@vaultkeepr/smart-account 0.1.2 → 0.2.0

package/dist/index.js

@@ -20,12 +20,15 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  CID_REGISTRY_ABI: () => CID_REGISTRY_ABI,
+  KEYED_MIGRATION_ENABLED: () => KEYED_MIGRATION_ENABLED,
+  PASSAGE_ENABLED: () => PASSAGE_ENABLED,
+  canWritePointer: () => canWritePointer,
   clearIdentity: () => clearIdentity,
   clearSmartAccountCache: () => clearSmartAccountCache,
   computeSmartAccountAddress: () => computeSmartAccountAddress,
+  createPassageIO: () => createPassageIO,
   createVaultSmartAccount: () => createVaultSmartAccount,
-  flushCidOnChainSync: () => flushCidOnChainSync,
+  deriveIdentity: () => deriveIdentity,
   formatSecretKeyForDisplay: () => formatSecretKeyForDisplay,
   generateSecretKey: () => generateSecretKey,
   getCachedSmartAccountAddress: () => getCachedSmartAccountAddress,
@@ -35,24 +38,24 @@ __export(index_exports, {
   getIdentityOwner: () => getIdentityOwner,
   getIdentitySmartAccount: () => getIdentitySmartAccount,
   getIdentitySnapshot: () => getIdentitySnapshot,
-  getOnChainSyncStatus: () => getOnChainSyncStatus,
   getOwnerFromPassword: () => getOwnerFromPassword,
   getPimlicoApiKey: () => getPimlicoApiKey,
   getTargetChain: () => getTargetChain,
+  identityState: () => identityState,
   initIdentityFromPassword: () => initIdentityFromPassword,
   initIdentityFromSigner: () => initIdentityFromSigner,
-  isCidRegistryConfigured: () => isCidRegistryConfigured,
   isIdentityConnected: () => isIdentityConnected,
   isSmartAccountConfigured: () => isSmartAccountConfigured,
   isValidSecretKey: () => isValidSecretKey,
+  migrateKeyedPointer: () => migrateKeyedPointer,
   parseSecretKeyInput: () => parseSecretKeyInput,
-  publishCidOnChain: () => publishCidOnChain,
-  readCidOnChain: () => readCidOnChain,
-  resetOnChainSync: () => resetOnChainSync,
-  scheduleCidOnChainSync: () => scheduleCidOnChainSync,
+  readPassageState: () => readPassageState,
+  runPassage: () => runPassage,
+  runPassageWith: () => runPassageWith,
   signMessageWithIdentity: () => signMessageWithIdentity,
   subscribeIdentity: () => subscribeIdentity,
-  useIdentity: () => useIdentity
+  useIdentity: () => useIdentity,
+  verifyAAAuth: () => verifyAAAuth
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -214,248 +217,95 @@ function clearSmartAccountCache() {
   _cachedKey = null;
 }
 
-// src/owner.ts
-var import_core = require("@vaultkeepr/core");
-async function getOwnerFromPassword(password, secretKey) {
-  return (0, import_core.getHiddenWalletFromPassword)(password, secretKey);
-}
-
-// src/cidRegistry.ts
+// src/deriveIdentity.ts
 var import_viem2 = require("viem");
-var import_logger2 = require("@vaultkeepr/logger");
-var CID_REGISTRY_ABI = [
-  {
-    name: "setCid",
-    type: "function",
-    stateMutability: "nonpayable",
-    inputs: [{ name: "cid", type: "string" }],
-    outputs: []
-  },
-  {
-    name: "deleteCid",
-    type: "function",
-    stateMutability: "nonpayable",
-    inputs: [],
-    outputs: []
-  },
-  {
-    name: "getCid",
-    type: "function",
-    stateMutability: "view",
-    inputs: [{ name: "account", type: "address" }],
-    outputs: [{ name: "", type: "string" }]
-  },
-  {
-    name: "hasCid",
-    type: "function",
-    stateMutability: "view",
-    inputs: [{ name: "account", type: "address" }],
-    outputs: [{ name: "", type: "bool" }]
-  },
-  {
-    name: "getUpdatedAt",
-    type: "function",
-    stateMutability: "view",
-    inputs: [{ name: "account", type: "address" }],
-    outputs: [{ name: "", type: "uint256" }]
-  },
-  {
-    name: "nextAllowedUpdate",
-    type: "function",
-    stateMutability: "view",
-    inputs: [{ name: "account", type: "address" }],
-    outputs: [{ name: "", type: "uint256" }]
-  },
-  {
-    name: "cooldownSeconds",
-    type: "function",
-    stateMutability: "view",
-    inputs: [],
-    outputs: [{ name: "", type: "uint256" }]
-  }
-];
-function getCidRegistryAddress() {
-  let addr = "";
-  try {
-    addr = process.env.CID_REGISTRY_ADDRESS || "";
-  } catch {
-  }
-  if (addr) return addr;
-  try {
-    addr = process.env.NEXT_PUBLIC_CID_REGISTRY_ADDRESS || "";
-  } catch {
-  }
-  if (addr) return addr;
-  try {
-    addr = process.env.EXPO_PUBLIC_CID_REGISTRY_ADDRESS || "";
-  } catch {
-  }
-  if (addr) return addr;
-  return "0x0000000000000000000000000000000000000000";
+async function deriveIdentity(ownerAccount, mode) {
+  const aaAddress = await computeSmartAccountAddress(ownerAccount);
+  return {
+    ownerAddress: ownerAccount.address,
+    aaAddress,
+    mode
+  };
 }
-function isCidRegistryConfigured() {
-  return getCidRegistryAddress() !== "0x0000000000000000000000000000000000000000" && isSmartAccountConfigured();
+var MAX_SKEW_MS = 5 * 6e4;
+var UNSIGNABLE_OWNER = "verifyAAAuth: owner stub cannot sign";
+function addressOnlyAccount(address) {
+  return {
+    address,
+    type: "local",
+    publicKey: "0x",
+    source: "custom",
+    signMessage: async () => {
+      throw new Error(UNSIGNABLE_OWNER);
+    },
+    signTypedData: async () => {
+      throw new Error(UNSIGNABLE_OWNER);
+    },
+    signTransaction: async () => {
+      throw new Error(UNSIGNABLE_OWNER);
+    }
+  };
 }
-async function publishCidOnChain(smartAccount, cid) {
-  if (!isCidRegistryConfigured()) {
-    import_logger2.logger.warn(
-      "[CidRegistry] Non configur\xE9, skip on-chain publish"
-    );
-    return null;
-  }
+async function verifyAAAuth(params) {
+  const rejected = {
+    ok: false,
+    ownerAddress: import_viem2.zeroAddress,
+    aaAddress: import_viem2.zeroAddress
+  };
   try {
-    const calldata = (0, import_viem2.encodeFunctionData)({
-      abi: CID_REGISTRY_ABI,
-      functionName: "setCid",
-      args: [cid]
-    });
-    const userOpHash = await smartAccount.client.sendUserOperation({
-      calls: [
-        {
-          to: getCidRegistryAddress(),
-          data: calldata,
-          value: BigInt(0)
-        }
-      ]
-    });
-    import_logger2.logger.debug(
-      `[CidRegistry] UserOp soumise: ${userOpHash}`
-    );
-    const receipt = await smartAccount.client.waitForUserOperationReceipt({
-      hash: userOpHash
-    });
-    import_logger2.logger.debug(
-      `[CidRegistry] CID publi\xE9 on-chain \u2014 tx: ${receipt.receipt.transactionHash} | CID: ${cid.slice(0, 20)}...`
+    if (!Number.isFinite(params.timestamp) || Math.abs(Date.now() - params.timestamp) > MAX_SKEW_MS) {
+      return rejected;
+    }
+    const signature = params.signature;
+    let ownerAddress;
+    if (params.claimedOwner) {
+      ownerAddress = (0, import_viem2.getAddress)(params.claimedOwner);
+      const publicClient = (0, import_viem2.createPublicClient)({
+        chain: TARGET_CHAIN,
+        transport: (0, import_viem2.http)()
+      });
+      const valid = await publicClient.verifyMessage({
+        address: ownerAddress,
+        message: params.message,
+        signature
+      });
+      if (!valid) {
+        return {
+          ok: false,
+          ownerAddress,
+          aaAddress: params.claimedAA ? (0, import_viem2.getAddress)(params.claimedAA) : import_viem2.zeroAddress
+        };
+      }
+    } else {
+      ownerAddress = await (0, import_viem2.recoverMessageAddress)({
+        message: params.message,
+        signature
+      });
+    }
+    const claimedAA = params.claimedAA ? (0, import_viem2.getAddress)(params.claimedAA) : null;
+    const aaAddress = await computeSmartAccountAddress(
+      addressOnlyAccount(ownerAddress)
     );
-    return receipt.receipt.transactionHash;
-  } catch (error) {
-    import_logger2.logger.error("[CidRegistry] Erreur:", error instanceof Error ? error.message : error);
-    return null;
-  }
-}
-async function readCidOnChain(smartAccountAddress) {
-  if (!isCidRegistryConfigured()) return null;
-  try {
-    const publicClient = (0, import_viem2.createPublicClient)({
-      chain: TARGET_CHAIN,
-      transport: (0, import_viem2.http)()
-    });
-    const cid = await publicClient.readContract({
-      address: getCidRegistryAddress(),
-      abi: CID_REGISTRY_ABI,
-      functionName: "getCid",
-      args: [smartAccountAddress]
-    });
-    return cid && cid.length > 0 ? cid : null;
-  } catch (error) {
-    import_logger2.logger.error("[CidRegistry] Erreur lecture:", error instanceof Error ? error.message : error);
-    return null;
+    if (claimedAA && !(0, import_viem2.isAddressEqual)(claimedAA, aaAddress)) {
+      return { ok: false, ownerAddress, aaAddress };
+    }
+    return { ok: true, ownerAddress, aaAddress };
+  } catch {
+    return rejected;
   }
 }
 
-// src/onChainSync.ts
-var import_logger3 = require("@vaultkeepr/logger");
-var DEFAULT_DEBOUNCE_MS = 5 * 60 * 1e3;
-var _pendingCid = null;
-var _pendingSmartAccount = null;
-var _debounceTimer = null;
-var _lastPublishedCid = null;
-var _lastPublishTime = 0;
-var _isPublishing = false;
-function scheduleCidOnChainSync(smartAccount, cid, debounceMs = DEFAULT_DEBOUNCE_MS) {
-  if (!isCidRegistryConfigured()) return;
-  if (cid === _lastPublishedCid) {
-    import_logger3.logger.debug("[OnChainSync] CID identique, skip");
-    return;
-  }
-  const sa = smartAccount ?? _pendingSmartAccount;
-  if (!sa) {
-    import_logger3.logger.warn("[OnChainSync] Pas de Smart Account disponible, skip");
-    return;
-  }
-  _pendingCid = cid;
-  _pendingSmartAccount = sa;
-  if (_debounceTimer) {
-    clearTimeout(_debounceTimer);
-  }
-  _debounceTimer = setTimeout(() => {
-    _executeSync();
-  }, debounceMs);
-  import_logger3.logger.debug(
-    `[OnChainSync] CID planifi\xE9 dans ${(debounceMs / 1e3).toFixed(0)}s : ${cid.slice(0, 20)}...`
-  );
-}
-async function flushCidOnChainSync() {
-  import_logger3.logger.debug(
-    "[OnChainSync] flush demand\xE9 \u2014 pending:",
-    _pendingCid?.slice(0, 20),
-    "SA:",
-    !!_pendingSmartAccount
-  );
-  if (!_pendingCid || !_pendingSmartAccount) {
-    import_logger3.logger.debug("[OnChainSync] Rien \xE0 flush");
-    return true;
-  }
-  if (_debounceTimer) {
-    clearTimeout(_debounceTimer);
-    _debounceTimer = null;
-  }
-  import_logger3.logger.debug("[OnChainSync] Flush imm\xE9diat...");
-  return _executeSync();
-}
-function getOnChainSyncStatus() {
-  return {
-    hasPending: _pendingCid !== null && _pendingCid !== _lastPublishedCid,
-    pendingCid: _pendingCid,
-    lastPublishedCid: _lastPublishedCid,
-    lastPublishTime: _lastPublishTime,
-    isPublishing: _isPublishing
-  };
-}
-function resetOnChainSync() {
-  if (_debounceTimer) {
-    clearTimeout(_debounceTimer);
-    _debounceTimer = null;
-  }
-  _pendingCid = null;
-  _pendingSmartAccount = null;
-  _lastPublishedCid = null;
-  _lastPublishTime = 0;
-  _isPublishing = false;
-}
-async function _executeSync() {
-  if (!_pendingCid || !_pendingSmartAccount || _isPublishing) return false;
-  if (_pendingCid === _lastPublishedCid) {
-    _pendingCid = null;
-    return true;
-  }
-  _isPublishing = true;
-  const cid = _pendingCid;
-  const sa = _pendingSmartAccount;
-  try {
-    import_logger3.logger.debug(`[OnChainSync] Publication on-chain: ${cid.slice(0, 20)}...`);
-    const txHash = await publishCidOnChain(sa, cid);
-    if (txHash) {
-      _lastPublishedCid = cid;
-      _lastPublishTime = Date.now();
-      _pendingCid = null;
-      import_logger3.logger.debug(
-        `[OnChainSync] \u2705 CID publi\xE9 on-chain : ${cid.slice(0, 20)}...`
-      );
-      return true;
-    }
-    import_logger3.logger.warn("[OnChainSync] Publication \xE9chou\xE9e (null txHash)");
-    return false;
-  } catch (error) {
-    import_logger3.logger.error("[OnChainSync] Erreur publication:", error instanceof Error ? error.message : error);
-    return false;
-  } finally {
-    _isPublishing = false;
+// src/owner.ts
+var import_core = require("@vaultkeepr/core");
+async function getOwnerFromPassword(password, secretKey) {
+  if (secretKey) {
+    return (0, import_core.getHiddenWalletFromSecretKey)(secretKey);
   }
+  return (0, import_core.getHiddenWalletFromPassword)(password);
 }
 
 // src/identity.ts
-var import_logger4 = require("@vaultkeepr/logger");
+var import_logger2 = require("@vaultkeepr/logger");
 var _state = {
   owner: null,
   smartAccount: null,
@@ -481,7 +331,15 @@ async function initIdentityFromPassword(password, secretKey) {
         mode: "password"
       });
     } catch (e) {
-      import_logger4.logger.warn("[Identity] SA init failed (non-blocking):", e.message);
+      import_logger2.logger.warn("[Identity] SA init failed (non-blocking):", e.message);
+    }
+  }
+  let aaAddress = sa?.address ?? null;
+  if (!aaAddress && isSmartAccountConfigured()) {
+    try {
+      aaAddress = await computeSmartAccountAddress(owner);
+    } catch (e) {
+      import_logger2.logger.warn("[Identity] AA derivation failed (non-blocking):", e.message);
     }
   }
   _state = {
@@ -491,12 +349,13 @@ async function initIdentityFromPassword(password, secretKey) {
     initialized: true
   };
   _notify();
-  import_logger4.logger.debug(
-    `[Identity] Connect\xE9 (password) \u2014 adresse: ${(0, import_logger4.redactAddress)(owner.address)}` + (sa ? ` | SA: ${(0, import_logger4.redactAddress)(sa.address)}` : "") + (secretKey ? ` | SK: \u2713` : " | no secretKey")
+  import_logger2.logger.debug(
+    `[Identity] Connect\xE9 (password) \u2014 adresse: ${(0, import_logger2.redactAddress)(owner.address)}` + (sa ? ` | SA: ${(0, import_logger2.redactAddress)(sa.address)}` : "") + (secretKey ? ` | SK: \u2713` : " | no secretKey")
   );
   return {
     address: owner.address,
-    smartAccountAddress: sa?.address ?? null
+    smartAccountAddress: sa?.address ?? null,
+    aaAddress
   };
 }
 async function initIdentityFromSigner(signer, mode = "passkey") {
@@ -505,7 +364,15 @@ async function initIdentityFromSigner(signer, mode = "passkey") {
     try {
       sa = await createVaultSmartAccount({ ownerAccount: signer, mode });
     } catch (e) {
-      import_logger4.logger.warn("[Identity] SA init failed (non-blocking):", e.message);
+      import_logger2.logger.warn("[Identity] SA init failed (non-blocking):", e.message);
+    }
+  }
+  let aaAddress = sa?.address ?? null;
+  if (!aaAddress && isSmartAccountConfigured()) {
+    try {
+      aaAddress = await computeSmartAccountAddress(signer);
+    } catch (e) {
+      import_logger2.logger.warn("[Identity] AA derivation failed (non-blocking):", e.message);
     }
   }
   _state = {
@@ -515,12 +382,13 @@ async function initIdentityFromSigner(signer, mode = "passkey") {
     initialized: true
   };
   _notify();
-  import_logger4.logger.info(
+  import_logger2.logger.info(
     `[Identity] Connected (${mode}) \u2014 address: ${signer.address}` + (sa ? ` | SA: ${sa.address}` : "")
   );
   return {
     address: signer.address,
-    smartAccountAddress: sa?.address ?? null
+    smartAccountAddress: sa?.address ?? null,
+    aaAddress
   };
 }
 function clearIdentity() {
@@ -532,7 +400,7 @@ function clearIdentity() {
   };
   clearSmartAccountCache();
   _notify();
-  import_logger4.logger.info("[Identity] Disconnected");
+  import_logger2.logger.info("[Identity] Disconnected");
 }
 function getIdentityAddress() {
   return _state.owner?.address ?? null;
@@ -591,24 +459,10 @@ function useIdentity() {
   const disconnect = (0, import_react.useCallback)(() => {
     clearIdentity();
   }, []);
-  const notifyOnChainSync = (0, import_react.useCallback)(
-    (cid) => {
-      const sa = getIdentitySmartAccount();
-      if (!sa) return;
-      scheduleCidOnChainSync(sa, cid);
-    },
-    []
-  );
-  const cleanupOnLock = (0, import_react.useCallback)(async () => {
-    await flushCidOnChainSync().catch(() => {
-    });
+  const cleanupOnLock = (0, import_react.useCallback)(() => {
     clearSmartAccountCache();
-    resetOnChainSync();
     clearIdentity();
-  }, []);
-  const flushOnChainSync = (0, import_react.useCallback)(async () => {
-    await flushCidOnChainSync().catch(() => {
-    });
+    return Promise.resolve();
   }, []);
   return {
     address: state.owner?.address ?? null,
@@ -617,9 +471,7 @@ function useIdentity() {
     smartAccountAddress: state.smartAccount?.address ?? null,
     signMessage,
     disconnect,
-    notifyOnChainSync,
-    cleanupOnLock,
-    flushOnChainSync
+    cleanupOnLock
   };
 }
 
@@ -627,13 +479,12 @@ function useIdentity() {
 var import_viem3 = require("viem");
 function generateSecretKey() {
   const bytes = new Uint8Array(32);
-  if (typeof globalThis.crypto?.getRandomValues === "function") {
-    globalThis.crypto.getRandomValues(bytes);
-  } else {
-    for (let i = 0; i < 32; i++) {
-      bytes[i] = Math.floor(Math.random() * 256);
-    }
+  if (typeof globalThis.crypto?.getRandomValues !== "function") {
+    throw new Error(
+      "[SmartAccount] CSPRNG indisponible: crypto.getRandomValues est requis pour generer une cle secrete. Un fallback Math.random produirait une cle devinable (CWE-338), refuse."
+    );
   }
+  globalThis.crypto.getRandomValues(bytes);
   return (0, import_viem3.bytesToHex)(bytes).slice(2);
 }
 function isValidSecretKey(key) {
@@ -646,14 +497,215 @@ function formatSecretKeyForDisplay(key) {
 function parseSecretKeyInput(input) {
   return input.replace(/[-\s]/g, "").toLowerCase();
 }
+
+// src/keyPassage.ts
+function identityState(input) {
+  if (input.hasSecretKey) return { kind: "ready" };
+  if (input.pointer === "moved") return { kind: "pair_required" };
+  if (input.pointer === "active") return { kind: "pass_to_key" };
+  return { kind: "join_or_create" };
+}
+function canWritePointer(state) {
+  return state.kind === "ready" || state.kind === "pass_to_key";
+}
+function sameAddress(a, b) {
+  return a.trim().toLowerCase() === b.trim().toLowerCase();
+}
+async function runPassage(io, opts) {
+  if (opts.hasSecretKey) return { status: "already_keyed" };
+  const legacy = await io.readLegacyPointer();
+  if (legacy.moved) {
+    const pending = await io.peekPendingKey();
+    if (pending && legacy.movedTo && sameAddress(await io.smartAccountOf(pending), legacy.movedTo)) {
+      await io.activatePendingKey();
+      return { status: "moved", smartAccount: legacy.movedTo };
+    }
+    if (pending) await io.discardPendingKey();
+    return { status: "already_moved" };
+  }
+  if (!legacy.cid) return { status: "nothing_to_pass" };
+  const secretKey = await io.getOrCreatePendingKey();
+  const smartAccount = await io.smartAccountOf(secretKey);
+  await io.writeSmartAccountPointer(smartAccount, legacy.cid);
+  await io.markLegacyMoved(smartAccount);
+  await io.activatePendingKey();
+  return { status: "moved", smartAccount };
+}
+
+// src/passageClient.ts
+var PASSAGE_ENABLED = false;
+var DELEGATION_TTL_SECONDS = 300;
+async function postJson(env, path, body) {
+  const res = await env.fetch(`${env.apiBase}${path}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`passage ${path} failed (${res.status})`);
+  return res.json();
+}
+function createPassageIO(env) {
+  const legacyAddress = env.legacyAddress.toLowerCase();
+  const delegation2 = async (sign) => {
+    const sessionId = env.newSessionId();
+    const expiryTimestamp = Math.floor(env.now() / 1e3) + DELEGATION_TTL_SECONDS;
+    const delegationSignature = await sign(env.formatDelegation(sessionId, expiryTimestamp));
+    return { sessionId, expiryTimestamp, delegationSignature };
+  };
+  return {
+    async readLegacyPointer() {
+      const d = await delegation2((m) => env.signLegacy(m));
+      const query = [
+        `wallet=${encodeURIComponent(legacyAddress)}`,
+        `delegationSignature=${encodeURIComponent(d.delegationSignature)}`,
+        `sessionId=${encodeURIComponent(d.sessionId)}`,
+        `expiryTimestamp=${d.expiryTimestamp}`
+      ].join("&");
+      const res = await env.fetch(`${env.apiBase}/api/vault-cid?${query}`);
+      if (!res.ok) throw new Error(`passage read failed (${res.status})`);
+      const json = await res.json();
+      return { cid: json.cid ?? null, moved: !!json.moved, movedTo: json.movedTo ?? void 0 };
+    },
+    peekPendingKey: () => env.pending.read(),
+    async getOrCreatePendingKey() {
+      const existing = await env.pending.read();
+      if (existing) return existing;
+      const secretKey = env.newSecretKey();
+      await env.pending.write(secretKey);
+      return secretKey;
+    },
+    smartAccountOf: (secretKey) => env.smartAccountOf(secretKey),
+    async writeSmartAccountPointer(smartAccount, cid) {
+      const pendingKey = await env.pending.read();
+      if (!pendingKey) throw new Error("passage: no pending key");
+      const d = await delegation2((m) => env.signWithKey(pendingKey, m));
+      await postJson(env, "/api/vault-cid", {
+        walletAddress: smartAccount,
+        cid,
+        delegationSignature: d.delegationSignature,
+        sessionId: d.sessionId,
+        expiryTimestamp: d.expiryTimestamp
+      });
+    },
+    async markLegacyMoved(smartAccount) {
+      const d = await delegation2((m) => env.signLegacy(m));
+      await postJson(env, "/api/vault-cid/move", {
+        walletAddress: legacyAddress,
+        targetSmartAccount: smartAccount,
+        delegationSignature: d.delegationSignature,
+        sessionId: d.sessionId,
+        expiryTimestamp: d.expiryTimestamp
+      });
+    },
+    async activatePendingKey() {
+      const pendingKey = await env.pending.read();
+      if (!pendingKey) throw new Error("passage: no pending key");
+      await env.activate(pendingKey);
+      await env.pending.clear();
+    },
+    discardPendingKey: () => env.pending.clear()
+  };
+}
+async function readPassageState(env, hasSecretKey) {
+  const legacy = await createPassageIO(env).readLegacyPointer();
+  const pointer = legacy.moved ? "moved" : legacy.cid ? "active" : "none";
+  return identityState({ hasSecretKey, pointer });
+}
+function runPassageWith(env, hasSecretKey) {
+  return runPassage(createPassageIO(env), { hasSecretKey });
+}
+
+// src/keyedMigration.ts
+var KEYED_MIGRATION_ENABLED = false;
+var DELEGATION_TTL_SECONDS2 = 300;
+async function delegation(env) {
+  const sessionId = env.newSessionId();
+  const expiryTimestamp = Math.floor(env.now() / 1e3) + DELEGATION_TTL_SECONDS2;
+  const delegationSignature = await env.signWithKey(env.formatDelegation(sessionId, expiryTimestamp));
+  return { sessionId, expiryTimestamp, delegationSignature };
+}
+async function readPointer(env, wallet) {
+  const d = await delegation(env);
+  const query = [
+    `wallet=${encodeURIComponent(wallet)}`,
+    `delegationSignature=${encodeURIComponent(d.delegationSignature)}`,
+    `sessionId=${encodeURIComponent(d.sessionId)}`,
+    `expiryTimestamp=${d.expiryTimestamp}`
+  ].join("&");
+  const res = await env.fetch(`${env.apiBase}/api/vault-cid?${query}`);
+  if (!res.ok) throw new Error(`keyed migration: read failed (${res.status})`);
+  const json = await res.json();
+  return { cid: json.cid ?? null, moved: !!json.moved, movedTo: json.movedTo ?? void 0 };
+}
+async function copyPointer(env, smartAccount, cid) {
+  const d = await delegation(env);
+  const res = await env.fetch(`${env.apiBase}/api/vault-cid`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      walletAddress: smartAccount,
+      cid,
+      delegationSignature: d.delegationSignature,
+      sessionId: d.sessionId,
+      expiryTimestamp: d.expiryTimestamp
+    })
+  });
+  if (!res.ok) throw new Error(`keyed migration: SA copy failed (${res.status})`);
+}
+async function markMoved(env, owner, smartAccount) {
+  const d = await delegation(env);
+  const res = await env.fetch(`${env.apiBase}/api/vault-cid/move`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      walletAddress: owner,
+      targetSmartAccount: smartAccount,
+      delegationSignature: d.delegationSignature,
+      sessionId: d.sessionId,
+      expiryTimestamp: d.expiryTimestamp
+    })
+  });
+  if (!res.ok) throw new Error(`keyed migration: move failed (${res.status})`);
+}
+async function reconcileAfterMove(env, owner, smartAccount) {
+  const frozen = await readPointer(env, owner);
+  if (!frozen.cid) throw new Error("keyed migration: legacy pointer empty after the move");
+  const copied = await readPointer(env, smartAccount);
+  if (copied.cid === frozen.cid) return;
+  await copyPointer(env, smartAccount, frozen.cid);
+  const check = await readPointer(env, smartAccount);
+  if (check.cid !== frozen.cid) throw new Error("keyed migration: SA copy differs after the move");
+}
+async function migrateKeyedPointer(env) {
+  const owner = env.ownerAddress.toLowerCase();
+  const smartAccount = env.smartAccount.toLowerCase();
+  const legacy = await readPointer(env, owner);
+  if (legacy.moved) {
+    if ((legacy.movedTo ?? "").toLowerCase() !== smartAccount) {
+      throw new Error("keyed migration: legacy pointer moved to another smart account");
+    }
+    await reconcileAfterMove(env, owner, smartAccount);
+    return "already_moved";
+  }
+  if (!legacy.cid) return "no_pointer";
+  const target = await readPointer(env, smartAccount);
+  if (target.cid !== null && target.cid !== legacy.cid) return "conflict";
+  if (target.cid === null) await copyPointer(env, smartAccount, legacy.cid);
+  await markMoved(env, owner, smartAccount);
+  await reconcileAfterMove(env, owner, smartAccount);
+  return "moved";
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  CID_REGISTRY_ABI,
+  KEYED_MIGRATION_ENABLED,
+  PASSAGE_ENABLED,
+  canWritePointer,
   clearIdentity,
   clearSmartAccountCache,
   computeSmartAccountAddress,
+  createPassageIO,
   createVaultSmartAccount,
-  flushCidOnChainSync,
+  deriveIdentity,
   formatSecretKeyForDisplay,
   generateSecretKey,
   getCachedSmartAccountAddress,
@@ -663,22 +715,22 @@ function parseSecretKeyInput(input) {
   getIdentityOwner,
   getIdentitySmartAccount,
   getIdentitySnapshot,
-  getOnChainSyncStatus,
   getOwnerFromPassword,
   getPimlicoApiKey,
   getTargetChain,
+  identityState,
   initIdentityFromPassword,
   initIdentityFromSigner,
-  isCidRegistryConfigured,
   isIdentityConnected,
   isSmartAccountConfigured,
   isValidSecretKey,
+  migrateKeyedPointer,
   parseSecretKeyInput,
-  publishCidOnChain,
-  readCidOnChain,
-  resetOnChainSync,
-  scheduleCidOnChainSync,
+  readPassageState,
+  runPassage,
+  runPassageWith,
   signMessageWithIdentity,
   subscribeIdentity,
-  useIdentity
+  useIdentity,
+  verifyAAAuth
 });