@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/react/shared-ts/src/near/nearClient.js

@@ -1,252 +0,0 @@
-import { errorMessage } from "../utils/errors.js";
-import { base64Decode, base64Encode } from "../utils/base64.js";
-import { secureRandomId } from "../utils/secureRandomId.js";
-import { isFunction } from "../utils/validation.js";
-import { decodeJsonRpcEnvelope } from "../utils/jsonRpc.js";
-import { decodeNearAccessKeyList, decodeNearAccessKeyView, decodeNearAccountView, decodeNearBlockReference, decodeNearCodeBase64, decodeNearContractCallResult, decodeNearFinalExecutionOutcome, parseNearContractResult } from "../utils/nearRpcResults.js";
-//#region ../shared-ts/src/near/nearClient.ts
-var RpcCallType = /* @__PURE__ */ function(RpcCallType) {
-	RpcCallType["Query"] = "query";
-	RpcCallType["View"] = "view";
-	RpcCallType["Send"] = "send_tx";
-	RpcCallType["Block"] = "block";
-	RpcCallType["Call"] = "call_function";
-	return RpcCallType;
-}(RpcCallType || {});
-const DEFAULT_SEND_WAIT_UNTIL = "EXECUTED_OPTIMISTIC";
-/** The wallet narrows the transaction, signature and nonce lease types. */
-var SignedTransaction = class SignedTransaction {
-	constructor(data) {
-		this.transaction = data.transaction;
-		this.signature = data.signature;
-		this.borsh_bytes = data.borsh_bytes;
-		if (data.nonceLease) this.nonceLease = data.nonceLease;
-		if (data.serverDispatch) this.serverDispatch = data.serverDispatch;
-	}
-	static fromPlain(input) {
-		return new SignedTransaction({
-			transaction: input.transaction,
-			signature: input.signature,
-			borsh_bytes: input.borsh_bytes,
-			...input.nonceLease ? { nonceLease: input.nonceLease } : {},
-			...input.serverDispatch ? { serverDispatch: input.serverDispatch } : {}
-		});
-	}
-	encode() {
-		return new Uint8Array(this.borsh_bytes).buffer;
-	}
-	base64Encode() {
-		return base64Encode(this.encode());
-	}
-};
-function toArrayBufferFromUnknownBytes(bytes) {
-	if (!bytes) return null;
-	if (Array.isArray(bytes)) return new Uint8Array(bytes).buffer;
-	if (ArrayBuffer.isView(bytes)) {
-		const view = bytes;
-		return view.buffer.slice(view.byteOffset, view.byteOffset + view.byteLength);
-	}
-	if (bytes instanceof ArrayBuffer) return bytes;
-	return null;
-}
-function encodeSignedTransactionBase64(signed) {
-	const maybeSigned = signed?.signedTransaction;
-	const txPayload = maybeSigned && typeof maybeSigned === "object" ? maybeSigned : signed;
-	const maybeBase64 = txPayload.base64Encode;
-	if (isFunction(maybeBase64)) return maybeBase64.call(txPayload);
-	const maybeEncode = txPayload.encode;
-	if (isFunction(maybeEncode)) return base64Encode(maybeEncode.call(txPayload));
-	const snakeBuf = toArrayBufferFromUnknownBytes(txPayload.borsh_bytes);
-	if (snakeBuf) return base64Encode(snakeBuf);
-	const camelBuf = toArrayBufferFromUnknownBytes(txPayload.borshBytes);
-	if (camelBuf) return base64Encode(camelBuf);
-	throw new Error("Invalid signed transaction payload: cannot serialize to base64");
-}
-var NearJsonRpcClient = class NearJsonRpcClient {
-	constructor(rpcUrl) {
-		this.rpcUrls = NearJsonRpcClient.normalizeRpcUrls(rpcUrl);
-	}
-	static normalizeRpcUrls(input) {
-		const normalized = (Array.isArray(input) ? input : input.split(/[\s,]+/).map((url) => url.trim()).filter(Boolean)).map((url) => {
-			try {
-				return new URL(url).toString();
-			} catch (err) {
-				const message = errorMessage(err) || `Invalid NEAR RPC URL: ${url}`;
-				throw new Error(message);
-			}
-		});
-		if (!normalized.length) throw new Error("NEAR RPC URL cannot be empty");
-		return Array.from(new Set(normalized));
-	}
-	/** The error for a non-2xx HTTP response. */
-	errorFromHttpStatus(response) {
-		return /* @__PURE__ */ new Error(`RPC request failed: ${response.status} ${response.statusText}`);
-	}
-	/**
-	* What a call rejects with when its request, response or decoding fails; the
-	* server reports every such failure as a NearRpcError.
-	*/
-	errorFromFailedCall(_operationName, error) {
-		return error;
-	}
-	/** Sends a transaction once; the wallet retries transient failures. */
-	sendWithRetry(send) {
-		return send();
-	}
-	/** Build a JSON-RPC 2.0 POST body (stringified). */
-	buildRequestBody(method, params) {
-		return JSON.stringify({
-			jsonrpc: "2.0",
-			id: secureRandomId("near-rpc", 32, "NEAR JSON-RPC request IDs"),
-			method,
-			params
-		});
-	}
-	/** Perform a single POST to one endpoint and decode its JSON-RPC envelope. */
-	async postOnce(url, requestBody) {
-		const response = await fetch(url, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: requestBody
-		});
-		if (!response.ok) throw this.errorFromHttpStatus(response);
-		const text = await response.text();
-		if (!text?.trim()) throw new Error("Empty response from RPC server");
-		const decoded = decodeJsonRpcEnvelope(JSON.parse(text));
-		if (!decoded.ok) throw new Error(`Invalid NEAR JSON-RPC response: ${decoded.error}`);
-		return decoded.value;
-	}
-	/** Try each configured RPC endpoint in order and return the first decoded envelope. */
-	async requestWithFallback(requestBody) {
-		let lastError;
-		for (const [index, url] of this.rpcUrls.entries()) try {
-			const result = await this.postOnce(url, requestBody);
-			if (index > 0) console.warn(`[NearClient] RPC succeeded via fallback: ${url}`);
-			return result;
-		} catch (err) {
-			lastError = err;
-			const remaining = index < this.rpcUrls.length - 1;
-			console.warn(`[NearClient] RPC call to ${url} failed${remaining ? ", trying next" : ""}: ${errorMessage(err) || "RPC request failed"}`);
-			if (!remaining) throw err instanceof Error ? err : new Error(String(err));
-		}
-		throw new Error(errorMessage(lastError) || "RPC request failed");
-	}
-	/** Unwrap an envelope while keeping the method result unknown. */
-	unwrapRpcResult(rpc, operationName) {
-		if (rpc.kind === "failure") throw this.errorFromRpc(operationName, rpc.error);
-		const result = rpc.result;
-		if (typeof result === "object" && result !== null && "error" in result) {
-			const wrappedError = Reflect.get(result, "error");
-			const msg = typeof wrappedError === "string" ? wrappedError : JSON.stringify(wrappedError);
-			throw this.errorFromWrappedResult(`${operationName} Error: ${msg}`);
-		}
-		return rpc.result;
-	}
-	/**
-	* Execute RPC call with proper error handling and result extraction
-	*/
-	async makeRpcCall(method, params, operationName, decodeResult) {
-		const requestBody = this.buildRequestBody(method, params);
-		try {
-			const rpc = await this.requestWithFallback(requestBody);
-			return decodeResult(this.unwrapRpcResult(rpc, operationName));
-		} catch (error) {
-			throw this.errorFromFailedCall(operationName, error);
-		}
-	}
-	async query(params, decodeResult) {
-		return this.makeRpcCall(RpcCallType.Query, params, "Query", decodeResult);
-	}
-	async viewAccessKey(accountId, publicKey, finalityQuery) {
-		const params = {
-			request_type: "view_access_key",
-			finality: finalityQuery?.finality || "final",
-			account_id: accountId,
-			public_key: publicKey
-		};
-		return this.makeRpcCall(RpcCallType.Query, params, "View Access Key", decodeNearAccessKeyView);
-	}
-	async viewAccessKeyList(accountId, finalityQuery) {
-		const params = {
-			request_type: "view_access_key_list",
-			finality: finalityQuery?.finality || "final",
-			account_id: accountId
-		};
-		return this.makeRpcCall(RpcCallType.Query, params, "View Access Key List", decodeNearAccessKeyList);
-	}
-	async viewAccount(accountId) {
-		const params = {
-			request_type: "view_account",
-			finality: "final",
-			account_id: accountId
-		};
-		return this.makeRpcCall(RpcCallType.Query, params, "View Account", decodeNearAccountView);
-	}
-	async viewCode(accountId, finalityQuery) {
-		const params = {
-			request_type: "view_code",
-			finality: finalityQuery?.finality || "final",
-			account_id: accountId
-		};
-		return base64Decode(await this.makeRpcCall(RpcCallType.Query, params, "View Code", decodeNearCodeBase64));
-	}
-	async viewBlock(params) {
-		return this.makeRpcCall(RpcCallType.Block, params, "View Block", decodeNearBlockReference);
-	}
-	async sendTransaction(signedTransaction, waitUntil = DEFAULT_SEND_WAIT_UNTIL) {
-		const params = {
-			signed_tx_base64: encodeSignedTransactionBase64(signedTransaction),
-			wait_until: waitUntil
-		};
-		return this.sendWithRetry(async () => {
-			const outcome = await this.makeRpcCall(RpcCallType.Send, params, "Send Transaction", decodeNearFinalExecutionOutcome);
-			const status = outcome.status;
-			if (status && typeof status === "object" && "Failure" in status) throw this.errorFromOutcome("Send Transaction", outcome, status.Failure);
-			return outcome;
-		});
-	}
-	async txStatus(txHash, senderAccountId) {
-		const params = {
-			tx_hash: txHash,
-			sender_account_id: senderAccountId
-		};
-		return this.makeRpcCall("EXPERIMENTAL_tx_status", params, "Tx Status", decodeNearFinalExecutionOutcome);
-	}
-	async callFunction(accountId, method, args, decodeResult, blockQuery) {
-		const rpcParams = {
-			request_type: "call_function",
-			...blockQuery ?? { finality: "final" },
-			account_id: accountId,
-			method_name: method,
-			args_base64: base64Encode(new TextEncoder().encode(JSON.stringify(args)).buffer)
-		};
-		return decodeResult(parseNearContractResult((await this.makeRpcCall(RpcCallType.Query, rpcParams, "View Function", decodeNearContractCallResult)).result));
-	}
-	async view(params) {
-		return this.callFunction(params.account, params.method, params.args, params.decodeResult);
-	}
-	async getAccessKeys({ account, block_id }) {
-		const params = {
-			request_type: "view_access_key_list",
-			account_id: account,
-			finality: "final"
-		};
-		if (block_id) {
-			params.block_id = block_id;
-			delete params.finality;
-		}
-		const accessKeyList = await this.makeRpcCall(RpcCallType.Query, params, "View Access Key List", decodeNearAccessKeyList);
-		const fullAccessKeys = [];
-		const functionCallAccessKeys = [];
-		for (const key of accessKeyList.keys) if (key.access_key.permission === "FullAccess") fullAccessKeys.push(key);
-		else if (key.access_key.permission && typeof key.access_key.permission === "object" && "FunctionCall" in key.access_key.permission) functionCallAccessKeys.push(key);
-		return {
-			fullAccessKeys,
-			functionCallAccessKeys
-		};
-	}
-};
-//#endregion
-export { NearJsonRpcClient, SignedTransaction, encodeSignedTransactionBase64 };
-
-//# sourceMappingURL=nearClient.js.map

package/dist/esm/react/shared-ts/src/passkey-custody/ceremonyCommitPayload.js

@@ -1,43 +0,0 @@
-//#region ../shared-ts/src/passkey-custody/ceremonyCommitPayload.ts
-function walletCustodyCommitPayloadWithRecoveryBackupAcknowledgement(payload) {
-	if (!payload.establishedCustody) throw new Error("only a custody-establishing commit issues recovery codes");
-	return {
-		...payload,
-		recoveryBackupAcknowledged: true
-	};
-}
-/**
-* Parses the outcome a registration response carries. Throws, because this runs
-* on the client against its own Gateway's response: an unrecognised custody
-* status is a version skew the client must not paper over by guessing.
-*/
-function parseWalletCustodyRegistrationOutcome(value, label) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} walletCustody must be an object`);
-	const record = value;
-	switch (record.status) {
-		case "not_requested":
-		case "committed":
-		case "custody_already_established": return { status: record.status };
-		case "joined": {
-			const digest = record.keyManifestDigestB64u;
-			if (typeof digest !== "string" || !digest) throw new Error(`${label} joined custody carries no key manifest digest`);
-			return {
-				status: "joined",
-				keyManifestDigestB64u: digest
-			};
-		}
-		case "rejected": {
-			const reason = record.reason;
-			if (typeof reason !== "string" || !reason) throw new Error(`${label} rejected custody carries no reason`);
-			return {
-				status: "rejected",
-				reason
-			};
-		}
-		default: throw new Error(`${label} walletCustody status is unrecognised`);
-	}
-}
-//#endregion
-export { parseWalletCustodyRegistrationOutcome, walletCustodyCommitPayloadWithRecoveryBackupAcknowledgement };
-
-//# sourceMappingURL=ceremonyCommitPayload.js.map

package/dist/esm/react/shared-ts/src/passkey-custody/custodyEnvelope.js

@@ -1,278 +0,0 @@
-import { requireRecord } from "../utils/validation.js";
-import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseUnixMs } from "./primitives.js";
-import { parsePasskeyCustodySecretBinding } from "./custodySecretBinding.js";
-//#region ../shared-ts/src/passkey-custody/custodyEnvelope.ts
-const WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";
-const PASSKEY_PRF_KEK_VERSION_V1 = "passkey_prf_kek_hkdf_sha256_v1";
-const EMAIL_OTP_FACTOR_KEK_VERSION_V1 = "email_otp_factor_kek_hkdf_sha256_v1";
-const ENVELOPE_OWNERSHIP_FIELDS = ["kind", "walletAuthMethodId"];
-function parseWalletCustodyEnvelopeOwnership(raw, label) {
-	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${label} must be an object`);
-	const record = raw;
-	rejectUnknownFields(record, ENVELOPE_OWNERSHIP_FIELDS, label);
-	switch (record.kind) {
-		case "unbound":
-			if (record.walletAuthMethodId !== void 0) throw new Error(`${label}.walletAuthMethodId belongs to the method_bound branch`);
-			return { kind: "unbound" };
-		case "method_bound": {
-			const parsed = parseWalletAuthMethodId(record.walletAuthMethodId);
-			if (!parsed.ok) throw new Error(`${label}.walletAuthMethodId ${parsed.error.message}`);
-			return {
-				kind: "method_bound",
-				walletAuthMethodId: parsed.value
-			};
-		}
-		default: throw new Error(`${label}.kind must be unbound or method_bound`);
-	}
-}
-/**
-* The exact JSON `signer_core::PasskeyCustodyEnvelopeBindingV1` deserialises.
-*
-* Every caller that hands a binding to wasm must build it here. The Rust struct
-* uses `deny_unknown_fields` and now requires `ownership`, so a hand-rolled
-* object that omits it fails to deserialise — and that failure surfaces as an
-* unopenable envelope, not a type error.
-*/
-function custodyEnvelopeBindingJsonV1(envelope) {
-	return JSON.stringify({
-		walletId: envelope.walletId,
-		envelopeId: envelope.envelopeId,
-		factor: envelope.factor,
-		envelopeRevision: envelope.envelopeRevision,
-		binding: envelope.binding,
-		ownership: custodyEnvelopeOwnershipWireV1(envelope.ownership)
-	});
-}
-/**
-* Reads the serde shape back — the inverse of `custodyEnvelopeOwnershipWireV1`.
-*
-* The record shape and the wire shape are deliberately different: one is
-* TypeScript's tagged union, the other is what `serde` emits for a Rust enum.
-* Anything that came out of wasm carries the wire shape, and passing it to the
-* record parser would reject a perfectly valid ownership for having no `kind`.
-*/
-function parseWalletCustodyEnvelopeOwnershipWireV1(raw, label) {
-	if (raw === "unbound") return { kind: "unbound" };
-	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${label} must be "unbound" or a methodBound object`);
-	const record = raw;
-	rejectUnknownFields(record, ["methodBound"], label);
-	const methodBound = record.methodBound;
-	if (typeof methodBound !== "object" || methodBound === null || Array.isArray(methodBound)) throw new Error(`${label}.methodBound must be an object`);
-	const fields = methodBound;
-	rejectUnknownFields(fields, ["walletAuthMethodId"], `${label}.methodBound`);
-	const parsed = parseWalletAuthMethodId(fields.walletAuthMethodId);
-	if (!parsed.ok) throw new Error(`${label}.methodBound.walletAuthMethodId ${parsed.error.message}`);
-	return {
-		kind: "method_bound",
-		walletAuthMethodId: parsed.value
-	};
-}
-/** Serde's shape for the ownership enum: a bare string, or a one-key object. */
-function custodyEnvelopeOwnershipWireV1(ownership) {
-	switch (ownership.kind) {
-		case "unbound": return "unbound";
-		case "method_bound": return { methodBound: { walletAuthMethodId: String(ownership.walletAuthMethodId) } };
-		default: throw new Error(`Unhandled custody envelope ownership: ${String(ownership)}`);
-	}
-}
-function buildMethodBoundEnvelopeOwnership(walletAuthMethodId) {
-	return {
-		kind: "method_bound",
-		walletAuthMethodId
-	};
-}
-function buildPasskeyEnvelopeFactor(args) {
-	return {
-		kind: "passkey",
-		rpId: args.rpId,
-		credentialIdB64u: args.credentialIdB64u,
-		kekVersion: PASSKEY_PRF_KEK_VERSION_V1
-	};
-}
-function buildEmailOtpEnvelopeFactor(args) {
-	return {
-		kind: "email_otp",
-		enrollmentId: args.enrollmentId,
-		enrollmentSealKeyVersion: args.enrollmentSealKeyVersion,
-		kekVersion: EMAIL_OTP_FACTOR_KEK_VERSION_V1
-	};
-}
-function buildActiveEnvelopeLifecycle(args) {
-	return {
-		state: "active",
-		activatedAtMs: args.activatedAtMs
-	};
-}
-function buildRetiredEnvelopeLifecycle(args) {
-	return {
-		state: "retired",
-		activatedAtMs: args.activatedAtMs,
-		retiredAtMs: args.retiredAtMs
-	};
-}
-function buildRevokedEnvelopeLifecycle(args) {
-	return {
-		state: "revoked",
-		activatedAtMs: args.activatedAtMs,
-		revokedAtMs: args.revokedAtMs
-	};
-}
-function buildPasskeyCustodyEnvelopeRecord(args) {
-	return {
-		kind: "wallet_custody_envelope_v2",
-		envelopeId: args.envelopeId,
-		walletId: args.walletId,
-		ownership: args.ownership,
-		binding: args.binding,
-		factor: args.factor,
-		envelopeVersion: WALLET_CUSTODY_ENVELOPE_VERSION_V2,
-		envelopeRevision: args.envelopeRevision,
-		nonceB64u: args.nonceB64u,
-		sealedCustodySecretB64u: args.sealedCustodySecretB64u,
-		ciphertextDigestB64u: args.ciphertextDigestB64u,
-		aadHashB64u: args.aadHashB64u,
-		lifecycle: args.lifecycle,
-		createdAtMs: args.createdAtMs,
-		updatedAtMs: args.updatedAtMs
-	};
-}
-const ENVELOPE_LIFECYCLE_FIELDS = [
-	"state",
-	"activatedAtMs",
-	"retiredAtMs",
-	"revokedAtMs"
-];
-function parsePasskeyCustodyEnvelopeLifecycle(raw, label = "lifecycle") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, ENVELOPE_LIFECYCLE_FIELDS, label);
-	const activatedAtMs = parseUnixMs(record.activatedAtMs, `${label}.activatedAtMs`);
-	switch (record.state) {
-		case "active":
-			if (record.retiredAtMs !== void 0 || record.revokedAtMs !== void 0) throw new Error(`${label} cannot be active and carry a retired or revoked timestamp`);
-			return buildActiveEnvelopeLifecycle({ activatedAtMs });
-		case "retired": {
-			if (record.revokedAtMs !== void 0) throw new Error(`${label} cannot be retired and carry a revoked timestamp`);
-			const retiredAtMs = parseUnixMs(record.retiredAtMs, `${label}.retiredAtMs`);
-			if (retiredAtMs < activatedAtMs) throw new Error(`${label}.retiredAtMs cannot precede activation`);
-			return buildRetiredEnvelopeLifecycle({
-				activatedAtMs,
-				retiredAtMs
-			});
-		}
-		case "revoked": {
-			if (record.retiredAtMs !== void 0) throw new Error(`${label} cannot be revoked and carry a retired timestamp`);
-			const revokedAtMs = parseUnixMs(record.revokedAtMs, `${label}.revokedAtMs`);
-			if (revokedAtMs < activatedAtMs) throw new Error(`${label}.revokedAtMs cannot precede activation`);
-			return buildRevokedEnvelopeLifecycle({
-				activatedAtMs,
-				revokedAtMs
-			});
-		}
-		default: throw new Error(`${label}.state must be active, retired, or revoked`);
-	}
-}
-const PASSKEY_FACTOR_FIELDS = [
-	"kind",
-	"rpId",
-	"credentialIdB64u",
-	"kekVersion"
-];
-const EMAIL_OTP_FACTOR_FIELDS = [
-	"kind",
-	"enrollmentId",
-	"enrollmentSealKeyVersion",
-	"kekVersion"
-];
-const ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS]));
-function requireNonEmptyString(value, label) {
-	if (typeof value !== "string" || !value.trim()) throw new Error(`${label} is required`);
-	return value;
-}
-function parseWalletCustodyEnvelopeFactor(raw, label = "factor") {
-	const record = requireRecord(raw, label);
-	switch (record.kind) {
-		case "passkey": {
-			rejectUnknownFields(record, PASSKEY_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
-			if (record.kekVersion !== PASSKEY_PRF_KEK_VERSION_V1) throw new Error(`${label}.kekVersion must be ${PASSKEY_PRF_KEK_VERSION_V1}`);
-			const rpId = parseWebAuthnRpId(record.rpId);
-			if (!rpId.ok) throw new Error(`${label}.rpId ${rpId.error.message}`);
-			const credentialIdB64u = parseWebAuthnCredentialIdB64u(record.credentialIdB64u);
-			if (!credentialIdB64u.ok) throw new Error(`${label}.credentialIdB64u ${credentialIdB64u.error.message}`);
-			return buildPasskeyEnvelopeFactor({
-				rpId: rpId.value,
-				credentialIdB64u: credentialIdB64u.value
-			});
-		}
-		case "email_otp":
-			rejectUnknownFields(record, EMAIL_OTP_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
-			if (record.kekVersion !== EMAIL_OTP_FACTOR_KEK_VERSION_V1) throw new Error(`${label}.kekVersion must be ${EMAIL_OTP_FACTOR_KEK_VERSION_V1}`);
-			return buildEmailOtpEnvelopeFactor({
-				enrollmentId: requireNonEmptyString(record.enrollmentId, `${label}.enrollmentId`),
-				enrollmentSealKeyVersion: requireNonEmptyString(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`)
-			});
-		default: throw new Error(`${label}.kind must be passkey or email_otp`);
-	}
-}
-const ENVELOPE_RECORD_FIELDS = [
-	"kind",
-	"envelopeId",
-	"walletId",
-	"ownership",
-	"binding",
-	"factor",
-	"envelopeVersion",
-	"envelopeRevision",
-	"nonceB64u",
-	"sealedCustodySecretB64u",
-	"ciphertextDigestB64u",
-	"aadHashB64u",
-	"lifecycle",
-	"createdAtMs",
-	"updatedAtMs"
-];
-/**
-* Parses one raw server row, wire payload, or IndexedDB cache entry into the
-* exact envelope record. This is the single boundary: core custody code accepts
-* `PasskeyCustodyEnvelopeRecord`, never a raw shape.
-*/
-function parsePasskeyCustodyEnvelopeRecord(raw, label = "walletCustodyEnvelope") {
-	const record = requireRecord(raw, label);
-	if (record.kind !== "wallet_custody_envelope_v2") throw new Error(`${label}.kind must be ${WALLET_CUSTODY_ENVELOPE_VERSION_V2}`);
-	rejectUnknownFields(record, ENVELOPE_RECORD_FIELDS, label);
-	if (record.envelopeVersion !== "wallet_custody_envelope_v2") throw new Error(`${label}.envelopeVersion must be ${WALLET_CUSTODY_ENVELOPE_VERSION_V2}`);
-	const envelopeId = parsePasskeyEnvelopeId(record.envelopeId);
-	if (!envelopeId.ok) throw new Error(`${label}.envelopeId ${envelopeId.error.message}`);
-	const walletId = parseWalletId(record.walletId);
-	if (!walletId.ok) throw new Error(`${label}.walletId ${walletId.error.message}`);
-	const ownership = parseWalletCustodyEnvelopeOwnership(record.ownership, `${label}.ownership`);
-	const createdAtMs = parseUnixMs(record.createdAtMs, `${label}.createdAtMs`);
-	const updatedAtMs = parseUnixMs(record.updatedAtMs, `${label}.updatedAtMs`);
-	if (updatedAtMs < createdAtMs) throw new Error(`${label}.updatedAtMs cannot precede createdAtMs`);
-	return buildPasskeyCustodyEnvelopeRecord({
-		envelopeId: envelopeId.value,
-		walletId: walletId.value,
-		ownership,
-		binding: parsePasskeyCustodySecretBinding(record.binding, `${label}.binding`),
-		factor: parseWalletCustodyEnvelopeFactor(record.factor, `${label}.factor`),
-		envelopeRevision: parseEnvelopeRevision(record.envelopeRevision, `${label}.envelopeRevision`),
-		nonceB64u: parseEnvelopeNonceB64u(record.nonceB64u, `${label}.nonceB64u`),
-		sealedCustodySecretB64u: parseEnvelopeCiphertextB64u(record.sealedCustodySecretB64u, `${label}.sealedCustodySecretB64u`),
-		ciphertextDigestB64u: parseDigestField(record.ciphertextDigestB64u, `${label}.ciphertextDigestB64u`),
-		aadHashB64u: parseDigestField(record.aadHashB64u, `${label}.aadHashB64u`),
-		lifecycle: parsePasskeyCustodyEnvelopeLifecycle(record.lifecycle, `${label}.lifecycle`),
-		createdAtMs,
-		updatedAtMs
-	});
-}
-/** Two ownerships name the same owner. */
-function sameWalletCustodyEnvelopeOwnership(left, right) {
-	if (left.kind !== right.kind) return false;
-	if (left.kind === "unbound") return true;
-	return right.kind === "method_bound" && String(left.walletAuthMethodId) === String(right.walletAuthMethodId);
-}
-//#endregion
-export { WALLET_CUSTODY_ENVELOPE_VERSION_V2, buildActiveEnvelopeLifecycle, buildEmailOtpEnvelopeFactor, buildMethodBoundEnvelopeOwnership, buildPasskeyCustodyEnvelopeRecord, buildPasskeyEnvelopeFactor, buildRevokedEnvelopeLifecycle, custodyEnvelopeBindingJsonV1, custodyEnvelopeOwnershipWireV1, parsePasskeyCustodyEnvelopeRecord, parseWalletCustodyEnvelopeFactor, parseWalletCustodyEnvelopeOwnershipWireV1, sameWalletCustodyEnvelopeOwnership };
-
-//# sourceMappingURL=custodyEnvelope.js.map