@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/sdk/operationFingerprint-CGZui5dR.js

@@ -1,55 +0,0 @@
-import { i as base64UrlEncode } from "./base64-Clm8C-e9.js";
-import { f as alphabetizeStringify, m as sha256BytesUtf8 } from "./chains-BMh3btVo.js";
-import { r as parseDigestB64u } from "./canonicalPrimitives-BTHWz80v.js";
-//#region ../shared-ts/src/authorization/operationFingerprint.ts
-const CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1 = "seams:authorization:capability-operation-fingerprint:v1";
-var CapabilityOperationEnvelopeProof = class {
-	retainProof() {
-		return true;
-	}
-	constructor(fields) {
-		this.retainProof();
-		this.tenantId = fields.tenantId;
-		this.principalId = fields.principalId;
-		this.capabilityId = fields.capabilityId;
-		this.operationId = fields.operationId;
-		this.operation = fields.operation;
-		this.digests = fields.digests;
-	}
-};
-function buildCapabilityOperationEnvelope(fields) {
-	return new CapabilityOperationEnvelopeProof({
-		tenantId: fields.tenantId,
-		principalId: fields.principalId,
-		capabilityId: fields.capabilityId,
-		operationId: fields.operationId,
-		operation: fields.operation,
-		digests: {
-			laneDigest: fields.digests.laneDigest,
-			intentDigest: fields.digests.intentDigest,
-			displayDigest: fields.digests.displayDigest
-		}
-	});
-}
-function canonicalCapabilityOperationFingerprintPreimageV1(envelope) {
-	return `${CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1}|${alphabetizeStringify({
-		tenantId: envelope.tenantId,
-		principalId: envelope.principalId,
-		capabilityId: envelope.capabilityId,
-		operationId: envelope.operationId,
-		operation: envelope.operation,
-		digests: envelope.digests
-	})}`;
-}
-async function computeCapabilityOperationFingerprintDigest(envelope) {
-	return parseCapabilityOperationFingerprintDigest(base64UrlEncode(await sha256BytesUtf8(canonicalCapabilityOperationFingerprintPreimageV1(envelope))));
-}
-function parseCapabilityOperationFingerprintDigest(value) {
-	return parseDigestB64u(value);
-}
-function parseSigningOperationFingerprintDigest(value) {
-	if (typeof value !== "string" || !value.startsWith("sha256:")) throw new Error("signing operation fingerprint must use the sha256: prefix");
-	return parseDigestB64u(value.slice(7));
-}
-//#endregion
-export { computeCapabilityOperationFingerprintDigest as n, parseSigningOperationFingerprintDigest as r, buildCapabilityOperationEnvelope as t };

package/dist/esm/sdk/passkey-custody-Bk1jAknm.js

@@ -1,487 +0,0 @@
-import { M as parseWebAuthnRpId, O as parseWalletId, T as parseWalletAuthMethodId, b as parseSigningLaneId, c as parseLaneShareEpoch, d as parseLinkedDeviceId, j as parseWebAuthnCredentialIdB64u, k as parseWalletKeyId, l as parseLinkDeviceSessionId, u as parseLinkedDeviceEnrollmentId, v as parsePasskeyEnvelopeId, x as parseThresholdEcdsaSessionId } from "./domainIds-lcrFg6Sa.js";
-import { _ as requireRecord } from "./validation-gat4LEKm.js";
-import { C as parseEnvelopeRevision, E as parseUnixMs, P as rejectUnknownFields, S as parseEnvelopeNonceB64u, T as parseSecp256k1CompressedPublicKeyB64u, b as parseEd25519PublicKeyB64u, v as requireEvmFamilySigningKeySlotId, x as parseEnvelopeCiphertextB64u, y as parseDigestField } from "./sessionPolicy-CHiilOAB.js";
-import { a as parseNearEd25519SigningKeyId } from "./registrationIds-DLSdEKSv.js";
-//#region ../shared-ts/src/passkey-custody/custodySecretBinding.ts
-/** The only derivation scheme owner custody supports. */
-const WALLET_SEED_DERIVATION_SCHEME_V1 = "wallet_seed_parallel_hkdf_sha256_v1";
-/** True when this binding covers owner custody rather than one lane's share. */
-function isWalletCustodySeedBinding(binding) {
-	return binding.kind === "wallet_custody_seed_v1";
-}
-function buildWalletCustodySeedBinding() {
-	return {
-		kind: "wallet_custody_seed_v1",
-		derivationScheme: WALLET_SEED_DERIVATION_SCHEME_V1
-	};
-}
-function buildEd25519YaoClientRootBinding(args) {
-	return {
-		kind: "ed25519_yao_client_root_v1",
-		linkSessionId: args.linkSessionId,
-		walletKeyId: args.walletKeyId,
-		targetFactor: args.targetFactor,
-		applicationBindingDigestB64u: args.applicationBindingDigestB64u,
-		registeredPublicKeyB64u: args.registeredPublicKeyB64u,
-		enrollmentId: args.enrollmentId,
-		deviceId: args.deviceId,
-		revocationEpoch: args.revocationEpoch
-	};
-}
-function buildEd25519LaneHolderShareBinding(args) {
-	return {
-		kind: "ed25519_lane_holder_share_v1",
-		walletKeyId: args.walletKeyId,
-		laneId: args.laneId,
-		laneShareEpoch: args.laneShareEpoch,
-		nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-		registeredPublicKeyB64u: args.registeredPublicKeyB64u,
-		participantBindingDigestB64u: args.participantBindingDigestB64u
-	};
-}
-function buildEcdsaLaneHolderShareBinding(args) {
-	return {
-		kind: "ecdsa_lane_holder_share_v1",
-		walletKeyId: args.walletKeyId,
-		laneId: args.laneId,
-		laneShareEpoch: args.laneShareEpoch,
-		evmFamilySigningKeySlotId: args.evmFamilySigningKeySlotId,
-		thresholdSessionId: args.thresholdSessionId,
-		thresholdPublicKey33B64u: args.thresholdPublicKey33B64u
-	};
-}
-const LANE_SCOPE_FIELDS = [
-	"kind",
-	"walletKeyId",
-	"laneId",
-	"laneShareEpoch"
-];
-const ALLOWED_FIELDS_BY_KIND = {
-	wallet_custody_seed_v1: ["kind", "derivationScheme"],
-	ed25519_yao_client_root_v1: [
-		"kind",
-		"linkSessionId",
-		"walletKeyId",
-		"targetFactor",
-		"applicationBindingDigestB64u",
-		"registeredPublicKeyB64u",
-		"enrollmentId",
-		"deviceId",
-		"revocationEpoch"
-	],
-	ed25519_lane_holder_share_v1: [
-		...LANE_SCOPE_FIELDS,
-		"nearEd25519SigningKeyId",
-		"registeredPublicKeyB64u",
-		"participantBindingDigestB64u"
-	],
-	ecdsa_lane_holder_share_v1: [
-		...LANE_SCOPE_FIELDS,
-		"evmFamilySigningKeySlotId",
-		"thresholdSessionId",
-		"thresholdPublicKey33B64u"
-	]
-};
-const ALL_BRANCH_FIELDS = Array.from(new Set(Object.values(ALLOWED_FIELDS_BY_KIND).flat()));
-function requireCustodySecretKind(value, label) {
-	if (value === "wallet_custody_seed_v1" || value === "ed25519_yao_client_root_v1" || value === "ed25519_lane_holder_share_v1" || value === "ecdsa_lane_holder_share_v1") return value;
-	throw new Error(`${label}.kind must be a known passkey custody secret kind`);
-}
-function requireNonNegativeSafeInteger(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	return value;
-}
-function parseEd25519YaoClientRootTargetFactor(value, label) {
-	const record = requireRecord(value, label);
-	rejectUnknownFields(record, ["kind"], label);
-	if (record.kind === "passkey_prf" || record.kind === "email_otp") return { kind: record.kind };
-	throw new Error(`${label}.kind must be passkey_prf or email_otp`);
-}
-function requireLaneScope(record, label) {
-	const walletKeyId = parseWalletKeyId(record.walletKeyId);
-	if (!walletKeyId.ok) throw new Error(`${label}.walletKeyId ${walletKeyId.error.message}`);
-	const laneId = parseSigningLaneId(record.laneId);
-	if (!laneId.ok) throw new Error(`${label}.laneId ${laneId.error.message}`);
-	const laneShareEpoch = parseLaneShareEpoch(record.laneShareEpoch);
-	if (!laneShareEpoch.ok) throw new Error(`${label}.laneShareEpoch ${laneShareEpoch.error.message}`);
-	return {
-		walletKeyId: walletKeyId.value,
-		laneId: laneId.value,
-		laneShareEpoch: laneShareEpoch.value
-	};
-}
-function requireThresholdEcdsaSessionId(value, label) {
-	const parsed = parseThresholdEcdsaSessionId(value);
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
-/**
-* Parses one raw persistence or wire shape into an exact custody-secret branch.
-* Cross-branch fields, unknown fields, and plaintext-secret fields are rejected
-* rather than dropped, so a mismatched record can never be narrowed into a
-* branch it does not satisfy.
-*/
-function parsePasskeyCustodySecretBinding(raw, label = "passkeyCustodySecretBinding") {
-	const record = requireRecord(raw, label);
-	const kind = requireCustodySecretKind(record.kind, label);
-	rejectUnknownFields(record, ALLOWED_FIELDS_BY_KIND[kind], label, ALL_BRANCH_FIELDS);
-	switch (kind) {
-		case "wallet_custody_seed_v1":
-			if (record.derivationScheme !== WALLET_SEED_DERIVATION_SCHEME_V1) throw new Error(`${label}.derivationScheme must be ${WALLET_SEED_DERIVATION_SCHEME_V1}`);
-			return buildWalletCustodySeedBinding();
-		case "ed25519_yao_client_root_v1": {
-			const linkSessionId = parseLinkDeviceSessionId(record.linkSessionId);
-			if (!linkSessionId.ok) throw new Error(`${label}.linkSessionId ${linkSessionId.error.message}`);
-			const walletKeyId = parseWalletKeyId(record.walletKeyId);
-			if (!walletKeyId.ok) throw new Error(`${label}.walletKeyId ${walletKeyId.error.message}`);
-			const enrollmentId = parseLinkedDeviceEnrollmentId(record.enrollmentId);
-			if (!enrollmentId.ok) throw new Error(`${label}.enrollmentId ${enrollmentId.error.message}`);
-			const deviceId = parseLinkedDeviceId(record.deviceId);
-			if (!deviceId.ok) throw new Error(`${label}.deviceId ${deviceId.error.message}`);
-			return buildEd25519YaoClientRootBinding({
-				linkSessionId: linkSessionId.value,
-				walletKeyId: walletKeyId.value,
-				targetFactor: parseEd25519YaoClientRootTargetFactor(record.targetFactor, `${label}.targetFactor`),
-				applicationBindingDigestB64u: parseDigestField(record.applicationBindingDigestB64u, `${label}.applicationBindingDigestB64u`),
-				registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, `${label}.registeredPublicKeyB64u`),
-				enrollmentId: enrollmentId.value,
-				deviceId: deviceId.value,
-				revocationEpoch: requireNonNegativeSafeInteger(record.revocationEpoch, `${label}.revocationEpoch`)
-			});
-		}
-		case "ed25519_lane_holder_share_v1": {
-			const lane = requireLaneScope(record, label);
-			return buildEd25519LaneHolderShareBinding({
-				walletKeyId: lane.walletKeyId,
-				laneId: lane.laneId,
-				laneShareEpoch: lane.laneShareEpoch,
-				nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(record.nearEd25519SigningKeyId),
-				registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, `${label}.registeredPublicKeyB64u`),
-				participantBindingDigestB64u: parseDigestField(record.participantBindingDigestB64u, `${label}.participantBindingDigestB64u`)
-			});
-		}
-		case "ecdsa_lane_holder_share_v1": {
-			const lane = requireLaneScope(record, label);
-			return buildEcdsaLaneHolderShareBinding({
-				walletKeyId: lane.walletKeyId,
-				laneId: lane.laneId,
-				laneShareEpoch: lane.laneShareEpoch,
-				evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(record.evmFamilySigningKeySlotId, `${label}.evmFamilySigningKeySlotId`),
-				thresholdSessionId: requireThresholdEcdsaSessionId(record.thresholdSessionId, `${label}.thresholdSessionId`),
-				thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.thresholdPublicKey33B64u, `${label}.thresholdPublicKey33B64u`)
-			});
-		}
-	}
-}
-//#endregion
-//#region ../shared-ts/src/passkey-custody/custodyEnvelope.ts
-const WALLET_CUSTODY_ENVELOPE_VERSION_V2 = "wallet_custody_envelope_v2";
-const PASSKEY_PRF_KEK_VERSION_V1 = "passkey_prf_kek_hkdf_sha256_v1";
-const EMAIL_OTP_FACTOR_KEK_VERSION_V1 = "email_otp_factor_kek_hkdf_sha256_v1";
-const ENVELOPE_OWNERSHIP_FIELDS = ["kind", "walletAuthMethodId"];
-function parseWalletCustodyEnvelopeOwnership(raw, label) {
-	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${label} must be an object`);
-	const record = raw;
-	rejectUnknownFields(record, ENVELOPE_OWNERSHIP_FIELDS, label);
-	switch (record.kind) {
-		case "unbound":
-			if (record.walletAuthMethodId !== void 0) throw new Error(`${label}.walletAuthMethodId belongs to the method_bound branch`);
-			return { kind: "unbound" };
-		case "method_bound": {
-			const parsed = parseWalletAuthMethodId(record.walletAuthMethodId);
-			if (!parsed.ok) throw new Error(`${label}.walletAuthMethodId ${parsed.error.message}`);
-			return {
-				kind: "method_bound",
-				walletAuthMethodId: parsed.value
-			};
-		}
-		default: throw new Error(`${label}.kind must be unbound or method_bound`);
-	}
-}
-/**
-* The exact JSON `signer_core::PasskeyCustodyEnvelopeBindingV1` deserialises.
-*
-* Every caller that hands a binding to wasm must build it here. The Rust struct
-* uses `deny_unknown_fields` and now requires `ownership`, so a hand-rolled
-* object that omits it fails to deserialise — and that failure surfaces as an
-* unopenable envelope, not a type error.
-*/
-function custodyEnvelopeBindingJsonV1(envelope) {
-	return JSON.stringify({
-		walletId: envelope.walletId,
-		envelopeId: envelope.envelopeId,
-		factor: envelope.factor,
-		envelopeRevision: envelope.envelopeRevision,
-		binding: envelope.binding,
-		ownership: custodyEnvelopeOwnershipWireV1(envelope.ownership)
-	});
-}
-/**
-* Reads the serde shape back — the inverse of `custodyEnvelopeOwnershipWireV1`.
-*
-* The record shape and the wire shape are deliberately different: one is
-* TypeScript's tagged union, the other is what `serde` emits for a Rust enum.
-* Anything that came out of wasm carries the wire shape, and passing it to the
-* record parser would reject a perfectly valid ownership for having no `kind`.
-*/
-function parseWalletCustodyEnvelopeOwnershipWireV1(raw, label) {
-	if (raw === "unbound") return { kind: "unbound" };
-	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error(`${label} must be "unbound" or a methodBound object`);
-	const record = raw;
-	rejectUnknownFields(record, ["methodBound"], label);
-	const methodBound = record.methodBound;
-	if (typeof methodBound !== "object" || methodBound === null || Array.isArray(methodBound)) throw new Error(`${label}.methodBound must be an object`);
-	const fields = methodBound;
-	rejectUnknownFields(fields, ["walletAuthMethodId"], `${label}.methodBound`);
-	const parsed = parseWalletAuthMethodId(fields.walletAuthMethodId);
-	if (!parsed.ok) throw new Error(`${label}.methodBound.walletAuthMethodId ${parsed.error.message}`);
-	return {
-		kind: "method_bound",
-		walletAuthMethodId: parsed.value
-	};
-}
-/** Serde's shape for the ownership enum: a bare string, or a one-key object. */
-function custodyEnvelopeOwnershipWireV1(ownership) {
-	switch (ownership.kind) {
-		case "unbound": return "unbound";
-		case "method_bound": return { methodBound: { walletAuthMethodId: String(ownership.walletAuthMethodId) } };
-		default: throw new Error(`Unhandled custody envelope ownership: ${String(ownership)}`);
-	}
-}
-function buildMethodBoundEnvelopeOwnership(walletAuthMethodId) {
-	return {
-		kind: "method_bound",
-		walletAuthMethodId
-	};
-}
-function buildPasskeyEnvelopeFactor(args) {
-	return {
-		kind: "passkey",
-		rpId: args.rpId,
-		credentialIdB64u: args.credentialIdB64u,
-		kekVersion: PASSKEY_PRF_KEK_VERSION_V1
-	};
-}
-function buildEmailOtpEnvelopeFactor(args) {
-	return {
-		kind: "email_otp",
-		enrollmentId: args.enrollmentId,
-		enrollmentSealKeyVersion: args.enrollmentSealKeyVersion,
-		kekVersion: EMAIL_OTP_FACTOR_KEK_VERSION_V1
-	};
-}
-function buildActiveEnvelopeLifecycle(args) {
-	return {
-		state: "active",
-		activatedAtMs: args.activatedAtMs
-	};
-}
-function buildRetiredEnvelopeLifecycle(args) {
-	return {
-		state: "retired",
-		activatedAtMs: args.activatedAtMs,
-		retiredAtMs: args.retiredAtMs
-	};
-}
-function buildRevokedEnvelopeLifecycle(args) {
-	return {
-		state: "revoked",
-		activatedAtMs: args.activatedAtMs,
-		revokedAtMs: args.revokedAtMs
-	};
-}
-function buildPasskeyCustodyEnvelopeRecord(args) {
-	return {
-		kind: "wallet_custody_envelope_v2",
-		envelopeId: args.envelopeId,
-		walletId: args.walletId,
-		ownership: args.ownership,
-		binding: args.binding,
-		factor: args.factor,
-		envelopeVersion: WALLET_CUSTODY_ENVELOPE_VERSION_V2,
-		envelopeRevision: args.envelopeRevision,
-		nonceB64u: args.nonceB64u,
-		sealedCustodySecretB64u: args.sealedCustodySecretB64u,
-		ciphertextDigestB64u: args.ciphertextDigestB64u,
-		aadHashB64u: args.aadHashB64u,
-		lifecycle: args.lifecycle,
-		createdAtMs: args.createdAtMs,
-		updatedAtMs: args.updatedAtMs
-	};
-}
-const ENVELOPE_LIFECYCLE_FIELDS = [
-	"state",
-	"activatedAtMs",
-	"retiredAtMs",
-	"revokedAtMs"
-];
-function parsePasskeyCustodyEnvelopeLifecycle(raw, label = "lifecycle") {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, ENVELOPE_LIFECYCLE_FIELDS, label);
-	const activatedAtMs = parseUnixMs(record.activatedAtMs, `${label}.activatedAtMs`);
-	switch (record.state) {
-		case "active":
-			if (record.retiredAtMs !== void 0 || record.revokedAtMs !== void 0) throw new Error(`${label} cannot be active and carry a retired or revoked timestamp`);
-			return buildActiveEnvelopeLifecycle({ activatedAtMs });
-		case "retired": {
-			if (record.revokedAtMs !== void 0) throw new Error(`${label} cannot be retired and carry a revoked timestamp`);
-			const retiredAtMs = parseUnixMs(record.retiredAtMs, `${label}.retiredAtMs`);
-			if (retiredAtMs < activatedAtMs) throw new Error(`${label}.retiredAtMs cannot precede activation`);
-			return buildRetiredEnvelopeLifecycle({
-				activatedAtMs,
-				retiredAtMs
-			});
-		}
-		case "revoked": {
-			if (record.retiredAtMs !== void 0) throw new Error(`${label} cannot be revoked and carry a retired timestamp`);
-			const revokedAtMs = parseUnixMs(record.revokedAtMs, `${label}.revokedAtMs`);
-			if (revokedAtMs < activatedAtMs) throw new Error(`${label}.revokedAtMs cannot precede activation`);
-			return buildRevokedEnvelopeLifecycle({
-				activatedAtMs,
-				revokedAtMs
-			});
-		}
-		default: throw new Error(`${label}.state must be active, retired, or revoked`);
-	}
-}
-const PASSKEY_FACTOR_FIELDS = [
-	"kind",
-	"rpId",
-	"credentialIdB64u",
-	"kekVersion"
-];
-const EMAIL_OTP_FACTOR_FIELDS = [
-	"kind",
-	"enrollmentId",
-	"enrollmentSealKeyVersion",
-	"kekVersion"
-];
-const ALL_FACTOR_FIELDS = Array.from(new Set([...PASSKEY_FACTOR_FIELDS, ...EMAIL_OTP_FACTOR_FIELDS]));
-function requireNonEmptyString(value, label) {
-	if (typeof value !== "string" || !value.trim()) throw new Error(`${label} is required`);
-	return value;
-}
-function parseWalletCustodyEnvelopeFactor(raw, label = "factor") {
-	const record = requireRecord(raw, label);
-	switch (record.kind) {
-		case "passkey": {
-			rejectUnknownFields(record, PASSKEY_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
-			if (record.kekVersion !== PASSKEY_PRF_KEK_VERSION_V1) throw new Error(`${label}.kekVersion must be ${PASSKEY_PRF_KEK_VERSION_V1}`);
-			const rpId = parseWebAuthnRpId(record.rpId);
-			if (!rpId.ok) throw new Error(`${label}.rpId ${rpId.error.message}`);
-			const credentialIdB64u = parseWebAuthnCredentialIdB64u(record.credentialIdB64u);
-			if (!credentialIdB64u.ok) throw new Error(`${label}.credentialIdB64u ${credentialIdB64u.error.message}`);
-			return buildPasskeyEnvelopeFactor({
-				rpId: rpId.value,
-				credentialIdB64u: credentialIdB64u.value
-			});
-		}
-		case "email_otp":
-			rejectUnknownFields(record, EMAIL_OTP_FACTOR_FIELDS, label, ALL_FACTOR_FIELDS);
-			if (record.kekVersion !== EMAIL_OTP_FACTOR_KEK_VERSION_V1) throw new Error(`${label}.kekVersion must be ${EMAIL_OTP_FACTOR_KEK_VERSION_V1}`);
-			return buildEmailOtpEnvelopeFactor({
-				enrollmentId: requireNonEmptyString(record.enrollmentId, `${label}.enrollmentId`),
-				enrollmentSealKeyVersion: requireNonEmptyString(record.enrollmentSealKeyVersion, `${label}.enrollmentSealKeyVersion`)
-			});
-		default: throw new Error(`${label}.kind must be passkey or email_otp`);
-	}
-}
-const ENVELOPE_RECORD_FIELDS = [
-	"kind",
-	"envelopeId",
-	"walletId",
-	"ownership",
-	"binding",
-	"factor",
-	"envelopeVersion",
-	"envelopeRevision",
-	"nonceB64u",
-	"sealedCustodySecretB64u",
-	"ciphertextDigestB64u",
-	"aadHashB64u",
-	"lifecycle",
-	"createdAtMs",
-	"updatedAtMs"
-];
-/**
-* Parses one raw server row, wire payload, or IndexedDB cache entry into the
-* exact envelope record. This is the single boundary: core custody code accepts
-* `PasskeyCustodyEnvelopeRecord`, never a raw shape.
-*/
-function parsePasskeyCustodyEnvelopeRecord(raw, label = "walletCustodyEnvelope") {
-	const record = requireRecord(raw, label);
-	if (record.kind !== "wallet_custody_envelope_v2") throw new Error(`${label}.kind must be ${WALLET_CUSTODY_ENVELOPE_VERSION_V2}`);
-	rejectUnknownFields(record, ENVELOPE_RECORD_FIELDS, label);
-	if (record.envelopeVersion !== "wallet_custody_envelope_v2") throw new Error(`${label}.envelopeVersion must be ${WALLET_CUSTODY_ENVELOPE_VERSION_V2}`);
-	const envelopeId = parsePasskeyEnvelopeId(record.envelopeId);
-	if (!envelopeId.ok) throw new Error(`${label}.envelopeId ${envelopeId.error.message}`);
-	const walletId = parseWalletId(record.walletId);
-	if (!walletId.ok) throw new Error(`${label}.walletId ${walletId.error.message}`);
-	const ownership = parseWalletCustodyEnvelopeOwnership(record.ownership, `${label}.ownership`);
-	const createdAtMs = parseUnixMs(record.createdAtMs, `${label}.createdAtMs`);
-	const updatedAtMs = parseUnixMs(record.updatedAtMs, `${label}.updatedAtMs`);
-	if (updatedAtMs < createdAtMs) throw new Error(`${label}.updatedAtMs cannot precede createdAtMs`);
-	return buildPasskeyCustodyEnvelopeRecord({
-		envelopeId: envelopeId.value,
-		walletId: walletId.value,
-		ownership,
-		binding: parsePasskeyCustodySecretBinding(record.binding, `${label}.binding`),
-		factor: parseWalletCustodyEnvelopeFactor(record.factor, `${label}.factor`),
-		envelopeRevision: parseEnvelopeRevision(record.envelopeRevision, `${label}.envelopeRevision`),
-		nonceB64u: parseEnvelopeNonceB64u(record.nonceB64u, `${label}.nonceB64u`),
-		sealedCustodySecretB64u: parseEnvelopeCiphertextB64u(record.sealedCustodySecretB64u, `${label}.sealedCustodySecretB64u`),
-		ciphertextDigestB64u: parseDigestField(record.ciphertextDigestB64u, `${label}.ciphertextDigestB64u`),
-		aadHashB64u: parseDigestField(record.aadHashB64u, `${label}.aadHashB64u`),
-		lifecycle: parsePasskeyCustodyEnvelopeLifecycle(record.lifecycle, `${label}.lifecycle`),
-		createdAtMs,
-		updatedAtMs
-	});
-}
-/** Two ownerships name the same owner. */
-function sameWalletCustodyEnvelopeOwnership(left, right) {
-	if (left.kind !== right.kind) return false;
-	if (left.kind === "unbound") return true;
-	return right.kind === "method_bound" && String(left.walletAuthMethodId) === String(right.walletAuthMethodId);
-}
-//#endregion
-//#region ../shared-ts/src/passkey-custody/ceremonyCommitPayload.ts
-function walletCustodyCommitPayloadWithRecoveryBackupAcknowledgement(payload) {
-	if (!payload.establishedCustody) throw new Error("only a custody-establishing commit issues recovery codes");
-	return {
-		...payload,
-		recoveryBackupAcknowledged: true
-	};
-}
-/**
-* Parses the outcome a registration response carries. Throws, because this runs
-* on the client against its own Gateway's response: an unrecognised custody
-* status is a version skew the client must not paper over by guessing.
-*/
-function parseWalletCustodyRegistrationOutcome(value, label) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} walletCustody must be an object`);
-	const record = value;
-	switch (record.status) {
-		case "not_requested":
-		case "committed":
-		case "custody_already_established": return { status: record.status };
-		case "joined": {
-			const digest = record.keyManifestDigestB64u;
-			if (typeof digest !== "string" || !digest) throw new Error(`${label} joined custody carries no key manifest digest`);
-			return {
-				status: "joined",
-				keyManifestDigestB64u: digest
-			};
-		}
-		case "rejected": {
-			const reason = record.reason;
-			if (typeof reason !== "string" || !reason) throw new Error(`${label} rejected custody carries no reason`);
-			return {
-				status: "rejected",
-				reason
-			};
-		}
-		default: throw new Error(`${label} walletCustody status is unrecognised`);
-	}
-}
-//#endregion
-export { buildEmailOtpEnvelopeFactor as a, buildPasskeyEnvelopeFactor as c, parsePasskeyCustodyEnvelopeRecord as d, parseWalletCustodyEnvelopeOwnershipWireV1 as f, isWalletCustodySeedBinding as h, buildActiveEnvelopeLifecycle as i, custodyEnvelopeBindingJsonV1 as l, buildEd25519YaoClientRootBinding as m, walletCustodyCommitPayloadWithRecoveryBackupAcknowledgement as n, buildMethodBoundEnvelopeOwnership as o, sameWalletCustodyEnvelopeOwnership as p, WALLET_CUSTODY_ENVELOPE_VERSION_V2 as r, buildPasskeyCustodyEnvelopeRecord as s, parseWalletCustodyRegistrationOutcome as t, custodyEnvelopeOwnershipWireV1 as u };