@seams/wallet 0.11.0 → 0.12.0

package/dist/public/sdk/{walletRecoveryCommit-DDPa1rAJ.js → walletRecoveryCommit-BYRC_2li.js}

@@ -1 +1 @@
-import{A as e,D as t,M as n,O as r,S as i,T as a,j as o,o as s,s as c}from"./domainIds-BzkGsRqO.js";import{E as l,c as u,d,k as f}from"./chains-C_X_fNuS.js";import{D as p,_ as m,c as h,i as g,j as _,n as v,o as y,r as b,s as x,t as S,y as C}from"./primitives-CqrjmIAH.js";import{i as w,r as T}from"./base64-DW79QA0h.js";import{o as ee}from"./sessionPolicy-CBTZQe1n.js";import{n as te,t as ne}from"./signingSessionSeal-DX41aXUL.js";import{E,O as D,k as O}from"./activeWalletSession-WdZkhtBB.js";import{l as k}from"./capabilityKinds-N8xo_IEh.js";import{d as re,t as A}from"./accountIds-BzZs7YoX.js";import{M as ie,h as ae,m as oe}from"./accountLifecycle-HEUmDLus.js";import{m as se}from"./walletAuthority-BWvfaKIX.js";import{Jt as ce,Kt as le,Nt as ue,Qt as de,Wt as fe,Xt as pe,Yt as me,en as he,q as ge,qt as _e,tn as ve,tt as ye,xt as be}from"./emailOtpEcdsaDerivationIdentity-p0C1CQva.js";import{n as xe}from"./challengeDelivery-5lIu9spR.js";import{l as Se}from"./digestEncoding-CkUc5vtR.js";import{i as Ce}from"./walletAuthMethodRecord-CnBw27ED.js";import{d as j}from"./passkey-custody-Cd_yyoRa.js";import{C as we}from"./ecdsaCapabilityManifest-ChszYCC0.js";import{E as Te,_ as M,r as Ee,u as N}from"./walletCustodyEcdsaContinuity-_IKoCUBO.js";import{a as De,f as P,l as Oe,n as F,t as ke,u as I}from"./wallet-recovery-D7ywcIHw.js";import{o as Ae}from"./helpers-BnkILY2_.js";function je(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`wallet recovery target must be an object`);let t=e,r=Object.keys(t);switch(t.kind){case`passkey`:{if(r.length!==2||!r.includes(`rpId`))throw Error(`Passkey recovery target fields are invalid`);let e=n(t.rpId);if(!e.ok)throw Error(`Passkey recovery target RP ID is invalid`);return{kind:`passkey`,rpId:e.value}}case`google_email_otp`:if(r.length!==2||!r.includes(`googleProvider`)||t.googleProvider!==`google`)throw Error(`Google Email OTP recovery target fields are invalid`);return{kind:`google_email_otp`,googleProvider:`google`};default:throw Error(`wallet recovery target kind is unsupported`)}}const Me=[`ok`,`walletId`,`target`,`recoveryOperationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`wrap`,`entries`,`keyManifest`,`reservationId`,`reservationExpiresAtMs`,`storeVersion`],Ne=[...Me,`registration`];function L(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);return e}function Pe(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==r.size||i.some(e=>!r.has(e)))throw Error(`${n} contains unexpected fields`)}function R(e,t,n){let r=L(e,n);return Pe(r,t,n),r}function z(e,t){return Object.prototype.hasOwnProperty.call(e,t)?Reflect.get(e,t):void 0}function Fe(e){try{return L(e,`walletRecoveryPrepare response`)}catch{return null}}function Ie(e){let t=r(e.walletId);if(!t.ok)throw Error(`wallet recovery ${t.error.message}`);return JSON.stringify({walletId:String(t.value),wrap:e.prepared.wrap,entry:e.prepared.entries[0]})}async function Le(e){let t=await Re(e);return t.ok?await ze({response:t.response,target:e.target,reservationId:e.reservationId}):{kind:t.kind}}async function Re(e){let t=`${_(e.relayUrl)}/wallets/recovery/prepare`,n=e.fetchImpl||fetch;try{return{ok:!0,response:await n(t,p({body:{recoveryCodeB64u:e.recoveryCodeB64u,reservationId:e.reservationId,target:e.target}}))}}catch{return{ok:!1,kind:`transport_uncertain`}}}async function ze(n){let i=n.response,o=Fe(await i.json().catch(()=>({})));if(i.status===200&&o&&z(o,`ok`)===!0)try{let i=R(o,n.target.kind===`passkey`?Ne:Me,`walletRecoveryPrepare`),s=Ge()(z(i,`wrap`),`walletRecoveryPrepare.wrap`),c=Ke(z(i,`entries`)),l=r(z(i,`walletId`));if(!l.ok)throw Error(`walletRecoveryPrepare.walletId is invalid`);let u=l.value,d=je(z(i,`target`));if(!Ue(d,n.target))throw Error(`wallet recovery preparation changed the recovery target`);let f=e(z(i,`recoveryOperationId`)),p=k(z(i,`targetDeviceId`)),m=t(z(i,`targetAuthorityId`)),g=a(z(i,`targetWalletAuthMethodId`));if(!f.ok||!p.ok||!m.ok||!g.ok)throw Error(`wallet recovery preparation target identity is invalid`);let _=qe(z(i,`keyManifest`),u),v=P(z(i,`reservationId`)),y=h(z(i,`reservationExpiresAtMs`),`walletRecoveryPrepare.reservationExpiresAtMs`),b=B(z(i,`storeVersion`),`storeVersion`);if(v!==n.reservationId)throw Error(`wallet recovery preparation changed the reservation identity`);let x={kind:`prepared`,walletId:u,recoveryOperationId:f.value,targetDeviceId:p.value,targetAuthorityId:m.value,targetWalletAuthMethodId:g.value,wrap:s,entries:c,keyManifest:_,reservationId:v,reservationExpiresAtMs:y,storeVersion:b};switch(d.kind){case`passkey`:{let e=Be(String(u),d.rpId)(z(i,`registration`),`registration`);if(e.walletAuthMethodId!==g.value)throw Error(`wallet recovery registration changed the target auth method`);return{...x,target:d,registration:e}}case`google_email_otp`:if(Object.prototype.hasOwnProperty.call(i,`registration`))throw Error(`Google Email OTP recovery cannot carry passkey registration`);return{...x,target:d};default:return We(d)}}catch{return{kind:`transport_uncertain`}}return i.status===409?{kind:`retryable_conflict`}:i.status===401&&o&&z(o,`code`)===`recovery_code_used`?{kind:`consumed`}:i.status===401||i.status===400?{kind:`refused`}:{kind:`transport_uncertain`}}function Be(e,t){let r=w(new TextEncoder().encode(e)),i=D({type:E(`public-key`),id:(e,t)=>{let n=O(o)(e,t);return at(n,t),n}});return D({kind:E(`webauthn_recovery_registration_v1`),challengeId:B,challengeB64u:(e,t)=>it(e,32,t),replacementId:B,walletAuthMethodId:O(a),rpId:O(n),user:D({idB64u:at,name:B,displayName:B},(t,n)=>{if(t.idB64u!==r||t.name!==e||t.displayName!==e)throw Error(`${n} is bound to another wallet`)}),pubKeyCredParams:(e,t)=>{if(!Array.isArray(e)||e.length!==2)throw Error(`${t} is invalid`);return[Ve(-7)(e[0],`${t}[0]`),Ve(-257)(e[1],`${t}[1]`)]},authenticatorSelection:D({residentKey:E(`required`),userVerification:E(`preferred`)}),timeoutMs:(e,t)=>{let n=Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} is invalid`);return n},attestation:E(`none`),extensions:D({prf:D({eval:D({firstB64u:He(ne),secondB64u:He(te)})})}),excludeCredentials:(e,t)=>l(e,t).map((e,n)=>i(e,`${t}[${n}]`))},(e,n)=>{if(e.rpId!==t)throw Error(`${n} changed the relying party`)})}function Ve(e){return D({type:E(`public-key`),alg:(t,n)=>{if(t!==e)throw Error(`${n} is invalid`);return e}})}function He(e){return(t,n)=>{let r=it(t,e.length,n);if(r!==w(e))throw Error(`${n} is unsupported`);return r}}function Ue(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId;case`google_email_otp`:return t.kind===`google_email_otp`&&e.googleProvider===t.googleProvider;default:return We(e)}}function We(e){throw Error(`unsupported wallet recovery target: ${String(e)}`)}function Ge(){return D({nonceB64u:g,wrappedManifestKekB64u:b,aadHashB64u:S})}function Ke(e){if(!Array.isArray(e)||e.length!==1)throw Error(`walletRecoveryPrepare.entries must contain exactly one custody seed`);return[De(e[0],`walletRecoveryPrepare.entries[0]`)]}function B(e,t){if(typeof e!=`string`||!e.trim())throw Error(`walletRecoveryPrepare.${t} must be a non-empty string`);return e.trim()}function qe(e,t){let n=R(e,[`version`,`walletId`,`entries`],`walletRecoveryPrepare.keyManifest`);if(z(n,`version`)!==`wallet_recovery_preparation_key_manifest_v1`)throw Error(`walletRecoveryPrepare.keyManifest version is invalid`);let r=B(z(n,`walletId`),`keyManifest.walletId`);if(r!==t)throw Error(`walletRecoveryPrepare.keyManifest changed the wallet identity`);let i=z(n,`entries`);if(!Array.isArray(i)||i.length===0)throw Error(`walletRecoveryPrepare.keyManifest must contain a key set`);let a=i.map(e=>Je(e,r));if(new Set(a.map(e=>e.keySetId)).size!==a.length)throw Error(`walletRecoveryPrepare.keyManifest contains duplicate key sets`);return{version:`wallet_recovery_preparation_key_manifest_v1`,walletId:r,entries:a}}function Je(e,t){switch(z(L(e,`walletRecoveryPrepare.keyManifest.entries[]`),`kind`)){case`near_ed25519`:{let n=R(e,[`kind`,`keySetId`,`signerId`,`nearAccountId`,`recordedKeyManifestDigestB64u`,`recoveryBasis`],`walletRecoveryPrepare.keyManifest.entries[].near_ed25519`),r=B(z(n,`signerId`),`keyManifest.entries[].signerId`),i=B(z(n,`keySetId`),`keyManifest.entries[].keySetId`),a=`near_ed25519:${r}`;if(i!==a)throw Error(`walletRecoveryPrepare NEAR key-set identity is inconsistent`);let o=B(z(n,`nearAccountId`),`keyManifest.entries[].nearAccountId`),s=Ye(z(n,`recoveryBasis`),t);return{kind:`near_ed25519`,keySetId:a,signerId:r,nearAccountId:o,recordedKeyManifestDigestB64u:S(z(n,`recordedKeyManifestDigestB64u`),`walletRecoveryPrepare.keyManifest.entries[].recordedKeyManifestDigestB64u`),recoveryBasis:s}}case`evm_family_ecdsa`:{let n=R(e,[`kind`,`keySetId`,`keyHandle`,`evmFamilySigningKeySlotId`,`recordedKeyManifestDigestB64u`,`recoveryBasis`],`walletRecoveryPrepare.keyManifest.entries[].evm_family_ecdsa`),r=B(z(n,`keyHandle`),`keyManifest.entries[].keyHandle`),i=B(z(n,`keySetId`),`keyManifest.entries[].keySetId`),a=`evm_family_ecdsa:${r}`;if(i!==a)throw Error(`walletRecoveryPrepare ECDSA key-set identity is inconsistent`);let o=Xe(z(n,`recoveryBasis`),t);return{kind:`evm_family_ecdsa`,keySetId:a,keyHandle:r,evmFamilySigningKeySlotId:Se(z(n,`evmFamilySigningKeySlotId`)),recordedKeyManifestDigestB64u:S(z(n,`recordedKeyManifestDigestB64u`),`walletRecoveryPrepare.keyManifest.entries[].recordedKeyManifestDigestB64u`),recoveryBasis:o}}default:throw Error(`walletRecoveryPrepare key-manifest entry kind is invalid`)}}function Ye(e,t){let n=R(e,[`capabilityKind`,`activeCapabilityBinding`,`scope`,`applicationBinding`,`participantIds`,`registeredPublicKey`,`runtimePolicyScope`,`activationTranscript`,`activationStateEpoch`,`signingWorkerVerifyingShare`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis`),r=z(n,`capabilityKind`);if(r!==`registration`&&r!==`recovery`)throw Error(`walletRecoveryPrepare NEAR recovery capability kind is invalid`);let i=V(z(n,`activeCapabilityBinding`),32,`NEAR recovery active capability binding`),a=et(z(n,`scope`)),o=tt(z(n,`applicationBinding`)),s=rt(z(n,`participantIds`),`NEAR recovery participant IDs`),c=V(z(n,`registeredPublicKey`),32,`NEAR recovery registered public key`),l=nt(z(n,`runtimePolicyScope`)),u=V(z(n,`activationTranscript`),32,`NEAR recovery activation transcript`),d=Number(z(n,`activationStateEpoch`));if(!Number.isSafeInteger(d)||d<=0)throw Error(`walletRecoveryPrepare NEAR recovery activation state epoch is invalid`);let f=V(z(n,`signingWorkerVerifyingShare`),32,`NEAR recovery signing-worker verifying share`);if(o.wallet_id!==t||a.account_id!==t||a.root_share_epoch!==l.signingRootVersion)throw Error(`walletRecoveryPrepare NEAR recovery basis changed its wallet scope`);return{capabilityKind:r,activeCapabilityBinding:i,scope:a,applicationBinding:o,participantIds:s,registeredPublicKey:c,runtimePolicyScope:l,activationTranscript:u,activationStateEpoch:d,signingWorkerVerifyingShare:f}}function Xe(e,t){let n=R(e,[`publicCapability`,`activationReceipt`,`serverGeneration`,`clientRootPublicKey33B64u`,`chainTargets`,`ecdsaThresholdKeyId`,`signingRootId`,`signingRootVersion`,`runtimePolicyScope`,`participantIds`,`possessionChallenge`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis`),r=ge(z(n,`publicCapability`)),i=ye(z(n,`activationReceipt`));if(r.client_id!==t)throw Error(`walletRecoveryPrepare ECDSA recovery capability changed the wallet scope`);let a=ce(z(n,`signingRootId`)),o=me(z(n,`signingRootVersion`)),s=nt(z(n,`runtimePolicyScope`));if(s.signingRootVersion!==o)throw Error(`walletRecoveryPrepare ECDSA recovery scope changed the signing root`);let c=fe(z(n,`serverGeneration`));if(String(i.server_generation)!==String(c))throw Error(`walletRecoveryPrepare ECDSA activation receipt changed server generation`);let l=ke(z(n,`possessionChallenge`));if(l.walletId!==t||l.expectedServerGeneration!==String(c)||l.derivationClientSharePublicKey33B64u!==r.public_identity.derivation_client_share_public_key33_b64u)throw Error(`walletRecoveryPrepare ECDSA possession challenge changed its capability`);return{publicCapability:r,activationReceipt:i,serverGeneration:c,clientRootPublicKey33B64u:_e(B(z(n,`clientRootPublicKey33B64u`),`keyManifest.entries[].recoveryBasis.clientRootPublicKey33B64u`)),chainTargets:Ze(z(n,`chainTargets`)),ecdsaThresholdKeyId:pe(z(n,`ecdsaThresholdKeyId`)),signingRootId:a,signingRootVersion:o,runtimePolicyScope:s,participantIds:$e(z(n,`participantIds`)),possessionChallenge:l}}function Ze(e){if(!Array.isArray(e)||e.length===0)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are invalid`);let t=e.map((e,t)=>Qe(e,t));if(new Set(t.map(Te)).size!==t.length)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are duplicated`);let n=t[0];if(!n)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are invalid`);return[n,...t.slice(1)]}function Qe(e,t){let n=`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.chainTargets[${t}]`,r=L(e,n),i=z(r,`kind`);Pe(r,i===`evm`?[`kind`,`namespace`,`chainId`,`networkSlug`]:[`kind`,`chainId`,`networkSlug`],n);let a=z(r,`namespace`),o=Number(z(r,`chainId`));if(!Number.isSafeInteger(o)||o<=0)throw Error(`walletRecoveryPrepare ECDSA recovery chain id is invalid`);let s=z(r,`networkSlug`),c=typeof s==`string`&&s.trim()?s.trim():null;if(i===`evm`){if(a!==`eip155`)throw Error(`walletRecoveryPrepare ECDSA recovery EVM namespace is invalid`);return{kind:`evm`,namespace:`eip155`,chainId:o,networkSlug:c??`evm-${o}`}}if(i===`tempo`)return{kind:`tempo`,chainId:o,networkSlug:c??`tempo-${o}`};throw Error(`walletRecoveryPrepare ECDSA recovery chain family is invalid`)}function $e(e){if(!Array.isArray(e)||e.length!==2||e[0]!==1||e[1]!==2)throw Error(`walletRecoveryPrepare ECDSA recovery participant IDs are invalid`);return[1,2]}function et(e){let t=R(e,[`lifecycle_id`,`root_share_epoch`,`account_id`,`threshold_session_id`,`signer_set_id`,`signing_worker_id`,`material_activation`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.scope`);return{lifecycle_id:B(z(t,`lifecycle_id`),`keyManifest.entries[].recoveryBasis.scope.lifecycle_id`),root_share_epoch:B(z(t,`root_share_epoch`),`keyManifest.entries[].recoveryBasis.scope.root_share_epoch`),account_id:B(z(t,`account_id`),`keyManifest.entries[].recoveryBasis.scope.account_id`),threshold_session_id:B(z(t,`threshold_session_id`),`keyManifest.entries[].recoveryBasis.scope.threshold_session_id`),signer_set_id:B(z(t,`signer_set_id`),`keyManifest.entries[].recoveryBasis.scope.signer_set_id`),signing_worker_id:B(z(t,`signing_worker_id`),`keyManifest.entries[].recoveryBasis.scope.signing_worker_id`),material_activation:de(z(t,`material_activation`))}}function tt(e){let t=R(e,[`wallet_id`,`near_ed25519_signing_key_id`,`signing_root_id`,`key_creation_signer_slot`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.applicationBinding`),n=Number(z(t,`key_creation_signer_slot`));if(!Number.isSafeInteger(n)||n<=0)throw Error(`walletRecoveryPrepare NEAR recovery key-creation signer slot is invalid`);return{wallet_id:B(z(t,`wallet_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.wallet_id`),near_ed25519_signing_key_id:B(z(t,`near_ed25519_signing_key_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.near_ed25519_signing_key_id`),signing_root_id:B(z(t,`signing_root_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.signing_root_id`),key_creation_signer_slot:n}}function nt(e){let t=R(e,[`orgId`,`projectId`,`envId`,`signingRootVersion`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.runtimePolicyScope`);try{return C(t)}catch{throw Error(`walletRecoveryPrepare NEAR recovery runtime policy scope is invalid`)}}function rt(e,t){if(!Array.isArray(e)||e.length!==2||!Number.isSafeInteger(e[0])||!Number.isSafeInteger(e[1])||Number(e[0])<=0||Number(e[1])<=0||Number(e[0])===Number(e[1]))throw Error(`walletRecoveryPrepare ${t} is invalid`);return[Number(e[0]),Number(e[1])]}function it(e,t,n){let r=B(e,n),i=T(r);if(i.length!==t||w(i)!==r)throw Error(`walletRecoveryPrepare ${n} is invalid`);return r}function at(e,t){let n=B(e,t),r=T(n);if(r.length===0||w(r)!==n)throw Error(`walletRecoveryPrepare ${t} is invalid`);return n}function V(e,t,n){if(!Array.isArray(e)||e.length!==t||e.some(e=>!Number.isInteger(e)||e<0||e>255))throw Error(`walletRecoveryPrepare ${n} is invalid`);return e.map(Number)}const ot=`/wallets/recovery/finalize`;async function st(e){let t=`${_(e.relayUrl)}${ot}`,n=e.fetchImpl||fetch,r;try{r=Ae(e.webauthnRegistration)}catch{return{kind:`refused`}}let i;try{let t=new Set;i=e.ecdsaMaterialPossessionProofs.map(e=>{if(typeof e.keySetId!=`string`||!e.keySetId.startsWith(`evm_family_ecdsa:`)||e.keySetId.length<=17)throw Error(`ECDSA possession proof key-set id is invalid`);if(t.has(e.keySetId))throw Error(`ECDSA possession proof key-set ids are duplicated`);return t.add(e.keySetId),{keySetId:e.keySetId,proof:F(e.proof)}})}catch{return{kind:`refused`}}let a;try{if(a=j(e.replacementEnvelope,`walletRecoveryFinalize.replacementEnvelope`),String(a.walletId)!==String(e.walletId))throw Error(`replacement envelope changed the wallet identity`);if(String(a.envelopeId)!==String(e.replacementId))throw Error(`replacement envelope changed the replacement identity`);if(a.factor.kind!==`passkey`)throw Error(`replacement envelope is not bound to a passkey`)}catch{return{kind:`refused`}}let o;try{o=await n(t,p({body:{kind:`finalize`,walletId:e.walletId,reservationId:e.reservationId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,challengeId:e.challengeId,replacementId:e.replacementId,webauthnRegistration:r,replacementEnvelope:a,ecdsaMaterialPossessionProofs:i}}))}catch{return{kind:`transport_uncertain`}}let s=lt(await o.json().catch(()=>({})));if(o.status===200&&s.kind===`success`)try{let t=await I(s.projection,ut(e,a));if(t.kind!==`passkey`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:t.storeVersion,authority:t.authority,authMethod:t.authMethod}}catch{return{kind:`transport_uncertain`}}return o.status===409?{kind:`retryable_conflict`}:o.status===400||o.status===401?{kind:`refused`}:{kind:`transport_uncertain`}}async function ct(e){let t;try{if(t=j(e.replacementEnvelope,`walletRecoveryReplay.replacementEnvelope`),String(t.walletId)!==String(e.walletId)||String(t.envelopeId)!==String(e.replacementId)||t.factor.kind!==`passkey`)throw Error(`recovery replay envelope identity is invalid`)}catch{return{kind:`refused`}}let n;try{n=await(e.fetchImpl??fetch)(`${_(e.relayUrl)}${ot}`,p({body:{kind:`replay`,walletId:e.walletId,reservationId:e.reservationId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,replacementId:e.replacementId,replacementEnvelope:t}}))}catch{return{kind:`transport_uncertain`}}let r=lt(await n.json().catch(()=>({})));if(n.status===200&&r.kind===`success`)try{let n=await I(r.projection,ut(e,t));if(n.kind!==`passkey`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:n.storeVersion,authority:n.authority,authMethod:n.authMethod}}catch{return{kind:`transport_uncertain`}}return n.status===409?{kind:`retryable_conflict`}:n.status===400||n.status===401?{kind:`refused`}:{kind:`transport_uncertain`}}function lt(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===2&&n.includes(`ok`)&&n.includes(`projection`)&&t.get(`ok`)===!0)return{kind:`success`,projection:t.get(`projection`)};let r=t.get(`code`),i=t.get(`message`);return t.size===3&&n.includes(`ok`)&&n.includes(`code`)&&n.includes(`message`)&&t.get(`ok`)===!1&&typeof r==`string`&&typeof i==`string`?{kind:`failure`,code:r,message:i}:{kind:`invalid`}}function ut(n,i){if(i.factor.kind!==`passkey`)throw Error(`replacement envelope is not a passkey envelope`);return{kind:`passkey`,walletId:H(r(n.walletId)),recoveryOperationId:H(e(n.recoveryOperationId)),targetDeviceId:H(k(n.targetDeviceId)),targetAuthorityId:H(t(n.targetAuthorityId)),targetWalletAuthMethodId:H(a(n.targetWalletAuthMethodId)),rpId:i.factor.rpId,credentialIdB64u:i.factor.credentialIdB64u}}function H(e){if(!e.ok)throw Error(`invalid recovery identity`);return e.value}function U(e){return e.target.kind===`passkey`}function dt(e){return{kind:`email_otp_enrollment_reference_v1`,enrollmentId:e.enrollment.enrollmentId,enrollmentSealKeyVersion:e.enrollment.kind===`existing`?e.enrollment.enrollmentSealKeyVersion:e.enrollment.material.enrollmentSealKeyVersion}}const ft=[`kind`,`keySetId`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`participantIds`,`stateEpoch`,`signingWorkerVerifyingShareB64u`,`materialActivation`,`sealed`],pt=[`kind`,`keySetId`,`possessionProof`,`readyStateBlobB64u`,`publicFacts`],mt=[`contextBinding32B64u`,`derivationClientSharePublicKey33B64u`,`clientVerifyingShare33B64u`,`relayerPublicKey33B64u`,`groupPublicKey33B64u`,`ethereumAddress`,`clientShareRetryCounter`,`relayerShareRetryCounter`],ht=[`kind`,`version`,`recoveryOperationId`,`walletId`,`reservationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`replacementEnvelope`,`keyManifest`,`nearKeySets`,`ecdsaKeySets`,`target`];function W(e,t,n){if(m(e,t,n),Object.keys(e).length!==t.length)throw Error(n+` fields are invalid`)}function G(e,t){if(typeof e!=`string`||!e||e.trim()!==e)throw Error(t+` must be a non-empty canonical string`);return e}function K(e,t,n){let r=G(e,t),i=T(r);if(n!==void 0&&i.byteLength!==n)throw Error(t+` must decode to `+n+` bytes`);return r}function gt(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(t+` must be a non-negative safe integer`);return e}function _t(e,t){if(!Array.isArray(e)||e.length!==2||e.some(vt))throw Error(t+` must contain two positive participant IDs`);return[e[0],e[1]]}function vt(e){return typeof e!=`number`||!Number.isSafeInteger(e)||e<1}function yt(e,t){let n=G(f(t,`recovery durable NEAR key set`).keySetId,`recovery durable NEAR keySetId`),r=e.entries.find(e=>e.keySetId===n);if(!r||r.kind!==`near_ed25519`)throw Error(`recovery durable NEAR key-set manifest entry is invalid`);return r}function bt(e,t){let n=G(f(t,`recovery durable ECDSA key set`).keySetId,`recovery durable ECDSA keySetId`),r=e.entries.find(e=>e.keySetId===n);if(!r||r.kind!==`evm_family_ecdsa`)throw Error(`recovery durable ECDSA key-set manifest entry is invalid`);return r}function xt(e){let t=ee(e);if(!t)throw Error(`recovery runtime policy scope is invalid`);return t}function St(e,t){let n=f(e,`recovery durable NEAR key set`);if(W(n,ft,`recovery durable NEAR key set`),n.kind!==`near_ed25519`||n.keySetId!==t.keySetId)throw Error(`recovery durable NEAR key-set identity is invalid`);let r=t.recoveryBasis,a=r.scope.threshold_session_id;if(!i(a).ok)throw Error(`recovery durable NEAR thresholdSessionId is invalid`);let o={kind:ie,applicationBindingDigestB64u:S(n.applicationBindingDigestB64u,`recovery durable NEAR application binding digest`),registeredPublicKeyB64u:v(n.registeredPublicKeyB64u,`recovery durable NEAR registered public key`),participantIds:_t(n.participantIds,`recovery durable NEAR participantIds`),stateEpoch:G(n.stateEpoch,`recovery durable NEAR stateEpoch`),walletId:r.applicationBinding.wallet_id,nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:r.applicationBinding.near_ed25519_signing_key_id,signerSlot:y(r.applicationBinding.key_creation_signer_slot,`recovery durable NEAR signerSlot`),signingWorkerId:r.scope.signing_worker_id,signingWorkerVerifyingShareB64u:v(n.signingWorkerVerifyingShareB64u,`recovery durable NEAR signing-worker verifying share`)},s=f(n.sealed,`recovery durable NEAR sealed material`);return W(s,[`ciphertextB64u`,`nonceB64u`],`recovery durable NEAR sealed material`),{kind:`near_ed25519`,keySetId:t.keySetId,binding:o,thresholdSessionId:a,runtimePolicyScope:xt(r.runtimePolicyScope),materialActivation:de(n.materialActivation),sealed:{ciphertextB64u:b(s.ciphertextB64u,`recovery durable NEAR ciphertext`),nonceB64u:g(s.nonceB64u,`recovery durable NEAR nonce`)}}}function Ct(e){let t=f(e,`recovery durable ECDSA public facts`);W(t,mt,`recovery durable ECDSA public facts`);let n=G(t.ethereumAddress,`recovery durable ECDSA ethereumAddress`).toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(n))throw Error(`recovery durable ECDSA ethereumAddress is invalid`);return{contextBinding32B64u:S(t.contextBinding32B64u,`recovery durable ECDSA context binding`),derivationClientSharePublicKey33B64u:x(t.derivationClientSharePublicKey33B64u,`recovery durable ECDSA client share`),clientVerifyingShare33B64u:x(t.clientVerifyingShare33B64u,`recovery durable ECDSA client verifying share`),relayerPublicKey33B64u:x(t.relayerPublicKey33B64u,`recovery durable ECDSA relayer public key`),groupPublicKey33B64u:x(t.groupPublicKey33B64u,`recovery durable ECDSA group public key`),ethereumAddress:n,clientShareRetryCounter:gt(t.clientShareRetryCounter,`recovery durable ECDSA client-share retry counter`),relayerShareRetryCounter:gt(t.relayerShareRetryCounter,`recovery durable ECDSA relayer-share retry counter`)}}function wt(e,t){let n=f(e,`recovery durable ECDSA key set`);if(W(n,pt,`recovery durable ECDSA key set`),n.kind!==`evm_family_ecdsa`||n.keySetId!==t.keySetId)throw Error(`recovery durable ECDSA key-set identity is invalid`);return{kind:`evm_family_ecdsa`,entry:t,possessionProof:F(n.possessionProof),readyStateBlobB64u:K(n.readyStateBlobB64u,`recovery durable ECDSA ready-state blob`),publicFacts:Ct(n.publicFacts)}}function Tt(e){let t=f(e,`recovery durable registration`);if(W(t,[`kind`,`id`,`rawId`,`type`,`authenticatorAttachment`,`response`],`recovery durable registration`),t.kind!==`wallet_recovery_redacted_registration_v1`)throw Error(`recovery durable registration kind is invalid`);if(t.authenticatorAttachment!==null&&typeof t.authenticatorAttachment!=`string`)throw Error(`recovery durable registration authenticatorAttachment is invalid`);let n=f(t.response,`recovery durable registration response`);if(W(n,[`clientDataJSON`,`attestationObject`,`transports`],`recovery durable registration response`),!Array.isArray(n.transports))throw Error(`recovery durable registration transports are invalid`);return{kind:`wallet_recovery_redacted_registration_v1`,id:G(t.id,`recovery durable registration id`),rawId:K(t.rawId,`recovery durable registration rawId`),type:G(t.type,`recovery durable registration type`),authenticatorAttachment:t.authenticatorAttachment,response:{clientDataJSON:K(n.clientDataJSON,`recovery durable registration clientDataJSON`),attestationObject:K(n.attestationObject,`recovery durable registration attestationObject`),transports:n.transports.map((e,t)=>G(e,`recovery durable registration transports[`+t+`]`))}}}function Et(e){let t=f(e,`recovery durable Email OTP enrollment`);if(t.kind===`existing`)return W(t,[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`],`recovery durable existing Email OTP enrollment`),{kind:`existing`,enrollmentId:G(t.enrollmentId,`recovery enrollmentId`),enrollmentSealKeyVersion:G(t.enrollmentSealKeyVersion,`recovery enrollment seal-key version`)};if(t.kind!==`create`)throw Error(`recovery durable Email OTP enrollment kind is invalid`);W(t,[`kind`,`enrollmentId`,`providerSubject`,`verifiedEmail`,`material`],`recovery durable create Email OTP enrollment`);let n=f(t.material,`recovery durable enrollment material`);return W(n,[`enrollmentSealKeyVersion`,`clientUnlockPublicKeyB64u`,`unlockKeyVersion`,`serverSealedFactorCiphertextB64u`],`recovery durable enrollment material`),{kind:`create`,enrollmentId:G(t.enrollmentId,`recovery enrollmentId`),providerSubject:G(t.providerSubject,`recovery enrollment providerSubject`),verifiedEmail:G(t.verifiedEmail,`recovery enrollment verifiedEmail`),material:{enrollmentSealKeyVersion:G(n.enrollmentSealKeyVersion,`recovery enrollment material seal-key version`),clientUnlockPublicKeyB64u:K(n.clientUnlockPublicKeyB64u,`recovery enrollment client unlock public key`),unlockKeyVersion:G(n.unlockKeyVersion,`recovery enrollment unlock-key version`),serverSealedFactorCiphertextB64u:K(n.serverSealedFactorCiphertextB64u,`recovery enrollment sealed factor ciphertext`)}}}function q(i){let o=f(i,`wallet recovery durable payload`);if(o.kind!==`wallet_recovery_durable_payload_v1`||o.version!==1)throw Error(`wallet recovery durable payload version is invalid`);W(o,[...ht,...f(o.target,`wallet recovery durable target`).kind===`passkey`?[`replacementId`,`challengeId`,`registration`]:[`providerSubject`,`verifiedEmail`,`emailHashHex`,`registrationAuthorityId`,`replacementId`,`enrollment`]],`wallet recovery durable payload`);let s=e(o.recoveryOperationId),l=r(o.walletId),u;try{u=P(o.reservationId)}catch(e){throw Error(`wallet recovery durable reservationId is invalid`,{cause:e})}let d=k(o.targetDeviceId),p=t(o.targetAuthorityId),m=a(o.targetWalletAuthMethodId);if(!s.ok||!l.ok||!d.ok||!p.ok||!m.ok)throw Error(`wallet recovery durable payload identity is invalid`);if(!Array.isArray(o.nearKeySets)||!Array.isArray(o.ecdsaKeySets))throw Error(`wallet recovery durable key-set arrays are invalid`);let h=qe(o.keyManifest,String(l.value)),g=o.nearKeySets.map(e=>St(e,yt(h,e))),_=o.ecdsaKeySets.map(e=>wt(e,bt(h,e))),v=[...g.map(e=>e.keySetId),..._.map(e=>e.entry.keySetId)];if(new Set(v).size!==v.length)throw Error(`wallet recovery durable key-set ids are duplicated`);if(h.entries.length!==v.length||h.entries.some(e=>!v.includes(e.keySetId)))throw Error(`wallet recovery durable key-set manifest coverage is invalid`);let y={kind:`wallet_recovery_durable_payload_v1`,version:1,recoveryOperationId:s.value,walletId:l.value,reservationId:u,targetDeviceId:d.value,targetAuthorityId:p.value,targetWalletAuthMethodId:m.value,replacementEnvelope:j(o.replacementEnvelope,`wallet recovery durable replacementEnvelope`),keyManifest:h,nearKeySets:g,ecdsaKeySets:_};if(String(y.replacementEnvelope.walletId)!==String(l.value))throw Error(`wallet recovery durable replacement envelope wallet changed`);if(y.replacementEnvelope.ownership.kind!==`method_bound`||y.replacementEnvelope.ownership.walletAuthMethodId!==m.value)throw Error(`wallet recovery durable replacement envelope method changed`);for(let e of g)if(e.binding.walletId!==String(l.value))throw Error(`wallet recovery durable NEAR binding wallet changed`);let b=f(o.target,`wallet recovery durable target`);if(b.kind===`passkey`){W(b,[`kind`,`rpId`],`wallet recovery durable passkey target`);let e=n(b.rpId);if(!e.ok)throw Error(`wallet recovery durable passkey RP ID is invalid`);let t=Tt(o.registration);if(t.rawId!==y.replacementEnvelope.factor.credentialIdB64u)throw Error(`wallet recovery durable passkey registration identity changed`);if(y.replacementEnvelope.factor.kind!==`passkey`)throw Error(`wallet recovery durable passkey envelope factor is invalid`);if(y.replacementEnvelope.factor.rpId!==e.value||y.replacementEnvelope.factor.credentialIdB64u!==t.rawId)throw Error(`wallet recovery durable passkey envelope identity changed`);let r=G(o.replacementId,`wallet recovery durable replacementId`);if(String(y.replacementEnvelope.envelopeId)!==r)throw Error(`wallet recovery durable passkey envelope id changed`);return{...y,target:{kind:`passkey`,rpId:e.value},replacementId:r,challengeId:G(o.challengeId,`wallet recovery durable challengeId`),registration:t}}if(b.kind!==`google_email_otp`)throw Error(`wallet recovery durable target kind is invalid`);W(b,[`kind`],`wallet recovery durable Email OTP target`);let x=G(o.providerSubject,`wallet recovery providerSubject`);if(!c(x).ok)throw Error(`wallet recovery durable providerSubject is invalid`);let S=G(o.verifiedEmail,`wallet recovery durable verifiedEmail`),C=G(o.emailHashHex,`wallet recovery durable emailHashHex`);if(!/^[0-9a-f]{64}$/.test(C))throw Error(`wallet recovery durable emailHashHex is invalid`);let w=G(o.registrationAuthorityId,`wallet recovery durable registrationAuthorityId`),T=Et(o.enrollment);if(y.replacementEnvelope.factor.kind!==`email_otp`)throw Error(`wallet recovery durable Email OTP envelope factor is invalid`);let ee=T.kind===`existing`?{enrollmentId:T.enrollmentId,enrollmentSealKeyVersion:T.enrollmentSealKeyVersion}:{enrollmentId:T.enrollmentId,enrollmentSealKeyVersion:T.material.enrollmentSealKeyVersion};if(y.replacementEnvelope.factor.enrollmentId!==ee.enrollmentId||y.replacementEnvelope.factor.enrollmentSealKeyVersion!==ee.enrollmentSealKeyVersion)throw Error(`wallet recovery durable Email OTP envelope identity changed`);if(T.kind===`create`&&(T.providerSubject!==x||T.verifiedEmail!==S))throw Error(`wallet recovery durable Email OTP enrollment identity changed`);let te=G(o.replacementId,`wallet recovery durable replacementId`);if(String(y.replacementEnvelope.envelopeId)!==te)throw Error(`wallet recovery durable Email OTP envelope id changed`);return{...y,target:{kind:`google_email_otp`},providerSubject:x,verifiedEmail:S,emailHashHex:C,registrationAuthorityId:w,replacementId:te,enrollment:T}}function Dt(e){let t=e.nearKeySets.map(e=>({kind:e.kind,keySetId:e.keySetId,applicationBindingDigestB64u:e.binding.applicationBindingDigestB64u,registeredPublicKeyB64u:e.binding.registeredPublicKeyB64u,participantIds:e.binding.participantIds,stateEpoch:e.binding.stateEpoch,signingWorkerVerifyingShareB64u:e.binding.signingWorkerVerifyingShareB64u,materialActivation:e.materialActivation,sealed:e.sealed})),n=e.ecdsaKeySets.map(e=>({kind:e.kind,keySetId:e.entry.keySetId,possessionProof:e.possessionProof,readyStateBlobB64u:e.readyStateBlobB64u,publicFacts:e.publicFacts})),r={kind:e.kind,version:e.version,recoveryOperationId:String(e.recoveryOperationId),walletId:String(e.walletId),reservationId:String(e.reservationId),targetDeviceId:String(e.targetDeviceId),targetAuthorityId:String(e.targetAuthorityId),targetWalletAuthMethodId:String(e.targetWalletAuthMethodId),replacementEnvelope:e.replacementEnvelope,keyManifest:e.keyManifest,nearKeySets:t,ecdsaKeySets:n},i=U(e)?{...r,target:e.target,replacementId:e.replacementId,challengeId:e.challengeId,registration:e.registration}:{...r,target:e.target,providerSubject:e.providerSubject,verifiedEmail:e.verifiedEmail,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,replacementId:e.replacementId,enrollment:e.enrollment};return q(i),i}async function Ot(e){if(U(e))return;let t=await d(e.verifiedEmail);if(e.emailHashHex!==t)throw Error(`wallet recovery durable email hash does not match verified email`);if(e.enrollment.kind===`create`&&(e.enrollment.providerSubject!==e.providerSubject||e.enrollment.verifiedEmail!==e.verifiedEmail))throw Error(`wallet recovery durable enrollment does not match Email OTP identity`)}function J(e){if(U(e)){let t=o(e.registration.rawId);if(!t.ok)throw Error(`wallet recovery durable passkey credential id is invalid`);return{kind:`passkey`,rpId:e.target.rpId,credentialIdB64u:t.value}}let t=c(e.providerSubject);if(!t.ok)throw Error(`wallet recovery durable providerSubject is invalid`);return{kind:`google_email_otp`,providerSubject:t.value,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,enrollment:dt(e)}}function kt(e){return{kind:`near_ed25519`,keySetId:e.entry.keySetId,applicationBindingDigestB64u:e.localMaterial.applicationBindingDigestB64u,registeredPublicKeyB64u:w(e.metadata.registeredPublicKey),participantIds:e.metadata.participantIds,stateEpoch:String(e.metadata.stateEpoch),signingWorkerVerifyingShareB64u:w(e.metadata.signingWorkerVerifyingShare),materialActivation:ve(e.metadata.materialActivation),sealed:{ciphertextB64u:e.localMaterial.b64u,nonceB64u:e.localMaterial.nonceB64u}}}function At(e){return{kind:`evm_family_ecdsa`,keySetId:e.entry.keySetId,possessionProof:F(e.activation.possessionProof),readyStateBlobB64u:e.readyStateBlobB64u,publicFacts:e.publicFacts}}function jt(e){return{kind:`wallet_recovery_redacted_registration_v1`,id:e.id,rawId:e.rawId,type:e.type,authenticatorAttachment:e.authenticatorAttachment??null,response:{clientDataJSON:e.response.clientDataJSON,attestationObject:e.response.attestationObject,transports:[...e.response.transports]}}}async function Mt(e){let t={kind:`wallet_recovery_durable_payload_v1`,version:1,recoveryOperationId:String(e.prepared.recoveryOperationId),walletId:e.walletId,reservationId:e.prepared.reservationId,targetDeviceId:e.prepared.targetDeviceId,targetAuthorityId:e.prepared.targetAuthorityId,targetWalletAuthMethodId:e.prepared.targetWalletAuthMethodId,replacementEnvelope:j(e.recovered.replacementEnvelope,`wallet recovery durable replacement envelope`),keyManifest:{version:`wallet_recovery_preparation_key_manifest_v1`,walletId:String(e.walletId),entries:[...e.recovered.nearKeySets.map(e=>e.entry),...e.recovered.ecdsaKeySets.map(e=>e.entry)]},nearKeySets:e.recovered.nearKeySets.map(kt),ecdsaKeySets:e.recovered.ecdsaKeySets.map(At)};if(e.replacement.kind===`passkey`){if(e.target.kind!==`passkey`)throw Error(`wallet recovery durable payload branch is invalid`);let n=e.prepared.registration;if(!n)throw Error(`wallet recovery registration options are unavailable`);let r=jt(e.replacement.registration);if(r.rawId!==e.replacement.credentialIdB64u)throw Error(`wallet recovery passkey registration rawId changed its credential identity`);let i=q({...t,target:{kind:`passkey`,rpId:e.target.rpId},replacementId:n.replacementId,challengeId:n.challengeId,registration:r});return await Ot(i),i}if(e.target.kind!==`google_email_otp`)throw Error(`wallet recovery durable payload branch is invalid`);let n=e.replacement.enrollment;if(e.replacement.factor.walletAuthMethodId!==t.targetWalletAuthMethodId)throw Error(`wallet recovery Email OTP factor method changed its target identity`);let r=await d(e.replacement.verifiedEmail),i=q({...t,target:{kind:`google_email_otp`},enrollment:n,providerSubject:e.replacement.providerSubject,verifiedEmail:e.replacement.verifiedEmail,emailHashHex:r,registrationAuthorityId:e.replacement.registrationAuthorityId,replacementId:e.replacement.factor.replacementId});return await Ot(i),i}function Nt(e){return new TextEncoder().encode(u({kind:`pending_wallet_recovery_commit_v1`,version:1,...e}))}function Pt(e){return Nt({recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:J(e)})}async function Ft(e){let t=await crypto.subtle.generateKey({name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`]);if(!(t instanceof CryptoKey))throw Error(`wallet recovery durable key generation failed`);let n=crypto.getRandomValues(new Uint8Array(12)),r=new TextEncoder().encode(JSON.stringify(Dt(e)));return{kind:`wallet_recovery_encrypted_material_v1`,key:t,iv:n,ciphertext:new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n,additionalData:Pt(e)},t,r))}}async function It(e){let t=await crypto.subtle.decrypt({name:`AES-GCM`,iv:e.localMaterial.iv,additionalData:Lt(e)},e.localMaterial.key,e.localMaterial.ciphertext),n=q(JSON.parse(new TextDecoder().decode(t)));if(await Ot(n),!Rt(e,n))throw Error(`wallet recovery durable payload identity does not match its journal`);return n}function Lt(e){return Nt({recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:e.target})}function Y(t){let n=e(t);if(!n.ok)throw Error(`wallet recovery operation id is invalid`);return n.value}function Rt(e,t){let n={kind:`pending_wallet_recovery_commit_v1`,version:1,recoveryOperationId:Y(t.recoveryOperationId),walletId:t.walletId,reservationId:t.reservationId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,localMaterial:e.localMaterial,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs},r=J(t);if(e.stage===`awaiting_server_promotion`)return M(e,{...n,stage:`awaiting_server_promotion`,target:r});switch(r.kind){case`passkey`:return e.projection.kind===`passkey`?M(e,{...n,stage:`server_promoted`,target:r,projection:e.projection}):!1;case`google_email_otp`:return e.projection.kind===`google_email_otp`?M(e,{...n,stage:`server_promoted`,target:r,projection:e.projection}):!1}}function zt(e,t,n,r){return{kind:`pending_wallet_recovery_commit_v1`,version:1,recoveryOperationId:Y(e.recoveryOperationId),walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:J(e),localMaterial:t,createdAtMs:n,updatedAtMs:r}}function Bt(e,t,n=Date.now()){return{...zt(e,t,n,n),stage:`awaiting_server_promotion`}}function Vt(e,t,n,r=Date.now()){let i=zt(t,e.localMaterial,e.createdAtMs,Math.max(r,e.createdAtMs+1));if(U(t)){if(n.kind!==`passkey`)throw Error(`wallet recovery promotion projection branch changed`);return{...i,stage:`server_promoted`,target:J(t),projection:n}}if(n.kind!==`google_email_otp`)throw Error(`wallet recovery promotion projection branch changed`);return{...i,stage:`server_promoted`,target:J(t),projection:n}}const Ht=`/wallets/recovery/google-email-otp/finalize`;async function Ut(e){let t=await X(e,`/wallets/recovery/google/verify`,{recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,idToken:e.idToken});if(!t.ok)return t.failure;try{let n=Jt(t.body),r=qt(n,e),i=Q(s(n.challengeId)),a=Number(n.expiresAtMs);if(!Number.isSafeInteger(a)||a<=0)throw Error(`invalid expiry`);return{kind:`verified`,...r,challengeId:i,delivery:xe(n.delivery,`walletRecoveryGoogleVerify.delivery`),expiresAtMs:a}}catch{return{kind:`transport_uncertain`}}}async function Wt(e){let t=await X(e,`/wallets/recovery/email-otp/verify`,{recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,challengeId:e.challengeId,otpCode:e.otpCode});if(!t.ok)return t.failure;try{let n=Yt(t.body),r=qt(n,e),i=Q(s(n.challengeId));if(i!==e.challengeId)throw Error(`challenge changed`);return{kind:`verified`,...r,challengeId:i}}catch{return{kind:`transport_uncertain`}}}async function Gt(e){let t,n;try{if(t=j(e.replacementEnvelope,`walletRecoveryGoogleEmailOtpFinalize.replacementEnvelope`),t.factor.kind!==`email_otp`)throw Error(`wrong factor`);n=e.ecdsaMaterialPossessionProofs.map(e=>({keySetId:e.keySetId,proof:F(e.proof)}))}catch{return{kind:`refused`}}let r=await X(e,Ht,{kind:`finalize`,recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,replacementEnvelope:t,ecdsaMaterialPossessionProofs:n,...e.emailOtpEnrollment?{emailOtpEnrollment:e.emailOtpEnrollment}:{}});if(!r.ok)return r.failure;try{let n=await I(Xt(r.body,`walletRecoveryGoogleEmailOtpFinalize`).projection,en(e,t));if(n.kind!==`google_email_otp`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:n.storeVersion,authority:n.authority,authMethod:n.authMethod}}catch{return{kind:`transport_uncertain`}}}async function Kt(e){let t;try{if(t=j(e.replacementEnvelope,`walletRecoveryGoogleEmailOtpReplay.replacementEnvelope`),t.factor.kind!==`email_otp`||String(t.walletId)!==String(e.walletId))throw Error(`recovery replay envelope identity is invalid`)}catch{return{kind:`refused`}}let n=await X(e,Ht,{kind:`replay`,recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,replacementEnvelope:t});if(!n.ok)return n.failure;try{let r=await I(Xt(n.body,`walletRecoveryGoogleEmailOtpReplay`).projection,en(e,t));if(r.kind!==`google_email_otp`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:r.storeVersion,authority:r.authority,authMethod:r.authMethod}}catch{return{kind:`transport_uncertain`}}}async function X(e,t,n){let r;try{r=await(e.fetchImpl??fetch)(`${_(e.relayUrl)}${t}`,p({body:n}))}catch{return{ok:!1,failure:{kind:`transport_uncertain`}}}let i=await r.json().catch(()=>void 0);return r.status===200?{ok:!0,body:i}:r.status===409||r.status===429?{ok:!1,failure:{kind:`retryable_conflict`}}:r.status===400||r.status===401?{ok:!1,failure:{kind:`refused`}}:{ok:!1,failure:{kind:`transport_uncertain`}}}function qt(t,n){let r=Q(e(t.recoveryOperationId)),i=P(t.reservationId);if(r!==n.recoveryOperationId||i!==n.reservationId)throw Error(`recovery operation identity changed`);return{recoveryOperationId:r,reservationId:i}}function Jt(e){let t=Zt(e,[`ok`,`recoveryOperationId`,`reservationId`,`challengeId`,`delivery`,`expiresAtMs`],`walletRecoveryGoogleVerify`);return $t(t,`walletRecoveryGoogleVerify`),{recoveryOperationId:Z(t,`recoveryOperationId`),reservationId:Z(t,`reservationId`),challengeId:Z(t,`challengeId`),delivery:Z(t,`delivery`),expiresAtMs:Z(t,`expiresAtMs`)}}function Yt(e){let t=Zt(e,[`ok`,`recoveryOperationId`,`reservationId`,`challengeId`],`walletRecoveryEmailOtpVerify`);return $t(t,`walletRecoveryEmailOtpVerify`),{recoveryOperationId:Z(t,`recoveryOperationId`),reservationId:Z(t,`reservationId`),challengeId:Z(t,`challengeId`)}}function Xt(e,t){let n=Zt(e,[`ok`,`projection`],t);return $t(n,t),{projection:Z(n,`projection`)}}function Zt(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be a JSON object`);let r=Object.getPrototypeOf(e);if(r!==Object.prototype&&r!==null)throw Error(`${n} must be a plain JSON object`);let i=Object.keys(e);if(i.length!==t.length||!Qt(i,t))throw Error(`${n} has an unexpected response shape`);return e}function Qt(e,t){for(let n of t)if(!e.includes(n))return!1;return!0}function $t(e,t){if(Z(e,`ok`)!==!0)throw Error(`${t} did not succeed`)}function Z(e,t){let n=Object.getOwnPropertyDescriptor(e,t);if(!n||!(`value`in n))throw Error(`response field ${t} is missing`);return n.value}function Q(e){if(!e.ok)throw Error(`invalid domain identity`);return e.value}function $(e){if(typeof e!=`string`||!e.trim())throw Error(`value must be a string`);return e.trim()}function en(e,t){if(t.factor.kind!==`email_otp`)throw Error(`replacement envelope is not an Email OTP envelope`);return{kind:`google_email_otp`,walletId:e.walletId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,providerSubject:Q(c(e.expectedProviderSubject)),emailHashHex:tn(e.expectedEmailHashHex),registrationAuthorityId:$(e.expectedRegistrationAuthorityId),enrollment:{kind:`email_otp_enrollment_reference_v1`,enrollmentId:$(t.factor.enrollmentId),enrollmentSealKeyVersion:$(t.factor.enrollmentSealKeyVersion)}}}function tn(e){let t=$(e);if(!/^[0-9a-f]{64}$/.test(t))throw Error(`email hash is invalid`);return t}async function nn(e,t){if(e.version!==t.version||e.storeVersion!==t.storeVersion||e.walletId!==t.walletId||e.recoveryOperationId!==t.recoveryOperationId||e.targetDeviceId!==t.targetDeviceId||e.targetAuthorityId!==t.targetAuthorityId||e.targetWalletAuthMethodId!==t.targetWalletAuthMethodId||!await se(e.authority,t.authority)||!Ce(e.authMethod,t.authMethod)||e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`?e.target.kind===t.target.kind&&e.target.rpId===t.target.rpId&&e.target.credentialIdB64u===t.target.credentialIdB64u:!1;case`google_email_otp`:return t.kind===`google_email_otp`?e.target.kind===t.target.kind&&e.target.provider===t.target.provider&&e.target.providerSubject===t.target.providerSubject&&e.target.emailHashHex===t.target.emailHashHex&&e.target.registrationAuthorityId===t.target.registrationAuthorityId&&e.target.enrollment.kind===t.target.enrollment.kind&&e.target.enrollment.enrollmentId===t.target.enrollment.enrollmentId&&e.target.enrollment.enrollmentSealKeyVersion===t.target.enrollment.enrollmentSealKeyVersion:!1;default:return rn(e)}}function rn(e){throw Error(`unsupported wallet recovery projection: ${String(e)}`)}function an(e){let t=Y(e.payload.recoveryOperationId);switch(e.kind){case`passkey`:return Oe({kind:`passkey`,storeVersion:e.promotion.storeVersion,walletId:e.payload.walletId,recoveryOperationId:t,targetDeviceId:e.payload.targetDeviceId,targetAuthorityId:e.payload.targetAuthorityId,targetWalletAuthMethodId:e.payload.targetWalletAuthMethodId,authority:e.promotion.authority,authMethod:e.promotion.authMethod});case`google_email_otp`:{let n=c(e.payload.providerSubject);if(!n.ok)throw Error(`wallet recovery provider subject is invalid`);return Oe({kind:`google_email_otp`,storeVersion:e.promotion.storeVersion,walletId:e.payload.walletId,recoveryOperationId:t,targetDeviceId:e.payload.targetDeviceId,targetAuthorityId:e.payload.targetAuthorityId,targetWalletAuthMethodId:e.payload.targetWalletAuthMethodId,authority:e.promotion.authority,authMethod:e.promotion.authMethod,providerSubject:n.value,emailHashHex:e.payload.emailHashHex,registrationAuthorityId:e.payload.registrationAuthorityId,enrollment:dt(e.payload)})}}}function on(e){return e.ecdsaKeySets.map(e=>({keySetId:e.entry.keySetId,proof:e.possessionProof}))}function sn(e){return{id:e.registration.id,rawId:e.registration.rawId,type:e.registration.type,authenticatorAttachment:e.registration.authenticatorAttachment??void 0,response:{clientDataJSON:e.registration.response.clientDataJSON,attestationObject:e.registration.response.attestationObject,transports:[...e.registration.response.transports]},clientExtensionResults:{prf:{results:{first:void 0,second:void 0}}}}}async function cn(e){let{payload:t}=e;if(U(t)){let n=await st({relayUrl:e.relayUrl,walletId:String(t.walletId),reservationId:String(t.reservationId),recoveryOperationId:Y(t.recoveryOperationId),targetDeviceId:String(t.targetDeviceId),targetAuthorityId:String(t.targetAuthorityId),targetWalletAuthMethodId:String(t.targetWalletAuthMethodId),challengeId:t.challengeId,replacementId:t.replacementId,webauthnRegistration:sn(t),replacementEnvelope:t.replacementEnvelope,ecdsaMaterialPossessionProofs:on(t),fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`passkey`,payload:t,promotion:n}:n}let n=await Gt({relayUrl:e.relayUrl,recoveryOperationId:Y(t.recoveryOperationId),reservationId:t.reservationId,walletId:t.walletId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,expectedProviderSubject:t.providerSubject,expectedEmailHashHex:t.emailHashHex,expectedRegistrationAuthorityId:t.registrationAuthorityId,replacementEnvelope:t.replacementEnvelope,ecdsaMaterialPossessionProofs:on(t),emailOtpEnrollment:ln(t.enrollment),fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`google_email_otp`,payload:t,promotion:n}:n}function ln(e){return e.kind===`create`?{kind:`create`,material:e.material}:null}async function un(e){let{payload:t}=e;if(U(t)){let n=await ct({relayUrl:e.relayUrl,walletId:String(t.walletId),reservationId:String(t.reservationId),recoveryOperationId:Y(t.recoveryOperationId),targetDeviceId:String(t.targetDeviceId),targetAuthorityId:String(t.targetAuthorityId),targetWalletAuthMethodId:String(t.targetWalletAuthMethodId),replacementId:t.replacementId,replacementEnvelope:t.replacementEnvelope,fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`passkey`,payload:t,promotion:n}:n}let n=await Kt({relayUrl:e.relayUrl,recoveryOperationId:Y(t.recoveryOperationId),reservationId:t.reservationId,walletId:t.walletId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,expectedProviderSubject:t.providerSubject,expectedEmailHashHex:t.emailHashHex,expectedRegistrationAuthorityId:t.registrationAuthorityId,replacementEnvelope:t.replacementEnvelope,fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`google_email_otp`,payload:t,promotion:n}:n}function dn(e){return e.kind===`passkey`||e.kind===`google_email_otp`}async function fn(e){let t=await un(e);return dn(t)||t.kind!==`refused`?t:await cn(e)}function pn(e,t){return{walletId:e.walletId,factor:{kind:`passkey`,credentialIdB64u:t.target.credentialIdB64u},verifier:{kind:`webauthn`,rpId:t.target.rpId},bindingId:t.authMethod.walletAuthMethodId}}function mn(e,t){let n=be({walletId:e.walletId,provider:`google`,providerUserId:e.providerSubject,emailHashHex:e.emailHashHex});return{walletId:n.walletId,factor:n.factor,verifier:n.verifier,bindingId:t.authMethod.walletAuthMethodId}}async function hn(e,t){if(U(e)){if(t.kind!==`passkey`)throw Error(`wallet recovery projection branch changed`);return ue({authority:pn(e,t)})}if(t.kind!==`google_email_otp`)throw Error(`wallet recovery projection branch changed`);return ue({authority:mn(e,t)})}async function gn(e){let t=[],n=[];for(let r of e.payload.ecdsaKeySets){let i=r.entry,a=i.recoveryBasis,o=await le({walletId:e.payload.walletId,signingRootId:a.signingRootId,signingRootVersion:a.signingRootVersion}),s=await Ee({authority:e.authority,chainTargets:a.chainTargets,walletId:String(e.payload.walletId),keyHandle:i.keyHandle,ecdsaThresholdKeyId:a.ecdsaThresholdKeyId,signingRootId:a.signingRootId,signingRootVersion:a.signingRootVersion,relayerKeyId:o,participantIds:a.participantIds,publicCapability:a.publicCapability,activationReceipt:a.activationReceipt,runtimePolicyScope:a.runtimePolicyScope,readyStateBlobB64u:r.readyStateBlobB64u,publicFacts:r.publicFacts});n.push(s);for(let n of a.chainTargets)t.push(_n({payload:e.payload,keySet:r,chainTarget:n,materialRef:s.roleLocalMaterialRef,relayerKeyId:o}))}return{walletKeys:t,ecdsaContinuity:n}}function _n(e){let t=e.keySet.entry,n=t.recoveryBasis,r=e.keySet.publicFacts,i=we({walletId:e.payload.walletId,chainTarget:e.chainTarget,keyHandle:t.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,applicationBindingDigestB64u:n.publicCapability.context.application_binding_digest_b64u,clientParticipantId:1,relayerParticipantId:2,participantIds:n.participantIds,contextBinding32B64u:r.contextBinding32B64u,derivationClientSharePublicKey33B64u:r.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:r.relayerPublicKey33B64u,groupPublicKey33B64u:r.groupPublicKey33B64u,ethereumAddress:r.ethereumAddress,publicCapability:n.publicCapability});return{keyScope:`evm-family`,chainTarget:e.chainTarget,walletId:String(e.payload.walletId),evmFamilySigningKeySlotId:t.evmFamilySigningKeySlotId,keyHandle:t.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,thresholdEcdsaPublicKeyB64u:r.groupPublicKey33B64u,thresholdOwnerAddress:r.ethereumAddress,relayerKeyId:e.relayerKeyId,relayerVerifyingShareB64u:r.relayerPublicKey33B64u,participantIds:n.participantIds,publicCapability:n.publicCapability,roleLocalMaterialRef:e.materialRef,ecdsaRoleLocalPublicFacts:i}}function vn(e){if(e.nearKeySets.length!==1)throw Error(`wallet recovery requires exactly one NEAR key set`);return e.nearKeySets[0]}function yn(e){return[...e.registration.response.transports]}function bn(e){return`ed25519:${re(T(vn(e).binding.registeredPublicKeyB64u))}`}function xn(e,t){let n=i(t.thresholdSessionId);if(!n.ok)throw Error(`recovery NEAR threshold session id is invalid`);return{walletId:e.walletId,nearAccountId:A(t.binding.nearAccountId),thresholdSessionId:n.value,runtimePolicyScope:t.runtimePolicyScope,materialActivation:he(t.materialActivation)}}async function Sn(e){if(U(e.payload)){if(e.projection.kind!==`passkey`)throw Error(`wallet recovery projection branch changed`);let t={walletId:e.payload.walletId,rpId:e.projection.target.rpId,credentialIdB64u:e.projection.target.credentialIdB64u,credentialPublicKeyB64u:e.projection.authMethod.credentialPublicKeyB64u,transports:yn(e.payload),walletKeys:e.walletKeys};if(e.payload.nearKeySets.length===0)return ae({kind:`evm_family_ecdsa`,...t});let n=vn(e.payload);return ae({kind:`near_ed25519`,...t,nearAccountId:A(n.binding.nearAccountId),nearEd25519SigningKeyId:n.binding.nearEd25519SigningKeyId,signerSlot:n.binding.signerSlot,operationalPublicKey:bn(e.payload),relayerKeyId:n.binding.signingWorkerId,participantIds:n.binding.participantIds,custodyMaterials:e.payload.nearKeySets.map(e=>({binding:e.binding,sealed:e.sealed}))})}if(e.projection.kind!==`google_email_otp`)throw Error(`wallet recovery projection branch changed`);let t=mn(e.payload,e.projection),n={walletId:e.payload.walletId,email:e.payload.verifiedEmail,registrationAuthorityId:e.payload.registrationAuthorityId,authority:t,walletKeys:e.walletKeys};if(e.payload.nearKeySets.length===0)return oe({kind:`evm_family_ecdsa`,...n});let r=vn(e.payload);return oe({kind:`near_ed25519`,...n,nearAccountId:A(r.binding.nearAccountId),nearEd25519SigningKeyId:r.binding.nearEd25519SigningKeyId,signerSlot:r.binding.signerSlot,operationalPublicKey:bn(e.payload),relayerKeyId:r.binding.signingWorkerId,participantIds:r.binding.participantIds,custodyMaterials:e.payload.nearKeySets.map(e=>({binding:e.binding,sealed:e.sealed}))})}async function Cn(e){let t=e.pending.projection,n=await hn(e.payload,t),r=await gn({payload:e.payload,authority:n}),i=await Sn({payload:e.payload,projection:t,walletKeys:r.walletKeys});await N.publishPendingWalletRecoveryCommit({pending:e.pending,authority:t.authority,authMethod:t.authMethod,registration:i,ecdsaContinuity:r.ecdsaContinuity,ed25519PublicCapabilityReferences:e.payload.nearKeySets.map(t=>xn(e.payload,t))})}async function wn(e){let t=await N.listPendingWalletRecoveryCommits(),n=[];for(let r of t)try{let t=await It(r),i=r.stage===`awaiting_server_promotion`?await fn({relayUrl:e.relayUrl,payload:t,fetchImpl:e.fetchImpl}):await un({relayUrl:e.relayUrl,payload:t,fetchImpl:e.fetchImpl});if(!dn(i)){if(i.kind===`refused`){await N.deletePendingWalletRecoveryCommit(r.recoveryOperationId),n.push({kind:`discarded`,recoveryOperationId:String(r.recoveryOperationId)});continue}n.push({kind:`pending`,recoveryOperationId:String(r.recoveryOperationId),failure:i});continue}let a=i,o=an(a),s=r.stage===`awaiting_server_promotion`?await N.advancePendingWalletRecoveryCommit({awaiting:r,promoted:Vt(r,a.payload,o,r.updatedAtMs+1)}):r;if(r.stage===`server_promoted`&&!await nn(r.projection,o))throw Error(`wallet recovery replay projection changed`);await Cn({pending:s,payload:a.payload}),n.push({kind:`completed`,recoveryOperationId:String(r.recoveryOperationId)})}catch(e){console.warn(`[SeamsWeb] pending wallet recovery replay failed before classification:`,String(r.recoveryOperationId),e instanceof Error?e.message:String(e||`unknown error`)),n.push({kind:`corrupt`,recoveryOperationId:String(r.recoveryOperationId)})}return n}async function Tn(e){let t=await Mt(e.operation);return{payload:t,pending:Bt(t,await Ft(t),e.nowMs)}}async function En(e){let t=an(e.promotion);return N.advancePendingWalletRecoveryCommit({awaiting:e.awaiting,promoted:Vt(e.awaiting,e.promotion.payload,t,e.awaiting.updatedAtMs+1)})}export{Gt as a,U as c,Le as d,wn as i,st as l,En as n,Wt as o,Cn as r,Ut as s,Tn as t,Ie as u};
+import{A as e,D as t,M as n,O as r,S as i,T as a,j as o,o as s,s as c}from"./domainIds-BzkGsRqO.js";import{E as l,c as u,d,k as f}from"./chains-C_X_fNuS.js";import{D as p,_ as m,c as h,i as g,j as _,n as v,o as y,r as b,s as x,t as S,y as C}from"./primitives-CqrjmIAH.js";import{i as w,r as T}from"./base64-DW79QA0h.js";import{o as ee}from"./sessionPolicy-CBTZQe1n.js";import{n as te,t as ne}from"./signingSessionSeal-DX41aXUL.js";import{E,O as D,k as O}from"./activeWalletSession-WdZkhtBB.js";import{l as k}from"./capabilityKinds-N8xo_IEh.js";import{d as re,t as A}from"./accountIds-BzZs7YoX.js";import{M as ie,h as ae,m as oe}from"./accountLifecycle-HEUmDLus.js";import{m as se}from"./walletAuthority-BWvfaKIX.js";import{Jt as ce,Kt as le,Nt as ue,Qt as de,Wt as fe,Xt as pe,Yt as me,en as he,q as ge,qt as _e,tn as ve,tt as ye,xt as be}from"./emailOtpEcdsaDerivationIdentity-p0C1CQva.js";import{n as xe}from"./challengeDelivery-5lIu9spR.js";import{l as Se}from"./digestEncoding-CkUc5vtR.js";import{i as Ce}from"./walletAuthMethodRecord-CnBw27ED.js";import{d as j}from"./passkey-custody-Cd_yyoRa.js";import{C as we}from"./ecdsaCapabilityManifest-ChszYCC0.js";import{E as Te,_ as M,r as Ee,u as N}from"./walletCustodyEcdsaContinuity-D-gYxv6e.js";import{a as De,f as P,l as Oe,n as F,t as ke,u as I}from"./wallet-recovery-LMtGiEL3.js";import{o as Ae}from"./helpers-BnkILY2_.js";function je(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`wallet recovery target must be an object`);let t=e,r=Object.keys(t);switch(t.kind){case`passkey`:{if(r.length!==2||!r.includes(`rpId`))throw Error(`Passkey recovery target fields are invalid`);let e=n(t.rpId);if(!e.ok)throw Error(`Passkey recovery target RP ID is invalid`);return{kind:`passkey`,rpId:e.value}}case`google_email_otp`:if(r.length!==2||!r.includes(`googleProvider`)||t.googleProvider!==`google`)throw Error(`Google Email OTP recovery target fields are invalid`);return{kind:`google_email_otp`,googleProvider:`google`};default:throw Error(`wallet recovery target kind is unsupported`)}}const Me=[`ok`,`walletId`,`target`,`recoveryOperationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`wrap`,`entries`,`keyManifest`,`reservationId`,`reservationExpiresAtMs`,`storeVersion`],Ne=[...Me,`registration`];function L(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);return e}function Pe(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==r.size||i.some(e=>!r.has(e)))throw Error(`${n} contains unexpected fields`)}function R(e,t,n){let r=L(e,n);return Pe(r,t,n),r}function z(e,t){return Object.prototype.hasOwnProperty.call(e,t)?Reflect.get(e,t):void 0}function Fe(e){try{return L(e,`walletRecoveryPrepare response`)}catch{return null}}function Ie(e){let t=r(e.walletId);if(!t.ok)throw Error(`wallet recovery ${t.error.message}`);return JSON.stringify({walletId:String(t.value),wrap:e.prepared.wrap,entry:e.prepared.entries[0]})}async function Le(e){let t=await Re(e);return t.ok?await ze({response:t.response,target:e.target,reservationId:e.reservationId}):{kind:t.kind}}async function Re(e){let t=`${_(e.relayUrl)}/wallets/recovery/prepare`,n=e.fetchImpl||fetch;try{return{ok:!0,response:await n(t,p({body:{recoveryCodeB64u:e.recoveryCodeB64u,reservationId:e.reservationId,target:e.target}}))}}catch{return{ok:!1,kind:`transport_uncertain`}}}async function ze(n){let i=n.response,o=Fe(await i.json().catch(()=>({})));if(i.status===200&&o&&z(o,`ok`)===!0)try{let i=R(o,n.target.kind===`passkey`?Ne:Me,`walletRecoveryPrepare`),s=Ge()(z(i,`wrap`),`walletRecoveryPrepare.wrap`),c=Ke(z(i,`entries`)),l=r(z(i,`walletId`));if(!l.ok)throw Error(`walletRecoveryPrepare.walletId is invalid`);let u=l.value,d=je(z(i,`target`));if(!Ue(d,n.target))throw Error(`wallet recovery preparation changed the recovery target`);let f=e(z(i,`recoveryOperationId`)),p=k(z(i,`targetDeviceId`)),m=t(z(i,`targetAuthorityId`)),g=a(z(i,`targetWalletAuthMethodId`));if(!f.ok||!p.ok||!m.ok||!g.ok)throw Error(`wallet recovery preparation target identity is invalid`);let _=qe(z(i,`keyManifest`),u),v=P(z(i,`reservationId`)),y=h(z(i,`reservationExpiresAtMs`),`walletRecoveryPrepare.reservationExpiresAtMs`),b=B(z(i,`storeVersion`),`storeVersion`);if(v!==n.reservationId)throw Error(`wallet recovery preparation changed the reservation identity`);let x={kind:`prepared`,walletId:u,recoveryOperationId:f.value,targetDeviceId:p.value,targetAuthorityId:m.value,targetWalletAuthMethodId:g.value,wrap:s,entries:c,keyManifest:_,reservationId:v,reservationExpiresAtMs:y,storeVersion:b};switch(d.kind){case`passkey`:{let e=Be(String(u),d.rpId)(z(i,`registration`),`registration`);if(e.walletAuthMethodId!==g.value)throw Error(`wallet recovery registration changed the target auth method`);return{...x,target:d,registration:e}}case`google_email_otp`:if(Object.prototype.hasOwnProperty.call(i,`registration`))throw Error(`Google Email OTP recovery cannot carry passkey registration`);return{...x,target:d};default:return We(d)}}catch{return{kind:`transport_uncertain`}}return i.status===409?{kind:`retryable_conflict`}:i.status===401&&o&&z(o,`code`)===`recovery_code_used`?{kind:`consumed`}:i.status===401||i.status===400?{kind:`refused`}:{kind:`transport_uncertain`}}function Be(e,t){let r=w(new TextEncoder().encode(e)),i=D({type:E(`public-key`),id:(e,t)=>{let n=O(o)(e,t);return at(n,t),n}});return D({kind:E(`webauthn_recovery_registration_v1`),challengeId:B,challengeB64u:(e,t)=>it(e,32,t),replacementId:B,walletAuthMethodId:O(a),rpId:O(n),user:D({idB64u:at,name:B,displayName:B},(t,n)=>{if(t.idB64u!==r||t.name!==e||t.displayName!==e)throw Error(`${n} is bound to another wallet`)}),pubKeyCredParams:(e,t)=>{if(!Array.isArray(e)||e.length!==2)throw Error(`${t} is invalid`);return[Ve(-7)(e[0],`${t}[0]`),Ve(-257)(e[1],`${t}[1]`)]},authenticatorSelection:D({residentKey:E(`required`),userVerification:E(`preferred`)}),timeoutMs:(e,t)=>{let n=Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} is invalid`);return n},attestation:E(`none`),extensions:D({prf:D({eval:D({firstB64u:He(ne),secondB64u:He(te)})})}),excludeCredentials:(e,t)=>l(e,t).map((e,n)=>i(e,`${t}[${n}]`))},(e,n)=>{if(e.rpId!==t)throw Error(`${n} changed the relying party`)})}function Ve(e){return D({type:E(`public-key`),alg:(t,n)=>{if(t!==e)throw Error(`${n} is invalid`);return e}})}function He(e){return(t,n)=>{let r=it(t,e.length,n);if(r!==w(e))throw Error(`${n} is unsupported`);return r}}function Ue(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId;case`google_email_otp`:return t.kind===`google_email_otp`&&e.googleProvider===t.googleProvider;default:return We(e)}}function We(e){throw Error(`unsupported wallet recovery target: ${String(e)}`)}function Ge(){return D({nonceB64u:g,wrappedManifestKekB64u:b,aadHashB64u:S})}function Ke(e){if(!Array.isArray(e)||e.length!==1)throw Error(`walletRecoveryPrepare.entries must contain exactly one custody seed`);return[De(e[0],`walletRecoveryPrepare.entries[0]`)]}function B(e,t){if(typeof e!=`string`||!e.trim())throw Error(`walletRecoveryPrepare.${t} must be a non-empty string`);return e.trim()}function qe(e,t){let n=R(e,[`version`,`walletId`,`entries`],`walletRecoveryPrepare.keyManifest`);if(z(n,`version`)!==`wallet_recovery_preparation_key_manifest_v1`)throw Error(`walletRecoveryPrepare.keyManifest version is invalid`);let r=B(z(n,`walletId`),`keyManifest.walletId`);if(r!==t)throw Error(`walletRecoveryPrepare.keyManifest changed the wallet identity`);let i=z(n,`entries`);if(!Array.isArray(i)||i.length===0)throw Error(`walletRecoveryPrepare.keyManifest must contain a key set`);let a=i.map(e=>Je(e,r));if(new Set(a.map(e=>e.keySetId)).size!==a.length)throw Error(`walletRecoveryPrepare.keyManifest contains duplicate key sets`);return{version:`wallet_recovery_preparation_key_manifest_v1`,walletId:r,entries:a}}function Je(e,t){switch(z(L(e,`walletRecoveryPrepare.keyManifest.entries[]`),`kind`)){case`near_ed25519`:{let n=R(e,[`kind`,`keySetId`,`signerId`,`nearAccountId`,`recordedKeyManifestDigestB64u`,`recoveryBasis`],`walletRecoveryPrepare.keyManifest.entries[].near_ed25519`),r=B(z(n,`signerId`),`keyManifest.entries[].signerId`),i=B(z(n,`keySetId`),`keyManifest.entries[].keySetId`),a=`near_ed25519:${r}`;if(i!==a)throw Error(`walletRecoveryPrepare NEAR key-set identity is inconsistent`);let o=B(z(n,`nearAccountId`),`keyManifest.entries[].nearAccountId`),s=Ye(z(n,`recoveryBasis`),t);return{kind:`near_ed25519`,keySetId:a,signerId:r,nearAccountId:o,recordedKeyManifestDigestB64u:S(z(n,`recordedKeyManifestDigestB64u`),`walletRecoveryPrepare.keyManifest.entries[].recordedKeyManifestDigestB64u`),recoveryBasis:s}}case`evm_family_ecdsa`:{let n=R(e,[`kind`,`keySetId`,`keyHandle`,`evmFamilySigningKeySlotId`,`recordedKeyManifestDigestB64u`,`recoveryBasis`],`walletRecoveryPrepare.keyManifest.entries[].evm_family_ecdsa`),r=B(z(n,`keyHandle`),`keyManifest.entries[].keyHandle`),i=B(z(n,`keySetId`),`keyManifest.entries[].keySetId`),a=`evm_family_ecdsa:${r}`;if(i!==a)throw Error(`walletRecoveryPrepare ECDSA key-set identity is inconsistent`);let o=Xe(z(n,`recoveryBasis`),t);return{kind:`evm_family_ecdsa`,keySetId:a,keyHandle:r,evmFamilySigningKeySlotId:Se(z(n,`evmFamilySigningKeySlotId`)),recordedKeyManifestDigestB64u:S(z(n,`recordedKeyManifestDigestB64u`),`walletRecoveryPrepare.keyManifest.entries[].recordedKeyManifestDigestB64u`),recoveryBasis:o}}default:throw Error(`walletRecoveryPrepare key-manifest entry kind is invalid`)}}function Ye(e,t){let n=R(e,[`capabilityKind`,`activeCapabilityBinding`,`scope`,`applicationBinding`,`participantIds`,`registeredPublicKey`,`runtimePolicyScope`,`activationTranscript`,`activationStateEpoch`,`signingWorkerVerifyingShare`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis`),r=z(n,`capabilityKind`);if(r!==`registration`&&r!==`recovery`)throw Error(`walletRecoveryPrepare NEAR recovery capability kind is invalid`);let i=V(z(n,`activeCapabilityBinding`),32,`NEAR recovery active capability binding`),a=et(z(n,`scope`)),o=tt(z(n,`applicationBinding`)),s=rt(z(n,`participantIds`),`NEAR recovery participant IDs`),c=V(z(n,`registeredPublicKey`),32,`NEAR recovery registered public key`),l=nt(z(n,`runtimePolicyScope`)),u=V(z(n,`activationTranscript`),32,`NEAR recovery activation transcript`),d=Number(z(n,`activationStateEpoch`));if(!Number.isSafeInteger(d)||d<=0)throw Error(`walletRecoveryPrepare NEAR recovery activation state epoch is invalid`);let f=V(z(n,`signingWorkerVerifyingShare`),32,`NEAR recovery signing-worker verifying share`);if(o.wallet_id!==t||a.account_id!==t||a.root_share_epoch!==l.signingRootVersion)throw Error(`walletRecoveryPrepare NEAR recovery basis changed its wallet scope`);return{capabilityKind:r,activeCapabilityBinding:i,scope:a,applicationBinding:o,participantIds:s,registeredPublicKey:c,runtimePolicyScope:l,activationTranscript:u,activationStateEpoch:d,signingWorkerVerifyingShare:f}}function Xe(e,t){let n=R(e,[`publicCapability`,`activationReceipt`,`serverGeneration`,`clientRootPublicKey33B64u`,`chainTargets`,`ecdsaThresholdKeyId`,`signingRootId`,`signingRootVersion`,`runtimePolicyScope`,`participantIds`,`possessionChallenge`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis`),r=ge(z(n,`publicCapability`)),i=ye(z(n,`activationReceipt`));if(r.client_id!==t)throw Error(`walletRecoveryPrepare ECDSA recovery capability changed the wallet scope`);let a=ce(z(n,`signingRootId`)),o=me(z(n,`signingRootVersion`)),s=nt(z(n,`runtimePolicyScope`));if(s.signingRootVersion!==o)throw Error(`walletRecoveryPrepare ECDSA recovery scope changed the signing root`);let c=fe(z(n,`serverGeneration`));if(String(i.server_generation)!==String(c))throw Error(`walletRecoveryPrepare ECDSA activation receipt changed server generation`);let l=ke(z(n,`possessionChallenge`));if(l.walletId!==t||l.expectedServerGeneration!==String(c)||l.derivationClientSharePublicKey33B64u!==r.public_identity.derivation_client_share_public_key33_b64u)throw Error(`walletRecoveryPrepare ECDSA possession challenge changed its capability`);return{publicCapability:r,activationReceipt:i,serverGeneration:c,clientRootPublicKey33B64u:_e(B(z(n,`clientRootPublicKey33B64u`),`keyManifest.entries[].recoveryBasis.clientRootPublicKey33B64u`)),chainTargets:Ze(z(n,`chainTargets`)),ecdsaThresholdKeyId:pe(z(n,`ecdsaThresholdKeyId`)),signingRootId:a,signingRootVersion:o,runtimePolicyScope:s,participantIds:$e(z(n,`participantIds`)),possessionChallenge:l}}function Ze(e){if(!Array.isArray(e)||e.length===0)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are invalid`);let t=e.map((e,t)=>Qe(e,t));if(new Set(t.map(Te)).size!==t.length)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are duplicated`);let n=t[0];if(!n)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are invalid`);return[n,...t.slice(1)]}function Qe(e,t){let n=`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.chainTargets[${t}]`,r=L(e,n),i=z(r,`kind`);Pe(r,i===`evm`?[`kind`,`namespace`,`chainId`,`networkSlug`]:[`kind`,`chainId`,`networkSlug`],n);let a=z(r,`namespace`),o=Number(z(r,`chainId`));if(!Number.isSafeInteger(o)||o<=0)throw Error(`walletRecoveryPrepare ECDSA recovery chain id is invalid`);let s=z(r,`networkSlug`),c=typeof s==`string`&&s.trim()?s.trim():null;if(i===`evm`){if(a!==`eip155`)throw Error(`walletRecoveryPrepare ECDSA recovery EVM namespace is invalid`);return{kind:`evm`,namespace:`eip155`,chainId:o,networkSlug:c??`evm-${o}`}}if(i===`tempo`)return{kind:`tempo`,chainId:o,networkSlug:c??`tempo-${o}`};throw Error(`walletRecoveryPrepare ECDSA recovery chain family is invalid`)}function $e(e){if(!Array.isArray(e)||e.length!==2||e[0]!==1||e[1]!==2)throw Error(`walletRecoveryPrepare ECDSA recovery participant IDs are invalid`);return[1,2]}function et(e){let t=R(e,[`lifecycle_id`,`root_share_epoch`,`account_id`,`threshold_session_id`,`signer_set_id`,`signing_worker_id`,`material_activation`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.scope`);return{lifecycle_id:B(z(t,`lifecycle_id`),`keyManifest.entries[].recoveryBasis.scope.lifecycle_id`),root_share_epoch:B(z(t,`root_share_epoch`),`keyManifest.entries[].recoveryBasis.scope.root_share_epoch`),account_id:B(z(t,`account_id`),`keyManifest.entries[].recoveryBasis.scope.account_id`),threshold_session_id:B(z(t,`threshold_session_id`),`keyManifest.entries[].recoveryBasis.scope.threshold_session_id`),signer_set_id:B(z(t,`signer_set_id`),`keyManifest.entries[].recoveryBasis.scope.signer_set_id`),signing_worker_id:B(z(t,`signing_worker_id`),`keyManifest.entries[].recoveryBasis.scope.signing_worker_id`),material_activation:de(z(t,`material_activation`))}}function tt(e){let t=R(e,[`wallet_id`,`near_ed25519_signing_key_id`,`signing_root_id`,`key_creation_signer_slot`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.applicationBinding`),n=Number(z(t,`key_creation_signer_slot`));if(!Number.isSafeInteger(n)||n<=0)throw Error(`walletRecoveryPrepare NEAR recovery key-creation signer slot is invalid`);return{wallet_id:B(z(t,`wallet_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.wallet_id`),near_ed25519_signing_key_id:B(z(t,`near_ed25519_signing_key_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.near_ed25519_signing_key_id`),signing_root_id:B(z(t,`signing_root_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.signing_root_id`),key_creation_signer_slot:n}}function nt(e){let t=R(e,[`orgId`,`projectId`,`envId`,`signingRootVersion`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.runtimePolicyScope`);try{return C(t)}catch{throw Error(`walletRecoveryPrepare NEAR recovery runtime policy scope is invalid`)}}function rt(e,t){if(!Array.isArray(e)||e.length!==2||!Number.isSafeInteger(e[0])||!Number.isSafeInteger(e[1])||Number(e[0])<=0||Number(e[1])<=0||Number(e[0])===Number(e[1]))throw Error(`walletRecoveryPrepare ${t} is invalid`);return[Number(e[0]),Number(e[1])]}function it(e,t,n){let r=B(e,n),i=T(r);if(i.length!==t||w(i)!==r)throw Error(`walletRecoveryPrepare ${n} is invalid`);return r}function at(e,t){let n=B(e,t),r=T(n);if(r.length===0||w(r)!==n)throw Error(`walletRecoveryPrepare ${t} is invalid`);return n}function V(e,t,n){if(!Array.isArray(e)||e.length!==t||e.some(e=>!Number.isInteger(e)||e<0||e>255))throw Error(`walletRecoveryPrepare ${n} is invalid`);return e.map(Number)}const ot=`/wallets/recovery/finalize`;async function st(e){let t=`${_(e.relayUrl)}${ot}`,n=e.fetchImpl||fetch,r;try{r=Ae(e.webauthnRegistration)}catch{return{kind:`refused`}}let i;try{let t=new Set;i=e.ecdsaMaterialPossessionProofs.map(e=>{if(typeof e.keySetId!=`string`||!e.keySetId.startsWith(`evm_family_ecdsa:`)||e.keySetId.length<=17)throw Error(`ECDSA possession proof key-set id is invalid`);if(t.has(e.keySetId))throw Error(`ECDSA possession proof key-set ids are duplicated`);return t.add(e.keySetId),{keySetId:e.keySetId,proof:F(e.proof)}})}catch{return{kind:`refused`}}let a;try{if(a=j(e.replacementEnvelope,`walletRecoveryFinalize.replacementEnvelope`),String(a.walletId)!==String(e.walletId))throw Error(`replacement envelope changed the wallet identity`);if(String(a.envelopeId)!==String(e.replacementId))throw Error(`replacement envelope changed the replacement identity`);if(a.factor.kind!==`passkey`)throw Error(`replacement envelope is not bound to a passkey`)}catch{return{kind:`refused`}}let o;try{o=await n(t,p({body:{kind:`finalize`,walletId:e.walletId,reservationId:e.reservationId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,challengeId:e.challengeId,replacementId:e.replacementId,webauthnRegistration:r,replacementEnvelope:a,ecdsaMaterialPossessionProofs:i}}))}catch{return{kind:`transport_uncertain`}}let s=lt(await o.json().catch(()=>({})));if(o.status===200&&s.kind===`success`)try{let t=await I(s.projection,ut(e,a));if(t.kind!==`passkey`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:t.storeVersion,authority:t.authority,authMethod:t.authMethod}}catch{return{kind:`transport_uncertain`}}return o.status===409?{kind:`retryable_conflict`}:o.status===400||o.status===401?{kind:`refused`}:{kind:`transport_uncertain`}}async function ct(e){let t;try{if(t=j(e.replacementEnvelope,`walletRecoveryReplay.replacementEnvelope`),String(t.walletId)!==String(e.walletId)||String(t.envelopeId)!==String(e.replacementId)||t.factor.kind!==`passkey`)throw Error(`recovery replay envelope identity is invalid`)}catch{return{kind:`refused`}}let n;try{n=await(e.fetchImpl??fetch)(`${_(e.relayUrl)}${ot}`,p({body:{kind:`replay`,walletId:e.walletId,reservationId:e.reservationId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,replacementId:e.replacementId,replacementEnvelope:t}}))}catch{return{kind:`transport_uncertain`}}let r=lt(await n.json().catch(()=>({})));if(n.status===200&&r.kind===`success`)try{let n=await I(r.projection,ut(e,t));if(n.kind!==`passkey`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:n.storeVersion,authority:n.authority,authMethod:n.authMethod}}catch{return{kind:`transport_uncertain`}}return n.status===409?{kind:`retryable_conflict`}:n.status===400||n.status===401?{kind:`refused`}:{kind:`transport_uncertain`}}function lt(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===2&&n.includes(`ok`)&&n.includes(`projection`)&&t.get(`ok`)===!0)return{kind:`success`,projection:t.get(`projection`)};let r=t.get(`code`),i=t.get(`message`);return t.size===3&&n.includes(`ok`)&&n.includes(`code`)&&n.includes(`message`)&&t.get(`ok`)===!1&&typeof r==`string`&&typeof i==`string`?{kind:`failure`,code:r,message:i}:{kind:`invalid`}}function ut(n,i){if(i.factor.kind!==`passkey`)throw Error(`replacement envelope is not a passkey envelope`);return{kind:`passkey`,walletId:H(r(n.walletId)),recoveryOperationId:H(e(n.recoveryOperationId)),targetDeviceId:H(k(n.targetDeviceId)),targetAuthorityId:H(t(n.targetAuthorityId)),targetWalletAuthMethodId:H(a(n.targetWalletAuthMethodId)),rpId:i.factor.rpId,credentialIdB64u:i.factor.credentialIdB64u}}function H(e){if(!e.ok)throw Error(`invalid recovery identity`);return e.value}function U(e){return e.target.kind===`passkey`}function dt(e){return{kind:`email_otp_enrollment_reference_v1`,enrollmentId:e.enrollment.enrollmentId,enrollmentSealKeyVersion:e.enrollment.kind===`existing`?e.enrollment.enrollmentSealKeyVersion:e.enrollment.material.enrollmentSealKeyVersion}}const ft=[`kind`,`keySetId`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`participantIds`,`stateEpoch`,`signingWorkerVerifyingShareB64u`,`materialActivation`,`sealed`],pt=[`kind`,`keySetId`,`possessionProof`,`readyStateBlobB64u`,`publicFacts`],mt=[`contextBinding32B64u`,`derivationClientSharePublicKey33B64u`,`clientVerifyingShare33B64u`,`relayerPublicKey33B64u`,`groupPublicKey33B64u`,`ethereumAddress`,`clientShareRetryCounter`,`relayerShareRetryCounter`],ht=[`kind`,`version`,`recoveryOperationId`,`walletId`,`reservationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`replacementEnvelope`,`keyManifest`,`nearKeySets`,`ecdsaKeySets`,`target`];function W(e,t,n){if(m(e,t,n),Object.keys(e).length!==t.length)throw Error(n+` fields are invalid`)}function G(e,t){if(typeof e!=`string`||!e||e.trim()!==e)throw Error(t+` must be a non-empty canonical string`);return e}function K(e,t,n){let r=G(e,t),i=T(r);if(n!==void 0&&i.byteLength!==n)throw Error(t+` must decode to `+n+` bytes`);return r}function gt(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(t+` must be a non-negative safe integer`);return e}function _t(e,t){if(!Array.isArray(e)||e.length!==2||e.some(vt))throw Error(t+` must contain two positive participant IDs`);return[e[0],e[1]]}function vt(e){return typeof e!=`number`||!Number.isSafeInteger(e)||e<1}function yt(e,t){let n=G(f(t,`recovery durable NEAR key set`).keySetId,`recovery durable NEAR keySetId`),r=e.entries.find(e=>e.keySetId===n);if(!r||r.kind!==`near_ed25519`)throw Error(`recovery durable NEAR key-set manifest entry is invalid`);return r}function bt(e,t){let n=G(f(t,`recovery durable ECDSA key set`).keySetId,`recovery durable ECDSA keySetId`),r=e.entries.find(e=>e.keySetId===n);if(!r||r.kind!==`evm_family_ecdsa`)throw Error(`recovery durable ECDSA key-set manifest entry is invalid`);return r}function xt(e){let t=ee(e);if(!t)throw Error(`recovery runtime policy scope is invalid`);return t}function St(e,t){let n=f(e,`recovery durable NEAR key set`);if(W(n,ft,`recovery durable NEAR key set`),n.kind!==`near_ed25519`||n.keySetId!==t.keySetId)throw Error(`recovery durable NEAR key-set identity is invalid`);let r=t.recoveryBasis,a=r.scope.threshold_session_id;if(!i(a).ok)throw Error(`recovery durable NEAR thresholdSessionId is invalid`);let o={kind:ie,applicationBindingDigestB64u:S(n.applicationBindingDigestB64u,`recovery durable NEAR application binding digest`),registeredPublicKeyB64u:v(n.registeredPublicKeyB64u,`recovery durable NEAR registered public key`),participantIds:_t(n.participantIds,`recovery durable NEAR participantIds`),stateEpoch:G(n.stateEpoch,`recovery durable NEAR stateEpoch`),walletId:r.applicationBinding.wallet_id,nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:r.applicationBinding.near_ed25519_signing_key_id,signerSlot:y(r.applicationBinding.key_creation_signer_slot,`recovery durable NEAR signerSlot`),signingWorkerId:r.scope.signing_worker_id,signingWorkerVerifyingShareB64u:v(n.signingWorkerVerifyingShareB64u,`recovery durable NEAR signing-worker verifying share`)},s=f(n.sealed,`recovery durable NEAR sealed material`);return W(s,[`ciphertextB64u`,`nonceB64u`],`recovery durable NEAR sealed material`),{kind:`near_ed25519`,keySetId:t.keySetId,binding:o,thresholdSessionId:a,runtimePolicyScope:xt(r.runtimePolicyScope),materialActivation:de(n.materialActivation),sealed:{ciphertextB64u:b(s.ciphertextB64u,`recovery durable NEAR ciphertext`),nonceB64u:g(s.nonceB64u,`recovery durable NEAR nonce`)}}}function Ct(e){let t=f(e,`recovery durable ECDSA public facts`);W(t,mt,`recovery durable ECDSA public facts`);let n=G(t.ethereumAddress,`recovery durable ECDSA ethereumAddress`).toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(n))throw Error(`recovery durable ECDSA ethereumAddress is invalid`);return{contextBinding32B64u:S(t.contextBinding32B64u,`recovery durable ECDSA context binding`),derivationClientSharePublicKey33B64u:x(t.derivationClientSharePublicKey33B64u,`recovery durable ECDSA client share`),clientVerifyingShare33B64u:x(t.clientVerifyingShare33B64u,`recovery durable ECDSA client verifying share`),relayerPublicKey33B64u:x(t.relayerPublicKey33B64u,`recovery durable ECDSA relayer public key`),groupPublicKey33B64u:x(t.groupPublicKey33B64u,`recovery durable ECDSA group public key`),ethereumAddress:n,clientShareRetryCounter:gt(t.clientShareRetryCounter,`recovery durable ECDSA client-share retry counter`),relayerShareRetryCounter:gt(t.relayerShareRetryCounter,`recovery durable ECDSA relayer-share retry counter`)}}function wt(e,t){let n=f(e,`recovery durable ECDSA key set`);if(W(n,pt,`recovery durable ECDSA key set`),n.kind!==`evm_family_ecdsa`||n.keySetId!==t.keySetId)throw Error(`recovery durable ECDSA key-set identity is invalid`);return{kind:`evm_family_ecdsa`,entry:t,possessionProof:F(n.possessionProof),readyStateBlobB64u:K(n.readyStateBlobB64u,`recovery durable ECDSA ready-state blob`),publicFacts:Ct(n.publicFacts)}}function Tt(e){let t=f(e,`recovery durable registration`);if(W(t,[`kind`,`id`,`rawId`,`type`,`authenticatorAttachment`,`response`],`recovery durable registration`),t.kind!==`wallet_recovery_redacted_registration_v1`)throw Error(`recovery durable registration kind is invalid`);if(t.authenticatorAttachment!==null&&typeof t.authenticatorAttachment!=`string`)throw Error(`recovery durable registration authenticatorAttachment is invalid`);let n=f(t.response,`recovery durable registration response`);if(W(n,[`clientDataJSON`,`attestationObject`,`transports`],`recovery durable registration response`),!Array.isArray(n.transports))throw Error(`recovery durable registration transports are invalid`);return{kind:`wallet_recovery_redacted_registration_v1`,id:G(t.id,`recovery durable registration id`),rawId:K(t.rawId,`recovery durable registration rawId`),type:G(t.type,`recovery durable registration type`),authenticatorAttachment:t.authenticatorAttachment,response:{clientDataJSON:K(n.clientDataJSON,`recovery durable registration clientDataJSON`),attestationObject:K(n.attestationObject,`recovery durable registration attestationObject`),transports:n.transports.map((e,t)=>G(e,`recovery durable registration transports[`+t+`]`))}}}function Et(e){let t=f(e,`recovery durable Email OTP enrollment`);if(t.kind===`existing`)return W(t,[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`],`recovery durable existing Email OTP enrollment`),{kind:`existing`,enrollmentId:G(t.enrollmentId,`recovery enrollmentId`),enrollmentSealKeyVersion:G(t.enrollmentSealKeyVersion,`recovery enrollment seal-key version`)};if(t.kind!==`create`)throw Error(`recovery durable Email OTP enrollment kind is invalid`);W(t,[`kind`,`enrollmentId`,`providerSubject`,`verifiedEmail`,`material`],`recovery durable create Email OTP enrollment`);let n=f(t.material,`recovery durable enrollment material`);return W(n,[`enrollmentSealKeyVersion`,`clientUnlockPublicKeyB64u`,`unlockKeyVersion`,`serverSealedFactorCiphertextB64u`],`recovery durable enrollment material`),{kind:`create`,enrollmentId:G(t.enrollmentId,`recovery enrollmentId`),providerSubject:G(t.providerSubject,`recovery enrollment providerSubject`),verifiedEmail:G(t.verifiedEmail,`recovery enrollment verifiedEmail`),material:{enrollmentSealKeyVersion:G(n.enrollmentSealKeyVersion,`recovery enrollment material seal-key version`),clientUnlockPublicKeyB64u:K(n.clientUnlockPublicKeyB64u,`recovery enrollment client unlock public key`),unlockKeyVersion:G(n.unlockKeyVersion,`recovery enrollment unlock-key version`),serverSealedFactorCiphertextB64u:K(n.serverSealedFactorCiphertextB64u,`recovery enrollment sealed factor ciphertext`)}}}function q(i){let o=f(i,`wallet recovery durable payload`);if(o.kind!==`wallet_recovery_durable_payload_v1`||o.version!==1)throw Error(`wallet recovery durable payload version is invalid`);W(o,[...ht,...f(o.target,`wallet recovery durable target`).kind===`passkey`?[`replacementId`,`challengeId`,`registration`]:[`providerSubject`,`verifiedEmail`,`emailHashHex`,`registrationAuthorityId`,`replacementId`,`enrollment`]],`wallet recovery durable payload`);let s=e(o.recoveryOperationId),l=r(o.walletId),u;try{u=P(o.reservationId)}catch(e){throw Error(`wallet recovery durable reservationId is invalid`,{cause:e})}let d=k(o.targetDeviceId),p=t(o.targetAuthorityId),m=a(o.targetWalletAuthMethodId);if(!s.ok||!l.ok||!d.ok||!p.ok||!m.ok)throw Error(`wallet recovery durable payload identity is invalid`);if(!Array.isArray(o.nearKeySets)||!Array.isArray(o.ecdsaKeySets))throw Error(`wallet recovery durable key-set arrays are invalid`);let h=qe(o.keyManifest,String(l.value)),g=o.nearKeySets.map(e=>St(e,yt(h,e))),_=o.ecdsaKeySets.map(e=>wt(e,bt(h,e))),v=[...g.map(e=>e.keySetId),..._.map(e=>e.entry.keySetId)];if(new Set(v).size!==v.length)throw Error(`wallet recovery durable key-set ids are duplicated`);if(h.entries.length!==v.length||h.entries.some(e=>!v.includes(e.keySetId)))throw Error(`wallet recovery durable key-set manifest coverage is invalid`);let y={kind:`wallet_recovery_durable_payload_v1`,version:1,recoveryOperationId:s.value,walletId:l.value,reservationId:u,targetDeviceId:d.value,targetAuthorityId:p.value,targetWalletAuthMethodId:m.value,replacementEnvelope:j(o.replacementEnvelope,`wallet recovery durable replacementEnvelope`),keyManifest:h,nearKeySets:g,ecdsaKeySets:_};if(String(y.replacementEnvelope.walletId)!==String(l.value))throw Error(`wallet recovery durable replacement envelope wallet changed`);if(y.replacementEnvelope.ownership.kind!==`method_bound`||y.replacementEnvelope.ownership.walletAuthMethodId!==m.value)throw Error(`wallet recovery durable replacement envelope method changed`);for(let e of g)if(e.binding.walletId!==String(l.value))throw Error(`wallet recovery durable NEAR binding wallet changed`);let b=f(o.target,`wallet recovery durable target`);if(b.kind===`passkey`){W(b,[`kind`,`rpId`],`wallet recovery durable passkey target`);let e=n(b.rpId);if(!e.ok)throw Error(`wallet recovery durable passkey RP ID is invalid`);let t=Tt(o.registration);if(t.rawId!==y.replacementEnvelope.factor.credentialIdB64u)throw Error(`wallet recovery durable passkey registration identity changed`);if(y.replacementEnvelope.factor.kind!==`passkey`)throw Error(`wallet recovery durable passkey envelope factor is invalid`);if(y.replacementEnvelope.factor.rpId!==e.value||y.replacementEnvelope.factor.credentialIdB64u!==t.rawId)throw Error(`wallet recovery durable passkey envelope identity changed`);let r=G(o.replacementId,`wallet recovery durable replacementId`);if(String(y.replacementEnvelope.envelopeId)!==r)throw Error(`wallet recovery durable passkey envelope id changed`);return{...y,target:{kind:`passkey`,rpId:e.value},replacementId:r,challengeId:G(o.challengeId,`wallet recovery durable challengeId`),registration:t}}if(b.kind!==`google_email_otp`)throw Error(`wallet recovery durable target kind is invalid`);W(b,[`kind`],`wallet recovery durable Email OTP target`);let x=G(o.providerSubject,`wallet recovery providerSubject`);if(!c(x).ok)throw Error(`wallet recovery durable providerSubject is invalid`);let S=G(o.verifiedEmail,`wallet recovery durable verifiedEmail`),C=G(o.emailHashHex,`wallet recovery durable emailHashHex`);if(!/^[0-9a-f]{64}$/.test(C))throw Error(`wallet recovery durable emailHashHex is invalid`);let w=G(o.registrationAuthorityId,`wallet recovery durable registrationAuthorityId`),T=Et(o.enrollment);if(y.replacementEnvelope.factor.kind!==`email_otp`)throw Error(`wallet recovery durable Email OTP envelope factor is invalid`);let ee=T.kind===`existing`?{enrollmentId:T.enrollmentId,enrollmentSealKeyVersion:T.enrollmentSealKeyVersion}:{enrollmentId:T.enrollmentId,enrollmentSealKeyVersion:T.material.enrollmentSealKeyVersion};if(y.replacementEnvelope.factor.enrollmentId!==ee.enrollmentId||y.replacementEnvelope.factor.enrollmentSealKeyVersion!==ee.enrollmentSealKeyVersion)throw Error(`wallet recovery durable Email OTP envelope identity changed`);if(T.kind===`create`&&(T.providerSubject!==x||T.verifiedEmail!==S))throw Error(`wallet recovery durable Email OTP enrollment identity changed`);let te=G(o.replacementId,`wallet recovery durable replacementId`);if(String(y.replacementEnvelope.envelopeId)!==te)throw Error(`wallet recovery durable Email OTP envelope id changed`);return{...y,target:{kind:`google_email_otp`},providerSubject:x,verifiedEmail:S,emailHashHex:C,registrationAuthorityId:w,replacementId:te,enrollment:T}}function Dt(e){let t=e.nearKeySets.map(e=>({kind:e.kind,keySetId:e.keySetId,applicationBindingDigestB64u:e.binding.applicationBindingDigestB64u,registeredPublicKeyB64u:e.binding.registeredPublicKeyB64u,participantIds:e.binding.participantIds,stateEpoch:e.binding.stateEpoch,signingWorkerVerifyingShareB64u:e.binding.signingWorkerVerifyingShareB64u,materialActivation:e.materialActivation,sealed:e.sealed})),n=e.ecdsaKeySets.map(e=>({kind:e.kind,keySetId:e.entry.keySetId,possessionProof:e.possessionProof,readyStateBlobB64u:e.readyStateBlobB64u,publicFacts:e.publicFacts})),r={kind:e.kind,version:e.version,recoveryOperationId:String(e.recoveryOperationId),walletId:String(e.walletId),reservationId:String(e.reservationId),targetDeviceId:String(e.targetDeviceId),targetAuthorityId:String(e.targetAuthorityId),targetWalletAuthMethodId:String(e.targetWalletAuthMethodId),replacementEnvelope:e.replacementEnvelope,keyManifest:e.keyManifest,nearKeySets:t,ecdsaKeySets:n},i=U(e)?{...r,target:e.target,replacementId:e.replacementId,challengeId:e.challengeId,registration:e.registration}:{...r,target:e.target,providerSubject:e.providerSubject,verifiedEmail:e.verifiedEmail,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,replacementId:e.replacementId,enrollment:e.enrollment};return q(i),i}async function Ot(e){if(U(e))return;let t=await d(e.verifiedEmail);if(e.emailHashHex!==t)throw Error(`wallet recovery durable email hash does not match verified email`);if(e.enrollment.kind===`create`&&(e.enrollment.providerSubject!==e.providerSubject||e.enrollment.verifiedEmail!==e.verifiedEmail))throw Error(`wallet recovery durable enrollment does not match Email OTP identity`)}function J(e){if(U(e)){let t=o(e.registration.rawId);if(!t.ok)throw Error(`wallet recovery durable passkey credential id is invalid`);return{kind:`passkey`,rpId:e.target.rpId,credentialIdB64u:t.value}}let t=c(e.providerSubject);if(!t.ok)throw Error(`wallet recovery durable providerSubject is invalid`);return{kind:`google_email_otp`,providerSubject:t.value,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,enrollment:dt(e)}}function kt(e){return{kind:`near_ed25519`,keySetId:e.entry.keySetId,applicationBindingDigestB64u:e.localMaterial.applicationBindingDigestB64u,registeredPublicKeyB64u:w(e.metadata.registeredPublicKey),participantIds:e.metadata.participantIds,stateEpoch:String(e.metadata.stateEpoch),signingWorkerVerifyingShareB64u:w(e.metadata.signingWorkerVerifyingShare),materialActivation:ve(e.metadata.materialActivation),sealed:{ciphertextB64u:e.localMaterial.b64u,nonceB64u:e.localMaterial.nonceB64u}}}function At(e){return{kind:`evm_family_ecdsa`,keySetId:e.entry.keySetId,possessionProof:F(e.activation.possessionProof),readyStateBlobB64u:e.readyStateBlobB64u,publicFacts:e.publicFacts}}function jt(e){return{kind:`wallet_recovery_redacted_registration_v1`,id:e.id,rawId:e.rawId,type:e.type,authenticatorAttachment:e.authenticatorAttachment??null,response:{clientDataJSON:e.response.clientDataJSON,attestationObject:e.response.attestationObject,transports:[...e.response.transports]}}}async function Mt(e){let t={kind:`wallet_recovery_durable_payload_v1`,version:1,recoveryOperationId:String(e.prepared.recoveryOperationId),walletId:e.walletId,reservationId:e.prepared.reservationId,targetDeviceId:e.prepared.targetDeviceId,targetAuthorityId:e.prepared.targetAuthorityId,targetWalletAuthMethodId:e.prepared.targetWalletAuthMethodId,replacementEnvelope:j(e.recovered.replacementEnvelope,`wallet recovery durable replacement envelope`),keyManifest:{version:`wallet_recovery_preparation_key_manifest_v1`,walletId:String(e.walletId),entries:[...e.recovered.nearKeySets.map(e=>e.entry),...e.recovered.ecdsaKeySets.map(e=>e.entry)]},nearKeySets:e.recovered.nearKeySets.map(kt),ecdsaKeySets:e.recovered.ecdsaKeySets.map(At)};if(e.replacement.kind===`passkey`){if(e.target.kind!==`passkey`)throw Error(`wallet recovery durable payload branch is invalid`);let n=e.prepared.registration;if(!n)throw Error(`wallet recovery registration options are unavailable`);let r=jt(e.replacement.registration);if(r.rawId!==e.replacement.credentialIdB64u)throw Error(`wallet recovery passkey registration rawId changed its credential identity`);let i=q({...t,target:{kind:`passkey`,rpId:e.target.rpId},replacementId:n.replacementId,challengeId:n.challengeId,registration:r});return await Ot(i),i}if(e.target.kind!==`google_email_otp`)throw Error(`wallet recovery durable payload branch is invalid`);let n=e.replacement.enrollment;if(e.replacement.factor.walletAuthMethodId!==t.targetWalletAuthMethodId)throw Error(`wallet recovery Email OTP factor method changed its target identity`);let r=await d(e.replacement.verifiedEmail),i=q({...t,target:{kind:`google_email_otp`},enrollment:n,providerSubject:e.replacement.providerSubject,verifiedEmail:e.replacement.verifiedEmail,emailHashHex:r,registrationAuthorityId:e.replacement.registrationAuthorityId,replacementId:e.replacement.factor.replacementId});return await Ot(i),i}function Nt(e){return new TextEncoder().encode(u({kind:`pending_wallet_recovery_commit_v1`,version:1,...e}))}function Pt(e){return Nt({recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:J(e)})}async function Ft(e){let t=await crypto.subtle.generateKey({name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`]);if(!(t instanceof CryptoKey))throw Error(`wallet recovery durable key generation failed`);let n=crypto.getRandomValues(new Uint8Array(12)),r=new TextEncoder().encode(JSON.stringify(Dt(e)));return{kind:`wallet_recovery_encrypted_material_v1`,key:t,iv:n,ciphertext:new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n,additionalData:Pt(e)},t,r))}}async function It(e){let t=await crypto.subtle.decrypt({name:`AES-GCM`,iv:e.localMaterial.iv,additionalData:Lt(e)},e.localMaterial.key,e.localMaterial.ciphertext),n=q(JSON.parse(new TextDecoder().decode(t)));if(await Ot(n),!Rt(e,n))throw Error(`wallet recovery durable payload identity does not match its journal`);return n}function Lt(e){return Nt({recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:e.target})}function Y(t){let n=e(t);if(!n.ok)throw Error(`wallet recovery operation id is invalid`);return n.value}function Rt(e,t){let n={kind:`pending_wallet_recovery_commit_v1`,version:1,recoveryOperationId:Y(t.recoveryOperationId),walletId:t.walletId,reservationId:t.reservationId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,localMaterial:e.localMaterial,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs},r=J(t);if(e.stage===`awaiting_server_promotion`)return M(e,{...n,stage:`awaiting_server_promotion`,target:r});switch(r.kind){case`passkey`:return e.projection.kind===`passkey`?M(e,{...n,stage:`server_promoted`,target:r,projection:e.projection}):!1;case`google_email_otp`:return e.projection.kind===`google_email_otp`?M(e,{...n,stage:`server_promoted`,target:r,projection:e.projection}):!1}}function zt(e,t,n,r){return{kind:`pending_wallet_recovery_commit_v1`,version:1,recoveryOperationId:Y(e.recoveryOperationId),walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:J(e),localMaterial:t,createdAtMs:n,updatedAtMs:r}}function Bt(e,t,n=Date.now()){return{...zt(e,t,n,n),stage:`awaiting_server_promotion`}}function Vt(e,t,n,r=Date.now()){let i=zt(t,e.localMaterial,e.createdAtMs,Math.max(r,e.createdAtMs+1));if(U(t)){if(n.kind!==`passkey`)throw Error(`wallet recovery promotion projection branch changed`);return{...i,stage:`server_promoted`,target:J(t),projection:n}}if(n.kind!==`google_email_otp`)throw Error(`wallet recovery promotion projection branch changed`);return{...i,stage:`server_promoted`,target:J(t),projection:n}}const Ht=`/wallets/recovery/google-email-otp/finalize`;async function Ut(e){let t=await X(e,`/wallets/recovery/google/verify`,{recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,idToken:e.idToken});if(!t.ok)return t.failure;try{let n=Jt(t.body),r=qt(n,e),i=Q(s(n.challengeId)),a=Number(n.expiresAtMs);if(!Number.isSafeInteger(a)||a<=0)throw Error(`invalid expiry`);return{kind:`verified`,...r,challengeId:i,delivery:xe(n.delivery,`walletRecoveryGoogleVerify.delivery`),expiresAtMs:a}}catch{return{kind:`transport_uncertain`}}}async function Wt(e){let t=await X(e,`/wallets/recovery/email-otp/verify`,{recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,challengeId:e.challengeId,otpCode:e.otpCode});if(!t.ok)return t.failure;try{let n=Yt(t.body),r=qt(n,e),i=Q(s(n.challengeId));if(i!==e.challengeId)throw Error(`challenge changed`);return{kind:`verified`,...r,challengeId:i}}catch{return{kind:`transport_uncertain`}}}async function Gt(e){let t,n;try{if(t=j(e.replacementEnvelope,`walletRecoveryGoogleEmailOtpFinalize.replacementEnvelope`),t.factor.kind!==`email_otp`)throw Error(`wrong factor`);n=e.ecdsaMaterialPossessionProofs.map(e=>({keySetId:e.keySetId,proof:F(e.proof)}))}catch{return{kind:`refused`}}let r=await X(e,Ht,{kind:`finalize`,recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,replacementEnvelope:t,ecdsaMaterialPossessionProofs:n,...e.emailOtpEnrollment?{emailOtpEnrollment:e.emailOtpEnrollment}:{}});if(!r.ok)return r.failure;try{let n=await I(Xt(r.body,`walletRecoveryGoogleEmailOtpFinalize`).projection,en(e,t));if(n.kind!==`google_email_otp`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:n.storeVersion,authority:n.authority,authMethod:n.authMethod}}catch{return{kind:`transport_uncertain`}}}async function Kt(e){let t;try{if(t=j(e.replacementEnvelope,`walletRecoveryGoogleEmailOtpReplay.replacementEnvelope`),t.factor.kind!==`email_otp`||String(t.walletId)!==String(e.walletId))throw Error(`recovery replay envelope identity is invalid`)}catch{return{kind:`refused`}}let n=await X(e,Ht,{kind:`replay`,recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,replacementEnvelope:t});if(!n.ok)return n.failure;try{let r=await I(Xt(n.body,`walletRecoveryGoogleEmailOtpReplay`).projection,en(e,t));if(r.kind!==`google_email_otp`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:r.storeVersion,authority:r.authority,authMethod:r.authMethod}}catch{return{kind:`transport_uncertain`}}}async function X(e,t,n){let r;try{r=await(e.fetchImpl??fetch)(`${_(e.relayUrl)}${t}`,p({body:n}))}catch{return{ok:!1,failure:{kind:`transport_uncertain`}}}let i=await r.json().catch(()=>void 0);return r.status===200?{ok:!0,body:i}:r.status===409||r.status===429?{ok:!1,failure:{kind:`retryable_conflict`}}:r.status===400||r.status===401?{ok:!1,failure:{kind:`refused`}}:{ok:!1,failure:{kind:`transport_uncertain`}}}function qt(t,n){let r=Q(e(t.recoveryOperationId)),i=P(t.reservationId);if(r!==n.recoveryOperationId||i!==n.reservationId)throw Error(`recovery operation identity changed`);return{recoveryOperationId:r,reservationId:i}}function Jt(e){let t=Zt(e,[`ok`,`recoveryOperationId`,`reservationId`,`challengeId`,`delivery`,`expiresAtMs`],`walletRecoveryGoogleVerify`);return $t(t,`walletRecoveryGoogleVerify`),{recoveryOperationId:Z(t,`recoveryOperationId`),reservationId:Z(t,`reservationId`),challengeId:Z(t,`challengeId`),delivery:Z(t,`delivery`),expiresAtMs:Z(t,`expiresAtMs`)}}function Yt(e){let t=Zt(e,[`ok`,`recoveryOperationId`,`reservationId`,`challengeId`],`walletRecoveryEmailOtpVerify`);return $t(t,`walletRecoveryEmailOtpVerify`),{recoveryOperationId:Z(t,`recoveryOperationId`),reservationId:Z(t,`reservationId`),challengeId:Z(t,`challengeId`)}}function Xt(e,t){let n=Zt(e,[`ok`,`projection`],t);return $t(n,t),{projection:Z(n,`projection`)}}function Zt(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be a JSON object`);let r=Object.getPrototypeOf(e);if(r!==Object.prototype&&r!==null)throw Error(`${n} must be a plain JSON object`);let i=Object.keys(e);if(i.length!==t.length||!Qt(i,t))throw Error(`${n} has an unexpected response shape`);return e}function Qt(e,t){for(let n of t)if(!e.includes(n))return!1;return!0}function $t(e,t){if(Z(e,`ok`)!==!0)throw Error(`${t} did not succeed`)}function Z(e,t){let n=Object.getOwnPropertyDescriptor(e,t);if(!n||!(`value`in n))throw Error(`response field ${t} is missing`);return n.value}function Q(e){if(!e.ok)throw Error(`invalid domain identity`);return e.value}function $(e){if(typeof e!=`string`||!e.trim())throw Error(`value must be a string`);return e.trim()}function en(e,t){if(t.factor.kind!==`email_otp`)throw Error(`replacement envelope is not an Email OTP envelope`);return{kind:`google_email_otp`,walletId:e.walletId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,providerSubject:Q(c(e.expectedProviderSubject)),emailHashHex:tn(e.expectedEmailHashHex),registrationAuthorityId:$(e.expectedRegistrationAuthorityId),enrollment:{kind:`email_otp_enrollment_reference_v1`,enrollmentId:$(t.factor.enrollmentId),enrollmentSealKeyVersion:$(t.factor.enrollmentSealKeyVersion)}}}function tn(e){let t=$(e);if(!/^[0-9a-f]{64}$/.test(t))throw Error(`email hash is invalid`);return t}async function nn(e,t){if(e.version!==t.version||e.storeVersion!==t.storeVersion||e.walletId!==t.walletId||e.recoveryOperationId!==t.recoveryOperationId||e.targetDeviceId!==t.targetDeviceId||e.targetAuthorityId!==t.targetAuthorityId||e.targetWalletAuthMethodId!==t.targetWalletAuthMethodId||!await se(e.authority,t.authority)||!Ce(e.authMethod,t.authMethod)||e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`?e.target.kind===t.target.kind&&e.target.rpId===t.target.rpId&&e.target.credentialIdB64u===t.target.credentialIdB64u:!1;case`google_email_otp`:return t.kind===`google_email_otp`?e.target.kind===t.target.kind&&e.target.provider===t.target.provider&&e.target.providerSubject===t.target.providerSubject&&e.target.emailHashHex===t.target.emailHashHex&&e.target.registrationAuthorityId===t.target.registrationAuthorityId&&e.target.enrollment.kind===t.target.enrollment.kind&&e.target.enrollment.enrollmentId===t.target.enrollment.enrollmentId&&e.target.enrollment.enrollmentSealKeyVersion===t.target.enrollment.enrollmentSealKeyVersion:!1;default:return rn(e)}}function rn(e){throw Error(`unsupported wallet recovery projection: ${String(e)}`)}function an(e){let t=Y(e.payload.recoveryOperationId);switch(e.kind){case`passkey`:return Oe({kind:`passkey`,storeVersion:e.promotion.storeVersion,walletId:e.payload.walletId,recoveryOperationId:t,targetDeviceId:e.payload.targetDeviceId,targetAuthorityId:e.payload.targetAuthorityId,targetWalletAuthMethodId:e.payload.targetWalletAuthMethodId,authority:e.promotion.authority,authMethod:e.promotion.authMethod});case`google_email_otp`:{let n=c(e.payload.providerSubject);if(!n.ok)throw Error(`wallet recovery provider subject is invalid`);return Oe({kind:`google_email_otp`,storeVersion:e.promotion.storeVersion,walletId:e.payload.walletId,recoveryOperationId:t,targetDeviceId:e.payload.targetDeviceId,targetAuthorityId:e.payload.targetAuthorityId,targetWalletAuthMethodId:e.payload.targetWalletAuthMethodId,authority:e.promotion.authority,authMethod:e.promotion.authMethod,providerSubject:n.value,emailHashHex:e.payload.emailHashHex,registrationAuthorityId:e.payload.registrationAuthorityId,enrollment:dt(e.payload)})}}}function on(e){return e.ecdsaKeySets.map(e=>({keySetId:e.entry.keySetId,proof:e.possessionProof}))}function sn(e){return{id:e.registration.id,rawId:e.registration.rawId,type:e.registration.type,authenticatorAttachment:e.registration.authenticatorAttachment??void 0,response:{clientDataJSON:e.registration.response.clientDataJSON,attestationObject:e.registration.response.attestationObject,transports:[...e.registration.response.transports]},clientExtensionResults:{prf:{results:{first:void 0,second:void 0}}}}}async function cn(e){let{payload:t}=e;if(U(t)){let n=await st({relayUrl:e.relayUrl,walletId:String(t.walletId),reservationId:String(t.reservationId),recoveryOperationId:Y(t.recoveryOperationId),targetDeviceId:String(t.targetDeviceId),targetAuthorityId:String(t.targetAuthorityId),targetWalletAuthMethodId:String(t.targetWalletAuthMethodId),challengeId:t.challengeId,replacementId:t.replacementId,webauthnRegistration:sn(t),replacementEnvelope:t.replacementEnvelope,ecdsaMaterialPossessionProofs:on(t),fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`passkey`,payload:t,promotion:n}:n}let n=await Gt({relayUrl:e.relayUrl,recoveryOperationId:Y(t.recoveryOperationId),reservationId:t.reservationId,walletId:t.walletId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,expectedProviderSubject:t.providerSubject,expectedEmailHashHex:t.emailHashHex,expectedRegistrationAuthorityId:t.registrationAuthorityId,replacementEnvelope:t.replacementEnvelope,ecdsaMaterialPossessionProofs:on(t),emailOtpEnrollment:ln(t.enrollment),fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`google_email_otp`,payload:t,promotion:n}:n}function ln(e){return e.kind===`create`?{kind:`create`,material:e.material}:null}async function un(e){let{payload:t}=e;if(U(t)){let n=await ct({relayUrl:e.relayUrl,walletId:String(t.walletId),reservationId:String(t.reservationId),recoveryOperationId:Y(t.recoveryOperationId),targetDeviceId:String(t.targetDeviceId),targetAuthorityId:String(t.targetAuthorityId),targetWalletAuthMethodId:String(t.targetWalletAuthMethodId),replacementId:t.replacementId,replacementEnvelope:t.replacementEnvelope,fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`passkey`,payload:t,promotion:n}:n}let n=await Kt({relayUrl:e.relayUrl,recoveryOperationId:Y(t.recoveryOperationId),reservationId:t.reservationId,walletId:t.walletId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,expectedProviderSubject:t.providerSubject,expectedEmailHashHex:t.emailHashHex,expectedRegistrationAuthorityId:t.registrationAuthorityId,replacementEnvelope:t.replacementEnvelope,fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`google_email_otp`,payload:t,promotion:n}:n}function dn(e){return e.kind===`passkey`||e.kind===`google_email_otp`}async function fn(e){let t=await un(e);return dn(t)||t.kind!==`refused`?t:await cn(e)}function pn(e,t){return{walletId:e.walletId,factor:{kind:`passkey`,credentialIdB64u:t.target.credentialIdB64u},verifier:{kind:`webauthn`,rpId:t.target.rpId},bindingId:t.authMethod.walletAuthMethodId}}function mn(e,t){let n=be({walletId:e.walletId,provider:`google`,providerUserId:e.providerSubject,emailHashHex:e.emailHashHex});return{walletId:n.walletId,factor:n.factor,verifier:n.verifier,bindingId:t.authMethod.walletAuthMethodId}}async function hn(e,t){if(U(e)){if(t.kind!==`passkey`)throw Error(`wallet recovery projection branch changed`);return ue({authority:pn(e,t)})}if(t.kind!==`google_email_otp`)throw Error(`wallet recovery projection branch changed`);return ue({authority:mn(e,t)})}async function gn(e){let t=[],n=[];for(let r of e.payload.ecdsaKeySets){let i=r.entry,a=i.recoveryBasis,o=await le({walletId:e.payload.walletId,signingRootId:a.signingRootId,signingRootVersion:a.signingRootVersion}),s=await Ee({authority:e.authority,chainTargets:a.chainTargets,walletId:String(e.payload.walletId),keyHandle:i.keyHandle,ecdsaThresholdKeyId:a.ecdsaThresholdKeyId,signingRootId:a.signingRootId,signingRootVersion:a.signingRootVersion,relayerKeyId:o,participantIds:a.participantIds,publicCapability:a.publicCapability,activationReceipt:a.activationReceipt,runtimePolicyScope:a.runtimePolicyScope,readyStateBlobB64u:r.readyStateBlobB64u,publicFacts:r.publicFacts});n.push(s);for(let n of a.chainTargets)t.push(_n({payload:e.payload,keySet:r,chainTarget:n,materialRef:s.roleLocalMaterialRef,relayerKeyId:o}))}return{walletKeys:t,ecdsaContinuity:n}}function _n(e){let t=e.keySet.entry,n=t.recoveryBasis,r=e.keySet.publicFacts,i=we({walletId:e.payload.walletId,chainTarget:e.chainTarget,keyHandle:t.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,applicationBindingDigestB64u:n.publicCapability.context.application_binding_digest_b64u,clientParticipantId:1,relayerParticipantId:2,participantIds:n.participantIds,contextBinding32B64u:r.contextBinding32B64u,derivationClientSharePublicKey33B64u:r.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:r.relayerPublicKey33B64u,groupPublicKey33B64u:r.groupPublicKey33B64u,ethereumAddress:r.ethereumAddress,publicCapability:n.publicCapability});return{keyScope:`evm-family`,chainTarget:e.chainTarget,walletId:String(e.payload.walletId),evmFamilySigningKeySlotId:t.evmFamilySigningKeySlotId,keyHandle:t.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,thresholdEcdsaPublicKeyB64u:r.groupPublicKey33B64u,thresholdOwnerAddress:r.ethereumAddress,relayerKeyId:e.relayerKeyId,relayerVerifyingShareB64u:r.relayerPublicKey33B64u,participantIds:n.participantIds,publicCapability:n.publicCapability,roleLocalMaterialRef:e.materialRef,ecdsaRoleLocalPublicFacts:i}}function vn(e){if(e.nearKeySets.length!==1)throw Error(`wallet recovery requires exactly one NEAR key set`);return e.nearKeySets[0]}function yn(e){return[...e.registration.response.transports]}function bn(e){return`ed25519:${re(T(vn(e).binding.registeredPublicKeyB64u))}`}function xn(e,t){let n=i(t.thresholdSessionId);if(!n.ok)throw Error(`recovery NEAR threshold session id is invalid`);return{walletId:e.walletId,nearAccountId:A(t.binding.nearAccountId),thresholdSessionId:n.value,runtimePolicyScope:t.runtimePolicyScope,materialActivation:he(t.materialActivation)}}async function Sn(e){if(U(e.payload)){if(e.projection.kind!==`passkey`)throw Error(`wallet recovery projection branch changed`);let t={walletId:e.payload.walletId,rpId:e.projection.target.rpId,credentialIdB64u:e.projection.target.credentialIdB64u,credentialPublicKeyB64u:e.projection.authMethod.credentialPublicKeyB64u,transports:yn(e.payload),walletKeys:e.walletKeys};if(e.payload.nearKeySets.length===0)return ae({kind:`evm_family_ecdsa`,...t});let n=vn(e.payload);return ae({kind:`near_ed25519`,...t,nearAccountId:A(n.binding.nearAccountId),nearEd25519SigningKeyId:n.binding.nearEd25519SigningKeyId,signerSlot:n.binding.signerSlot,operationalPublicKey:bn(e.payload),relayerKeyId:n.binding.signingWorkerId,participantIds:n.binding.participantIds,custodyMaterials:e.payload.nearKeySets.map(e=>({binding:e.binding,sealed:e.sealed}))})}if(e.projection.kind!==`google_email_otp`)throw Error(`wallet recovery projection branch changed`);let t=mn(e.payload,e.projection),n={walletId:e.payload.walletId,email:e.payload.verifiedEmail,registrationAuthorityId:e.payload.registrationAuthorityId,authority:t,walletKeys:e.walletKeys};if(e.payload.nearKeySets.length===0)return oe({kind:`evm_family_ecdsa`,...n});let r=vn(e.payload);return oe({kind:`near_ed25519`,...n,nearAccountId:A(r.binding.nearAccountId),nearEd25519SigningKeyId:r.binding.nearEd25519SigningKeyId,signerSlot:r.binding.signerSlot,operationalPublicKey:bn(e.payload),relayerKeyId:r.binding.signingWorkerId,participantIds:r.binding.participantIds,custodyMaterials:e.payload.nearKeySets.map(e=>({binding:e.binding,sealed:e.sealed}))})}async function Cn(e){let t=e.pending.projection,n=await hn(e.payload,t),r=await gn({payload:e.payload,authority:n}),i=await Sn({payload:e.payload,projection:t,walletKeys:r.walletKeys});await N.publishPendingWalletRecoveryCommit({pending:e.pending,authority:t.authority,authMethod:t.authMethod,registration:i,ecdsaContinuity:r.ecdsaContinuity,ed25519PublicCapabilityReferences:e.payload.nearKeySets.map(t=>xn(e.payload,t))})}async function wn(e){let t=await N.listPendingWalletRecoveryCommits(),n=[];for(let r of t)try{let t=await It(r),i=r.stage===`awaiting_server_promotion`?await fn({relayUrl:e.relayUrl,payload:t,fetchImpl:e.fetchImpl}):await un({relayUrl:e.relayUrl,payload:t,fetchImpl:e.fetchImpl});if(!dn(i)){if(i.kind===`refused`){await N.deletePendingWalletRecoveryCommit(r.recoveryOperationId),n.push({kind:`discarded`,recoveryOperationId:String(r.recoveryOperationId)});continue}n.push({kind:`pending`,recoveryOperationId:String(r.recoveryOperationId),failure:i});continue}let a=i,o=an(a),s=r.stage===`awaiting_server_promotion`?await N.advancePendingWalletRecoveryCommit({awaiting:r,promoted:Vt(r,a.payload,o,r.updatedAtMs+1)}):r;if(r.stage===`server_promoted`&&!await nn(r.projection,o))throw Error(`wallet recovery replay projection changed`);await Cn({pending:s,payload:a.payload}),n.push({kind:`completed`,recoveryOperationId:String(r.recoveryOperationId)})}catch(e){console.warn(`[SeamsWeb] pending wallet recovery replay failed before classification:`,String(r.recoveryOperationId),e instanceof Error?e.message:String(e||`unknown error`)),n.push({kind:`corrupt`,recoveryOperationId:String(r.recoveryOperationId)})}return n}async function Tn(e){let t=await Mt(e.operation);return{payload:t,pending:Bt(t,await Ft(t),e.nowMs)}}async function En(e){let t=an(e.promotion);return N.advancePendingWalletRecoveryCommit({awaiting:e.awaiting,promoted:Vt(e.awaiting,e.promotion.payload,t,e.awaiting.updatedAtMs+1)})}export{Gt as a,U as c,Le as d,wn as i,st as l,En as n,Wt as o,Cn as r,Ut as s,Tn as t,Ie as u};

package/dist/public/wallet-assets.manifest.json

@@ -1,14 +1,14 @@
 {
   "schemaVersion": 1,
   "packageName": "@seams/wallet",
-  "packageVersion": "0.11.0",
+  "packageVersion": "0.12.0",
   "assetRoot": "dist/public",
   "sdkBasePath": "/sdk",
   "walletServicePath": "/wallet-service",
   "headersManifest": "headers.manifest.json",
   "versionSkewContract": {
     "kind": "wallet_iframe_protocol_handshake",
-    "packageVersion": "0.11.0",
+    "packageVersion": "0.12.0",
     "protocolVersion": "15.0.0",
     "readyPayloadField": "protocolVersion",
     "failureMode": "typed_error",
@@ -970,8 +970,8 @@
       ]
     },
     {
-      "route": "/sdk/host-Bqmmy8Ts.js",
-      "sourceFile": "sdk/host-Bqmmy8Ts.js",
+      "route": "/sdk/host-CHQwi-Nm.js",
+      "sourceFile": "sdk/host-CHQwi-Nm.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1402,8 +1402,8 @@
       ]
     },
     {
-      "route": "/sdk/pendingWalletRecoveryCodeBackup-CMCOUuA-.js",
-      "sourceFile": "sdk/pendingWalletRecoveryCodeBackup-CMCOUuA-.js",
+      "route": "/sdk/pendingWalletRecoveryCodeBackup-DMg5U0Fk.js",
+      "sourceFile": "sdk/pendingWalletRecoveryCodeBackup-DMg5U0Fk.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1570,8 +1570,8 @@
       ]
     },
     {
-      "route": "/sdk/recovery-entrypoint-QxTiyx-o.js",
-      "sourceFile": "sdk/recovery-entrypoint-QxTiyx-o.js",
+      "route": "/sdk/recovery-entrypoint-EHY_b7Z-.js",
+      "sourceFile": "sdk/recovery-entrypoint-EHY_b7Z-.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1594,8 +1594,8 @@
       ]
     },
     {
-      "route": "/sdk/registration-Drtkzrlc.js",
-      "sourceFile": "sdk/registration-Drtkzrlc.js",
+      "route": "/sdk/registration-CQxxUt5s.js",
+      "sourceFile": "sdk/registration-CQxxUt5s.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1618,8 +1618,8 @@
       ]
     },
     {
-      "route": "/sdk/registration-eyzHqLHi.js",
-      "sourceFile": "sdk/registration-eyzHqLHi.js",
+      "route": "/sdk/registration-Drtkzrlc.js",
+      "sourceFile": "sdk/registration-Drtkzrlc.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1834,8 +1834,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-auth-CbveTM2_.js",
-      "sourceFile": "sdk/runtime-auth-CbveTM2_.js",
+      "route": "/sdk/runtime-auth-DtpRz88X.js",
+      "sourceFile": "sdk/runtime-auth-DtpRz88X.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1858,8 +1858,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-device-link-CHsqrEQ9.js",
-      "sourceFile": "sdk/runtime-device-link-CHsqrEQ9.js",
+      "route": "/sdk/runtime-device-link-DXjabXJb.js",
+      "sourceFile": "sdk/runtime-device-link-DXjabXJb.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1882,8 +1882,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-ecdsa-tempo-MgmnU9g-.js",
-      "sourceFile": "sdk/runtime-ecdsa-tempo-MgmnU9g-.js",
+      "route": "/sdk/runtime-ecdsa-tempo-DlKMIbyP.js",
+      "sourceFile": "sdk/runtime-ecdsa-tempo-DlKMIbyP.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1906,8 +1906,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-email-otp-Cj96n102.js",
-      "sourceFile": "sdk/runtime-email-otp-Cj96n102.js",
+      "route": "/sdk/runtime-email-otp-BBPghU2G.js",
+      "sourceFile": "sdk/runtime-email-otp-BBPghU2G.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1930,8 +1930,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-export-mcwZRxKk.js",
-      "sourceFile": "sdk/runtime-export-mcwZRxKk.js",
+      "route": "/sdk/runtime-export-pw-xJL8o.js",
+      "sourceFile": "sdk/runtime-export-pw-xJL8o.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1954,8 +1954,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-near-BMdTtu7D.js",
-      "sourceFile": "sdk/runtime-near-BMdTtu7D.js",
+      "route": "/sdk/runtime-near-B-vYxGjl.js",
+      "sourceFile": "sdk/runtime-near-B-vYxGjl.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1978,8 +1978,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-preferences-CBlhE8bX.js",
-      "sourceFile": "sdk/runtime-preferences-CBlhE8bX.js",
+      "route": "/sdk/runtime-preferences-D-hY0RfC.js",
+      "sourceFile": "sdk/runtime-preferences-D-hY0RfC.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2002,8 +2002,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-recovery-codes-B1gixZsp.js",
-      "sourceFile": "sdk/runtime-recovery-codes-B1gixZsp.js",
+      "route": "/sdk/runtime-recovery-codes-rLR4Guy4.js",
+      "sourceFile": "sdk/runtime-recovery-codes-rLR4Guy4.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2026,8 +2026,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-recovery-mJp3MLeG.js",
-      "sourceFile": "sdk/runtime-recovery-mJp3MLeG.js",
+      "route": "/sdk/runtime-recovery-Vg1ND2nl.js",
+      "sourceFile": "sdk/runtime-recovery-Vg1ND2nl.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2146,8 +2146,8 @@
       ]
     },
     {
-      "route": "/sdk/shared-8Qe7Nxgg.js",
-      "sourceFile": "sdk/shared-8Qe7Nxgg.js",
+      "route": "/sdk/shared-6bpRPbcM.js",
+      "sourceFile": "sdk/shared-6bpRPbcM.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2770,8 +2770,8 @@
       ]
     },
     {
-      "route": "/sdk/wallet-recovery-D7ywcIHw.js",
-      "sourceFile": "sdk/wallet-recovery-D7ywcIHw.js",
+      "route": "/sdk/wallet-recovery-LMtGiEL3.js",
+      "sourceFile": "sdk/wallet-recovery-LMtGiEL3.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2914,8 +2914,8 @@
       ]
     },
     {
-      "route": "/sdk/walletCustodyEcdsaContinuity-_IKoCUBO.js",
-      "sourceFile": "sdk/walletCustodyEcdsaContinuity-_IKoCUBO.js",
+      "route": "/sdk/walletCustodyEcdsaContinuity-D-gYxv6e.js",
+      "sourceFile": "sdk/walletCustodyEcdsaContinuity-D-gYxv6e.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2986,8 +2986,8 @@
       ]
     },
     {
-      "route": "/sdk/walletRecoveryCommit-DDPa1rAJ.js",
-      "sourceFile": "sdk/walletRecoveryCommit-DDPa1rAJ.js",
+      "route": "/sdk/walletRecoveryCommit-BYRC_2li.js",
+      "sourceFile": "sdk/walletRecoveryCommit-BYRC_2li.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",

package/dist/public/wallet-service/index.html

@@ -5,14 +5,14 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Web3Authn Wallet Service</title>
     <!-- Surface styles are external so strict CSP can keep style-src 'self' -->
-    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.11.0" />
+    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.12.0" />
     <!-- Minimal shims some ESM bundles expect (externalized to enable strict CSP) -->
-    <script src="/sdk/wallet-shims.js?v=0.11.0"></script>
+    <script src="/sdk/wallet-shims.js?v=0.12.0"></script>
     <!-- Hint the browser to fetch the host script earlier -->
-    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.11.0" crossorigin>
+    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.12.0" crossorigin>
   </head>
   <body>
     <!-- sdkBasePath points to the SDK root (e.g. '/sdk'). Load the host directly. -->
-    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.11.0"></script>
+    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.12.0"></script>
   </body>
 </html>

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/auth-menu/domain.d.ts

@@ -200,7 +200,7 @@ export type AuthMenuLinkDeviceViewModel = AuthMenuViewModelCommon & {
     readonly passkeyName?: never;
     readonly passkeyNameLabel?: never;
 };
-export type AuthMenuRecoveryStage = 'enter_code' | 'preparing' | 'passkey_ready' | 'google_ready' | 'email_code_required' | 'finalizing' | 'sign_in_ready';
+export type AuthMenuRecoveryStage = 'enter_code' | 'choose_method' | 'preparing' | 'passkey_ready' | 'google_ready' | 'email_code_required' | 'finalizing' | 'sign_in_ready';
 type AuthMenuIdleStatus = Extract<AuthMenuSurfaceStatus, {
     readonly kind: 'idle';
 }>;
@@ -214,8 +214,6 @@ export type AuthMenuRecoveryViewModel = AuthMenuViewModelCommon & {
     readonly kind: 'recovery';
     readonly mode: 'login';
     readonly recoveryCode: string;
-    /** Preview display length; live recovery defaults to the protocol code length. */
-    readonly recoveryCodeSlotCount?: 16 | 32;
     readonly recoveryCodeError: string | null;
     readonly passkeyName?: never;
     readonly passkeyNameLabel?: never;
@@ -223,6 +221,10 @@ export type AuthMenuRecoveryViewModel = AuthMenuViewModelCommon & {
     readonly stage: 'enter_code';
     readonly walletId?: never;
     readonly status: AuthMenuIdleStatus | AuthMenuRecoverableStatus;
+} | {
+    readonly stage: 'choose_method';
+    readonly walletId?: never;
+    readonly status: AuthMenuIdleStatus | AuthMenuRecoverableStatus;
 } | {
     readonly stage: 'preparing';
     readonly target: WalletRecoveryTargetV1;
@@ -281,6 +283,8 @@ export type AuthMenuIntent = {
 } | {
     readonly kind: 'recovery_code_changed';
     readonly recoveryCode: string;
+} | {
+    readonly kind: 'recovery_code_submit';
 } | {
     readonly kind: 'recovery_passkey_selected';
 } | {

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/auth-menu/session.d.ts

@@ -49,7 +49,7 @@ type AuthMenuReturnState = {
 };
 type AuthMenuRecoveryState = {
     readonly kind: 'recovery';
-    readonly stage: 'enter_code' | 'preparing';
+    readonly stage: 'enter_code' | 'choose_method' | 'preparing';
     readonly viewModel: AuthMenuRecoveryViewModel;
     readonly returnState: AuthMenuReturnState;
     readonly operation?: never;
@@ -238,6 +238,8 @@ export declare class AuthMenuSession {
     private openRecovery;
     private closeRecovery;
     private changeRecoveryCode;
+    private submitRecoveryCode;
+    private returnToRecoveryCode;
     private prepareRecovery;
     private completeRecoveryPreparation;
     private rejectRecoveryPreparation;

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/ui/auth-menu/AuthMenuSurface.d.ts

@@ -9,12 +9,12 @@ type AuthMenuSurfaceProps = {
     readonly styles: CspStylesheetManager;
 };
 type AccountMenuState = 'closed' | 'open' | 'closing';
-export declare class AuthMenuSurface extends Component<AuthMenuSurfaceProps, {
+type AuthMenuSurfaceState = {
     accountMenu: AccountMenuState;
-}> {
-    state: {
-        accountMenu: AccountMenuState;
-    };
+    recoveryCaret: number | null;
+};
+export declare class AuthMenuSurface extends Component<AuthMenuSurfaceProps, AuthMenuSurfaceState> {
+    state: AuthMenuSurfaceState;
     private accountMenuExitTimer;
     private accountMenuChoice;
     private previouslyFocusedElement;
@@ -67,6 +67,9 @@ export declare class AuthMenuSurface extends Component<AuthMenuSurfaceProps, {
     private onLinkDeviceOpen;
     private onRecoveryOpen;
     private onRecoveryCodeInput;
+    private onRecoveryCaretMove;
+    private onRecoveryCodeBlur;
+    private syncRecoveryCaret;
     private onRecoverySubmit;
     private onRecoveryPasskeySelected;
     private onRecoveryGoogleSelected;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "type": "module",
   "description": "Seams web and runtime TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",
@@ -184,12 +184,10 @@
   },
   "devDependencies": {
     "@simplewebauthn/server": "^13.2.2",
-    "@types/express": "^4.17.21",
     "@types/node": "^20.19.9",
     "@types/qrcode": "^1.5.5",
     "@types/react": "^19.1.12",
     "@types/react-dom": "^19.1.9",
-    "express": "^4.21.2",
     "react": "^19.1.1",
     "react-dom": "^19.1.1",
     "rolldown": "^1.0.0-beta.27",