@kingdomchain/wallet-client 0.1.0 → 0.2.0

package/dist/index.js

@@ -1,9 +1,11 @@
-import { toHex, fromHex } from '@cosmjs/encoding';
+import { toHex, fromHex, toBase64, fromBase64 } from '@cosmjs/encoding';
 import { sha256 } from '@noble/hashes/sha256';
 import * as ed from '@noble/ed25519';
-import { Registry } from '@cosmjs/proto-signing';
+import { Registry, DirectSecp256k1Wallet } from '@cosmjs/proto-signing';
 import { defaultRegistryTypes, SigningStargateClient } from '@cosmjs/stargate';
 import { BinaryWriter, BinaryReader } from '@bufbuild/protobuf/wire';
+import SignClient from '@walletconnect/sign-client';
+import { Random } from '@cosmjs/crypto';
 
 // src/attestation.ts
 var ATTESTATION_TYPE_CITIZENSHIP_APPLICATION = "citizenship_application";
@@ -1590,6 +1592,16 @@ function isKeplrAvailable() {
 function isLeapAvailable() {
   return typeof window !== "undefined" && isWalletApiPresent(window.leap);
 }
+function getCosmostationKeplrApi() {
+  if (typeof window === "undefined") {
+    return void 0;
+  }
+  const api = window.cosmostation?.providers?.keplr;
+  return isWalletApiPresent(api) ? api : void 0;
+}
+function isCosmostationAvailable() {
+  return getCosmostationKeplrApi() != null;
+}
 function buildKingdomChainInfo(chainId, rpcUrl, restUrl, chainName = "Kingdom Chain") {
   validateChainConfig(chainId, rpcUrl, restUrl);
   const accPub = `${BECH32_PREFIX}pub`;
@@ -1665,6 +1677,10 @@ async function connectLeap(chainInfo) {
   const api = resolveWalletApi(() => window.leap, "Leap");
   return suggestAndConnect(api, chainInfo, "Leap");
 }
+async function connectCosmostation(chainInfo) {
+  const api = resolveWalletApi(getCosmostationKeplrApi, "Cosmostation");
+  return suggestAndConnect(api, chainInfo, "Cosmostation");
+}
 async function createBrowserSigningClient(rpcUrl, signer) {
   if (!rpcUrl.trim()) {
     throw new InvalidChainConfigError("rpcUrl is required");
@@ -1677,6 +1693,720 @@ async function createBrowserSigningClient(rpcUrl, signer) {
     throw new RpcConnectionError(rpcUrl, err);
   }
 }
+var WALLETCONNECT_COSMOS_NAMESPACE = "cosmos";
+var WALLETCONNECT_COSMOS_METHODS = [
+  "cosmos_getAccounts",
+  "cosmos_signDirect",
+  "cosmos_signAmino"
+];
+var WalletConnectNotInitializedError = class extends Error {
+  constructor() {
+    super("WalletConnect Sign Client is not initialized.");
+    this.name = "WalletConnectNotInitializedError";
+  }
+};
+var WalletConnectSessionError = class extends Error {
+  constructor(message, cause) {
+    super(message, { cause });
+    this.name = "WalletConnectSessionError";
+  }
+};
+var WalletConnectSigningError = class extends Error {
+  constructor(message, cause) {
+    super(message, { cause });
+    this.name = "WalletConnectSigningError";
+  }
+};
+function toWalletConnectCosmosChainId(chainId) {
+  return `${WALLETCONNECT_COSMOS_NAMESPACE}:${chainId}`;
+}
+function parseWalletConnectAccount(account) {
+  const parts = account.split(":");
+  if (parts.length !== 3) {
+    throw new WalletConnectSessionError(`Invalid WalletConnect account id: ${account}`);
+  }
+  const [namespace, chainId, address] = parts;
+  return { namespace, chainId, address };
+}
+function buildRequiredCosmosNamespaces(chainId) {
+  const wcChainId = toWalletConnectCosmosChainId(chainId);
+  return {
+    [WALLETCONNECT_COSMOS_NAMESPACE]: {
+      methods: [...WALLETCONNECT_COSMOS_METHODS],
+      chains: [wcChainId],
+      events: []
+    }
+  };
+}
+async function initWalletConnectClient(config) {
+  if (!config.projectId.trim()) {
+    throw new WalletConnectSessionError("WalletConnect projectId is required");
+  }
+  if (!config.chainId.trim()) {
+    throw new WalletConnectSessionError("chainId is required");
+  }
+  return SignClient.init({
+    projectId: config.projectId,
+    metadata: config.metadata,
+    relayUrl: config.relayUrl
+  });
+}
+function createWalletConnectOfflineSigner(client, session, chainId) {
+  const wcChainId = toWalletConnectCosmosChainId(chainId);
+  const accounts = session.namespaces[WALLETCONNECT_COSMOS_NAMESPACE]?.accounts ?? [];
+  const chainAccounts = accounts.map(parseWalletConnectAccount).filter((entry) => entry.chainId === chainId);
+  if (chainAccounts.length === 0) {
+    throw new WalletConnectSessionError(
+      `WalletConnect session has no accounts for chain ${chainId}`
+    );
+  }
+  const primaryAddress = chainAccounts[0].address;
+  return {
+    getAccounts: async () => {
+      try {
+        const response = await client.request({
+          topic: session.topic,
+          chainId: wcChainId,
+          request: {
+            method: "cosmos_getAccounts",
+            params: {}
+          }
+        });
+        if (Array.isArray(response) && response.length > 0) {
+          return response.map((account) => ({
+            address: account.address,
+            algo: account.algo,
+            pubkey: fromBase64(account.pubkey)
+          }));
+        }
+      } catch {
+      }
+      return chainAccounts.map((account) => ({
+        address: account.address,
+        algo: "secp256k1",
+        pubkey: new Uint8Array(0)
+      }));
+    },
+    signDirect: async (signerAddress, signDoc) => {
+      if (signerAddress !== primaryAddress) {
+        throw new WalletConnectSigningError(
+          `WalletConnect signer address mismatch: expected ${primaryAddress}, got ${signerAddress}`
+        );
+      }
+      try {
+        const result = await client.request({
+          topic: session.topic,
+          chainId: wcChainId,
+          request: {
+            method: "cosmos_signDirect",
+            params: {
+              signerAddress,
+              signDoc: {
+                chainId: signDoc.chainId,
+                accountNumber: signDoc.accountNumber.toString(),
+                authInfoBytes: toBase64(signDoc.authInfoBytes),
+                bodyBytes: toBase64(signDoc.bodyBytes)
+              }
+            }
+          }
+        });
+        return {
+          signed: {
+            chainId: result.signed?.chainId ?? signDoc.chainId,
+            accountNumber: BigInt(result.signed?.accountNumber ?? signDoc.accountNumber),
+            authInfoBytes: result.signed?.authInfoBytes ? fromBase64(result.signed.authInfoBytes) : signDoc.authInfoBytes,
+            bodyBytes: result.signed?.bodyBytes ? fromBase64(result.signed.bodyBytes) : signDoc.bodyBytes
+          },
+          signature: {
+            pub_key: {
+              type: result.signature.pub_key.type,
+              value: result.signature.pub_key.value
+            },
+            signature: result.signature.signature
+          }
+        };
+      } catch (err) {
+        throw new WalletConnectSigningError("WalletConnect cosmos_signDirect failed.", err);
+      }
+    }
+  };
+}
+async function connectWalletConnect(client, chainId, options) {
+  const { uri, approval } = await client.connect({
+    pairingTopic: options?.pairingTopic,
+    requiredNamespaces: buildRequiredCosmosNamespaces(chainId)
+  });
+  if (!uri) {
+    throw new WalletConnectSessionError("WalletConnect did not return a pairing URI");
+  }
+  const session = await approval();
+  const signer = createWalletConnectOfflineSigner(client, session, chainId);
+  const accounts = await signer.getAccounts();
+  if (accounts.length === 0 || !accounts[0]?.address?.trim()) {
+    throw new WalletConnectSessionError("WalletConnect session returned no usable accounts");
+  }
+  return { uri, session, signer };
+}
+async function disconnectWalletConnect(client, session, reason = "User disconnected") {
+  await client.disconnect({
+    topic: session.topic,
+    reason: { code: 6e3, message: reason }
+  });
+}
+async function restoreWalletConnectSession(client, chainId) {
+  const sessions = client.session.getAll();
+  const wcChainId = toWalletConnectCosmosChainId(chainId);
+  const active = sessions.find((session) => {
+    const chains = session.namespaces[WALLETCONNECT_COSMOS_NAMESPACE]?.chains ?? [];
+    return chains.includes(wcChainId);
+  });
+  if (!active) {
+    return null;
+  }
+  const signer = createWalletConnectOfflineSigner(client, active, chainId);
+  return { session: active, signer };
+}
+
+// src/embeddedWallet/types.ts
+var EMBEDDED_WALLET_VAULT_VERSION = 1;
+var EMBEDDED_WALLET_KDF_PRF = "webauthn-prf";
+var EMBEDDED_WALLET_KDF_PBKDF2 = "pbkdf2-passkey";
+var EmbeddedWalletBackupRequiredError = class extends Error {
+  constructor() {
+    super(
+      "Encrypted backup must be downloaded and acknowledged before the first transaction."
+    );
+    this.name = "EmbeddedWalletBackupRequiredError";
+  }
+};
+var EmbeddedWalletVaultError = class extends Error {
+  constructor(message, cause) {
+    super(message, { cause });
+    this.name = "EmbeddedWalletVaultError";
+  }
+};
+var PBKDF2_ITERATIONS = 31e4;
+var AES_GCM_IV_BYTES = 12;
+function assertKekLength(kek) {
+  if (kek.length !== 32) {
+    throw new EmbeddedWalletVaultError(`KEK must be 32 bytes, got ${kek.length}`);
+  }
+}
+function serializePlaintext(payload) {
+  const json = JSON.stringify({
+    privateKey: toBase64(payload.privateKey),
+    hdPath: payload.hdPath,
+    createdAt: payload.createdAt
+  });
+  return new TextEncoder().encode(json);
+}
+function deserializePlaintext(bytes) {
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(bytes));
+  } catch (err) {
+    throw new EmbeddedWalletVaultError("Failed to parse decrypted wallet payload", err);
+  }
+  if (typeof parsed !== "object" || parsed == null || typeof parsed.hdPath !== "string" || typeof parsed.createdAt !== "string" || typeof parsed.privateKey !== "string") {
+    throw new EmbeddedWalletVaultError("Decrypted wallet payload has invalid shape");
+  }
+  return {
+    privateKey: fromBase64(parsed.privateKey),
+    hdPath: parsed.hdPath,
+    createdAt: parsed.createdAt
+  };
+}
+async function deriveKekFromPrf(prfOutput) {
+  if (prfOutput.length < 32) {
+    throw new EmbeddedWalletVaultError(`PRF output must be at least 32 bytes, got ${prfOutput.length}`);
+  }
+  return prfOutput.slice(0, 32);
+}
+async function deriveKekFromPbkdf2(passkeyMaterial, salt, iterations = PBKDF2_ITERATIONS) {
+  if (salt.length < 16) {
+    throw new EmbeddedWalletVaultError("PBKDF2 salt must be at least 16 bytes");
+  }
+  const keyMaterial = await crypto.subtle.importKey(
+    "raw",
+    new Uint8Array(passkeyMaterial),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const derived = await crypto.subtle.deriveBits(
+    { name: "PBKDF2", salt: new Uint8Array(salt), iterations, hash: "SHA-256" },
+    keyMaterial,
+    256
+  );
+  return new Uint8Array(derived);
+}
+function createPbkdf2Salt() {
+  const salt = new Uint8Array(32);
+  crypto.getRandomValues(salt);
+  return salt;
+}
+function createPasskeyMaterialFromAssertion(authenticatorData, clientDataJSON) {
+  const combined = new Uint8Array(authenticatorData.length + clientDataJSON.length);
+  combined.set(authenticatorData, 0);
+  combined.set(clientDataJSON, authenticatorData.length);
+  return combined;
+}
+async function importAesKey(kek) {
+  assertKekLength(kek);
+  const raw = new Uint8Array(kek);
+  return crypto.subtle.importKey("raw", raw, "AES-GCM", false, ["encrypt", "decrypt"]);
+}
+async function encryptWalletPayload(payload, options) {
+  const iv = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));
+  const aesKey = await importAesKey(options.kek);
+  const plaintext = serializePlaintext(payload);
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    aesKey,
+    new Uint8Array(plaintext)
+  );
+  if (options.kdf === EMBEDDED_WALLET_KDF_PBKDF2 && !options.kdfSalt) {
+    throw new EmbeddedWalletVaultError("PBKDF2 encryption requires kdfSalt");
+  }
+  return {
+    version: EMBEDDED_WALLET_VAULT_VERSION,
+    kdf: options.kdf,
+    credentialId: toBase64(options.credentialId),
+    publicAddress: options.publicAddress,
+    iv: toBase64(iv),
+    ciphertext: toBase64(new Uint8Array(ciphertext)),
+    kdfSalt: options.kdfSalt ? toBase64(options.kdfSalt) : "",
+    kdfIterations: options.kdf === EMBEDDED_WALLET_KDF_PBKDF2 ? PBKDF2_ITERATIONS : 0,
+    prfSalt: options.prfSalt ? toBase64(options.prfSalt) : "",
+    backupAcknowledged: options.backupAcknowledged ?? false,
+    backupAcknowledgedAt: options.backupAcknowledged ? (/* @__PURE__ */ new Date()).toISOString() : void 0,
+    createdAt: payload.createdAt
+  };
+}
+async function decryptWalletPayload(vault, kek) {
+  if (vault.version !== EMBEDDED_WALLET_VAULT_VERSION) {
+    throw new EmbeddedWalletVaultError(`Unsupported vault version: ${vault.version}`);
+  }
+  const aesKey = await importAesKey(kek);
+  const iv = fromBase64(vault.iv);
+  const ciphertext = fromBase64(vault.ciphertext);
+  let plaintextBytes;
+  try {
+    plaintextBytes = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: new Uint8Array(iv) },
+      aesKey,
+      new Uint8Array(ciphertext)
+    );
+  } catch (err) {
+    throw new EmbeddedWalletVaultError("Failed to decrypt wallet vault (wrong key or corrupted data)", err);
+  }
+  return deserializePlaintext(new Uint8Array(plaintextBytes));
+}
+function markVaultBackupAcknowledged(vault) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    ...vault,
+    backupAcknowledged: true,
+    backupAcknowledgedAt: now
+  };
+}
+function assertVaultPermitsTransaction(vault) {
+  if (!vault.backupAcknowledged) {
+    throw new EmbeddedWalletBackupRequiredError();
+  }
+}
+
+// src/embeddedWallet/prf.ts
+function detectWebAuthnPrfCapabilities() {
+  if (typeof globalThis.PublicKeyCredential === "undefined") {
+    return {
+      webAuthnAvailable: false,
+      prfLikelySupported: false,
+      prfFallbackReason: "WebAuthn is not available in this environment"
+    };
+  }
+  const ua = typeof navigator !== "undefined" ? navigator.userAgent : "";
+  const isSafari = /Safari/i.test(ua) && !/Chrome|Chromium|CriOS|FxiOS/i.test(ua);
+  if (isSafari) {
+    return {
+      webAuthnAvailable: true,
+      prfLikelySupported: false,
+      prfFallbackReason: "Safari does not support WebAuthn PRF for cross-device QR flows; use PBKDF2 fallback"
+    };
+  }
+  const getCaps = PublicKeyCredential.getClientCapabilities;
+  if (typeof getCaps !== "function") {
+    return {
+      webAuthnAvailable: true,
+      prfLikelySupported: true
+    };
+  }
+  return {
+    webAuthnAvailable: true,
+    prfLikelySupported: true,
+    prfFallbackReason: void 0
+  };
+}
+function readPrfOutput(clientExtensionResults) {
+  const prf = clientExtensionResults?.prf;
+  const first = prf?.results?.first ?? (prf?.results ? Object.values(prf.results)[0] : void 0);
+  if (!first || first.byteLength < 32) {
+    return null;
+  }
+  return new Uint8Array(first).slice(0, 32);
+}
+function selectEmbeddedWalletKdf(caps, prfOutput) {
+  if (caps.prfLikelySupported && prfOutput && prfOutput.length >= 32) {
+    return "webauthn-prf";
+  }
+  return "pbkdf2-passkey";
+}
+
+// src/embeddedWallet/backup.ts
+function exportEncryptedBackup(vault) {
+  return {
+    format: "kingdom-os-embedded-wallet-backup",
+    version: EMBEDDED_WALLET_VAULT_VERSION,
+    vault: structuredClone(vault),
+    exportedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function parseEncryptedBackup(json) {
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch (err) {
+    throw new Error("Backup file is not valid JSON", { cause: err });
+  }
+  if (typeof parsed !== "object" || parsed == null || parsed.format !== "kingdom-os-embedded-wallet-backup" || parsed.version !== EMBEDDED_WALLET_VAULT_VERSION || typeof parsed.vault !== "object") {
+    throw new Error("Unrecognized embedded wallet backup format");
+  }
+  return parsed;
+}
+function serializeBackupFile(backup) {
+  return JSON.stringify(backup, null, 2);
+}
+var WEBAUTHN_RP_NAME = "Kingdom OS";
+var WebAuthnUnavailableError = class extends Error {
+  constructor(message = "WebAuthn is not available in this browser") {
+    super(message);
+    this.name = "WebAuthnUnavailableError";
+  }
+};
+var WebAuthnUserCancelledError = class extends Error {
+  constructor(message = "Passkey request was cancelled") {
+    super(message);
+    this.name = "WebAuthnUserCancelledError";
+  }
+};
+function randomChallenge() {
+  return toBufferSource(crypto.getRandomValues(new Uint8Array(32)));
+}
+function toBufferSource(bytes) {
+  return Uint8Array.from(bytes);
+}
+function resolveRpId(explicit) {
+  if (explicit?.trim()) {
+    return explicit.trim();
+  }
+  if (typeof window !== "undefined" && window.location.hostname) {
+    return window.location.hostname;
+  }
+  throw new EmbeddedWalletVaultError("rpId is required when window.location is unavailable");
+}
+function mapWebAuthnError(err) {
+  if (err instanceof DOMException) {
+    if (err.name === "NotAllowedError") {
+      return new WebAuthnUserCancelledError();
+    }
+    return new EmbeddedWalletVaultError(`WebAuthn failed: ${err.name}`, err);
+  }
+  return err instanceof Error ? err : new EmbeddedWalletVaultError(String(err));
+}
+async function registerPasskey(options) {
+  if (typeof navigator === "undefined" || !navigator.credentials?.create) {
+    throw new WebAuthnUnavailableError();
+  }
+  const rpId = resolveRpId(options.rpId);
+  const prfSalt = options.prfSalt ?? crypto.getRandomValues(new Uint8Array(32));
+  try {
+    const credential = await navigator.credentials.create({
+      publicKey: {
+        challenge: randomChallenge(),
+        rp: { name: WEBAUTHN_RP_NAME, id: rpId },
+        user: {
+          id: toBufferSource(options.userId),
+          name: options.userName,
+          displayName: options.displayName
+        },
+        pubKeyCredParams: [{ alg: -7, type: "public-key" }],
+        authenticatorSelection: {
+          residentKey: "preferred",
+          userVerification: "required"
+        },
+        extensions: {
+          prf: { eval: { first: toBufferSource(prfSalt) } }
+        }
+      }
+    });
+    if (!credential || !(credential.response instanceof AuthenticatorAttestationResponse)) {
+      throw new EmbeddedWalletVaultError("Passkey registration returned no credential");
+    }
+    const prfOutput = readPrfFromExtensions(credential.getClientExtensionResults());
+    return {
+      credentialId: new Uint8Array(credential.rawId),
+      authenticatorData: new Uint8Array(credential.response.getAuthenticatorData()),
+      clientDataJSON: new Uint8Array(credential.response.clientDataJSON),
+      prfOutput,
+      prfSalt
+    };
+  } catch (err) {
+    throw mapWebAuthnError(err);
+  }
+}
+async function assertPasskey(options) {
+  if (typeof navigator === "undefined" || !navigator.credentials?.get) {
+    throw new WebAuthnUnavailableError();
+  }
+  const rpId = resolveRpId(options.rpId);
+  const extensions = {};
+  if (options.prfSalt) {
+    extensions.prf = { eval: { first: toBufferSource(options.prfSalt) } };
+  }
+  try {
+    const assertion = await navigator.credentials.get({
+      publicKey: {
+        challenge: randomChallenge(),
+        rpId,
+        allowCredentials: [{ id: toBufferSource(options.credentialId), type: "public-key" }],
+        userVerification: "required",
+        extensions
+      }
+    });
+    if (!assertion || !(assertion.response instanceof AuthenticatorAssertionResponse)) {
+      throw new EmbeddedWalletVaultError("Passkey assertion returned no credential");
+    }
+    return {
+      credentialId: new Uint8Array(assertion.rawId),
+      authenticatorData: new Uint8Array(assertion.response.authenticatorData),
+      clientDataJSON: new Uint8Array(assertion.response.clientDataJSON),
+      prfOutput: readPrfFromExtensions(assertion.getClientExtensionResults())
+    };
+  } catch (err) {
+    throw mapWebAuthnError(err);
+  }
+}
+function readPrfFromExtensions(results) {
+  const prf = results?.prf;
+  const first = prf?.results?.first;
+  if (!first || first.byteLength < 32) {
+    return null;
+  }
+  return new Uint8Array(first).slice(0, 32);
+}
+function encodeCredentialId(id) {
+  return toBase64(id);
+}
+function decodeCredentialId(encoded) {
+  return fromBase64(encoded);
+}
+var DEFAULT_HD_PATH = "m/44'/118'/0'/0/0";
+async function embeddedPlaintextToSigner(plaintext, prefix = BECH32_PREFIX) {
+  if (plaintext.privateKey.length !== 32) {
+    throw new EmbeddedWalletVaultError(
+      `Invalid secp256k1 private key length: ${plaintext.privateKey.length}`
+    );
+  }
+  return DirectSecp256k1Wallet.fromKey(plaintext.privateKey, prefix);
+}
+function defaultEmbeddedHdPath() {
+  return DEFAULT_HD_PATH;
+}
+
+// src/embeddedWallet/storage.ts
+var DB_NAME = "kingdom-os-wallet";
+var DB_VERSION = 1;
+var STORE_NAME = "vault";
+var PRIMARY_KEY = "primary";
+function openDb() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(DB_NAME, DB_VERSION);
+    request.onerror = () => reject(request.error ?? new Error("IndexedDB open failed"));
+    request.onupgradeneeded = () => {
+      const db = request.result;
+      if (!db.objectStoreNames.contains(STORE_NAME)) {
+        db.createObjectStore(STORE_NAME);
+      }
+    };
+    request.onsuccess = () => resolve(request.result);
+  });
+}
+async function saveVaultToIndexedDb(vault) {
+  const db = await openDb();
+  await new Promise((resolve, reject) => {
+    const tx = db.transaction(STORE_NAME, "readwrite");
+    tx.objectStore(STORE_NAME).put(vault, PRIMARY_KEY);
+    tx.oncomplete = () => resolve();
+    tx.onerror = () => reject(tx.error ?? new Error("IndexedDB write failed"));
+  });
+  db.close();
+}
+async function loadVaultFromIndexedDb() {
+  const db = await openDb();
+  const vault = await new Promise((resolve, reject) => {
+    const tx = db.transaction(STORE_NAME, "readonly");
+    const request = tx.objectStore(STORE_NAME).get(PRIMARY_KEY);
+    request.onsuccess = () => resolve(request.result ?? null);
+    request.onerror = () => reject(request.error ?? new Error("IndexedDB read failed"));
+  });
+  db.close();
+  return vault;
+}
+async function clearVaultFromIndexedDb() {
+  const db = await openDb();
+  await new Promise((resolve, reject) => {
+    const tx = db.transaction(STORE_NAME, "readwrite");
+    tx.objectStore(STORE_NAME).delete(PRIMARY_KEY);
+    tx.oncomplete = () => resolve();
+    tx.onerror = () => reject(tx.error ?? new Error("IndexedDB delete failed"));
+  });
+  db.close();
+}
+var activeSession = null;
+async function deriveKekFromPasskeyMaterial(vault, prfOutput, authenticatorData, clientDataJSON) {
+  const caps = detectWebAuthnPrfCapabilities();
+  const kdf = selectEmbeddedWalletKdf(caps, prfOutput);
+  if (kdf === EMBEDDED_WALLET_KDF_PRF && prfOutput) {
+    return deriveKekFromPrf(prfOutput);
+  }
+  if (vault.kdf !== EMBEDDED_WALLET_KDF_PBKDF2 || !vault.kdfSalt) {
+    throw new EmbeddedWalletVaultError("Vault expects PBKDF2 but passkey material unavailable");
+  }
+  const salt = decodeCredentialId(vault.kdfSalt);
+  const material = createPasskeyMaterialFromAssertion(authenticatorData, clientDataJSON);
+  return deriveKekFromPbkdf2(material, salt, vault.kdfIterations || void 0);
+}
+async function unlockVaultToSession(vault) {
+  const credentialId = decodeCredentialId(vault.credentialId);
+  const prfSalt = vault.prfSalt ? decodeCredentialId(vault.prfSalt) : void 0;
+  const assertion = await assertPasskey({ credentialId, rpId: void 0, prfSalt });
+  const kek = await deriveKekFromPasskeyMaterial(
+    vault,
+    assertion.prfOutput,
+    assertion.authenticatorData,
+    assertion.clientDataJSON
+  );
+  const plaintext = await decryptWalletPayload(vault, kek);
+  const signer = await embeddedPlaintextToSigner(plaintext);
+  const [account] = await signer.getAccounts();
+  const session = { address: account.address, vault, signer };
+  activeSession = session;
+  return session;
+}
+async function hasEmbeddedWallet() {
+  const vault = await loadVaultFromIndexedDb();
+  return vault != null;
+}
+async function createEmbeddedWallet(options) {
+  const registration = await registerPasskey({
+    userId: options.userId,
+    userName: options.userName,
+    displayName: options.displayName,
+    rpId: options.rpId
+  });
+  const privateKey = Random.getBytes(32);
+  const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+  const plaintext = {
+    privateKey,
+    hdPath: defaultEmbeddedHdPath(),
+    createdAt
+  };
+  const previewSigner = await embeddedPlaintextToSigner(plaintext);
+  const [account] = await previewSigner.getAccounts();
+  const caps = detectWebAuthnPrfCapabilities();
+  const kdf = selectEmbeddedWalletKdf(caps, registration.prfOutput);
+  let kek;
+  let kdfSalt;
+  let prfSalt;
+  if (kdf === EMBEDDED_WALLET_KDF_PRF && registration.prfOutput) {
+    kek = await deriveKekFromPrf(registration.prfOutput);
+    prfSalt = registration.prfSalt;
+  } else {
+    kdfSalt = createPbkdf2Salt();
+    const material = createPasskeyMaterialFromAssertion(
+      registration.authenticatorData,
+      registration.clientDataJSON
+    );
+    kek = await deriveKekFromPbkdf2(material, kdfSalt);
+  }
+  const vault = await encryptWalletPayload(plaintext, {
+    kdf,
+    credentialId: registration.credentialId,
+    publicAddress: account.address,
+    kek,
+    kdfSalt,
+    prfSalt,
+    backupAcknowledged: false
+  });
+  await saveVaultToIndexedDb(vault);
+  lockEmbeddedWallet();
+  return { address: account.address, vault };
+}
+async function unlockEmbeddedWallet() {
+  const vault = await loadVaultFromIndexedDb();
+  if (!vault) {
+    throw new EmbeddedWalletVaultError("No embedded wallet found on this device");
+  }
+  return unlockVaultToSession(vault);
+}
+function lockEmbeddedWallet() {
+  activeSession = null;
+}
+function getEmbeddedWalletSession() {
+  return activeSession;
+}
+function getEmbeddedOfflineSigner() {
+  if (!activeSession) {
+    throw new EmbeddedWalletVaultError("Embedded wallet is locked");
+  }
+  assertVaultPermitsTransaction(activeSession.vault);
+  const inner = activeSession.signer;
+  return {
+    getAccounts: () => inner.getAccounts(),
+    signDirect: (signerAddress, signDoc) => inner.signDirect(signerAddress, signDoc)
+  };
+}
+async function acknowledgeEmbeddedBackup() {
+  const vault = await loadVaultFromIndexedDb();
+  if (!vault) {
+    throw new EmbeddedWalletVaultError("No embedded wallet found on this device");
+  }
+  const updated = markVaultBackupAcknowledged(vault);
+  await saveVaultToIndexedDb(updated);
+  if (activeSession) {
+    activeSession = { ...activeSession, vault: updated };
+  }
+  return exportEncryptedBackup(updated);
+}
+function downloadEmbeddedBackupFile(backup, filename) {
+  const blob = new Blob([serializeBackupFile(backup)], { type: "application/json" });
+  const url = URL.createObjectURL(blob);
+  const anchor = document.createElement("a");
+  anchor.href = url;
+  anchor.download = filename ?? `kingdom-os-wallet-backup-${backup.vault.publicAddress}.json`;
+  anchor.click();
+  URL.revokeObjectURL(url);
+}
+async function importEmbeddedBackup(json) {
+  const backup = parseEncryptedBackup(json);
+  await saveVaultToIndexedDb(backup.vault);
+  lockEmbeddedWallet();
+  return backup.vault;
+}
+async function clearEmbeddedWallet() {
+  lockEmbeddedWallet();
+  await clearVaultFromIndexedDb();
+}
 
 // src/submitApplication.ts
 function buildSubmitApplicationMsg(applicantWallet, applicationId, attestationInput, signature) {
@@ -1718,6 +2448,6 @@ async function signCitizenshipAttestation(params) {
   return { signature, input };
 }
 
-export { ATTESTATION_TYPE_CITIZENSHIP_APPLICATION, ATTESTATION_TYPE_RECOVERY, ApplicationStatus, BECH32_PREFIX, CHAIN_COIN_TYPE, DEFAULT_CHAIN_ID, DEFAULT_REST_URL, DEFAULT_RPC_URL, InvalidChainConfigError, MsgSubmitApplication, MsgSubmitRecoveryAttestation, RecoveryAttestationStatus, RpcConnectionError, UKDR_DECIMALS, UKDR_DISPLAY_DENOM, UKDR_MINIMAL_DENOM, WalletAccountError, WalletConnectionError, WalletConnectionRejectedError, WalletNotInstalledError, attestationSignPayload, buildKingdomChainInfo, buildSubmitApplicationMsg, connectKeplr, connectLeap, createBrowserSigningClient, createKingdomChainRegistry, isKeplrAvailable, isLeapAvailable, providerSeedFromHex, publicKeyFromPrivateSeed, signAttestationPayload, signCitizenshipAttestation, suggestAndConnect, validateChainConfig };
+export { ATTESTATION_TYPE_CITIZENSHIP_APPLICATION, ATTESTATION_TYPE_RECOVERY, ApplicationStatus, BECH32_PREFIX, CHAIN_COIN_TYPE, DEFAULT_CHAIN_ID, DEFAULT_REST_URL, DEFAULT_RPC_URL, EMBEDDED_WALLET_KDF_PBKDF2, EMBEDDED_WALLET_KDF_PRF, EMBEDDED_WALLET_VAULT_VERSION, EmbeddedWalletBackupRequiredError, EmbeddedWalletVaultError, InvalidChainConfigError, MsgSubmitApplication, MsgSubmitRecoveryAttestation, RecoveryAttestationStatus, RpcConnectionError, UKDR_DECIMALS, UKDR_DISPLAY_DENOM, UKDR_MINIMAL_DENOM, WALLETCONNECT_COSMOS_METHODS, WALLETCONNECT_COSMOS_NAMESPACE, WEBAUTHN_RP_NAME, WalletAccountError, WalletConnectNotInitializedError, WalletConnectSessionError, WalletConnectSigningError, WalletConnectionError, WalletConnectionRejectedError, WalletNotInstalledError, WebAuthnUnavailableError, WebAuthnUserCancelledError, acknowledgeEmbeddedBackup, assertPasskey, assertVaultPermitsTransaction, attestationSignPayload, buildKingdomChainInfo, buildRequiredCosmosNamespaces, buildSubmitApplicationMsg, clearEmbeddedWallet, clearVaultFromIndexedDb, connectCosmostation, connectKeplr, connectLeap, connectWalletConnect, createBrowserSigningClient, createEmbeddedWallet, createKingdomChainRegistry, createPasskeyMaterialFromAssertion, createPbkdf2Salt, createWalletConnectOfflineSigner, decodeCredentialId, decryptWalletPayload, defaultEmbeddedHdPath, deriveKekFromPbkdf2, deriveKekFromPrf, detectWebAuthnPrfCapabilities, disconnectWalletConnect, downloadEmbeddedBackupFile, embeddedPlaintextToSigner, encodeCredentialId, encryptWalletPayload, exportEncryptedBackup, getCosmostationKeplrApi, getEmbeddedOfflineSigner, getEmbeddedWalletSession, hasEmbeddedWallet, importEmbeddedBackup, initWalletConnectClient, isCosmostationAvailable, isKeplrAvailable, isLeapAvailable, loadVaultFromIndexedDb, lockEmbeddedWallet, markVaultBackupAcknowledged, parseEncryptedBackup, parseWalletConnectAccount, providerSeedFromHex, publicKeyFromPrivateSeed, readPrfOutput, registerPasskey, restoreWalletConnectSession, saveVaultToIndexedDb, selectEmbeddedWalletKdf, serializeBackupFile, signAttestationPayload, signCitizenshipAttestation, suggestAndConnect, toWalletConnectCosmosChainId, unlockEmbeddedWallet, validateChainConfig };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map