@oxy.so/contracts 2.1.0 → 2.2.0

package/dist/cjs/webIdentityCarrier.js

@@ -1,181 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.webIdentityEnvelopeEstablishSchema = exports.webauthnAssertionResponseSchema = exports.webIdentityEnvelopePutSchema = exports.webIdentityEnvelopeActionSchema = exports.webIdentityEnvelopeProofFieldsSchema = exports.webIdentityEnvelopeResponseSchema = exports.webIdentityHolderSchema = exports.webIdentityEnvelopeUploadSchema = exports.webIdentityEnvelopeSchema = exports.webIdentityWrapSchema = exports.webauthnRpIdSchema = exports.webauthnCredentialIdSchema = exports.webIdentityPublicKeySchema = exports.WEB_IDENTITY_SECRET_KINDS = exports.WEB_IDENTITY_ENVELOPE_VERSION = void 0;
-/**
- * Web identity holder contract — the sealed envelope that lets a browser hold an
- * account's self-custody root without Oxy ever being able to use it (ADR 0024).
- *
- * A root is a BIP-39 phrase (12–24 words) whose seed's first 32 bytes are the
- * secp256k1 key — exactly the Commons derivation — or, for a few imported
- * identities, a raw private key that never had a phrase. On the web it travels as:
- *
- *   secret ── XChaCha20-Poly1305 under a random DEK ──▶ sealedSecret
- *   DEK    ── XChaCha20-Poly1305 under KEK_i ──▶ wraps[i]
- *   KEK_i = HKDF(PRF output of passkey i)
- *
- * The server stores the envelope and can open NONE of it: the PRF output never
- * leaves the user's authenticator, and the secret is never uploaded. The AEAD
- * associated data binds the secret to the root's public key and kind, and each
- * wrap to its credential and RP ID, so a re-labelled or transplanted envelope
- * fails to open instead of decrypting into the wrong identity.
- *
- * Platform-agnostic — zod only, ESM-safe (no `require()`).
- */
-const zod_1 = require("zod");
-const identityProof_1 = require("./identityProof");
-/** The envelope scheme. A scheme change is a new literal, never a mutation. */
-exports.WEB_IDENTITY_ENVELOPE_VERSION = 2;
-/**
- * What an envelope seals. A raw-key identity stays a raw-key identity:
- * nothing ever derives or displays a phrase for it.
- */
-exports.WEB_IDENTITY_SECRET_KINDS = ['mnemonic-entropy', 'raw-private-key'];
-const hex = (bytes, label) => zod_1.z
-    .string()
-    .trim()
-    .regex(new RegExp(`^[0-9a-fA-F]{${bytes * 2}}$`), `${label} must be ${bytes * 2} hex characters`);
-/**
- * The identity's secp256k1 public key in Oxy's canonical form: uncompressed SEC1
- * (`04` + 64 bytes), lowercase hex — what `KeyManager.derivePublicKey` produces
- * and `users.public_key` stores.
- */
-exports.webIdentityPublicKeySchema = zod_1.z
-    .string()
-    .trim()
-    .regex(/^04[0-9a-f]{128}$/, 'publicKey must be an uncompressed, lowercase secp256k1 key (130 hex characters)');
-/** A WebAuthn credential id, base64url as the browser reports it. */
-exports.webauthnCredentialIdSchema = zod_1.z
-    .string()
-    .trim()
-    .min(16)
-    .max(1024)
-    .regex(/^[A-Za-z0-9_-]+$/, 'credentialId must be base64url');
-/** A WebAuthn RP ID: a bare registrable host name, lowercase. */
-exports.webauthnRpIdSchema = zod_1.z
-    .string()
-    .trim()
-    .min(1)
-    .max(253)
-    .regex(/^(localhost|[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+)$/, 'rpId must be a lowercase host name');
-/** One passkey's wrap of the envelope's data key. */
-exports.webIdentityWrapSchema = zod_1.z.object({
-    credentialId: exports.webauthnCredentialIdSchema,
-    /** 24-byte XChaCha20-Poly1305 nonce. */
-    nonce: hex(24, 'nonce'),
-    /** The 32-byte DEK sealed under this passkey's KEK, with the 16-byte tag appended (48 bytes). */
-    wrappedKey: hex(48, 'wrappedKey'),
-    createdAt: zod_1.z.string().datetime(),
-    /** The RP ID the passkey was created under, asserted explicitly by every later ceremony (ADR 0024 D2). */
-    rpId: exports.webauthnRpIdSchema,
-    /**
-     * When this passkey's PRF output was shown to open the envelope. A wrap is a
-     * root HOLDER only once this is set; a login passkey never is by default.
-     */
-    verifiedAt: zod_1.z.string().datetime().optional(),
-});
-/**
- * The sealed identity as it is stored (server copy and local copy alike).
- *
- * `wraps` holds one entry per passkey able to open it; at least one, and a
- * bounded number so an envelope cannot grow without limit.
- */
-exports.webIdentityEnvelopeSchema = zod_1.z
-    .object({
-    version: zod_1.z.literal(exports.WEB_IDENTITY_ENVELOPE_VERSION),
-    algorithm: zod_1.z.literal('xchacha20poly1305'),
-    publicKey: exports.webIdentityPublicKeySchema,
-    secretKind: zod_1.z.enum(exports.WEB_IDENTITY_SECRET_KINDS),
-    /** 24-byte nonce of the secret seal. */
-    secretNonce: hex(24, 'secretNonce'),
-    /**
-     * The sealed secret, tag appended: 16/20/24/28/32 bytes of BIP-39 entropy
-     * (12–24 words) or a 32-byte private key, plus 16.
-     */
-    sealedSecret: zod_1.z
-        .string()
-        .trim()
-        .regex(/^(?:[0-9a-fA-F]{64}|[0-9a-fA-F]{72}|[0-9a-fA-F]{80}|[0-9a-fA-F]{88}|[0-9a-fA-F]{96})$/, 'sealedSecret has an unsupported length'),
-    wraps: zod_1.z.array(exports.webIdentityWrapSchema).min(1).max(10),
-})
-    .refine((envelope) => envelope.secretKind === 'mnemonic-entropy' || envelope.sealedSecret.length === 96, {
-    message: 'a raw private key seals to 48 bytes',
-    path: ['sealedSecret'],
-});
-/**
- * `PUT /identity/web-envelope` — store or replace the caller's envelope.
- *
- * Refused unless `envelope.publicKey` is the identity key already linked to the
- * account: an envelope can only ever carry the account's own identity.
- */
-exports.webIdentityEnvelopeUploadSchema = zod_1.z.object({
-    envelope: exports.webIdentityEnvelopeSchema,
-});
-/** A root holder as the status read reports it — metadata only, nothing that opens anything. */
-exports.webIdentityHolderSchema = zod_1.z.object({
-    credentialId: exports.webauthnCredentialIdSchema,
-    rpId: exports.webauthnRpIdSchema,
-    verifiedAt: zod_1.z.string().datetime().nullable(),
-    createdAt: zod_1.z.string().datetime(),
-});
-/**
- * `GET /identity/web-envelope` — the caller's envelope and the readiness facts
- * ADR 0024 D5 keeps separate. A client decides what to show from these fields
- * WITHOUT decrypting anything.
- */
-exports.webIdentityEnvelopeResponseSchema = zod_1.z.object({
-    envelope: exports.webIdentityEnvelopeSchema.nullable(),
-    /** The revision a write must name as `expectedRevision`; `0` when there is no envelope. */
-    revision: zod_1.z.number().int().nonnegative(),
-    /** Whether the account has a linked root at all (it may live only in Commons). */
-    rootLinked: zod_1.z.boolean(),
-    /** The web wraps, as metadata. */
-    holders: zod_1.z.array(exports.webIdentityHolderSchema),
-    /** When the owner confirmed the recovery material is written down, or `null`. */
-    phraseConfirmedAt: zod_1.z.string().datetime().nullable(),
-    /** When the recovery material was shown to re-derive this root, or `null`. */
-    recoveryVerifiedAt: zod_1.z.string().datetime().nullable(),
-    updatedAt: zod_1.z.string().datetime().nullable(),
-});
-/** A root proof, plus the envelope revision the write expects to replace. */
-exports.webIdentityEnvelopeProofFieldsSchema = zod_1.z.object({
-    proof: identityProof_1.identityProofSchema,
-    expectedRevision: zod_1.z.number().int().nonnegative(),
-});
-/**
- * `POST /identity/web-envelope/phrase-confirmed`, `/recovery-verified` and
- * `DELETE /identity/web-envelope` prove control of the root, not just a bearer.
- */
-exports.webIdentityEnvelopeActionSchema = exports.webIdentityEnvelopeProofFieldsSchema.strict();
-/** `PUT /identity/web-envelope` body. */
-exports.webIdentityEnvelopePutSchema = exports.webIdentityEnvelopeUploadSchema.extend(exports.webIdentityEnvelopeProofFieldsSchema.shape).strict();
-/**
- * A WebAuthn assertion by one of the account's EXISTING passkeys whose
- * `clientDataJSON.challenge` is the proof challenge — the fresh use of the
- * existing factor a keyless account needs before its first root is linked.
- */
-exports.webauthnAssertionResponseSchema = zod_1.z
-    .object({
-    id: exports.webauthnCredentialIdSchema,
-    rawId: zod_1.z.string().min(1).max(2048),
-    type: zod_1.z.literal('public-key'),
-    response: zod_1.z
-        .object({
-        clientDataJSON: zod_1.z.string().min(1).max(8192),
-        authenticatorData: zod_1.z.string().min(1).max(8192),
-        signature: zod_1.z.string().min(1).max(2048),
-        userHandle: zod_1.z.string().max(2048).optional(),
-    })
-        .passthrough(),
-    clientExtensionResults: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
-    authenticatorAttachment: zod_1.z.string().optional(),
-})
-    .passthrough();
-/**
- * `POST /identity/web-envelope/establish` body — an account's FIRST root, linked
- * and stored with its envelope in ONE transaction: one root proof
- * (`web_envelope_establish`, digest of the envelope) plus a fresh `assertion` by
- * an existing passkey over the same challenge.
- */
-exports.webIdentityEnvelopeEstablishSchema = exports.webIdentityEnvelopeUploadSchema
-    .extend({ proof: identityProof_1.identityProofSchema, assertion: exports.webauthnAssertionResponseSchema })
-    .strict();

package/dist/esm/identityMove.js

@@ -1,148 +0,0 @@
-/**
- * Identity move contract — give a web root to Commons (add it, or keep it only in
- * Commons; ADR 0024 D6).
- *
- * The web (holding the root) shows a QR carrying only a move id; Commons scans.
- * The relay in between must not be able to take the root, so:
- *
- *  1. `POST /identity/move { initiatorCommitment }` — the web publishes only
- *     `H(initiatorKey, nonce)`, never the key.
- *  2. `POST /identity/move/:moveId/join { responderEphemeralPublicKey }` —
- *     Commons, having read the commitment first, joins with its own key.
- *  3. `POST /identity/move/:moveId/reveal` — only then does the web reveal its
- *     key and nonce; Commons checks them against the commitment it read.
- *  4. Both screens show a 6-digit code over `(moveId, both keys, commitment)`;
- *     the person confirms on the web that they match.
- *  5. `POST /identity/move/:moveId/seal` — the web seals the phrase entropy under
- *     `HKDF(ECDH(both keys), moveId)`, authorized by a one-use root proof over the
- *     exact sealed bytes.
- *  6. `POST /identity/move/:moveId/receipt` — Commons stores the root, reads it
- *     back from its keychain, and signs a receipt over the move, the root, both
- *     keys and the digest of the ciphertext it opened. The server verifies it; the
- *     web verifies it again from what IT sealed before removing anything.
- *
- * Why the commitment: without it the relay sees both keys before committing to
- * anything and can grind a substituted key until the two codes agree (~10⁶
- * tries, seconds). With it, the relay must fix the key it shows Commons before
- * learning Commons' key, and the key it shows the web before the web reveals.
- *
- * The server holds a commitment, two ephemeral public keys, an opaque ciphertext
- * and a receipt — nothing that decrypts the ciphertext.
- *
- * Platform-agnostic — zod only, ESM-safe (no `require()`).
- */
-import { z } from 'zod';
-import { canonicalJson, identityProofSchema } from './identityProof.js';
-/** A move lives this long: one interactive handoff. */
-export const IDENTITY_MOVE_TTL_MS = 5 * 60 * 1000;
-/** 128-bit move id, lowercase hex. */
-export const identityMoveIdSchema = z
-    .string()
-    .trim()
-    .regex(/^[0-9a-f]{32}$/, 'moveId must be 32 lowercase hex characters');
-/** An ephemeral secp256k1 public key, uncompressed lowercase hex. */
-export const identityMoveEphemeralKeySchema = z
-    .string()
-    .trim()
-    .regex(/^04[0-9a-f]{128}$/, 'ephemeral public key must be uncompressed, lowercase hex');
-export const IDENTITY_MOVE_STATUSES = ['pending', 'joined', 'sealed', 'completed', 'cancelled', 'expired'];
-/** The QR payload Commons scans. Carries the move id only. */
-export const IDENTITY_MOVE_QR_PREFIX = 'oxycommons://move?id=';
-const hex64 = (label) => z.string().trim().regex(/^[0-9a-f]{64}$/, `${label} must be 64 lowercase hex characters`);
-export const identityMoveCreateRequestSchema = z
-    .object({
-    /** `H(initiator ephemeral key, nonce)` — the key itself is revealed only after Commons joins. */
-    initiatorCommitment: hex64('initiatorCommitment'),
-})
-    .strict();
-export const identityMoveCreateResponseSchema = z.object({
-    moveId: identityMoveIdSchema,
-    expiresAt: z.string().datetime(),
-});
-export const identityMoveJoinRequestSchema = z.object({
-    responderEphemeralPublicKey: identityMoveEphemeralKeySchema,
-});
-/** After Commons joined: the committed key and its nonce. */
-export const identityMoveRevealRequestSchema = z
-    .object({
-    initiatorEphemeralPublicKey: identityMoveEphemeralKeySchema,
-    commitmentNonce: hex64('commitmentNonce'),
-})
-    .strict();
-export const identityMoveSealRequestSchema = z
-    .object({
-    /** 24-byte XChaCha20-Poly1305 nonce, hex. */
-    nonce: z.string().trim().regex(/^[0-9a-f]{48}$/, 'nonce must be 48 lowercase hex characters'),
-    /** The 16–32-byte phrase entropy (12–24 words), tag appended, hex. */
-    ciphertext: z
-        .string()
-        .trim()
-        .regex(/^(?:[0-9a-f]{64}|[0-9a-f]{72}|[0-9a-f]{80}|[0-9a-f]{88}|[0-9a-f]{96})$/, 'ciphertext has an unsupported length'),
-    /**
-     * Root proof (`identity_move_seal`), payload `{ moveId, nonce, ciphertext }`,
-     * over a one-use challenge from `POST /identity/proof-challenge`.
-     */
-    proof: identityProofSchema,
-})
-    .strict();
-export const identityMoveReceiptRequestSchema = z
-    .object({
-    /** Root signature over `buildMoveReceiptMessage(...)`. */
-    signature: z.string().trim().min(1).max(512),
-})
-    .strict();
-export const identityMoveStateSchema = z.object({
-    moveId: identityMoveIdSchema,
-    status: z.enum(IDENTITY_MOVE_STATUSES),
-    initiatorCommitment: z.string(),
-    initiatorCommitmentNonce: z.string().nullable(),
-    publicKey: z.string().regex(/^04[0-9a-f]{128}$/),
-    initiatorEphemeralPublicKey: identityMoveEphemeralKeySchema.nullable(),
-    responderEphemeralPublicKey: identityMoveEphemeralKeySchema.nullable(),
-    nonce: z.string().nullable(),
-    ciphertext: z.string().nullable(),
-    receiptSignature: z.string().nullable(),
-    expiresAt: z.string().datetime(),
-});
-/**
- * The initiator's commitment input, `canonicalJson({ v, purpose, key, nonce })`,
- * which the caller hashes with SHA-256.
- */
-export function buildMoveCommitmentInput(initiatorEphemeralPublicKey, nonce) {
-    return canonicalJson({
-        v: 2,
-        purpose: 'oxy-identity-move-initiator-commitment',
-        initiatorEphemeralPublicKey: initiatorEphemeralPublicKey.toLowerCase(),
-        nonce: nonce.toLowerCase(),
-    });
-}
-/** The bytes both sides hash for the 6-digit code. */
-export function buildMoveSasInput(input) {
-    return canonicalJson({
-        v: 'oxy-identity-transfer-sas-v2',
-        moveId: input.moveId.toLowerCase(),
-        initiator: input.initiatorEphemeralPublicKey.toLowerCase(),
-        responder: input.responderEphemeralPublicKey.toLowerCase(),
-        commitment: input.initiatorCommitment.toLowerCase(),
-    });
-}
-/** The ciphertext digest input the receipt binds: `canonicalJson({ nonce, ciphertext })`. */
-export function buildMoveCiphertextDigestInput(sealed) {
-    return canonicalJson({ nonce: sealed.nonce.toLowerCase(), ciphertext: sealed.ciphertext.toLowerCase() });
-}
-/** The payload a seal proof digests. */
-export function buildMoveSealPayload(moveId, sealed) {
-    return { moveId: moveId.toLowerCase(), nonce: sealed.nonce.toLowerCase(), ciphertext: sealed.ciphertext.toLowerCase() };
-}
-/** The exact bytes a receipt signs. */
-export function buildMoveReceiptMessage(input) {
-    return canonicalJson({
-        v: 2,
-        domain: 'oxy-identity-move-receipt',
-        moveId: input.moveId.toLowerCase(),
-        rootPublicKey: input.rootPublicKey.toLowerCase(),
-        initiator: input.initiatorEphemeralPublicKey.toLowerCase(),
-        responder: input.responderEphemeralPublicKey.toLowerCase(),
-        ciphertextDigest: input.ciphertextDigest.toLowerCase(),
-    });
-}

package/dist/esm/identityRecovery.js

@@ -1,48 +0,0 @@
-/**
- * Signed-out recovery contract (ADR 0024 D5) — get an EXISTING account back from
- * its root alone, with no passkey, session or email.
- *
- *  1. `POST /identity/recovery/challenge` → a one-use challenge. It says nothing
- *     about any account.
- *  2. The holder derives the root locally from recovery material (12/24 words or a
- *     raw key) and signs `recover_account_start` over that challenge:
- *     `POST /identity/recovery/start { publicKey, proof }`. Only a valid proof
- *     learns which account the root belongs to; the response carries passkey
- *     registration options for THAT account and a short-lived ticket.
- *  3. The holder creates the passkey, seals the root under it (PRF), and signs
- *     `recover_account_complete` over the registration challenge and the envelope
- *     digest: `POST /identity/recovery/complete`. The passkey, the envelope and a
- *     session are created in one transaction.
- *
- * The recovery material and the root never leave the holder. Platform-agnostic —
- * zod only, ESM-safe.
- */
-import { z } from 'zod';
-import { identityProofSchema } from './identityProof.js';
-import { webIdentityEnvelopeSchema, webIdentityPublicKeySchema } from './webIdentityCarrier.js';
-/** A recovery attempt lives this long between steps. */
-export const IDENTITY_RECOVERY_TTL_MS = 5 * 60 * 1000;
-export const identityRecoveryChallengeResponseSchema = z.object({
-    challenge: z.string().regex(/^[0-9a-f]{64}$/),
-    expiresAt: z.number().int().positive(),
-});
-export const identityRecoveryStartRequestSchema = z
-    .object({
-    publicKey: webIdentityPublicKeySchema,
-    /** `recover_account_start`, subject `root:<publicKey>`, actor `anonymous`. */
-    proof: identityProofSchema,
-})
-    .strict();
-export const identityRecoveryCompleteRequestSchema = z
-    .object({
-    ticket: z.string().regex(/^[0-9a-f]{64}$/),
-    /** The browser `RegistrationResponseJSON`, verified by the API's WebAuthn library. */
-    response: z.record(z.string(), z.unknown()),
-    /** The root sealed under the new passkey — exactly one wrap, for that credential. */
-    envelope: webIdentityEnvelopeSchema,
-    /** `recover_account_complete`, subject = account id, actor `credential:<id>`, challenge = registration challenge (hex). */
-    proof: identityProofSchema,
-    deviceName: z.string().trim().max(100).optional(),
-    deviceFingerprint: z.string().trim().max(512).optional(),
-})
-    .strict();

package/dist/esm/webIdentityCarrier.js

@@ -1,178 +0,0 @@
-/**
- * Web identity holder contract — the sealed envelope that lets a browser hold an
- * account's self-custody root without Oxy ever being able to use it (ADR 0024).
- *
- * A root is a BIP-39 phrase (12–24 words) whose seed's first 32 bytes are the
- * secp256k1 key — exactly the Commons derivation — or, for a few imported
- * identities, a raw private key that never had a phrase. On the web it travels as:
- *
- *   secret ── XChaCha20-Poly1305 under a random DEK ──▶ sealedSecret
- *   DEK    ── XChaCha20-Poly1305 under KEK_i ──▶ wraps[i]
- *   KEK_i = HKDF(PRF output of passkey i)
- *
- * The server stores the envelope and can open NONE of it: the PRF output never
- * leaves the user's authenticator, and the secret is never uploaded. The AEAD
- * associated data binds the secret to the root's public key and kind, and each
- * wrap to its credential and RP ID, so a re-labelled or transplanted envelope
- * fails to open instead of decrypting into the wrong identity.
- *
- * Platform-agnostic — zod only, ESM-safe (no `require()`).
- */
-import { z } from 'zod';
-import { identityProofSchema } from './identityProof.js';
-/** The envelope scheme. A scheme change is a new literal, never a mutation. */
-export const WEB_IDENTITY_ENVELOPE_VERSION = 2;
-/**
- * What an envelope seals. A raw-key identity stays a raw-key identity:
- * nothing ever derives or displays a phrase for it.
- */
-export const WEB_IDENTITY_SECRET_KINDS = ['mnemonic-entropy', 'raw-private-key'];
-const hex = (bytes, label) => z
-    .string()
-    .trim()
-    .regex(new RegExp(`^[0-9a-fA-F]{${bytes * 2}}$`), `${label} must be ${bytes * 2} hex characters`);
-/**
- * The identity's secp256k1 public key in Oxy's canonical form: uncompressed SEC1
- * (`04` + 64 bytes), lowercase hex — what `KeyManager.derivePublicKey` produces
- * and `users.public_key` stores.
- */
-export const webIdentityPublicKeySchema = z
-    .string()
-    .trim()
-    .regex(/^04[0-9a-f]{128}$/, 'publicKey must be an uncompressed, lowercase secp256k1 key (130 hex characters)');
-/** A WebAuthn credential id, base64url as the browser reports it. */
-export const webauthnCredentialIdSchema = z
-    .string()
-    .trim()
-    .min(16)
-    .max(1024)
-    .regex(/^[A-Za-z0-9_-]+$/, 'credentialId must be base64url');
-/** A WebAuthn RP ID: a bare registrable host name, lowercase. */
-export const webauthnRpIdSchema = z
-    .string()
-    .trim()
-    .min(1)
-    .max(253)
-    .regex(/^(localhost|[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+)$/, 'rpId must be a lowercase host name');
-/** One passkey's wrap of the envelope's data key. */
-export const webIdentityWrapSchema = z.object({
-    credentialId: webauthnCredentialIdSchema,
-    /** 24-byte XChaCha20-Poly1305 nonce. */
-    nonce: hex(24, 'nonce'),
-    /** The 32-byte DEK sealed under this passkey's KEK, with the 16-byte tag appended (48 bytes). */
-    wrappedKey: hex(48, 'wrappedKey'),
-    createdAt: z.string().datetime(),
-    /** The RP ID the passkey was created under, asserted explicitly by every later ceremony (ADR 0024 D2). */
-    rpId: webauthnRpIdSchema,
-    /**
-     * When this passkey's PRF output was shown to open the envelope. A wrap is a
-     * root HOLDER only once this is set; a login passkey never is by default.
-     */
-    verifiedAt: z.string().datetime().optional(),
-});
-/**
- * The sealed identity as it is stored (server copy and local copy alike).
- *
- * `wraps` holds one entry per passkey able to open it; at least one, and a
- * bounded number so an envelope cannot grow without limit.
- */
-export const webIdentityEnvelopeSchema = z
-    .object({
-    version: z.literal(WEB_IDENTITY_ENVELOPE_VERSION),
-    algorithm: z.literal('xchacha20poly1305'),
-    publicKey: webIdentityPublicKeySchema,
-    secretKind: z.enum(WEB_IDENTITY_SECRET_KINDS),
-    /** 24-byte nonce of the secret seal. */
-    secretNonce: hex(24, 'secretNonce'),
-    /**
-     * The sealed secret, tag appended: 16/20/24/28/32 bytes of BIP-39 entropy
-     * (12–24 words) or a 32-byte private key, plus 16.
-     */
-    sealedSecret: z
-        .string()
-        .trim()
-        .regex(/^(?:[0-9a-fA-F]{64}|[0-9a-fA-F]{72}|[0-9a-fA-F]{80}|[0-9a-fA-F]{88}|[0-9a-fA-F]{96})$/, 'sealedSecret has an unsupported length'),
-    wraps: z.array(webIdentityWrapSchema).min(1).max(10),
-})
-    .refine((envelope) => envelope.secretKind === 'mnemonic-entropy' || envelope.sealedSecret.length === 96, {
-    message: 'a raw private key seals to 48 bytes',
-    path: ['sealedSecret'],
-});
-/**
- * `PUT /identity/web-envelope` — store or replace the caller's envelope.
- *
- * Refused unless `envelope.publicKey` is the identity key already linked to the
- * account: an envelope can only ever carry the account's own identity.
- */
-export const webIdentityEnvelopeUploadSchema = z.object({
-    envelope: webIdentityEnvelopeSchema,
-});
-/** A root holder as the status read reports it — metadata only, nothing that opens anything. */
-export const webIdentityHolderSchema = z.object({
-    credentialId: webauthnCredentialIdSchema,
-    rpId: webauthnRpIdSchema,
-    verifiedAt: z.string().datetime().nullable(),
-    createdAt: z.string().datetime(),
-});
-/**
- * `GET /identity/web-envelope` — the caller's envelope and the readiness facts
- * ADR 0024 D5 keeps separate. A client decides what to show from these fields
- * WITHOUT decrypting anything.
- */
-export const webIdentityEnvelopeResponseSchema = z.object({
-    envelope: webIdentityEnvelopeSchema.nullable(),
-    /** The revision a write must name as `expectedRevision`; `0` when there is no envelope. */
-    revision: z.number().int().nonnegative(),
-    /** Whether the account has a linked root at all (it may live only in Commons). */
-    rootLinked: z.boolean(),
-    /** The web wraps, as metadata. */
-    holders: z.array(webIdentityHolderSchema),
-    /** When the owner confirmed the recovery material is written down, or `null`. */
-    phraseConfirmedAt: z.string().datetime().nullable(),
-    /** When the recovery material was shown to re-derive this root, or `null`. */
-    recoveryVerifiedAt: z.string().datetime().nullable(),
-    updatedAt: z.string().datetime().nullable(),
-});
-/** A root proof, plus the envelope revision the write expects to replace. */
-export const webIdentityEnvelopeProofFieldsSchema = z.object({
-    proof: identityProofSchema,
-    expectedRevision: z.number().int().nonnegative(),
-});
-/**
- * `POST /identity/web-envelope/phrase-confirmed`, `/recovery-verified` and
- * `DELETE /identity/web-envelope` prove control of the root, not just a bearer.
- */
-export const webIdentityEnvelopeActionSchema = webIdentityEnvelopeProofFieldsSchema.strict();
-/** `PUT /identity/web-envelope` body. */
-export const webIdentityEnvelopePutSchema = webIdentityEnvelopeUploadSchema.extend(webIdentityEnvelopeProofFieldsSchema.shape).strict();
-/**
- * A WebAuthn assertion by one of the account's EXISTING passkeys whose
- * `clientDataJSON.challenge` is the proof challenge — the fresh use of the
- * existing factor a keyless account needs before its first root is linked.
- */
-export const webauthnAssertionResponseSchema = z
-    .object({
-    id: webauthnCredentialIdSchema,
-    rawId: z.string().min(1).max(2048),
-    type: z.literal('public-key'),
-    response: z
-        .object({
-        clientDataJSON: z.string().min(1).max(8192),
-        authenticatorData: z.string().min(1).max(8192),
-        signature: z.string().min(1).max(2048),
-        userHandle: z.string().max(2048).optional(),
-    })
-        .passthrough(),
-    clientExtensionResults: z.record(z.string(), z.unknown()).optional(),
-    authenticatorAttachment: z.string().optional(),
-})
-    .passthrough();
-/**
- * `POST /identity/web-envelope/establish` body — an account's FIRST root, linked
- * and stored with its envelope in ONE transaction: one root proof
- * (`web_envelope_establish`, digest of the envelope) plus a fresh `assertion` by
- * an existing passkey over the same challenge.
- */
-export const webIdentityEnvelopeEstablishSchema = webIdentityEnvelopeUploadSchema
-    .extend({ proof: identityProofSchema, assertion: webauthnAssertionResponseSchema })
-    .strict();