@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/react/SeamsWeb/operations/recovery/walletRecoveryRotation.js

@@ -1,214 +0,0 @@
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-import { joinNormalizedUrl } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/encoders.js";
-import { SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
-import { redactCredentialExtensionOutputs } from "../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
-import { WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../shared-ts/src/utils/emailOtpDomain.js";
-import { computeWalletCustodyAdminChallengeDigest } from "../../../shared-ts/src/authorization/walletCustodyOperation.js";
-import { IndexedDBManager } from "../../../core/indexedDB/index.js";
-import { buildEmailOtpRoutePlan } from "../../../core/signingEngine/stepUpConfirmation/otpPrompt/authLane.js";
-import { fetchPasskeyCustodyEnvelope } from "../../../core/rpcClients/relayer/passkeyCustodyEnvelope.js";
-import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "../authMethods/passkey/ecdsaBootstrap.js";
-import { requestWalletCustodyEmailOtpChallenge } from "../../../core/rpcClients/relayer/walletRecoveryRotate.js";
-import { rotateWalletRecoverySetWithActiveFactorV1, rotateWalletRecoverySetWithEmailOtpV1 } from "../../../core/signingEngine/walletCustody/walletRecoveryRotation.js";
-//#region src/SeamsWeb/operations/recovery/walletRecoveryRotation.ts
-function authenticatorTransports(value) {
-	if (!Array.isArray(value)) return [];
-	return value.filter((transport) => {
-		switch (transport) {
-			case "ble":
-			case "hybrid":
-			case "internal":
-			case "nfc":
-			case "smart-card":
-			case "usb": return true;
-			default: return false;
-		}
-	});
-}
-function passkeyAllowCredentials(records) {
-	const credentials = records.flatMap((record) => {
-		const id = String(record.credentialId || "").trim();
-		return id ? [{
-			id,
-			type: "public-key",
-			transports: authenticatorTransports(record.transports)
-		}] : [];
-	});
-	if (credentials.length === 0) throw new Error("Wallet recovery-code rotation requires an active passkey");
-	return credentials;
-}
-async function requestPasskeyEnvelopeChallenge(args) {
-	const response = await fetch(joinNormalizedUrl(args.relayUrl, "/wallet/unlock/challenge"), {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			unlockBackend: "passkey",
-			userId: args.walletId,
-			rpId: args.rpId
-		})
-	});
-	const value = await response.json().catch(() => ({}));
-	const body = value && typeof value === "object" && !Array.isArray(value) ? value : {};
-	if (!response.ok || body.ok !== true) throw new Error(typeof body.message === "string" ? body.message : "passkey envelope challenge failed");
-	const challengeId = typeof body.challengeId === "string" ? body.challengeId.trim() : "";
-	const challengeB64u = typeof body.challengeB64u === "string" ? body.challengeB64u.trim() : "";
-	if (!challengeId || !challengeB64u) throw new Error("passkey envelope challenge is invalid");
-	return {
-		challengeId,
-		challengeB64u
-	};
-}
-async function rotateWithPasskey(args) {
-	const rpId = String(args.context.signingEngine.getRpId() || "").trim();
-	if (!rpId) throw new Error("Wallet recovery-code rotation requires an RP ID");
-	const requestOrigin = typeof window === "undefined" ? "" : window.location.origin;
-	if (!requestOrigin) throw new Error("Wallet recovery-code rotation requires a browser Origin");
-	const allowCredentials = passkeyAllowCredentials(await IndexedDBManager.listProfileAuthenticators(args.walletId));
-	const envelopeChallenge = await requestPasskeyEnvelopeChallenge({
-		relayUrl: args.relayUrl,
-		walletId: args.walletId,
-		rpId
-	});
-	const envelopeCredential = await args.context.signingEngine.getAuthenticationCredentialsSerialized({
-		subjectId: args.walletId,
-		challengeB64u: envelopeChallenge.challengeB64u,
-		allowCredentials,
-		includeSecondPrfOutput: true
-	});
-	const envelopeCredentialId = passkeyCredentialIdB64uFromAuthentication(envelopeCredential);
-	if (!envelopeCredentialId) throw new Error("Wallet recovery-code rotation did not receive a passkey credential");
-	const fetchedEnvelope = await fetchPasskeyCustodyEnvelope({
-		relayUrl: args.relayUrl,
-		locator: {
-			walletId: args.walletId,
-			factor: {
-				kind: "passkey",
-				rpId,
-				credentialIdB64u: envelopeCredentialId
-			}
-		},
-		challengeId: envelopeChallenge.challengeId,
-		expectedOrigin: requestOrigin,
-		webauthnAuthentication: redactCredentialExtensionOutputs(envelopeCredential)
-	});
-	if (fetchedEnvelope.kind !== "active") throw new Error(fetchedEnvelope.message);
-	const envelope = fetchedEnvelope.envelope;
-	const factorSecret = base64UrlDecode(requirePasskeyPrfFirstB64u(envelopeCredential, "Wallet recovery-code rotation"));
-	try {
-		const worker = args.context.signingEngine.getSignerWorkerContext();
-		const factorProof = async ({ operation, payload }) => {
-			const challengeDigest = await computeWalletCustodyAdminChallengeDigest({
-				walletId: args.walletId,
-				operation,
-				payload,
-				requestOrigin
-			});
-			const adminCredential = await args.context.signingEngine.getAuthenticationCredentialsSerialized({
-				subjectId: args.walletId,
-				challengeB64u: challengeDigest,
-				allowCredentials,
-				includeSecondPrfOutput: false
-			});
-			const adminCredentialId = passkeyCredentialIdB64uFromAuthentication(adminCredential);
-			if (!adminCredentialId || adminCredentialId !== envelopeCredentialId) throw new Error("Wallet recovery-code rotation selected an unrelated passkey");
-			return {
-				kind: "passkey",
-				walletId: args.walletId,
-				rpId,
-				credentialIdB64u: envelopeCredentialId,
-				challenge_digest: challengeDigest,
-				webauthn_authentication: adminCredential
-			};
-		};
-		return await rotateWalletRecoverySetWithActiveFactorV1({
-			relayUrl: args.relayUrl,
-			walletId: args.walletId,
-			factorProof,
-			custodyEnvelope: envelope,
-			factorSecret: factorSecret.buffer,
-			worker: { rotateRecoverySet: async (request) => await worker.requestWorkerOperation({
-				kind: "walletCustodyCeremony",
-				request: {
-					type: "rotateWalletRecoverySet",
-					timeoutMs: 3e4,
-					payload: request,
-					transfer: [request.factorSecret]
-				}
-			}) }
-		});
-	} finally {
-		factorSecret.fill(0);
-	}
-}
-async function rotateWithEmailOtp(args) {
-	const worker = args.context.signingEngine.getSignerWorkerContext();
-	const routePlan = buildEmailOtpRoutePlan({
-		routeFamily: "login",
-		operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
-	});
-	const factorProof = async ({ operation, payload }) => {
-		const requestOrigin = typeof window === "undefined" ? "" : window.location.origin;
-		const challenge = await requestWalletCustodyEmailOtpChallenge({
-			relayUrl: args.relayUrl,
-			walletId: args.walletId,
-			providerSubjectId: args.authorization.providerSubjectId,
-			operation,
-			payload,
-			...requestOrigin ? { requestOrigin } : {}
-		});
-		if (challenge.kind !== "ready") throw new Error(challenge.message);
-		const challengeDigest = await computeWalletCustodyAdminChallengeDigest({
-			walletId: args.walletId,
-			operation,
-			payload,
-			requestOrigin
-		});
-		if (challenge.challengeId !== args.authorization.challengeId || challenge.challenge_digest !== args.authorization.challenge_digest || challengeDigest !== args.authorization.challenge_digest) throw new Error("Wallet recovery Email OTP challenge is bound to a different operation");
-		return {
-			kind: "email_otp",
-			provider_subject_id: args.authorization.providerSubjectId,
-			challenge_id: args.authorization.challengeId,
-			otp_code: args.authorization.otpCode,
-			challenge_digest: challengeDigest
-		};
-	};
-	return await rotateWalletRecoverySetWithEmailOtpV1({
-		relayUrl: args.relayUrl,
-		walletId: args.walletId,
-		factorProof,
-		worker: { rotateRecoverySet: async ({ recoveryCodesJson }) => await worker.requestWorkerOperation({
-			kind: "emailOtp",
-			request: {
-				type: "rotateEmailOtpWalletRecoverySet",
-				timeoutMs: 6e4,
-				payload: {
-					relayUrl: args.relayUrl,
-					walletId: args.walletId,
-					userId: args.walletId,
-					groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-					routePlan,
-					verification: {
-						kind: "otp",
-						challengeId: args.authorization.challengeId,
-						otpCode: args.authorization.otpCode
-					},
-					recoveryCodesJson
-				}
-			}
-		}) }
-	});
-}
-async function rotateWalletRecoveryCodes(args) {
-	switch (args.authorization.kind) {
-		case "existing_passkey": return await rotateWithPasskey(args);
-		case "email_otp": return await rotateWithEmailOtp({
-			...args,
-			authorization: args.authorization
-		});
-	}
-}
-//#endregion
-export { rotateWalletRecoveryCodes };
-
-//# sourceMappingURL=walletRecoveryRotation.js.map

package/dist/esm/react/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecovery.js

@@ -1,184 +0,0 @@
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { parseEcdsaRoleLocalMaterialHandle } from "../../../core/signingEngine/session/keyMaterialBrands.js";
-import { buildEcdsaCapabilityScope } from "../../../core/signingEngine/session/material/ecdsaCapabilityManifest.js";
-import { ecdsaCapabilityScopesMatch, runtimePolicyScopesMatch } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestRecords.js";
-import { IndexedDbEcdsaCapabilityManifestStore } from "../../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
-import { prepareWalletCustodyEcdsaContinuity } from "../../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
-import { prepareWalletEcdsaRegistrationPublication } from "../../../core/signingEngine/flows/registration/accountLifecycle.js";
-import { pendingEcdsaActivateRequest, requireCommittedEcdsaRegistrationResponse, requireEcdsaProjection, requireResponseWalletKeys } from "./pendingEcdsaRegistrationRecoveryValidation.js";
-//#region src/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecovery.ts
-async function prepareRegistrationContinuity(input) {
-	const store = new IndexedDbEcdsaCapabilityManifestStore();
-	const materialActivation = routerAbMpcMaterialActivationRefFromWire(input.activationReceipt.ecdsa_activation.material_activation);
-	const existing = await store.lookupByMaterialActivation({
-		walletId: input.authority.walletId,
-		authority: input.authority,
-		materialActivation
-	});
-	if (existing.kind === "missing") {
-		const prepared = await prepareWalletCustodyEcdsaContinuity(input);
-		return {
-			roleLocalMaterialRef: prepared.roleLocalMaterialRef,
-			publication: [prepared]
-		};
-	}
-	if (existing.kind !== "active") throw new Error(`Pending ECDSA registration continuity is ${existing.kind}`);
-	const manifest = existing.manifest;
-	const material = manifest.durableMaterial;
-	if (!sameRouterAbEcdsaRegistrationActivationReceiptV1(manifest.activation.serverActivation.serverActivationReceipt.protocolReceipt, input.activationReceipt) || !sameRouterAbEcdsaDerivationPublicCapabilityV1(material.roleLocalPublicFacts.publicCapability, input.publicCapability) || !ecdsaCapabilityScopesMatch(manifest.signer.scope, buildEcdsaCapabilityScope({ targetMemberships: input.chainTargets })) || material.roleLocalBinding.keyHandle !== input.keyHandle || material.roleLocalBinding.ecdsaThresholdKeyId !== input.ecdsaThresholdKeyId || material.roleLocalBinding.relayerKeyId !== input.relayerKeyId || material.bindingDigest !== input.publicFacts.contextBinding32B64u || manifest.signer.signingRootId !== input.signingRootId || manifest.signer.signingRootVersion !== input.signingRootVersion || !runtimePolicyScopesMatch(material.runtimePolicyScope, input.runtimePolicyScope)) throw new Error("Pending ECDSA registration conflicts with its restored activation");
-	return {
-		roleLocalMaterialRef: {
-			kind: "ecdsa_role_local_persisted_material_ref_v1",
-			durableMaterialRef: material.durableMaterialRef,
-			bindingDigest: material.bindingDigest,
-			materialActivation
-		},
-		publication: []
-	};
-}
-function nonEmptyWalletKeys(walletKeys) {
-	const first = walletKeys[0];
-	if (!first) throw new Error("ECDSA registration finalization returned no wallet keys");
-	return [first, ...walletKeys.slice(1)];
-}
-function nonEmptyChainTargets(walletKeys) {
-	const first = walletKeys[0];
-	if (!first) throw new Error("ECDSA registration activation returned no chain targets");
-	return [first.chainTarget, ...walletKeys.slice(1).map((walletKey) => walletKey.chainTarget)];
-}
-async function prepareEcdsaRegistrationPublication(args) {
-	const walletKeys = nonEmptyWalletKeys(args.walletKeys);
-	if (args.pending.auth.kind === "passkey") {
-		if (args.response.authMethod.kind !== "passkey" || !args.response.authMethod.credentialPublicKeyB64u) throw new Error("ECDSA registration publication has no exact Passkey credential");
-		return await prepareWalletEcdsaRegistrationPublication({
-			kind: "passkey",
-			walletId: args.pending.walletId,
-			rpId: args.pending.auth.rpId,
-			credentialIdB64u: args.pending.auth.credentialIdB64u,
-			credentialPublicKeyB64u: args.response.authMethod.credentialPublicKeyB64u,
-			transports: args.pending.auth.transports,
-			walletKeys
-		});
-	}
-	if (args.response.authMethod.kind !== "email_otp") throw new Error("ECDSA Email OTP registration publication has a different auth method");
-	const authority = parseEmailOtpWalletAuthAuthority(args.response.authority);
-	if (!authority) throw new Error("ECDSA Email OTP registration authority is invalid");
-	return await prepareWalletEcdsaRegistrationPublication({
-		kind: "email_otp",
-		walletId: args.pending.walletId,
-		email: args.pending.auth.email,
-		registrationAuthorityId: args.pending.auth.registrationAuthorityId,
-		authority,
-		walletKeys
-	});
-}
-function publicationInput(args) {
-	return {
-		pending: args.pending,
-		authority: args.response.authority,
-		foundingAuthority: {
-			authority: args.response.foundingAuthority,
-			authMethod: args.response.foundingAuthMethod
-		},
-		request: {
-			operation: args.pending.operation,
-			registrationCeremonyId: args.pending.registrationCeremonyId,
-			idempotencyKey: args.pending.idempotencyKey,
-			walletId: args.pending.walletId,
-			walletAuthMethodId: args.pending.walletAuthMethodId
-		},
-		walletSessionPublication: {
-			kind: "issued",
-			walletSession: args.session.session.wallet_session,
-			operationCredential: args.session.session.operation_credential
-		},
-		ecdsaContinuity: args.ecdsaContinuity,
-		registration: args.registration
-	};
-}
-async function resumePendingEcdsaRegistration(args) {
-	const response = await args.ports.activateWalletRegistration(pendingEcdsaActivateRequest(args.relayerUrl, args.pending));
-	const committed = await requireCommittedEcdsaRegistrationResponse({
-		pending: args.pending,
-		response
-	});
-	const responseWalletKeys = requireResponseWalletKeys(committed);
-	const unlockInput = {
-		relayerUrl: args.relayerUrl,
-		pending: args.pending,
-		response: committed,
-		walletKeys: responseWalletKeys,
-		exactMethod: args.exactMethod,
-		signingSurface: args.signingSurface
-	};
-	const unlocked = await args.ports.unlockPendingEcdsaRegistration(unlockInput);
-	const primaryKey = responseWalletKeys[0];
-	if (!primaryKey) throw new Error("ECDSA registration activation returned no primary key");
-	const authority = await walletAuthAuthorityRef({ authority: committed.authority });
-	const continuity = await prepareRegistrationContinuity({
-		authority,
-		chainTargets: nonEmptyChainTargets(responseWalletKeys),
-		walletId: String(args.pending.walletId),
-		keyHandle: primaryKey.keyHandle,
-		ecdsaThresholdKeyId: primaryKey.ecdsaThresholdKeyId,
-		signingRootId: primaryKey.signingRootId,
-		signingRootVersion: primaryKey.signingRootVersion,
-		relayerKeyId: primaryKey.relayerKeyId,
-		participantIds: primaryKey.participantIds,
-		publicCapability: primaryKey.publicCapability,
-		activationReceipt: committed.ecdsa.activation,
-		runtimePolicyScope: requireEcdsaProjection(committed).ecdsa.runtimePolicyScope,
-		readyStateBlobB64u: unlocked.readyStateBlobB64u,
-		publicFacts: unlocked.publicFacts
-	});
-	const finalizedRoleLocalMaterial = {
-		kind: "ecdsa_role_local_worker_handle_v1",
-		materialHandle: parseEcdsaRoleLocalMaterialHandle(continuity.roleLocalMaterialRef.durableMaterialRef),
-		bindingDigest: continuity.roleLocalMaterialRef.bindingDigest,
-		durableMaterialRef: continuity.roleLocalMaterialRef.durableMaterialRef
-	};
-	const walletKeys = await args.signingSurface.finalizeWalletRegistrationEcdsaSessions({
-		walletId: String(args.pending.walletId),
-		session: {
-			chainTargets: nonEmptyChainTargets(responseWalletKeys),
-			authority,
-			bootstrap: { applicationBindingDigestB64u: committed.ecdsa.bootstrap.applicationBindingDigestB64u },
-			roleLocalMaterial: finalizedRoleLocalMaterial,
-			materialActivation: continuity.roleLocalMaterialRef.materialActivation,
-			clientPublicFacts: {
-				contextBinding32B64u: unlocked.publicFacts.contextBinding32B64u,
-				derivationClientSharePublicKey33B64u: unlocked.publicFacts.derivationClientSharePublicKey33B64u,
-				clientVerifyingShareB64u: unlocked.publicFacts.clientVerifyingShare33B64u,
-				relayerPublicKey33B64u: unlocked.publicFacts.relayerPublicKey33B64u,
-				groupPublicKey33B64u: unlocked.publicFacts.groupPublicKey33B64u,
-				ethereumAddress: unlocked.publicFacts.ethereumAddress
-			},
-			publicCapability: primaryKey.publicCapability
-		},
-		walletKeys: responseWalletKeys
-	});
-	const registration = await prepareEcdsaRegistrationPublication({
-		pending: args.pending,
-		response: committed,
-		walletKeys
-	});
-	await args.ports.publishPendingWalletRegistrationCommit(publicationInput({
-		pending: args.pending,
-		response: committed,
-		registration,
-		session: unlocked.session,
-		ecdsaContinuity: continuity.publication
-	}));
-	return {
-		kind: "published",
-		registrationCeremonyId: args.pending.registrationCeremonyId,
-		walletId: committed.walletId,
-		sessionResult: "already_committed"
-	};
-}
-//#endregion
-export { resumePendingEcdsaRegistration };
-
-//# sourceMappingURL=pendingEcdsaRegistrationRecovery.js.map

package/dist/esm/react/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecoveryUnlock.js

@@ -1,247 +0,0 @@
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-import { joinNormalizedUrl } from "../../../shared-ts/src/utils/normalize.js";
-import { requireNonEmptyString, requireRecord } from "../../../shared-ts/src/utils/validation.js";
-import { DEFAULT_THRESHOLD_SESSION_POLICY } from "../../../core/signingEngine/threshold/sessionPolicy.js";
-import { SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
-import { parseThresholdEcdsaSessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletSessionMintId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../shared-ts/src/utils/emailOtpDomain.js";
-import { thresholdEcdsaChainTargetKey, toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
-import { verifyPasskeyWalletUnlock } from "../../../core/rpcClients/near/rpcCalls.js";
-import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
-import { joinCustodyJsonFromEstablishedCommitPayload } from "../../../core/signingEngine/walletCustody/registrationCeremony.js";
-import { buildFreshEmailOtpRoutePlan } from "../../../core/signingEngine/session/emailOtp/routePlan.js";
-import { unlockEmailOtpWallet } from "../../../core/signingEngine/session/emailOtp/walletUnlock.js";
-import { generateSessionId } from "../../../core/signingEngine/session/passkey/prfCache.js";
-import { requireEcdsaProjection } from "./pendingEcdsaRegistrationRecoveryValidation.js";
-import { passkeyCredentialIdB64uFromAuthentication, requirePasskeyPrfFirstB64u } from "../authMethods/passkey/ecdsaBootstrap.js";
-//#region src/SeamsWeb/operations/registration/pendingEcdsaRegistrationRecoveryUnlock.ts
-function requireParsedThresholdSessionId(value) {
-	const parsed = parseThresholdEcdsaSessionId(value);
-	if (!parsed.ok) throw new Error("ECDSA registration recovery could not create a session id");
-	return parsed.value;
-}
-function requireParsedWalletSessionMintId(value) {
-	const parsed = parseWalletSessionMintId(value);
-	if (!parsed.ok) throw new Error("ECDSA registration recovery could not create a Wallet Session mint id");
-	return parsed.value;
-}
-function buildEcdsaUnlockPolicy(args) {
-	return parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1({
-		kind: "router_ab_ecdsa_post_registration_session_activation_policy_v1",
-		key_handle: args.keyHandle,
-		session_policy: {
-			threshold_session_id: requireParsedThresholdSessionId(generateSessionId("threshold-ecdsa-registration-recovery")),
-			wallet_session_mint_id: requireParsedWalletSessionMintId(generateSessionId("wallet-session-mint")),
-			ttl_ms: DEFAULT_THRESHOLD_SESSION_POLICY.ttlMs,
-			remaining_uses: DEFAULT_THRESHOLD_SESSION_POLICY.remainingUses,
-			runtime_policy_scope: args.runtimePolicyScope
-		}
-	});
-}
-async function requestPasskeyUnlockChallenge(args) {
-	const response = await fetch(joinNormalizedUrl(args.relayerUrl, "/wallet/unlock/challenge"), {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			unlockBackend: "passkey",
-			userId: args.walletId,
-			rpId: args.rpId
-		})
-	});
-	const body = requireRecord(await response.json().catch(() => ({})), "Passkey unlock challenge response");
-	if (!response.ok || body.ok !== true) throw new Error(typeof body.message === "string" && body.message ? body.message : `wallet/unlock/challenge failed (HTTP ${response.status})`);
-	return {
-		challengeId: requireNonEmptyString(body.challengeId, "Passkey unlock challenge ID"),
-		challengeB64u: requireNonEmptyString(body.challengeB64u, "Passkey unlock challenge")
-	};
-}
-function isAuthenticatorTransport(value) {
-	return value === "ble" || value === "hybrid" || value === "internal" || value === "nfc" || value === "usb";
-}
-function exactPasskeyAllowCredential(credentialIdB64u, transports) {
-	return {
-		id: credentialIdB64u,
-		type: "public-key",
-		transports: transports.filter(isAuthenticatorTransport)
-	};
-}
-function assertIssuedEcdsaSessionMatchesRegistration(args) {
-	const walletSession = args.session.session.wallet_session;
-	if (walletSession.walletId !== args.pending.walletId || walletSession.authMethodId !== args.pending.walletAuthMethodId || walletSession.authorityId !== args.response.foundingAuthority.authorityId || walletSession.expiresAtMs !== args.session.session.expires_at_ms || walletSession.authorizationId !== args.session.session.authorization_id || walletSession.quotaId !== args.session.session.quota_id || args.session.session.remaining_uses <= 0 || args.session.session.expires_at_ms <= Date.now() || args.session.session.wallet_session_id !== args.session.session.operation_credential.walletSessionId || !sameRouterAbEcdsaDerivationPublicCapabilityV1(args.session.public_capability, args.walletKey.publicCapability)) throw new Error("ECDSA registration unlock did not issue the exact Wallet Session");
-}
-function assertCustodyContinuityMatchesRegistration(args) {
-	if (args.signers.length !== args.walletKeys.length) throw new Error("ECDSA registration unlock returned incomplete custody continuity");
-	const remainingTargets = /* @__PURE__ */ new Map();
-	for (const walletKey of args.walletKeys) {
-		const target = thresholdEcdsaChainTargetKey(walletKey.chainTarget);
-		if (remainingTargets.has(target)) throw new Error("ECDSA registration has duplicate custody targets");
-		remainingTargets.set(target, walletKey);
-	}
-	for (const signer of args.signers) {
-		const target = thresholdEcdsaChainTargetKey(signer.chainTarget);
-		const walletKey = remainingTargets.get(target);
-		if (!walletKey) throw new Error("ECDSA registration unlock returned an unknown target");
-		remainingTargets.delete(target);
-		if (signer.walletKey.walletId !== args.pending.walletId || signer.walletKey.keyHandle !== walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== walletKey.signingRootId || signer.walletKey.signingRootVersion !== walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== walletKey.relayerKeyId || signer.walletKey.contextBinding32B64u !== walletKey.contextBinding32B64u || signer.walletKey.derivationClientSharePublicKey33B64u !== walletKey.derivationClientSharePublicKey33B64u || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, args.response.ecdsa.activation)) throw new Error("ECDSA registration unlock returned different custody continuity");
-	}
-}
-function zeroizeArrayBuffer(buffer) {
-	new Uint8Array(buffer).fill(0);
-}
-async function unlockWithPasskey(args) {
-	if (args.pending.auth.kind !== "passkey") throw new Error("ECDSA registration passkey unlock has a different pending factor");
-	const primaryKey = args.walletKeys[0];
-	if (!primaryKey) throw new Error("ECDSA registration unlock has no primary wallet key");
-	const expectedOrigin = args.exactMethod.expectedOrigin.trim();
-	if (!expectedOrigin) throw new Error("ECDSA registration passkey unlock requires an origin");
-	const challenge = await requestPasskeyUnlockChallenge({
-		relayerUrl: args.relayerUrl,
-		walletId: String(args.pending.walletId),
-		rpId: args.pending.auth.rpId
-	});
-	const credential = await args.signingSurface.getAuthenticationCredentialsSerialized({
-		subjectId: String(args.pending.walletId),
-		challengeB64u: challenge.challengeB64u,
-		allowCredentials: [exactPasskeyAllowCredential(args.pending.auth.credentialIdB64u, args.pending.auth.transports)],
-		includeSecondPrfOutput: true
-	});
-	if (passkeyCredentialIdB64uFromAuthentication(credential) !== args.pending.auth.credentialIdB64u) throw new Error("ECDSA registration unlock returned a different Passkey credential");
-	const prfFirstB64u = requirePasskeyPrfFirstB64u(credential, "ECDSA registration recovery");
-	const verified = await verifyPasskeyWalletUnlock(args.relayerUrl, {
-		type: "passkey_assertion",
-		challengeId: challenge.challengeId,
-		walletId: String(args.pending.walletId),
-		webauthn_authentication: credential,
-		ed25519SessionRequest: { kind: "not_requested" },
-		expected_origin: expectedOrigin,
-		ecdsaSessionPolicy: buildEcdsaUnlockPolicy({
-			keyHandle: primaryKey.keyHandle,
-			runtimePolicyScope: requireEcdsaProjection(args.response).ecdsa.runtimePolicyScope
-		})
-	}, new WalletSessionStatusReadScope());
-	if (!verified.success) throw new Error(verified.error || "Passkey ECDSA registration unlock failed");
-	if (verified.ecdsaSession.kind !== "router_ab_ecdsa_post_registration_session_activated_v1" || !verified.ecdsaCustody || !verified.walletCustody) throw new Error("Passkey ECDSA registration unlock did not issue exact session custody");
-	assertIssuedEcdsaSessionMatchesRegistration({
-		pending: args.pending,
-		response: args.response,
-		session: verified.ecdsaSession,
-		walletKey: primaryKey
-	});
-	assertCustodyContinuityMatchesRegistration({
-		pending: args.pending,
-		response: args.response,
-		walletKeys: args.walletKeys,
-		signers: verified.ecdsaCustody.signers
-	});
-	const factorSecret = Uint8Array.from(base64UrlDecode(prfFirstB64u)).buffer;
-	try {
-		const rejoined = await args.signingSurface.rejoinWalletCustodyEvmFamilyKeySet({
-			walletId: String(args.pending.walletId),
-			custodyJson: joinCustodyJsonFromEstablishedCommitPayload(args.pending.localMaterial.custodyCommit),
-			factorSecret,
-			evmFamilySigningKeySlotId: primaryKey.evmFamilySigningKeySlotId,
-			applicationBindingDigestB64u: args.response.ecdsa.bootstrap.applicationBindingDigestB64u,
-			registeredClientRootPublicKey33B64u: primaryKey.derivationClientSharePublicKey33B64u,
-			relayerPublicIdentityJson: JSON.stringify({
-				relayerKeyId: primaryKey.relayerKeyId,
-				relayerPublicKey33B64u: primaryKey.relayerVerifyingShareB64u,
-				groupPublicKey33B64u: primaryKey.thresholdEcdsaPublicKeyB64u,
-				ethereumAddress: primaryKey.thresholdOwnerAddress,
-				relayerShareRetryCounter: primaryKey.relayerShareRetryCounter
-			})
-		});
-		return {
-			session: verified.ecdsaSession,
-			readyStateBlobB64u: rejoined.readyStateBlobB64u,
-			publicFacts: rejoined.publicFacts
-		};
-	} finally {
-		zeroizeArrayBuffer(factorSecret);
-	}
-}
-async function unlockWithEmailOtp(args) {
-	if (args.pending.auth.kind !== "email_otp") throw new Error("ECDSA registration Email OTP unlock has a different pending factor");
-	const primaryKey = args.walletKeys[0];
-	if (!primaryKey) throw new Error("ECDSA registration unlock has no primary wallet key");
-	const runtimePolicyScope = requireEcdsaProjection(args.response).ecdsa.runtimePolicyScope;
-	const verified = await unlockEmailOtpWallet({
-		walletSession: {
-			walletId: toWalletId(args.pending.walletId),
-			walletSessionUserId: String(args.pending.walletId)
-		},
-		authoritySelector: {
-			kind: "wallet_auth_method",
-			walletAuthMethodId: args.pending.walletAuthMethodId
-		},
-		relayUrl: args.relayerUrl,
-		groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-		routePlan: buildFreshEmailOtpRoutePlan({
-			freshRouteFamily: "login",
-			operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
-		}),
-		workerCtx: args.signingSurface.getSignerWorkerContext(),
-		verification: {
-			kind: "otp",
-			challengeId: args.exactMethod.challengeId,
-			otpCode: args.exactMethod.otpCode
-		},
-		runtimePolicyScope,
-		ecdsaSessionHandleBinding: {
-			keyHandle: primaryKey.keyHandle,
-			authSubjectId: args.pending.auth.providerSubject,
-			operation: "wallet_unlock",
-			chainTarget: primaryKey.chainTarget
-		},
-		ecdsaSessionPolicy: buildEcdsaUnlockPolicy({
-			keyHandle: primaryKey.keyHandle,
-			runtimePolicyScope
-		})
-	});
-	if (verified.operation !== "wallet_unlock") throw new Error("Email OTP ECDSA registration unlock returned the wrong operation");
-	assertIssuedEcdsaSessionMatchesRegistration({
-		pending: args.pending,
-		response: args.response,
-		session: verified.ecdsaSession,
-		walletKey: primaryKey
-	});
-	assertCustodyContinuityMatchesRegistration({
-		pending: args.pending,
-		response: args.response,
-		walletKeys: args.walletKeys,
-		signers: verified.ecdsaCustody.continuity.signers
-	});
-	return {
-		session: verified.ecdsaSession,
-		readyStateBlobB64u: verified.ecdsaCustody.readyStateBlobB64u,
-		publicFacts: verified.ecdsaCustody.publicFacts
-	};
-}
-async function unlockPendingEcdsaRegistration(args) {
-	switch (args.exactMethod.kind) {
-		case "passkey": return await unlockWithPasskey({
-			relayerUrl: args.relayerUrl,
-			pending: args.pending,
-			response: args.response,
-			walletKeys: args.walletKeys,
-			exactMethod: args.exactMethod,
-			signingSurface: args.signingSurface
-		});
-		case "email_otp": return await unlockWithEmailOtp({
-			relayerUrl: args.relayerUrl,
-			pending: args.pending,
-			response: args.response,
-			walletKeys: args.walletKeys,
-			exactMethod: args.exactMethod,
-			signingSurface: args.signingSurface
-		});
-		default:
-			args.exactMethod;
-			throw new Error(`Unsupported pending registration unlock method: ${String(args.exactMethod)}`);
-	}
-}
-//#endregion
-export { unlockPendingEcdsaRegistration };
-
-//# sourceMappingURL=pendingEcdsaRegistrationRecoveryUnlock.js.map