@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/react/SeamsWeb/operations/recovery/walletRecoveryDurablePayload.js

@@ -1,386 +0,0 @@
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-import { requireRecord } from "../../../shared-ts/src/utils/validation.js";
-import { sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import "../../../shared-ts/src/utils/encoders.js";
-import { normalizeThresholdRuntimePolicyScope } from "../../../core/signingEngine/threshold/sessionPolicy.js";
-import { parseEmailOtpProviderUserId, parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { rejectUnknownFields } from "../../../shared-ts/src/utils/exactRecord.js";
-import { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u } from "../../../shared-ts/src/passkey-custody/primitives.js";
-import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../../../shared-ts/src/passkey-custody/index.js";
-import { parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
-import { parseWalletRecoveryEcdsaPossessionProofV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js";
-import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedDB/walletCustodyEd25519MaterialRecord.js";
-import { parseWalletRecoveryPreparationKeyManifest } from "../../../core/rpcClients/relayer/walletRecoveryPrepare.js";
-function isDurablePasskeyPayload(payload) {
-	return payload.target.kind === "passkey";
-}
-function durableEmailEnrollmentReference(payload) {
-	return {
-		kind: "email_otp_enrollment_reference_v1",
-		enrollmentId: payload.enrollment.enrollmentId,
-		enrollmentSealKeyVersion: payload.enrollment.kind === "existing" ? payload.enrollment.enrollmentSealKeyVersion : payload.enrollment.material.enrollmentSealKeyVersion
-	};
-}
-const NEAR_KEY_SET_FIELDS = [
-	"kind",
-	"keySetId",
-	"applicationBindingDigestB64u",
-	"registeredPublicKeyB64u",
-	"participantIds",
-	"stateEpoch",
-	"signingWorkerVerifyingShareB64u",
-	"materialActivation",
-	"sealed"
-];
-const ECDSA_KEY_SET_FIELDS = [
-	"kind",
-	"keySetId",
-	"possessionProof",
-	"readyStateBlobB64u",
-	"publicFacts"
-];
-const PUBLIC_FACTS_FIELDS = [
-	"contextBinding32B64u",
-	"derivationClientSharePublicKey33B64u",
-	"clientVerifyingShare33B64u",
-	"relayerPublicKey33B64u",
-	"groupPublicKey33B64u",
-	"ethereumAddress",
-	"clientShareRetryCounter",
-	"relayerShareRetryCounter"
-];
-const PAYLOAD_COMMON_FIELDS = [
-	"kind",
-	"version",
-	"recoveryOperationId",
-	"walletId",
-	"reservationId",
-	"targetDeviceId",
-	"targetAuthorityId",
-	"targetWalletAuthMethodId",
-	"replacementEnvelope",
-	"keyManifest",
-	"nearKeySets",
-	"ecdsaKeySets",
-	"target"
-];
-function durableExactFields(value, fields, label) {
-	rejectUnknownFields(value, fields, label);
-	if (Object.keys(value).length !== fields.length) throw new Error(label + " fields are invalid");
-}
-function durableString(value, label) {
-	if (typeof value !== "string" || !value || value.trim() !== value) throw new Error(label + " must be a non-empty canonical string");
-	return value;
-}
-function durableBase64Url(value, label, byteLength) {
-	const normalized = durableString(value, label);
-	const bytes = base64UrlDecode(normalized);
-	if (byteLength !== void 0 && bytes.byteLength !== byteLength) throw new Error(label + " must decode to " + byteLength + " bytes");
-	return normalized;
-}
-function durableCompressedPublicKey(value, label) {
-	return parseSecp256k1CompressedPublicKeyB64u(value, label);
-}
-function durableSafeInteger(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(label + " must be a non-negative safe integer");
-	return value;
-}
-function durableParticipantPair(value, label) {
-	if (!Array.isArray(value) || value.length !== 2 || value.some(isInvalidParticipant)) throw new Error(label + " must contain two positive participant IDs");
-	return [value[0], value[1]];
-}
-function isInvalidParticipant(value) {
-	return typeof value !== "number" || !Number.isSafeInteger(value) || value < 1;
-}
-function nearManifestEntryForKeySet(manifest, raw) {
-	const keySetId = durableString(requireRecord(raw, "recovery durable NEAR key set").keySetId, "recovery durable NEAR keySetId");
-	const entry = manifest.entries.find((candidate) => candidate.keySetId === keySetId);
-	if (!entry || entry.kind !== "near_ed25519") throw new Error("recovery durable NEAR key-set manifest entry is invalid");
-	return entry;
-}
-function ecdsaManifestEntryForKeySet(manifest, raw) {
-	const keySetId = durableString(requireRecord(raw, "recovery durable ECDSA key set").keySetId, "recovery durable ECDSA keySetId");
-	const entry = manifest.entries.find((candidate) => candidate.keySetId === keySetId);
-	if (!entry || entry.kind !== "evm_family_ecdsa") throw new Error("recovery durable ECDSA key-set manifest entry is invalid");
-	return entry;
-}
-function durableRuntimePolicyScope(value) {
-	const scope = normalizeThresholdRuntimePolicyScope(value);
-	if (!scope) throw new Error("recovery runtime policy scope is invalid");
-	return scope;
-}
-function parseWalletRecoveryDurableNearKeySet(raw, manifestEntry) {
-	const record = requireRecord(raw, "recovery durable NEAR key set");
-	durableExactFields(record, NEAR_KEY_SET_FIELDS, "recovery durable NEAR key set");
-	if (record.kind !== "near_ed25519" || record.keySetId !== manifestEntry.keySetId) throw new Error("recovery durable NEAR key-set identity is invalid");
-	const basis = manifestEntry.recoveryBasis;
-	const thresholdSessionId = basis.scope.threshold_session_id;
-	if (!parseThresholdEd25519SessionId(thresholdSessionId).ok) throw new Error("recovery durable NEAR thresholdSessionId is invalid");
-	const binding = {
-		kind: WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND,
-		applicationBindingDigestB64u: parseDigestField(record.applicationBindingDigestB64u, "recovery durable NEAR application binding digest"),
-		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "recovery durable NEAR registered public key"),
-		participantIds: durableParticipantPair(record.participantIds, "recovery durable NEAR participantIds"),
-		stateEpoch: durableString(record.stateEpoch, "recovery durable NEAR stateEpoch"),
-		walletId: basis.applicationBinding.wallet_id,
-		nearAccountId: manifestEntry.nearAccountId,
-		nearEd25519SigningKeyId: basis.applicationBinding.near_ed25519_signing_key_id,
-		signerSlot: parseKeyCreationSignerSlot(basis.applicationBinding.key_creation_signer_slot, "recovery durable NEAR signerSlot"),
-		signingWorkerId: basis.scope.signing_worker_id,
-		signingWorkerVerifyingShareB64u: parseEd25519PublicKeyB64u(record.signingWorkerVerifyingShareB64u, "recovery durable NEAR signing-worker verifying share")
-	};
-	const sealedRecord = requireRecord(record.sealed, "recovery durable NEAR sealed material");
-	durableExactFields(sealedRecord, ["ciphertextB64u", "nonceB64u"], "recovery durable NEAR sealed material");
-	return {
-		kind: "near_ed25519",
-		keySetId: manifestEntry.keySetId,
-		binding,
-		thresholdSessionId,
-		runtimePolicyScope: durableRuntimePolicyScope(basis.runtimePolicyScope),
-		materialActivation: parseRouterAbMpcMaterialActivationRef(record.materialActivation),
-		sealed: {
-			ciphertextB64u: parseEnvelopeCiphertextB64u(sealedRecord.ciphertextB64u, "recovery durable NEAR ciphertext"),
-			nonceB64u: parseEnvelopeNonceB64u(sealedRecord.nonceB64u, "recovery durable NEAR nonce")
-		}
-	};
-}
-function parseWalletRecoveryDurableEcdsaPublicFacts(raw) {
-	const record = requireRecord(raw, "recovery durable ECDSA public facts");
-	durableExactFields(record, PUBLIC_FACTS_FIELDS, "recovery durable ECDSA public facts");
-	const ethereumAddress = durableString(record.ethereumAddress, "recovery durable ECDSA ethereumAddress").toLowerCase();
-	if (!/^0x[0-9a-f]{40}$/.test(ethereumAddress)) throw new Error("recovery durable ECDSA ethereumAddress is invalid");
-	return {
-		contextBinding32B64u: parseDigestField(record.contextBinding32B64u, "recovery durable ECDSA context binding"),
-		derivationClientSharePublicKey33B64u: durableCompressedPublicKey(record.derivationClientSharePublicKey33B64u, "recovery durable ECDSA client share"),
-		clientVerifyingShare33B64u: durableCompressedPublicKey(record.clientVerifyingShare33B64u, "recovery durable ECDSA client verifying share"),
-		relayerPublicKey33B64u: durableCompressedPublicKey(record.relayerPublicKey33B64u, "recovery durable ECDSA relayer public key"),
-		groupPublicKey33B64u: durableCompressedPublicKey(record.groupPublicKey33B64u, "recovery durable ECDSA group public key"),
-		ethereumAddress,
-		clientShareRetryCounter: durableSafeInteger(record.clientShareRetryCounter, "recovery durable ECDSA client-share retry counter"),
-		relayerShareRetryCounter: durableSafeInteger(record.relayerShareRetryCounter, "recovery durable ECDSA relayer-share retry counter")
-	};
-}
-function parseWalletRecoveryDurableEcdsaKeySet(raw, manifestEntry) {
-	const record = requireRecord(raw, "recovery durable ECDSA key set");
-	durableExactFields(record, ECDSA_KEY_SET_FIELDS, "recovery durable ECDSA key set");
-	if (record.kind !== "evm_family_ecdsa" || record.keySetId !== manifestEntry.keySetId) throw new Error("recovery durable ECDSA key-set identity is invalid");
-	return {
-		kind: "evm_family_ecdsa",
-		entry: manifestEntry,
-		possessionProof: parseWalletRecoveryEcdsaPossessionProofV1(record.possessionProof),
-		readyStateBlobB64u: durableBase64Url(record.readyStateBlobB64u, "recovery durable ECDSA ready-state blob"),
-		publicFacts: parseWalletRecoveryDurableEcdsaPublicFacts(record.publicFacts)
-	};
-}
-function parseWalletRecoveryDurableRegistration(raw) {
-	const record = requireRecord(raw, "recovery durable registration");
-	durableExactFields(record, [
-		"kind",
-		"id",
-		"rawId",
-		"type",
-		"authenticatorAttachment",
-		"response"
-	], "recovery durable registration");
-	if (record.kind !== "wallet_recovery_redacted_registration_v1") throw new Error("recovery durable registration kind is invalid");
-	if (record.authenticatorAttachment !== null && typeof record.authenticatorAttachment !== "string") throw new Error("recovery durable registration authenticatorAttachment is invalid");
-	const responseRecord = requireRecord(record.response, "recovery durable registration response");
-	durableExactFields(responseRecord, [
-		"clientDataJSON",
-		"attestationObject",
-		"transports"
-	], "recovery durable registration response");
-	if (!Array.isArray(responseRecord.transports)) throw new Error("recovery durable registration transports are invalid");
-	return {
-		kind: "wallet_recovery_redacted_registration_v1",
-		id: durableString(record.id, "recovery durable registration id"),
-		rawId: durableBase64Url(record.rawId, "recovery durable registration rawId"),
-		type: durableString(record.type, "recovery durable registration type"),
-		authenticatorAttachment: record.authenticatorAttachment,
-		response: {
-			clientDataJSON: durableBase64Url(responseRecord.clientDataJSON, "recovery durable registration clientDataJSON"),
-			attestationObject: durableBase64Url(responseRecord.attestationObject, "recovery durable registration attestationObject"),
-			transports: responseRecord.transports.map((transport, index) => durableString(transport, "recovery durable registration transports[" + index + "]"))
-		}
-	};
-}
-function parseWalletRecoveryDurableEnrollment(raw) {
-	const record = requireRecord(raw, "recovery durable Email OTP enrollment");
-	if (record.kind === "existing") {
-		durableExactFields(record, [
-			"kind",
-			"enrollmentId",
-			"enrollmentSealKeyVersion"
-		], "recovery durable existing Email OTP enrollment");
-		return {
-			kind: "existing",
-			enrollmentId: durableString(record.enrollmentId, "recovery enrollmentId"),
-			enrollmentSealKeyVersion: durableString(record.enrollmentSealKeyVersion, "recovery enrollment seal-key version")
-		};
-	}
-	if (record.kind !== "create") throw new Error("recovery durable Email OTP enrollment kind is invalid");
-	durableExactFields(record, [
-		"kind",
-		"enrollmentId",
-		"providerSubject",
-		"verifiedEmail",
-		"material"
-	], "recovery durable create Email OTP enrollment");
-	const material = requireRecord(record.material, "recovery durable enrollment material");
-	durableExactFields(material, [
-		"enrollmentSealKeyVersion",
-		"clientUnlockPublicKeyB64u",
-		"unlockKeyVersion",
-		"serverSealedFactorCiphertextB64u"
-	], "recovery durable enrollment material");
-	return {
-		kind: "create",
-		enrollmentId: durableString(record.enrollmentId, "recovery enrollmentId"),
-		providerSubject: durableString(record.providerSubject, "recovery enrollment providerSubject"),
-		verifiedEmail: durableString(record.verifiedEmail, "recovery enrollment verifiedEmail"),
-		material: {
-			enrollmentSealKeyVersion: durableString(material.enrollmentSealKeyVersion, "recovery enrollment material seal-key version"),
-			clientUnlockPublicKeyB64u: durableBase64Url(material.clientUnlockPublicKeyB64u, "recovery enrollment client unlock public key"),
-			unlockKeyVersion: durableString(material.unlockKeyVersion, "recovery enrollment unlock-key version"),
-			serverSealedFactorCiphertextB64u: durableBase64Url(material.serverSealedFactorCiphertextB64u, "recovery enrollment sealed factor ciphertext")
-		}
-	};
-}
-function parseWalletRecoveryDurablePayload(raw) {
-	const record = requireRecord(raw, "wallet recovery durable payload");
-	if (record.kind !== "wallet_recovery_durable_payload_v1" || record.version !== 1) throw new Error("wallet recovery durable payload version is invalid");
-	durableExactFields(record, [...PAYLOAD_COMMON_FIELDS, ...requireRecord(record.target, "wallet recovery durable target").kind === "passkey" ? [
-		"replacementId",
-		"challengeId",
-		"registration"
-	] : [
-		"providerSubject",
-		"verifiedEmail",
-		"emailHashHex",
-		"registrationAuthorityId",
-		"replacementId",
-		"enrollment"
-	]], "wallet recovery durable payload");
-	const recoveryOperationId = parseWalletRecoveryOperationId(record.recoveryOperationId);
-	const walletId = parseWalletId(record.walletId);
-	let reservationId;
-	try {
-		reservationId = parseRecoveryCodeReservationId(record.reservationId);
-	} catch (error) {
-		throw new Error("wallet recovery durable reservationId is invalid", { cause: error });
-	}
-	const targetDeviceId = parseDeviceId(record.targetDeviceId);
-	const targetAuthorityId = parseWalletAuthorityId(record.targetAuthorityId);
-	const targetWalletAuthMethodId = parseWalletAuthMethodId(record.targetWalletAuthMethodId);
-	if (!recoveryOperationId.ok || !walletId.ok || !targetDeviceId.ok || !targetAuthorityId.ok || !targetWalletAuthMethodId.ok) throw new Error("wallet recovery durable payload identity is invalid");
-	if (!Array.isArray(record.nearKeySets) || !Array.isArray(record.ecdsaKeySets)) throw new Error("wallet recovery durable key-set arrays are invalid");
-	const keyManifest = parseWalletRecoveryPreparationKeyManifest(record.keyManifest, String(walletId.value));
-	const nearKeySets = record.nearKeySets.map((keySet) => parseWalletRecoveryDurableNearKeySet(keySet, nearManifestEntryForKeySet(keyManifest, keySet)));
-	const ecdsaKeySets = record.ecdsaKeySets.map((keySet) => parseWalletRecoveryDurableEcdsaKeySet(keySet, ecdsaManifestEntryForKeySet(keyManifest, keySet)));
-	const keySetIds = [...nearKeySets.map((keySet) => keySet.keySetId), ...ecdsaKeySets.map((keySet) => keySet.entry.keySetId)];
-	if (new Set(keySetIds).size !== keySetIds.length) throw new Error("wallet recovery durable key-set ids are duplicated");
-	if (keyManifest.entries.length !== keySetIds.length || keyManifest.entries.some((entry) => !keySetIds.includes(entry.keySetId))) throw new Error("wallet recovery durable key-set manifest coverage is invalid");
-	const common = {
-		kind: "wallet_recovery_durable_payload_v1",
-		version: 1,
-		recoveryOperationId: recoveryOperationId.value,
-		walletId: walletId.value,
-		reservationId,
-		targetDeviceId: targetDeviceId.value,
-		targetAuthorityId: targetAuthorityId.value,
-		targetWalletAuthMethodId: targetWalletAuthMethodId.value,
-		replacementEnvelope: parsePasskeyCustodyEnvelopeRecord(record.replacementEnvelope, "wallet recovery durable replacementEnvelope"),
-		keyManifest,
-		nearKeySets,
-		ecdsaKeySets
-	};
-	if (String(common.replacementEnvelope.walletId) !== String(walletId.value)) throw new Error("wallet recovery durable replacement envelope wallet changed");
-	if (common.replacementEnvelope.ownership.kind !== "method_bound" || common.replacementEnvelope.ownership.walletAuthMethodId !== targetWalletAuthMethodId.value) throw new Error("wallet recovery durable replacement envelope method changed");
-	for (const keySet of nearKeySets) if (keySet.binding.walletId !== String(walletId.value)) throw new Error("wallet recovery durable NEAR binding wallet changed");
-	const target = requireRecord(record.target, "wallet recovery durable target");
-	if (target.kind === "passkey") {
-		durableExactFields(target, ["kind", "rpId"], "wallet recovery durable passkey target");
-		const rpId = parseWebAuthnRpId(target.rpId);
-		if (!rpId.ok) throw new Error("wallet recovery durable passkey RP ID is invalid");
-		const registration = parseWalletRecoveryDurableRegistration(record.registration);
-		if (registration.rawId !== common.replacementEnvelope.factor.credentialIdB64u) throw new Error("wallet recovery durable passkey registration identity changed");
-		if (common.replacementEnvelope.factor.kind !== "passkey") throw new Error("wallet recovery durable passkey envelope factor is invalid");
-		if (common.replacementEnvelope.factor.rpId !== rpId.value || common.replacementEnvelope.factor.credentialIdB64u !== registration.rawId) throw new Error("wallet recovery durable passkey envelope identity changed");
-		const replacementId = durableString(record.replacementId, "wallet recovery durable replacementId");
-		if (String(common.replacementEnvelope.envelopeId) !== replacementId) throw new Error("wallet recovery durable passkey envelope id changed");
-		return {
-			...common,
-			target: {
-				kind: "passkey",
-				rpId: rpId.value
-			},
-			replacementId,
-			challengeId: durableString(record.challengeId, "wallet recovery durable challengeId"),
-			registration
-		};
-	}
-	if (target.kind !== "google_email_otp") throw new Error("wallet recovery durable target kind is invalid");
-	durableExactFields(target, ["kind"], "wallet recovery durable Email OTP target");
-	const providerSubject = durableString(record.providerSubject, "wallet recovery providerSubject");
-	if (!parseEmailOtpProviderUserId(providerSubject).ok) throw new Error("wallet recovery durable providerSubject is invalid");
-	const verifiedEmail = durableString(record.verifiedEmail, "wallet recovery durable verifiedEmail");
-	const emailHashHex = durableString(record.emailHashHex, "wallet recovery durable emailHashHex");
-	if (!/^[0-9a-f]{64}$/.test(emailHashHex)) throw new Error("wallet recovery durable emailHashHex is invalid");
-	const registrationAuthorityId = durableString(record.registrationAuthorityId, "wallet recovery durable registrationAuthorityId");
-	const enrollment = parseWalletRecoveryDurableEnrollment(record.enrollment);
-	if (common.replacementEnvelope.factor.kind !== "email_otp") throw new Error("wallet recovery durable Email OTP envelope factor is invalid");
-	const enrollmentReference = enrollment.kind === "existing" ? {
-		enrollmentId: enrollment.enrollmentId,
-		enrollmentSealKeyVersion: enrollment.enrollmentSealKeyVersion
-	} : {
-		enrollmentId: enrollment.enrollmentId,
-		enrollmentSealKeyVersion: enrollment.material.enrollmentSealKeyVersion
-	};
-	if (common.replacementEnvelope.factor.enrollmentId !== enrollmentReference.enrollmentId || common.replacementEnvelope.factor.enrollmentSealKeyVersion !== enrollmentReference.enrollmentSealKeyVersion) throw new Error("wallet recovery durable Email OTP envelope identity changed");
-	if (enrollment.kind === "create" && (enrollment.providerSubject !== providerSubject || enrollment.verifiedEmail !== verifiedEmail)) throw new Error("wallet recovery durable Email OTP enrollment identity changed");
-	const replacementId = durableString(record.replacementId, "wallet recovery durable replacementId");
-	if (String(common.replacementEnvelope.envelopeId) !== replacementId) throw new Error("wallet recovery durable Email OTP envelope id changed");
-	return {
-		...common,
-		target: { kind: "google_email_otp" },
-		providerSubject,
-		verifiedEmail,
-		emailHashHex,
-		registrationAuthorityId,
-		replacementId,
-		enrollment
-	};
-}
-async function validateWalletRecoveryDurablePayloadBindings(payload) {
-	if (isDurablePasskeyPayload(payload)) return;
-	const expectedEmailHashHex = await sha256HexUtf8(payload.verifiedEmail);
-	if (payload.emailHashHex !== expectedEmailHashHex) throw new Error("wallet recovery durable email hash does not match verified email");
-	if (payload.enrollment.kind === "create" && (payload.enrollment.providerSubject !== payload.providerSubject || payload.enrollment.verifiedEmail !== payload.verifiedEmail)) throw new Error("wallet recovery durable enrollment does not match Email OTP identity");
-}
-function durablePayloadIdentityTarget(payload) {
-	if (isDurablePasskeyPayload(payload)) {
-		const credentialIdB64u = parseWebAuthnCredentialIdB64u(payload.registration.rawId);
-		if (!credentialIdB64u.ok) throw new Error("wallet recovery durable passkey credential id is invalid");
-		return {
-			kind: "passkey",
-			rpId: payload.target.rpId,
-			credentialIdB64u: credentialIdB64u.value
-		};
-	}
-	const providerSubject = parseEmailOtpProviderUserId(payload.providerSubject);
-	if (!providerSubject.ok) throw new Error("wallet recovery durable providerSubject is invalid");
-	return {
-		kind: "google_email_otp",
-		providerSubject: providerSubject.value,
-		emailHashHex: payload.emailHashHex,
-		registrationAuthorityId: payload.registrationAuthorityId,
-		enrollment: durableEmailEnrollmentReference(payload)
-	};
-}
-//#endregion
-export { durableEmailEnrollmentReference, durablePayloadIdentityTarget, isDurablePasskeyPayload, parseWalletRecoveryDurablePayload, validateWalletRecoveryDurablePayloadBindings };
-
-//# sourceMappingURL=walletRecoveryDurablePayload.js.map

package/dist/esm/react/SeamsWeb/operations/recovery/walletRecoveryJournal.js

@@ -1,118 +0,0 @@
-import { alphabetizeStringify } from "../../../shared-ts/src/utils/digests.js";
-import { parseWalletRecoveryOperationId } from "../../../shared-ts/src/utils/domainIds.js";
-import { pendingWalletRecoveryCommitIdentityMatches } from "../../../core/indexedDB/pendingWalletRecoveryCommit.js";
-import { durablePayloadIdentityTarget, isDurablePasskeyPayload, parseWalletRecoveryDurablePayload, validateWalletRecoveryDurablePayloadBindings } from "./walletRecoveryDurablePayload.js";
-//#region src/SeamsWeb/operations/recovery/walletRecoveryJournal.ts
-const WALLET_RECOVERY_DURABLE_PAYLOAD_AAD_KIND = "pending_wallet_recovery_commit_v1";
-function walletRecoveryDurableAad(input) {
-	return new TextEncoder().encode(alphabetizeStringify({
-		kind: WALLET_RECOVERY_DURABLE_PAYLOAD_AAD_KIND,
-		version: 1,
-		...input
-	}));
-}
-async function decryptWalletRecoveryDurablePayload(record) {
-	const plaintext = await crypto.subtle.decrypt({
-		name: "AES-GCM",
-		iv: record.localMaterial.iv,
-		additionalData: durablePayloadAadForPendingRecord(record)
-	}, record.localMaterial.key, record.localMaterial.ciphertext);
-	const payload = parseWalletRecoveryDurablePayload(JSON.parse(new TextDecoder().decode(plaintext)));
-	await validateWalletRecoveryDurablePayloadBindings(payload);
-	if (!pendingRecordMatchesDurablePayload(record, payload)) throw new Error("wallet recovery durable payload identity does not match its journal");
-	return payload;
-}
-function durablePayloadAadForPendingRecord(record) {
-	return walletRecoveryDurableAad({
-		recoveryOperationId: record.recoveryOperationId,
-		walletId: record.walletId,
-		reservationId: record.reservationId,
-		targetDeviceId: record.targetDeviceId,
-		targetAuthorityId: record.targetAuthorityId,
-		targetWalletAuthMethodId: record.targetWalletAuthMethodId,
-		target: record.target
-	});
-}
-function requireWalletRecoveryOperationId(value) {
-	const parsed = parseWalletRecoveryOperationId(value);
-	if (!parsed.ok) throw new Error("wallet recovery operation id is invalid");
-	return parsed.value;
-}
-function pendingRecordMatchesDurablePayload(record, payload) {
-	const common = {
-		kind: "pending_wallet_recovery_commit_v1",
-		version: 1,
-		recoveryOperationId: requireWalletRecoveryOperationId(payload.recoveryOperationId),
-		walletId: payload.walletId,
-		reservationId: payload.reservationId,
-		targetDeviceId: payload.targetDeviceId,
-		targetAuthorityId: payload.targetAuthorityId,
-		targetWalletAuthMethodId: payload.targetWalletAuthMethodId,
-		localMaterial: record.localMaterial,
-		createdAtMs: record.createdAtMs,
-		updatedAtMs: record.updatedAtMs
-	};
-	const target = durablePayloadIdentityTarget(payload);
-	if (record.stage === "awaiting_server_promotion") return pendingWalletRecoveryCommitIdentityMatches(record, {
-		...common,
-		stage: "awaiting_server_promotion",
-		target
-	});
-	switch (target.kind) {
-		case "passkey":
-			if (record.projection.kind !== "passkey") return false;
-			return pendingWalletRecoveryCommitIdentityMatches(record, {
-				...common,
-				stage: "server_promoted",
-				target,
-				projection: record.projection
-			});
-		case "google_email_otp":
-			if (record.projection.kind !== "google_email_otp") return false;
-			return pendingWalletRecoveryCommitIdentityMatches(record, {
-				...common,
-				stage: "server_promoted",
-				target,
-				projection: record.projection
-			});
-	}
-}
-function pendingWalletRecoveryCommonFromPayload(payload, localMaterial, createdAtMs, updatedAtMs) {
-	return {
-		kind: "pending_wallet_recovery_commit_v1",
-		version: 1,
-		recoveryOperationId: requireWalletRecoveryOperationId(payload.recoveryOperationId),
-		walletId: payload.walletId,
-		reservationId: payload.reservationId,
-		targetDeviceId: payload.targetDeviceId,
-		targetAuthorityId: payload.targetAuthorityId,
-		targetWalletAuthMethodId: payload.targetWalletAuthMethodId,
-		target: durablePayloadIdentityTarget(payload),
-		localMaterial,
-		createdAtMs,
-		updatedAtMs
-	};
-}
-function promotedPendingWalletRecoveryCommit(awaiting, payload, projection, nowMs = Date.now()) {
-	const common = pendingWalletRecoveryCommonFromPayload(payload, awaiting.localMaterial, awaiting.createdAtMs, Math.max(nowMs, awaiting.createdAtMs + 1));
-	if (isDurablePasskeyPayload(payload)) {
-		if (projection.kind !== "passkey") throw new Error("wallet recovery promotion projection branch changed");
-		return {
-			...common,
-			stage: "server_promoted",
-			target: durablePayloadIdentityTarget(payload),
-			projection
-		};
-	}
-	if (projection.kind !== "google_email_otp") throw new Error("wallet recovery promotion projection branch changed");
-	return {
-		...common,
-		stage: "server_promoted",
-		target: durablePayloadIdentityTarget(payload),
-		projection
-	};
-}
-//#endregion
-export { decryptWalletRecoveryDurablePayload, promotedPendingWalletRecoveryCommit, requireWalletRecoveryOperationId };
-
-//# sourceMappingURL=walletRecoveryJournal.js.map