-	listed: 0,
-	discovered: 0,
-	truncated: 0
-};
-async function discoverPersistedSessionsForWallet(deps, args) {
-	const walletId = toWalletId(args.walletId);
-	switch (args.authMethod) {
-		case SIGNER_AUTH_METHODS.emailOtp: return await deps.discovery.emailOtp({
-			...args,
-			walletId,
-			authMethod: SIGNER_AUTH_METHODS.emailOtp
-		});
-		case SIGNER_AUTH_METHODS.passkey: return await deps.discovery.passkey?.({
-			...args,
-			walletId,
-			authMethod: SIGNER_AUTH_METHODS.passkey
-		}) ?? EMPTY_DISCOVER_PERSISTED_SESSIONS_FOR_WALLET_RESULT;
-		default:
-			args.authMethod;
-			throw new Error("Unsupported signer auth method");
-	}
-}
-async function readPersistedAvailableSigningLanes(deps, args) {
-	return await readPersistedAvailableSigningLanes$1(deps.availableLanes, args, deps.getConfiguredEcdsaChainTargets());
-}
-/** Human operational read: one exact owner, configured ECDSA targets. */
-async function readOwnerScopedSigningLanes(deps, args, statusReads) {
-	return await readOwnerScopedAvailableSigningLanes(deps.availableLanes, {
-		walletId: args.walletId,
-		ownerScope: args.ownerScope,
-		ecdsaChainTargets: deps.getConfiguredEcdsaChainTargets(),
-		requiredEcdsaCapability: "sign"
-	}, statusReads);
-}
-//#endregion
-export { discoverPersistedSessionsForWallet, readOwnerScopedSigningLanes, readPersistedAvailableSigningLanes };
-
-//# sourceMappingURL=public.js.map