@seams/wallet 0.23.0 → 0.24.0

package/dist/esm/sdk/types-DdzuHlAQ.js

@@ -0,0 +1 @@
+import{C as e,S as t,s as n}from"./domainIds-t1lp25yU.js";import{d as r,h as i}from"./capabilityKinds-BzrNeEyO.js";import{n as a}from"./signerDomain-D-EUTlLK.js";function o(e){switch(e.kind){case a.passkey:return a.passkey;case a.emailOtp:return a.emailOtp;case`voiceid`:return`voiceid`}throw Error(`[SigningSession] unsupported signing lane auth binding`)}function s(e,t){let n=String(e||``).trim();if(!n)throw Error(`[SigningSession] ${t} is required for signing lane authority`);return n}function c(e){switch(e.kind){case`voiceid`:return[`voiceid`,e.walletAuthMethodId,e.deviceKeyId].join(`:`);case a.passkey:return[a.passkey,s(String(e.rpId),`passkey rpId`),s(e.credentialIdB64u,`passkey credential`)].join(`:`);case a.emailOtp:return[a.emailOtp,s(e.providerSubjectId,`Email OTP provider subject`)].join(`:`)}throw Error(`[SigningSession] unsupported signing lane auth binding`)}const l={TransactionSign:`transaction_sign`},u={Cached:`cached`,Reauth:`reauth`},d={WarmSession:`warm_session`,EmailOtpReauth:`email_otp_reauth`,PasskeyReauth:`passkey_reauth`,NotReady:`not_ready`,OperationStepUp:`operation_step_up`};function f(e,t){let n=String(e||``).trim();if(!n)throw Error(`[SigningSession] ${t} is required`);return n}function p(e,t){if(!e.ok)throw Error(`[SigningSession] ${e.error.message||`${t} is required`}`);return e.value}function m(e,t){if(!e.ok)throw Error(`[SigningSession] ${e.error.message||`${t} is required`}`);return e.value}const h={walletSession(e){return m(i(e),`walletSessionId`)},walletSessionQuota(e){return m(r(e),`quotaId`)},thresholdEd25519Session(t){return p(e(t),`thresholdEd25519SessionId`)},thresholdEcdsaSession(e){return p(t(e),`thresholdEcdsaSessionId`)},emailOtpChallenge(e){return p(n(e),`emailOtpChallengeId`)},signingOperation(e){return f(e,`signingOperationId`)},signingOperationFingerprint(e){return f(e,`signingOperationFingerprint`)}};function g(e){let t=e.identity.signer,n={authMethod:o(e.auth),curve:e.curve,keyKind:e.keyKind,chainFamily:e.chainFamily,sessionOrigin:e.sessionOrigin,storageSource:e.storageSource,retention:e.retention};switch(t.kind){case`evm_family_ecdsa_signer`:return{...n,curve:`ecdsa`,walletId:t.walletId};case`near_ed25519_signer`:return{...n,curve:`ed25519`,walletId:t.account.wallet.walletId,nearAccountId:t.account.nearAccountId,nearEd25519SigningKeyId:t.nearEd25519SigningKeyId}}}function _(e){return{kind:e.kind,lane:g(e.lane)}}export{g as a,o as c,d as i,l as n,_ as o,h as r,c as s,u as t};

package/dist/esm/sdk/unlockedEd25519ExportRootCapability-D43rvO9a.js

@@ -0,0 +1 @@
+import{C as e,E as t,a as n,k as r}from"./domainIds-t1lp25yU.js";import{C as i,j as a,k as o}from"./chains-gV2K9gA4.js";import{N as s,X as c}from"./activeWalletSession-H9JBdHyQ.js";import{h as l}from"./capabilityKinds-BzrNeEyO.js";import{P as u,k as d}from"./registrationIntent-DTs2SR9E.js";import{t as f}from"./accountIds-D5NI31F2.js";import{ot as p,rt as m}from"./walletCapabilityBindings-CUPk3mVH.js";import{dn as h}from"./emailOtpEcdsaDerivationIdentity-CIh9IPai.js";function g(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<1)throw Error(`${t} must be a positive integer`);return e}function _(t,n){let r=e(t);if(!r.ok)throw Error(`${n} is invalid`);return r.value}function v(e,t){if(!Array.isArray(e)||e.length!==32)throw Error(`${t} must contain exactly 32 bytes`);let n=[];for(let r of e){if(typeof r!=`number`||!Number.isInteger(r)||r<0||r>255)throw Error(`${t} must contain exactly 32 bytes`);n.push(r)}return Object.freeze(n)}function y(e,t){if(!Array.isArray(e)||e.length===0)throw Error(`${t} must contain bytes`);return e.map(e=>{if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`${t} must contain bytes`);return e})}function b(e){if(!Array.isArray(e)||e.length!==2||!Number.isSafeInteger(e[0])||!Number.isSafeInteger(e[1])||e[0]<1||e[1]<1||e[0]===e[1])throw Error(`participantIds must contain two distinct positive integers`);return[Number(e[0]),Number(e[1])]}function x(e){let t=o(e,`capability.registrationContinuity`);if(t.kind===`recovery`)return{kind:`recovery`,activationTranscript:y(t.activationTranscript,`capability.registrationContinuity.activationTranscript`)};if(t.kind!==`registration`)throw Error(`capability.registrationContinuity kind is invalid`);let n=p(t.admissionRequest),r=m(t.admissionReceipt);if(!n.ok)throw Error(`capability registration continuity transcript is invalid: ${n.message}`);if(!r.ok)throw Error(`capability registration continuity transcript is invalid: ${r.message}`);return{kind:`registration`,admissionRequest:n.value,admissionReceipt:r.value,activationTranscript:y(t.activationTranscript,`capability.registrationContinuity.activationTranscript`)}}function S(e){let t=o(e,`capability`);if(t.kind!==`router_ab_ed25519_yao_active_capability_v1`)throw Error(`Yao recovery capability kind is invalid`);let n=o(t.applicationBinding,`capability.applicationBinding`),r=o(t.lifecycle,`capability.lifecycle`),i;try{i=h(t.materialActivation)}catch(e){throw Error(`capability.materialActivation is invalid: ${e instanceof Error?e.message:String(e)}`)}return{materialActivation:i,activeCapabilityBinding:v(t.activeCapabilityBinding,`capability.activeCapabilityBinding`),registeredPublicKey:v(t.registeredPublicKey,`capability.registeredPublicKey`),nearAccountId:f(a(t.nearAccountId,`capability.nearAccountId`)),applicationBinding:{wallet_id:a(n.wallet_id,`applicationBinding.wallet_id`),near_ed25519_signing_key_id:a(n.near_ed25519_signing_key_id,`applicationBinding.near_ed25519_signing_key_id`),signing_root_id:a(n.signing_root_id,`applicationBinding.signing_root_id`),key_creation_signer_slot:g(n.key_creation_signer_slot,`applicationBinding.key_creation_signer_slot`)},participantIds:b(t.participantIds),runtimePolicyScope:c(o(t.runtimePolicyScope,`capability.runtimePolicyScope`)),lifecycle:{lifecycleId:a(r.lifecycleId,`lifecycle.lifecycleId`),rootShareEpoch:a(r.rootShareEpoch,`lifecycle.rootShareEpoch`),accountId:a(r.accountId,`lifecycle.accountId`),thresholdSessionId:_(a(r.thresholdSessionId,`lifecycle.thresholdSessionId`),`lifecycle.thresholdSessionId`),signerSetId:a(r.signerSetId,`lifecycle.signerSetId`),signingWorkerId:a(r.signingWorkerId,`lifecycle.signingWorkerId`)},stateEpoch:g(t.stateEpoch,`capability.stateEpoch`),registrationContinuity:x(t.registrationContinuity)}}function C(e,t){return e.requestWorkerOperation(t)}function w(e,t,n){return e.requestOperation({kind:`walletCustodyCeremony`,request:{type:t,payload:n}})}function T(e){return w.bind(void 0,e)}let E=null,D=null,O=null,k=null;function A(e){k=e}function j(e){let t=k;if(!t||e.kind!==`unlocked_wallet_ed25519_export_root_capability_v1`)return;let n=e.upgradedEnvelope;if(n!==void 0)try{t({walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,walletSessionId:e.walletSessionId,envelope:n})}catch(e){console.warn(`[walletCustody] the upgraded custody envelope was not forwarded:`,e instanceof Error?e.message:String(e||`unknown error`))}}function M(e){return{requestOperation:C.bind(void 0,e)}}function N(){O!==null&&(clearTimeout(O),O=null)}function P(){N(),E=null,D=null}function F(e,t){N();let n=Math.max(0,e.expiresAtMs-Date.now());O=setTimeout(()=>{if(O=null,!(E!==e||D!==t)){if(e.expiresAtMs>Date.now()){F(e,t);return}H(t,{kind:`capability`,capabilityHandleId:e.capabilityHandleId})}},Math.min(n,2147483647))}function I(e){if(!i(e))return null;if(e.kind===`unlocked_linked_device_ed25519_client_root_capability_v1`)return L(e);let a=Object.keys(e),o=a.includes(`upgradedEnvelope`),c=o?[`kind`,`capabilityHandleId`,`walletId`,`walletAuthMethodId`,`walletSessionId`,`expiresAtMs`,`upgradedEnvelope`]:[`kind`,`capabilityHandleId`,`walletId`,`walletAuthMethodId`,`walletSessionId`,`expiresAtMs`];if(a.length!==c.length||a.some(e=>!c.includes(e))||e.kind!==`unlocked_wallet_ed25519_export_root_capability_v1`)return null;let u=n(e.capabilityHandleId),f=r(e.walletId),p=t(e.walletAuthMethodId),m=l(e.walletSessionId);if(!u.ok||!f.ok||!p.ok||!m.ok)return null;let h;try{h=s(e.expiresAtMs,`unlocked Ed25519 export-root capability expiry`)}catch{return null}let g;if(o)try{g=d(e.upgradedEnvelope)}catch{}return{kind:`unlocked_wallet_ed25519_export_root_capability_v1`,capabilityHandleId:u.value,walletId:f.value,walletAuthMethodId:p.value,walletSessionId:m.value,expiresAtMs:h,...g?{upgradedEnvelope:g}:{}}}function L(e){let i=[`kind`,`capabilityHandleId`,`walletId`,`walletAuthMethodId`,`walletSessionId`,`expiresAtMs`],a=Object.keys(e);if(a.length!==i.length||a.some(e=>!i.includes(e)))return null;let o=n(e.capabilityHandleId),c=r(e.walletId),u=t(e.walletAuthMethodId),d=l(e.walletSessionId);if(!o.ok||!c.ok||!u.ok||!d.ok)return null;let f;try{f=s(e.expiresAtMs,`unlocked Ed25519 Client-root capability expiry`)}catch{return null}return{kind:`unlocked_linked_device_ed25519_client_root_capability_v1`,capabilityHandleId:o.value,walletId:c.value,walletAuthMethodId:u.value,walletSessionId:d.value,expiresAtMs:f}}async function R(e,t){let n=t.existingEnvelope.binding;if(!u(n)&&n.kind!==`ed25519_yao_client_root_v1`)return;let r=t.existingFactorSecret.slice(),i;try{i=await e.requestOperation({kind:`walletCustodyCeremony`,request:{type:`establishUnlockedWalletEd25519ExportRootCapability`,payload:{existingEnvelope:t.existingEnvelope,existingFactorSecret:r.buffer,walletId:t.walletId,walletAuthMethodId:t.walletAuthMethodId,walletSessionId:t.walletSessionId,expiresAtMs:t.expiresAtMs},transfer:[r.buffer]}})}finally{r.byteLength>0&&r.fill(0)}let a=I(i);if(a===null)throw Error(`unlocked Ed25519 export-root capability worker returned no reference`);return N(),E=a,D=e,F(a,e),j(a),a}function z(e){let t=B(e);return t?.kind===`unlocked_wallet_ed25519_export_root_capability_v1`?t:void 0}function B(e){let t=E;if(t&&t.walletId===e){if(t.expiresAtMs<=Date.now()){let e=D;e?H(e,{kind:`capability`,capabilityHandleId:t.capabilityHandleId}):P();return}return t}}function V(){P()}async function H(e,t){let n=E;n!==null&&(t.kind===`all`||t.kind===`capability`&&t.capabilityHandleId===n.capabilityHandleId||t.kind===`wallet`&&t.walletId===n.walletId||t.kind===`wallet_session`&&t.walletSessionId===n.walletSessionId)&&P();try{await e.requestOperation({kind:`walletCustodyCeremony`,request:{type:`destroyUnlockedWalletEd25519ExportRootCapabilities`,payload:{scope:t}}})}catch{}}export{z as a,C as c,B as i,T as l,V as n,A as o,R as r,M as s,H as t,S as u};

package/dist/esm/sdk/voiceid-host.js

@@ -0,0 +1 @@
+import{E as e,P as t,i as n,k as r,t as i,y as a}from"./domainIds-t1lp25yU.js";import{C as o,a as s,b as c,c as l,k as u}from"./chains-gV2K9gA4.js";import{A as d,F as f,J as p,L as m,V as h,ct as g,i as _,it as v,n as y,ot as b,st as x}from"./activeWalletSession-H9JBdHyQ.js";import{i as S,r as C}from"./base64-BmKR3UqU.js";import{r as w}from"./secureRandomId-8LSc91aN.js";import"./walletDbName-DDJXrgA5.js";import"./signingSessionSeal-DqbjG8c8.js";import{r as T}from"./configuration-CAqANpTI.js";import{i as E,t as D}from"./transactionReview-DSGnpreN.js";import"./capabilityKinds-BzrNeEyO.js";import{a as O,r as k}from"./canonicalPrimitives-B6YMrI3W.js";import{o as A}from"./errors-ADOZT8oV.js";import{r as j,v as M}from"./icons-DyndJzSh.js";import{t as N}from"./surface-measurement-reporter-NUm_54LH.js";import{n as P,t as F}from"./csp-stylesheet-DeuiM0Mo.js";import"./signerDomain-D-EUTlLK.js";import{C as I,E as L,N as R,O as z,S as B,T as V,Y as H,k as U}from"./registrationIntent-DTs2SR9E.js";import{a as W}from"./presignatures-B9GrGx0L.js";import"./accountIds-D5NI31F2.js";import"./walletCapabilityBindings-CUPk3mVH.js";import"./emailOtpEcdsaDerivationIdentity-CIh9IPai.js";import{a as G,c as K,o as q,r as J,s as Y}from"./walletAuthMethodRecord-yIqCeE-o.js";import"./signerSlot-D4ZOuK7e.js";import{a as X,o as Z,s as Q,t as $}from"./indexedDB-C1odKEC6.js";import"./keccak-C9kCkZem.js";import"./registrationSignerPlan-CgbFVsAp.js";import{o as ee}from"./walletSessionAuthorizationStore-zkxcMdSp.js";import{a as te,i as ne,n as re,t as ie,u as ae}from"./resealedEnvelopeResult--iCVt_Bh.js";import{n as oe}from"./walletSessionAuthorizationStatus-98G3Qji8.js";import{i as se,n as ce}from"./evmCryptoWasm-DacbCVNM.js";import{a as le,s as ue,u as de}from"./unlockedEd25519ExportRootCapability-D43rvO9a.js";import{t as fe}from"./SeamsWordmark-CFpsGoLw.js";import{t as pe}from"./actions-GYsSR2Q2.js";var me=class{promise;resolveValue=null;rejectValue=null;constructor(){this.promise=new Promise(this.capture)}resolve(e){if(!this.resolveValue)throw Error(`Worker deferred resolver is unavailable`);this.resolveValue(e)}reject(e){if(!this.rejectValue)throw Error(`Worker deferred rejecter is unavailable`);this.rejectValue(e)}capture=(e,t)=>{this.resolveValue=e,this.rejectValue=t}};const he=1;export{pe as ActionType,$ as IndexedDBManager,W as SEAMS_WALLET_STORES,fe as SeamsWordmark,D as TransactionReviewError,he as VOICE_ID_HOST_API_VERSION,me as WorkerDeferred,i as allocateWalletAuthMethodId,l as alphabetizeStringify,M as authMenuSuccessCopy,re as availabilityKey,j as backIcon,C as base64UrlDecode,S as base64UrlEncode,f as buildDelegatedWalletAuthorityV1,m as buildFullOwnerPermissionsV1,B as buildMethodBoundEnvelopeOwnership,I as buildPasskeyCustodyEnvelopeRecord,v as buildRelayerJsonPostRequestInit,V as buildVoiceIdEnvelopeFactor,R as buildWalletCustodySeedBinding,b as buildWalletSessionAuthorizationHeaders,ce as buildWebauthnP256SignatureWasm,F as createCspStylesheetManager,oe as createRelayerExactWalletSessionStatusPort,N as createWalletIframeSurfaceMeasurementReporter,L as custodyEnvelopeBindingJsonV1,se as decodeCoseP256PublicKeyWasm,x as fetchWithWalletHomeDiscovery,P as getDefaultCspNonce,c as isFiniteNumber,o as isPlainObject,z as isVoiceIdSeedEnvelope,t as joinNormalizedUrl,n as mpcMaterialActivationRefsEqual,g as normalizeRelayerBaseUrl,y as parseActiveWalletSessionV1,k as parseDigestB64u,de as parseEd25519YaoRecoveryCapabilityV1,d as parseEnvelopeRevision,H as parseLinkedDeviceListResultV1,U as parsePasskeyCustodyEnvelopeRecord,a as parsePasskeyEnvelopeId,ie as parseResealedEnvelopeResult,ne as parseStoredAuthMethodAvailability,E as parseTransactionReviewWire,G as parseVoiceIdDeviceAssertion,q as parseVoiceIdDevicePublicKeyB64u,Y as parseVoiceIdWalletSessionChallenge,e as parseWalletAuthMethodId,J as parseWalletAuthMethodRecordV2,X as parseWalletAuthMethodV2StorageRow,Z as parseWalletAuthorityStorageRow,r as parseWalletId,Q as parseWalletSelectionStorageRow,_ as parseWalletSessionOperationCredentialV1,te as readAuthMethodEnabled,le as readUnlockedWalletEd25519ExportRootCapabilityV1,p as rejectUnknownFields,u as requireRecord,s as resolveNearNetwork,h as sameDelegatedWalletAuthorityV1,w as secureRandomId,O as sha256DigestB64u,A as toError,K as voiceIdWalletSessionChallengeBytes,ue as walletCustodyCeremonyTransportFromWorkerContextV1,ae as walletForHostRequest,T as walletHostExecutionFingerprint,ee as walletSessionAuthorizations};

package/dist/esm/sdk/wallet-iframe-host-ecdsa.js

@@ -1 +1 @@
-import"./activeWalletSession-BtEHhe99.js";import"./walletDbName-BVZhb4xF.js";import"./signingSessionSeal-DqbjG8c8.js";import{t as e}from"./host-C5KYWEcs.js";import"./capabilityKinds-CqHVzVsJ.js";import"./errors-CI1xdN0d.js";e({supportedRuntimeRouteKinds:new Set([`auth`,`ecdsa`,`email_otp`,`export`,`recovery`,`preferences`])});
+import"./activeWalletSession-H9JBdHyQ.js";import"./walletDbName-DDJXrgA5.js";import"./signingSessionSeal-DqbjG8c8.js";import{t as e}from"./host-C0Is56lU.js";import"./capabilityKinds-BzrNeEyO.js";import"./errors-ADOZT8oV.js";e({supportedRuntimeRouteKinds:new Set([`auth`,`ecdsa`,`email_otp`,`export`,`recovery`,`preferences`])});

package/dist/esm/sdk/wallet-iframe-host-full.js

@@ -1 +1 @@
-import"./activeWalletSession-BtEHhe99.js";import"./walletDbName-BVZhb4xF.js";import"./signingSessionSeal-DqbjG8c8.js";import{t as e}from"./host-C5KYWEcs.js";import"./capabilityKinds-CqHVzVsJ.js";import"./errors-CI1xdN0d.js";e();
+import"./activeWalletSession-H9JBdHyQ.js";import"./walletDbName-DDJXrgA5.js";import"./signingSessionSeal-DqbjG8c8.js";import{t as e}from"./host-C0Is56lU.js";import"./capabilityKinds-BzrNeEyO.js";import"./errors-ADOZT8oV.js";e();

package/dist/esm/sdk/wallet-iframe-host-near.js

@@ -1 +1 @@
-import"./activeWalletSession-BtEHhe99.js";import"./walletDbName-BVZhb4xF.js";import"./signingSessionSeal-DqbjG8c8.js";import{t as e}from"./host-C5KYWEcs.js";import"./capabilityKinds-CqHVzVsJ.js";import"./errors-CI1xdN0d.js";e({supportedRuntimeRouteKinds:new Set([`auth`,`near`,`export`,`device_link`,`recovery`,`preferences`])});
+import"./activeWalletSession-H9JBdHyQ.js";import"./walletDbName-DDJXrgA5.js";import"./signingSessionSeal-DqbjG8c8.js";import{t as e}from"./host-C0Is56lU.js";import"./capabilityKinds-BzrNeEyO.js";import"./errors-ADOZT8oV.js";e({supportedRuntimeRouteKinds:new Set([`auth`,`near`,`export`,`device_link`,`recovery`,`preferences`])});

package/dist/esm/sdk/wallet-iframe-host-runtime.js

@@ -1 +1 @@
-import"./activeWalletSession-BtEHhe99.js";import"./walletDbName-BVZhb4xF.js";import"./signingSessionSeal-DqbjG8c8.js";import{t as e}from"./host-C5KYWEcs.js";import"./capabilityKinds-CqHVzVsJ.js";import"./errors-CI1xdN0d.js";export{e as initWalletIFrame};
+import"./activeWalletSession-H9JBdHyQ.js";import"./walletDbName-DDJXrgA5.js";import"./signingSessionSeal-DqbjG8c8.js";import{t as e}from"./host-C0Is56lU.js";import"./capabilityKinds-BzrNeEyO.js";import"./errors-ADOZT8oV.js";export{e as initWalletIFrame};

package/dist/esm/sdk/wallet-recovery-BjIQdOha.js

@@ -0,0 +1 @@
+import{k as e}from"./domainIds-t1lp25yU.js";import{k as t,l as n}from"./chains-gV2K9gA4.js";import{E as r,J as i,O as a,k as o}from"./activeWalletSession-H9JBdHyQ.js";import{i as s,r as c}from"./base64-BmKR3UqU.js";import{a as l,r as u}from"./canonicalPrimitives-B6YMrI3W.js";import{M as d,j as f}from"./indexedDB-C1odKEC6.js";const p=/^wallet-rkid-v1-[A-Za-z0-9_-]{43}$/;function m(e,t=`recoveryKeyId`){if(typeof e!=`string`||!p.test(e))throw Error(`${t} must be a derived wallet recovery key id`);return e}function h(){let e=[],t=[];for(let n=0;n<10;n+=1){let n=_();t.push(n),e.push(d(f(n)))}return{codes:e,codeBytes:t}}function g(e){for(let t of e.codeBytes)t.fill(0)}function _(){let e=globalThis.crypto;if(!e?.getRandomValues)throw Error(`a secure random source is required to issue wallet recovery codes`);return e.getRandomValues(new Uint8Array(20))}function v(e,t=`recoveryCodeLocator`){try{return u(e)}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`must be a canonical digest`}`)}}async function y(e){if(!(e instanceof Uint8Array)||e.length!==20)throw Error(`recovery code bytes must be exactly 20 bytes`);let t=null;try{let r=new TextEncoder().encode(`seams/wallet-recovery/code-locator/v1`);t=new Uint8Array(8+r.length+e.length);let i=new DataView(t.buffer);return i.setUint32(0,r.length,!1),t.set(r,4),i.setUint32(4+r.length,e.length,!1),t.set(e,8+r.length),v(s(await n(t)))}finally{t?.fill(0)}}function b(e){return{custodySecretKind:`wallet_custody_seed_v1`,nonceB64u:e.nonceB64u,wrappedCustodySecretB64u:e.wrappedCustodySecretB64u,aadHashB64u:e.aadHashB64u}}function x(n,s){let c=s.label||`walletRecoverySetRotation`,l=t(n,c);i(l,w,c);let u=e(l.walletId);if(!u.ok)throw Error(`${c}.walletId ${u.error.message}`);if(String(u.value)!==String(s.expectedWalletId))throw Error(`${c}.walletId is outside the authenticated wallet`);if(!Array.isArray(l.manifestKekWraps))throw Error(`${c}.manifestKekWraps must be an array`);if(l.manifestKekWraps.length!==10)throw Error(`${c}.manifestKekWraps must carry exactly 10 recovery-code wraps`);let d=l.manifestKekWraps.map((e,n)=>{let s=t(e,`${c}.manifestKekWraps[${n}]`);return i(s,C,`${c}.manifestKekWraps[${n}]`),{recoveryKeyId:m(s.recoveryKeyId,`${c}.manifestKekWraps[${n}].recoveryKeyId`),nonceB64u:o(s.nonceB64u,`${c}.manifestKekWraps[${n}].nonceB64u`),ciphertextB64u:a(s.ciphertextB64u,`${c}.manifestKekWraps[${n}].ciphertextB64u`),aadHashB64u:r(s.aadHashB64u,`${c}.manifestKekWraps[${n}].aadHashB64u`)}}),f=new Set;for(let e of d){let t=String(e.recoveryKeyId);if(!f.add(t))throw Error(`${c} contains duplicate recovery key ids`)}if(!Array.isArray(l.entries)||l.entries.length!==1)throw Error(`${c}.entries must carry exactly one wallet custody seed entry`);let p=T(l.entries[0],`${c}.entries[0]`);return{walletId:u.value,manifestKekWraps:d,entry:p}}const S=[`custodySecretKind`,`nonceB64u`,`wrappedCustodySecretB64u`,`aadHashB64u`],C=[`recoveryKeyId`,`nonceB64u`,`ciphertextB64u`,`aadHashB64u`],w=[`walletId`,`manifestKekWraps`,`entries`];function T(e,n){let s=t(e,n);if(i(s,S,n),s.custodySecretKind!==`wallet_custody_seed_v1`)throw Error(`${n}.custodySecretKind must be wallet_custody_seed_v1; lane holder shares are reprovisioned, not recovered`);return b({nonceB64u:o(s.nonceB64u,`${n}.nonceB64u`),wrappedCustodySecretB64u:a(s.wrappedCustodySecretB64u,`${n}.wrappedCustodySecretB64u`),aadHashB64u:r(s.aadHashB64u,`${n}.aadHashB64u`)})}function E(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} must be an object`);return e}function D(e,t){let n=typeof e==`string`?e.trim():``;if(!n)throw Error(`${t} is required`);return n}function O(e){let t=E(e,`rotation worker result`);if(!Array.isArray(t.recoveryManifestKekWraps)||t.recoveryManifestKekWraps.length!==10)throw Error(`rotation worker result must contain exactly 10 recovery wraps`);return{walletId:D(t.walletId,`rotation worker walletId`),recoveryManifestKekWraps:t.recoveryManifestKekWraps.map((e,t)=>{let n=E(e,`rotation worker wrap ${t}`);return{recoveryKeyId:D(n.recoveryKeyId,`rotation worker wrap ${t} recoveryKeyId`),nonceB64u:D(n.nonceB64u,`rotation worker wrap ${t} nonceB64u`),ciphertextB64u:D(n.ciphertextB64u,`rotation worker wrap ${t} ciphertextB64u`),aadHashB64u:D(n.aadHashB64u,`rotation worker wrap ${t} aadHashB64u`)}}),recoveryEntryNonceB64u:D(t.recoveryEntryNonceB64u,`rotation worker recoveryEntryNonceB64u`),recoveryEntryCiphertextB64u:D(t.recoveryEntryCiphertextB64u,`rotation worker recoveryEntryCiphertextB64u`),recoveryEntryAadHashB64u:D(t.recoveryEntryAadHashB64u,`rotation worker recoveryEntryAadHashB64u`)}}function k(t){let n=O(t),i=e(n.walletId);if(!i.ok)throw Error(`rotation worker wallet id is invalid: ${i.error.message}`);let s={custodySecretKind:`wallet_custody_seed_v1`,nonceB64u:o(n.recoveryEntryNonceB64u,`rotation.entry.nonceB64u`),wrappedCustodySecretB64u:a(n.recoveryEntryCiphertextB64u,`rotation.entry.wrappedCustodySecretB64u`),aadHashB64u:r(n.recoveryEntryAadHashB64u,`rotation.entry.aadHashB64u`)};return x({walletId:i.value,manifestKekWraps:n.recoveryManifestKekWraps.map(e=>({recoveryKeyId:m(e.recoveryKeyId,`rotation.recoveryKeyId`),nonceB64u:o(e.nonceB64u,`rotation.wrap.nonceB64u`),ciphertextB64u:a(e.ciphertextB64u,`rotation.wrap.ciphertextB64u`),aadHashB64u:r(e.aadHashB64u,`rotation.wrap.aadHashB64u`)})),entries:[s]},{expectedWalletId:i.value,label:`rotation.workerResult`})}const A=`secp256k1_bip340_sha256_v1`;function j(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`);for(let r of n)if(!Object.hasOwn(e,r))throw Error(`${t}.${r} is required`)}function M(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} must be a non-empty canonical identifier`);for(let n=0;n<e.length;n+=1){let r=e.charCodeAt(n);if(r<33||r>126)throw Error(`${t} must contain visible ASCII bytes`)}return e}function N(e){return e.startsWith(`evm_family_ecdsa:`)&&e.length>17}function P(e,t){let n=M(e,t);if(!N(n))throw Error(`${t} must identify an ECDSA key set`);return n}function F(e,t){try{return u(e)}catch{throw Error(`${t} must be canonical base64url for 32 bytes`)}}function I(e,t){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical base64url`);let n;try{n=c(e)}catch{throw Error(`${t} must be valid base64url`)}if(n.length!==33||n[0]!==2&&n[0]!==3||s(n)!==e)throw Error(`${t} must be canonical compressed secp256k1 public key bytes`);return e}function L(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe integer`);return e}function R(e,t){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical base64url`);let n;try{n=c(e)}catch{throw Error(`${t} must be valid base64url`)}if(n.length!==64||s(n)!==e)throw Error(`${t} must be canonical base64url for 64 bytes`);return e}function z(e){let n=t(e,`walletRecoveryEcdsaPossessionChallenge`);if(j(n,`walletRecoveryEcdsaPossessionChallenge`,[`kind`,`walletId`,`reservationId`,`replacementId`,`keySetId`,`keyHandle`,`recordedKeyManifestDigestB64u`,`publicCapabilityDigestB64u`,`authorityRefDigestB64u`,`derivationClientSharePublicKey33B64u`,`expectedServerGeneration`,`expiresAtMs`,`serverNonceB64u`]),n.kind!==`wallet_recovery_ecdsa_possession_challenge_v1`)throw Error(`walletRecoveryEcdsaPossessionChallenge.kind is invalid`);let r=P(n.keySetId,`walletRecoveryEcdsaPossessionChallenge.keySetId`);return{kind:`wallet_recovery_ecdsa_possession_challenge_v1`,walletId:M(n.walletId,`walletRecoveryEcdsaPossessionChallenge.walletId`),reservationId:M(n.reservationId,`walletRecoveryEcdsaPossessionChallenge.reservationId`),replacementId:M(n.replacementId,`walletRecoveryEcdsaPossessionChallenge.replacementId`),keySetId:r,keyHandle:M(n.keyHandle,`walletRecoveryEcdsaPossessionChallenge.keyHandle`),recordedKeyManifestDigestB64u:F(n.recordedKeyManifestDigestB64u,`walletRecoveryEcdsaPossessionChallenge.recordedKeyManifestDigestB64u`),publicCapabilityDigestB64u:F(n.publicCapabilityDigestB64u,`walletRecoveryEcdsaPossessionChallenge.publicCapabilityDigestB64u`),authorityRefDigestB64u:F(n.authorityRefDigestB64u,`walletRecoveryEcdsaPossessionChallenge.authorityRefDigestB64u`),derivationClientSharePublicKey33B64u:I(n.derivationClientSharePublicKey33B64u,`walletRecoveryEcdsaPossessionChallenge.derivationClientSharePublicKey33B64u`),expectedServerGeneration:M(n.expectedServerGeneration,`walletRecoveryEcdsaPossessionChallenge.expectedServerGeneration`),expiresAtMs:L(n.expiresAtMs,`walletRecoveryEcdsaPossessionChallenge.expiresAtMs`),serverNonceB64u:F(n.serverNonceB64u,`walletRecoveryEcdsaPossessionChallenge.serverNonceB64u`)}}function B(e){let n=t(e,`walletRecoveryEcdsaPossessionProof`);if(j(n,`walletRecoveryEcdsaPossessionProof`,[`kind`,`scheme`,`signature64B64u`]),n.kind!==`wallet_recovery_ecdsa_possession_proof_v1`)throw Error(`walletRecoveryEcdsaPossessionProof.kind is invalid`);if(n.scheme!==A)throw Error(`walletRecoveryEcdsaPossessionProof.scheme is invalid`);return{kind:`wallet_recovery_ecdsa_possession_proof_v1`,scheme:A,signature64B64u:R(n.signature64B64u,`walletRecoveryEcdsaPossessionProof.signature64B64u`)}}function V(e){let t=z(e),n=[`seams/wallet-recovery/ecdsa-existing-material-possession/v1`,A,t.walletId,t.reservationId,t.replacementId,t.keySetId,t.keyHandle,c(t.recordedKeyManifestDigestB64u),c(t.publicCapabilityDigestB64u),c(t.authorityRefDigestB64u),c(t.derivationClientSharePublicKey33B64u),t.expectedServerGeneration,c(t.serverNonceB64u),H(t.expiresAtMs)],r=[];for(let e of n){let t=typeof e==`string`?new TextEncoder().encode(e):e,n=t.length;if(n>4294967295)throw Error(`wallet recovery possession field is too large`);r.push(n>>>24&255,n>>>16&255,n>>>8&255,n&255,...t)}return Uint8Array.from(r)}function H(e){let t=BigInt(e),n=new Uint8Array(8);for(let e=n.length-1;e>=0;--e)n[e]=Number(t&255n),t>>=8n;return n}async function U(e){return l(V(e))}export{T as a,g as c,k as i,B as n,y as o,U as r,h as s,z as t};