@seams/wallet 0.21.0 → 0.22.0

package/dist/{esm/sdk/walletRecoveryAdminProof-CIoLawfC.js → public/sdk/walletRecoveryAdminProof-CtH8_lph.js}

@@ -1 +1 @@
-import{nt as e,ot as t}from"./activeWalletSession-BtEHhe99.js";import{r as n}from"./base64-BmKR3UqU.js";import{r,t as i}from"./secureRandomId-8LSc91aN.js";import{o as a}from"./signerSlot-CpyIfl3J.js";import{l as o}from"./wallet-recovery-BEui57xM.js";import{n as s,s as c,t as l,u}from"./helpers-BXezXx19.js";import{i as ee}from"./pendingWalletRecoveryCodeBackup-DWeemdJv.js";import{t as d}from"./walletCustodyOperation-BO_tSfGY.js";import{t as f}from"./webauthnPromptCoordinator-CBkTiMP0.js";import{i as p}from"./collectAuthenticationCredentialForChallengeB64u-CSwy9csE.js";function m(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===5&&n.every(e=>[`ok`,`challengeId`,`challenge_digest`,`expiresAtMs`,`otpChannel`].includes(e))&&t.get(`ok`)===!0)return{kind:`success`,challengeId:t.get(`challengeId`),challengeDigest:t.get(`challenge_digest`),expiresAtMs:t.get(`expiresAtMs`),otpChannel:t.get(`otpChannel`)};let r=[`ok`,`code`,`message`,`retryAfterMs`];if((t.size===3||t.size===4)&&n.every(e=>r.includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`&&typeof t.get(`message`)==`string`&&(t.size===3||typeof t.get(`retryAfterMs`)==`number`)){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function h(e){let t;try{t=await S({relayUrl:e.relayUrl,path:`/wallets/custody/email-otp/challenge`,body:{walletId:e.walletId,providerSubjectId:e.providerSubjectId,operation:e.operation,payload:e.payload,...e.requestOrigin?{requestOrigin:e.requestOrigin}:{}},fetchImpl:e.fetchImpl})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`Email OTP challenge request failed`}}let n=m(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status!==200||n.kind!==`success`)return{kind:t.status>=400&&t.status<500?`rejected`:`transport_failed`,message:r||`Email OTP challenge failed (HTTP ${t.status})`};let i=typeof n.challengeId==`string`?n.challengeId.trim():``,a=typeof n.challengeDigest==`string`?n.challengeDigest.trim():``,o=Number(n.expiresAtMs),s=typeof n.otpChannel==`string`?n.otpChannel.trim():``;return!i||!a||!Number.isSafeInteger(o)||o<=0||!s?{kind:`transport_failed`,message:`Email OTP challenge returned an unusable payload`}:{kind:`ready`,challengeId:i,challenge_digest:a,expiresAtMs:o,otpChannel:s}}function g(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[`ok`,`activeCodeCount`,`totalCodeCount`,`issuedAtMs`,`storeVersion`,`backupOutstanding`],r=[...t.keys()];if(t.size===n.length&&r.every(e=>n.includes(e))&&t.get(`ok`)===!0)return{kind:`success`,activeCodeCount:t.get(`activeCodeCount`),totalCodeCount:t.get(`totalCodeCount`),issuedAtMs:t.get(`issuedAtMs`),storeVersion:t.get(`storeVersion`),backupOutstanding:t.get(`backupOutstanding`)};let i=[`ok`,`code`,`message`];if(t.size===i.length&&r.every(e=>i.includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function _(e){let t;try{t=await S({relayUrl:e.relayUrl,path:`/wallets/${encodeURIComponent(e.walletId)}/recovery/status`,body:{requestId:e.requestId,factorProof:e.factorProof},fetchImpl:e.fetchImpl})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`recovery status request failed`}}let n=g(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status===401||t.status===403)return{kind:`unauthorized`,message:r||`recovery status is unauthorized`};if(t.status===404)return{kind:`no_recovery_set`,message:r||`this wallet has no recovery set`};if(t.status!==200)return{kind:`transport_failed`,message:r||`recovery status failed (HTTP ${t.status})`};if(n.kind!==`success`)return{kind:`transport_failed`,message:`recovery status returned an unusable payload`};let i=Number(n.activeCodeCount),a=Number(n.totalCodeCount),o=Number(n.issuedAtMs),s=typeof n.storeVersion==`string`?n.storeVersion.trim():``;return!Number.isSafeInteger(i)||i<0||!Number.isSafeInteger(a)||a<i||!Number.isSafeInteger(o)||o<=0||!s||typeof n.backupOutstanding!=`boolean`?{kind:`transport_failed`,message:`recovery status returned an unusable payload`}:{kind:`ready`,walletId:e.walletId,activeCodeCount:i,totalCodeCount:a,issuedAtMs:o,storeVersion:s,backupOutstanding:n.backupOutstanding,pendingLocalBackup:!1}}function v(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===2&&n.includes(`ok`)&&n.includes(`issuedAtMs`)&&t.get(`ok`)===!0)return{kind:`success`,issuedAtMs:t.get(`issuedAtMs`)};if(t.size===3&&n.includes(`ok`)&&n.includes(`code`)&&n.includes(`message`)&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function y(e){let t;try{t=await S({relayUrl:e.relayUrl,path:`/wallets/recovery/acknowledge-backup`,body:{walletId:e.walletId,requestId:e.requestId,expectedIssuedAtMs:e.expectedIssuedAtMs,factorProof:e.factorProof},fetchImpl:e.fetchImpl})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`recovery backup acknowledgement failed`}}let n=v(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status===401||t.status===403)return{kind:`unauthorized`,message:r||`recovery backup acknowledgement is unauthorized`};if(t.status===404)return{kind:`no_recovery_set`,message:r||`this wallet has no recovery set`};if(t.status===409)return{kind:`conflict`,message:r||`Recovery codes changed. Check status and review the current set.`};if(t.status!==200)return{kind:`transport_failed`,message:r||`recovery backup acknowledgement failed (HTTP ${t.status})`};if(n.kind!==`success`)return{kind:`transport_failed`,message:`recovery backup acknowledgement returned an unusable payload`};let i=Number(n.issuedAtMs);return!Number.isSafeInteger(i)||i<=0?{kind:`transport_failed`,message:`recovery backup acknowledgement returned an unusable payload`}:{kind:`acknowledged`,walletId:e.walletId,issuedAtMs:i}}function b(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===3&&n.every(e=>[`ok`,`issuedAtMs`,`storeVersion`].includes(e))&&t.get(`ok`)===!0)return{kind:`success`,issuedAtMs:t.get(`issuedAtMs`),storeVersion:t.get(`storeVersion`)};if(t.size===3&&n.every(e=>[`ok`,`code`,`message`].includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function x(e){let t=await S({relayUrl:e.relayUrl,path:`/wallets/recovery/rotate`,body:{walletId:e.walletId,expectedStoreVersion:e.expectedStoreVersion,manifestKekWraps:e.replacement.manifestKekWraps,entries:[e.replacement.entry],recoveryCodeLocators:e.recoveryCodeLocators,factorProof:e.factorProof},fetchImpl:e.fetchImpl}),n=b(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status===200&&n.kind===`success`){let e=Number(n.issuedAtMs),t=typeof n.storeVersion==`string`?n.storeVersion.trim():``;return!Number.isSafeInteger(e)||e<=0||!t?{kind:`transport_failed`,message:`rotation returned an unusable response`}:{kind:`rotated`,issuedAtMs:e,storeVersion:t}}return t.status===404?{kind:`no_recovery_set`,message:r||`no recovery set`}:t.status===409?{kind:`conflict`,message:r||`recovery set changed`}:t.status===400?{kind:`rejected`,message:r||`rotation rejected`}:{kind:`transport_failed`,message:r||`rotation failed (HTTP ${t.status})`}}async function S(n){let r=`${t(n.relayUrl)}${n.path}`;return await(n.fetchImpl||fetch)(r,e({headers:{Accept:`application/json`},body:n.body}))}var C=class extends Error{code=`wallet_origin_webauthn_unavailable`;constructor(e){super(e),this.name=`WalletOriginWebAuthnUnavailableError`}};async function w(e,t,n){let r=T(e,t);try{return e===`create`?await navigator.credentials.create({publicKey:r,...n.abortSignal?{signal:n.abortSignal}:{}}):await navigator.credentials.get({publicKey:r,...n.abortSignal?{signal:n.abortSignal}:{}})}catch(t){throw e===`create`&&(N(t)||P(t))?new C(`Wallet-origin WebAuthn registration is unavailable: ${F(t)}`):t}}function T(e,t){return e===`create`?E(t):D(t)}function E(e){return{...e,challenge:M(e.challenge),user:{...e.user,id:M(e.user.id)},excludeCredentials:e.excludeCredentials?.map(O),extensions:k(e.extensions)}}function D(e){return{...e,challenge:M(e.challenge),allowCredentials:e.allowCredentials?.map(O),extensions:k(e.extensions)}}function O(e){return{...e,id:M(e.id)}}function k(e){if(!e)return e;let t={...e},n=t.prf;if(n&&typeof n==`object`){let e={...n};if(e.eval&&typeof e.eval==`object`&&(e.eval=A(e.eval)),e.evalByCredential&&typeof e.evalByCredential==`object`){let t={};for(let[n,r]of Object.entries(e.evalByCredential))t[n]=r&&typeof r==`object`?A(r):r;e.evalByCredential=t}t.prf=e}return t}function A(e){return{...e,...j(e.first)?{first:M(e.first)}:{},...j(e.second)?{second:M(e.second)}:{}}}function j(e){return e instanceof ArrayBuffer||ArrayBuffer.isView(e)}function M(e){if(e instanceof ArrayBuffer)return e.slice(0);let t=e,n=new Uint8Array(t.buffer,t.byteOffset,t.byteLength).slice();if(e instanceof DataView)return new DataView(n.buffer);let r=Object.getPrototypeOf(e).constructor;return new r(n.buffer)}function N(e){let t=F(e);return/origin of the document is not the same as its ancestors/i.test(t)}function P(e){let t=I(e),n=F(e),r=t===`NotAllowedError`,i=/document is not focused|not focused|focus/i.test(n);return!!(r&&i)}function F(e){return String(e?.message||``)}function I(e){let t=e?.name;return typeof t==`string`?t:``}function L(e,t){return(e||t||``).toLowerCase()}function R(e){let t=n(String(e||``));if(t.length!==32)throw Error(`Invalid WebAuthn challenge: expected 32 bytes, got ${t.length}`);return t}function z(e){if(e.kind!==`wallet_registration`)throw Error(`Wallet registration challenge is unavailable`);return e.challengeB64u}function B(e){let t=a(String(e.walletId||``).trim());if(String(e.intendedUserName||``).trim()!==String(t))throw Error(`WebAuthn registration user.name must match walletId`);return{walletId:t}}var V=class{rpIdOverride;abortController;removePageAbortHandlers;removeExternalAbortListener;constructor(e){this.rpIdOverride=e}getRpId(){try{return L(this.rpIdOverride,window?.location?.hostname)}catch{return this.rpIdOverride||``}}getAuthenticationCredentialsSerializedForChallengeB64u(e){let t=`webauthn-get-${i(12,`WebAuthn get request IDs`)}`;return f.runImmediate({owner:{kind:`wallet_request`,requestId:t,operation:`authentication`},operation:this.executeAuthenticationCredential.bind(this,e)})}async executeAuthenticationCredential({subjectId:e,challengeB64u:t,allowCredentials:r=[],includeSecondPrfOutput:i=!1,cancellation:a={kind:`none`}}){this.abortController=new AbortController,this.removePageAbortHandlers=q(this.abortController),this.removeExternalAbortListener=H(this.abortController,a);let o=this.getRpId(),u={challenge:R(t),rpId:o,userVerification:`preferred`,timeout:6e4,extensions:{prf:{eval:{first:l(),second:s()}}}};r.length>0&&(u.allowCredentials=r.map(e=>({id:n(e.id),type:`public-key`,transports:e.transports})));try{let e=c({credential:await w(`get`,u,{abortSignal:this.abortController.signal}),firstPrfOutput:!0,secondPrfOutput:i});return G(e,t),e}finally{this.removePageAbortHandlers?.(),this.removePageAbortHandlers=void 0,this.removeExternalAbortListener?.(),this.removeExternalAbortListener=void 0,this.abortController=void 0}}generateRegistrationCredentialsInternal(e){switch(e.prompt.kind){case`reserved`:return f.runReserved({reservation:e.prompt.reservation,owner:e.prompt.owner,operation:this.executeRegistrationCredential.bind(this,e)});case`immediate`:return f.runImmediate({owner:{kind:`wallet_request`,requestId:e.prompt.requestId,operation:`registration`},operation:this.executeRegistrationCredential.bind(this,e)})}}async executeRegistrationCredential(e){this.abortController=new AbortController,this.removePageAbortHandlers=q(this.abortController),this.removeExternalAbortListener=H(this.abortController,e.prompt.cancellation);let t=this.getRpId(),r=B({walletId:e.walletId,intendedUserName:e.intendedUserName}),i=e.kind===`wallet_recovery`?e.recoveryRegistration:null,a=e.kind===`wallet_add_auth_method`?e.registration:null,o=i??a,c=o?.rpId??t;if(o&&c!==t)throw Error(`Wallet recovery RP ID does not match the wallet origin`);let u=o?{challenge:R(o.challengeB64u),rp:{name:`Seams Wallet`,id:c},user:{id:n(o.user.idB64u),name:o.user.name,displayName:o.user.displayName},pubKeyCredParams:o.pubKeyCredParams.map(e=>({...e})),authenticatorSelection:{...o.authenticatorSelection},timeout:o.timeoutMs,attestation:o.attestation,extensions:{prf:{eval:{first:n(o.extensions.prf.eval.firstB64u),second:n(o.extensions.prf.eval.secondB64u)}}},excludeCredentials:o.excludeCredentials.map(e=>({type:e.type,id:n(e.id)}))}:{challenge:R(z(e)),rp:{name:`WebAuthn Passkey`,id:c},user:{id:new TextEncoder().encode(K(e.walletId,e.signerSlot)),name:r.walletId,displayName:r.walletId},pubKeyCredParams:[{alg:-7,type:`public-key`},{alg:-257,type:`public-key`}],authenticatorSelection:{residentKey:`required`,userVerification:`preferred`},timeout:6e4,attestation:`none`,extensions:{prf:{eval:{first:l(),second:s()}}}};try{return await w(`create`,u,{abortSignal:this.abortController.signal})}finally{this.removePageAbortHandlers?.(),this.removePageAbortHandlers=void 0,this.removeExternalAbortListener?.(),this.removeExternalAbortListener=void 0,this.abortController=void 0}}};function H(e,t){if(t.kind===`none`)return;let n=t.signal,r=e.abort.bind(e);if(n.aborted){r();return}return n.addEventListener(`abort`,r,{once:!0}),n.removeEventListener.bind(n,`abort`,r)}function U(e){return String(e||``).trim().replace(/=+$/g,``)}function W(e){let t=String(e.response?.clientDataJSON||``).trim();if(!t)throw Error(`WebAuthn authentication response missing clientDataJSON`);let r=``;try{r=new TextDecoder().decode(n(t))}catch(e){throw Error(`WebAuthn authentication response has invalid clientDataJSON encoding: ${e instanceof Error?e.message:String(e)}`)}let i;try{i=JSON.parse(r)}catch(e){throw Error(`WebAuthn authentication response has invalid clientDataJSON JSON: ${e instanceof Error?e.message:String(e)}`)}let a=i&&typeof i==`object`?i.challenge:void 0;if(typeof a!=`string`||!a.trim())throw Error(`WebAuthn authentication response clientDataJSON missing challenge`);return a}function G(e,t){let n=U(W(e)),r=U(t);if(n!==r)throw Error(`Unexpected authentication response challenge "${n}", expected "${r}"`)}function K(e,t){return t===void 0||t===1?e:`${e} (${t})`}function q(e){let t=()=>{document.hidden&&e.abort()},n=()=>{e.abort()},r=()=>{e.abort()};return document.addEventListener(`visibilitychange`,t,{passive:!0}),window.addEventListener(`pagehide`,n,{passive:!0}),window.addEventListener(`beforeunload`,r,{passive:!0}),()=>{document.removeEventListener(`visibilitychange`,t),window.removeEventListener(`pagehide`,n),window.removeEventListener(`beforeunload`,r)}}async function J(e){let t=e.request.payload.walletId,n=window.location.origin,r=await d({walletId:t,operation:e.request.operation,payload:e.request.payload,requestOrigin:n}),i=await p({credentialStore:o,touchIdPrompt:new V(e.rpId),walletId:t,challengeB64u:r,includeSecondPrfOutput:!1}),a=ee(i);if(!a)throw Error(`Wallet recovery proof did not receive a passkey credential`);return{kind:`passkey`,walletId:t,rpId:e.rpId,credentialIdB64u:a,challenge_digest:r,webauthn_authentication:u(i)}}function Y(){return r(`wallet-recovery-admin`,16,`wallet recovery administration request IDs`)}async function X(e){let t=Y(),n={walletId:e.walletId,requestId:t},r=await J({rpId:e.rpId,request:{operation:`recovery_status`,payload:n}});return await _({relayUrl:e.relayUrl,walletId:e.walletId,requestId:t,factorProof:r})}async function Z(e){let t=Y(),n={walletId:e.walletId,requestId:t,expectedIssuedAtMs:e.expectedIssuedAtMs},r=await J({rpId:e.rpId,request:{operation:`recovery_backup_acknowledge`,payload:n}});return await y({relayUrl:e.relayUrl,walletId:e.walletId,requestId:t,expectedIssuedAtMs:e.expectedIssuedAtMs,factorProof:r})}async function Q(e){let t=await o.resolveSelectedWalletAuthority(e);if(t.kind!==`resolved`||t.selection.lockState!==`unlocked`||String(t.selection.walletId)!==e||t.selection.walletAuthMethodId!==t.authMethod.walletAuthMethodId||t.authMethod.kind!==`email_otp`||t.authMethod.status!==`active`||t.authority.state!==`active`||String(t.authMethod.walletId)!==e||String(t.authority.walletId)!==e)throw Error(`Unlock this wallet with its active Email OTP method`);let n=await o.listWalletAuthMethodsForWallet(e),r=null;for(let e of n)if(!(e.kind!==`email_otp`||e.status!==`active`||e.localStatus!==`synced`||String(e.authority.bindingId)!==String(t.authMethod.walletAuthMethodId))){if(r!==null)throw Error(`The selected Email OTP owner method is duplicated`);r=String(e.authority.factor.providerUserId||``).trim()}if(!r)throw Error(`The selected Email OTP owner method is unavailable on this wallet`);return{walletAuthMethodId:String(t.authMethod.walletAuthMethodId),providerSubjectId:r}}async function $(e){let t=e.request.payload.walletId,{providerSubjectId:n}=await Q(t),r=window.location.origin,i=await d({walletId:t,operation:e.request.operation,payload:e.request.payload,requestOrigin:r}),a=await h({relayUrl:e.relayUrl,walletId:t,providerSubjectId:n,operation:e.request.operation,payload:e.request.payload,requestOrigin:r});if(a.kind!==`ready`)throw Error(a.message);if(a.challenge_digest!==i)throw Error(`Recovery Email OTP challenge does not match this operation`);let o=await e.context.signingEngine.requestEmailOtpOwnerConfirmation({purpose:e.request.operation,walletId:t,emailAddress:`your email`,challengeId:a.challengeId});if(o.challengeId!==a.challengeId)throw Error(`Recovery Email OTP confirmation changed its challenge`);return{kind:`email_otp`,provider_subject_id:n,challenge_id:o.challengeId,otp_code:o.otpCode,challenge_digest:i}}async function te(e){let t=Y(),n={walletId:e.walletId,requestId:t},r=await $({context:e.context,relayUrl:e.relayUrl,request:{operation:`recovery_status`,payload:n}});return await _({relayUrl:e.relayUrl,walletId:e.walletId,requestId:t,factorProof:r})}async function ne(e){let t=Y(),n={walletId:e.walletId,requestId:t,expectedIssuedAtMs:e.expectedIssuedAtMs},r=await $({context:e.context,relayUrl:e.relayUrl,request:{operation:`recovery_backup_acknowledge`,payload:n}});return await y({relayUrl:e.relayUrl,walletId:e.walletId,requestId:t,expectedIssuedAtMs:e.expectedIssuedAtMs,factorProof:r})}export{X as a,_ as c,te as i,h as l,Z as n,Q as o,$ as r,V as s,ne as t,x as u};
+import{nt as e,ot as t}from"./activeWalletSession-BtEHhe99.js";import{r as n}from"./base64-BmKR3UqU.js";import{r,t as i}from"./secureRandomId-8LSc91aN.js";import{o as a}from"./signerSlot-CpyIfl3J.js";import{l as o}from"./wallet-recovery-BEui57xM.js";import{n as s,s as c,t as l,u}from"./helpers-BXezXx19.js";import{i as ee}from"./pendingWalletRecoveryCodeBackup-LbstFwcY.js";import{t as d}from"./walletCustodyOperation-BO_tSfGY.js";import{t as f}from"./webauthnPromptCoordinator-CBkTiMP0.js";import{i as p}from"./collectAuthenticationCredentialForChallengeB64u-CSwy9csE.js";function m(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===5&&n.every(e=>[`ok`,`challengeId`,`challenge_digest`,`expiresAtMs`,`otpChannel`].includes(e))&&t.get(`ok`)===!0)return{kind:`success`,challengeId:t.get(`challengeId`),challengeDigest:t.get(`challenge_digest`),expiresAtMs:t.get(`expiresAtMs`),otpChannel:t.get(`otpChannel`)};let r=[`ok`,`code`,`message`,`retryAfterMs`];if((t.size===3||t.size===4)&&n.every(e=>r.includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`&&typeof t.get(`message`)==`string`&&(t.size===3||typeof t.get(`retryAfterMs`)==`number`)){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function h(e){let t;try{t=await S({relayUrl:e.relayUrl,path:`/wallets/custody/email-otp/challenge`,body:{walletId:e.walletId,providerSubjectId:e.providerSubjectId,operation:e.operation,payload:e.payload,...e.requestOrigin?{requestOrigin:e.requestOrigin}:{}},fetchImpl:e.fetchImpl})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`Email OTP challenge request failed`}}let n=m(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status!==200||n.kind!==`success`)return{kind:t.status>=400&&t.status<500?`rejected`:`transport_failed`,message:r||`Email OTP challenge failed (HTTP ${t.status})`};let i=typeof n.challengeId==`string`?n.challengeId.trim():``,a=typeof n.challengeDigest==`string`?n.challengeDigest.trim():``,o=Number(n.expiresAtMs),s=typeof n.otpChannel==`string`?n.otpChannel.trim():``;return!i||!a||!Number.isSafeInteger(o)||o<=0||!s?{kind:`transport_failed`,message:`Email OTP challenge returned an unusable payload`}:{kind:`ready`,challengeId:i,challenge_digest:a,expiresAtMs:o,otpChannel:s}}function g(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[`ok`,`activeCodeCount`,`totalCodeCount`,`issuedAtMs`,`storeVersion`,`backupOutstanding`],r=[...t.keys()];if(t.size===n.length&&r.every(e=>n.includes(e))&&t.get(`ok`)===!0)return{kind:`success`,activeCodeCount:t.get(`activeCodeCount`),totalCodeCount:t.get(`totalCodeCount`),issuedAtMs:t.get(`issuedAtMs`),storeVersion:t.get(`storeVersion`),backupOutstanding:t.get(`backupOutstanding`)};let i=[`ok`,`code`,`message`];if(t.size===i.length&&r.every(e=>i.includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function _(e){let t;try{t=await S({relayUrl:e.relayUrl,path:`/wallets/${encodeURIComponent(e.walletId)}/recovery/status`,body:{requestId:e.requestId,factorProof:e.factorProof},fetchImpl:e.fetchImpl})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`recovery status request failed`}}let n=g(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status===401||t.status===403)return{kind:`unauthorized`,message:r||`recovery status is unauthorized`};if(t.status===404)return{kind:`no_recovery_set`,message:r||`this wallet has no recovery set`};if(t.status!==200)return{kind:`transport_failed`,message:r||`recovery status failed (HTTP ${t.status})`};if(n.kind!==`success`)return{kind:`transport_failed`,message:`recovery status returned an unusable payload`};let i=Number(n.activeCodeCount),a=Number(n.totalCodeCount),o=Number(n.issuedAtMs),s=typeof n.storeVersion==`string`?n.storeVersion.trim():``;return!Number.isSafeInteger(i)||i<0||!Number.isSafeInteger(a)||a<i||!Number.isSafeInteger(o)||o<=0||!s||typeof n.backupOutstanding!=`boolean`?{kind:`transport_failed`,message:`recovery status returned an unusable payload`}:{kind:`ready`,walletId:e.walletId,activeCodeCount:i,totalCodeCount:a,issuedAtMs:o,storeVersion:s,backupOutstanding:n.backupOutstanding,pendingLocalBackup:!1}}function v(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===2&&n.includes(`ok`)&&n.includes(`issuedAtMs`)&&t.get(`ok`)===!0)return{kind:`success`,issuedAtMs:t.get(`issuedAtMs`)};if(t.size===3&&n.includes(`ok`)&&n.includes(`code`)&&n.includes(`message`)&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function y(e){let t;try{t=await S({relayUrl:e.relayUrl,path:`/wallets/recovery/acknowledge-backup`,body:{walletId:e.walletId,requestId:e.requestId,expectedIssuedAtMs:e.expectedIssuedAtMs,factorProof:e.factorProof},fetchImpl:e.fetchImpl})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`recovery backup acknowledgement failed`}}let n=v(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status===401||t.status===403)return{kind:`unauthorized`,message:r||`recovery backup acknowledgement is unauthorized`};if(t.status===404)return{kind:`no_recovery_set`,message:r||`this wallet has no recovery set`};if(t.status===409)return{kind:`conflict`,message:r||`Recovery codes changed. Check status and review the current set.`};if(t.status!==200)return{kind:`transport_failed`,message:r||`recovery backup acknowledgement failed (HTTP ${t.status})`};if(n.kind!==`success`)return{kind:`transport_failed`,message:`recovery backup acknowledgement returned an unusable payload`};let i=Number(n.issuedAtMs);return!Number.isSafeInteger(i)||i<=0?{kind:`transport_failed`,message:`recovery backup acknowledgement returned an unusable payload`}:{kind:`acknowledged`,walletId:e.walletId,issuedAtMs:i}}function b(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===3&&n.every(e=>[`ok`,`issuedAtMs`,`storeVersion`].includes(e))&&t.get(`ok`)===!0)return{kind:`success`,issuedAtMs:t.get(`issuedAtMs`),storeVersion:t.get(`storeVersion`)};if(t.size===3&&n.every(e=>[`ok`,`code`,`message`].includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function x(e){let t=await S({relayUrl:e.relayUrl,path:`/wallets/recovery/rotate`,body:{walletId:e.walletId,expectedStoreVersion:e.expectedStoreVersion,manifestKekWraps:e.replacement.manifestKekWraps,entries:[e.replacement.entry],recoveryCodeLocators:e.recoveryCodeLocators,factorProof:e.factorProof},fetchImpl:e.fetchImpl}),n=b(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status===200&&n.kind===`success`){let e=Number(n.issuedAtMs),t=typeof n.storeVersion==`string`?n.storeVersion.trim():``;return!Number.isSafeInteger(e)||e<=0||!t?{kind:`transport_failed`,message:`rotation returned an unusable response`}:{kind:`rotated`,issuedAtMs:e,storeVersion:t}}return t.status===404?{kind:`no_recovery_set`,message:r||`no recovery set`}:t.status===409?{kind:`conflict`,message:r||`recovery set changed`}:t.status===400?{kind:`rejected`,message:r||`rotation rejected`}:{kind:`transport_failed`,message:r||`rotation failed (HTTP ${t.status})`}}async function S(n){let r=`${t(n.relayUrl)}${n.path}`;return await(n.fetchImpl||fetch)(r,e({headers:{Accept:`application/json`},body:n.body}))}var C=class extends Error{code=`wallet_origin_webauthn_unavailable`;constructor(e){super(e),this.name=`WalletOriginWebAuthnUnavailableError`}};async function w(e,t,n){let r=T(e,t);try{return e===`create`?await navigator.credentials.create({publicKey:r,...n.abortSignal?{signal:n.abortSignal}:{}}):await navigator.credentials.get({publicKey:r,...n.abortSignal?{signal:n.abortSignal}:{}})}catch(t){throw e===`create`&&(N(t)||P(t))?new C(`Wallet-origin WebAuthn registration is unavailable: ${F(t)}`):t}}function T(e,t){return e===`create`?E(t):D(t)}function E(e){return{...e,challenge:M(e.challenge),user:{...e.user,id:M(e.user.id)},excludeCredentials:e.excludeCredentials?.map(O),extensions:k(e.extensions)}}function D(e){return{...e,challenge:M(e.challenge),allowCredentials:e.allowCredentials?.map(O),extensions:k(e.extensions)}}function O(e){return{...e,id:M(e.id)}}function k(e){if(!e)return e;let t={...e},n=t.prf;if(n&&typeof n==`object`){let e={...n};if(e.eval&&typeof e.eval==`object`&&(e.eval=A(e.eval)),e.evalByCredential&&typeof e.evalByCredential==`object`){let t={};for(let[n,r]of Object.entries(e.evalByCredential))t[n]=r&&typeof r==`object`?A(r):r;e.evalByCredential=t}t.prf=e}return t}function A(e){return{...e,...j(e.first)?{first:M(e.first)}:{},...j(e.second)?{second:M(e.second)}:{}}}function j(e){return e instanceof ArrayBuffer||ArrayBuffer.isView(e)}function M(e){if(e instanceof ArrayBuffer)return e.slice(0);let t=e,n=new Uint8Array(t.buffer,t.byteOffset,t.byteLength).slice();if(e instanceof DataView)return new DataView(n.buffer);let r=Object.getPrototypeOf(e).constructor;return new r(n.buffer)}function N(e){let t=F(e);return/origin of the document is not the same as its ancestors/i.test(t)}function P(e){let t=I(e),n=F(e),r=t===`NotAllowedError`,i=/document is not focused|not focused|focus/i.test(n);return!!(r&&i)}function F(e){return String(e?.message||``)}function I(e){let t=e?.name;return typeof t==`string`?t:``}function L(e,t){return(e||t||``).toLowerCase()}function R(e){let t=n(String(e||``));if(t.length!==32)throw Error(`Invalid WebAuthn challenge: expected 32 bytes, got ${t.length}`);return t}function z(e){if(e.kind!==`wallet_registration`)throw Error(`Wallet registration challenge is unavailable`);return e.challengeB64u}function B(e){let t=a(String(e.walletId||``).trim());if(String(e.intendedUserName||``).trim()!==String(t))throw Error(`WebAuthn registration user.name must match walletId`);return{walletId:t}}var V=class{rpIdOverride;abortController;removePageAbortHandlers;removeExternalAbortListener;constructor(e){this.rpIdOverride=e}getRpId(){try{return L(this.rpIdOverride,window?.location?.hostname)}catch{return this.rpIdOverride||``}}getAuthenticationCredentialsSerializedForChallengeB64u(e){let t=`webauthn-get-${i(12,`WebAuthn get request IDs`)}`;return f.runImmediate({owner:{kind:`wallet_request`,requestId:t,operation:`authentication`},operation:this.executeAuthenticationCredential.bind(this,e)})}async executeAuthenticationCredential({subjectId:e,challengeB64u:t,allowCredentials:r=[],includeSecondPrfOutput:i=!1,cancellation:a={kind:`none`}}){this.abortController=new AbortController,this.removePageAbortHandlers=q(this.abortController),this.removeExternalAbortListener=H(this.abortController,a);let o=this.getRpId(),u={challenge:R(t),rpId:o,userVerification:`preferred`,timeout:6e4,extensions:{prf:{eval:{first:l(),second:s()}}}};r.length>0&&(u.allowCredentials=r.map(e=>({id:n(e.id),type:`public-key`,transports:e.transports})));try{let e=c({credential:await w(`get`,u,{abortSignal:this.abortController.signal}),firstPrfOutput:!0,secondPrfOutput:i});return G(e,t),e}finally{this.removePageAbortHandlers?.(),this.removePageAbortHandlers=void 0,this.removeExternalAbortListener?.(),this.removeExternalAbortListener=void 0,this.abortController=void 0}}generateRegistrationCredentialsInternal(e){switch(e.prompt.kind){case`reserved`:return f.runReserved({reservation:e.prompt.reservation,owner:e.prompt.owner,operation:this.executeRegistrationCredential.bind(this,e)});case`immediate`:return f.runImmediate({owner:{kind:`wallet_request`,requestId:e.prompt.requestId,operation:`registration`},operation:this.executeRegistrationCredential.bind(this,e)})}}async executeRegistrationCredential(e){this.abortController=new AbortController,this.removePageAbortHandlers=q(this.abortController),this.removeExternalAbortListener=H(this.abortController,e.prompt.cancellation);let t=this.getRpId(),r=B({walletId:e.walletId,intendedUserName:e.intendedUserName}),i=e.kind===`wallet_recovery`?e.recoveryRegistration:null,a=e.kind===`wallet_add_auth_method`?e.registration:null,o=i??a,c=o?.rpId??t;if(o&&c!==t)throw Error(`Wallet recovery RP ID does not match the wallet origin`);let u=o?{challenge:R(o.challengeB64u),rp:{name:`Seams Wallet`,id:c},user:{id:n(o.user.idB64u),name:o.user.name,displayName:o.user.displayName},pubKeyCredParams:o.pubKeyCredParams.map(e=>({...e})),authenticatorSelection:{...o.authenticatorSelection},timeout:o.timeoutMs,attestation:o.attestation,extensions:{prf:{eval:{first:n(o.extensions.prf.eval.firstB64u),second:n(o.extensions.prf.eval.secondB64u)}}},excludeCredentials:o.excludeCredentials.map(e=>({type:e.type,id:n(e.id)}))}:{challenge:R(z(e)),rp:{name:`WebAuthn Passkey`,id:c},user:{id:new TextEncoder().encode(K(e.walletId,e.signerSlot)),name:r.walletId,displayName:r.walletId},pubKeyCredParams:[{alg:-7,type:`public-key`},{alg:-257,type:`public-key`}],authenticatorSelection:{residentKey:`required`,userVerification:`preferred`},timeout:6e4,attestation:`none`,extensions:{prf:{eval:{first:l(),second:s()}}}};try{return await w(`create`,u,{abortSignal:this.abortController.signal})}finally{this.removePageAbortHandlers?.(),this.removePageAbortHandlers=void 0,this.removeExternalAbortListener?.(),this.removeExternalAbortListener=void 0,this.abortController=void 0}}};function H(e,t){if(t.kind===`none`)return;let n=t.signal,r=e.abort.bind(e);if(n.aborted){r();return}return n.addEventListener(`abort`,r,{once:!0}),n.removeEventListener.bind(n,`abort`,r)}function U(e){return String(e||``).trim().replace(/=+$/g,``)}function W(e){let t=String(e.response?.clientDataJSON||``).trim();if(!t)throw Error(`WebAuthn authentication response missing clientDataJSON`);let r=``;try{r=new TextDecoder().decode(n(t))}catch(e){throw Error(`WebAuthn authentication response has invalid clientDataJSON encoding: ${e instanceof Error?e.message:String(e)}`)}let i;try{i=JSON.parse(r)}catch(e){throw Error(`WebAuthn authentication response has invalid clientDataJSON JSON: ${e instanceof Error?e.message:String(e)}`)}let a=i&&typeof i==`object`?i.challenge:void 0;if(typeof a!=`string`||!a.trim())throw Error(`WebAuthn authentication response clientDataJSON missing challenge`);return a}function G(e,t){let n=U(W(e)),r=U(t);if(n!==r)throw Error(`Unexpected authentication response challenge "${n}", expected "${r}"`)}function K(e,t){return t===void 0||t===1?e:`${e} (${t})`}function q(e){let t=()=>{document.hidden&&e.abort()},n=()=>{e.abort()},r=()=>{e.abort()};return document.addEventListener(`visibilitychange`,t,{passive:!0}),window.addEventListener(`pagehide`,n,{passive:!0}),window.addEventListener(`beforeunload`,r,{passive:!0}),()=>{document.removeEventListener(`visibilitychange`,t),window.removeEventListener(`pagehide`,n),window.removeEventListener(`beforeunload`,r)}}async function J(e){let t=e.request.payload.walletId,n=window.location.origin,r=await d({walletId:t,operation:e.request.operation,payload:e.request.payload,requestOrigin:n}),i=await p({credentialStore:o,touchIdPrompt:new V(e.rpId),walletId:t,challengeB64u:r,includeSecondPrfOutput:!1}),a=ee(i);if(!a)throw Error(`Wallet recovery proof did not receive a passkey credential`);return{kind:`passkey`,walletId:t,rpId:e.rpId,credentialIdB64u:a,challenge_digest:r,webauthn_authentication:u(i)}}function Y(){return r(`wallet-recovery-admin`,16,`wallet recovery administration request IDs`)}async function X(e){let t=Y(),n={walletId:e.walletId,requestId:t},r=await J({rpId:e.rpId,request:{operation:`recovery_status`,payload:n}});return await _({relayUrl:e.relayUrl,walletId:e.walletId,requestId:t,factorProof:r})}async function Z(e){let t=Y(),n={walletId:e.walletId,requestId:t,expectedIssuedAtMs:e.expectedIssuedAtMs},r=await J({rpId:e.rpId,request:{operation:`recovery_backup_acknowledge`,payload:n}});return await y({relayUrl:e.relayUrl,walletId:e.walletId,requestId:t,expectedIssuedAtMs:e.expectedIssuedAtMs,factorProof:r})}async function Q(e){let t=await o.resolveSelectedWalletAuthority(e);if(t.kind!==`resolved`||t.selection.lockState!==`unlocked`||String(t.selection.walletId)!==e||t.selection.walletAuthMethodId!==t.authMethod.walletAuthMethodId||t.authMethod.kind!==`email_otp`||t.authMethod.status!==`active`||t.authority.state!==`active`||String(t.authMethod.walletId)!==e||String(t.authority.walletId)!==e)throw Error(`Unlock this wallet with its active Email OTP method`);let n=await o.listWalletAuthMethodsForWallet(e),r=null;for(let e of n)if(!(e.kind!==`email_otp`||e.status!==`active`||e.localStatus!==`synced`||String(e.authority.bindingId)!==String(t.authMethod.walletAuthMethodId))){if(r!==null)throw Error(`The selected Email OTP owner method is duplicated`);r=String(e.authority.factor.providerUserId||``).trim()}if(!r)throw Error(`The selected Email OTP owner method is unavailable on this wallet`);return{walletAuthMethodId:String(t.authMethod.walletAuthMethodId),providerSubjectId:r}}async function $(e){let t=e.request.payload.walletId,{providerSubjectId:n}=await Q(t),r=window.location.origin,i=await d({walletId:t,operation:e.request.operation,payload:e.request.payload,requestOrigin:r}),a=await h({relayUrl:e.relayUrl,walletId:t,providerSubjectId:n,operation:e.request.operation,payload:e.request.payload,requestOrigin:r});if(a.kind!==`ready`)throw Error(a.message);if(a.challenge_digest!==i)throw Error(`Recovery Email OTP challenge does not match this operation`);let o=await e.context.signingEngine.requestEmailOtpOwnerConfirmation({purpose:e.request.operation,walletId:t,emailAddress:`your email`,challengeId:a.challengeId});if(o.challengeId!==a.challengeId)throw Error(`Recovery Email OTP confirmation changed its challenge`);return{kind:`email_otp`,provider_subject_id:n,challenge_id:o.challengeId,otp_code:o.otpCode,challenge_digest:i}}async function te(e){let t=Y(),n={walletId:e.walletId,requestId:t},r=await $({context:e.context,relayUrl:e.relayUrl,request:{operation:`recovery_status`,payload:n}});return await _({relayUrl:e.relayUrl,walletId:e.walletId,requestId:t,factorProof:r})}async function ne(e){let t=Y(),n={walletId:e.walletId,requestId:t,expectedIssuedAtMs:e.expectedIssuedAtMs},r=await $({context:e.context,relayUrl:e.relayUrl,request:{operation:`recovery_backup_acknowledge`,payload:n}});return await y({relayUrl:e.relayUrl,walletId:e.walletId,requestId:t,expectedIssuedAtMs:e.expectedIssuedAtMs,factorProof:r})}export{X as a,_ as c,te as i,h as l,Z as n,Q as o,$ as r,V as s,ne as t,x as u};

package/dist/public/wallet-assets.manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "packageName": "@seams/wallet",
-  "packageVersion": "0.21.0",
+  "packageVersion": "0.22.0",
   "assetRoot": "dist/public",
   "sdkBasePath": "/sdk",
   "walletServicePath": "/wallet-service",
@@ -9,7 +9,7 @@
   "headersManifest": "headers.manifest.json",
   "versionSkewContract": {
     "kind": "wallet_iframe_protocol_handshake",
-    "packageVersion": "0.21.0",
+    "packageVersion": "0.22.0",
     "protocolVersion": "16.0.0",
     "readyPayloadField": "protocolVersion",
     "failureMode": "typed_error",
@@ -107,8 +107,8 @@
       ]
     },
     {
-      "route": "/sdk/adapters-La60hveX.js",
-      "sourceFile": "sdk/adapters-La60hveX.js",
+      "route": "/sdk/adapters-CgJpSAxH.js",
+      "sourceFile": "sdk/adapters-CgJpSAxH.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -131,8 +131,8 @@
       ]
     },
     {
-      "route": "/sdk/appearance-token-vars-Bu6YUWmf.js",
-      "sourceFile": "sdk/appearance-token-vars-Bu6YUWmf.js",
+      "route": "/sdk/appearance-token-vars-BA3KQyEE.js",
+      "sourceFile": "sdk/appearance-token-vars-BA3KQyEE.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -563,8 +563,8 @@
       ]
     },
     {
-      "route": "/sdk/ConfirmationDrawer-B7RCp58z.js",
-      "sourceFile": "sdk/ConfirmationDrawer-B7RCp58z.js",
+      "route": "/sdk/ConfirmationDrawer-Ck33ZmU-.js",
+      "sourceFile": "sdk/ConfirmationDrawer-Ck33ZmU-.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -923,8 +923,8 @@
       ]
     },
     {
-      "route": "/sdk/export-viewer-host-CVdpEuY6.js",
-      "sourceFile": "sdk/export-viewer-host-CVdpEuY6.js",
+      "route": "/sdk/export-viewer-host-C9n-62Pi.js",
+      "sourceFile": "sdk/export-viewer-host-C9n-62Pi.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -947,8 +947,8 @@
       ]
     },
     {
-      "route": "/sdk/exportKeypairOperation-gVCqLrDl.js",
-      "sourceFile": "sdk/exportKeypairOperation-gVCqLrDl.js",
+      "route": "/sdk/exportKeypairOperation-Du9HKB8f.js",
+      "sourceFile": "sdk/exportKeypairOperation-Du9HKB8f.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -995,8 +995,8 @@
       ]
     },
     {
-      "route": "/sdk/host-Bz7mRJPZ.js",
-      "sourceFile": "sdk/host-Bz7mRJPZ.js",
+      "route": "/sdk/host-DoftJdVQ.js",
+      "sourceFile": "sdk/host-DoftJdVQ.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1139,8 +1139,8 @@
       ]
     },
     {
-      "route": "/sdk/localOnly-TXaYAZj-.js",
-      "sourceFile": "sdk/localOnly-TXaYAZj-.js",
+      "route": "/sdk/localOnly-CvFSZFUy.js",
+      "sourceFile": "sdk/localOnly-CvFSZFUy.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1163,8 +1163,8 @@
       ]
     },
     {
-      "route": "/sdk/mountExportPrivateKeySurface-DUnKOBQr.js",
-      "sourceFile": "sdk/mountExportPrivateKeySurface-DUnKOBQr.js",
+      "route": "/sdk/mountExportPrivateKeySurface-DdJHWwqY.js",
+      "sourceFile": "sdk/mountExportPrivateKeySurface-DdJHWwqY.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1187,8 +1187,8 @@
       ]
     },
     {
-      "route": "/sdk/mountRecoveryCodeBackupSurface-MGTl6FhG.js",
-      "sourceFile": "sdk/mountRecoveryCodeBackupSurface-MGTl6FhG.js",
+      "route": "/sdk/mountRecoveryCodeBackupSurface-D3QFgMGE.js",
+      "sourceFile": "sdk/mountRecoveryCodeBackupSurface-D3QFgMGE.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1379,8 +1379,8 @@
       ]
     },
     {
-      "route": "/sdk/pendingWalletRecoveryCodeBackup-DWeemdJv.js",
-      "sourceFile": "sdk/pendingWalletRecoveryCodeBackup-DWeemdJv.js",
+      "route": "/sdk/pendingWalletRecoveryCodeBackup-LbstFwcY.js",
+      "sourceFile": "sdk/pendingWalletRecoveryCodeBackup-LbstFwcY.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1571,8 +1571,8 @@
       ]
     },
     {
-      "route": "/sdk/registration-DeCUrUR9.js",
-      "sourceFile": "sdk/registration-DeCUrUR9.js",
+      "route": "/sdk/registration-CeOmKyCG.js",
+      "sourceFile": "sdk/registration-CeOmKyCG.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1595,8 +1595,8 @@
       ]
     },
     {
-      "route": "/sdk/registration-DVX_lnP7.js",
-      "sourceFile": "sdk/registration-DVX_lnP7.js",
+      "route": "/sdk/registration-CIxJvbTo.js",
+      "sourceFile": "sdk/registration-CIxJvbTo.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1787,8 +1787,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-auth-BAGyfscG.js",
-      "sourceFile": "sdk/runtime-auth-BAGyfscG.js",
+      "route": "/sdk/runtime-auth-C0V-5znH.js",
+      "sourceFile": "sdk/runtime-auth-C0V-5znH.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1811,8 +1811,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-device-link-DKkMLVor.js",
-      "sourceFile": "sdk/runtime-device-link-DKkMLVor.js",
+      "route": "/sdk/runtime-device-link-B1jpHQSF.js",
+      "sourceFile": "sdk/runtime-device-link-B1jpHQSF.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1835,8 +1835,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-ecdsa-tempo-0TAVH1xg.js",
-      "sourceFile": "sdk/runtime-ecdsa-tempo-0TAVH1xg.js",
+      "route": "/sdk/runtime-ecdsa-tempo-CDSZ3pxS.js",
+      "sourceFile": "sdk/runtime-ecdsa-tempo-CDSZ3pxS.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1859,8 +1859,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-email-otp-DoHa8Hif.js",
-      "sourceFile": "sdk/runtime-email-otp-DoHa8Hif.js",
+      "route": "/sdk/runtime-email-otp-DXuxFOjL.js",
+      "sourceFile": "sdk/runtime-email-otp-DXuxFOjL.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1883,8 +1883,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-export-CAt17IFH.js",
-      "sourceFile": "sdk/runtime-export-CAt17IFH.js",
+      "route": "/sdk/runtime-export-Ba12ChDI.js",
+      "sourceFile": "sdk/runtime-export-Ba12ChDI.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1907,8 +1907,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-near-BQX9Jk9Z.js",
-      "sourceFile": "sdk/runtime-near-BQX9Jk9Z.js",
+      "route": "/sdk/runtime-near-DRrdWzmr.js",
+      "sourceFile": "sdk/runtime-near-DRrdWzmr.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1931,8 +1931,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-preferences-BuKTIpv6.js",
-      "sourceFile": "sdk/runtime-preferences-BuKTIpv6.js",
+      "route": "/sdk/runtime-preferences-BWyhRaBA.js",
+      "sourceFile": "sdk/runtime-preferences-BWyhRaBA.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1955,8 +1955,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-recovery-codes-CWmt0FDB.js",
-      "sourceFile": "sdk/runtime-recovery-codes-CWmt0FDB.js",
+      "route": "/sdk/runtime-recovery-codes-CuqYWqK7.js",
+      "sourceFile": "sdk/runtime-recovery-codes-CuqYWqK7.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1979,8 +1979,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-recovery-DyxJKKNw.js",
-      "sourceFile": "sdk/runtime-recovery-DyxJKKNw.js",
+      "route": "/sdk/runtime-recovery-DlJlaZlf.js",
+      "sourceFile": "sdk/runtime-recovery-DlJlaZlf.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2099,8 +2099,8 @@
       ]
     },
     {
-      "route": "/sdk/shared-BVps1f3F.js",
-      "sourceFile": "sdk/shared-BVps1f3F.js",
+      "route": "/sdk/shared-B95wnpoD.js",
+      "sourceFile": "sdk/shared-B95wnpoD.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2483,8 +2483,8 @@
       ]
     },
     {
-      "route": "/sdk/transaction-activity-D5f-Yn9t.js",
-      "sourceFile": "sdk/transaction-activity-D5f-Yn9t.js",
+      "route": "/sdk/transaction-activity-CpDMkSPm.js",
+      "sourceFile": "sdk/transaction-activity-CpDMkSPm.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2987,8 +2987,8 @@
       ]
     },
     {
-      "route": "/sdk/walletRecoveryAdminProof-CIoLawfC.js",
-      "sourceFile": "sdk/walletRecoveryAdminProof-CIoLawfC.js",
+      "route": "/sdk/walletRecoveryAdminProof-CtH8_lph.js",
+      "sourceFile": "sdk/walletRecoveryAdminProof-CtH8_lph.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",

package/dist/public/wallet-service/index.html

@@ -5,14 +5,14 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Web3Authn Wallet Service</title>
     <!-- Surface styles are external so strict CSP can keep style-src 'self' -->
-    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.21.0" />
+    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.22.0" />
     <!-- Minimal shims some ESM bundles expect (externalized to enable strict CSP) -->
-    <script src="/sdk/wallet-shims.js?v=0.21.0"></script>
+    <script src="/sdk/wallet-shims.js?v=0.22.0"></script>
     <!-- Hint the browser to fetch the host script earlier -->
-    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.21.0" crossorigin>
+    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.22.0" crossorigin>
   </head>
   <body>
     <!-- sdkBasePath points to the SDK root (e.g. '/sdk'). Load the host directly. -->
-    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.21.0"></script>
+    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.22.0"></script>
   </body>
 </html>

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/auth-menu/controller.d.ts

@@ -14,7 +14,9 @@ export declare class AuthMenuController {
         request: HostedAuthMenuOpenRequest;
         requestId: string | undefined;
     }): Promise<import('../../shared/messages').HostedAuthMenuOutcome>;
+    private readLoginAccounts;
     private bootstrapLoginAccounts;
+    private applyLoginAccounts;
     private prepareLogin;
     private prepareRecoveredLogin;
     private beginGoogleEmailOtp;

package/dist/types/wallet/src/core/signingEngine/uiConfirm/ui/transaction-activity.d.ts

@@ -1,5 +1,5 @@
 import type { ChildToParentEnvelope, ParentToChildEnvelope } from '../../../../SeamsWeb/walletIframe/shared/messages';
-import type { TransactionReceiptModel, TransactionReceiptState, TransactionReceiptView } from './transaction-receipt';
+import type { ReceiptProgress, TransactionReceiptModel, TransactionReceiptView } from './transaction-receipt';
 type ReceiptSurface = {
     readonly element: HTMLElement;
     showReceipt(model: TransactionReceiptModel): void;
@@ -9,7 +9,7 @@ type Activity = {
     requestId: string;
     post: (message: ChildToParentEnvelope) => void;
     surface: ReceiptSurface | null;
-    state: TransactionReceiptState;
+    progress: ReceiptProgress;
     view: TransactionReceiptView;
     retained: boolean;
     signingHash: string | null;

package/dist/types/wallet/src/core/signingEngine/uiConfirm/ui/transaction-receipt.d.ts

@@ -19,15 +19,34 @@ export type TransactionReceiptState = {
     hash: string | null;
     message: string;
 };
+export type MessageReceiptState = {
+    kind: 'signing';
+    message?: never;
+} | {
+    kind: 'signed';
+    message?: never;
+} | {
+    kind: 'failed';
+    message: string;
+};
+export type ReceiptProgress = {
+    readonly subject: 'transaction';
+    readonly state: TransactionReceiptState;
+} | {
+    readonly subject: 'message';
+    readonly state: MessageReceiptState;
+};
 export type TransactionReceiptView = 'expanded' | 'toast';
-export type TransactionReceiptModel = {
-    state: TransactionReceiptState;
+export type TransactionReceiptModel = ReceiptProgress & {
     view: TransactionReceiptView;
     onView: (view: TransactionReceiptView) => void;
     onDismiss: () => void;
 };
-export declare function receiptIsPending(state: TransactionReceiptState): boolean;
-export declare function receiptCompletedStages(state: TransactionReceiptState): 0 | 1 | 2 | 3;
-export declare function receiptHeading(state: TransactionReceiptState): string;
-export declare function receiptDescription(state: TransactionReceiptState): string;
+export declare function receiptIsPending(receipt: ReceiptProgress): boolean;
+export declare function receiptIsComplete(receipt: ReceiptProgress): boolean;
+/** A message signature has one stage, so its toast fills at once when signed. */
+export declare function receiptCompletedStages(receipt: ReceiptProgress): 0 | 1 | 2 | 3;
+export declare function receiptTitle(receipt: ReceiptProgress): string;
+export declare function receiptHeading(receipt: ReceiptProgress): string;
+export declare function receiptDescription(receipt: ReceiptProgress): string;
 //# sourceMappingURL=transaction-receipt.d.ts.map