@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/signingEngine/threshold/ed25519/walletSession.js

@@ -1,220 +1,18 @@
-import { parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { normalizeTrimmedString, stripTrailingSlashes } from "../../../../shared-ts/src/utils/normalize.js";
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseWalletSessionOperationCredentialV1 } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
-import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit } from "../../../rpcClients/relayer/relayerHttp.js";
+import "../../../../shared-ts/src/utils/errors.js";
 import { ROUTER_AB_ED25519_WALLET_SESSION_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { toRpId } from "../../session/identity/evmFamilyEcdsaIdentity.js";
-import { normalizeThresholdRuntimePolicyScope } from "../sessionPolicy.js";
-import { getPrfFirstB64uFromCredential, redactCredentialExtensionOutputs } from "../../webauthnAuth/credentials/credentialExtensions.js";
+import { buildRelayerJsonPostRequestInit, buildWalletSessionAuthorizationHeaders } from "../../../rpcClients/relayer/relayerHttp.js";
 import "../../../../shared-ts/src/device-linking/index.js";
-import { errorMessage } from "../../../../shared-ts/src/utils/errors.js";
-import { buildWebAuthnPrfFirstSecretSource } from "../../../platform/secretSources.js";
-import { parseWalletSessionAlreadyCommittedResponseV1 } from "../../../../shared-ts/src/authorization/walletSessionIssuance.js";
+import { redactCredentialExtensionOutputs } from "../../webauthnAuth/credentials/credentialExtensions.js";
 import "../../../../shared-ts/src/authorization/index.js";
 //#region src/core/signingEngine/threshold/ed25519/walletSession.ts
-const ED25519_WALLET_SESSION_MINT_TIMEOUT_MS = 15e3;
-function abortEd25519WalletSessionMint(controller) {
-	controller.abort("timeout");
-}
 function requireNonEmptyEd25519SecretSourceString(value, field) {
 	const normalized = String(value ?? "").trim();
 	if (!normalized) throw new Error(`[threshold-ed25519] ${field} is required`);
 	return normalized;
 }
-function buildRequiredPrfAuthenticatorSuccess(args) {
-	const prfFirstB64u = requireNonEmptyEd25519SecretSourceString(getPrfFirstB64uFromCredential(args.credential), "prfFirstB64u");
-	return {
-		ok: true,
-		operation: "get_passkey",
-		requirePrfFirst: true,
-		credential: args.credential,
-		credentialIdB64u: requireNonEmptyEd25519SecretSourceString(args.credential.rawId || args.credential.id, "credentialIdB64u"),
-		rawIdB64u: String(args.credential.rawId || "").trim(),
-		rpId: toRpId(args.rpId),
-		prf: {
-			kind: "required",
-			prfFirstB64u
-		}
-	};
-}
-function buildThresholdEd25519WebAuthnPrfSecretSource(args) {
-	return {
-		kind: "webauthn_prf_first_credential",
-		credential: args.credential,
-		secretSource: buildWebAuthnPrfFirstSecretSource(buildRequiredPrfAuthenticatorSuccess(args))
-	};
-}
-function localPrfFirstForEd25519WalletSessionMintAuthorization(auth) {
-	return auth.policySecretSource.secretSource.prfFirstB64u;
-}
-function parseWalletSessionMintExpiresAtMs(value) {
-	if (typeof value !== "string") return null;
-	const expiresAtMs = Date.parse(value);
-	return Number.isSafeInteger(expiresAtMs) && expiresAtMs > Date.now() ? expiresAtMs : null;
-}
-function parseWalletSessionMintRemainingUses(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
-}
-/**
-* Ed25519 Wallet Session mint.
-*
-* `threshold_session_policy_webauthn` sends a WebAuthn assertion whose challenge
-* is the `sessionPolicyDigest32`. The local PRF credential stays in wallet origin.
-*
-* Notes:
-* - PRF outputs must never be sent to the Router API; they should be used only in wallet origin.
-*/
-async function mintEd25519WalletSession(args) {
-	const relayerUrl = stripTrailingSlashes(normalizeTrimmedString(args.relayerUrl));
-	if (!relayerUrl) return {
-		ok: false,
-		code: "invalid_args",
-		message: "Missing relayerUrl for Wallet Session mint"
-	};
-	if (typeof fetch !== "function") return {
-		ok: false,
-		code: "unsupported",
-		message: "fetch is not available for Wallet Session mint"
-	};
-	const webauthn_authentication = redactCredentialExtensionOutputs(args.auth.policySecretSource.credential);
-	const controller = new AbortController();
-	let timeoutId = null;
-	try {
-		const url = `${relayerUrl}${ROUTER_AB_ED25519_WALLET_SESSION_PATH}`;
-		const existingOperationCredential = args.existingOperationCredential;
-		const publishableKey = String(args.publishableKey || "").trim() || void 0;
-		const bearerToken = existingOperationCredential?.token || publishableKey;
-		const projectEnvironmentId = !existingOperationCredential && publishableKey ? String(args.projectEnvironmentId || "").trim() || void 0 : void 0;
-		timeoutId = setTimeout(abortEd25519WalletSessionMint, ED25519_WALLET_SESSION_MINT_TIMEOUT_MS, controller);
-		const response = await fetch(url, {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...bearerToken ? { Authorization: `Bearer ${bearerToken}` } : {}
-			},
-			credentials: "omit",
-			signal: controller.signal,
-			body: JSON.stringify({
-				sessionKind: args.sessionKind,
-				relayerKeyId: args.relayerKeyId,
-				sessionPolicy: args.sessionPolicy,
-				...projectEnvironmentId ? { projectEnvironmentId } : {},
-				walletSessionTarget: { kind: "new_wallet_session" },
-				...webauthn_authentication ? { webauthn_authentication } : {}
-			})
-		});
-		let data;
-		try {
-			const parsed = await response.json();
-			data = isPlainObject(parsed) ? parsed : {};
-		} catch (error) {
-			if (controller.signal.aborted) throw error;
-			data = {};
-		}
-		if (!response.ok) {
-			const alreadyCommitted = parseWalletSessionAlreadyCommittedResponseV1(data);
-			if (alreadyCommitted) return alreadyCommitted;
-			return {
-				ok: false,
-				code: typeof data.code === "string" ? data.code : "http_error",
-				message: typeof data.message === "string" ? data.message : `HTTP ${response.status}`
-			};
-		}
-		const alreadyCommitted = parseWalletSessionAlreadyCommittedResponseV1(data);
-		if (alreadyCommitted) return alreadyCommitted;
-		if (data.ok !== true) return {
-			ok: false,
-			code: typeof data.code === "string" ? data.code : "invalid_response",
-			message: typeof data.message === "string" ? data.message : "Wallet Session mint returned an unsuccessful response"
-		};
-		const thresholdSessionId = parseThresholdEd25519SessionId(data.thresholdSessionId);
-		if (!thresholdSessionId.ok) return {
-			ok: false,
-			code: "invalid_response",
-			message: "Wallet Session mint returned an invalid thresholdSessionId"
-		};
-		const walletSessionId = parseWalletSessionId(data.walletSessionId);
-		const authorizationId = parseWalletSessionAuthorizationId(data.authorizationId);
-		const quotaId = parseMpcWalletSigningQuotaId(data.quotaId);
-		if (!walletSessionId.ok || !authorizationId.ok || !quotaId.ok) return {
-			ok: false,
-			code: "invalid_response",
-			message: "Wallet Session mint returned invalid authorization identity"
-		};
-		const expiresAtMs = parseWalletSessionMintExpiresAtMs(data.expiresAt);
-		const remainingUses = parseWalletSessionMintRemainingUses(data.remainingUses);
-		const runtimePolicyScope = normalizeThresholdRuntimePolicyScope(data.runtimePolicyScope);
-		if (!expiresAtMs || !remainingUses || !runtimePolicyScope) return {
-			ok: false,
-			code: "invalid_response",
-			message: "Wallet Session mint returned invalid lifecycle or policy data"
-		};
-		const base = {
-			ok: true,
-			thresholdSessionId: thresholdSessionId.value,
-			walletSessionId: walletSessionId.value,
-			authorizationId: authorizationId.value,
-			quotaId: quotaId.value,
-			expiresAtMs,
-			remainingUses,
-			runtimePolicyScope
-		};
-		if (data.sessionKind === "issued_exact_wallet_session") {
-			let operationCredential;
-			try {
-				operationCredential = parseWalletSessionOperationCredentialV1(data.operationCredential);
-			} catch (error) {
-				return {
-					ok: false,
-					code: "invalid_response",
-					message: errorMessage(error) || "Wallet Session mint returned an invalid operation credential"
-				};
-			}
-			if (operationCredential.walletSessionId !== walletSessionId.value) return {
-				ok: false,
-				code: "invalid_response",
-				message: "Wallet Session mint credential does not identify its session"
-			};
-			return {
-				...base,
-				sessionKind: data.sessionKind,
-				operationCredential
-			};
-		}
-		if (data.sessionKind !== "already_committed_exact_wallet_session" || data.operationCredential !== void 0) return {
-			ok: false,
-			code: "invalid_response",
-			message: "Wallet Session mint returned an invalid session branch"
-		};
-		if (!existingOperationCredential) return {
-			ok: false,
-			code: "invalid_response",
-			message: "Reused Wallet Session mint requires the credential the caller already holds"
-		};
-		if (existingOperationCredential.walletSessionId !== walletSessionId.value) return {
-			ok: false,
-			code: "invalid_response",
-			message: "Reused Wallet Session mint returned another lifecycle identity"
-		};
-		return {
-			...base,
-			sessionKind: data.sessionKind
-		};
-	} catch (e) {
-		const msg = errorMessage(e) || "Failed to mint threshold session";
-		const timedOut = controller.signal.aborted;
-		return {
-			ok: false,
-			code: timedOut ? "timeout" : "network_error",
-			message: timedOut ? `Wallet Session mint timed out after ${ED25519_WALLET_SESSION_MINT_TIMEOUT_MS}ms` : msg
-		};
-	} finally {
-		if (timeoutId !== null) clearTimeout(timeoutId);
-	}
-}
 function serializeEd25519OperationStepUpProof(proof) {
 	switch (proof.kind) {
 		case "passkey": return {
@@ -331,10 +129,10 @@ async function issueEd25519OperationStepUpAuthorization(args) {
 	const materialRecovery = buildEd25519OperationStepUpMaterialRecoveryRequest(args);
 	const bearer = args.credential.kind === "wallet_session_opaque" ? {
 		token: args.credential.walletSessionToken,
-		missingMessage: "walletSessionToken is required"
+		home: args.credential.home
 	} : null;
 	const requestInit = buildRelayerJsonPostRequestInit({
-		...bearer ? { headers: buildBearerAuthorizationHeader(bearer) } : {},
+		...bearer ? { headers: buildWalletSessionAuthorizationHeaders(bearer) } : {},
 		body: {
 			kind: "router_ab_ed25519_yao_operation_step_up_grant_v1",
 			normalSigningRequest: args.normalSigningRequest,
@@ -358,6 +156,6 @@ async function issueEd25519OperationStepUpAuthorization(args) {
 	});
 }
 //#endregion
-export { buildThresholdEd25519WebAuthnPrfSecretSource, issueEd25519OperationStepUpAuthorization, localPrfFirstForEd25519WalletSessionMintAuthorization, mintEd25519WalletSession };
+export { issueEd25519OperationStepUpAuthorization };
 
 //# sourceMappingURL=walletSession.js.map

package/dist/esm/core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.js

@@ -1,71 +1,18 @@
-import { parseMpcMaterialActivationRef, parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
-import { toAccountId } from "../../../types/accountIds.js";
-import { nearEd25519SigningKeyIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { toRpId } from "../../session/identity/evmFamilyEcdsaIdentity.js";
+import { parseMpcMaterialActivationRef, parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { normalizeThresholdRuntimePolicyScope } from "../sessionPolicy.js";
-import { parseSignerSlot } from "../../../../shared-ts/src/utils/signerSlot.js";
+import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
+import { toAccountId } from "../../../types/accountIds.js";
+import "../../../../shared-ts/src/utils/registrationIds.js";
 //#region src/core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.ts
 const ED25519_YAO_PUBLIC_CAPABILITY_REFERENCES_KIND_V1 = "ed25519_yao_public_capability_references_v1";
-const ED25519_YAO_PUBLIC_CAPABILITY_LANES_KIND_V1 = "ed25519_yao_public_capability_lanes_v1";
 const ED25519_YAO_PUBLIC_CAPABILITY_REFERENCES_APP_STATE_KEY = "ed25519YaoPublicCapabilityReferencesV1";
-const ED25519_YAO_PUBLIC_CAPABILITY_LANES_APP_STATE_KEY = "ed25519YaoPublicCapabilityLanesV1";
 const MAX_PUBLIC_CAPABILITY_REFERENCES = 64;
-const MAX_PUBLIC_CAPABILITY_LANES = 64;
-/**
-* Publish the durable identity and its auth lane from one canonical material
-* reference. Cold recovery reads the identity projection, while warm signing
-* reads the lane projection; both must describe the same activation.
-*/
-async function publishEd25519YaoPublicCapabilityReferenceAndLane(store, reference) {
-	const identity = {
-		walletId: reference.walletId,
-		nearAccountId: reference.nearAccountId,
-		thresholdSessionId: reference.thresholdSessionId,
-		runtimePolicyScope: reference.runtimePolicyScope,
-		materialActivation: reference.materialActivation
-	};
-	await store.upsert(identity);
-	await store.upsertLane(reference);
-}
 function requireExactKeys(record, expectedKeys, label) {
 	const actual = Object.keys(record).sort();
 	const expected = [...expectedKeys].sort();
 	if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) throw new Error(`${label} contains unexpected fields`);
 }
-function requireNonNegativeInteger(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative integer`);
-	return value;
-}
-function requirePositiveInteger(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
-	return value;
-}
-function parseSigningLaneAuth(value, label) {
-	const record = requireRecord(value, label);
-	const kind = requireCanonicalString(record.kind, `${label}.kind`, "must be a non-empty normalized string");
-	switch (kind) {
-		case "passkey":
-			requireExactKeys(record, [
-				"kind",
-				"rpId",
-				"credentialIdB64u"
-			], label);
-			return {
-				kind,
-				rpId: toRpId(requireCanonicalString(record.rpId, `${label}.rpId`, "must be a non-empty normalized string")),
-				credentialIdB64u: requireCanonicalString(record.credentialIdB64u, `${label}.credentialIdB64u`, "must be a non-empty normalized string")
-			};
-		case "email_otp":
-			requireExactKeys(record, ["kind", "providerSubjectId"], label);
-			return {
-				kind,
-				providerSubjectId: requireCanonicalString(record.providerSubjectId, `${label}.providerSubjectId`, "must be a non-empty normalized string")
-			};
-		default: throw new Error(`${label}.kind is invalid`);
-	}
-}
 function parsePublicCapabilityIdentity(value, label) {
 	const record = requireRecord(value, label);
 	requireExactKeys(record, [
@@ -89,48 +36,6 @@ function parsePublicCapabilityIdentity(value, label) {
 		materialActivation: materialActivation.value
 	};
 }
-function parsePublicCapabilityLane(value, label) {
-	const record = requireRecord(value, label);
-	const auth = parseSigningLaneAuth(record.auth, `${label}.auth`);
-	requireExactKeys(record, [
-		"walletId",
-		"nearAccountId",
-		"thresholdSessionId",
-		"runtimePolicyScope",
-		"materialActivation",
-		"auth",
-		"nearEd25519SigningKeyId",
-		"signerSlot",
-		...auth.kind === "email_otp" ? ["remainingUses", "expiresAtMs"] : []
-	], label);
-	const base = parsePublicCapabilityIdentity({
-		walletId: record.walletId,
-		nearAccountId: record.nearAccountId,
-		thresholdSessionId: record.thresholdSessionId,
-		runtimePolicyScope: record.runtimePolicyScope,
-		materialActivation: record.materialActivation
-	}, label);
-	const signerSlot = parseSignerSlot(record.signerSlot);
-	if (signerSlot === null) throw new Error(`${label}.signerSlot is invalid`);
-	const common = {
-		...base,
-		nearEd25519SigningKeyId: nearEd25519SigningKeyIdFromString(requireCanonicalString(record.nearEd25519SigningKeyId, `${label}.nearEd25519SigningKeyId`, "must be a non-empty normalized string")),
-		signerSlot
-	};
-	switch (auth.kind) {
-		case "email_otp": return {
-			...common,
-			auth,
-			remainingUses: requireNonNegativeInteger(record.remainingUses, `${label}.remainingUses`),
-			expiresAtMs: requirePositiveInteger(record.expiresAtMs, `${label}.expiresAtMs`)
-		};
-		case "passkey": return {
-			...common,
-			auth
-		};
-		default: throw new Error(`${label}.auth is invalid`);
-	}
-}
 function parseEd25519YaoPublicCapabilityReferencesV1(value) {
 	const record = requireRecord(value, "Ed25519 Yao public capability references");
 	requireExactKeys(record, ["kind", "identities"], "Ed25519 Yao public capability references");
@@ -144,31 +49,12 @@ function parseEd25519YaoPublicCapabilityReferencesV1(value) {
 		identities
 	};
 }
-function parseEd25519YaoPublicCapabilityLanesV1(value) {
-	const record = requireRecord(value, "Ed25519 Yao public capability lanes");
-	requireExactKeys(record, ["kind", "lanes"], "Ed25519 Yao public capability lanes");
-	if (record.kind !== ED25519_YAO_PUBLIC_CAPABILITY_LANES_KIND_V1) throw new Error("Ed25519 Yao public capability lanes kind is invalid");
-	if (!Array.isArray(record.lanes)) throw new Error("Ed25519 Yao public capability lanes must be an array");
-	if (record.lanes.length > MAX_PUBLIC_CAPABILITY_LANES) throw new Error("Ed25519 Yao public capability lane capacity is exceeded");
-	const lanes = record.lanes.map((lane, index) => parsePublicCapabilityLane(lane, `Ed25519 Yao public capability lane ${index}`));
-	if (new Set(lanes.map(publicCapabilityIdentityKey)).size !== lanes.length) throw new Error("Ed25519 Yao public capability lanes contain duplicate identities");
-	return {
-		kind: ED25519_YAO_PUBLIC_CAPABILITY_LANES_KIND_V1,
-		lanes
-	};
-}
 function emptyPublicCapabilityReferences() {
 	return {
 		kind: ED25519_YAO_PUBLIC_CAPABILITY_REFERENCES_KIND_V1,
 		identities: []
 	};
 }
-function emptyPublicCapabilityLanes() {
-	return {
-		kind: ED25519_YAO_PUBLIC_CAPABILITY_LANES_KIND_V1,
-		lanes: []
-	};
-}
 function publicCapabilityIdentityKey(identity) {
 	const activation = identity.materialActivation;
 	return JSON.stringify([
@@ -185,9 +71,6 @@ function publicCapabilityIdentityKey(identity) {
 function clonePublicCapabilityIdentity(identity) {
 	return parsePublicCapabilityIdentity(identity, "Ed25519 Yao public capability identity");
 }
-function clonePublicCapabilityLane(lane) {
-	return parsePublicCapabilityLane(lane, "Ed25519 Yao public capability lane");
-}
 async function upsertEd25519YaoPublicCapabilityReferenceInTransaction(store, identity) {
 	const currentRow = await store.get(ED25519_YAO_PUBLIC_CAPABILITY_REFERENCES_APP_STATE_KEY);
 	if (currentRow !== void 0 && currentRow.key !== ED25519_YAO_PUBLIC_CAPABILITY_REFERENCES_APP_STATE_KEY) throw new Error("Ed25519 Yao public capability reference app-state key is inconsistent");
@@ -203,93 +86,7 @@ async function upsertEd25519YaoPublicCapabilityReferenceInTransaction(store, ide
 		})
 	});
 }
-var IndexedDbEd25519YaoPublicCapabilityReferenceStore = class {
-	constructor(appState) {
-		this.appState = appState;
-	}
-	async readProjection() {
-		if (this.appState.isDisabled()) return emptyPublicCapabilityReferences();
-		const raw = await this.appState.getAppState(ED25519_YAO_PUBLIC_CAPABILITY_REFERENCES_APP_STATE_KEY);
-		if (raw === void 0 || raw === null) return emptyPublicCapabilityReferences();
-		return parseEd25519YaoPublicCapabilityReferencesV1(raw);
-	}
-	async writeProjection(projection) {
-		if (this.appState.isDisabled()) return;
-		await this.appState.setAppState(ED25519_YAO_PUBLIC_CAPABILITY_REFERENCES_APP_STATE_KEY, parseEd25519YaoPublicCapabilityReferencesV1(projection));
-	}
-	async readLaneProjection() {
-		if (this.appState.isDisabled()) return emptyPublicCapabilityLanes();
-		const raw = await this.appState.getAppState(ED25519_YAO_PUBLIC_CAPABILITY_LANES_APP_STATE_KEY);
-		if (raw === void 0 || raw === null) return emptyPublicCapabilityLanes();
-		return parseEd25519YaoPublicCapabilityLanesV1(raw);
-	}
-	async writeLaneProjection(projection) {
-		if (this.appState.isDisabled()) return;
-		await this.appState.setAppState(ED25519_YAO_PUBLIC_CAPABILITY_LANES_APP_STATE_KEY, parseEd25519YaoPublicCapabilityLanesV1(projection));
-	}
-	async upsert(identity) {
-		const normalized = clonePublicCapabilityIdentity(identity);
-		const identities = (await this.readProjection()).identities.filter((candidate) => String(candidate.walletId) !== String(normalized.walletId) || String(candidate.nearAccountId) !== String(normalized.nearAccountId));
-		if (identities.length >= MAX_PUBLIC_CAPABILITY_REFERENCES) throw new Error("Ed25519 Yao public capability reference capacity is exhausted");
-		await this.writeProjection({
-			kind: ED25519_YAO_PUBLIC_CAPABILITY_REFERENCES_KIND_V1,
-			identities: [...identities, normalized]
-		});
-	}
-	async remove(identity) {
-		const key = publicCapabilityIdentityKey(identity);
-		const current = await this.readProjection();
-		await this.writeProjection({
-			kind: ED25519_YAO_PUBLIC_CAPABILITY_REFERENCES_KIND_V1,
-			identities: current.identities.filter((candidate) => publicCapabilityIdentityKey(candidate) !== key)
-		});
-	}
-	async list() {
-		return (await this.readProjection()).identities.map(clonePublicCapabilityIdentity);
-	}
-	async upsertLane(reference) {
-		const normalized = clonePublicCapabilityLane(reference);
-		const lanes = (await this.readLaneProjection()).lanes.filter((candidate) => String(candidate.walletId) !== String(normalized.walletId) || String(candidate.nearAccountId) !== String(normalized.nearAccountId));
-		if (lanes.length >= MAX_PUBLIC_CAPABILITY_LANES) throw new Error("Ed25519 Yao public capability lane capacity is exhausted");
-		await this.writeLaneProjection({
-			kind: ED25519_YAO_PUBLIC_CAPABILITY_LANES_KIND_V1,
-			lanes: [...lanes, normalized]
-		});
-	}
-	async removeLane(identity) {
-		const key = publicCapabilityIdentityKey(identity);
-		const current = await this.readLaneProjection();
-		await this.writeLaneProjection({
-			kind: ED25519_YAO_PUBLIC_CAPABILITY_LANES_KIND_V1,
-			lanes: current.lanes.filter((candidate) => publicCapabilityIdentityKey(candidate) !== key)
-		});
-	}
-	async listLanes() {
-		return (await this.readLaneProjection()).lanes.map(clonePublicCapabilityLane);
-	}
-};
-/**
-* The verified Email OTP provider subject this installation persisted on its
-* own Ed25519 lanes. A linked installation holds no local factor record to
-* carry that subject — the record belongs to registration — so the owner lane
-* scope reads it here. Exactly one subject may answer for a wallet: two would
-* mean two provider identities on one installation, which is an integrity
-* failure rather than a value to choose between.
-*/
-async function readEmailOtpProviderSubjectForWalletV1(appState, walletIdInput) {
-	const walletId = String(walletIdInput || "").trim();
-	if (!walletId) return null;
-	const subjects = /* @__PURE__ */ new Set();
-	for (const lane of await new IndexedDbEd25519YaoPublicCapabilityReferenceStore(appState).listLanes()) {
-		if (lane.auth.kind !== "email_otp") continue;
-		if (String(lane.walletId) !== walletId) continue;
-		const providerSubjectId = String(lane.auth.providerSubjectId || "").trim();
-		if (providerSubjectId) subjects.add(providerSubjectId);
-	}
-	if (subjects.size !== 1) return null;
-	return [...subjects][0] ?? null;
-}
 //#endregion
-export { IndexedDbEd25519YaoPublicCapabilityReferenceStore, publishEd25519YaoPublicCapabilityReferenceAndLane, readEmailOtpProviderSubjectForWalletV1, upsertEd25519YaoPublicCapabilityReferenceInTransaction };
+export { upsertEd25519YaoPublicCapabilityReferenceInTransaction };
 
 //# sourceMappingURL=yaoPublicCapabilityReferences.js.map

package/dist/esm/core/signingEngine/threshold/sessionPolicy.js

@@ -1,9 +1,9 @@
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import { normalizeThresholdEd25519ParticipantIds } from "../../../shared-ts/src/threshold/participants.js";
-import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../../../shared-ts/src/threshold/participants.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS, MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS } from "../../../shared-ts/src/threshold/sessionPolicy.js";
+import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 //#region src/core/signingEngine/threshold/sessionPolicy.ts
 const THRESHOLD_SESSION_POLICY_VERSION = "threshold_session_v1";
 function normalizeThresholdRuntimePolicyScope(value) {
@@ -20,17 +20,11 @@ const DEFAULT_THRESHOLD_SESSION_POLICY = {
 	ttlMs: DEFAULT_THRESHOLD_SESSION_TTL_MS,
 	remainingUses: 3
 };
-const DEFAULT_UNLOCK_REMAINING_USES = 3;
 function parsePositiveSessionUses(value, fieldName) {
 	const remainingUses = Math.floor(Number(value) || 0);
 	if (!Number.isFinite(remainingUses) || remainingUses <= 0) throw new Error(`[ThresholdSessionPolicy] ${fieldName} must be a positive integer`);
 	return remainingUses;
 }
-function resolveWalletUnlockSessionUsesFromRequestedUses(args) {
-	const normalized = Math.floor(Number(args.requestedRemainingUses) || 0);
-	if (!Number.isFinite(normalized) || normalized <= 0) return null;
-	return Math.min(normalized, DEFAULT_UNLOCK_REMAINING_USES);
-}
 function clampThresholdSessionPolicy(input) {
 	const ttlMs = Math.max(0, Math.floor(Number(input.ttlMs) || 0));
 	const remainingUses = Math.max(0, Math.floor(Number(input.remainingUses) || 0));
@@ -88,6 +82,6 @@ async function buildExactEd25519SessionPolicy(params) {
 	};
 }
 //#endregion
-export { DEFAULT_THRESHOLD_SESSION_POLICY, DEFAULT_THRESHOLD_SESSION_TTL_MS, DEFAULT_UNLOCK_REMAINING_USES, THRESHOLD_SESSION_POLICY_VERSION, buildEd25519SessionPolicy, clampThresholdSessionPolicy, computeEd25519SessionPolicyDigest32, normalizeThresholdRuntimePolicyScope, parsePositiveSessionUses, resolveWalletUnlockSessionUsesFromRequestedUses };
+export { DEFAULT_THRESHOLD_SESSION_TTL_MS, THRESHOLD_SESSION_POLICY_VERSION, buildEd25519SessionPolicy, computeEd25519SessionPolicyDigest32, normalizeThresholdRuntimePolicyScope, parsePositiveSessionUses };
 
 //# sourceMappingURL=sessionPolicy.js.map

package/dist/esm/core/signingEngine/uiConfirm/nearFundingNotice.js

@@ -6,11 +6,6 @@ function shortenNearAccountForFundingNotice(accountId) {
 	if (value.length <= 8) return value;
 	return `${value.slice(0, 4)}...${value.slice(-4)}`;
 }
-function formatNearAccountFundingNotice(nearAccountId) {
-	const accountId = String(nearAccountId || "").trim();
-	if (!accountId) return "NEAR account needs funding before signing.";
-	return `NEAR account ${accountId} needs funding before signing.`;
-}
 function parseNearAccountFundingNotice(body) {
 	const value = String(body || "").trim();
 	const match = NEAR_ACCOUNT_FUNDING_NOTICE_PATTERN.exec(value);
@@ -25,17 +20,6 @@ function parseNearAccountFundingNotice(body) {
 function isNearTransactionSubmittingNotice(body) {
 	return String(body || "").trim() === NEAR_TRANSACTION_SUBMITTING_NOTICE;
 }
-/**
-* Shown while an unfunded implicit account is being funded, which happens after
-* the user confirms and before the step-up prompt. Funding is a real NEAR
-* transaction, so this is the one step in the confirmation that can take
-* seconds — without it the prompt keeps saying the account "needs funding" next
-* to a bare spinner, and a legitimate wait reads as a hang.
-*/
-function formatNearAccountFundingProgressNotice(nearAccountId) {
-	const accountId = shortenNearAccountForFundingNotice(nearAccountId);
-	return accountId ? `Funding NEAR account ${accountId}...` : "Funding NEAR account...";
-}
 function isNearAccountFundingProgressNotice(body) {
 	const value = String(body || "").trim();
 	return value.startsWith("Funding NEAR account") && value.endsWith("...");
@@ -45,6 +29,6 @@ function isNearSigningProgressNotice(body) {
 	return isNearTransactionSubmittingNotice(body) || isNearAccountFundingProgressNotice(body);
 }
 //#endregion
-export { formatNearAccountFundingNotice, formatNearAccountFundingProgressNotice, isNearSigningProgressNotice, parseNearAccountFundingNotice };
+export { isNearSigningProgressNotice, parseNearAccountFundingNotice };
 
 //# sourceMappingURL=nearFundingNotice.js.map