@kingdomchain/wallet-client 0.6.3 → 0.8.1

package/dist/index.js

@@ -1940,6 +1940,7 @@ var EMBEDDED_WALLET_VAULT_VERSION = 1;
 var EMBEDDED_WALLET_KDF_PRF = "webauthn-prf";
 var EMBEDDED_WALLET_KDF_PBKDF2 = "pbkdf2-passkey";
 var EMBEDDED_WALLET_KDF_PIN = "pbkdf2-pin";
+var EMBEDDED_WALLET_KDF_DEVICE_PIN = "device-pin";
 var EMBEDDED_WALLET_KEY_HD_DERIVED = "hd-derived";
 var EMBEDDED_WALLET_KEY_DIRECT_ENTROPY = "direct-entropy";
 var EMBEDDED_WALLET_RECOVERY_PHRASE_GENERAL_WARNING = {
@@ -1994,6 +1995,23 @@ var EmbeddedWalletWeakPasscodeError = class extends Error {
     this.reason = reason;
   }
 };
+var EmbeddedWalletPasskeyUnsupportedError = class extends EmbeddedWalletVaultError {
+  code = "passkey_prf_unsupported";
+  constructor(message = "This device cannot protect the wallet with a passkey; keep using the passcode") {
+    super(message);
+    this.name = "EmbeddedWalletPasskeyUnsupportedError";
+  }
+};
+var EmbeddedWalletQuickUnlockError = class extends Error {
+  code;
+  attemptsLeft;
+  constructor(code, message, attemptsLeft) {
+    super(message);
+    this.name = "EmbeddedWalletQuickUnlockError";
+    this.code = code;
+    this.attemptsLeft = attemptsLeft;
+  }
+};
 var DEFAULT_HD_PATH = "m/44'/118'/0'/0/0";
 async function embeddedPlaintextToSigner(plaintext, prefix = BECH32_PREFIX) {
   if (plaintext.privateKey.length !== 32) {
@@ -2321,6 +2339,30 @@ function assertVaultPermitsTransaction(vault) {
     throw new EmbeddedWalletBackupRequiredError();
   }
 }
+async function encryptPlaintextWithKek(payload, kek) {
+  const iv = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));
+  const aesKey = await importAesKey(kek);
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    aesKey,
+    new Uint8Array(serializePlaintext(payload))
+  );
+  return { iv: toBase64(iv), ciphertext: toBase64(new Uint8Array(ciphertext)) };
+}
+async function decryptPlaintextWithKek(iv, ciphertext, kek) {
+  const aesKey = await importAesKey(kek);
+  let plaintextBytes;
+  try {
+    plaintextBytes = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: new Uint8Array(fromBase64(iv)) },
+      aesKey,
+      new Uint8Array(fromBase64(ciphertext))
+    );
+  } catch (err) {
+    throw new EmbeddedWalletDecryptError(err);
+  }
+  return deserializePlaintext(new Uint8Array(plaintextBytes));
+}
 
 // src/embeddedWallet/prf.ts
 function detectWebAuthnPrfCapabilities() {
@@ -2331,15 +2373,6 @@ function detectWebAuthnPrfCapabilities() {
       prfFallbackReason: "WebAuthn is not available in this environment"
     };
   }
-  const ua = typeof navigator !== "undefined" ? navigator.userAgent : "";
-  const isSafari = /Safari/i.test(ua) && !/Chrome|Chromium|CriOS|FxiOS/i.test(ua);
-  if (isSafari) {
-    return {
-      webAuthnAvailable: true,
-      prfLikelySupported: false,
-      prfFallbackReason: "Safari does not support WebAuthn PRF for cross-device QR flows; use PBKDF2 fallback"
-    };
-  }
   const getCaps = PublicKeyCredential.getClientCapabilities;
   if (typeof getCaps !== "function") {
     return {
@@ -2370,6 +2403,11 @@ function selectEmbeddedWalletKdf(caps, prfOutput) {
 
 // src/embeddedWallet/backup.ts
 function exportEncryptedBackup(vault) {
+  if (vault.kdf === "device-pin") {
+    throw new Error(
+      "A PIN wallet is bound to this device and has no backup file; its backup is the 24-word recovery phrase"
+    );
+  }
   return {
     format: "kingdom-os-embedded-wallet-backup",
     version: EMBEDDED_WALLET_VAULT_VERSION,
@@ -2519,10 +2557,11 @@ function decodeCredentialId(encoded) {
 
 // src/embeddedWallet/storage.ts
 var DB_NAME = "kingdom-os-wallet";
-var DB_VERSION = 3;
+var DB_VERSION = 4;
 var VAULT_STORE_NAME = "vault";
 var LOCKOUT_STORE_NAME = "passcode-lockout";
 var SESSION_STORE_NAME = "session-cache";
+var QUICK_UNLOCK_STORE_NAME = "quick-unlock";
 var VAULT_LEGACY_KEY = "primary";
 function resolveVaultStorageKey(scopeId) {
   const trimmed = scopeId?.trim();
@@ -2543,6 +2582,9 @@ function openDb() {
       if (!db.objectStoreNames.contains(SESSION_STORE_NAME)) {
         db.createObjectStore(SESSION_STORE_NAME);
       }
+      if (!db.objectStoreNames.contains(QUICK_UNLOCK_STORE_NAME)) {
+        db.createObjectStore(QUICK_UNLOCK_STORE_NAME);
+      }
     };
     request.onsuccess = () => resolve(request.result);
   });
@@ -2651,6 +2693,40 @@ async function clearSessionCacheRecord(options = {}) {
   });
   db.close();
 }
+async function saveQuickUnlockRecord(record, options = {}) {
+  const key = resolveVaultStorageKey(options.scopeId);
+  const db = await openDb();
+  await new Promise((resolve, reject) => {
+    const tx = db.transaction(QUICK_UNLOCK_STORE_NAME, "readwrite");
+    tx.objectStore(QUICK_UNLOCK_STORE_NAME).put(record, key);
+    tx.oncomplete = () => resolve();
+    tx.onerror = () => reject(tx.error ?? new Error("IndexedDB write failed"));
+  });
+  db.close();
+}
+async function loadQuickUnlockRecord(options = {}) {
+  const key = resolveVaultStorageKey(options.scopeId);
+  const db = await openDb();
+  const record = await new Promise((resolve, reject) => {
+    const tx = db.transaction(QUICK_UNLOCK_STORE_NAME, "readonly");
+    const request = tx.objectStore(QUICK_UNLOCK_STORE_NAME).get(key);
+    request.onsuccess = () => resolve(request.result ?? null);
+    request.onerror = () => reject(request.error ?? new Error("IndexedDB read failed"));
+  });
+  db.close();
+  return record;
+}
+async function clearQuickUnlockRecord(options = {}) {
+  const key = resolveVaultStorageKey(options.scopeId);
+  const db = await openDb();
+  await new Promise((resolve, reject) => {
+    const tx = db.transaction(QUICK_UNLOCK_STORE_NAME, "readwrite");
+    tx.objectStore(QUICK_UNLOCK_STORE_NAME).delete(key);
+    tx.oncomplete = () => resolve();
+    tx.onerror = () => reject(tx.error ?? new Error("IndexedDB delete failed"));
+  });
+  db.close();
+}
 var EMBEDDED_WALLET_SESSION_TTL_MS = 12 * 60 * 60 * 1e3;
 var AES_GCM_IV_BYTES2 = 12;
 function serializeSessionPlaintext(plaintext) {
@@ -2890,10 +2966,264 @@ function assertPasscodeAllowedForCreation(passcode) {
     throw new EmbeddedWalletWeakPasscodeError(strength.blockReason ?? "too_weak");
   }
 }
+var QUICK_UNLOCK_PIN_LENGTH = 6;
+var QUICK_UNLOCK_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var QUICK_UNLOCK_MAX_ATTEMPTS = 5;
+var QUICK_UNLOCK_PBKDF2_ITERATIONS = 6e5;
+var AES_GCM_IV_BYTES3 = 12;
+function assertQuickUnlockPinAllowed(pin) {
+  if (typeof pin !== "string" || !new RegExp(`^\\d{${QUICK_UNLOCK_PIN_LENGTH}}$`).test(pin)) {
+    throw new EmbeddedWalletQuickUnlockError(
+      "invalid_pin",
+      `PIN must be exactly ${QUICK_UNLOCK_PIN_LENGTH} digits`
+    );
+  }
+  if (isTrivialPin(pin)) {
+    throw new EmbeddedWalletQuickUnlockError(
+      "invalid_pin",
+      "PIN is too easy to guess; avoid repeats and sequences like 123456"
+    );
+  }
+}
+function isTrivialPin(pin) {
+  const digits = pin.split("").map(Number);
+  const steps = digits.slice(1).map((d, i) => d - digits[i]);
+  if (steps.every((s) => s === 0)) return true;
+  if (steps.every((s) => s === 1) || steps.every((s) => s === -1)) return true;
+  for (const period of [2, 3]) {
+    if (pin === pin.slice(0, period).repeat(pin.length / period)) return true;
+  }
+  return false;
+}
+async function derivePinKey(pin, salt, iterations) {
+  const material = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(pin),
+    "PBKDF2",
+    false,
+    ["deriveKey"]
+  );
+  return crypto.subtle.deriveKey(
+    { name: "PBKDF2", salt: new Uint8Array(salt), iterations, hash: "SHA-256" },
+    material,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function createQuickUnlockRecord(options) {
+  const { plaintext, publicAddress, pin, ttlMs, iterations, ...storageOptions } = options;
+  assertQuickUnlockPinAllowed(pin);
+  const rounds = iterations ?? QUICK_UNLOCK_PBKDF2_ITERATIONS;
+  const salt = crypto.getRandomValues(new Uint8Array(32));
+  const pinKey = await derivePinKey(pin, salt, rounds);
+  const deviceKey = await crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, [
+    "encrypt",
+    "decrypt"
+  ]);
+  const innerIv = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES3));
+  const inner = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv: innerIv },
+    pinKey,
+    new Uint8Array(serializePlaintext(plaintext))
+  );
+  const outerIv = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES3));
+  const outer = await crypto.subtle.encrypt({ name: "AES-GCM", iv: outerIv }, deviceKey, inner);
+  const record = {
+    deviceKey,
+    publicAddress,
+    salt: toBase64(salt),
+    iterations: rounds,
+    innerIv: toBase64(innerIv),
+    outerIv: toBase64(outerIv),
+    ciphertext: toBase64(new Uint8Array(outer)),
+    expiresAt: Date.now() + (ttlMs ?? QUICK_UNLOCK_TTL_MS),
+    failedAttempts: 0
+  };
+  await saveQuickUnlockRecord(record, storageOptions);
+  return record;
+}
+async function openQuickUnlockRecord(options) {
+  const { pin, ...storageOptions } = options;
+  if (typeof pin !== "string" || !/^\d+$/.test(pin) || pin.length !== QUICK_UNLOCK_PIN_LENGTH) {
+    throw new EmbeddedWalletQuickUnlockError(
+      "invalid_pin",
+      `PIN must be exactly ${QUICK_UNLOCK_PIN_LENGTH} digits`
+    );
+  }
+  const record = await loadQuickUnlockRecord(storageOptions);
+  if (!record) {
+    throw new EmbeddedWalletQuickUnlockError("not_set", "No PIN is set up on this device");
+  }
+  if (typeof record.expiresAt !== "number" || Date.now() >= record.expiresAt) {
+    throw new EmbeddedWalletQuickUnlockError(
+      "expired",
+      "PIN expired; unlock with Face ID or your passcode"
+    );
+  }
+  const attempt = (record.failedAttempts ?? 0) + 1;
+  await saveQuickUnlockRecord({ ...record, failedAttempts: attempt }, storageOptions);
+  let inner;
+  try {
+    inner = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: new Uint8Array(fromBase64(record.outerIv)) },
+      record.deviceKey,
+      new Uint8Array(fromBase64(record.ciphertext))
+    );
+  } catch {
+    await clearQuickUnlockRecord(storageOptions).catch(() => void 0);
+    throw new EmbeddedWalletQuickUnlockError("not_set", "PIN record is unusable on this device");
+  }
+  const pinKey = await derivePinKey(pin, fromBase64(record.salt), record.iterations);
+  let plaintextBytes;
+  try {
+    plaintextBytes = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: new Uint8Array(fromBase64(record.innerIv)) },
+      pinKey,
+      inner
+    );
+  } catch {
+    if (attempt >= QUICK_UNLOCK_MAX_ATTEMPTS) {
+      await clearQuickUnlockRecord(storageOptions).catch(() => void 0);
+      throw new EmbeddedWalletQuickUnlockError(
+        "wiped",
+        "Too many wrong PINs; unlock with Face ID or your passcode"
+      );
+    }
+    throw new EmbeddedWalletQuickUnlockError(
+      "wrong_pin",
+      "Wrong PIN",
+      QUICK_UNLOCK_MAX_ATTEMPTS - attempt
+    );
+  }
+  await saveQuickUnlockRecord({ ...record, failedAttempts: 0 }, storageOptions);
+  return {
+    plaintext: deserializePlaintext(new Uint8Array(plaintextBytes)),
+    publicAddress: record.publicAddress
+  };
+}
+async function getQuickUnlockStatus(options = {}) {
+  const record = await loadQuickUnlockRecord(options);
+  if (!record) {
+    return {
+      enabled: false,
+      expired: false,
+      expiresAt: null,
+      attemptsLeft: QUICK_UNLOCK_MAX_ATTEMPTS,
+      publicAddress: null
+    };
+  }
+  return {
+    enabled: true,
+    expired: typeof record.expiresAt !== "number" || Date.now() >= record.expiresAt,
+    expiresAt: record.expiresAt,
+    attemptsLeft: Math.max(0, QUICK_UNLOCK_MAX_ATTEMPTS - (record.failedAttempts ?? 0)),
+    publicAddress: record.publicAddress
+  };
+}
+async function refreshQuickUnlockExpiry(options) {
+  const { publicAddress, ttlMs, ...storageOptions } = options;
+  const record = await loadQuickUnlockRecord(storageOptions);
+  if (!record) return;
+  if (record.publicAddress !== publicAddress) {
+    await clearQuickUnlockRecord(storageOptions);
+    return;
+  }
+  await saveQuickUnlockRecord(
+    { ...record, expiresAt: Date.now() + (ttlMs ?? QUICK_UNLOCK_TTL_MS), failedAttempts: 0 },
+    storageOptions
+  );
+}
+async function clearQuickUnlock(options = {}) {
+  await clearQuickUnlockRecord(options);
+}
+var DEVICE_PIN_PBKDF2_ITERATIONS = 6e5;
+var AES_GCM_IV_BYTES4 = 12;
+function vaultUsesPinUnlock(vault) {
+  return vault.kdf === EMBEDDED_WALLET_KDF_DEVICE_PIN;
+}
+async function encryptPlaintextWithDevicePin(plaintext, pin, options) {
+  assertQuickUnlockPinAllowed(pin);
+  const iterations = options.iterations ?? DEVICE_PIN_PBKDF2_ITERATIONS;
+  const salt = crypto.getRandomValues(new Uint8Array(32));
+  const pinKey = await derivePinKey(pin, salt, iterations);
+  const deviceKey = await crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, [
+    "encrypt",
+    "decrypt"
+  ]);
+  const iv = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES4));
+  const inner = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    pinKey,
+    new Uint8Array(serializePlaintext(plaintext))
+  );
+  const deviceIv = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES4));
+  const outer = await crypto.subtle.encrypt({ name: "AES-GCM", iv: deviceIv }, deviceKey, inner);
+  const acknowledged = options.backupAcknowledged ?? false;
+  return {
+    version: EMBEDDED_WALLET_VAULT_VERSION,
+    kdf: EMBEDDED_WALLET_KDF_DEVICE_PIN,
+    credentialId: "",
+    publicAddress: options.publicAddress,
+    iv: toBase64(iv),
+    ciphertext: toBase64(new Uint8Array(outer)),
+    kdfSalt: toBase64(salt),
+    kdfIterations: iterations,
+    prfSalt: "",
+    backupAcknowledged: acknowledged,
+    backupAcknowledgedAt: acknowledged ? (/* @__PURE__ */ new Date()).toISOString() : void 0,
+    createdAt: plaintext.createdAt,
+    deviceKey,
+    deviceIv: toBase64(deviceIv)
+  };
+}
+async function decryptDevicePinVault(vault, pin) {
+  if (!vaultUsesPinUnlock(vault)) {
+    throw new EmbeddedWalletVaultError("Vault does not use PIN unlock");
+  }
+  if (typeof pin !== "string" || !new RegExp(`^\\d{${QUICK_UNLOCK_PIN_LENGTH}}$`).test(pin)) {
+    throw new EmbeddedWalletQuickUnlockError(
+      "invalid_pin",
+      `PIN must be exactly ${QUICK_UNLOCK_PIN_LENGTH} digits`
+    );
+  }
+  if (!vault.deviceKey || !vault.deviceIv) {
+    throw new EmbeddedWalletVaultError(
+      "This wallet's device key is missing; recover it with your 24 words"
+    );
+  }
+  let inner;
+  try {
+    inner = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: new Uint8Array(fromBase64(vault.deviceIv)) },
+      vault.deviceKey,
+      new Uint8Array(fromBase64(vault.ciphertext))
+    );
+  } catch (err) {
+    throw new EmbeddedWalletVaultError(
+      "This wallet's device layer is damaged; recover it with your 24 words",
+      err
+    );
+  }
+  const pinKey = await derivePinKey(pin, fromBase64(vault.kdfSalt), vault.kdfIterations);
+  let plaintext;
+  try {
+    plaintext = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: new Uint8Array(fromBase64(vault.iv)) },
+      pinKey,
+      inner
+    );
+  } catch (err) {
+    throw new EmbeddedWalletDecryptError(err);
+  }
+  return deserializePlaintext(new Uint8Array(plaintext));
+}
 
 // src/embeddedWallet/wallet.ts
 var activeSession = null;
 var activeScopeId;
+var activePlaintext = null;
+var activeUnlockWasStrong = false;
 function resolveScopeId(scopeId) {
   const trimmed = scopeId?.trim();
   return trimmed || void 0;
@@ -2910,6 +3240,12 @@ function vaultUsesPasskeyUnlock(vault) {
 function vaultUsesPasscodeUnlock(vault) {
   return vault.kdf === EMBEDDED_WALLET_KDF_PIN;
 }
+function vaultHasPasskeyUnlock(vault) {
+  return Boolean(vault.passkeyWrap) || vaultUsesPasskeyUnlock(vault);
+}
+function vaultPersistsSessionCache(vault) {
+  return !(vaultUsesPinUnlock(vault) || Boolean(vault.passkeyWrap));
+}
 function isPasscodeDecryptFailure(err) {
   return err instanceof EmbeddedWalletDecryptError;
 }
@@ -2932,6 +3268,28 @@ async function decryptVaultWithPasscodeProtected(vault, passcode) {
     throw err;
   }
 }
+async function decryptVaultWithPinProtected(vault, pin) {
+  if (!pin) {
+    throw new EmbeddedWalletVaultError("PIN is required to unlock this wallet");
+  }
+  await assertPasscodeUnlockAllowed(vault.publicAddress);
+  try {
+    const plaintext = await decryptDevicePinVault(vault, pin);
+    await recordPasscodeUnlockSuccess(vault.publicAddress);
+    return plaintext;
+  } catch (err) {
+    if (isPasscodeDecryptFailure(err)) {
+      await recordPasscodeUnlockFailure(vault.publicAddress);
+    }
+    throw err;
+  }
+}
+async function decryptVaultWithSecret(vault, secret) {
+  if (vaultUsesPinUnlock(vault)) {
+    return decryptVaultWithPinProtected(vault, secret.pin);
+  }
+  return decryptVaultWithPasscodeProtected(vault, secret.passcode);
+}
 async function deriveKekFromPasskeyMaterial(vault, prfOutput, authenticatorData, clientDataJSON) {
   const caps = detectWebAuthnPrfCapabilities();
   const kdf = selectEmbeddedWalletKdf(caps, prfOutput);
@@ -2987,40 +3345,27 @@ async function encryptPlaintextWithPasscode(plaintext, passcode, backupAcknowled
   });
   return { address: account.address, vault };
 }
-async function encryptPlaintextWithPasskeyRegistration(plaintext, registration, backupAcknowledged = false) {
-  const previewSigner = await embeddedPlaintextToSigner(plaintext);
-  const [account] = await previewSigner.getAccounts();
-  const caps = detectWebAuthnPrfCapabilities();
-  const kdf = selectEmbeddedWalletKdf(caps, registration.prfOutput);
-  let kek;
-  let kdfSalt;
-  let prfSalt;
-  if (kdf === EMBEDDED_WALLET_KDF_PRF && registration.prfOutput) {
-    kek = await deriveKekFromPrf(registration.prfOutput);
-    prfSalt = registration.prfSalt;
-  } else {
-    kdfSalt = createPbkdf2Salt();
-    const material = createPasskeyMaterialFromAssertion(
-      registration.authenticatorData,
-      registration.clientDataJSON
-    );
-    kek = await deriveKekFromPbkdf2(material, kdfSalt);
+async function encryptPlaintextWithSecret(plaintext, secret, backupAcknowledged = false) {
+  if (secret.pin != null) {
+    const signer = await embeddedPlaintextToSigner(plaintext);
+    const [account] = await signer.getAccounts();
+    const vault = await encryptPlaintextWithDevicePin(plaintext, secret.pin, {
+      publicAddress: account.address,
+      backupAcknowledged
+    });
+    return { address: account.address, vault };
   }
-  const vault = await encryptWalletPayload(plaintext, {
-    kdf,
-    credentialId: registration.credentialId,
-    publicAddress: account.address,
-    kek,
-    kdfSalt,
-    prfSalt,
-    backupAcknowledged
-  });
-  return { address: account.address, vault };
+  if (secret.passcode == null) {
+    throw new EmbeddedWalletVaultError("A PIN (or legacy passcode) is required");
+  }
+  return encryptPlaintextWithPasscode(plaintext, secret.passcode, backupAcknowledged);
 }
 async function unlockVaultToSession(vault, options = {}) {
   const scopeId = scopeFromOptions(options);
   let plaintext;
-  if (vaultUsesPasscodeUnlock(vault)) {
+  if (vaultUsesPinUnlock(vault)) {
+    plaintext = await decryptVaultWithPinProtected(vault, options.pin);
+  } else if (vaultUsesPasscodeUnlock(vault)) {
     plaintext = await decryptVaultWithPasscodeProtected(vault, options.passcode);
   } else {
     const credentialId = decodeCredentialId(vault.credentialId);
@@ -3028,14 +3373,32 @@ async function unlockVaultToSession(vault, options = {}) {
     const assertion = await assertPasskey({ credentialId, rpId: void 0, prfSalt });
     plaintext = await decryptVaultWithUnlockMaterial(vault, void 0, assertion);
   }
+  return establishSession(vault, plaintext, scopeId, { strong: true });
+}
+async function establishSession(vault, plaintext, scopeId, options) {
   const signer = await embeddedPlaintextToSigner(plaintext);
   const [account] = await signer.getAccounts();
   const session = { address: account.address, vault, signer };
   activeSession = session;
   activeScopeId = scopeId;
-  try {
-    await cacheUnlockedSession({ scopeId, plaintext });
-  } catch {
+  activePlaintext = plaintext;
+  activeUnlockWasStrong = options.strong;
+  if (vaultPersistsSessionCache(vault)) {
+    try {
+      await cacheUnlockedSession({ scopeId, plaintext });
+    } catch {
+    }
+  } else {
+    try {
+      await clearUnlockedSession({ scopeId });
+    } catch {
+    }
+  }
+  if (options.strong) {
+    try {
+      await refreshQuickUnlockExpiry({ scopeId, publicAddress: account.address });
+    } catch {
+    }
   }
   return session;
 }
@@ -3076,7 +3439,7 @@ async function createEmbeddedWallet(options) {
   }
   const createdAt = (/* @__PURE__ */ new Date()).toISOString();
   const plaintext = await createHdDerivedPlaintext(createdAt);
-  const { address, vault } = await encryptPlaintextWithPasscode(plaintext, options.passcode);
+  const { address, vault } = await encryptPlaintextWithSecret(plaintext, options);
   await saveVaultToIndexedDb(vault, { scopeId });
   lockEmbeddedWallet();
   activeScopeId = scopeId;
@@ -3089,7 +3452,11 @@ async function revealEmbeddedRecoveryPhrase(options = {}) {
     throw new EmbeddedWalletVaultError("No embedded wallet found on this device");
   }
   let plaintext;
-  if (vaultUsesPasscodeUnlock(vault)) {
+  if ((vaultUsesPasscodeUnlock(vault) || vaultUsesPinUnlock(vault)) && !options.passcode && !options.pin && vault.passkeyWrap) {
+    plaintext = await decryptPasskeyWrap(vault);
+  } else if (vaultUsesPinUnlock(vault)) {
+    plaintext = await decryptVaultWithPinProtected(vault, options.pin);
+  } else if (vaultUsesPasscodeUnlock(vault)) {
     plaintext = await decryptVaultWithPasscodeProtected(vault, options.passcode);
   } else {
     const credentialId = decodeCredentialId(vault.credentialId);
@@ -3145,7 +3512,7 @@ async function recoverEmbeddedWalletFromMnemonic(options) {
       "Recovered wallet address does not match expectedAddress"
     );
   }
-  const result = await encryptPlaintextWithPasscode(plaintext, options.passcode);
+  const result = await encryptPlaintextWithSecret(plaintext, options);
   if (result.address !== address) {
     throw new EmbeddedWalletVaultError("Internal error: recovered address mismatch");
   }
@@ -3154,41 +3521,220 @@ async function recoverEmbeddedWalletFromMnemonic(options) {
   activeScopeId = scopeId;
   return { address: result.address, vault: result.vault, keyType };
 }
+function activePlaintextFor(scopeId, vault) {
+  if (!activePlaintext || !activeSession) return null;
+  if (activeScopeId !== scopeId) return null;
+  if (activeSession.address !== vault.publicAddress) return null;
+  return activePlaintext;
+}
 async function enableEmbeddedPasskeyUnlock(options) {
   const scopeId = scopeFromOptions(options) ?? activeScopeId;
   const vault = await loadVaultForScope(scopeId);
   if (!vault) {
     throw new EmbeddedWalletVaultError("No embedded wallet found on this device");
   }
-  if (vaultUsesPasskeyUnlock(vault)) {
+  if (vaultHasPasskeyUnlock(vault)) {
     throw new EmbeddedWalletVaultError("Passkey unlock is already enabled for this wallet");
   }
-  if (!vaultUsesPasscodeUnlock(vault)) {
+  if (!vaultUsesPasscodeUnlock(vault) && !vaultUsesPinUnlock(vault)) {
     throw new EmbeddedWalletVaultError("Unsupported vault unlock method for passkey upgrade");
   }
-  const addressBefore = vault.publicAddress;
-  const backupAcknowledged = vault.backupAcknowledged;
-  const plaintext = await decryptVaultWithPasscodeProtected(vault, options.passcode);
+  const plaintext = options.passcode != null || options.pin != null ? await decryptVaultWithSecret(vault, options) : activePlaintextFor(scopeId, vault);
+  if (!plaintext) {
+    throw new EmbeddedWalletVaultError("Unlock the wallet (or pass the passcode) before adding Face ID");
+  }
+  const prfSalt = crypto.getRandomValues(new Uint8Array(32));
   const registration = await registerPasskey({
     userId: options.userId,
     userName: options.userName,
     displayName: options.displayName,
-    rpId: options.rpId
+    rpId: options.rpId,
+    prfSalt
   });
-  const result = await encryptPlaintextWithPasskeyRegistration(
+  let prfOutput = registration.prfOutput;
+  if (!prfOutput) {
+    try {
+      const assertion = await assertPasskey({
+        credentialId: registration.credentialId,
+        rpId: options.rpId,
+        prfSalt
+      });
+      prfOutput = assertion.prfOutput;
+    } catch {
+      prfOutput = null;
+    }
+  }
+  if (!prfOutput) {
+    throw new EmbeddedWalletPasskeyUnsupportedError();
+  }
+  const previewSigner = await embeddedPlaintextToSigner(plaintext);
+  const [account] = await previewSigner.getAccounts();
+  if (account.address !== vault.publicAddress) {
+    throw new EmbeddedWalletVaultError("Passkey upgrade must not change wallet address");
+  }
+  const kek = await deriveKekFromPrf(prfOutput);
+  const wrapped = await encryptPlaintextWithKek(plaintext, kek);
+  const updated = {
+    ...vault,
+    passkeyWrap: {
+      credentialId: encodeCredentialId(registration.credentialId),
+      prfSalt: encodeCredentialId(prfSalt),
+      rpId: options.rpId,
+      iv: wrapped.iv,
+      ciphertext: wrapped.ciphertext,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  };
+  await saveVaultToIndexedDb(updated, { scopeId });
+  if (activeSession && activeSession.address === updated.publicAddress) {
+    activeSession = { ...activeSession, vault: updated };
+  }
+  return { address: updated.publicAddress, vault: updated };
+}
+async function setEmbeddedWalletPin(options) {
+  const scopeId = scopeFromOptions(options) ?? activeScopeId;
+  const vault = await loadVaultForScope(scopeId);
+  if (!vault) {
+    throw new EmbeddedWalletVaultError("No embedded wallet found on this device");
+  }
+  if (!vaultUsesPasscodeUnlock(vault) && !vaultUsesPinUnlock(vault)) {
+    throw new EmbeddedWalletVaultError("This wallet type cannot switch to a PIN");
+  }
+  let plaintext = null;
+  if (options.currentPin != null || options.passcode != null) {
+    plaintext = await decryptVaultWithSecret(vault, {
+      pin: options.currentPin,
+      passcode: options.passcode
+    });
+  } else if (activeUnlockWasStrong) {
+    plaintext = activePlaintextFor(scopeId, vault);
+  }
+  if (!plaintext) {
+    throw new EmbeddedWalletVaultError("Unlock the wallet before changing the PIN");
+  }
+  const result = await encryptPlaintextWithSecret(
     plaintext,
-    registration,
-    backupAcknowledged
+    { pin: options.pin },
+    vault.backupAcknowledged
   );
-  if (result.address !== addressBefore) {
-    throw new EmbeddedWalletVaultError("Passkey upgrade must not change wallet address");
+  if (result.address !== vault.publicAddress) {
+    throw new EmbeddedWalletVaultError("Changing the PIN must not change the wallet address");
+  }
+  const updated = {
+    ...result.vault,
+    backupAcknowledgedAt: vault.backupAcknowledgedAt,
+    createdAt: vault.createdAt,
+    passkeyWrap: vault.passkeyWrap
+  };
+  if (!updated.passkeyWrap) delete updated.passkeyWrap;
+  await saveVaultToIndexedDb(updated, { scopeId });
+  await clearQuickUnlock({ scopeId }).catch(() => void 0);
+  if (activeSession && activeSession.address === updated.publicAddress) {
+    activeSession = { ...activeSession, vault: updated };
   }
-  await saveVaultToIndexedDb(result.vault, { scopeId });
-  if (activeSession) {
-    activeSession = { ...activeSession, vault: result.vault };
+  return { address: updated.publicAddress, vault: updated };
+}
+async function disableEmbeddedPasskeyUnlock(options = {}) {
+  const scopeId = scopeFromOptions(options) ?? activeScopeId;
+  const vault = await loadVaultForScope(scopeId);
+  if (!vault) {
+    throw new EmbeddedWalletVaultError("No embedded wallet found on this device");
   }
-  lockEmbeddedWallet();
-  return result;
+  if (!vault.passkeyWrap) {
+    return vault;
+  }
+  const updated = { ...vault };
+  delete updated.passkeyWrap;
+  await saveVaultToIndexedDb(updated, { scopeId });
+  if (activeSession && activeSession.address === updated.publicAddress) {
+    activeSession = { ...activeSession, vault: updated };
+  }
+  return updated;
+}
+async function decryptPasskeyWrap(vault) {
+  const wrap = vault.passkeyWrap;
+  if (!wrap) {
+    throw new EmbeddedWalletVaultError("Face ID is not set up for this wallet");
+  }
+  const prfSalt = decodeCredentialId(wrap.prfSalt);
+  const assertion = await assertPasskey({
+    credentialId: decodeCredentialId(wrap.credentialId),
+    rpId: wrap.rpId,
+    prfSalt
+  });
+  if (!assertion.prfOutput) {
+    throw new EmbeddedWalletPasskeyUnsupportedError(
+      "This browser did not return the passkey secret; unlock with your passcode"
+    );
+  }
+  const kek = await deriveKekFromPrf(assertion.prfOutput);
+  const plaintext = await decryptPlaintextWithKek(wrap.iv, wrap.ciphertext, kek);
+  const signer = await embeddedPlaintextToSigner(plaintext);
+  const [account] = await signer.getAccounts();
+  if (account.address !== vault.publicAddress) {
+    throw new EmbeddedWalletVaultError("Passkey opened a key for a different address");
+  }
+  return plaintext;
+}
+async function unlockEmbeddedWalletWithPasskey(options = {}) {
+  const scopeId = scopeFromOptions(options) ?? activeScopeId;
+  const vault = await loadVaultForScope(scopeId);
+  if (!vault) {
+    throw new EmbeddedWalletVaultError("No embedded wallet found on this device");
+  }
+  if (vaultUsesPasskeyUnlock(vault)) {
+    return unlockVaultToSession(vault, { scopeId });
+  }
+  const plaintext = await decryptPasskeyWrap(vault);
+  return establishSession(vault, plaintext, scopeId, { strong: true });
+}
+async function setEmbeddedQuickUnlockPin(options) {
+  const scopeId = scopeFromOptions(options) ?? activeScopeId;
+  const vault = await loadVaultForScope(scopeId);
+  if (!vault) {
+    throw new EmbeddedWalletVaultError("No embedded wallet found on this device");
+  }
+  const plaintext = activePlaintextFor(scopeId, vault);
+  if (!plaintext || !activeUnlockWasStrong) {
+    throw new EmbeddedWalletQuickUnlockError(
+      "no_session",
+      "Unlock with Face ID or your passcode before choosing a PIN"
+    );
+  }
+  await createQuickUnlockRecord({
+    scopeId,
+    plaintext,
+    publicAddress: vault.publicAddress,
+    pin: options.pin
+  });
+  return getQuickUnlockStatus({ scopeId });
+}
+async function unlockEmbeddedWalletWithPin(options) {
+  const scopeId = scopeFromOptions(options) ?? activeScopeId;
+  const vault = await loadVaultForScope(scopeId);
+  if (!vault) {
+    throw new EmbeddedWalletVaultError("No embedded wallet found on this device");
+  }
+  const opened = await openQuickUnlockRecord({ scopeId, pin: options.pin });
+  if (opened.publicAddress !== vault.publicAddress) {
+    await clearQuickUnlock({ scopeId }).catch(() => void 0);
+    throw new EmbeddedWalletQuickUnlockError("not_set", "PIN belongs to a different wallet");
+  }
+  const signer = await embeddedPlaintextToSigner(opened.plaintext);
+  const [account] = await signer.getAccounts();
+  if (account.address !== vault.publicAddress) {
+    await clearQuickUnlock({ scopeId }).catch(() => void 0);
+    throw new EmbeddedWalletQuickUnlockError("not_set", "PIN record does not match this wallet");
+  }
+  return establishSession(vault, opened.plaintext, scopeId, { strong: false });
+}
+async function getEmbeddedQuickUnlockStatus(options = {}) {
+  const scopeId = scopeFromOptions(options) ?? activeScopeId;
+  return getQuickUnlockStatus({ scopeId });
+}
+async function clearEmbeddedQuickUnlockPin(options = {}) {
+  const scopeId = scopeFromOptions(options) ?? activeScopeId;
+  await clearQuickUnlock({ scopeId });
 }
 async function unlockEmbeddedWallet(options = {}) {
   const scopeId = scopeFromOptions(options) ?? activeScopeId;
@@ -3218,12 +3764,16 @@ async function tryRestoreUnlockedSession(options = {}) {
   const session = { address: account.address, vault, signer };
   activeSession = session;
   activeScopeId = scopeId;
+  activePlaintext = plaintext;
+  activeUnlockWasStrong = false;
   return session;
 }
 function lockEmbeddedWallet() {
   const scopeId = activeScopeId;
   activeSession = null;
   activeScopeId = void 0;
+  activePlaintext = null;
+  activeUnlockWasStrong = false;
   void clearUnlockedSession({ scopeId }).catch(() => void 0);
 }
 function getEmbeddedWalletSession() {
@@ -3251,7 +3801,7 @@ async function acknowledgeEmbeddedBackup(options = {}) {
   if (activeSession) {
     activeSession = { ...activeSession, vault: updated };
   }
-  return exportEncryptedBackup(updated);
+  return vaultUsesPinUnlock(updated) ? null : exportEncryptedBackup(updated);
 }
 function downloadEmbeddedBackupFile(backup, filename) {
   const blob = new Blob([serializeBackupFile(backup)], { type: "application/json" });
@@ -3280,6 +3830,7 @@ async function clearEmbeddedWallet(options = {}) {
   const scopeId = scopeFromOptions(options) ?? activeScopeId;
   lockEmbeddedWallet();
   await clearUnlockedSession({ scopeId });
+  await clearQuickUnlock({ scopeId }).catch(() => void 0);
   await clearVaultFromIndexedDb({ scopeId });
 }
 
@@ -3562,6 +4113,6 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-export { ATTESTATION_TYPE_CITIZENSHIP_APPLICATION, ATTESTATION_TYPE_RECOVERY, ApplicationStatus, BECH32_PREFIX, CHAIN_COIN_TYPE, CitizenTxError, DEFAULT_CHAIN_ID, DEFAULT_REST_URL, DEFAULT_RPC_URL, EMBEDDED_WALLET_KDF_PBKDF2, EMBEDDED_WALLET_KDF_PIN, EMBEDDED_WALLET_KDF_PRF, EMBEDDED_WALLET_KEY_DIRECT_ENTROPY, EMBEDDED_WALLET_KEY_HD_DERIVED, EMBEDDED_WALLET_PASSCODE_MAX_LENGTH, EMBEDDED_WALLET_PASSCODE_MIN_LENGTH, EMBEDDED_WALLET_PASSKEY_PBKDF2_ITERATIONS, EMBEDDED_WALLET_PIN_PBKDF2_ITERATIONS, EMBEDDED_WALLET_RECOVERY_PHRASE_DIRECT_ENTROPY_WARNING, EMBEDDED_WALLET_RECOVERY_PHRASE_GENERAL_WARNING, EMBEDDED_WALLET_SESSION_TTL_MS, EMBEDDED_WALLET_VAULT_VERSION, EmbeddedWalletBackupRequiredError, EmbeddedWalletDecryptError, EmbeddedWalletLockoutError, EmbeddedWalletVaultError, EmbeddedWalletWeakPasscodeError, InvalidChainConfigError, MsgClaimReward, MsgSubmitApplication, MsgSubmitRecoveryAttestation, PASSCODE_LOCKOUT_FAILURE_THRESHOLD, PASSCODE_LOCKOUT_INITIAL_MS, PASSCODE_LOCKOUT_MAX_MS, RecoveryAttestationStatus, RestQueryError, RpcConnectionError, UKDR_DECIMALS, UKDR_DISPLAY_DENOM, UKDR_MINIMAL_DENOM, VAULT_LEGACY_KEY, WALLETCONNECT_COSMOS_METHODS, WALLETCONNECT_COSMOS_NAMESPACE, WEBAUTHN_RP_NAME, WalletAccountError, WalletConnectNotInitializedError, WalletConnectSessionError, WalletConnectSigningError, WalletConnectionError, WalletConnectionRejectedError, WalletNotInstalledError, WebAuthnUnavailableError, WebAuthnUserCancelledError, acknowledgeEmbeddedBackup, addressFromHdMnemonic, addressFromPrivateKey, assertPasscodeAllowedForCreation, assertPasscodeUnlockAllowed, assertPasskey, assertValidPasscode, assertValidRecoveryMnemonic, assertVaultPermitsTransaction, attestationSignPayload, broadcastAndConfirmTx, buildClaimRewardMsg, buildKingdomChainInfo, buildRequiredCosmosNamespaces, buildSendUkdrMsg, buildSubmitApplicationMsg, cacheUnlockedSession, citizenTxErrorMessage, clearEmbeddedWallet, clearPasscodeLockoutRecord, clearSessionCacheRecord, clearUnlockedSession, clearVaultFromIndexedDb, computePasscodeLockoutDurationMs, connectCosmostation, connectKeplr, connectLeap, connectWalletConnect, createBrowserSigningClient, createEmbeddedWallet, createHdDerivedPlaintext, createKingdomChainRegistry, createPasskeyMaterialFromAssertion, createPbkdf2Salt, createWalletConnectOfflineSigner, decodeCredentialId, decodeDirectEntropyMnemonic, decryptWalletPayload, defaultEmbeddedHdPath, defaultUkdrTxFee, deriveKekFromPasscode, deriveKekFromPbkdf2, deriveKekFromPrf, derivePrivateKeyFromHdMnemonic, detectRecoveryMnemonicKeyType, detectWebAuthnPrfCapabilities, disconnectWalletConnect, downloadEmbeddedBackupFile, embeddedPlaintextToSigner, enableEmbeddedPasskeyUnlock, encodeCredentialId, encodeDirectEntropyMnemonic, encryptWalletPayload, evaluatePasscodeStrength, exportEncryptedBackup, fetchFeeGrantGranter, fetchUkdrBalance, fetchUnclaimedFinalizedRewards, formatUkdrAsKdr, getCosmostationKeplrApi, getEmbeddedOfflineSigner, getEmbeddedWalletSession, getPasscodeLockoutState, hasEmbeddedWallet, hasLegacyEmbeddedWallet, hasMixedCharacterClasses, importEmbeddedBackup, initWalletConnectClient, isCosmostationAvailable, isKeplrAvailable, isLeapAvailable, loadPasscodeLockoutRecord, loadSessionCacheRecord, loadVaultFromIndexedDb, lockEmbeddedWallet, markVaultBackupAcknowledged, migrateLegacyEmbeddedWallet, normalizePasscode, normalizeRecoveryMnemonic, parseEncryptedBackup, parseKdrToUkdr, parseWalletConnectAccount, plaintextFromRecoveryMnemonic, providerSeedFromHex, publicKeyFromPrivateSeed, readPrfOutput, recordPasscodeUnlockFailure, recordPasscodeUnlockSuccess, recoverEmbeddedWalletFromMnemonic, recoveryMnemonicAddress, recoveryMnemonicFromPlaintext, registerPasskey, resolvePlaintextKeyType, resolveVaultStorageKey, restoreCachedSessionPlaintext, restoreWalletConnectSession, revealEmbeddedRecoveryPhrase, savePasscodeLockoutRecord, saveSessionCacheRecord, saveVaultToIndexedDb, selectEmbeddedWalletKdf, serializeBackupFile, signAttestationPayload, signCitizenshipAttestation, suggestAndConnect, toWalletConnectCosmosChainId, tryRestoreUnlockedSession, ukdrCoin, unlockEmbeddedWallet, validateChainConfig, vaultUsesPasscodeUnlock, vaultUsesPasskeyUnlock };
+export { ATTESTATION_TYPE_CITIZENSHIP_APPLICATION, ATTESTATION_TYPE_RECOVERY, ApplicationStatus, BECH32_PREFIX, CHAIN_COIN_TYPE, CitizenTxError, DEFAULT_CHAIN_ID, DEFAULT_REST_URL, DEFAULT_RPC_URL, DEVICE_PIN_PBKDF2_ITERATIONS, EMBEDDED_WALLET_KDF_DEVICE_PIN, EMBEDDED_WALLET_KDF_PBKDF2, EMBEDDED_WALLET_KDF_PIN, EMBEDDED_WALLET_KDF_PRF, EMBEDDED_WALLET_KEY_DIRECT_ENTROPY, EMBEDDED_WALLET_KEY_HD_DERIVED, EMBEDDED_WALLET_PASSCODE_MAX_LENGTH, EMBEDDED_WALLET_PASSCODE_MIN_LENGTH, EMBEDDED_WALLET_PASSKEY_PBKDF2_ITERATIONS, EMBEDDED_WALLET_PIN_PBKDF2_ITERATIONS, EMBEDDED_WALLET_RECOVERY_PHRASE_DIRECT_ENTROPY_WARNING, EMBEDDED_WALLET_RECOVERY_PHRASE_GENERAL_WARNING, EMBEDDED_WALLET_SESSION_TTL_MS, EMBEDDED_WALLET_VAULT_VERSION, EmbeddedWalletBackupRequiredError, EmbeddedWalletDecryptError, EmbeddedWalletLockoutError, EmbeddedWalletPasskeyUnsupportedError, EmbeddedWalletQuickUnlockError, EmbeddedWalletVaultError, EmbeddedWalletWeakPasscodeError, InvalidChainConfigError, MsgClaimReward, MsgSubmitApplication, MsgSubmitRecoveryAttestation, PASSCODE_LOCKOUT_FAILURE_THRESHOLD, PASSCODE_LOCKOUT_INITIAL_MS, PASSCODE_LOCKOUT_MAX_MS, QUICK_UNLOCK_MAX_ATTEMPTS, QUICK_UNLOCK_PBKDF2_ITERATIONS, QUICK_UNLOCK_PIN_LENGTH, QUICK_UNLOCK_TTL_MS, RecoveryAttestationStatus, RestQueryError, RpcConnectionError, UKDR_DECIMALS, UKDR_DISPLAY_DENOM, UKDR_MINIMAL_DENOM, VAULT_LEGACY_KEY, WALLETCONNECT_COSMOS_METHODS, WALLETCONNECT_COSMOS_NAMESPACE, WEBAUTHN_RP_NAME, WalletAccountError, WalletConnectNotInitializedError, WalletConnectSessionError, WalletConnectSigningError, WalletConnectionError, WalletConnectionRejectedError, WalletNotInstalledError, WebAuthnUnavailableError, WebAuthnUserCancelledError, acknowledgeEmbeddedBackup, addressFromHdMnemonic, addressFromPrivateKey, assertPasscodeAllowedForCreation, assertPasscodeUnlockAllowed, assertPasskey, assertQuickUnlockPinAllowed, assertValidPasscode, assertValidRecoveryMnemonic, assertVaultPermitsTransaction, attestationSignPayload, broadcastAndConfirmTx, buildClaimRewardMsg, buildKingdomChainInfo, buildRequiredCosmosNamespaces, buildSendUkdrMsg, buildSubmitApplicationMsg, cacheUnlockedSession, citizenTxErrorMessage, clearEmbeddedQuickUnlockPin, clearEmbeddedWallet, clearPasscodeLockoutRecord, clearQuickUnlock, clearQuickUnlockRecord, clearSessionCacheRecord, clearUnlockedSession, clearVaultFromIndexedDb, computePasscodeLockoutDurationMs, connectCosmostation, connectKeplr, connectLeap, connectWalletConnect, createBrowserSigningClient, createEmbeddedWallet, createHdDerivedPlaintext, createKingdomChainRegistry, createPasskeyMaterialFromAssertion, createPbkdf2Salt, createQuickUnlockRecord, createWalletConnectOfflineSigner, decodeCredentialId, decodeDirectEntropyMnemonic, decryptDevicePinVault, decryptPlaintextWithKek, decryptWalletPayload, defaultEmbeddedHdPath, defaultUkdrTxFee, deriveKekFromPasscode, deriveKekFromPbkdf2, deriveKekFromPrf, derivePinKey, derivePrivateKeyFromHdMnemonic, deserializePlaintext, detectRecoveryMnemonicKeyType, detectWebAuthnPrfCapabilities, disableEmbeddedPasskeyUnlock, disconnectWalletConnect, downloadEmbeddedBackupFile, embeddedPlaintextToSigner, enableEmbeddedPasskeyUnlock, encodeCredentialId, encodeDirectEntropyMnemonic, encryptPlaintextWithDevicePin, encryptPlaintextWithKek, encryptWalletPayload, evaluatePasscodeStrength, exportEncryptedBackup, fetchFeeGrantGranter, fetchUkdrBalance, fetchUnclaimedFinalizedRewards, formatUkdrAsKdr, getCosmostationKeplrApi, getEmbeddedOfflineSigner, getEmbeddedQuickUnlockStatus, getEmbeddedWalletSession, getPasscodeLockoutState, getQuickUnlockStatus, hasEmbeddedWallet, hasLegacyEmbeddedWallet, hasMixedCharacterClasses, importEmbeddedBackup, initWalletConnectClient, isCosmostationAvailable, isKeplrAvailable, isLeapAvailable, isTrivialPin, loadPasscodeLockoutRecord, loadQuickUnlockRecord, loadSessionCacheRecord, loadVaultFromIndexedDb, lockEmbeddedWallet, markVaultBackupAcknowledged, migrateLegacyEmbeddedWallet, normalizePasscode, normalizeRecoveryMnemonic, openQuickUnlockRecord, parseEncryptedBackup, parseKdrToUkdr, parseWalletConnectAccount, plaintextFromRecoveryMnemonic, providerSeedFromHex, publicKeyFromPrivateSeed, readPrfOutput, recordPasscodeUnlockFailure, recordPasscodeUnlockSuccess, recoverEmbeddedWalletFromMnemonic, recoveryMnemonicAddress, recoveryMnemonicFromPlaintext, refreshQuickUnlockExpiry, registerPasskey, resolvePlaintextKeyType, resolveVaultStorageKey, restoreCachedSessionPlaintext, restoreWalletConnectSession, revealEmbeddedRecoveryPhrase, savePasscodeLockoutRecord, saveQuickUnlockRecord, saveSessionCacheRecord, saveVaultToIndexedDb, selectEmbeddedWalletKdf, serializeBackupFile, serializePlaintext, setEmbeddedQuickUnlockPin, setEmbeddedWalletPin, signAttestationPayload, signCitizenshipAttestation, suggestAndConnect, toWalletConnectCosmosChainId, tryRestoreUnlockedSession, ukdrCoin, unlockEmbeddedWallet, unlockEmbeddedWalletWithPasskey, unlockEmbeddedWalletWithPin, validateChainConfig, vaultHasPasskeyUnlock, vaultUsesPasscodeUnlock, vaultUsesPasskeyUnlock, vaultUsesPinUnlock };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map