@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/signingEngine/session/warmCapabilities/ed25519SealedSessionRuntime.js

@@ -1,251 +0,0 @@
-import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { toAccountId } from "../../../types/accountIds.js";
-import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
-import { nearEd25519SigningKeyIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
-import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { SigningSessionIds } from "../operationState/types.js";
-import { toRpId } from "../identity/evmFamilyEcdsaIdentity.js";
-import { normalizeThresholdRuntimePolicyScope } from "../../threshold/sessionPolicy.js";
-import { parseSignerSlot } from "../../../../shared-ts/src/utils/signerSlot.js";
-import { parseEmailOtpWalletAuthAuthority, parsePasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { nearEd25519SessionMatchesMaterialActivation } from "../material/nearEd25519YaoSigningPreparation.js";
-import { listExactSealedSessionsForWallet } from "../persistence/sealedSessionStore.js";
-//#region src/core/signingEngine/session/warmCapabilities/ed25519SealedSessionRuntime.ts
-function nonEmptyString(value) {
-	return String(value ?? "").trim() || null;
-}
-function positiveSafeInteger(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
-}
-function nonNegativeSafeInteger(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
-}
-function exactParticipantIds(value) {
-	const participantIds = normalizeThresholdEd25519ParticipantIds(value);
-	return participantIds?.length === 2 ? [participantIds[0], participantIds[1]] : null;
-}
-function sealedFactor(record) {
-	const restore = record.ed25519Restore;
-	switch (record.authMethod) {
-		case SIGNER_AUTH_METHODS.passkey: {
-			const credentialIdB64u = nonEmptyString(restore.credentialIdB64u);
-			if (!credentialIdB64u) return null;
-			return {
-				kind: "passkey",
-				rpId: toRpId(restore.rpId),
-				credentialIdB64u
-			};
-		}
-		case SIGNER_AUTH_METHODS.emailOtp: {
-			if (!("provider" in restore)) return null;
-			const providerSubjectId = nonEmptyString(restore.providerSubjectId);
-			const emailHashHex = nonEmptyString(restore.emailHashHex);
-			if (!providerSubjectId || !emailHashHex) return null;
-			return {
-				kind: "email_otp",
-				provider: restore.provider,
-				providerSubjectId,
-				emailHashHex
-			};
-		}
-	}
-}
-function authBinding(factor) {
-	switch (factor.kind) {
-		case "passkey": return {
-			kind: SIGNER_AUTH_METHODS.passkey,
-			rpId: factor.rpId,
-			credentialIdB64u: factor.credentialIdB64u
-		};
-		case "email_otp": return {
-			kind: SIGNER_AUTH_METHODS.emailOtp,
-			providerSubjectId: factor.providerSubjectId
-		};
-	}
-}
-function parseExactEd25519SealedSessionRuntime(record) {
-	const restore = record.ed25519Restore;
-	const thresholdSessionIdRaw = nonEmptyString(record.thresholdSessionIds.ed25519);
-	const relayerUrl = nonEmptyString(record.relayerUrl);
-	const relayerKeyId = nonEmptyString(restore.relayerKeyId);
-	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
-	const remainingUses = nonNegativeSafeInteger(record.remainingUses);
-	const signerSlot = parseSignerSlot(restore.signerSlot);
-	const participantIds = exactParticipantIds(restore.participantIds);
-	const runtimePolicyScope = normalizeThresholdRuntimePolicyScope(restore.runtimePolicyScope);
-	const signingRoot = runtimePolicyScope ? signingRootScopeFromRuntimePolicyScope(runtimePolicyScope) : null;
-	const signingRootVersion = nonEmptyString(signingRoot?.signingRootVersion);
-	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(restore.routerAbNormalSigning);
-	const factor = sealedFactor(record);
-	if (!thresholdSessionIdRaw || !relayerUrl || !relayerKeyId || !expiresAtMs || remainingUses === null || !signerSlot || !participantIds || !runtimePolicyScope || !signingRoot || !signingRootVersion || !routerAbNormalSigning || routerAbNormalSigning.signingWorkerId !== relayerKeyId || !factor) return null;
-	if (record.signingRootId !== signingRoot.signingRootId || record.signingRootVersion !== signingRootVersion) return null;
-	try {
-		return {
-			kind: "exact_ed25519_sealed_session_runtime",
-			sealedRecord: record,
-			walletId: toWalletId(record.walletId),
-			nearAccountId: toAccountId(restore.nearAccountId),
-			nearEd25519SigningKeyId: nearEd25519SigningKeyIdFromString(restore.nearEd25519SigningKeyId),
-			signerSlot,
-			factor,
-			auth: authBinding(factor),
-			thresholdSessionId: SigningSessionIds.thresholdEd25519Session(thresholdSessionIdRaw),
-			remainingUses,
-			expiresAtMs,
-			relayerUrl,
-			relayerKeyId,
-			participantIds,
-			runtimePolicyScope,
-			signingRootId: signingRoot.signingRootId,
-			signingRootVersion,
-			routerAbNormalSigning
-		};
-	} catch {
-		return null;
-	}
-}
-async function ed25519SealedRuntimeAuthorityRef(args) {
-	let authority;
-	switch (args.runtime.factor.kind) {
-		case "passkey":
-			authority = parsePasskeyWalletAuthAuthority({
-				walletId: args.runtime.walletId,
-				factor: {
-					kind: "passkey",
-					credentialIdB64u: args.runtime.factor.credentialIdB64u
-				},
-				verifier: {
-					kind: "webauthn",
-					rpId: args.runtime.factor.rpId
-				},
-				bindingId: args.walletAuthMethodId
-			});
-			break;
-		case "email_otp":
-			authority = parseEmailOtpWalletAuthAuthority({
-				walletId: args.runtime.walletId,
-				factor: {
-					kind: "email_otp",
-					provider: args.runtime.factor.provider,
-					providerUserId: args.runtime.factor.providerSubjectId
-				},
-				verifier: {
-					kind: "email_otp_wallet_auth_method",
-					emailHashHex: args.runtime.factor.emailHashHex
-				},
-				bindingId: args.walletAuthMethodId
-			});
-			break;
-		default: return assertNeverEd25519Factor(args.runtime.factor);
-	}
-	if (!authority) throw new Error("[SigningEngine][near] sealed Ed25519 authority is invalid");
-	return await walletAuthAuthorityRef({ authority });
-}
-function assertNeverEd25519Factor(value) {
-	throw new Error(`Unsupported Ed25519 factor: ${String(value)}`);
-}
-async function ed25519AuthorizationIdentityMatchesRuntime(args) {
-	const { authorization, runtime } = args;
-	if (authorization.session.walletId !== runtime.walletId || authorization.session.authMethodId !== authorization.selectedAuthMethod.walletAuthMethodId || authorization.session.quotaId !== authorization.status.quotaId || authorization.operationCredential.walletSessionId !== authorization.status.walletSessionId || authorization.operationCredential.token.trim().length === 0 || authorization.status.remainingUses <= 0 || !nearEd25519SessionMatchesMaterialActivation({
-		session: authorization.session,
-		materialActivation: runtime.sealedRecord.ed25519Restore.materialActivation
-	})) return false;
-	if (runtime.factor.kind === "passkey") {
-		if (authorization.selectedAuthMethod.kind !== "passkey" || String(authorization.selectedAuthMethod.rpId) !== String(runtime.factor.rpId) || authorization.selectedAuthMethod.credentialIdB64u !== runtime.factor.credentialIdB64u || authorization.selectedFactorAuthority.factor.kind !== "passkey" || authorization.selectedFactorAuthority.factor.credentialIdB64u !== runtime.factor.credentialIdB64u || authorization.selectedFactorAuthority.verifier.kind !== "webauthn" || String(authorization.selectedFactorAuthority.verifier.rpId) !== String(runtime.factor.rpId)) return false;
-	} else if (authorization.selectedAuthMethod.kind !== "email_otp" || authorization.selectedAuthMethod.emailHashHex !== runtime.factor.emailHashHex || authorization.selectedFactorAuthority.factor.kind !== "email_otp" || authorization.selectedFactorAuthority.factor.provider !== runtime.factor.provider || authorization.selectedFactorAuthority.factor.providerUserId !== runtime.factor.providerSubjectId || authorization.selectedFactorAuthority.verifier.kind !== "email_otp_wallet_auth_method" || authorization.selectedFactorAuthority.verifier.emailHashHex !== runtime.factor.emailHashHex) return false;
-	try {
-		const expected = await ed25519SealedRuntimeAuthorityRef({
-			runtime,
-			walletAuthMethodId: authorization.selectedAuthMethod.walletAuthMethodId
-		});
-		const selectedFactorRef = await walletAuthAuthorityRef({ authority: authorization.selectedFactorAuthority });
-		return expected.walletId === authorization.selectedAuthority.walletId && expected.walletAuthMethodId === authorization.selectedAuthMethod.walletAuthMethodId && expected.walletId === selectedFactorRef.walletId && expected.walletAuthMethodId === selectedFactorRef.walletAuthMethodId && expected.authorityDigest === selectedFactorRef.authorityDigest;
-	} catch {
-		return false;
-	}
-}
-function authBindingsEqual(left, right) {
-	switch (left.kind) {
-		case "passkey": return right.kind === "passkey" && left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u;
-		case "email_otp": return right.kind === "email_otp" && left.providerSubjectId === right.providerSubjectId;
-	}
-}
-function rawRecordMatchesLaneSubject(args) {
-	const signer = args.laneIdentity.signer;
-	const restore = args.record.ed25519Restore;
-	return args.record.walletId === signer.account.wallet.walletId && restore.nearAccountId === signer.account.nearAccountId && restore.nearEd25519SigningKeyId === signer.nearEd25519SigningKeyId && restore.signerSlot === signer.signerSlot && args.record.thresholdSessionIds.ed25519 === args.laneIdentity.thresholdSessionId;
-}
-function runtimeMatchesLane(runtime, laneIdentity) {
-	return authBindingsEqual(runtime.auth, laneIdentity.auth);
-}
-async function resolveExactEd25519SealedSessionRuntimeForLaneWithResolver(args, resolver) {
-	const candidates = (await resolver.listExactSealedSessionsForWallet({
-		walletId: args.walletId,
-		filter: {
-			authMethod: args.laneIdentity.auth.kind,
-			curve: "ed25519"
-		}
-	})).filter((record) => record.curve === "ed25519" && rawRecordMatchesLaneSubject({
-		record,
-		laneIdentity: args.laneIdentity
-	}));
-	if (candidates.length === 0) return { kind: "missing" };
-	if (candidates.length > 1) return { kind: "conflict" };
-	const runtime = parseExactEd25519SealedSessionRuntime(candidates[0]);
-	if (!runtime || !runtimeMatchesLane(runtime, args.laneIdentity)) return { kind: "corrupt" };
-	return {
-		kind: "resolved",
-		runtime
-	};
-}
-async function resolveExactEd25519SealedSessionRuntimeForLane(args) {
-	return await resolveExactEd25519SealedSessionRuntimeForLaneWithResolver(args, { listExactSealedSessionsForWallet });
-}
-async function resolveExactEd25519SealedSessionRuntimeForWalletWithResolver(walletId, resolver) {
-	return resolveOneEd25519SealedSessionRuntime(await listEd25519SealedSessionRecordsForWallet(walletId, resolver));
-}
-async function listEd25519SealedSessionRecordsForWallet(walletId, resolver) {
-	const listedRecords = await Promise.all([resolver.listExactSealedSessionsForWallet({
-		walletId,
-		filter: {
-			authMethod: SIGNER_AUTH_METHODS.passkey,
-			curve: "ed25519"
-		}
-	}), resolver.listExactSealedSessionsForWallet({
-		walletId,
-		filter: {
-			authMethod: SIGNER_AUTH_METHODS.emailOtp,
-			curve: "ed25519"
-		}
-	})]);
-	const records = [];
-	for (const listed of listedRecords) for (const record of listed) if (record.curve === "ed25519") records.push(record);
-	return records;
-}
-function resolveOneEd25519SealedSessionRuntime(records) {
-	if (records.length === 0) return { kind: "missing" };
-	if (records.length > 1) return { kind: "conflict" };
-	const runtime = parseExactEd25519SealedSessionRuntime(records[0]);
-	return runtime ? {
-		kind: "resolved",
-		runtime
-	} : { kind: "corrupt" };
-}
-async function resolveExactEd25519SealedSessionRuntimeForWallet(walletId) {
-	return await resolveExactEd25519SealedSessionRuntimeForWalletWithResolver(walletId, { listExactSealedSessionsForWallet });
-}
-async function resolveExactEd25519SealedSessionRuntimeForWalletSubjectWithResolver(args, resolver) {
-	const records = await listEd25519SealedSessionRecordsForWallet(args.walletId, resolver);
-	const matches = [];
-	for (const record of records) if (record.ed25519Restore.nearAccountId === args.nearAccountId && record.ed25519Restore.nearEd25519SigningKeyId === args.nearEd25519SigningKeyId) matches.push(record);
-	return resolveOneEd25519SealedSessionRuntime(matches);
-}
-async function resolveExactEd25519SealedSessionRuntimeForWalletSubject(args) {
-	return await resolveExactEd25519SealedSessionRuntimeForWalletSubjectWithResolver(args, { listExactSealedSessionsForWallet });
-}
-//#endregion
-export { ed25519AuthorizationIdentityMatchesRuntime, ed25519SealedRuntimeAuthorityRef, parseExactEd25519SealedSessionRuntime, resolveExactEd25519SealedSessionRuntimeForLane, resolveExactEd25519SealedSessionRuntimeForWallet, resolveExactEd25519SealedSessionRuntimeForWalletSubject };
-
-//# sourceMappingURL=ed25519SealedSessionRuntime.js.map

package/dist/esm/core/signingEngine/session/warmCapabilities/nearEd25519CapabilityRehydration.js

@@ -1,98 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { signingLaneAuthBindingKey } from "../identity/signingLaneAuthBinding.js";
-import { SigningSessionIds } from "../operationState/types.js";
-import { exactEd25519SigningLaneIdentity, exactSigningLaneIdentityKey, exactSigningLaneIdentityMatches, nearEd25519SignerBindingFromBoundaryFields } from "../identity/exactSigningLaneIdentity.js";
-import { materialActivationKey } from "../sealedRecovery/materialActivationKey.js";
-import { isConcreteAvailableSigningLane } from "../availability/availableSigningLanes.js";
-//#region src/core/signingEngine/session/warmCapabilities/nearEd25519CapabilityRehydration.ts
-function exactEd25519LaneIdentityFromAvailableLane(lane) {
-	if (!lane.authorization) throw new Error("Available Ed25519 lane requires Wallet Session authorization");
-	return exactEd25519SigningLaneIdentity({
-		signer: nearEd25519SignerBindingFromBoundaryFields({
-			walletId: lane.walletId,
-			nearAccountId: lane.nearAccountId,
-			nearEd25519SigningKeyId: lane.nearEd25519SigningKeyId,
-			signerSlot: lane.signerSlot
-		}),
-		auth: lane.auth,
-		walletSessionId: lane.authorization.operationCredential.walletSessionId,
-		quotaId: lane.authorization.session.quotaId,
-		thresholdSessionId: lane.thresholdSessionId
-	});
-}
-function nearEd25519MaterialIdentityKey(identity) {
-	const signer = identity.signer;
-	return JSON.stringify([
-		String(signer.account.wallet.walletId),
-		String(signer.account.nearAccountId),
-		String(signer.nearEd25519SigningKeyId),
-		signer.signerSlot,
-		signingLaneAuthBindingKey(identity.auth),
-		String(identity.thresholdSessionId)
-	]);
-}
-function nearEd25519MaterialIdentityFromAvailableLane(lane) {
-	return {
-		kind: "near_ed25519_material_identity",
-		signer: nearEd25519SignerBindingFromBoundaryFields({
-			walletId: lane.walletId,
-			nearAccountId: lane.nearAccountId,
-			nearEd25519SigningKeyId: lane.nearEd25519SigningKeyId,
-			signerSlot: lane.signerSlot
-		}),
-		auth: lane.auth,
-		thresholdSessionId: SigningSessionIds.thresholdEd25519Session(lane.thresholdSessionId)
-	};
-}
-function nearEd25519ExportMaterialIdentityAsMaterialIdentity(identity) {
-	return {
-		kind: "near_ed25519_material_identity",
-		signer: identity.signer,
-		auth: identity.auth,
-		thresholdSessionId: identity.thresholdSessionId
-	};
-}
-function nearEd25519CapabilityRehydrationMaterialIdentity(subject) {
-	switch (subject.kind) {
-		case "exact_lane": return {
-			kind: "near_ed25519_material_identity",
-			signer: subject.laneIdentity.signer,
-			auth: subject.laneIdentity.auth,
-			thresholdSessionId: subject.laneIdentity.thresholdSessionId
-		};
-		case "export_exact_lane": return nearEd25519ExportMaterialIdentityAsMaterialIdentity(subject.laneIdentity);
-		case "material_identity": return subject.materialIdentity;
-		default: return assertNeverNearEd25519CapabilityRehydrationSubject(subject);
-	}
-}
-function nearEd25519LaneMatchesCapabilityRehydrationSubject(lane, subject) {
-	if (!isConcreteAvailableSigningLane(lane) || lane.curve !== "ed25519") return false;
-	const subjectIdentity = nearEd25519CapabilityRehydrationMaterialIdentity(subject);
-	const subjectSigner = subjectIdentity.signer;
-	if (String(lane.walletId) !== String(subjectSigner.account.wallet.walletId) || String(lane.nearAccountId) !== String(subjectSigner.account.nearAccountId) || lane.signerSlot !== subjectSigner.signerSlot || String(lane.thresholdSessionId) !== subjectIdentity.thresholdSessionId) return false;
-	switch (subject.kind) {
-		case "exact_lane": return lane.authorizationState === "authorized" && exactSigningLaneIdentityMatches(exactEd25519LaneIdentityFromAvailableLane(lane), subject.laneIdentity);
-		case "export_exact_lane": return nearEd25519MaterialIdentityKey(nearEd25519MaterialIdentityFromAvailableLane(lane)) === nearEd25519MaterialIdentityKey(subjectIdentity) && mpcMaterialActivationRefsEqual(lane.materialActivation, subject.materialActivation);
-		case "material_identity": return nearEd25519MaterialIdentityKey(nearEd25519MaterialIdentityFromAvailableLane(lane)) === nearEd25519MaterialIdentityKey(subjectIdentity);
-		default: return assertNeverNearEd25519CapabilityRehydrationSubject(subject);
-	}
-}
-function nearEd25519CapabilityRehydrationKey(subject) {
-	switch (subject.kind) {
-		case "exact_lane": return JSON.stringify([subject.kind, exactSigningLaneIdentityKey(subject.laneIdentity)]);
-		case "export_exact_lane": return JSON.stringify([
-			subject.kind,
-			nearEd25519MaterialIdentityKey(nearEd25519ExportMaterialIdentityAsMaterialIdentity(subject.laneIdentity)),
-			materialActivationKey(subject.materialActivation)
-		]);
-		case "material_identity": return JSON.stringify([subject.kind, nearEd25519MaterialIdentityKey(subject.materialIdentity)]);
-		default: return assertNeverNearEd25519CapabilityRehydrationSubject(subject);
-	}
-}
-function assertNeverNearEd25519CapabilityRehydrationSubject(value) {
-	throw new Error(`Unknown Ed25519 capability rehydration subject: ${String(value)}`);
-}
-//#endregion
-export { exactEd25519LaneIdentityFromAvailableLane, nearEd25519CapabilityRehydrationKey, nearEd25519CapabilityRehydrationMaterialIdentity, nearEd25519LaneMatchesCapabilityRehydrationSubject };
-
-//# sourceMappingURL=nearEd25519CapabilityRehydration.js.map

package/dist/esm/core/signingEngine/session/warmCapabilities/public.js

@@ -1,31 +0,0 @@
-import { buildWalletSessionStatusCheckForSession, ed25519WalletSessionStatusOwner, getWalletSessionStatus, mergeWalletSigningSessionStatus } from "../lifecycle/walletSessionStatus.js";
-import { scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill as scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill$1 } from "./ecdsaLoginPrefill.js";
-//#region src/core/signingEngine/session/warmCapabilities/public.ts
-async function getWarmThresholdEd25519SessionStatus(deps, args) {
-	const status = await deps.statusReader.getEd25519SigningSessionStatus(args);
-	const sessionStatusCheck = args.authorization ? buildWalletSessionStatusCheckForSession({
-		owner: ed25519WalletSessionStatusOwner(args.runtime.walletId),
-		authorization: {
-			walletSessionId: args.authorization.operationCredential.walletSessionId,
-			quotaId: args.authorization.session.quotaId
-		}
-	}) : null;
-	return mergeWalletSigningSessionStatus(status, sessionStatusCheck ? await getWalletSessionStatus({ getAvailableStatus: deps.getWalletSessionStatus }, sessionStatusCheck) : null);
-}
-async function scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill(deps, args) {
-	return await scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill$1({
-		getSignerWorkerContext: deps.getSignerWorkerContext,
-		resolveClientSigningMaterialSource: deps.resolveClientSigningMaterialSource,
-		routerAbEcdsaDerivationPresignaturePoolPolicy: deps.routerAbEcdsaDerivationPresignaturePoolPolicy
-	}, args);
-}
-async function hydrateSigningSession(deps, args) {
-	await deps.hydrateSigningSession(args);
-}
-async function clearVolatileWarmSigningMaterial(deps, walletId) {
-	await deps.clearVolatileWarmSigningMaterial(walletId);
-}
-//#endregion
-export { clearVolatileWarmSigningMaterial, getWarmThresholdEd25519SessionStatus, hydrateSigningSession, scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill };
-
-//# sourceMappingURL=public.js.map

package/dist/esm/core/signingEngine/session/warmCapabilities/readModel.js

@@ -1,155 +0,0 @@
-import { emailOtpAuthContextConsumedAtMs, emailOtpAuthContextRetention, laneCandidateStateFromRuntimePolicy } from "../identity/laneIdentity.js";
-import { nearEd25519SessionMatchesMaterialActivation } from "../material/nearEd25519YaoSigningPreparation.js";
-//#region src/core/signingEngine/session/warmCapabilities/readModel.ts
-function normalizeWarmSessionReadPorts(ports) {
-	const getWarmSessionStatus = typeof ports?.getWarmSessionStatus === "function" ? (args) => ports.getWarmSessionStatus(args) : null;
-	const getWarmSessionStatuses = typeof ports?.getWarmSessionStatuses === "function" ? (args) => ports.getWarmSessionStatuses(args) : null;
-	if (getWarmSessionStatus && getWarmSessionStatuses) return {
-		statusPort: "single_and_batch",
-		getWarmSessionStatus,
-		getWarmSessionStatuses
-	};
-	if (getWarmSessionStatus) return {
-		statusPort: "single",
-		getWarmSessionStatus
-	};
-	if (getWarmSessionStatuses) return {
-		statusPort: "batch",
-		getWarmSessionStatuses
-	};
-	return null;
-}
-function reportWarmSessionAvailabilityFailure(args) {
-	console.warn("[WarmSessionStore] warm-session availability failure", {
-		operation: args.operation,
-		thresholdSessionId: args.thresholdSessionId,
-		code: String(args.code || "worker_error").trim() || "worker_error"
-	});
-}
-async function readWarmSessionClaim(touchConfirm, thresholdSessionIdRaw) {
-	const thresholdSessionId = String(thresholdSessionIdRaw || "").trim();
-	if (!touchConfirm || !thresholdSessionId || touchConfirm.statusPort === "batch") return null;
-	return toWarmSessionClaimFromStatusResult({
-		thresholdSessionId,
-		status: await touchConfirm.getWarmSessionStatus({ thresholdSessionId }).catch(() => ({
-			ok: false,
-			code: "worker_error",
-			message: "worker_error"
-		}))
-	});
-}
-function toWarmSessionClaimFromStatusResult(args) {
-	const thresholdSessionId = String(args.thresholdSessionId || "").trim();
-	if (!args.status.ok) {
-		if (args.status.code === "expired") return {
-			state: "expired",
-			thresholdSessionId
-		};
-		if (args.status.code === "exhausted") return {
-			state: "exhausted",
-			thresholdSessionId
-		};
-		if (args.status.code === "not_found") return {
-			state: "missing",
-			thresholdSessionId
-		};
-		reportWarmSessionAvailabilityFailure({
-			operation: "status_read",
-			thresholdSessionId,
-			code: args.status.code
-		});
-		return {
-			state: "unavailable",
-			thresholdSessionId,
-			code: String(args.status.code || "worker_error").trim() || "worker_error"
-		};
-	}
-	return {
-		state: "warm",
-		thresholdSessionId,
-		expiresAtMs: args.status.expiresAtMs,
-		remainingUses: args.status.remainingUses
-	};
-}
-function deriveEd25519CapabilityState(args) {
-	if (!args.auth || String(args.auth.session.walletId) !== String(args.runtime.walletId) || args.auth.selectedAuthMethod.kind !== args.runtime.factor.kind || args.auth.status.remainingUses <= 0 || args.auth.status.quotaId !== args.auth.session.quotaId || !nearEd25519SessionMatchesMaterialActivation({
-		session: args.auth.session,
-		materialActivation: args.runtime.sealedRecord.ed25519Restore.materialActivation
-	}) || args.runtime.factor.kind === "passkey" && (args.auth.selectedAuthMethod.kind !== "passkey" || String(args.auth.selectedAuthMethod.rpId) !== String(args.runtime.factor.rpId) || args.auth.selectedAuthMethod.credentialIdB64u !== args.runtime.factor.credentialIdB64u || args.auth.selectedFactorAuthority.factor.kind !== "passkey" || args.auth.selectedFactorAuthority.factor.credentialIdB64u !== args.runtime.factor.credentialIdB64u) || args.runtime.factor.kind === "email_otp" && (args.auth.selectedAuthMethod.kind !== "email_otp" || args.auth.selectedFactorAuthority.factor.kind !== "email_otp" || args.auth.selectedFactorAuthority.factor.providerUserId !== args.runtime.factor.providerSubjectId || args.auth.selectedFactorAuthority.verifier.kind !== "email_otp_wallet_auth_method" || args.auth.selectedFactorAuthority.verifier.emailHashHex !== args.runtime.factor.emailHashHex)) return "authorization_required";
-	const runtimeState = laneCandidateStateFromRuntimePolicy({
-		remainingUses: args.runtime.remainingUses,
-		expiresAtMs: args.runtime.expiresAtMs
-	});
-	if (runtimeState === "expired" || runtimeState === "exhausted") return "authorization_required";
-	if (!args.prfClaim) return "prf_missing";
-	switch (args.prfClaim.state) {
-		case "unavailable": return "prf_unavailable";
-		case "warm": return "ready";
-		case "missing":
-		case "expired":
-		case "exhausted": return "prf_missing";
-	}
-}
-function deriveEcdsaCapabilityState(args) {
-	if (!args.auth) return "authorization_required";
-	const runtimeState = laneCandidateStateFromRuntimePolicy({
-		remainingUses: args.runtime.remainingUses,
-		expiresAtMs: args.runtime.expiresAtMs
-	});
-	if (runtimeState === "expired" || runtimeState === "exhausted") return "authorization_required";
-	const ecdsaEmailOtpAuthContext = args.emailOtpAuthContext;
-	if (ecdsaEmailOtpAuthContext && emailOtpAuthContextRetention(ecdsaEmailOtpAuthContext) === "single_use" && Number(emailOtpAuthContextConsumedAtMs(ecdsaEmailOtpAuthContext)) > 0) return "prf_missing";
-	if (!args.prfClaim) return "prf_missing";
-	if (args.prfClaim.state === "unavailable") return "prf_unavailable";
-	if (args.prfClaim.state !== "warm") return "prf_missing";
-	return "ready";
-}
-function toSigningSessionStatus(args) {
-	const sessionId = String(args.sessionId || "").trim();
-	const claim = args.claim;
-	const metadata = {
-		...args.authMethod ? { authMethod: args.authMethod } : {},
-		...args.retention ? { retention: args.retention } : {}
-	};
-	if (!claim) return {
-		sessionId,
-		status: "not_found",
-		...metadata
-	};
-	if (claim.state === "unavailable") return {
-		sessionId,
-		status: "unavailable",
-		statusCode: claim.code,
-		...metadata
-	};
-	if (claim.state === "warm") return {
-		sessionId,
-		status: "active",
-		...metadata,
-		remainingUses: claim.remainingUses,
-		expiresAtMs: claim.expiresAtMs
-	};
-	return {
-		sessionId,
-		...metadata,
-		status: claim.state === "expired" ? "expired" : claim.state === "exhausted" ? "exhausted" : "not_found"
-	};
-}
-/** Transport identity comes from the sealed runtime; the bearer proof comes from
-* the active Wallet Session. An Email-OTP-bound runtime has no standing
-* authorization of its own, so without a live Wallet Session there is nothing to
-* seal against and the transport is withheld rather than emitted unauthorized. */
-function resolveEcdsaSealTransport(args) {
-	if (!(args.auth?.operationCredential.token || null)) return null;
-	if (!String(args.runtime.relayerUrl || "").trim()) return null;
-	const groupId = String(args.groupId || "").trim();
-	return {
-		curve: "ecdsa",
-		...args.signingSessionSealKeyVersion ? { signingSessionSealKeyVersion: args.signingSessionSealKeyVersion } : {},
-		...groupId ? { groupId } : {}
-	};
-}
-//#endregion
-export { deriveEcdsaCapabilityState, deriveEd25519CapabilityState, normalizeWarmSessionReadPorts, readWarmSessionClaim, resolveEcdsaSealTransport, toSigningSessionStatus, toWarmSessionClaimFromStatusResult };
-
-//# sourceMappingURL=readModel.js.map