@seams/wallet 0.15.6 → 0.18.0

package/dist/public/sdk/{types-hKLqDUhR.js → types-CQTWmtqu.js}

@@ -1 +1 @@
-import{S as e,o as t,x as n}from"./domainIds-BzkGsRqO.js";import{d as r,h as i}from"./capabilityKinds-N8xo_IEh.js";import{n as a}from"./signerDomain-Dp7BhfmZ.js";function o(e){switch(e.kind){case a.passkey:return a.passkey;case a.emailOtp:return a.emailOtp}throw Error(`[SigningSession] unsupported signing lane auth binding`)}function s(e,t){let n=String(e||``).trim();if(!n)throw Error(`[SigningSession] ${t} is required for signing lane authority`);return n}function c(e){switch(e.kind){case a.passkey:return[a.passkey,s(String(e.rpId),`passkey rpId`),s(e.credentialIdB64u,`passkey credential`)].join(`:`);case a.emailOtp:return[a.emailOtp,s(e.providerSubjectId,`Email OTP provider subject`)].join(`:`)}throw Error(`[SigningSession] unsupported signing lane auth binding`)}const l={TransactionSign:`transaction_sign`},u={Cached:`cached`,Reauth:`reauth`},d={WarmSession:`warm_session`,EmailOtpReauth:`email_otp_reauth`,PasskeyReauth:`passkey_reauth`,NotReady:`not_ready`,OperationStepUp:`operation_step_up`};function f(e,t){let n=String(e||``).trim();if(!n)throw Error(`[SigningSession] ${t} is required`);return n}function p(e,t){if(!e.ok)throw Error(`[SigningSession] ${e.error.message||`${t} is required`}`);return e.value}function m(e,t){if(!e.ok)throw Error(`[SigningSession] ${e.error.message||`${t} is required`}`);return e.value}const h={walletSession(e){return m(i(e),`walletSessionId`)},walletSessionQuota(e){return m(r(e),`quotaId`)},thresholdEd25519Session(t){return p(e(t),`thresholdEd25519SessionId`)},thresholdEcdsaSession(e){return p(n(e),`thresholdEcdsaSessionId`)},emailOtpChallenge(e){return p(t(e),`emailOtpChallengeId`)},signingOperation(e){return f(e,`signingOperationId`)},signingOperationFingerprint(e){return f(e,`signingOperationFingerprint`)}};function g(e){let t=e.identity.signer,n={authMethod:o(e.auth),curve:e.curve,keyKind:e.keyKind,chainFamily:e.chainFamily,sessionOrigin:e.sessionOrigin,storageSource:e.storageSource,retention:e.retention};switch(t.kind){case`evm_family_ecdsa_signer`:return{...n,curve:`ecdsa`,walletId:t.walletId};case`near_ed25519_signer`:return{...n,curve:`ed25519`,walletId:t.account.wallet.walletId,nearAccountId:t.account.nearAccountId,nearEd25519SigningKeyId:t.nearEd25519SigningKeyId}}}function _(e){return{kind:e.kind,lane:g(e.lane)}}export{g as a,o as c,d as i,l as n,_ as o,h as r,c as s,u as t};
+import{S as e,o as t,x as n}from"./domainIds-C3fUa33Q.js";import{d as r,h as i}from"./capabilityKinds-D0Yrp9uf.js";import{n as a}from"./signerDomain-BFqRQ0Jl.js";function o(e){switch(e.kind){case a.passkey:return a.passkey;case a.emailOtp:return a.emailOtp}throw Error(`[SigningSession] unsupported signing lane auth binding`)}function s(e,t){let n=String(e||``).trim();if(!n)throw Error(`[SigningSession] ${t} is required for signing lane authority`);return n}function c(e){switch(e.kind){case a.passkey:return[a.passkey,s(String(e.rpId),`passkey rpId`),s(e.credentialIdB64u,`passkey credential`)].join(`:`);case a.emailOtp:return[a.emailOtp,s(e.providerSubjectId,`Email OTP provider subject`)].join(`:`)}throw Error(`[SigningSession] unsupported signing lane auth binding`)}const l={TransactionSign:`transaction_sign`},u={Cached:`cached`,Reauth:`reauth`},d={WarmSession:`warm_session`,EmailOtpReauth:`email_otp_reauth`,PasskeyReauth:`passkey_reauth`,NotReady:`not_ready`,OperationStepUp:`operation_step_up`};function f(e,t){let n=String(e||``).trim();if(!n)throw Error(`[SigningSession] ${t} is required`);return n}function p(e,t){if(!e.ok)throw Error(`[SigningSession] ${e.error.message||`${t} is required`}`);return e.value}function m(e,t){if(!e.ok)throw Error(`[SigningSession] ${e.error.message||`${t} is required`}`);return e.value}const h={walletSession(e){return m(i(e),`walletSessionId`)},walletSessionQuota(e){return m(r(e),`quotaId`)},thresholdEd25519Session(t){return p(e(t),`thresholdEd25519SessionId`)},thresholdEcdsaSession(e){return p(n(e),`thresholdEcdsaSessionId`)},emailOtpChallenge(e){return p(t(e),`emailOtpChallengeId`)},signingOperation(e){return f(e,`signingOperationId`)},signingOperationFingerprint(e){return f(e,`signingOperationFingerprint`)}};function g(e){let t=e.identity.signer,n={authMethod:o(e.auth),curve:e.curve,keyKind:e.keyKind,chainFamily:e.chainFamily,sessionOrigin:e.sessionOrigin,storageSource:e.storageSource,retention:e.retention};switch(t.kind){case`evm_family_ecdsa_signer`:return{...n,curve:`ecdsa`,walletId:t.walletId};case`near_ed25519_signer`:return{...n,curve:`ed25519`,walletId:t.account.wallet.walletId,nearAccountId:t.account.nearAccountId,nearEd25519SigningKeyId:t.nearEd25519SigningKeyId}}}function _(e){return{kind:e.kind,lane:g(e.lane)}}export{g as a,o as c,d as i,l as n,_ as o,h as r,c as s,u as t};

package/dist/public/sdk/wallet-iframe-host-ecdsa.js

@@ -1 +1 @@
-import"./primitives-CqrjmIAH.js";import"./walletDbName-DtRewci9.js";import"./signingSessionSeal-DX41aXUL.js";import{t as e}from"./host-DfWylEiw.js";import"./activeWalletSession-WdZkhtBB.js";import"./capabilityKinds-N8xo_IEh.js";import"./errors-DIWY1KR9.js";e({supportedRuntimeRouteKinds:new Set([`auth`,`ecdsa`,`email_otp`,`export`,`recovery`,`preferences`])});
+import"./primitives-CTmDwMNc.js";import"./walletDbName-BxWApBQF.js";import"./signingSessionSeal-DqbjG8c8.js";import{t as e}from"./host-B-2QXolt.js";import"./activeWalletSession-BpbnpU9s.js";import"./capabilityKinds-D0Yrp9uf.js";import"./errors-ADOZT8oV.js";e({supportedRuntimeRouteKinds:new Set([`auth`,`ecdsa`,`email_otp`,`export`,`recovery`,`preferences`])});

package/dist/public/sdk/wallet-iframe-host-full.js

@@ -1 +1 @@
-import"./primitives-CqrjmIAH.js";import"./walletDbName-DtRewci9.js";import"./signingSessionSeal-DX41aXUL.js";import{t as e}from"./host-DfWylEiw.js";import"./activeWalletSession-WdZkhtBB.js";import"./capabilityKinds-N8xo_IEh.js";import"./errors-DIWY1KR9.js";e();
+import"./primitives-CTmDwMNc.js";import"./walletDbName-BxWApBQF.js";import"./signingSessionSeal-DqbjG8c8.js";import{t as e}from"./host-B-2QXolt.js";import"./activeWalletSession-BpbnpU9s.js";import"./capabilityKinds-D0Yrp9uf.js";import"./errors-ADOZT8oV.js";e();

package/dist/public/sdk/wallet-iframe-host-near.js

@@ -1 +1 @@
-import"./primitives-CqrjmIAH.js";import"./walletDbName-DtRewci9.js";import"./signingSessionSeal-DX41aXUL.js";import{t as e}from"./host-DfWylEiw.js";import"./activeWalletSession-WdZkhtBB.js";import"./capabilityKinds-N8xo_IEh.js";import"./errors-DIWY1KR9.js";e({supportedRuntimeRouteKinds:new Set([`auth`,`near`,`export`,`device_link`,`recovery`,`preferences`])});
+import"./primitives-CTmDwMNc.js";import"./walletDbName-BxWApBQF.js";import"./signingSessionSeal-DqbjG8c8.js";import{t as e}from"./host-B-2QXolt.js";import"./activeWalletSession-BpbnpU9s.js";import"./capabilityKinds-D0Yrp9uf.js";import"./errors-ADOZT8oV.js";e({supportedRuntimeRouteKinds:new Set([`auth`,`near`,`export`,`device_link`,`recovery`,`preferences`])});

package/dist/public/sdk/wallet-iframe-host-runtime.js

@@ -1 +1 @@
-import"./primitives-CqrjmIAH.js";import"./walletDbName-DtRewci9.js";import"./signingSessionSeal-DX41aXUL.js";import{t as e}from"./host-DfWylEiw.js";import"./activeWalletSession-WdZkhtBB.js";import"./capabilityKinds-N8xo_IEh.js";import"./errors-DIWY1KR9.js";export{e as initWalletIFrame};
+import"./primitives-CTmDwMNc.js";import"./walletDbName-BxWApBQF.js";import"./signingSessionSeal-DqbjG8c8.js";import{t as e}from"./host-B-2QXolt.js";import"./activeWalletSession-BpbnpU9s.js";import"./capabilityKinds-D0Yrp9uf.js";import"./errors-ADOZT8oV.js";export{e as initWalletIFrame};

package/dist/{esm/sdk/wallet-recovery-Bfhfk52N.js → public/sdk/wallet-recovery-DFaS3geI.js}

@@ -1 +1 @@
-import{A as e,D as t,M as n,O as r,T as i,j as a,n as o,s}from"./domainIds-BzkGsRqO.js";import{c,j as l,k as u,l as d,u as f}from"./chains-C_X_fNuS.js";import{_ as p,i as m,r as h,t as g}from"./primitives-CqrjmIAH.js";import{i as _,r as v}from"./base64-DW79QA0h.js";import{l as ee}from"./capabilityKinds-N8xo_IEh.js";import{a as y,n as b,r as x}from"./canonicalPrimitives-Dsbsxgxc.js";import{d as te,h as S,s as C}from"./walletAuthority-CAiGuWW2.js";import{r as w}from"./walletAuthMethodRecord-LniOQQmj.js";const T=`0123456789ABCDEFGHJKMNPQRSTVWXYZ`,E=Object.freeze(Array.from(T).reduce((e,t,n)=>(e[t]=n,e),{}));function D(e){if(!e)return!1;for(let t=0;t<e.length;t++){let n=e.charCodeAt(t);if(n<48||n>57)return!1}return!0}function O(e){if(e.byteLength!==20)throw Error(`Email OTP recovery key bytes must be exactly 20 bytes`);let t=0,n=0,r=``;for(let i=0;i<e.byteLength;i++)for(t=t<<8|e[i],n+=8;n>=5;)n-=5,r+=T[t>>n&31],t&=(1<<n)-1;return r}function k(e){let t=A(e),n=[],r=0;for(let e=0;e<8;e++)n.push(t.slice(r,r+4)),r+=4;return n.join(`-`)}function ne(e){if(e.length!==10)throw Error(`Email OTP recovery code set must contain 10 keys`);return[k(e[0]),k(e[1]),k(e[2]),k(e[3]),k(e[4]),k(e[5]),k(e[6]),k(e[7]),k(e[8]),k(e[9])]}function A(e){let t=String(e||``).replace(/[\s-]/g,``).toUpperCase();if(t.length!==32)throw Error(`Email OTP recovery key must be 32 Crockford Base32 characters`);if(D(t))throw Error(`Email OTP recovery key must not be decimal-only`);for(let e=0;e<t.length;e++)if(E[t[e]]===void 0)throw Error(`Email OTP recovery key contains unsupported characters`);return t}function re(e){let t=A(e),n=new Uint8Array(20),r=0,i=0,a=0;for(let e=0;e<t.length;e++)r=r<<5|E[t[e]],i+=5,i>=8&&(i-=8,n[a]=r>>i&255,r&=(1<<i)-1,a+=1);return n}async function ie(e){let t=String(e.keySetId||``).trim();if(!/^(near_ed25519|evm_family_ecdsa):\S+$/.test(t))throw Error(`wallet recovery key-set id is invalid`);return b(`wallet-recovery-key-v1:${_(await f(c({domain:`seams/wallet-recovery/key-lifecycle/v1`,reservationId:e.reservationId,keySetId:t})))}`)}function ae(e){if(typeof e!=`string`||e.length===0||e.length>512||e.trim()!==e||o(e))throw Error(`recovery code reservation id must be a compact opaque identifier`);return e}function oe(e){return e.kind===`passkey`?se(e):ce(e)}function se(e){let t={version:`wallet_recovery_committed_projection_v1`,storeVersion:l(e.storeVersion,`storeVersion`,`is invalid`),walletId:e.walletId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,authority:e.authority,kind:`passkey`,authMethod:e.authMethod,target:{kind:`passkey`,rpId:e.authMethod.rpId,credentialIdB64u:e.authMethod.credentialIdB64u}};return P(t),t}function ce(e){let t={version:`wallet_recovery_committed_projection_v1`,storeVersion:l(e.storeVersion,`storeVersion`,`is invalid`),walletId:e.walletId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,authority:e.authority,kind:`google_email_otp`,authMethod:e.authMethod,target:{kind:`google_email_otp`,provider:`google`,providerSubject:e.providerSubject,emailHashHex:H(e.emailHashHex),registrationAuthorityId:l(e.registrationAuthorityId,`registrationAuthorityId`,`is invalid`),enrollment:M(e.enrollment)}};return P(t),t}async function le(n,a){let o=F(n);if(o.version!==`wallet_recovery_committed_projection_v1`)throw Error(`wallet recovery committed projection version is invalid`);if(o.kind!==a.kind)throw Error(`wallet recovery committed projection target changed`);let s=V(r(o.walletId),`walletId`),c=V(e(o.recoveryOperationId),`recoveryOperationId`),u=V(ee(o.targetDeviceId),`targetDeviceId`),d=V(t(o.targetAuthorityId),`targetAuthorityId`),f=V(i(o.targetWalletAuthMethodId),`targetWalletAuthMethodId`),p=te(o.authority);if(!p.ok)throw Error(`wallet recovery authority projection is invalid`);let m=p.value;if(m.state!==`active`||!C(m)||!await S(m))throw Error(`wallet recovery authority projection digest or lifecycle is invalid`);let h=w(o.authMethod);if(!h||h.status!==`active`)throw Error(`wallet recovery auth method projection is invalid`);let g={version:`wallet_recovery_committed_projection_v1`,storeVersion:l(o.storeVersion,`storeVersion`,`is invalid`),walletId:s,recoveryOperationId:c,targetDeviceId:u,targetAuthorityId:d,targetWalletAuthMethodId:f,authority:m};if(a.kind===`passkey`){if(h.kind!==`passkey`)throw Error(`wallet recovery target method family changed`);let e=ue(o.target),t={...g,kind:`passkey`,authMethod:h,target:e};return N(t,a),P(t),t}if(h.kind!==`email_otp`)throw Error(`wallet recovery target method family changed`);let _=j(o.target),v={...g,kind:`google_email_otp`,authMethod:h,target:_};return N(v,a),P(v),v}function ue(e){let t=I(e);if(t.kind!==`passkey`)throw Error(`wallet recovery passkey target is invalid`);return{kind:`passkey`,rpId:V(n(t.rpId),`target.rpId`),credentialIdB64u:V(a(t.credentialIdB64u),`target.credentialIdB64u`)}}function j(e){let t=L(e);if(t.kind!==`google_email_otp`||t.provider!==`google`)throw Error(`wallet recovery Google Email OTP target is invalid`);return{kind:`google_email_otp`,provider:`google`,providerSubject:V(s(t.providerSubject),`target.providerSubject`),emailHashHex:H(t.emailHashHex),registrationAuthorityId:l(t.registrationAuthorityId,`target.registrationAuthorityId`,`is invalid`),enrollment:M(t.enrollment)}}function M(e){let t=R(e);if(t.kind!==`email_otp_enrollment_reference_v1`)throw Error(`wallet recovery Email OTP enrollment is invalid`);return{kind:`email_otp_enrollment_reference_v1`,enrollmentId:l(t.enrollmentId,`enrollment.enrollmentId`,`is invalid`),enrollmentSealKeyVersion:l(t.enrollmentSealKeyVersion,`enrollment.enrollmentSealKeyVersion`,`is invalid`)}}function N(e,t){if(e.kind!==t.kind||e.walletId!==t.walletId||e.recoveryOperationId!==t.recoveryOperationId||e.targetDeviceId!==t.targetDeviceId||e.targetAuthorityId!==t.targetAuthorityId||e.targetWalletAuthMethodId!==t.targetWalletAuthMethodId)throw Error(`wallet recovery committed projection identity changed`);if(e.kind===`passkey`&&t.kind===`passkey`){if(e.target.rpId!==t.rpId||e.target.credentialIdB64u!==t.credentialIdB64u)throw Error(`wallet recovery passkey target changed`);return}if(e.kind!==`google_email_otp`||t.kind!==`google_email_otp`)throw Error(`wallet recovery target identity changed`);if(e.target.providerSubject!==t.providerSubject||e.target.emailHashHex!==t.emailHashHex||e.target.registrationAuthorityId!==t.registrationAuthorityId||e.target.enrollment.enrollmentId!==t.enrollment.enrollmentId||e.target.enrollment.enrollmentSealKeyVersion!==t.enrollment.enrollmentSealKeyVersion)throw Error(`wallet recovery Google Email OTP target changed`)}function P(e){if(e.authority.walletId!==e.walletId||e.authority.authorityId!==e.targetAuthorityId||e.authority.principal.deviceId!==e.targetDeviceId||e.authority.provenance.kind!==`wallet_recovery`||e.authority.provenance.recoveryOperationId!==e.recoveryOperationId||e.authority.provenance.continuityAuthorityId===e.targetAuthorityId||e.authMethod.walletId!==e.walletId||e.authMethod.walletAuthorityId!==e.targetAuthorityId||e.authMethod.walletAuthMethodId!==e.targetWalletAuthMethodId||e.authMethod.status!==`active`)throw Error(`wallet recovery committed projection relations are invalid`);if(e.kind===`passkey`){if(e.authMethod.kind!==`passkey`||e.target.rpId!==e.authMethod.rpId||e.target.credentialIdB64u!==e.authMethod.credentialIdB64u)throw Error(`wallet recovery passkey projection relations are invalid`);return}if(e.authMethod.kind!==`email_otp`||e.target.emailHashHex!==e.authMethod.emailHashHex||e.target.registrationAuthorityId!==e.authMethod.registrationAuthorityId)throw Error(`wallet recovery Google Email OTP projection relations are invalid`)}function F(e){let t=z(e);if(t===null)throw Error(`wallet recovery committed projection must be an object`);return B(t,[`version`,`kind`,`storeVersion`,`walletId`,`recoveryOperationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`authority`,`authMethod`,`target`],`wallet recovery committed projection`),{version:Reflect.get(t,`version`),kind:Reflect.get(t,`kind`),storeVersion:Reflect.get(t,`storeVersion`),walletId:Reflect.get(t,`walletId`),recoveryOperationId:Reflect.get(t,`recoveryOperationId`),targetDeviceId:Reflect.get(t,`targetDeviceId`),targetAuthorityId:Reflect.get(t,`targetAuthorityId`),targetWalletAuthMethodId:Reflect.get(t,`targetWalletAuthMethodId`),authority:Reflect.get(t,`authority`),authMethod:Reflect.get(t,`authMethod`),target:Reflect.get(t,`target`)}}function I(e){let t=z(e);if(t===null)throw Error(`wallet recovery passkey target must be an object`);return B(t,[`kind`,`rpId`,`credentialIdB64u`],`wallet recovery passkey target`),{kind:Reflect.get(t,`kind`),rpId:Reflect.get(t,`rpId`),credentialIdB64u:Reflect.get(t,`credentialIdB64u`)}}function L(e){let t=z(e);if(t===null)throw Error(`wallet recovery Google Email OTP target must be an object`);return B(t,[`kind`,`provider`,`providerSubject`,`emailHashHex`,`registrationAuthorityId`,`enrollment`],`wallet recovery Google Email OTP target`),{kind:Reflect.get(t,`kind`),provider:Reflect.get(t,`provider`),providerSubject:Reflect.get(t,`providerSubject`),emailHashHex:Reflect.get(t,`emailHashHex`),registrationAuthorityId:Reflect.get(t,`registrationAuthorityId`),enrollment:Reflect.get(t,`enrollment`)}}function R(e){let t=z(e);if(t===null)throw Error(`wallet recovery Email OTP enrollment must be an object`);return B(t,[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`],`wallet recovery Email OTP enrollment`),{kind:Reflect.get(t,`kind`),enrollmentId:Reflect.get(t,`enrollmentId`),enrollmentSealKeyVersion:Reflect.get(t,`enrollmentSealKeyVersion`)}}function z(e){return typeof e==`object`&&e&&!Array.isArray(e)?e:null}function B(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length||i.some(e=>!r.has(e)))throw Error(`${n} contains unexpected fields`)}function V(e,t){if(!e.ok)throw Error(`${t} is invalid`);return e.value}function H(e){let t=l(e,`emailHashHex`,`is invalid`);if(!/^[0-9a-f]{64}$/.test(t))throw Error(`emailHashHex is invalid`);return t}const U=/^wallet-rkid-v1-[A-Za-z0-9_-]{43}$/;function W(e,t=`recoveryKeyId`){if(typeof e!=`string`||!U.test(e))throw Error(`${t} must be a derived wallet recovery key id`);return e}function de(){let e=[],t=[];for(let n=0;n<10;n+=1){let n=pe();t.push(n),e.push(k(O(n)))}return{codes:e,codeBytes:t}}function fe(e){for(let t of e.codeBytes)t.fill(0)}function pe(){let e=globalThis.crypto;if(!e?.getRandomValues)throw Error(`a secure random source is required to issue wallet recovery codes`);return e.getRandomValues(new Uint8Array(20))}function me(e,t=`recoveryCodeLocator`){try{return x(e)}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`must be a canonical digest`}`)}}async function he(e){if(!(e instanceof Uint8Array)||e.length!==20)throw Error(`recovery code bytes must be exactly 20 bytes`);let t=null;try{let n=new TextEncoder().encode(`seams/wallet-recovery/code-locator/v1`);t=new Uint8Array(8+n.length+e.length);let r=new DataView(t.buffer);return r.setUint32(0,n.length,!1),t.set(n,4),r.setUint32(4+n.length,e.length,!1),t.set(e,8+n.length),me(_(await d(t)))}finally{t?.fill(0)}}function ge(e){return{custodySecretKind:`wallet_custody_seed_v1`,nonceB64u:e.nonceB64u,wrappedCustodySecretB64u:e.wrappedCustodySecretB64u,aadHashB64u:e.aadHashB64u}}function _e(e,t){let n=t.label||`walletRecoverySetRotation`,i=u(e,n);p(i,be,n);let a=r(i.walletId);if(!a.ok)throw Error(`${n}.walletId ${a.error.message}`);if(String(a.value)!==String(t.expectedWalletId))throw Error(`${n}.walletId is outside the authenticated wallet`);if(!Array.isArray(i.manifestKekWraps))throw Error(`${n}.manifestKekWraps must be an array`);if(i.manifestKekWraps.length!==10)throw Error(`${n}.manifestKekWraps must carry exactly 10 recovery-code wraps`);let o=i.manifestKekWraps.map((e,t)=>{let r=u(e,`${n}.manifestKekWraps[${t}]`);return p(r,ye,`${n}.manifestKekWraps[${t}]`),{recoveryKeyId:W(r.recoveryKeyId,`${n}.manifestKekWraps[${t}].recoveryKeyId`),nonceB64u:m(r.nonceB64u,`${n}.manifestKekWraps[${t}].nonceB64u`),ciphertextB64u:h(r.ciphertextB64u,`${n}.manifestKekWraps[${t}].ciphertextB64u`),aadHashB64u:g(r.aadHashB64u,`${n}.manifestKekWraps[${t}].aadHashB64u`)}}),s=new Set;for(let e of o){let t=String(e.recoveryKeyId);if(!s.add(t))throw Error(`${n} contains duplicate recovery key ids`)}if(!Array.isArray(i.entries)||i.entries.length!==1)throw Error(`${n}.entries must carry exactly one wallet custody seed entry`);let c=G(i.entries[0],`${n}.entries[0]`);return{walletId:a.value,manifestKekWraps:o,entry:c}}const ve=[`custodySecretKind`,`nonceB64u`,`wrappedCustodySecretB64u`,`aadHashB64u`],ye=[`recoveryKeyId`,`nonceB64u`,`ciphertextB64u`,`aadHashB64u`],be=[`walletId`,`manifestKekWraps`,`entries`];function G(e,t){let n=u(e,t);if(p(n,ve,t),n.custodySecretKind!==`wallet_custody_seed_v1`)throw Error(`${t}.custodySecretKind must be wallet_custody_seed_v1; lane holder shares are reprovisioned, not recovered`);return ge({nonceB64u:m(n.nonceB64u,`${t}.nonceB64u`),wrappedCustodySecretB64u:h(n.wrappedCustodySecretB64u,`${t}.wrappedCustodySecretB64u`),aadHashB64u:g(n.aadHashB64u,`${t}.aadHashB64u`)})}function K(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} must be an object`);return e}function q(e,t){let n=typeof e==`string`?e.trim():``;if(!n)throw Error(`${t} is required`);return n}function xe(e){let t=K(e,`rotation worker result`);if(!Array.isArray(t.recoveryManifestKekWraps)||t.recoveryManifestKekWraps.length!==10)throw Error(`rotation worker result must contain exactly 10 recovery wraps`);return{walletId:q(t.walletId,`rotation worker walletId`),recoveryManifestKekWraps:t.recoveryManifestKekWraps.map((e,t)=>{let n=K(e,`rotation worker wrap ${t}`);return{recoveryKeyId:q(n.recoveryKeyId,`rotation worker wrap ${t} recoveryKeyId`),nonceB64u:q(n.nonceB64u,`rotation worker wrap ${t} nonceB64u`),ciphertextB64u:q(n.ciphertextB64u,`rotation worker wrap ${t} ciphertextB64u`),aadHashB64u:q(n.aadHashB64u,`rotation worker wrap ${t} aadHashB64u`)}}),recoveryEntryNonceB64u:q(t.recoveryEntryNonceB64u,`rotation worker recoveryEntryNonceB64u`),recoveryEntryCiphertextB64u:q(t.recoveryEntryCiphertextB64u,`rotation worker recoveryEntryCiphertextB64u`),recoveryEntryAadHashB64u:q(t.recoveryEntryAadHashB64u,`rotation worker recoveryEntryAadHashB64u`)}}function Se(e){let t=xe(e),n=r(t.walletId);if(!n.ok)throw Error(`rotation worker wallet id is invalid: ${n.error.message}`);let i={custodySecretKind:`wallet_custody_seed_v1`,nonceB64u:m(t.recoveryEntryNonceB64u,`rotation.entry.nonceB64u`),wrappedCustodySecretB64u:h(t.recoveryEntryCiphertextB64u,`rotation.entry.wrappedCustodySecretB64u`),aadHashB64u:g(t.recoveryEntryAadHashB64u,`rotation.entry.aadHashB64u`)};return _e({walletId:n.value,manifestKekWraps:t.recoveryManifestKekWraps.map(e=>({recoveryKeyId:W(e.recoveryKeyId,`rotation.recoveryKeyId`),nonceB64u:m(e.nonceB64u,`rotation.wrap.nonceB64u`),ciphertextB64u:h(e.ciphertextB64u,`rotation.wrap.ciphertextB64u`),aadHashB64u:g(e.aadHashB64u,`rotation.wrap.aadHashB64u`)})),entries:[i]},{expectedWalletId:n.value,label:`rotation.workerResult`})}const J=`secp256k1_bip340_sha256_v1`;function Y(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`);for(let r of n)if(!Object.hasOwn(e,r))throw Error(`${t}.${r} is required`)}function X(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} must be a non-empty canonical identifier`);for(let n=0;n<e.length;n+=1){let r=e.charCodeAt(n);if(r<33||r>126)throw Error(`${t} must contain visible ASCII bytes`)}return e}function Z(e){return e.startsWith(`evm_family_ecdsa:`)&&e.length>17}function Ce(e,t){let n=X(e,t);if(!Z(n))throw Error(`${t} must identify an ECDSA key set`);return n}function Q(e,t){try{return x(e)}catch{throw Error(`${t} must be canonical base64url for 32 bytes`)}}function we(e,t){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical base64url`);let n;try{n=v(e)}catch{throw Error(`${t} must be valid base64url`)}if(n.length!==33||n[0]!==2&&n[0]!==3||_(n)!==e)throw Error(`${t} must be canonical compressed secp256k1 public key bytes`);return e}function Te(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe integer`);return e}function Ee(e,t){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical base64url`);let n;try{n=v(e)}catch{throw Error(`${t} must be valid base64url`)}if(n.length!==64||_(n)!==e)throw Error(`${t} must be canonical base64url for 64 bytes`);return e}function $(e){let t=u(e,`walletRecoveryEcdsaPossessionChallenge`);if(Y(t,`walletRecoveryEcdsaPossessionChallenge`,[`kind`,`walletId`,`reservationId`,`replacementId`,`keySetId`,`keyHandle`,`recordedKeyManifestDigestB64u`,`publicCapabilityDigestB64u`,`authorityRefDigestB64u`,`derivationClientSharePublicKey33B64u`,`expectedServerGeneration`,`expiresAtMs`,`serverNonceB64u`]),t.kind!==`wallet_recovery_ecdsa_possession_challenge_v1`)throw Error(`walletRecoveryEcdsaPossessionChallenge.kind is invalid`);let n=Ce(t.keySetId,`walletRecoveryEcdsaPossessionChallenge.keySetId`);return{kind:`wallet_recovery_ecdsa_possession_challenge_v1`,walletId:X(t.walletId,`walletRecoveryEcdsaPossessionChallenge.walletId`),reservationId:X(t.reservationId,`walletRecoveryEcdsaPossessionChallenge.reservationId`),replacementId:X(t.replacementId,`walletRecoveryEcdsaPossessionChallenge.replacementId`),keySetId:n,keyHandle:X(t.keyHandle,`walletRecoveryEcdsaPossessionChallenge.keyHandle`),recordedKeyManifestDigestB64u:Q(t.recordedKeyManifestDigestB64u,`walletRecoveryEcdsaPossessionChallenge.recordedKeyManifestDigestB64u`),publicCapabilityDigestB64u:Q(t.publicCapabilityDigestB64u,`walletRecoveryEcdsaPossessionChallenge.publicCapabilityDigestB64u`),authorityRefDigestB64u:Q(t.authorityRefDigestB64u,`walletRecoveryEcdsaPossessionChallenge.authorityRefDigestB64u`),derivationClientSharePublicKey33B64u:we(t.derivationClientSharePublicKey33B64u,`walletRecoveryEcdsaPossessionChallenge.derivationClientSharePublicKey33B64u`),expectedServerGeneration:X(t.expectedServerGeneration,`walletRecoveryEcdsaPossessionChallenge.expectedServerGeneration`),expiresAtMs:Te(t.expiresAtMs,`walletRecoveryEcdsaPossessionChallenge.expiresAtMs`),serverNonceB64u:Q(t.serverNonceB64u,`walletRecoveryEcdsaPossessionChallenge.serverNonceB64u`)}}function De(e){let t=u(e,`walletRecoveryEcdsaPossessionProof`);if(Y(t,`walletRecoveryEcdsaPossessionProof`,[`kind`,`scheme`,`signature64B64u`]),t.kind!==`wallet_recovery_ecdsa_possession_proof_v1`)throw Error(`walletRecoveryEcdsaPossessionProof.kind is invalid`);if(t.scheme!==J)throw Error(`walletRecoveryEcdsaPossessionProof.scheme is invalid`);return{kind:`wallet_recovery_ecdsa_possession_proof_v1`,scheme:J,signature64B64u:Ee(t.signature64B64u,`walletRecoveryEcdsaPossessionProof.signature64B64u`)}}function Oe(e){let t=$(e),n=[`seams/wallet-recovery/ecdsa-existing-material-possession/v1`,J,t.walletId,t.reservationId,t.replacementId,t.keySetId,t.keyHandle,v(t.recordedKeyManifestDigestB64u),v(t.publicCapabilityDigestB64u),v(t.authorityRefDigestB64u),v(t.derivationClientSharePublicKey33B64u),t.expectedServerGeneration,v(t.serverNonceB64u),ke(t.expiresAtMs)],r=[];for(let e of n){let t=typeof e==`string`?new TextEncoder().encode(e):e,n=t.length;if(n>4294967295)throw Error(`wallet recovery possession field is too large`);r.push(n>>>24&255,n>>>16&255,n>>>8&255,n&255,...t)}return Uint8Array.from(r)}function ke(e){let t=BigInt(e),n=new Uint8Array(8);for(let e=n.length-1;e>=0;--e)n[e]=Number(t&255n),t>>=8n;return n}async function Ae(e){return y(Oe(e))}export{G as a,fe as c,ie as d,ae as f,A as g,re as h,Se as i,oe as l,ne as m,De as n,he as o,T as p,Ae as r,de as s,$ as t,le as u};
+import{A as e,D as t,M as n,O as r,T as i,j as a,n as o,s}from"./domainIds-C3fUa33Q.js";import{c,j as l,k as u,l as d,u as f}from"./chains-CPmd4s9f.js";import{_ as p,i as m,r as h,t as g}from"./primitives-CTmDwMNc.js";import{i as _,r as v}from"./base64-BmKR3UqU.js";import{l as ee}from"./capabilityKinds-D0Yrp9uf.js";import{a as y,n as b,r as x}from"./canonicalPrimitives-BMP5yILS.js";import{d as te,h as S,s as C}from"./walletAuthority-BY3kyKQ-.js";import{r as w}from"./walletAuthMethodRecord-CWdqdY_s.js";const T=`0123456789ABCDEFGHJKMNPQRSTVWXYZ`,E=Object.freeze(Array.from(T).reduce((e,t,n)=>(e[t]=n,e),{}));function D(e){if(!e)return!1;for(let t=0;t<e.length;t++){let n=e.charCodeAt(t);if(n<48||n>57)return!1}return!0}function O(e){if(e.byteLength!==20)throw Error(`Email OTP recovery key bytes must be exactly 20 bytes`);let t=0,n=0,r=``;for(let i=0;i<e.byteLength;i++)for(t=t<<8|e[i],n+=8;n>=5;)n-=5,r+=T[t>>n&31],t&=(1<<n)-1;return r}function k(e){let t=A(e),n=[],r=0;for(let e=0;e<8;e++)n.push(t.slice(r,r+4)),r+=4;return n.join(`-`)}function ne(e){if(e.length!==10)throw Error(`Email OTP recovery code set must contain 10 keys`);return[k(e[0]),k(e[1]),k(e[2]),k(e[3]),k(e[4]),k(e[5]),k(e[6]),k(e[7]),k(e[8]),k(e[9])]}function A(e){let t=String(e||``).replace(/[\s-]/g,``).toUpperCase();if(t.length!==32)throw Error(`Email OTP recovery key must be 32 Crockford Base32 characters`);if(D(t))throw Error(`Email OTP recovery key must not be decimal-only`);for(let e=0;e<t.length;e++)if(E[t[e]]===void 0)throw Error(`Email OTP recovery key contains unsupported characters`);return t}function re(e){let t=A(e),n=new Uint8Array(20),r=0,i=0,a=0;for(let e=0;e<t.length;e++)r=r<<5|E[t[e]],i+=5,i>=8&&(i-=8,n[a]=r>>i&255,r&=(1<<i)-1,a+=1);return n}async function ie(e){let t=String(e.keySetId||``).trim();if(!/^(near_ed25519|evm_family_ecdsa):\S+$/.test(t))throw Error(`wallet recovery key-set id is invalid`);return b(`wallet-recovery-key-v1:${_(await f(c({domain:`seams/wallet-recovery/key-lifecycle/v1`,reservationId:e.reservationId,keySetId:t})))}`)}function ae(e){if(typeof e!=`string`||e.length===0||e.length>512||e.trim()!==e||o(e))throw Error(`recovery code reservation id must be a compact opaque identifier`);return e}function oe(e){return e.kind===`passkey`?se(e):ce(e)}function se(e){let t={version:`wallet_recovery_committed_projection_v1`,storeVersion:l(e.storeVersion,`storeVersion`,`is invalid`),walletId:e.walletId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,authority:e.authority,kind:`passkey`,authMethod:e.authMethod,target:{kind:`passkey`,rpId:e.authMethod.rpId,credentialIdB64u:e.authMethod.credentialIdB64u}};return P(t),t}function ce(e){let t={version:`wallet_recovery_committed_projection_v1`,storeVersion:l(e.storeVersion,`storeVersion`,`is invalid`),walletId:e.walletId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,authority:e.authority,kind:`google_email_otp`,authMethod:e.authMethod,target:{kind:`google_email_otp`,provider:`google`,providerSubject:e.providerSubject,emailHashHex:H(e.emailHashHex),registrationAuthorityId:l(e.registrationAuthorityId,`registrationAuthorityId`,`is invalid`),enrollment:M(e.enrollment)}};return P(t),t}async function le(n,a){let o=F(n);if(o.version!==`wallet_recovery_committed_projection_v1`)throw Error(`wallet recovery committed projection version is invalid`);if(o.kind!==a.kind)throw Error(`wallet recovery committed projection target changed`);let s=V(r(o.walletId),`walletId`),c=V(e(o.recoveryOperationId),`recoveryOperationId`),u=V(ee(o.targetDeviceId),`targetDeviceId`),d=V(t(o.targetAuthorityId),`targetAuthorityId`),f=V(i(o.targetWalletAuthMethodId),`targetWalletAuthMethodId`),p=te(o.authority);if(!p.ok)throw Error(`wallet recovery authority projection is invalid`);let m=p.value;if(m.state!==`active`||!C(m)||!await S(m))throw Error(`wallet recovery authority projection digest or lifecycle is invalid`);let h=w(o.authMethod);if(!h||h.status!==`active`)throw Error(`wallet recovery auth method projection is invalid`);let g={version:`wallet_recovery_committed_projection_v1`,storeVersion:l(o.storeVersion,`storeVersion`,`is invalid`),walletId:s,recoveryOperationId:c,targetDeviceId:u,targetAuthorityId:d,targetWalletAuthMethodId:f,authority:m};if(a.kind===`passkey`){if(h.kind!==`passkey`)throw Error(`wallet recovery target method family changed`);let e=ue(o.target),t={...g,kind:`passkey`,authMethod:h,target:e};return N(t,a),P(t),t}if(h.kind!==`email_otp`)throw Error(`wallet recovery target method family changed`);let _=j(o.target),v={...g,kind:`google_email_otp`,authMethod:h,target:_};return N(v,a),P(v),v}function ue(e){let t=I(e);if(t.kind!==`passkey`)throw Error(`wallet recovery passkey target is invalid`);return{kind:`passkey`,rpId:V(n(t.rpId),`target.rpId`),credentialIdB64u:V(a(t.credentialIdB64u),`target.credentialIdB64u`)}}function j(e){let t=L(e);if(t.kind!==`google_email_otp`||t.provider!==`google`)throw Error(`wallet recovery Google Email OTP target is invalid`);return{kind:`google_email_otp`,provider:`google`,providerSubject:V(s(t.providerSubject),`target.providerSubject`),emailHashHex:H(t.emailHashHex),registrationAuthorityId:l(t.registrationAuthorityId,`target.registrationAuthorityId`,`is invalid`),enrollment:M(t.enrollment)}}function M(e){let t=R(e);if(t.kind!==`email_otp_enrollment_reference_v1`)throw Error(`wallet recovery Email OTP enrollment is invalid`);return{kind:`email_otp_enrollment_reference_v1`,enrollmentId:l(t.enrollmentId,`enrollment.enrollmentId`,`is invalid`),enrollmentSealKeyVersion:l(t.enrollmentSealKeyVersion,`enrollment.enrollmentSealKeyVersion`,`is invalid`)}}function N(e,t){if(e.kind!==t.kind||e.walletId!==t.walletId||e.recoveryOperationId!==t.recoveryOperationId||e.targetDeviceId!==t.targetDeviceId||e.targetAuthorityId!==t.targetAuthorityId||e.targetWalletAuthMethodId!==t.targetWalletAuthMethodId)throw Error(`wallet recovery committed projection identity changed`);if(e.kind===`passkey`&&t.kind===`passkey`){if(e.target.rpId!==t.rpId||e.target.credentialIdB64u!==t.credentialIdB64u)throw Error(`wallet recovery passkey target changed`);return}if(e.kind!==`google_email_otp`||t.kind!==`google_email_otp`)throw Error(`wallet recovery target identity changed`);if(e.target.providerSubject!==t.providerSubject||e.target.emailHashHex!==t.emailHashHex||e.target.registrationAuthorityId!==t.registrationAuthorityId||e.target.enrollment.enrollmentId!==t.enrollment.enrollmentId||e.target.enrollment.enrollmentSealKeyVersion!==t.enrollment.enrollmentSealKeyVersion)throw Error(`wallet recovery Google Email OTP target changed`)}function P(e){if(e.authority.walletId!==e.walletId||e.authority.authorityId!==e.targetAuthorityId||e.authority.principal.deviceId!==e.targetDeviceId||e.authority.provenance.kind!==`wallet_recovery`||e.authority.provenance.recoveryOperationId!==e.recoveryOperationId||e.authority.provenance.continuityAuthorityId===e.targetAuthorityId||e.authMethod.walletId!==e.walletId||e.authMethod.walletAuthorityId!==e.targetAuthorityId||e.authMethod.walletAuthMethodId!==e.targetWalletAuthMethodId||e.authMethod.status!==`active`)throw Error(`wallet recovery committed projection relations are invalid`);if(e.kind===`passkey`){if(e.authMethod.kind!==`passkey`||e.target.rpId!==e.authMethod.rpId||e.target.credentialIdB64u!==e.authMethod.credentialIdB64u)throw Error(`wallet recovery passkey projection relations are invalid`);return}if(e.authMethod.kind!==`email_otp`||e.target.emailHashHex!==e.authMethod.emailHashHex||e.target.registrationAuthorityId!==e.authMethod.registrationAuthorityId)throw Error(`wallet recovery Google Email OTP projection relations are invalid`)}function F(e){let t=z(e);if(t===null)throw Error(`wallet recovery committed projection must be an object`);return B(t,[`version`,`kind`,`storeVersion`,`walletId`,`recoveryOperationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`authority`,`authMethod`,`target`],`wallet recovery committed projection`),{version:Reflect.get(t,`version`),kind:Reflect.get(t,`kind`),storeVersion:Reflect.get(t,`storeVersion`),walletId:Reflect.get(t,`walletId`),recoveryOperationId:Reflect.get(t,`recoveryOperationId`),targetDeviceId:Reflect.get(t,`targetDeviceId`),targetAuthorityId:Reflect.get(t,`targetAuthorityId`),targetWalletAuthMethodId:Reflect.get(t,`targetWalletAuthMethodId`),authority:Reflect.get(t,`authority`),authMethod:Reflect.get(t,`authMethod`),target:Reflect.get(t,`target`)}}function I(e){let t=z(e);if(t===null)throw Error(`wallet recovery passkey target must be an object`);return B(t,[`kind`,`rpId`,`credentialIdB64u`],`wallet recovery passkey target`),{kind:Reflect.get(t,`kind`),rpId:Reflect.get(t,`rpId`),credentialIdB64u:Reflect.get(t,`credentialIdB64u`)}}function L(e){let t=z(e);if(t===null)throw Error(`wallet recovery Google Email OTP target must be an object`);return B(t,[`kind`,`provider`,`providerSubject`,`emailHashHex`,`registrationAuthorityId`,`enrollment`],`wallet recovery Google Email OTP target`),{kind:Reflect.get(t,`kind`),provider:Reflect.get(t,`provider`),providerSubject:Reflect.get(t,`providerSubject`),emailHashHex:Reflect.get(t,`emailHashHex`),registrationAuthorityId:Reflect.get(t,`registrationAuthorityId`),enrollment:Reflect.get(t,`enrollment`)}}function R(e){let t=z(e);if(t===null)throw Error(`wallet recovery Email OTP enrollment must be an object`);return B(t,[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`],`wallet recovery Email OTP enrollment`),{kind:Reflect.get(t,`kind`),enrollmentId:Reflect.get(t,`enrollmentId`),enrollmentSealKeyVersion:Reflect.get(t,`enrollmentSealKeyVersion`)}}function z(e){return typeof e==`object`&&e&&!Array.isArray(e)?e:null}function B(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length||i.some(e=>!r.has(e)))throw Error(`${n} contains unexpected fields`)}function V(e,t){if(!e.ok)throw Error(`${t} is invalid`);return e.value}function H(e){let t=l(e,`emailHashHex`,`is invalid`);if(!/^[0-9a-f]{64}$/.test(t))throw Error(`emailHashHex is invalid`);return t}const U=/^wallet-rkid-v1-[A-Za-z0-9_-]{43}$/;function W(e,t=`recoveryKeyId`){if(typeof e!=`string`||!U.test(e))throw Error(`${t} must be a derived wallet recovery key id`);return e}function de(){let e=[],t=[];for(let n=0;n<10;n+=1){let n=pe();t.push(n),e.push(k(O(n)))}return{codes:e,codeBytes:t}}function fe(e){for(let t of e.codeBytes)t.fill(0)}function pe(){let e=globalThis.crypto;if(!e?.getRandomValues)throw Error(`a secure random source is required to issue wallet recovery codes`);return e.getRandomValues(new Uint8Array(20))}function me(e,t=`recoveryCodeLocator`){try{return x(e)}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`must be a canonical digest`}`)}}async function he(e){if(!(e instanceof Uint8Array)||e.length!==20)throw Error(`recovery code bytes must be exactly 20 bytes`);let t=null;try{let n=new TextEncoder().encode(`seams/wallet-recovery/code-locator/v1`);t=new Uint8Array(8+n.length+e.length);let r=new DataView(t.buffer);return r.setUint32(0,n.length,!1),t.set(n,4),r.setUint32(4+n.length,e.length,!1),t.set(e,8+n.length),me(_(await d(t)))}finally{t?.fill(0)}}function ge(e){return{custodySecretKind:`wallet_custody_seed_v1`,nonceB64u:e.nonceB64u,wrappedCustodySecretB64u:e.wrappedCustodySecretB64u,aadHashB64u:e.aadHashB64u}}function _e(e,t){let n=t.label||`walletRecoverySetRotation`,i=u(e,n);p(i,be,n);let a=r(i.walletId);if(!a.ok)throw Error(`${n}.walletId ${a.error.message}`);if(String(a.value)!==String(t.expectedWalletId))throw Error(`${n}.walletId is outside the authenticated wallet`);if(!Array.isArray(i.manifestKekWraps))throw Error(`${n}.manifestKekWraps must be an array`);if(i.manifestKekWraps.length!==10)throw Error(`${n}.manifestKekWraps must carry exactly 10 recovery-code wraps`);let o=i.manifestKekWraps.map((e,t)=>{let r=u(e,`${n}.manifestKekWraps[${t}]`);return p(r,ye,`${n}.manifestKekWraps[${t}]`),{recoveryKeyId:W(r.recoveryKeyId,`${n}.manifestKekWraps[${t}].recoveryKeyId`),nonceB64u:m(r.nonceB64u,`${n}.manifestKekWraps[${t}].nonceB64u`),ciphertextB64u:h(r.ciphertextB64u,`${n}.manifestKekWraps[${t}].ciphertextB64u`),aadHashB64u:g(r.aadHashB64u,`${n}.manifestKekWraps[${t}].aadHashB64u`)}}),s=new Set;for(let e of o){let t=String(e.recoveryKeyId);if(!s.add(t))throw Error(`${n} contains duplicate recovery key ids`)}if(!Array.isArray(i.entries)||i.entries.length!==1)throw Error(`${n}.entries must carry exactly one wallet custody seed entry`);let c=G(i.entries[0],`${n}.entries[0]`);return{walletId:a.value,manifestKekWraps:o,entry:c}}const ve=[`custodySecretKind`,`nonceB64u`,`wrappedCustodySecretB64u`,`aadHashB64u`],ye=[`recoveryKeyId`,`nonceB64u`,`ciphertextB64u`,`aadHashB64u`],be=[`walletId`,`manifestKekWraps`,`entries`];function G(e,t){let n=u(e,t);if(p(n,ve,t),n.custodySecretKind!==`wallet_custody_seed_v1`)throw Error(`${t}.custodySecretKind must be wallet_custody_seed_v1; lane holder shares are reprovisioned, not recovered`);return ge({nonceB64u:m(n.nonceB64u,`${t}.nonceB64u`),wrappedCustodySecretB64u:h(n.wrappedCustodySecretB64u,`${t}.wrappedCustodySecretB64u`),aadHashB64u:g(n.aadHashB64u,`${t}.aadHashB64u`)})}function K(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} must be an object`);return e}function q(e,t){let n=typeof e==`string`?e.trim():``;if(!n)throw Error(`${t} is required`);return n}function xe(e){let t=K(e,`rotation worker result`);if(!Array.isArray(t.recoveryManifestKekWraps)||t.recoveryManifestKekWraps.length!==10)throw Error(`rotation worker result must contain exactly 10 recovery wraps`);return{walletId:q(t.walletId,`rotation worker walletId`),recoveryManifestKekWraps:t.recoveryManifestKekWraps.map((e,t)=>{let n=K(e,`rotation worker wrap ${t}`);return{recoveryKeyId:q(n.recoveryKeyId,`rotation worker wrap ${t} recoveryKeyId`),nonceB64u:q(n.nonceB64u,`rotation worker wrap ${t} nonceB64u`),ciphertextB64u:q(n.ciphertextB64u,`rotation worker wrap ${t} ciphertextB64u`),aadHashB64u:q(n.aadHashB64u,`rotation worker wrap ${t} aadHashB64u`)}}),recoveryEntryNonceB64u:q(t.recoveryEntryNonceB64u,`rotation worker recoveryEntryNonceB64u`),recoveryEntryCiphertextB64u:q(t.recoveryEntryCiphertextB64u,`rotation worker recoveryEntryCiphertextB64u`),recoveryEntryAadHashB64u:q(t.recoveryEntryAadHashB64u,`rotation worker recoveryEntryAadHashB64u`)}}function Se(e){let t=xe(e),n=r(t.walletId);if(!n.ok)throw Error(`rotation worker wallet id is invalid: ${n.error.message}`);let i={custodySecretKind:`wallet_custody_seed_v1`,nonceB64u:m(t.recoveryEntryNonceB64u,`rotation.entry.nonceB64u`),wrappedCustodySecretB64u:h(t.recoveryEntryCiphertextB64u,`rotation.entry.wrappedCustodySecretB64u`),aadHashB64u:g(t.recoveryEntryAadHashB64u,`rotation.entry.aadHashB64u`)};return _e({walletId:n.value,manifestKekWraps:t.recoveryManifestKekWraps.map(e=>({recoveryKeyId:W(e.recoveryKeyId,`rotation.recoveryKeyId`),nonceB64u:m(e.nonceB64u,`rotation.wrap.nonceB64u`),ciphertextB64u:h(e.ciphertextB64u,`rotation.wrap.ciphertextB64u`),aadHashB64u:g(e.aadHashB64u,`rotation.wrap.aadHashB64u`)})),entries:[i]},{expectedWalletId:n.value,label:`rotation.workerResult`})}const J=`secp256k1_bip340_sha256_v1`;function Y(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`);for(let r of n)if(!Object.hasOwn(e,r))throw Error(`${t}.${r} is required`)}function X(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} must be a non-empty canonical identifier`);for(let n=0;n<e.length;n+=1){let r=e.charCodeAt(n);if(r<33||r>126)throw Error(`${t} must contain visible ASCII bytes`)}return e}function Z(e){return e.startsWith(`evm_family_ecdsa:`)&&e.length>17}function Ce(e,t){let n=X(e,t);if(!Z(n))throw Error(`${t} must identify an ECDSA key set`);return n}function Q(e,t){try{return x(e)}catch{throw Error(`${t} must be canonical base64url for 32 bytes`)}}function we(e,t){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical base64url`);let n;try{n=v(e)}catch{throw Error(`${t} must be valid base64url`)}if(n.length!==33||n[0]!==2&&n[0]!==3||_(n)!==e)throw Error(`${t} must be canonical compressed secp256k1 public key bytes`);return e}function Te(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe integer`);return e}function Ee(e,t){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical base64url`);let n;try{n=v(e)}catch{throw Error(`${t} must be valid base64url`)}if(n.length!==64||_(n)!==e)throw Error(`${t} must be canonical base64url for 64 bytes`);return e}function $(e){let t=u(e,`walletRecoveryEcdsaPossessionChallenge`);if(Y(t,`walletRecoveryEcdsaPossessionChallenge`,[`kind`,`walletId`,`reservationId`,`replacementId`,`keySetId`,`keyHandle`,`recordedKeyManifestDigestB64u`,`publicCapabilityDigestB64u`,`authorityRefDigestB64u`,`derivationClientSharePublicKey33B64u`,`expectedServerGeneration`,`expiresAtMs`,`serverNonceB64u`]),t.kind!==`wallet_recovery_ecdsa_possession_challenge_v1`)throw Error(`walletRecoveryEcdsaPossessionChallenge.kind is invalid`);let n=Ce(t.keySetId,`walletRecoveryEcdsaPossessionChallenge.keySetId`);return{kind:`wallet_recovery_ecdsa_possession_challenge_v1`,walletId:X(t.walletId,`walletRecoveryEcdsaPossessionChallenge.walletId`),reservationId:X(t.reservationId,`walletRecoveryEcdsaPossessionChallenge.reservationId`),replacementId:X(t.replacementId,`walletRecoveryEcdsaPossessionChallenge.replacementId`),keySetId:n,keyHandle:X(t.keyHandle,`walletRecoveryEcdsaPossessionChallenge.keyHandle`),recordedKeyManifestDigestB64u:Q(t.recordedKeyManifestDigestB64u,`walletRecoveryEcdsaPossessionChallenge.recordedKeyManifestDigestB64u`),publicCapabilityDigestB64u:Q(t.publicCapabilityDigestB64u,`walletRecoveryEcdsaPossessionChallenge.publicCapabilityDigestB64u`),authorityRefDigestB64u:Q(t.authorityRefDigestB64u,`walletRecoveryEcdsaPossessionChallenge.authorityRefDigestB64u`),derivationClientSharePublicKey33B64u:we(t.derivationClientSharePublicKey33B64u,`walletRecoveryEcdsaPossessionChallenge.derivationClientSharePublicKey33B64u`),expectedServerGeneration:X(t.expectedServerGeneration,`walletRecoveryEcdsaPossessionChallenge.expectedServerGeneration`),expiresAtMs:Te(t.expiresAtMs,`walletRecoveryEcdsaPossessionChallenge.expiresAtMs`),serverNonceB64u:Q(t.serverNonceB64u,`walletRecoveryEcdsaPossessionChallenge.serverNonceB64u`)}}function De(e){let t=u(e,`walletRecoveryEcdsaPossessionProof`);if(Y(t,`walletRecoveryEcdsaPossessionProof`,[`kind`,`scheme`,`signature64B64u`]),t.kind!==`wallet_recovery_ecdsa_possession_proof_v1`)throw Error(`walletRecoveryEcdsaPossessionProof.kind is invalid`);if(t.scheme!==J)throw Error(`walletRecoveryEcdsaPossessionProof.scheme is invalid`);return{kind:`wallet_recovery_ecdsa_possession_proof_v1`,scheme:J,signature64B64u:Ee(t.signature64B64u,`walletRecoveryEcdsaPossessionProof.signature64B64u`)}}function Oe(e){let t=$(e),n=[`seams/wallet-recovery/ecdsa-existing-material-possession/v1`,J,t.walletId,t.reservationId,t.replacementId,t.keySetId,t.keyHandle,v(t.recordedKeyManifestDigestB64u),v(t.publicCapabilityDigestB64u),v(t.authorityRefDigestB64u),v(t.derivationClientSharePublicKey33B64u),t.expectedServerGeneration,v(t.serverNonceB64u),ke(t.expiresAtMs)],r=[];for(let e of n){let t=typeof e==`string`?new TextEncoder().encode(e):e,n=t.length;if(n>4294967295)throw Error(`wallet recovery possession field is too large`);r.push(n>>>24&255,n>>>16&255,n>>>8&255,n&255,...t)}return Uint8Array.from(r)}function ke(e){let t=BigInt(e),n=new Uint8Array(8);for(let e=n.length-1;e>=0;--e)n[e]=Number(t&255n),t>>=8n;return n}async function Ae(e){return y(Oe(e))}export{G as a,fe as c,ie as d,ae as f,A as g,re as h,Se as i,oe as l,ne as m,De as n,he as o,T as p,Ae as r,de as s,$ as t,le as u};