@aspect-wallet/sdk 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,55 @@
+/**
+ * @aspect-wallet/sdk - FcxWallet SDK for ERC-4337 smart wallets.
+ *
+ * @example
+ * ```ts
+ * import { FcxWalletClient } from '@aspect-wallet/sdk';
+ *
+ * const client = new FcxWalletClient({
+ *   apiKey: 'fcx_live_abc123...',
+ *   chain: 'arbitrum-one',
+ * });
+ * ```
+ */
+export { FcxWalletClient } from './core/client.js';
+export { FcxError } from './core/errors.js';
+export type { FcxErrorCode } from './core/errors.js';
+export { ENTRYPOINT_V06, RIP7212_PRECOMPILE, ERC1967_IMPLEMENTATION_SLOT, P256_N, GAS_SAFETY_MARGIN, FEE_SAFETY_MARGIN, CHAIN_IDS, } from './core/config.js';
+export { getUserOpHash } from './userop/hash.js';
+export { UserOpBuilder } from './userop/builder.js';
+export { encodeCallData, encodeBatchCallData, encodeInitCode } from './userop/encoding.js';
+export { NonceManager } from './userop/nonce.js';
+export { estimateGas, applyGasSafetyMargin } from './userop/gas.js';
+export type { ISigner } from './signer/interface.js';
+export { EoaSigner } from './signer/eoa.js';
+export { PasskeySigner } from './signer/passkey.js';
+export { SessionKeySigner } from './signer/session.js';
+export { MultiSigCollector } from './signer/multisig.js';
+export { encodeModuleSignature } from './signer/interface.js';
+export { WalletFactory, computeWalletAddress } from './wallet/factory.js';
+export { PaymasterClient } from './sponsor/paymaster.js';
+export { AuthClient } from './auth/email.js';
+export { OAuthClient } from './auth/oauth.js';
+export { PasskeyAuthClient } from './auth/passkey-auth.js';
+export { SessionManager } from './auth/session.js';
+export { GuardianManager } from './mfa/guardian.js';
+export { MultiSigManager } from './mfa/multisig.js';
+export { TimelockManager } from './mfa/timelock.js';
+export { TierSelector } from './mfa/tiers.js';
+export { SessionKeyManager } from './session-keys/manager.js';
+export { PermissionBuilder } from './session-keys/permissions.js';
+export { SessionKeyTemplates } from './session-keys/templates.js';
+export { SocialRecovery } from './recovery/social.js';
+export { KeyRotation } from './recovery/rotation.js';
+export { KeyExport } from './recovery/export.js';
+export { DeviceManager } from './recovery/devices.js';
+export { FreezeManager } from './security/freeze.js';
+export { WatchtowerClient } from './security/watchtower.js';
+export { RevokeManager } from './security/revoke.js';
+export { AuditClient } from './audit/history.js';
+export { ChainRegistry } from './chain/registry.js';
+export { BundlerClient } from './transport/bundler.js';
+export { ApiClient } from './transport/api.js';
+export { IframeBridge } from './transport/iframe.js';
+export type * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,2BAA2B,EAC3B,MAAM,EACN,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,GACV,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAGpE,YAAY,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG1E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrD,mBAAmB,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,64 @@
+/**
+ * @aspect-wallet/sdk - FcxWallet SDK for ERC-4337 smart wallets.
+ *
+ * @example
+ * ```ts
+ * import { FcxWalletClient } from '@aspect-wallet/sdk';
+ *
+ * const client = new FcxWalletClient({
+ *   apiKey: 'fcx_live_abc123...',
+ *   chain: 'arbitrum-one',
+ * });
+ * ```
+ */
+// Core
+export { FcxWalletClient } from './core/client.js';
+export { FcxError } from './core/errors.js';
+export { ENTRYPOINT_V06, RIP7212_PRECOMPILE, ERC1967_IMPLEMENTATION_SLOT, P256_N, GAS_SAFETY_MARGIN, FEE_SAFETY_MARGIN, CHAIN_IDS, } from './core/config.js';
+// UserOp
+export { getUserOpHash } from './userop/hash.js';
+export { UserOpBuilder } from './userop/builder.js';
+export { encodeCallData, encodeBatchCallData, encodeInitCode } from './userop/encoding.js';
+export { NonceManager } from './userop/nonce.js';
+export { estimateGas, applyGasSafetyMargin } from './userop/gas.js';
+export { EoaSigner } from './signer/eoa.js';
+export { PasskeySigner } from './signer/passkey.js';
+export { SessionKeySigner } from './signer/session.js';
+export { MultiSigCollector } from './signer/multisig.js';
+export { encodeModuleSignature } from './signer/interface.js';
+// Wallet
+export { WalletFactory, computeWalletAddress } from './wallet/factory.js';
+// Sponsor
+export { PaymasterClient } from './sponsor/paymaster.js';
+// Auth
+export { AuthClient } from './auth/email.js';
+export { OAuthClient } from './auth/oauth.js';
+export { PasskeyAuthClient } from './auth/passkey-auth.js';
+export { SessionManager } from './auth/session.js';
+// MFA
+export { GuardianManager } from './mfa/guardian.js';
+export { MultiSigManager } from './mfa/multisig.js';
+export { TimelockManager } from './mfa/timelock.js';
+export { TierSelector } from './mfa/tiers.js';
+// Session Keys
+export { SessionKeyManager } from './session-keys/manager.js';
+export { PermissionBuilder } from './session-keys/permissions.js';
+export { SessionKeyTemplates } from './session-keys/templates.js';
+// Recovery
+export { SocialRecovery } from './recovery/social.js';
+export { KeyRotation } from './recovery/rotation.js';
+export { KeyExport } from './recovery/export.js';
+export { DeviceManager } from './recovery/devices.js';
+// Security
+export { FreezeManager } from './security/freeze.js';
+export { WatchtowerClient } from './security/watchtower.js';
+export { RevokeManager } from './security/revoke.js';
+// Audit
+export { AuditClient } from './audit/history.js';
+// Chain
+export { ChainRegistry } from './chain/registry.js';
+// Transport
+export { BundlerClient } from './transport/bundler.js';
+export { ApiClient } from './transport/api.js';
+export { IframeBridge } from './transport/iframe.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO;AACP,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,2BAA2B,EAC3B,MAAM,EACN,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,GACV,MAAM,kBAAkB,CAAC;AAE1B,SAAS;AACT,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAIpE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,SAAS;AACT,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE1E,UAAU;AACV,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO;AACP,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM;AACN,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,eAAe;AACf,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,WAAW;AACX,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,WAAW;AACX,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,QAAQ;AACR,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,QAAQ;AACR,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,YAAY;AACZ,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/mfa/guardian.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Guardian co-signing management.
+ * Corresponds to SPEC-013 Section 8.2.
+ */
+import type { Address, GuardianInfo } from '../types.js';
+import { ApiClient } from '../transport/api.js';
+/**
+ * Manages guardian relationships for MFA and recovery.
+ */
+export declare class GuardianManager {
+    private readonly api;
+    constructor(api: ApiClient);
+    /** Add a guardian (requires owner signature) */
+    addGuardian(params: {
+        guardian: Address;
+        label: string;
+    }): Promise<void>;
+    /** Remove a guardian (requires owner signature, must stay above threshold) */
+    removeGuardian(guardian: Address): Promise<void>;
+    /** List all guardians for a wallet */
+    listGuardians(walletAddress: Address): Promise<GuardianInfo[]>;
+    /** Set the guardian threshold (K-of-N) */
+    setThreshold(threshold: number): Promise<void>;
+    /** Get the current threshold */
+    getThreshold(walletAddress: Address): Promise<number>;
+}
+//# sourceMappingURL=guardian.d.ts.map

package/dist/mfa/guardian.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian.d.ts","sourceRoot":"","sources":["../../src/mfa/guardian.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;GAEG;AACH,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAE3C,gDAAgD;IAC1C,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9E,8EAA8E;IACxE,cAAc,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,sCAAsC;IAChC,aAAa,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAIpE,0CAA0C;IACpC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,gCAAgC;IAC1B,YAAY,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;CAM5D"}

package/dist/mfa/guardian.js

@@ -0,0 +1,37 @@
+/**
+ * Guardian co-signing management.
+ * Corresponds to SPEC-013 Section 8.2.
+ */
+/**
+ * Manages guardian relationships for MFA and recovery.
+ */
+export class GuardianManager {
+    api;
+    constructor(api) {
+        this.api = api;
+    }
+    /** Add a guardian (requires owner signature) */
+    async addGuardian(params) {
+        await this.api.post('/mfa/guardians', params);
+    }
+    /** Remove a guardian (requires owner signature, must stay above threshold) */
+    async removeGuardian(guardian) {
+        await this.api.delete(`/mfa/guardians/${guardian}`);
+    }
+    /** List all guardians for a wallet */
+    async listGuardians(walletAddress) {
+        return this.api.get('/mfa/guardians', { wallet: walletAddress });
+    }
+    /** Set the guardian threshold (K-of-N) */
+    async setThreshold(threshold) {
+        await this.api.post('/mfa/threshold', { threshold });
+    }
+    /** Get the current threshold */
+    async getThreshold(walletAddress) {
+        const result = await this.api.get('/mfa/threshold', {
+            wallet: walletAddress,
+        });
+        return result.threshold;
+    }
+}
+//# sourceMappingURL=guardian.js.map

package/dist/mfa/guardian.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian.js","sourceRoot":"","sources":["../../src/mfa/guardian.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH;;GAEG;AACH,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAE/C,gDAAgD;IAChD,KAAK,CAAC,WAAW,CAAC,MAA4C;QAC5D,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,cAAc,CAAC,QAAiB;QACpC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,aAAa,CAAC,aAAsB;QACxC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAiB,gBAAgB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,YAAY,CAAC,SAAiB;QAClC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,gCAAgC;IAChC,KAAK,CAAC,YAAY,CAAC,aAAsB;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAwB,gBAAgB,EAAE;YACzE,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;CACF"}

package/dist/mfa/multisig.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Multi-sig operations for MFA.
+ * Corresponds to SPEC-013 Section 8.3.
+ */
+import type { Address, MultiSigProposal, CallRequest } from '../types.js';
+import { ApiClient } from '../transport/api.js';
+/**
+ * Manages multi-sig transaction proposals and approvals.
+ */
+export declare class MultiSigManager {
+    private readonly api;
+    constructor(api: ApiClient);
+    /**
+     * Propose a multi-sig transaction (owner signs first).
+     * Returns the proposal with current signature count.
+     */
+    proposeMultiSig(call: CallRequest): Promise<MultiSigProposal>;
+    /**
+     * Approve a multi-sig proposal (co-signer).
+     * If threshold is met, the UserOp is submitted automatically.
+     */
+    approveMultiSig(proposalId: string): Promise<MultiSigProposal>;
+    /** Get the status of a multi-sig proposal */
+    getProposal(proposalId: string): Promise<MultiSigProposal>;
+    /** List pending multi-sig proposals for a wallet */
+    listPending(walletAddress: Address): Promise<MultiSigProposal[]>;
+}
+//# sourceMappingURL=multisig.d.ts.map

package/dist/mfa/multisig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multisig.d.ts","sourceRoot":"","sources":["../../src/mfa/multisig.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAO,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;GAEG;AACH,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAE3C;;;OAGG;IACG,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQnE;;;OAGG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIpE,6CAA6C;IACvC,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIhE,oDAAoD;IAC9C,WAAW,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAGvE"}

package/dist/mfa/multisig.js

@@ -0,0 +1,40 @@
+/**
+ * Multi-sig operations for MFA.
+ * Corresponds to SPEC-013 Section 8.3.
+ */
+/**
+ * Manages multi-sig transaction proposals and approvals.
+ */
+export class MultiSigManager {
+    api;
+    constructor(api) {
+        this.api = api;
+    }
+    /**
+     * Propose a multi-sig transaction (owner signs first).
+     * Returns the proposal with current signature count.
+     */
+    async proposeMultiSig(call) {
+        return this.api.post('/mfa/multisig/propose', {
+            target: call.target,
+            value: call.value.toString(),
+            data: call.data,
+        });
+    }
+    /**
+     * Approve a multi-sig proposal (co-signer).
+     * If threshold is met, the UserOp is submitted automatically.
+     */
+    async approveMultiSig(proposalId) {
+        return this.api.post(`/mfa/multisig/${proposalId}/approve`, {});
+    }
+    /** Get the status of a multi-sig proposal */
+    async getProposal(proposalId) {
+        return this.api.get(`/mfa/multisig/${proposalId}`);
+    }
+    /** List pending multi-sig proposals for a wallet */
+    async listPending(walletAddress) {
+        return this.api.get('/mfa/multisig', { wallet: walletAddress });
+    }
+}
+//# sourceMappingURL=multisig.js.map

package/dist/mfa/multisig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multisig.js","sourceRoot":"","sources":["../../src/mfa/multisig.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH;;GAEG;AACH,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,IAAiB;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAmB,uBAAuB,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAmB,iBAAiB,UAAU,UAAU,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,6CAA6C;IAC7C,KAAK,CAAC,WAAW,CAAC,UAAkB;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAmB,iBAAiB,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,WAAW,CAAC,aAAsB;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAqB,eAAe,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IACtF,CAAC;CACF"}

package/dist/mfa/tiers.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Step-up auth tier selection.
+ * Corresponds to SPEC-013 Section 8.1.
+ *
+ * Tier 1: Session key (value < 0.01 ETH + target in allowlist)
+ * Tier 2: Owner key (value < 1 ETH)
+ * Tier 3: Device + Guardian (value < 10 ETH)
+ * Tier 4: Multi-sig + Timelock (account management OR value >= 10 ETH)
+ */
+import type { Address, Hex, SessionKeyPermissions } from '../types.js';
+/** Auth tier levels */
+export type AuthTier = 1 | 2 | 3 | 4;
+/**
+ * Automatically selects the appropriate auth tier based on
+ * transaction value, target, and active session key permissions.
+ */
+export declare class TierSelector {
+    /**
+     * Determine the required auth tier for a transaction.
+     *
+     * @param value - Transaction value in wei
+     * @param target - Target contract address
+     * @param selector - Function selector (first 4 bytes of callData)
+     * @param activeSessionPermissions - Permissions of any active session key
+     * @returns The required auth tier
+     */
+    static select(params: {
+        value: bigint;
+        target?: Address;
+        selector?: Hex;
+        activeSessionPermissions?: SessionKeyPermissions;
+    }): AuthTier;
+}
+//# sourceMappingURL=tiers.d.ts.map

package/dist/mfa/tiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tiers.d.ts","sourceRoot":"","sources":["../../src/mfa/tiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEvE,uBAAuB;AACvB,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAiBrC;;;GAGG;AACH,qBAAa,YAAY;IACvB;;;;;;;;OAQG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,GAAG,CAAC;QACf,wBAAwB,CAAC,EAAE,qBAAqB,CAAC;KAClD,GAAG,QAAQ;CAoCb"}

package/dist/mfa/tiers.js

@@ -0,0 +1,66 @@
+/**
+ * Step-up auth tier selection.
+ * Corresponds to SPEC-013 Section 8.1.
+ *
+ * Tier 1: Session key (value < 0.01 ETH + target in allowlist)
+ * Tier 2: Owner key (value < 1 ETH)
+ * Tier 3: Device + Guardian (value < 10 ETH)
+ * Tier 4: Multi-sig + Timelock (account management OR value >= 10 ETH)
+ */
+/** Tier thresholds in wei */
+const TIER_THRESHOLDS = {
+    TIER_1_MAX: 10000000000000000n, // 0.01 ETH
+    TIER_2_MAX: 1000000000000000000n, // 1 ETH
+    TIER_3_MAX: 10000000000000000000n, // 10 ETH
+};
+/** Account management selectors that always require Tier 4 */
+const TIER_4_SELECTORS = new Set([
+    '0xf2fde38b', // transferOwnership(address)
+    '0x79ba5097', // acceptOwnership()
+    '0x3659cfe6', // upgradeTo(address)
+    '0x4f1ef286', // upgradeToAndCall(address,bytes)
+]);
+/**
+ * Automatically selects the appropriate auth tier based on
+ * transaction value, target, and active session key permissions.
+ */
+export class TierSelector {
+    /**
+     * Determine the required auth tier for a transaction.
+     *
+     * @param value - Transaction value in wei
+     * @param target - Target contract address
+     * @param selector - Function selector (first 4 bytes of callData)
+     * @param activeSessionPermissions - Permissions of any active session key
+     * @returns The required auth tier
+     */
+    static select(params) {
+        const { value, target, selector, activeSessionPermissions } = params;
+        // Tier 4: Account management operations always
+        if (selector && TIER_4_SELECTORS.has(selector.slice(0, 10).toLowerCase())) {
+            return 4;
+        }
+        // Tier 4: Very high value (>= 10 ETH)
+        if (value >= TIER_THRESHOLDS.TIER_3_MAX) {
+            return 4;
+        }
+        // Tier 3: High value (< 10 ETH, >= 1 ETH)
+        if (value >= TIER_THRESHOLDS.TIER_2_MAX) {
+            return 3;
+        }
+        // Tier 2: Medium value (< 1 ETH, >= 0.01 ETH)
+        if (value >= TIER_THRESHOLDS.TIER_1_MAX) {
+            return 2;
+        }
+        // Tier 1: Low value + target in session allowlist
+        if (activeSessionPermissions && target && selector) {
+            const isAllowed = activeSessionPermissions.allowlist.some((entry) => entry.target.toLowerCase() === target.toLowerCase() &&
+                (entry.selector === '0xffffffff' || entry.selector.toLowerCase() === selector.slice(0, 10).toLowerCase()));
+            if (isAllowed)
+                return 1;
+        }
+        // Default to Tier 2 for low-value without active session
+        return 2;
+    }
+}
+//# sourceMappingURL=tiers.js.map

package/dist/mfa/tiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tiers.js","sourceRoot":"","sources":["../../src/mfa/tiers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,6BAA6B;AAC7B,MAAM,eAAe,GAAG;IACtB,UAAU,EAAE,kBAAuB,EAAQ,WAAW;IACtD,UAAU,EAAE,oBAA0B,EAAM,QAAQ;IACpD,UAAU,EAAE,qBAA2B,EAAK,SAAS;CACtD,CAAC;AAEF,8DAA8D;AAC9D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS;IACvC,YAAY,EAAE,6BAA6B;IAC3C,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,qBAAqB;IACnC,YAAY,EAAE,kCAAkC;CACjD,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,OAAO,YAAY;IACvB;;;;;;;;OAQG;IACH,MAAM,CAAC,MAAM,CAAC,MAKb;QACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,EAAE,GAAG,MAAM,CAAC;QAErE,+CAA+C;QAC/C,IAAI,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,CAAC;QACX,CAAC;QAED,sCAAsC;QACtC,IAAI,KAAK,IAAI,eAAe,CAAC,UAAU,EAAE,CAAC;YACxC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,0CAA0C;QAC1C,IAAI,KAAK,IAAI,eAAe,CAAC,UAAU,EAAE,CAAC;YACxC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,8CAA8C;QAC9C,IAAI,KAAK,IAAI,eAAe,CAAC,UAAU,EAAE,CAAC;YACxC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,kDAAkD;QAClD,IAAI,wBAAwB,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;YACnD,MAAM,SAAS,GAAG,wBAAwB,CAAC,SAAS,CAAC,IAAI,CACvD,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE;gBACnD,CAAC,KAAK,CAAC,QAAQ,KAAK,YAAY,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAC5G,CAAC;YACF,IAAI,SAAS;gBAAE,OAAO,CAAC,CAAC;QAC1B,CAAC;QAED,yDAAyD;QACzD,OAAO,CAAC,CAAC;IACX,CAAC;CACF"}

package/dist/mfa/timelock.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Timelock operations for high-value MFA (Tier 4).
+ * Corresponds to SPEC-013 Section 8.3.
+ */
+import type { Address, TimelockOperation, CallRequest } from '../types.js';
+import { ApiClient } from '../transport/api.js';
+/**
+ * Manages timelocked operations that require a delay before execution.
+ * Used for Tier 4 operations (account management, high-value transfers).
+ */
+export declare class TimelockManager {
+    private readonly api;
+    constructor(api: ApiClient);
+    /**
+     * Propose a timelocked operation (multi-sig + delay).
+     * The operation can only be executed after the timelock expires.
+     */
+    proposeWithTimelock(call: CallRequest, timelockDelay: number): Promise<TimelockOperation>;
+    /**
+     * Execute a timelocked operation after the delay has passed.
+     */
+    executeTimelocked(operationId: string): Promise<void>;
+    /**
+     * Cancel a pending timelocked operation (owner only).
+     */
+    cancelTimelocked(operationId: string): Promise<void>;
+    /** Get the status of a timelocked operation */
+    getStatus(operationId: string): Promise<TimelockOperation>;
+    /** List all pending timelocked operations for a wallet */
+    listPending(walletAddress: Address): Promise<TimelockOperation[]>;
+}
+//# sourceMappingURL=timelock.d.ts.map

package/dist/mfa/timelock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timelock.d.ts","sourceRoot":"","sources":["../../src/mfa/timelock.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAO,iBAAiB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;GAGG;AACH,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAE3C;;;OAGG;IACG,mBAAmB,CACvB,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,iBAAiB,CAAC;IAS7B;;OAEG;IACG,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D;;OAEG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D,+CAA+C;IACzC,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAIhE,0DAA0D;IACpD,WAAW,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;CAGxE"}

package/dist/mfa/timelock.js

@@ -0,0 +1,47 @@
+/**
+ * Timelock operations for high-value MFA (Tier 4).
+ * Corresponds to SPEC-013 Section 8.3.
+ */
+/**
+ * Manages timelocked operations that require a delay before execution.
+ * Used for Tier 4 operations (account management, high-value transfers).
+ */
+export class TimelockManager {
+    api;
+    constructor(api) {
+        this.api = api;
+    }
+    /**
+     * Propose a timelocked operation (multi-sig + delay).
+     * The operation can only be executed after the timelock expires.
+     */
+    async proposeWithTimelock(call, timelockDelay) {
+        return this.api.post('/mfa/timelock/propose', {
+            target: call.target,
+            value: call.value.toString(),
+            data: call.data,
+            timelockDelay,
+        });
+    }
+    /**
+     * Execute a timelocked operation after the delay has passed.
+     */
+    async executeTimelocked(operationId) {
+        await this.api.post(`/mfa/timelock/${operationId}/execute`, {});
+    }
+    /**
+     * Cancel a pending timelocked operation (owner only).
+     */
+    async cancelTimelocked(operationId) {
+        await this.api.post(`/mfa/timelock/${operationId}/cancel`, {});
+    }
+    /** Get the status of a timelocked operation */
+    async getStatus(operationId) {
+        return this.api.get(`/mfa/timelock/${operationId}`);
+    }
+    /** List all pending timelocked operations for a wallet */
+    async listPending(walletAddress) {
+        return this.api.get('/mfa/timelock', { wallet: walletAddress });
+    }
+}
+//# sourceMappingURL=timelock.js.map

package/dist/mfa/timelock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timelock.js","sourceRoot":"","sources":["../../src/mfa/timelock.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH;;;GAGG;AACH,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CACvB,IAAiB,EACjB,aAAqB;QAErB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAoB,uBAAuB,EAAE;YAC/D,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,WAAmB;QACzC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,WAAW,UAAU,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,WAAW,SAAS,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,SAAS,CAAC,WAAmB;QACjC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAoB,iBAAiB,WAAW,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,WAAW,CAAC,aAAsB;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAsB,eAAe,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IACvF,CAAC;CACF"}

package/dist/recovery/devices.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Multi-device management.
+ * Corresponds to SPEC-013 Section 10.3.
+ */
+import type { Address, DeviceInfo } from '../types.js';
+import { ApiClient } from '../transport/api.js';
+/**
+ * Device management module.
+ * Add/remove devices (passkeys) as validation modules on the smart account.
+ */
+export declare class DeviceManager {
+    private readonly api;
+    constructor(api: ApiClient);
+    /**
+     * Add a new device (e.g., passkey on phone).
+     * Prompts passkey creation, installs WebAuthn validation module on-chain.
+     */
+    addDevice(params: {
+        name: string;
+        type: 'passkey' | 'turnkey';
+        moduleId: number;
+    }): Promise<DeviceInfo>;
+    /** List all registered devices for a wallet */
+    listDevices(walletAddress: Address): Promise<DeviceInfo[]>;
+    /**
+     * Remove a lost device (from any remaining device).
+     * Uninstalls the validation module -- device can no longer sign.
+     */
+    removeDevice(moduleId: number): Promise<void>;
+}
+//# sourceMappingURL=devices.d.ts.map

package/dist/recovery/devices.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.d.ts","sourceRoot":"","sources":["../../src/recovery/devices.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;GAGG;AACH,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,SAAS;IAE3C;;;OAGG;IACG,SAAS,CAAC,MAAM,EAAE;QACtB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;QAC5B,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,UAAU,CAAC;IAIvB,+CAA+C;IACzC,WAAW,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAIhE;;;OAGG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGpD"}

package/dist/recovery/devices.js

@@ -0,0 +1,33 @@
+/**
+ * Multi-device management.
+ * Corresponds to SPEC-013 Section 10.3.
+ */
+/**
+ * Device management module.
+ * Add/remove devices (passkeys) as validation modules on the smart account.
+ */
+export class DeviceManager {
+    api;
+    constructor(api) {
+        this.api = api;
+    }
+    /**
+     * Add a new device (e.g., passkey on phone).
+     * Prompts passkey creation, installs WebAuthn validation module on-chain.
+     */
+    async addDevice(params) {
+        return this.api.post('/recovery/devices', params);
+    }
+    /** List all registered devices for a wallet */
+    async listDevices(walletAddress) {
+        return this.api.get('/recovery/devices', { wallet: walletAddress });
+    }
+    /**
+     * Remove a lost device (from any remaining device).
+     * Uninstalls the validation module -- device can no longer sign.
+     */
+    async removeDevice(moduleId) {
+        await this.api.delete(`/recovery/devices/${moduleId}`);
+    }
+}
+//# sourceMappingURL=devices.js.map

package/dist/recovery/devices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.js","sourceRoot":"","sources":["../../src/recovery/devices.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH;;;GAGG;AACH,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,GAAc;QAAd,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,MAIf;QACC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAa,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,WAAW,CAAC,aAAsB;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAe,mBAAmB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IACpF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/recovery/export.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Key export from Turnkey enclave.
+ * Corresponds to SPEC-013 Section 10.4.
+ *
+ * Non-custodial guarantee: user can always export their private key,
+ * even if the app backend is down.
+ */
+import type { KeyExportResult } from '../types.js';
+import { ApiClient } from '../transport/api.js';
+import { IframeBridge } from '../transport/iframe.js';
+/**
+ * Key export module.
+ * Exports private keys from the Turnkey enclave via the signer iframe.
+ */
+export declare class KeyExport {
+    private readonly api;
+    private readonly iframe;
+    constructor(api: ApiClient, iframe: IframeBridge | null);
+    /**
+     * Export the private key from the Turnkey enclave.
+     *
+     * Process:
+     * 1. SDK generates one-time keypair in browser
+     * 2. Sends public key to Turnkey enclave (via iframe)
+     * 3. Enclave encrypts user's key, returns blob
+     * 4. SDK decrypts locally
+     * 5. Returns raw private key
+     *
+     * Works even if the app backend is down (direct Turnkey communication).
+     */
+    exportKey(): Promise<KeyExportResult>;
+}
+//# sourceMappingURL=export.d.ts.map

package/dist/recovery/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../src/recovery/export.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD;;;GAGG;AACH,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,YAAY,GAAG,IAAI;IAG9C;;;;;;;;;;;OAWG;IACG,SAAS,IAAI,OAAO,CAAC,eAAe,CAAC;CAa5C"}

package/dist/recovery/export.js

@@ -0,0 +1,44 @@
+/**
+ * Key export from Turnkey enclave.
+ * Corresponds to SPEC-013 Section 10.4.
+ *
+ * Non-custodial guarantee: user can always export their private key,
+ * even if the app backend is down.
+ */
+/**
+ * Key export module.
+ * Exports private keys from the Turnkey enclave via the signer iframe.
+ */
+export class KeyExport {
+    api;
+    iframe;
+    constructor(api, iframe) {
+        this.api = api;
+        this.iframe = iframe;
+    }
+    /**
+     * Export the private key from the Turnkey enclave.
+     *
+     * Process:
+     * 1. SDK generates one-time keypair in browser
+     * 2. Sends public key to Turnkey enclave (via iframe)
+     * 3. Enclave encrypts user's key, returns blob
+     * 4. SDK decrypts locally
+     * 5. Returns raw private key
+     *
+     * Works even if the app backend is down (direct Turnkey communication).
+     */
+    async exportKey() {
+        if (this.iframe) {
+            const privateKey = await this.iframe.exportKey();
+            return {
+                privateKey,
+                address: '0x0000000000000000000000000000000000000000', // Will be resolved by iframe
+                warning: 'Store this securely. Anyone with this key can sign for your wallet.',
+            };
+        }
+        // Fallback: request via API
+        return this.api.post('/recovery/export', {});
+    }
+}
+//# sourceMappingURL=export.js.map

package/dist/recovery/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../src/recovery/export.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;;GAGG;AACH,MAAM,OAAO,SAAS;IAED;IACA;IAFnB,YACmB,GAAc,EACd,MAA2B;QAD3B,QAAG,GAAH,GAAG,CAAW;QACd,WAAM,GAAN,MAAM,CAAqB;IAC3C,CAAC;IAEJ;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,SAAS;QACb,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACjD,OAAO;gBACL,UAAU;gBACV,OAAO,EAAE,4CAA4C,EAAE,6BAA6B;gBACpF,OAAO,EAAE,qEAAqE;aAC/E,CAAC;QACJ,CAAC;QAED,4BAA4B;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAkB,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;CACF"}