@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/sdk/walletRecoveryCommit-sjGNTHUj.js

@@ -1,2159 +0,0 @@
-import { A as parseWalletRecoveryOperationId, D as parseWalletAuthorityId, M as parseWebAuthnRpId, O as parseWalletId, S as parseThresholdEd25519SessionId, T as parseWalletAuthMethodId, j as parseWebAuthnCredentialIdB64u, o as parseEmailOtpChallengeId, s as parseEmailOtpProviderUserId } from "./domainIds-lcrFg6Sa.js";
-import { M as base58Encode, _ as requireRecord } from "./validation-gat4LEKm.js";
-import { i as base64UrlEncode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
-import { E as parseUnixMs, P as rejectUnknownFields, S as parseEnvelopeNonceB64u, T as parseSecp256k1CompressedPublicKeyB64u, b as parseEd25519PublicKeyB64u, h as normalizeRuntimePolicyScope, o as normalizeThresholdRuntimePolicyScope, v as requireEvmFamilySigningKeySlotId, w as parseKeyCreationSignerSlot, x as parseEnvelopeCiphertextB64u, y as parseDigestField } from "./sessionPolicy-CHiilOAB.js";
-import { Ct as routerAbMpcMaterialActivationRefFromWire, E as parseRouterAbEcdsaRegistrationActivationReceiptV1, W as buildEmailOtpWalletAuthAuthority, _t as parseSdkEcdsaDerivationSigningRootId, gt as ecdsaClientRootPublicKey33B64uFromString, ht as computeEcdsaDerivationRoleLocalRelayerKeyId, nt as walletAuthAuthorityRef, pt as parseEcdsaServerGeneration, v as parseRouterAbEcdsaDerivationPublicCapabilityV1, vt as parseSdkEcdsaDerivationSigningRootVersion, wt as routerAbMpcMaterialActivationRefToWire, xt as parseRouterAbMpcMaterialActivationRef, yt as parseSdkEcdsaDerivationThresholdKeyId } from "./ecdsaPresignLifecycle-BFOTNYCK.js";
-import { l as parseDeviceId } from "./capabilityKinds-hvYqa6S_.js";
-import { f as alphabetizeStringify, h as sha256HexUtf8 } from "./chains-BMh3btVo.js";
-import { a as parseWalletRecoveryEnvelopeEntry, f as parseRecoveryCodeReservationId, l as buildWalletRecoveryCommittedProjectionV1, n as parseWalletRecoveryEcdsaPossessionProofV1, t as parseWalletRecoveryEcdsaPossessionChallengeV1, u as parseWalletRecoveryCommittedProjectionV1 } from "./wallet-recovery-Bz9qKgaL.js";
-import { M as WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND, h as prepareWalletRecoveryPasskeyPublication, m as prepareWalletRecoveryEmailOtpPublication } from "./accountLifecycle-BAGG_rbk.js";
-import { t as toAccountId } from "./accountIds-DhIPGOSN.js";
-import { T as sameWalletAuthMethodRecordV2, p as sameVerifiedActiveWalletAuthorityV1 } from "./walletAuthority-BQBxgUBn.js";
-import { d as parsePasskeyCustodyEnvelopeRecord } from "./passkey-custody-Bk1jAknm.js";
-import { r as prepareWalletCustodyEcdsaContinuity, u as IndexedDBManager, x as pendingWalletRecoveryCommitIdentityMatches } from "./walletCustodyEcdsaContinuity-Hn4ORIbf.js";
-import { n as PASSKEY_PRF_SECOND_SALT_V1, t as PASSKEY_PRF_FIRST_SALT_V1 } from "./signingSessionSeal-Cu-GHm6y.js";
-import { n as parseEmailOtpChallengeDelivery } from "./challengeDelivery-Dd0586fo.js";
-import { o as redactedPasskeyRegistrationCredential } from "./helpers-ZrowMnev.js";
-import { C as buildEcdsaRoleLocalPublicFacts } from "./ecdsaCapabilityManifest-kzO_fW09.js";
-import { n as buildRelayerJsonPostRequestInit, r as normalizeRelayerBaseUrl } from "./relayerHttp-VC8Holz1.js";
-//#region ../shared-ts/src/wallet-recovery/walletRecoveryTarget.ts
-function parseWalletRecoveryTargetV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("wallet recovery target must be an object");
-	const record = raw;
-	const fields = Object.keys(record);
-	switch (record.kind) {
-		case "passkey": {
-			if (fields.length !== 2 || !fields.includes("rpId")) throw new Error("Passkey recovery target fields are invalid");
-			const rpId = parseWebAuthnRpId(record.rpId);
-			if (!rpId.ok) throw new Error("Passkey recovery target RP ID is invalid");
-			return {
-				kind: "passkey",
-				rpId: rpId.value
-			};
-		}
-		case "google_email_otp":
-			if (fields.length !== 2 || !fields.includes("googleProvider") || record.googleProvider !== "google") throw new Error("Google Email OTP recovery target fields are invalid");
-			return {
-				kind: "google_email_otp",
-				googleProvider: "google"
-			};
-		default: throw new Error("wallet recovery target kind is unsupported");
-	}
-}
-//#endregion
-//#region src/core/rpcClients/relayer/walletRecoveryPrepare.ts
-/**
-* Preparing an admitted wallet recovery.
-*
-* The response is ciphertext: a wrapped manifest KEK and the entry ciphertexts
-* it opens. The code never leaves this call, and the server cannot open what
-* it returns — it only matched a derived identifier against stored wraps.
-*
-* Unknown and malformed codes remain generic. A consumed code has a durable
-* locator tombstone and receives the distinct `consumed` result used by the
-* recovery menu.
-*
-* `conflict` is the exception worth distinguishing, because it is the one
-* failure where the same code is still worth trying again.
-*/
-const WALLET_RECOVERY_PREPARE_PATH = "/wallets/recovery/prepare";
-const WALLET_RECOVERY_PREPARE_COMMON_RESPONSE_FIELDS = [
-	"ok",
-	"walletId",
-	"target",
-	"recoveryOperationId",
-	"targetDeviceId",
-	"targetAuthorityId",
-	"targetWalletAuthMethodId",
-	"wrap",
-	"entries",
-	"keyManifest",
-	"reservationId",
-	"reservationExpiresAtMs",
-	"storeVersion"
-];
-const WALLET_RECOVERY_PREPARE_PASSKEY_RESPONSE_FIELDS = [...WALLET_RECOVERY_PREPARE_COMMON_RESPONSE_FIELDS, "registration"];
-function decodeJsonObject(raw, label) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${label} must be an object`);
-	return raw;
-}
-function assertExactJsonObjectKeys(value, fields, label) {
-	const expected = new Set(fields);
-	const actual = Object.keys(value);
-	if (actual.length !== expected.size || actual.some((field) => !expected.has(field))) throw new Error(`${label} contains unexpected fields`);
-}
-function decodeExactJsonObject(raw, fields, label) {
-	const value = decodeJsonObject(raw, label);
-	assertExactJsonObjectKeys(value, fields, label);
-	return value;
-}
-function readJsonField(value, field) {
-	return Object.prototype.hasOwnProperty.call(value, field) ? Reflect.get(value, field) : void 0;
-}
-function decodeJsonObjectOrNull(raw) {
-	try {
-		return decodeJsonObject(raw, "walletRecoveryPrepare response");
-	} catch {
-		return null;
-	}
-}
-/**
-* Builds the only recovery-custody wire accepted by the ceremony WASM.
-*
-* The recovery key id and code are absent. Rust derives the id from the code
-* bytes supplied through the worker's separate secret field, so serialized
-* custody can contain only the reserved wrap and the wallet's single seed
-* entry.
-*/
-function buildWalletRecoveryCeremonyCustodyJson(args) {
-	const walletId = parseWalletId(args.walletId);
-	if (!walletId.ok) throw new Error(`wallet recovery ${walletId.error.message}`);
-	return JSON.stringify({
-		walletId: String(walletId.value),
-		wrap: args.prepared.wrap,
-		entry: args.prepared.entries[0]
-	});
-}
-async function prepareWalletRecoveryWithCode(args) {
-	const requested = await requestWalletRecoveryPrepare(args);
-	if (!requested.ok) return { kind: requested.kind };
-	return await parseWalletRecoveryPrepareResponse({
-		response: requested.response,
-		target: args.target,
-		reservationId: args.reservationId
-	});
-}
-async function requestWalletRecoveryPrepare(args) {
-	const url = `${normalizeRelayerBaseUrl(args.relayUrl)}${WALLET_RECOVERY_PREPARE_PATH}`;
-	const doFetch = args.fetchImpl || fetch;
-	try {
-		return {
-			ok: true,
-			response: await doFetch(url, buildRelayerJsonPostRequestInit({ body: {
-				recoveryCodeB64u: args.recoveryCodeB64u,
-				reservationId: args.reservationId,
-				target: args.target
-			} }))
-		};
-	} catch {
-		return {
-			ok: false,
-			kind: "transport_uncertain"
-		};
-	}
-}
-async function parseWalletRecoveryPrepareResponse(args) {
-	const response = args.response;
-	const body = decodeJsonObjectOrNull(await response.json().catch(() => ({})));
-	if (response.status === 200 && body && readJsonField(body, "ok") === true) try {
-		const preparedResponse = decodeExactJsonObject(body, args.target.kind === "passkey" ? WALLET_RECOVERY_PREPARE_PASSKEY_RESPONSE_FIELDS : WALLET_RECOVERY_PREPARE_COMMON_RESPONSE_FIELDS, "walletRecoveryPrepare");
-		const wrap = parsePreparedRecoveryWrap(readJsonField(preparedResponse, "wrap"));
-		const entries = parsePreparedRecoveryEntries(readJsonField(preparedResponse, "entries"));
-		const walletIdResult = parseWalletId(readJsonField(preparedResponse, "walletId"));
-		if (!walletIdResult.ok) throw new Error("walletRecoveryPrepare.walletId is invalid");
-		const walletId = walletIdResult.value;
-		const target = parseWalletRecoveryTargetV1(readJsonField(preparedResponse, "target"));
-		if (!recoveryTargetsMatch(target, args.target)) throw new Error("wallet recovery preparation changed the recovery target");
-		const recoveryOperationId = parseWalletRecoveryOperationId(readJsonField(preparedResponse, "recoveryOperationId"));
-		const targetDeviceId = parseDeviceId(readJsonField(preparedResponse, "targetDeviceId"));
-		const targetAuthorityId = parseWalletAuthorityId(readJsonField(preparedResponse, "targetAuthorityId"));
-		const targetWalletAuthMethodId = parseWalletAuthMethodId(readJsonField(preparedResponse, "targetWalletAuthMethodId"));
-		if (!recoveryOperationId.ok || !targetDeviceId.ok || !targetAuthorityId.ok || !targetWalletAuthMethodId.ok) throw new Error("wallet recovery preparation target identity is invalid");
-		const keyManifest = parseWalletRecoveryPreparationKeyManifest(readJsonField(preparedResponse, "keyManifest"), walletId);
-		const reservationId = parseRecoveryCodeReservationId(readJsonField(preparedResponse, "reservationId"));
-		const reservationExpiresAtMs = parseUnixMs(readJsonField(preparedResponse, "reservationExpiresAtMs"), "walletRecoveryPrepare.reservationExpiresAtMs");
-		const storeVersion = requireResponseString(readJsonField(preparedResponse, "storeVersion"), "storeVersion");
-		if (reservationId !== args.reservationId) throw new Error("wallet recovery preparation changed the reservation identity");
-		const common = {
-			kind: "prepared",
-			walletId,
-			recoveryOperationId: recoveryOperationId.value,
-			targetDeviceId: targetDeviceId.value,
-			targetAuthorityId: targetAuthorityId.value,
-			targetWalletAuthMethodId: targetWalletAuthMethodId.value,
-			wrap,
-			entries,
-			keyManifest,
-			reservationId,
-			reservationExpiresAtMs,
-			storeVersion
-		};
-		switch (target.kind) {
-			case "passkey": {
-				const registration = parseWalletRecoveryRegistrationOptions(readJsonField(preparedResponse, "registration"), String(walletId), target.rpId);
-				if (registration.walletAuthMethodId !== targetWalletAuthMethodId.value) throw new Error("wallet recovery registration changed the target auth method");
-				return {
-					...common,
-					target,
-					registration
-				};
-			}
-			case "google_email_otp":
-				if (Object.prototype.hasOwnProperty.call(preparedResponse, "registration")) throw new Error("Google Email OTP recovery cannot carry passkey registration");
-				return {
-					...common,
-					target
-				};
-			default: return assertNeverRecoveryTarget(target);
-		}
-	} catch {
-		return { kind: "transport_uncertain" };
-	}
-	if (response.status === 409) return { kind: "retryable_conflict" };
-	if (response.status === 401 && body && readJsonField(body, "code") === "recovery_code_used") return { kind: "consumed" };
-	if (response.status === 401 || response.status === 400) return { kind: "refused" };
-	return { kind: "transport_uncertain" };
-}
-function parseWalletRecoveryRegistrationOptions(raw, expectedWalletId, expectedRpId) {
-	const registration = decodeExactJsonObject(raw, [
-		"kind",
-		"challengeId",
-		"challengeB64u",
-		"replacementId",
-		"walletAuthMethodId",
-		"rpId",
-		"user",
-		"pubKeyCredParams",
-		"authenticatorSelection",
-		"timeoutMs",
-		"attestation",
-		"extensions",
-		"excludeCredentials"
-	], "walletRecoveryPrepare.registration");
-	if (readJsonField(registration, "kind") !== "webauthn_recovery_registration_v1") throw new Error("walletRecoveryPrepare.registration kind is invalid");
-	const challengeId = requireResponseString(readJsonField(registration, "challengeId"), "registration.challengeId");
-	const challengeB64u = requireCanonicalBytesB64u(readJsonField(registration, "challengeB64u"), 32, "registration.challengeB64u");
-	const replacementId = requireResponseString(readJsonField(registration, "replacementId"), "registration.replacementId");
-	const walletAuthMethodId = parseWalletAuthMethodId(readJsonField(registration, "walletAuthMethodId"));
-	if (!walletAuthMethodId.ok) throw new Error("walletRecoveryPrepare.registration.walletAuthMethodId is invalid");
-	const rpIdResult = parseWebAuthnRpId(readJsonField(registration, "rpId"));
-	if (!rpIdResult.ok) throw new Error("walletRecoveryPrepare.registration.rpId is invalid");
-	if (rpIdResult.value !== expectedRpId) throw new Error("walletRecoveryPrepare.registration changed the relying party");
-	const user = decodeExactJsonObject(readJsonField(registration, "user"), [
-		"idB64u",
-		"name",
-		"displayName"
-	], "walletRecoveryPrepare.registration.user");
-	const expectedUserIdB64u = base64UrlEncode(new TextEncoder().encode(expectedWalletId));
-	const idB64u = requireCanonicalNonEmptyB64u(readJsonField(user, "idB64u"), "registration.user.idB64u");
-	if (idB64u !== expectedUserIdB64u) throw new Error("walletRecoveryPrepare.registration user is bound to another wallet");
-	const name = requireResponseString(readJsonField(user, "name"), "registration.user.name");
-	const displayName = requireResponseString(readJsonField(user, "displayName"), "registration.user.displayName");
-	if (name !== expectedWalletId || displayName !== expectedWalletId) throw new Error("walletRecoveryPrepare.registration user labels changed the wallet identity");
-	const pubKeyCredParams = parseRecoveryPublicKeyParameters(readJsonField(registration, "pubKeyCredParams"));
-	const authenticatorSelection = parseRecoveryAuthenticatorSelection(readJsonField(registration, "authenticatorSelection"));
-	const timeoutMs = Number(readJsonField(registration, "timeoutMs"));
-	if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new Error("walletRecoveryPrepare.registration.timeoutMs is invalid");
-	if (readJsonField(registration, "attestation") !== "none") throw new Error("walletRecoveryPrepare.registration.attestation is invalid");
-	const extensions = parseRecoveryPrfExtensions(readJsonField(registration, "extensions"));
-	const excludeCredentials = parseRecoveryExcludeCredentials(readJsonField(registration, "excludeCredentials"));
-	return {
-		kind: "webauthn_recovery_registration_v1",
-		challengeId,
-		challengeB64u,
-		replacementId,
-		walletAuthMethodId: walletAuthMethodId.value,
-		rpId: rpIdResult.value,
-		user: {
-			idB64u,
-			name,
-			displayName
-		},
-		pubKeyCredParams,
-		authenticatorSelection,
-		timeoutMs,
-		attestation: "none",
-		extensions,
-		excludeCredentials
-	};
-}
-function parseRecoveryPrfExtensions(raw) {
-	const evaluation = decodeExactJsonObject(readJsonField(decodeExactJsonObject(readJsonField(decodeExactJsonObject(raw, ["prf"], "walletRecoveryPrepare.registration.extensions"), "prf"), ["eval"], "walletRecoveryPrepare.registration.extensions.prf"), "eval"), ["firstB64u", "secondB64u"], "walletRecoveryPrepare.registration.extensions.prf.eval");
-	const firstB64u = requireCanonicalBytesB64u(readJsonField(evaluation, "firstB64u"), PASSKEY_PRF_FIRST_SALT_V1.length, "registration.extensions.prf.eval.firstB64u");
-	const secondB64u = requireCanonicalBytesB64u(readJsonField(evaluation, "secondB64u"), PASSKEY_PRF_SECOND_SALT_V1.length, "registration.extensions.prf.eval.secondB64u");
-	if (firstB64u !== base64UrlEncode(PASSKEY_PRF_FIRST_SALT_V1) || secondB64u !== base64UrlEncode(PASSKEY_PRF_SECOND_SALT_V1)) throw new Error("walletRecoveryPrepare.registration PRF salts are unsupported");
-	return { prf: { eval: {
-		firstB64u,
-		secondB64u
-	} } };
-}
-function parseRecoveryPublicKeyParameters(raw) {
-	if (!Array.isArray(raw) || raw.length !== 2) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams is invalid");
-	const first = decodeExactJsonObject(raw[0], ["type", "alg"], "walletRecoveryPrepare.registration.pubKeyCredParams[0]");
-	const second = decodeExactJsonObject(raw[1], ["type", "alg"], "walletRecoveryPrepare.registration.pubKeyCredParams[1]");
-	if (readJsonField(first, "type") !== "public-key" || readJsonField(first, "alg") !== -7) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams[0] is invalid");
-	if (readJsonField(second, "type") !== "public-key" || readJsonField(second, "alg") !== -257) throw new Error("walletRecoveryPrepare.registration.pubKeyCredParams[1] is invalid");
-	return [{
-		type: "public-key",
-		alg: -7
-	}, {
-		type: "public-key",
-		alg: -257
-	}];
-}
-function parseRecoveryAuthenticatorSelection(raw) {
-	const selection = decodeExactJsonObject(raw, ["residentKey", "userVerification"], "walletRecoveryPrepare.registration.authenticatorSelection");
-	if (readJsonField(selection, "residentKey") !== "required" || readJsonField(selection, "userVerification") !== "preferred") throw new Error("walletRecoveryPrepare.registration.authenticatorSelection is invalid");
-	return {
-		residentKey: "required",
-		userVerification: "preferred"
-	};
-}
-function parseRecoveryExcludeCredentials(raw) {
-	if (!Array.isArray(raw)) throw new Error("walletRecoveryPrepare.registration.excludeCredentials is invalid");
-	return raw.map((entry, index) => {
-		const descriptor = decodeExactJsonObject(entry, ["type", "id"], `walletRecoveryPrepare.registration.excludeCredentials[${index}]`);
-		if (readJsonField(descriptor, "type") !== "public-key") throw new Error("walletRecoveryPrepare.registration.excludeCredentials type is invalid");
-		const parsedId = parseWebAuthnCredentialIdB64u(readJsonField(descriptor, "id"));
-		if (!parsedId.ok) throw new Error("walletRecoveryPrepare.registration.excludeCredentials id is invalid");
-		requireCanonicalNonEmptyB64u(parsedId.value, "registration.excludeCredentials.id");
-		return {
-			type: "public-key",
-			id: parsedId.value
-		};
-	});
-}
-function recoveryTargetsMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "passkey": return right.kind === "passkey" && left.rpId === right.rpId;
-		case "google_email_otp": return right.kind === "google_email_otp" && left.googleProvider === right.googleProvider;
-		default: return assertNeverRecoveryTarget(left);
-	}
-}
-function assertNeverRecoveryTarget(value) {
-	throw new Error(`unsupported wallet recovery target: ${String(value)}`);
-}
-const PREPARED_WRAP_FIELDS = [
-	"nonceB64u",
-	"wrappedManifestKekB64u",
-	"aadHashB64u"
-];
-function parsePreparedRecoveryWrap(raw) {
-	const wrap = decodeExactJsonObject(raw, PREPARED_WRAP_FIELDS, "walletRecoveryPrepare.wrap");
-	return {
-		nonceB64u: parseEnvelopeNonceB64u(readJsonField(wrap, "nonceB64u"), "walletRecoveryPrepare.wrap.nonceB64u"),
-		wrappedManifestKekB64u: parseEnvelopeCiphertextB64u(readJsonField(wrap, "wrappedManifestKekB64u"), "walletRecoveryPrepare.wrap.wrappedManifestKekB64u"),
-		aadHashB64u: parseDigestField(readJsonField(wrap, "aadHashB64u"), "walletRecoveryPrepare.wrap.aadHashB64u")
-	};
-}
-function parsePreparedRecoveryEntries(raw) {
-	if (!Array.isArray(raw) || raw.length !== 1) throw new Error("walletRecoveryPrepare.entries must contain exactly one custody seed");
-	return [parseWalletRecoveryEnvelopeEntry(raw[0], "walletRecoveryPrepare.entries[0]")];
-}
-function requireResponseString(raw, field) {
-	if (typeof raw !== "string" || !raw.trim()) throw new Error(`walletRecoveryPrepare.${field} must be a non-empty string`);
-	return raw.trim();
-}
-function parseWalletRecoveryPreparationKeyManifest(raw, expectedWalletId) {
-	const manifest = decodeExactJsonObject(raw, [
-		"version",
-		"walletId",
-		"entries"
-	], "walletRecoveryPrepare.keyManifest");
-	if (readJsonField(manifest, "version") !== "wallet_recovery_preparation_key_manifest_v1") throw new Error("walletRecoveryPrepare.keyManifest version is invalid");
-	const walletId = requireResponseString(readJsonField(manifest, "walletId"), "keyManifest.walletId");
-	if (walletId !== expectedWalletId) throw new Error("walletRecoveryPrepare.keyManifest changed the wallet identity");
-	const rawEntries = readJsonField(manifest, "entries");
-	if (!Array.isArray(rawEntries) || rawEntries.length === 0) throw new Error("walletRecoveryPrepare.keyManifest must contain a key set");
-	const entries = rawEntries.map((entry) => parseWalletRecoveryPreparationKeyManifestEntry(entry, walletId));
-	if (new Set(entries.map((entry) => entry.keySetId)).size !== entries.length) throw new Error("walletRecoveryPrepare.keyManifest contains duplicate key sets");
-	return {
-		version: "wallet_recovery_preparation_key_manifest_v1",
-		walletId,
-		entries
-	};
-}
-function parseWalletRecoveryPreparationKeyManifestEntry(raw, expectedWalletId) {
-	switch (readJsonField(decodeJsonObject(raw, "walletRecoveryPrepare.keyManifest.entries[]"), "kind")) {
-		case "near_ed25519": {
-			const exactEntry = decodeExactJsonObject(raw, [
-				"kind",
-				"keySetId",
-				"signerId",
-				"nearAccountId",
-				"recordedKeyManifestDigestB64u",
-				"recoveryBasis"
-			], "walletRecoveryPrepare.keyManifest.entries[].near_ed25519");
-			const signerId = requireResponseString(readJsonField(exactEntry, "signerId"), "keyManifest.entries[].signerId");
-			const suppliedKeySetId = requireResponseString(readJsonField(exactEntry, "keySetId"), "keyManifest.entries[].keySetId");
-			const keySetId = `near_ed25519:${signerId}`;
-			if (suppliedKeySetId !== keySetId) throw new Error("walletRecoveryPrepare NEAR key-set identity is inconsistent");
-			const nearAccountId = requireResponseString(readJsonField(exactEntry, "nearAccountId"), "keyManifest.entries[].nearAccountId");
-			const recoveryBasis = parseWalletRecoveryPreparationNearRecoveryBasis(readJsonField(exactEntry, "recoveryBasis"), expectedWalletId);
-			return {
-				kind: "near_ed25519",
-				keySetId,
-				signerId,
-				nearAccountId,
-				recordedKeyManifestDigestB64u: parseDigestField(readJsonField(exactEntry, "recordedKeyManifestDigestB64u"), "walletRecoveryPrepare.keyManifest.entries[].recordedKeyManifestDigestB64u"),
-				recoveryBasis
-			};
-		}
-		case "evm_family_ecdsa": {
-			const exactEntry = decodeExactJsonObject(raw, [
-				"kind",
-				"keySetId",
-				"keyHandle",
-				"evmFamilySigningKeySlotId",
-				"recordedKeyManifestDigestB64u",
-				"recoveryBasis"
-			], "walletRecoveryPrepare.keyManifest.entries[].evm_family_ecdsa");
-			const keyHandle = requireResponseString(readJsonField(exactEntry, "keyHandle"), "keyManifest.entries[].keyHandle");
-			const suppliedKeySetId = requireResponseString(readJsonField(exactEntry, "keySetId"), "keyManifest.entries[].keySetId");
-			const keySetId = `evm_family_ecdsa:${keyHandle}`;
-			if (suppliedKeySetId !== keySetId) throw new Error("walletRecoveryPrepare ECDSA key-set identity is inconsistent");
-			const recoveryBasis = parseWalletRecoveryPreparationEcdsaRecoveryBasis(readJsonField(exactEntry, "recoveryBasis"), expectedWalletId);
-			return {
-				kind: "evm_family_ecdsa",
-				keySetId,
-				keyHandle,
-				evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(readJsonField(exactEntry, "evmFamilySigningKeySlotId")),
-				recordedKeyManifestDigestB64u: parseDigestField(readJsonField(exactEntry, "recordedKeyManifestDigestB64u"), "walletRecoveryPrepare.keyManifest.entries[].recordedKeyManifestDigestB64u"),
-				recoveryBasis
-			};
-		}
-		default: throw new Error("walletRecoveryPrepare key-manifest entry kind is invalid");
-	}
-}
-function parseWalletRecoveryPreparationNearRecoveryBasis(raw, expectedWalletId) {
-	const basis = decodeExactJsonObject(raw, [
-		"capabilityKind",
-		"activeCapabilityBinding",
-		"scope",
-		"applicationBinding",
-		"participantIds",
-		"registeredPublicKey",
-		"runtimePolicyScope",
-		"activationTranscript",
-		"activationStateEpoch",
-		"signingWorkerVerifyingShare"
-	], "walletRecoveryPrepare.keyManifest.entries[].recoveryBasis");
-	const capabilityKind = readJsonField(basis, "capabilityKind");
-	if (capabilityKind !== "registration" && capabilityKind !== "recovery") throw new Error("walletRecoveryPrepare NEAR recovery capability kind is invalid");
-	const activeCapabilityBinding = requireByteArray(readJsonField(basis, "activeCapabilityBinding"), 32, "NEAR recovery active capability binding");
-	const scope = parseWalletRecoveryNearLifecycleScope(readJsonField(basis, "scope"));
-	const applicationBinding = parseWalletRecoveryNearApplicationBinding(readJsonField(basis, "applicationBinding"));
-	const participantIds = requireParticipantPair(readJsonField(basis, "participantIds"), "NEAR recovery participant IDs");
-	const registeredPublicKey = requireByteArray(readJsonField(basis, "registeredPublicKey"), 32, "NEAR recovery registered public key");
-	const runtimePolicyScope = parseWalletRecoveryRuntimePolicyScope(readJsonField(basis, "runtimePolicyScope"));
-	const activationTranscript = requireByteArray(readJsonField(basis, "activationTranscript"), 32, "NEAR recovery activation transcript");
-	const activationStateEpoch = Number(readJsonField(basis, "activationStateEpoch"));
-	if (!Number.isSafeInteger(activationStateEpoch) || activationStateEpoch <= 0) throw new Error("walletRecoveryPrepare NEAR recovery activation state epoch is invalid");
-	const signingWorkerVerifyingShare = requireByteArray(readJsonField(basis, "signingWorkerVerifyingShare"), 32, "NEAR recovery signing-worker verifying share");
-	if (applicationBinding.wallet_id !== expectedWalletId || scope.account_id !== expectedWalletId || scope.root_share_epoch !== runtimePolicyScope.signingRootVersion) throw new Error("walletRecoveryPrepare NEAR recovery basis changed its wallet scope");
-	return {
-		capabilityKind,
-		activeCapabilityBinding,
-		scope,
-		applicationBinding,
-		participantIds,
-		registeredPublicKey,
-		runtimePolicyScope,
-		activationTranscript,
-		activationStateEpoch,
-		signingWorkerVerifyingShare
-	};
-}
-function parseWalletRecoveryPreparationEcdsaRecoveryBasis(raw, expectedWalletId) {
-	const basis = decodeExactJsonObject(raw, [
-		"publicCapability",
-		"activationReceipt",
-		"serverGeneration",
-		"clientRootPublicKey33B64u",
-		"chainTargets",
-		"ecdsaThresholdKeyId",
-		"signingRootId",
-		"signingRootVersion",
-		"runtimePolicyScope",
-		"participantIds",
-		"possessionChallenge"
-	], "walletRecoveryPrepare.keyManifest.entries[].recoveryBasis");
-	const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(readJsonField(basis, "publicCapability"));
-	const activationReceipt = parseRouterAbEcdsaRegistrationActivationReceiptV1(readJsonField(basis, "activationReceipt"));
-	if (publicCapability.client_id !== expectedWalletId) throw new Error("walletRecoveryPrepare ECDSA recovery capability changed the wallet scope");
-	const signingRootId = parseSdkEcdsaDerivationSigningRootId(readJsonField(basis, "signingRootId"));
-	const signingRootVersion = parseSdkEcdsaDerivationSigningRootVersion(readJsonField(basis, "signingRootVersion"));
-	const runtimePolicyScope = parseWalletRecoveryRuntimePolicyScope(readJsonField(basis, "runtimePolicyScope"));
-	if (runtimePolicyScope.signingRootVersion !== signingRootVersion) throw new Error("walletRecoveryPrepare ECDSA recovery scope changed the signing root");
-	const serverGeneration = parseEcdsaServerGeneration(readJsonField(basis, "serverGeneration"));
-	if (String(activationReceipt.server_generation) !== String(serverGeneration)) throw new Error("walletRecoveryPrepare ECDSA activation receipt changed server generation");
-	const possessionChallenge = parseWalletRecoveryEcdsaPossessionChallengeV1(readJsonField(basis, "possessionChallenge"));
-	if (possessionChallenge.walletId !== expectedWalletId || possessionChallenge.expectedServerGeneration !== String(serverGeneration) || possessionChallenge.derivationClientSharePublicKey33B64u !== publicCapability.public_identity.derivation_client_share_public_key33_b64u) throw new Error("walletRecoveryPrepare ECDSA possession challenge changed its capability");
-	return {
-		publicCapability,
-		activationReceipt,
-		serverGeneration,
-		clientRootPublicKey33B64u: ecdsaClientRootPublicKey33B64uFromString(requireResponseString(readJsonField(basis, "clientRootPublicKey33B64u"), "keyManifest.entries[].recoveryBasis.clientRootPublicKey33B64u")),
-		chainTargets: parseWalletRecoveryEcdsaChainTargets(readJsonField(basis, "chainTargets")),
-		ecdsaThresholdKeyId: parseSdkEcdsaDerivationThresholdKeyId(readJsonField(basis, "ecdsaThresholdKeyId")),
-		signingRootId,
-		signingRootVersion,
-		runtimePolicyScope,
-		participantIds: parseWalletRecoveryEcdsaParticipantIds(readJsonField(basis, "participantIds")),
-		possessionChallenge
-	};
-}
-function parseWalletRecoveryEcdsaChainTargets(raw) {
-	if (!Array.isArray(raw) || raw.length === 0) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are invalid");
-	const targets = raw.map((value, index) => parseWalletRecoveryEcdsaChainTarget(value, index));
-	if (new Set(targets.map(walletRecoveryEcdsaChainTargetKey)).size !== targets.length) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are duplicated");
-	const first = targets[0];
-	if (!first) throw new Error("walletRecoveryPrepare ECDSA recovery chain targets are invalid");
-	return [first, ...targets.slice(1)];
-}
-function parseWalletRecoveryEcdsaChainTarget(raw, index) {
-	const label = `walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.chainTargets[${index}]`;
-	const target = decodeJsonObject(raw, label);
-	const kind = readJsonField(target, "kind");
-	assertExactJsonObjectKeys(target, kind === "evm" ? [
-		"kind",
-		"namespace",
-		"chainId",
-		"networkSlug"
-	] : [
-		"kind",
-		"chainId",
-		"networkSlug"
-	], label);
-	const namespace = readJsonField(target, "namespace");
-	const chainId = Number(readJsonField(target, "chainId"));
-	if (!Number.isSafeInteger(chainId) || chainId <= 0) throw new Error("walletRecoveryPrepare ECDSA recovery chain id is invalid");
-	const networkSlugValue = readJsonField(target, "networkSlug");
-	const networkSlug = typeof networkSlugValue === "string" && networkSlugValue.trim() ? networkSlugValue.trim() : null;
-	if (kind === "evm") {
-		if (namespace !== "eip155") throw new Error("walletRecoveryPrepare ECDSA recovery EVM namespace is invalid");
-		return {
-			kind: "evm",
-			namespace: "eip155",
-			chainId,
-			networkSlug: networkSlug ?? `evm-${chainId}`
-		};
-	}
-	if (kind === "tempo") return {
-		kind: "tempo",
-		chainId,
-		networkSlug: networkSlug ?? `tempo-${chainId}`
-	};
-	throw new Error("walletRecoveryPrepare ECDSA recovery chain family is invalid");
-}
-function walletRecoveryEcdsaChainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
-function parseWalletRecoveryEcdsaParticipantIds(raw) {
-	if (!Array.isArray(raw) || raw.length !== 2 || raw[0] !== 1 || raw[1] !== 2) throw new Error("walletRecoveryPrepare ECDSA recovery participant IDs are invalid");
-	return [1, 2];
-}
-function parseWalletRecoveryNearLifecycleScope(raw) {
-	const scope = decodeExactJsonObject(raw, [
-		"lifecycle_id",
-		"root_share_epoch",
-		"account_id",
-		"threshold_session_id",
-		"signer_set_id",
-		"signing_worker_id",
-		"material_activation"
-	], "walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.scope");
-	return {
-		lifecycle_id: requireResponseString(readJsonField(scope, "lifecycle_id"), "keyManifest.entries[].recoveryBasis.scope.lifecycle_id"),
-		root_share_epoch: requireResponseString(readJsonField(scope, "root_share_epoch"), "keyManifest.entries[].recoveryBasis.scope.root_share_epoch"),
-		account_id: requireResponseString(readJsonField(scope, "account_id"), "keyManifest.entries[].recoveryBasis.scope.account_id"),
-		threshold_session_id: requireResponseString(readJsonField(scope, "threshold_session_id"), "keyManifest.entries[].recoveryBasis.scope.threshold_session_id"),
-		signer_set_id: requireResponseString(readJsonField(scope, "signer_set_id"), "keyManifest.entries[].recoveryBasis.scope.signer_set_id"),
-		signing_worker_id: requireResponseString(readJsonField(scope, "signing_worker_id"), "keyManifest.entries[].recoveryBasis.scope.signing_worker_id"),
-		material_activation: parseRouterAbMpcMaterialActivationRef(readJsonField(scope, "material_activation"))
-	};
-}
-function parseWalletRecoveryNearApplicationBinding(raw) {
-	const applicationBinding = decodeExactJsonObject(raw, [
-		"wallet_id",
-		"near_ed25519_signing_key_id",
-		"signing_root_id",
-		"key_creation_signer_slot"
-	], "walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.applicationBinding");
-	const keyCreationSignerSlot = Number(readJsonField(applicationBinding, "key_creation_signer_slot"));
-	if (!Number.isSafeInteger(keyCreationSignerSlot) || keyCreationSignerSlot <= 0) throw new Error("walletRecoveryPrepare NEAR recovery key-creation signer slot is invalid");
-	return {
-		wallet_id: requireResponseString(readJsonField(applicationBinding, "wallet_id"), "keyManifest.entries[].recoveryBasis.applicationBinding.wallet_id"),
-		near_ed25519_signing_key_id: requireResponseString(readJsonField(applicationBinding, "near_ed25519_signing_key_id"), "keyManifest.entries[].recoveryBasis.applicationBinding.near_ed25519_signing_key_id"),
-		signing_root_id: requireResponseString(readJsonField(applicationBinding, "signing_root_id"), "keyManifest.entries[].recoveryBasis.applicationBinding.signing_root_id"),
-		key_creation_signer_slot: keyCreationSignerSlot
-	};
-}
-function parseWalletRecoveryRuntimePolicyScope(raw) {
-	const scope = decodeExactJsonObject(raw, [
-		"orgId",
-		"projectId",
-		"envId",
-		"signingRootVersion"
-	], "walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.runtimePolicyScope");
-	try {
-		return normalizeRuntimePolicyScope(scope);
-	} catch {
-		throw new Error("walletRecoveryPrepare NEAR recovery runtime policy scope is invalid");
-	}
-}
-function requireParticipantPair(raw, label) {
-	if (!Array.isArray(raw) || raw.length !== 2 || !Number.isSafeInteger(raw[0]) || !Number.isSafeInteger(raw[1]) || Number(raw[0]) <= 0 || Number(raw[1]) <= 0 || Number(raw[0]) === Number(raw[1])) throw new Error(`walletRecoveryPrepare ${label} is invalid`);
-	return [Number(raw[0]), Number(raw[1])];
-}
-function requireCanonicalBytesB64u(raw, length, label) {
-	const value = requireResponseString(raw, label);
-	const bytes = base64UrlDecode(value);
-	if (bytes.length !== length || base64UrlEncode(bytes) !== value) throw new Error(`walletRecoveryPrepare ${label} is invalid`);
-	return value;
-}
-function requireCanonicalNonEmptyB64u(raw, label) {
-	const value = requireResponseString(raw, label);
-	const bytes = base64UrlDecode(value);
-	if (bytes.length === 0 || base64UrlEncode(bytes) !== value) throw new Error(`walletRecoveryPrepare ${label} is invalid`);
-	return value;
-}
-function requireByteArray(raw, length, label) {
-	if (!Array.isArray(raw) || raw.length !== length || raw.some((value) => !Number.isInteger(value) || value < 0 || value > 255)) throw new Error(`walletRecoveryPrepare ${label} is invalid`);
-	return raw.map(Number);
-}
-//#endregion
-//#region src/core/rpcClients/relayer/walletRecoveryFinalize.ts
-/**
-* Installing the replacement credential a recovery enrolled.
-*
-* Sent after activation, carrying an envelope this client sealed under the new
-* credential. The server cannot open that ciphertext because it has no seed.
-* It queries its signer registry and exact activation receipts before a
-* `promoted` reply can consume the code and retire old credentials.
-*
-* Promotion is atomic. The successful response carries the committed
-* credential projection; every source retirement is part of that same commit.
-*/
-const WALLET_RECOVERY_FINALIZE_PATH = "/wallets/recovery/finalize";
-async function finalizeWalletRecovery(args) {
-	const url = `${normalizeRelayerBaseUrl(args.relayUrl)}${WALLET_RECOVERY_FINALIZE_PATH}`;
-	const doFetch = args.fetchImpl || fetch;
-	let webauthnRegistration;
-	try {
-		webauthnRegistration = redactedPasskeyRegistrationCredential(args.webauthnRegistration);
-	} catch {
-		return { kind: "refused" };
-	}
-	let ecdsaMaterialPossessionProofs;
-	try {
-		const seen = /* @__PURE__ */ new Set();
-		ecdsaMaterialPossessionProofs = args.ecdsaMaterialPossessionProofs.map((entry) => {
-			if (typeof entry.keySetId !== "string" || !entry.keySetId.startsWith("evm_family_ecdsa:") || entry.keySetId.length <= 17) throw new Error("ECDSA possession proof key-set id is invalid");
-			if (seen.has(entry.keySetId)) throw new Error("ECDSA possession proof key-set ids are duplicated");
-			seen.add(entry.keySetId);
-			return {
-				keySetId: entry.keySetId,
-				proof: parseWalletRecoveryEcdsaPossessionProofV1(entry.proof)
-			};
-		});
-	} catch {
-		return { kind: "refused" };
-	}
-	let replacementEnvelope;
-	try {
-		replacementEnvelope = parsePasskeyCustodyEnvelopeRecord(args.replacementEnvelope, "walletRecoveryFinalize.replacementEnvelope");
-		if (String(replacementEnvelope.walletId) !== String(args.walletId)) throw new Error("replacement envelope changed the wallet identity");
-		if (String(replacementEnvelope.envelopeId) !== String(args.replacementId)) throw new Error("replacement envelope changed the replacement identity");
-		if (replacementEnvelope.factor.kind !== "passkey") throw new Error("replacement envelope is not bound to a passkey");
-	} catch {
-		return { kind: "refused" };
-	}
-	let response;
-	try {
-		response = await doFetch(url, buildRelayerJsonPostRequestInit({ body: {
-			kind: "finalize",
-			walletId: args.walletId,
-			reservationId: args.reservationId,
-			recoveryOperationId: args.recoveryOperationId,
-			targetDeviceId: args.targetDeviceId,
-			targetAuthorityId: args.targetAuthorityId,
-			targetWalletAuthMethodId: args.targetWalletAuthMethodId,
-			challengeId: args.challengeId,
-			replacementId: args.replacementId,
-			webauthnRegistration,
-			replacementEnvelope,
-			ecdsaMaterialPossessionProofs
-		} }));
-	} catch {
-		return { kind: "transport_uncertain" };
-	}
-	const body = decodeWalletRecoveryFinalizeResponse(await response.json().catch(() => ({})));
-	if (response.status === 200 && body.kind === "success") try {
-		const projection = await parseWalletRecoveryCommittedProjectionV1(body.projection, buildPasskeyProjectionExpectation(args, replacementEnvelope));
-		if (projection.kind !== "passkey") throw new Error("recovery projection branch changed");
-		return {
-			kind: "promoted",
-			storeVersion: projection.storeVersion,
-			authority: projection.authority,
-			authMethod: projection.authMethod
-		};
-	} catch {
-		return { kind: "transport_uncertain" };
-	}
-	if (response.status === 409) return { kind: "retryable_conflict" };
-	if (response.status === 400 || response.status === 401) return { kind: "refused" };
-	return { kind: "transport_uncertain" };
-}
-/**
-* Replays a promotion whose server transaction already committed. The replay
-* body is credential-free and carries only the exact sealed replacement
-* envelope and immutable operation identity retained by the local journal.
-*/
-async function replayWalletRecovery(args) {
-	let replacementEnvelope;
-	try {
-		replacementEnvelope = parsePasskeyCustodyEnvelopeRecord(args.replacementEnvelope, "walletRecoveryReplay.replacementEnvelope");
-		if (String(replacementEnvelope.walletId) !== String(args.walletId) || String(replacementEnvelope.envelopeId) !== String(args.replacementId) || replacementEnvelope.factor.kind !== "passkey") throw new Error("recovery replay envelope identity is invalid");
-	} catch {
-		return { kind: "refused" };
-	}
-	let response;
-	try {
-		response = await (args.fetchImpl ?? fetch)(`${normalizeRelayerBaseUrl(args.relayUrl)}${WALLET_RECOVERY_FINALIZE_PATH}`, buildRelayerJsonPostRequestInit({ body: {
-			kind: "replay",
-			walletId: args.walletId,
-			reservationId: args.reservationId,
-			recoveryOperationId: args.recoveryOperationId,
-			targetDeviceId: args.targetDeviceId,
-			targetAuthorityId: args.targetAuthorityId,
-			targetWalletAuthMethodId: args.targetWalletAuthMethodId,
-			replacementId: args.replacementId,
-			replacementEnvelope
-		} }));
-	} catch {
-		return { kind: "transport_uncertain" };
-	}
-	const body = decodeWalletRecoveryFinalizeResponse(await response.json().catch(() => ({})));
-	if (response.status === 200 && body.kind === "success") try {
-		const projection = await parseWalletRecoveryCommittedProjectionV1(body.projection, buildPasskeyProjectionExpectation(args, replacementEnvelope));
-		if (projection.kind !== "passkey") throw new Error("recovery projection branch changed");
-		return {
-			kind: "promoted",
-			storeVersion: projection.storeVersion,
-			authority: projection.authority,
-			authMethod: projection.authMethod
-		};
-	} catch {
-		return { kind: "transport_uncertain" };
-	}
-	if (response.status === 409) return { kind: "retryable_conflict" };
-	if (response.status === 400 || response.status === 401) return { kind: "refused" };
-	return { kind: "transport_uncertain" };
-}
-function decodeWalletRecoveryFinalizeResponse(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) return { kind: "invalid" };
-	const fields = new Map(Object.entries(value));
-	const names = [...fields.keys()];
-	if (fields.size === 2 && names.includes("ok") && names.includes("projection") && fields.get("ok") === true) return {
-		kind: "success",
-		projection: fields.get("projection")
-	};
-	const code = fields.get("code");
-	const message = fields.get("message");
-	if (fields.size === 3 && names.includes("ok") && names.includes("code") && names.includes("message") && fields.get("ok") === false && typeof code === "string" && typeof message === "string") return {
-		kind: "failure",
-		code,
-		message
-	};
-	return { kind: "invalid" };
-}
-function buildPasskeyProjectionExpectation(args, replacementEnvelope) {
-	if (replacementEnvelope.factor.kind !== "passkey") throw new Error("replacement envelope is not a passkey envelope");
-	return {
-		kind: "passkey",
-		walletId: requireParsed$1(parseWalletId(args.walletId)),
-		recoveryOperationId: requireParsed$1(parseWalletRecoveryOperationId(args.recoveryOperationId)),
-		targetDeviceId: requireParsed$1(parseDeviceId(args.targetDeviceId)),
-		targetAuthorityId: requireParsed$1(parseWalletAuthorityId(args.targetAuthorityId)),
-		targetWalletAuthMethodId: requireParsed$1(parseWalletAuthMethodId(args.targetWalletAuthMethodId)),
-		rpId: replacementEnvelope.factor.rpId,
-		credentialIdB64u: replacementEnvelope.factor.credentialIdB64u
-	};
-}
-function requireParsed$1(result) {
-	if (!result.ok) throw new Error("invalid recovery identity");
-	return result.value;
-}
-function isDurablePasskeyPayload(payload) {
-	return payload.target.kind === "passkey";
-}
-function durableEmailEnrollmentReference(payload) {
-	return {
-		kind: "email_otp_enrollment_reference_v1",
-		enrollmentId: payload.enrollment.enrollmentId,
-		enrollmentSealKeyVersion: payload.enrollment.kind === "existing" ? payload.enrollment.enrollmentSealKeyVersion : payload.enrollment.material.enrollmentSealKeyVersion
-	};
-}
-const NEAR_KEY_SET_FIELDS = [
-	"kind",
-	"keySetId",
-	"applicationBindingDigestB64u",
-	"registeredPublicKeyB64u",
-	"participantIds",
-	"stateEpoch",
-	"signingWorkerVerifyingShareB64u",
-	"materialActivation",
-	"sealed"
-];
-const ECDSA_KEY_SET_FIELDS = [
-	"kind",
-	"keySetId",
-	"possessionProof",
-	"readyStateBlobB64u",
-	"publicFacts"
-];
-const PUBLIC_FACTS_FIELDS = [
-	"contextBinding32B64u",
-	"derivationClientSharePublicKey33B64u",
-	"clientVerifyingShare33B64u",
-	"relayerPublicKey33B64u",
-	"groupPublicKey33B64u",
-	"ethereumAddress",
-	"clientShareRetryCounter",
-	"relayerShareRetryCounter"
-];
-const PAYLOAD_COMMON_FIELDS = [
-	"kind",
-	"version",
-	"recoveryOperationId",
-	"walletId",
-	"reservationId",
-	"targetDeviceId",
-	"targetAuthorityId",
-	"targetWalletAuthMethodId",
-	"replacementEnvelope",
-	"keyManifest",
-	"nearKeySets",
-	"ecdsaKeySets",
-	"target"
-];
-function durableExactFields(value, fields, label) {
-	rejectUnknownFields(value, fields, label);
-	if (Object.keys(value).length !== fields.length) throw new Error(label + " fields are invalid");
-}
-function durableString(value, label) {
-	if (typeof value !== "string" || !value || value.trim() !== value) throw new Error(label + " must be a non-empty canonical string");
-	return value;
-}
-function durableBase64Url(value, label, byteLength) {
-	const normalized = durableString(value, label);
-	const bytes = base64UrlDecode(normalized);
-	if (byteLength !== void 0 && bytes.byteLength !== byteLength) throw new Error(label + " must decode to " + byteLength + " bytes");
-	return normalized;
-}
-function durableCompressedPublicKey(value, label) {
-	return parseSecp256k1CompressedPublicKeyB64u(value, label);
-}
-function durableSafeInteger(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(label + " must be a non-negative safe integer");
-	return value;
-}
-function durableParticipantPair(value, label) {
-	if (!Array.isArray(value) || value.length !== 2 || value.some(isInvalidParticipant)) throw new Error(label + " must contain two positive participant IDs");
-	return [value[0], value[1]];
-}
-function isInvalidParticipant(value) {
-	return typeof value !== "number" || !Number.isSafeInteger(value) || value < 1;
-}
-function nearManifestEntryForKeySet(manifest, raw) {
-	const keySetId = durableString(requireRecord(raw, "recovery durable NEAR key set").keySetId, "recovery durable NEAR keySetId");
-	const entry = manifest.entries.find((candidate) => candidate.keySetId === keySetId);
-	if (!entry || entry.kind !== "near_ed25519") throw new Error("recovery durable NEAR key-set manifest entry is invalid");
-	return entry;
-}
-function ecdsaManifestEntryForKeySet(manifest, raw) {
-	const keySetId = durableString(requireRecord(raw, "recovery durable ECDSA key set").keySetId, "recovery durable ECDSA keySetId");
-	const entry = manifest.entries.find((candidate) => candidate.keySetId === keySetId);
-	if (!entry || entry.kind !== "evm_family_ecdsa") throw new Error("recovery durable ECDSA key-set manifest entry is invalid");
-	return entry;
-}
-function durableRuntimePolicyScope(value) {
-	const scope = normalizeThresholdRuntimePolicyScope(value);
-	if (!scope) throw new Error("recovery runtime policy scope is invalid");
-	return scope;
-}
-function parseWalletRecoveryDurableNearKeySet(raw, manifestEntry) {
-	const record = requireRecord(raw, "recovery durable NEAR key set");
-	durableExactFields(record, NEAR_KEY_SET_FIELDS, "recovery durable NEAR key set");
-	if (record.kind !== "near_ed25519" || record.keySetId !== manifestEntry.keySetId) throw new Error("recovery durable NEAR key-set identity is invalid");
-	const basis = manifestEntry.recoveryBasis;
-	const thresholdSessionId = basis.scope.threshold_session_id;
-	if (!parseThresholdEd25519SessionId(thresholdSessionId).ok) throw new Error("recovery durable NEAR thresholdSessionId is invalid");
-	const binding = {
-		kind: WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND,
-		applicationBindingDigestB64u: parseDigestField(record.applicationBindingDigestB64u, "recovery durable NEAR application binding digest"),
-		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "recovery durable NEAR registered public key"),
-		participantIds: durableParticipantPair(record.participantIds, "recovery durable NEAR participantIds"),
-		stateEpoch: durableString(record.stateEpoch, "recovery durable NEAR stateEpoch"),
-		walletId: basis.applicationBinding.wallet_id,
-		nearAccountId: manifestEntry.nearAccountId,
-		nearEd25519SigningKeyId: basis.applicationBinding.near_ed25519_signing_key_id,
-		signerSlot: parseKeyCreationSignerSlot(basis.applicationBinding.key_creation_signer_slot, "recovery durable NEAR signerSlot"),
-		signingWorkerId: basis.scope.signing_worker_id,
-		signingWorkerVerifyingShareB64u: parseEd25519PublicKeyB64u(record.signingWorkerVerifyingShareB64u, "recovery durable NEAR signing-worker verifying share")
-	};
-	const sealedRecord = requireRecord(record.sealed, "recovery durable NEAR sealed material");
-	durableExactFields(sealedRecord, ["ciphertextB64u", "nonceB64u"], "recovery durable NEAR sealed material");
-	return {
-		kind: "near_ed25519",
-		keySetId: manifestEntry.keySetId,
-		binding,
-		thresholdSessionId,
-		runtimePolicyScope: durableRuntimePolicyScope(basis.runtimePolicyScope),
-		materialActivation: parseRouterAbMpcMaterialActivationRef(record.materialActivation),
-		sealed: {
-			ciphertextB64u: parseEnvelopeCiphertextB64u(sealedRecord.ciphertextB64u, "recovery durable NEAR ciphertext"),
-			nonceB64u: parseEnvelopeNonceB64u(sealedRecord.nonceB64u, "recovery durable NEAR nonce")
-		}
-	};
-}
-function parseWalletRecoveryDurableEcdsaPublicFacts(raw) {
-	const record = requireRecord(raw, "recovery durable ECDSA public facts");
-	durableExactFields(record, PUBLIC_FACTS_FIELDS, "recovery durable ECDSA public facts");
-	const ethereumAddress = durableString(record.ethereumAddress, "recovery durable ECDSA ethereumAddress").toLowerCase();
-	if (!/^0x[0-9a-f]{40}$/.test(ethereumAddress)) throw new Error("recovery durable ECDSA ethereumAddress is invalid");
-	return {
-		contextBinding32B64u: parseDigestField(record.contextBinding32B64u, "recovery durable ECDSA context binding"),
-		derivationClientSharePublicKey33B64u: durableCompressedPublicKey(record.derivationClientSharePublicKey33B64u, "recovery durable ECDSA client share"),
-		clientVerifyingShare33B64u: durableCompressedPublicKey(record.clientVerifyingShare33B64u, "recovery durable ECDSA client verifying share"),
-		relayerPublicKey33B64u: durableCompressedPublicKey(record.relayerPublicKey33B64u, "recovery durable ECDSA relayer public key"),
-		groupPublicKey33B64u: durableCompressedPublicKey(record.groupPublicKey33B64u, "recovery durable ECDSA group public key"),
-		ethereumAddress,
-		clientShareRetryCounter: durableSafeInteger(record.clientShareRetryCounter, "recovery durable ECDSA client-share retry counter"),
-		relayerShareRetryCounter: durableSafeInteger(record.relayerShareRetryCounter, "recovery durable ECDSA relayer-share retry counter")
-	};
-}
-function parseWalletRecoveryDurableEcdsaKeySet(raw, manifestEntry) {
-	const record = requireRecord(raw, "recovery durable ECDSA key set");
-	durableExactFields(record, ECDSA_KEY_SET_FIELDS, "recovery durable ECDSA key set");
-	if (record.kind !== "evm_family_ecdsa" || record.keySetId !== manifestEntry.keySetId) throw new Error("recovery durable ECDSA key-set identity is invalid");
-	return {
-		kind: "evm_family_ecdsa",
-		entry: manifestEntry,
-		possessionProof: parseWalletRecoveryEcdsaPossessionProofV1(record.possessionProof),
-		readyStateBlobB64u: durableBase64Url(record.readyStateBlobB64u, "recovery durable ECDSA ready-state blob"),
-		publicFacts: parseWalletRecoveryDurableEcdsaPublicFacts(record.publicFacts)
-	};
-}
-function parseWalletRecoveryDurableRegistration(raw) {
-	const record = requireRecord(raw, "recovery durable registration");
-	durableExactFields(record, [
-		"kind",
-		"id",
-		"rawId",
-		"type",
-		"authenticatorAttachment",
-		"response"
-	], "recovery durable registration");
-	if (record.kind !== "wallet_recovery_redacted_registration_v1") throw new Error("recovery durable registration kind is invalid");
-	if (record.authenticatorAttachment !== null && typeof record.authenticatorAttachment !== "string") throw new Error("recovery durable registration authenticatorAttachment is invalid");
-	const responseRecord = requireRecord(record.response, "recovery durable registration response");
-	durableExactFields(responseRecord, [
-		"clientDataJSON",
-		"attestationObject",
-		"transports"
-	], "recovery durable registration response");
-	if (!Array.isArray(responseRecord.transports)) throw new Error("recovery durable registration transports are invalid");
-	return {
-		kind: "wallet_recovery_redacted_registration_v1",
-		id: durableString(record.id, "recovery durable registration id"),
-		rawId: durableBase64Url(record.rawId, "recovery durable registration rawId"),
-		type: durableString(record.type, "recovery durable registration type"),
-		authenticatorAttachment: record.authenticatorAttachment,
-		response: {
-			clientDataJSON: durableBase64Url(responseRecord.clientDataJSON, "recovery durable registration clientDataJSON"),
-			attestationObject: durableBase64Url(responseRecord.attestationObject, "recovery durable registration attestationObject"),
-			transports: responseRecord.transports.map((transport, index) => durableString(transport, "recovery durable registration transports[" + index + "]"))
-		}
-	};
-}
-function parseWalletRecoveryDurableEnrollment(raw) {
-	const record = requireRecord(raw, "recovery durable Email OTP enrollment");
-	if (record.kind === "existing") {
-		durableExactFields(record, [
-			"kind",
-			"enrollmentId",
-			"enrollmentSealKeyVersion"
-		], "recovery durable existing Email OTP enrollment");
-		return {
-			kind: "existing",
-			enrollmentId: durableString(record.enrollmentId, "recovery enrollmentId"),
-			enrollmentSealKeyVersion: durableString(record.enrollmentSealKeyVersion, "recovery enrollment seal-key version")
-		};
-	}
-	if (record.kind !== "create") throw new Error("recovery durable Email OTP enrollment kind is invalid");
-	durableExactFields(record, [
-		"kind",
-		"enrollmentId",
-		"providerSubject",
-		"verifiedEmail",
-		"material"
-	], "recovery durable create Email OTP enrollment");
-	const material = requireRecord(record.material, "recovery durable enrollment material");
-	durableExactFields(material, [
-		"enrollmentSealKeyVersion",
-		"clientUnlockPublicKeyB64u",
-		"unlockKeyVersion",
-		"serverSealedFactorCiphertextB64u"
-	], "recovery durable enrollment material");
-	return {
-		kind: "create",
-		enrollmentId: durableString(record.enrollmentId, "recovery enrollmentId"),
-		providerSubject: durableString(record.providerSubject, "recovery enrollment providerSubject"),
-		verifiedEmail: durableString(record.verifiedEmail, "recovery enrollment verifiedEmail"),
-		material: {
-			enrollmentSealKeyVersion: durableString(material.enrollmentSealKeyVersion, "recovery enrollment material seal-key version"),
-			clientUnlockPublicKeyB64u: durableBase64Url(material.clientUnlockPublicKeyB64u, "recovery enrollment client unlock public key"),
-			unlockKeyVersion: durableString(material.unlockKeyVersion, "recovery enrollment unlock-key version"),
-			serverSealedFactorCiphertextB64u: durableBase64Url(material.serverSealedFactorCiphertextB64u, "recovery enrollment sealed factor ciphertext")
-		}
-	};
-}
-function parseWalletRecoveryDurablePayload(raw) {
-	const record = requireRecord(raw, "wallet recovery durable payload");
-	if (record.kind !== "wallet_recovery_durable_payload_v1" || record.version !== 1) throw new Error("wallet recovery durable payload version is invalid");
-	durableExactFields(record, [...PAYLOAD_COMMON_FIELDS, ...requireRecord(record.target, "wallet recovery durable target").kind === "passkey" ? [
-		"replacementId",
-		"challengeId",
-		"registration"
-	] : [
-		"providerSubject",
-		"verifiedEmail",
-		"emailHashHex",
-		"registrationAuthorityId",
-		"replacementId",
-		"enrollment"
-	]], "wallet recovery durable payload");
-	const recoveryOperationId = parseWalletRecoveryOperationId(record.recoveryOperationId);
-	const walletId = parseWalletId(record.walletId);
-	let reservationId;
-	try {
-		reservationId = parseRecoveryCodeReservationId(record.reservationId);
-	} catch (error) {
-		throw new Error("wallet recovery durable reservationId is invalid", { cause: error });
-	}
-	const targetDeviceId = parseDeviceId(record.targetDeviceId);
-	const targetAuthorityId = parseWalletAuthorityId(record.targetAuthorityId);
-	const targetWalletAuthMethodId = parseWalletAuthMethodId(record.targetWalletAuthMethodId);
-	if (!recoveryOperationId.ok || !walletId.ok || !targetDeviceId.ok || !targetAuthorityId.ok || !targetWalletAuthMethodId.ok) throw new Error("wallet recovery durable payload identity is invalid");
-	if (!Array.isArray(record.nearKeySets) || !Array.isArray(record.ecdsaKeySets)) throw new Error("wallet recovery durable key-set arrays are invalid");
-	const keyManifest = parseWalletRecoveryPreparationKeyManifest(record.keyManifest, String(walletId.value));
-	const nearKeySets = record.nearKeySets.map((keySet) => parseWalletRecoveryDurableNearKeySet(keySet, nearManifestEntryForKeySet(keyManifest, keySet)));
-	const ecdsaKeySets = record.ecdsaKeySets.map((keySet) => parseWalletRecoveryDurableEcdsaKeySet(keySet, ecdsaManifestEntryForKeySet(keyManifest, keySet)));
-	const keySetIds = [...nearKeySets.map((keySet) => keySet.keySetId), ...ecdsaKeySets.map((keySet) => keySet.entry.keySetId)];
-	if (new Set(keySetIds).size !== keySetIds.length) throw new Error("wallet recovery durable key-set ids are duplicated");
-	if (keyManifest.entries.length !== keySetIds.length || keyManifest.entries.some((entry) => !keySetIds.includes(entry.keySetId))) throw new Error("wallet recovery durable key-set manifest coverage is invalid");
-	const common = {
-		kind: "wallet_recovery_durable_payload_v1",
-		version: 1,
-		recoveryOperationId: recoveryOperationId.value,
-		walletId: walletId.value,
-		reservationId,
-		targetDeviceId: targetDeviceId.value,
-		targetAuthorityId: targetAuthorityId.value,
-		targetWalletAuthMethodId: targetWalletAuthMethodId.value,
-		replacementEnvelope: parsePasskeyCustodyEnvelopeRecord(record.replacementEnvelope, "wallet recovery durable replacementEnvelope"),
-		keyManifest,
-		nearKeySets,
-		ecdsaKeySets
-	};
-	if (String(common.replacementEnvelope.walletId) !== String(walletId.value)) throw new Error("wallet recovery durable replacement envelope wallet changed");
-	if (common.replacementEnvelope.ownership.kind !== "method_bound" || common.replacementEnvelope.ownership.walletAuthMethodId !== targetWalletAuthMethodId.value) throw new Error("wallet recovery durable replacement envelope method changed");
-	for (const keySet of nearKeySets) if (keySet.binding.walletId !== String(walletId.value)) throw new Error("wallet recovery durable NEAR binding wallet changed");
-	const target = requireRecord(record.target, "wallet recovery durable target");
-	if (target.kind === "passkey") {
-		durableExactFields(target, ["kind", "rpId"], "wallet recovery durable passkey target");
-		const rpId = parseWebAuthnRpId(target.rpId);
-		if (!rpId.ok) throw new Error("wallet recovery durable passkey RP ID is invalid");
-		const registration = parseWalletRecoveryDurableRegistration(record.registration);
-		if (registration.rawId !== common.replacementEnvelope.factor.credentialIdB64u) throw new Error("wallet recovery durable passkey registration identity changed");
-		if (common.replacementEnvelope.factor.kind !== "passkey") throw new Error("wallet recovery durable passkey envelope factor is invalid");
-		if (common.replacementEnvelope.factor.rpId !== rpId.value || common.replacementEnvelope.factor.credentialIdB64u !== registration.rawId) throw new Error("wallet recovery durable passkey envelope identity changed");
-		const replacementId = durableString(record.replacementId, "wallet recovery durable replacementId");
-		if (String(common.replacementEnvelope.envelopeId) !== replacementId) throw new Error("wallet recovery durable passkey envelope id changed");
-		return {
-			...common,
-			target: {
-				kind: "passkey",
-				rpId: rpId.value
-			},
-			replacementId,
-			challengeId: durableString(record.challengeId, "wallet recovery durable challengeId"),
-			registration
-		};
-	}
-	if (target.kind !== "google_email_otp") throw new Error("wallet recovery durable target kind is invalid");
-	durableExactFields(target, ["kind"], "wallet recovery durable Email OTP target");
-	const providerSubject = durableString(record.providerSubject, "wallet recovery providerSubject");
-	if (!parseEmailOtpProviderUserId(providerSubject).ok) throw new Error("wallet recovery durable providerSubject is invalid");
-	const verifiedEmail = durableString(record.verifiedEmail, "wallet recovery durable verifiedEmail");
-	const emailHashHex = durableString(record.emailHashHex, "wallet recovery durable emailHashHex");
-	if (!/^[0-9a-f]{64}$/.test(emailHashHex)) throw new Error("wallet recovery durable emailHashHex is invalid");
-	const registrationAuthorityId = durableString(record.registrationAuthorityId, "wallet recovery durable registrationAuthorityId");
-	const enrollment = parseWalletRecoveryDurableEnrollment(record.enrollment);
-	if (common.replacementEnvelope.factor.kind !== "email_otp") throw new Error("wallet recovery durable Email OTP envelope factor is invalid");
-	const enrollmentReference = enrollment.kind === "existing" ? {
-		enrollmentId: enrollment.enrollmentId,
-		enrollmentSealKeyVersion: enrollment.enrollmentSealKeyVersion
-	} : {
-		enrollmentId: enrollment.enrollmentId,
-		enrollmentSealKeyVersion: enrollment.material.enrollmentSealKeyVersion
-	};
-	if (common.replacementEnvelope.factor.enrollmentId !== enrollmentReference.enrollmentId || common.replacementEnvelope.factor.enrollmentSealKeyVersion !== enrollmentReference.enrollmentSealKeyVersion) throw new Error("wallet recovery durable Email OTP envelope identity changed");
-	if (enrollment.kind === "create" && (enrollment.providerSubject !== providerSubject || enrollment.verifiedEmail !== verifiedEmail)) throw new Error("wallet recovery durable Email OTP enrollment identity changed");
-	const replacementId = durableString(record.replacementId, "wallet recovery durable replacementId");
-	if (String(common.replacementEnvelope.envelopeId) !== replacementId) throw new Error("wallet recovery durable Email OTP envelope id changed");
-	return {
-		...common,
-		target: { kind: "google_email_otp" },
-		providerSubject,
-		verifiedEmail,
-		emailHashHex,
-		registrationAuthorityId,
-		replacementId,
-		enrollment
-	};
-}
-/**
-* Projects a parsed payload back onto the serialized wire shape the parser
-* accepts. Parsing enriches the key sets with manifest-derived facts (the
-* NEAR material binding, threshold session, and runtime scope; the ECDSA
-* manifest entry), so serializing the parsed record directly produces fields
-* the exact-field parser rejects on the next decrypt. The projection is
-* validated by the parser before it is returned, so an encrypt-time failure
-* surfaces immediately instead of stranding an undecodable journal record.
-*/
-function walletRecoveryDurablePayloadWireForm(payload) {
-	const nearKeySets = payload.nearKeySets.map((keySet) => ({
-		kind: keySet.kind,
-		keySetId: keySet.keySetId,
-		applicationBindingDigestB64u: keySet.binding.applicationBindingDigestB64u,
-		registeredPublicKeyB64u: keySet.binding.registeredPublicKeyB64u,
-		participantIds: keySet.binding.participantIds,
-		stateEpoch: keySet.binding.stateEpoch,
-		signingWorkerVerifyingShareB64u: keySet.binding.signingWorkerVerifyingShareB64u,
-		materialActivation: keySet.materialActivation,
-		sealed: keySet.sealed
-	}));
-	const ecdsaKeySets = payload.ecdsaKeySets.map((keySet) => ({
-		kind: keySet.kind,
-		keySetId: keySet.entry.keySetId,
-		possessionProof: keySet.possessionProof,
-		readyStateBlobB64u: keySet.readyStateBlobB64u,
-		publicFacts: keySet.publicFacts
-	}));
-	const common = {
-		kind: payload.kind,
-		version: payload.version,
-		recoveryOperationId: String(payload.recoveryOperationId),
-		walletId: String(payload.walletId),
-		reservationId: String(payload.reservationId),
-		targetDeviceId: String(payload.targetDeviceId),
-		targetAuthorityId: String(payload.targetAuthorityId),
-		targetWalletAuthMethodId: String(payload.targetWalletAuthMethodId),
-		replacementEnvelope: payload.replacementEnvelope,
-		keyManifest: payload.keyManifest,
-		nearKeySets,
-		ecdsaKeySets
-	};
-	const wire = isDurablePasskeyPayload(payload) ? {
-		...common,
-		target: payload.target,
-		replacementId: payload.replacementId,
-		challengeId: payload.challengeId,
-		registration: payload.registration
-	} : {
-		...common,
-		target: payload.target,
-		providerSubject: payload.providerSubject,
-		verifiedEmail: payload.verifiedEmail,
-		emailHashHex: payload.emailHashHex,
-		registrationAuthorityId: payload.registrationAuthorityId,
-		replacementId: payload.replacementId,
-		enrollment: payload.enrollment
-	};
-	parseWalletRecoveryDurablePayload(wire);
-	return wire;
-}
-async function validateWalletRecoveryDurablePayloadBindings(payload) {
-	if (isDurablePasskeyPayload(payload)) return;
-	const expectedEmailHashHex = await sha256HexUtf8(payload.verifiedEmail);
-	if (payload.emailHashHex !== expectedEmailHashHex) throw new Error("wallet recovery durable email hash does not match verified email");
-	if (payload.enrollment.kind === "create" && (payload.enrollment.providerSubject !== payload.providerSubject || payload.enrollment.verifiedEmail !== payload.verifiedEmail)) throw new Error("wallet recovery durable enrollment does not match Email OTP identity");
-}
-function durablePayloadIdentityTarget(payload) {
-	if (isDurablePasskeyPayload(payload)) {
-		const credentialIdB64u = parseWebAuthnCredentialIdB64u(payload.registration.rawId);
-		if (!credentialIdB64u.ok) throw new Error("wallet recovery durable passkey credential id is invalid");
-		return {
-			kind: "passkey",
-			rpId: payload.target.rpId,
-			credentialIdB64u: credentialIdB64u.value
-		};
-	}
-	const providerSubject = parseEmailOtpProviderUserId(payload.providerSubject);
-	if (!providerSubject.ok) throw new Error("wallet recovery durable providerSubject is invalid");
-	return {
-		kind: "google_email_otp",
-		providerSubject: providerSubject.value,
-		emailHashHex: payload.emailHashHex,
-		registrationAuthorityId: payload.registrationAuthorityId,
-		enrollment: durableEmailEnrollmentReference(payload)
-	};
-}
-function durableNearKeySetFromRecovered(recovered) {
-	return {
-		kind: "near_ed25519",
-		keySetId: recovered.entry.keySetId,
-		applicationBindingDigestB64u: recovered.localMaterial.applicationBindingDigestB64u,
-		registeredPublicKeyB64u: base64UrlEncode(recovered.metadata.registeredPublicKey),
-		participantIds: recovered.metadata.participantIds,
-		stateEpoch: String(recovered.metadata.stateEpoch),
-		signingWorkerVerifyingShareB64u: base64UrlEncode(recovered.metadata.signingWorkerVerifyingShare),
-		materialActivation: routerAbMpcMaterialActivationRefToWire(recovered.metadata.materialActivation),
-		sealed: {
-			ciphertextB64u: recovered.localMaterial.b64u,
-			nonceB64u: recovered.localMaterial.nonceB64u
-		}
-	};
-}
-function durableEcdsaKeySetFromRecovered(recovered) {
-	return {
-		kind: "evm_family_ecdsa",
-		keySetId: recovered.entry.keySetId,
-		possessionProof: parseWalletRecoveryEcdsaPossessionProofV1(recovered.activation.possessionProof),
-		readyStateBlobB64u: recovered.readyStateBlobB64u,
-		publicFacts: recovered.publicFacts
-	};
-}
-function redactedRecoveryRegistration(registration) {
-	return {
-		kind: "wallet_recovery_redacted_registration_v1",
-		id: registration.id,
-		rawId: registration.rawId,
-		type: registration.type,
-		authenticatorAttachment: registration.authenticatorAttachment ?? null,
-		response: {
-			clientDataJSON: registration.response.clientDataJSON,
-			attestationObject: registration.response.attestationObject,
-			transports: [...registration.response.transports]
-		}
-	};
-}
-async function walletRecoveryDurablePayloadFromOperation(operation) {
-	const common = {
-		kind: "wallet_recovery_durable_payload_v1",
-		version: 1,
-		recoveryOperationId: String(operation.prepared.recoveryOperationId),
-		walletId: operation.walletId,
-		reservationId: operation.prepared.reservationId,
-		targetDeviceId: operation.prepared.targetDeviceId,
-		targetAuthorityId: operation.prepared.targetAuthorityId,
-		targetWalletAuthMethodId: operation.prepared.targetWalletAuthMethodId,
-		replacementEnvelope: parsePasskeyCustodyEnvelopeRecord(operation.recovered.replacementEnvelope, "wallet recovery durable replacement envelope"),
-		keyManifest: {
-			version: "wallet_recovery_preparation_key_manifest_v1",
-			walletId: String(operation.walletId),
-			entries: [...operation.recovered.nearKeySets.map((keySet) => keySet.entry), ...operation.recovered.ecdsaKeySets.map((keySet) => keySet.entry)]
-		},
-		nearKeySets: operation.recovered.nearKeySets.map(durableNearKeySetFromRecovered),
-		ecdsaKeySets: operation.recovered.ecdsaKeySets.map(durableEcdsaKeySetFromRecovered)
-	};
-	if (operation.replacement.kind === "passkey") {
-		if (operation.target.kind !== "passkey") throw new Error("wallet recovery durable payload branch is invalid");
-		const registrationOptions = operation.prepared.registration;
-		if (!registrationOptions) throw new Error("wallet recovery registration options are unavailable");
-		const registration = redactedRecoveryRegistration(operation.replacement.registration);
-		if (registration.rawId !== operation.replacement.credentialIdB64u) throw new Error("wallet recovery passkey registration rawId changed its credential identity");
-		const payload = parseWalletRecoveryDurablePayload({
-			...common,
-			target: {
-				kind: "passkey",
-				rpId: operation.target.rpId
-			},
-			replacementId: registrationOptions.replacementId,
-			challengeId: registrationOptions.challengeId,
-			registration
-		});
-		await validateWalletRecoveryDurablePayloadBindings(payload);
-		return payload;
-	}
-	if (operation.target.kind !== "google_email_otp") throw new Error("wallet recovery durable payload branch is invalid");
-	const enrollment = operation.replacement.enrollment;
-	if (operation.replacement.factor.walletAuthMethodId !== common.targetWalletAuthMethodId) throw new Error("wallet recovery Email OTP factor method changed its target identity");
-	const emailHashHex = await sha256HexUtf8(operation.replacement.verifiedEmail);
-	const payload = parseWalletRecoveryDurablePayload({
-		...common,
-		target: { kind: "google_email_otp" },
-		enrollment,
-		providerSubject: operation.replacement.providerSubject,
-		verifiedEmail: operation.replacement.verifiedEmail,
-		emailHashHex,
-		registrationAuthorityId: operation.replacement.registrationAuthorityId,
-		replacementId: operation.replacement.factor.replacementId
-	});
-	await validateWalletRecoveryDurablePayloadBindings(payload);
-	return payload;
-}
-//#endregion
-//#region src/SeamsWeb/operations/recovery/walletRecoveryJournal.ts
-const WALLET_RECOVERY_DURABLE_PAYLOAD_AAD_KIND = "pending_wallet_recovery_commit_v1";
-const WALLET_RECOVERY_DURABLE_AES_GCM_IV_BYTES = 12;
-function walletRecoveryDurableAad(input) {
-	return new TextEncoder().encode(alphabetizeStringify({
-		kind: WALLET_RECOVERY_DURABLE_PAYLOAD_AAD_KIND,
-		version: 1,
-		...input
-	}));
-}
-function durablePayloadAad(payload) {
-	return walletRecoveryDurableAad({
-		recoveryOperationId: payload.recoveryOperationId,
-		walletId: payload.walletId,
-		reservationId: payload.reservationId,
-		targetDeviceId: payload.targetDeviceId,
-		targetAuthorityId: payload.targetAuthorityId,
-		targetWalletAuthMethodId: payload.targetWalletAuthMethodId,
-		target: durablePayloadIdentityTarget(payload)
-	});
-}
-async function encryptWalletRecoveryDurablePayload(payload) {
-	const key = await crypto.subtle.generateKey({
-		name: "AES-GCM",
-		length: 256
-	}, false, ["encrypt", "decrypt"]);
-	if (!(key instanceof CryptoKey)) throw new Error("wallet recovery durable key generation failed");
-	const iv = crypto.getRandomValues(new Uint8Array(WALLET_RECOVERY_DURABLE_AES_GCM_IV_BYTES));
-	const plaintext = new TextEncoder().encode(JSON.stringify(walletRecoveryDurablePayloadWireForm(payload)));
-	return {
-		kind: "wallet_recovery_encrypted_material_v1",
-		key,
-		iv,
-		ciphertext: new Uint8Array(await crypto.subtle.encrypt({
-			name: "AES-GCM",
-			iv,
-			additionalData: durablePayloadAad(payload)
-		}, key, plaintext))
-	};
-}
-async function decryptWalletRecoveryDurablePayload(record) {
-	const plaintext = await crypto.subtle.decrypt({
-		name: "AES-GCM",
-		iv: record.localMaterial.iv,
-		additionalData: durablePayloadAadForPendingRecord(record)
-	}, record.localMaterial.key, record.localMaterial.ciphertext);
-	const payload = parseWalletRecoveryDurablePayload(JSON.parse(new TextDecoder().decode(plaintext)));
-	await validateWalletRecoveryDurablePayloadBindings(payload);
-	if (!pendingRecordMatchesDurablePayload(record, payload)) throw new Error("wallet recovery durable payload identity does not match its journal");
-	return payload;
-}
-function durablePayloadAadForPendingRecord(record) {
-	return walletRecoveryDurableAad({
-		recoveryOperationId: record.recoveryOperationId,
-		walletId: record.walletId,
-		reservationId: record.reservationId,
-		targetDeviceId: record.targetDeviceId,
-		targetAuthorityId: record.targetAuthorityId,
-		targetWalletAuthMethodId: record.targetWalletAuthMethodId,
-		target: record.target
-	});
-}
-function requireWalletRecoveryOperationId(value) {
-	const parsed = parseWalletRecoveryOperationId(value);
-	if (!parsed.ok) throw new Error("wallet recovery operation id is invalid");
-	return parsed.value;
-}
-function pendingRecordMatchesDurablePayload(record, payload) {
-	const common = {
-		kind: "pending_wallet_recovery_commit_v1",
-		version: 1,
-		recoveryOperationId: requireWalletRecoveryOperationId(payload.recoveryOperationId),
-		walletId: payload.walletId,
-		reservationId: payload.reservationId,
-		targetDeviceId: payload.targetDeviceId,
-		targetAuthorityId: payload.targetAuthorityId,
-		targetWalletAuthMethodId: payload.targetWalletAuthMethodId,
-		localMaterial: record.localMaterial,
-		createdAtMs: record.createdAtMs,
-		updatedAtMs: record.updatedAtMs
-	};
-	const target = durablePayloadIdentityTarget(payload);
-	if (record.stage === "awaiting_server_promotion") return pendingWalletRecoveryCommitIdentityMatches(record, {
-		...common,
-		stage: "awaiting_server_promotion",
-		target
-	});
-	switch (target.kind) {
-		case "passkey":
-			if (record.projection.kind !== "passkey") return false;
-			return pendingWalletRecoveryCommitIdentityMatches(record, {
-				...common,
-				stage: "server_promoted",
-				target,
-				projection: record.projection
-			});
-		case "google_email_otp":
-			if (record.projection.kind !== "google_email_otp") return false;
-			return pendingWalletRecoveryCommitIdentityMatches(record, {
-				...common,
-				stage: "server_promoted",
-				target,
-				projection: record.projection
-			});
-	}
-}
-function pendingWalletRecoveryCommonFromPayload(payload, localMaterial, createdAtMs, updatedAtMs) {
-	return {
-		kind: "pending_wallet_recovery_commit_v1",
-		version: 1,
-		recoveryOperationId: requireWalletRecoveryOperationId(payload.recoveryOperationId),
-		walletId: payload.walletId,
-		reservationId: payload.reservationId,
-		targetDeviceId: payload.targetDeviceId,
-		targetAuthorityId: payload.targetAuthorityId,
-		targetWalletAuthMethodId: payload.targetWalletAuthMethodId,
-		target: durablePayloadIdentityTarget(payload),
-		localMaterial,
-		createdAtMs,
-		updatedAtMs
-	};
-}
-function awaitingPendingWalletRecoveryCommit(payload, localMaterial, nowMs = Date.now()) {
-	return {
-		...pendingWalletRecoveryCommonFromPayload(payload, localMaterial, nowMs, nowMs),
-		stage: "awaiting_server_promotion"
-	};
-}
-function promotedPendingWalletRecoveryCommit(awaiting, payload, projection, nowMs = Date.now()) {
-	const common = pendingWalletRecoveryCommonFromPayload(payload, awaiting.localMaterial, awaiting.createdAtMs, Math.max(nowMs, awaiting.createdAtMs + 1));
-	if (isDurablePasskeyPayload(payload)) {
-		if (projection.kind !== "passkey") throw new Error("wallet recovery promotion projection branch changed");
-		return {
-			...common,
-			stage: "server_promoted",
-			target: durablePayloadIdentityTarget(payload),
-			projection
-		};
-	}
-	if (projection.kind !== "google_email_otp") throw new Error("wallet recovery promotion projection branch changed");
-	return {
-		...common,
-		stage: "server_promoted",
-		target: durablePayloadIdentityTarget(payload),
-		projection
-	};
-}
-//#endregion
-//#region src/core/rpcClients/relayer/walletRecoveryGoogleEmailOtp.ts
-const GOOGLE_VERIFY_PATH = "/wallets/recovery/google/verify";
-const EMAIL_OTP_VERIFY_PATH = "/wallets/recovery/email-otp/verify";
-const GOOGLE_EMAIL_OTP_FINALIZE_PATH = "/wallets/recovery/google-email-otp/finalize";
-async function verifyWalletRecoveryGoogle(args) {
-	const response = await postRecoveryJson(args, GOOGLE_VERIFY_PATH, {
-		recoveryOperationId: args.recoveryOperationId,
-		reservationId: args.reservationId,
-		idToken: args.idToken
-	});
-	if (!response.ok) return response.failure;
-	try {
-		const body = decodeWalletRecoveryGoogleVerifyResponse(response.body);
-		const identity = parseRecoveryResponseIdentity(body, args);
-		const challengeId = requireParsed(parseEmailOtpChallengeId(body.challengeId));
-		const expiresAtMs = Number(body.expiresAtMs);
-		if (!Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0) throw new Error("invalid expiry");
-		return {
-			kind: "verified",
-			...identity,
-			challengeId,
-			delivery: parseEmailOtpChallengeDelivery(body.delivery, "walletRecoveryGoogleVerify.delivery"),
-			expiresAtMs
-		};
-	} catch {
-		return { kind: "transport_uncertain" };
-	}
-}
-async function verifyWalletRecoveryEmailOtp(args) {
-	const response = await postRecoveryJson(args, EMAIL_OTP_VERIFY_PATH, {
-		recoveryOperationId: args.recoveryOperationId,
-		reservationId: args.reservationId,
-		challengeId: args.challengeId,
-		otpCode: args.otpCode
-	});
-	if (!response.ok) return response.failure;
-	try {
-		const body = decodeWalletRecoveryEmailOtpVerifyResponse(response.body);
-		const identity = parseRecoveryResponseIdentity(body, args);
-		const challengeId = requireParsed(parseEmailOtpChallengeId(body.challengeId));
-		if (challengeId !== args.challengeId) throw new Error("challenge changed");
-		return {
-			kind: "verified",
-			...identity,
-			challengeId
-		};
-	} catch {
-		return { kind: "transport_uncertain" };
-	}
-}
-async function finalizeWalletRecoveryGoogleEmailOtp(args) {
-	let replacementEnvelope;
-	let ecdsaMaterialPossessionProofs;
-	try {
-		replacementEnvelope = parsePasskeyCustodyEnvelopeRecord(args.replacementEnvelope, "walletRecoveryGoogleEmailOtpFinalize.replacementEnvelope");
-		if (replacementEnvelope.factor.kind !== "email_otp") throw new Error("wrong factor");
-		ecdsaMaterialPossessionProofs = args.ecdsaMaterialPossessionProofs.map((entry) => ({
-			keySetId: entry.keySetId,
-			proof: parseWalletRecoveryEcdsaPossessionProofV1(entry.proof)
-		}));
-	} catch {
-		return { kind: "refused" };
-	}
-	const response = await postRecoveryJson(args, GOOGLE_EMAIL_OTP_FINALIZE_PATH, {
-		kind: "finalize",
-		recoveryOperationId: args.recoveryOperationId,
-		reservationId: args.reservationId,
-		replacementEnvelope,
-		ecdsaMaterialPossessionProofs,
-		...args.emailOtpEnrollment ? { emailOtpEnrollment: args.emailOtpEnrollment } : {}
-	});
-	if (!response.ok) return response.failure;
-	try {
-		const projection = await parseWalletRecoveryCommittedProjectionV1(decodeWalletRecoveryProjectionResponse(response.body, "walletRecoveryGoogleEmailOtpFinalize").projection, buildGoogleEmailOtpProjectionExpectation(args, replacementEnvelope));
-		if (projection.kind !== "google_email_otp") throw new Error("recovery projection branch changed");
-		return {
-			kind: "promoted",
-			storeVersion: projection.storeVersion,
-			authority: projection.authority,
-			authMethod: projection.authMethod
-		};
-	} catch {
-		return { kind: "transport_uncertain" };
-	}
-}
-/** Replays an already-committed Email OTP recovery without an OTP or factor. */
-async function replayWalletRecoveryGoogleEmailOtp(args) {
-	let replacementEnvelope;
-	try {
-		replacementEnvelope = parsePasskeyCustodyEnvelopeRecord(args.replacementEnvelope, "walletRecoveryGoogleEmailOtpReplay.replacementEnvelope");
-		if (replacementEnvelope.factor.kind !== "email_otp" || String(replacementEnvelope.walletId) !== String(args.walletId)) throw new Error("recovery replay envelope identity is invalid");
-	} catch {
-		return { kind: "refused" };
-	}
-	const response = await postRecoveryJson(args, GOOGLE_EMAIL_OTP_FINALIZE_PATH, {
-		kind: "replay",
-		recoveryOperationId: args.recoveryOperationId,
-		reservationId: args.reservationId,
-		replacementEnvelope
-	});
-	if (!response.ok) return response.failure;
-	try {
-		const projection = await parseWalletRecoveryCommittedProjectionV1(decodeWalletRecoveryProjectionResponse(response.body, "walletRecoveryGoogleEmailOtpReplay").projection, buildGoogleEmailOtpProjectionExpectation(args, replacementEnvelope));
-		if (projection.kind !== "google_email_otp") throw new Error("recovery projection branch changed");
-		return {
-			kind: "promoted",
-			storeVersion: projection.storeVersion,
-			authority: projection.authority,
-			authMethod: projection.authMethod
-		};
-	} catch {
-		return { kind: "transport_uncertain" };
-	}
-}
-async function postRecoveryJson(args, path, body) {
-	let response;
-	try {
-		response = await (args.fetchImpl ?? fetch)(`${normalizeRelayerBaseUrl(args.relayUrl)}${path}`, buildRelayerJsonPostRequestInit({ body }));
-	} catch {
-		return {
-			ok: false,
-			failure: { kind: "transport_uncertain" }
-		};
-	}
-	const responseBody = await response.json().catch(() => void 0);
-	if (response.status === 200) return {
-		ok: true,
-		body: responseBody
-	};
-	if (response.status === 409 || response.status === 429) return {
-		ok: false,
-		failure: { kind: "retryable_conflict" }
-	};
-	if (response.status === 400 || response.status === 401) return {
-		ok: false,
-		failure: { kind: "refused" }
-	};
-	return {
-		ok: false,
-		failure: { kind: "transport_uncertain" }
-	};
-}
-function parseRecoveryResponseIdentity(body, expected) {
-	const recoveryOperationId = requireParsed(parseWalletRecoveryOperationId(body.recoveryOperationId));
-	const reservationId = parseRecoveryCodeReservationId(body.reservationId);
-	if (recoveryOperationId !== expected.recoveryOperationId || reservationId !== expected.reservationId) throw new Error("recovery operation identity changed");
-	return {
-		recoveryOperationId,
-		reservationId
-	};
-}
-function decodeWalletRecoveryGoogleVerifyResponse(value) {
-	const response = requireExactJsonResponse(value, [
-		"ok",
-		"recoveryOperationId",
-		"reservationId",
-		"challengeId",
-		"delivery",
-		"expiresAtMs"
-	], "walletRecoveryGoogleVerify");
-	requireSuccessfulResponse(response, "walletRecoveryGoogleVerify");
-	return {
-		recoveryOperationId: readResponseField(response, "recoveryOperationId"),
-		reservationId: readResponseField(response, "reservationId"),
-		challengeId: readResponseField(response, "challengeId"),
-		delivery: readResponseField(response, "delivery"),
-		expiresAtMs: readResponseField(response, "expiresAtMs")
-	};
-}
-function decodeWalletRecoveryEmailOtpVerifyResponse(value) {
-	const response = requireExactJsonResponse(value, [
-		"ok",
-		"recoveryOperationId",
-		"reservationId",
-		"challengeId"
-	], "walletRecoveryEmailOtpVerify");
-	requireSuccessfulResponse(response, "walletRecoveryEmailOtpVerify");
-	return {
-		recoveryOperationId: readResponseField(response, "recoveryOperationId"),
-		reservationId: readResponseField(response, "reservationId"),
-		challengeId: readResponseField(response, "challengeId")
-	};
-}
-function decodeWalletRecoveryProjectionResponse(value, label) {
-	const response = requireExactJsonResponse(value, ["ok", "projection"], label);
-	requireSuccessfulResponse(response, label);
-	return { projection: readResponseField(response, "projection") };
-}
-function requireExactJsonResponse(value, fields, label) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must be a JSON object`);
-	const prototype = Object.getPrototypeOf(value);
-	if (prototype !== Object.prototype && prototype !== null) throw new Error(`${label} must be a plain JSON object`);
-	const keys = Object.keys(value);
-	if (keys.length !== fields.length || !hasExactResponseFields(keys, fields)) throw new Error(`${label} has an unexpected response shape`);
-	return value;
-}
-function hasExactResponseFields(keys, fields) {
-	for (const field of fields) if (!keys.includes(field)) return false;
-	return true;
-}
-function requireSuccessfulResponse(value, label) {
-	if (readResponseField(value, "ok") !== true) throw new Error(`${label} did not succeed`);
-}
-function readResponseField(value, field) {
-	const descriptor = Object.getOwnPropertyDescriptor(value, field);
-	if (!descriptor || !("value" in descriptor)) throw new Error(`response field ${field} is missing`);
-	return descriptor.value;
-}
-function requireParsed(result) {
-	if (!result.ok) throw new Error("invalid domain identity");
-	return result.value;
-}
-function requireString(value) {
-	if (typeof value !== "string" || !value.trim()) throw new Error("value must be a string");
-	return value.trim();
-}
-function buildGoogleEmailOtpProjectionExpectation(args, replacementEnvelope) {
-	if (replacementEnvelope.factor.kind !== "email_otp") throw new Error("replacement envelope is not an Email OTP envelope");
-	return {
-		kind: "google_email_otp",
-		walletId: args.walletId,
-		recoveryOperationId: args.recoveryOperationId,
-		targetDeviceId: args.targetDeviceId,
-		targetAuthorityId: args.targetAuthorityId,
-		targetWalletAuthMethodId: args.targetWalletAuthMethodId,
-		providerSubject: requireParsed(parseEmailOtpProviderUserId(args.expectedProviderSubject)),
-		emailHashHex: requireEmailHash(args.expectedEmailHashHex),
-		registrationAuthorityId: requireString(args.expectedRegistrationAuthorityId),
-		enrollment: {
-			kind: "email_otp_enrollment_reference_v1",
-			enrollmentId: requireString(replacementEnvelope.factor.enrollmentId),
-			enrollmentSealKeyVersion: requireString(replacementEnvelope.factor.enrollmentSealKeyVersion)
-		}
-	};
-}
-function requireEmailHash(value) {
-	const hash = requireString(value);
-	if (!/^[0-9a-f]{64}$/.test(hash)) throw new Error("email hash is invalid");
-	return hash;
-}
-//#endregion
-//#region src/SeamsWeb/operations/recovery/walletRecoveryCommit.ts
-async function sameWalletRecoveryCommittedProjectionV1(left, right) {
-	if (left.version !== right.version || left.storeVersion !== right.storeVersion || left.walletId !== right.walletId || left.recoveryOperationId !== right.recoveryOperationId || left.targetDeviceId !== right.targetDeviceId || left.targetAuthorityId !== right.targetAuthorityId || left.targetWalletAuthMethodId !== right.targetWalletAuthMethodId || !await sameVerifiedActiveWalletAuthorityV1(left.authority, right.authority) || !sameWalletAuthMethodRecordV2(left.authMethod, right.authMethod)) return false;
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "passkey":
-			if (right.kind !== "passkey") return false;
-			return left.target.kind === right.target.kind && left.target.rpId === right.target.rpId && left.target.credentialIdB64u === right.target.credentialIdB64u;
-		case "google_email_otp":
-			if (right.kind !== "google_email_otp") return false;
-			return left.target.kind === right.target.kind && left.target.provider === right.target.provider && left.target.providerSubject === right.target.providerSubject && left.target.emailHashHex === right.target.emailHashHex && left.target.registrationAuthorityId === right.target.registrationAuthorityId && left.target.enrollment.kind === right.target.enrollment.kind && left.target.enrollment.enrollmentId === right.target.enrollment.enrollmentId && left.target.enrollment.enrollmentSealKeyVersion === right.target.enrollment.enrollmentSealKeyVersion;
-		default: return assertNeverWalletRecoveryProjection(left);
-	}
-}
-function assertNeverWalletRecoveryProjection(value) {
-	throw new Error(`unsupported wallet recovery projection: ${String(value)}`);
-}
-function committedProjectionFromPromotion(input) {
-	const recoveryOperationId = requireWalletRecoveryOperationId(input.payload.recoveryOperationId);
-	switch (input.kind) {
-		case "passkey": return buildWalletRecoveryCommittedProjectionV1({
-			kind: "passkey",
-			storeVersion: input.promotion.storeVersion,
-			walletId: input.payload.walletId,
-			recoveryOperationId,
-			targetDeviceId: input.payload.targetDeviceId,
-			targetAuthorityId: input.payload.targetAuthorityId,
-			targetWalletAuthMethodId: input.payload.targetWalletAuthMethodId,
-			authority: input.promotion.authority,
-			authMethod: input.promotion.authMethod
-		});
-		case "google_email_otp": {
-			const providerSubject = parseEmailOtpProviderUserId(input.payload.providerSubject);
-			if (!providerSubject.ok) throw new Error("wallet recovery provider subject is invalid");
-			return buildWalletRecoveryCommittedProjectionV1({
-				kind: "google_email_otp",
-				storeVersion: input.promotion.storeVersion,
-				walletId: input.payload.walletId,
-				recoveryOperationId,
-				targetDeviceId: input.payload.targetDeviceId,
-				targetAuthorityId: input.payload.targetAuthorityId,
-				targetWalletAuthMethodId: input.payload.targetWalletAuthMethodId,
-				authority: input.promotion.authority,
-				authMethod: input.promotion.authMethod,
-				providerSubject: providerSubject.value,
-				emailHashHex: input.payload.emailHashHex,
-				registrationAuthorityId: input.payload.registrationAuthorityId,
-				enrollment: durableEmailEnrollmentReference(input.payload)
-			});
-		}
-	}
-}
-function ecdsaPossessionProofs(payload) {
-	return payload.ecdsaKeySets.map((keySet) => ({
-		keySetId: keySet.entry.keySetId,
-		proof: keySet.possessionProof
-	}));
-}
-function webAuthnRegistrationFromPayload(payload) {
-	return {
-		id: payload.registration.id,
-		rawId: payload.registration.rawId,
-		type: payload.registration.type,
-		authenticatorAttachment: payload.registration.authenticatorAttachment ?? void 0,
-		response: {
-			clientDataJSON: payload.registration.response.clientDataJSON,
-			attestationObject: payload.registration.response.attestationObject,
-			transports: [...payload.registration.response.transports]
-		},
-		clientExtensionResults: { prf: { results: {
-			first: void 0,
-			second: void 0
-		} } }
-	};
-}
-async function finalizeAwaitingCommit(input) {
-	const { payload } = input;
-	if (isDurablePasskeyPayload(payload)) {
-		const promotion = await finalizeWalletRecovery({
-			relayUrl: input.relayUrl,
-			walletId: String(payload.walletId),
-			reservationId: String(payload.reservationId),
-			recoveryOperationId: requireWalletRecoveryOperationId(payload.recoveryOperationId),
-			targetDeviceId: String(payload.targetDeviceId),
-			targetAuthorityId: String(payload.targetAuthorityId),
-			targetWalletAuthMethodId: String(payload.targetWalletAuthMethodId),
-			challengeId: payload.challengeId,
-			replacementId: payload.replacementId,
-			webauthnRegistration: webAuthnRegistrationFromPayload(payload),
-			replacementEnvelope: payload.replacementEnvelope,
-			ecdsaMaterialPossessionProofs: ecdsaPossessionProofs(payload),
-			fetchImpl: input.fetchImpl
-		});
-		if (promotion.kind !== "promoted") return promotion;
-		return {
-			kind: "passkey",
-			payload,
-			promotion
-		};
-	}
-	const promotion = await finalizeWalletRecoveryGoogleEmailOtp({
-		relayUrl: input.relayUrl,
-		recoveryOperationId: requireWalletRecoveryOperationId(payload.recoveryOperationId),
-		reservationId: payload.reservationId,
-		walletId: payload.walletId,
-		targetDeviceId: payload.targetDeviceId,
-		targetAuthorityId: payload.targetAuthorityId,
-		targetWalletAuthMethodId: payload.targetWalletAuthMethodId,
-		expectedProviderSubject: payload.providerSubject,
-		expectedEmailHashHex: payload.emailHashHex,
-		expectedRegistrationAuthorityId: payload.registrationAuthorityId,
-		replacementEnvelope: payload.replacementEnvelope,
-		ecdsaMaterialPossessionProofs: ecdsaPossessionProofs(payload),
-		emailOtpEnrollment: emailOtpEnrollmentMaterial(payload.enrollment),
-		fetchImpl: input.fetchImpl
-	});
-	if (promotion.kind !== "promoted") return promotion;
-	return {
-		kind: "google_email_otp",
-		payload,
-		promotion
-	};
-}
-function emailOtpEnrollmentMaterial(enrollment) {
-	return enrollment.kind === "create" ? {
-		kind: "create",
-		material: enrollment.material
-	} : null;
-}
-async function replayPromotedCommit(input) {
-	const { payload } = input;
-	if (isDurablePasskeyPayload(payload)) {
-		const promotion = await replayWalletRecovery({
-			relayUrl: input.relayUrl,
-			walletId: String(payload.walletId),
-			reservationId: String(payload.reservationId),
-			recoveryOperationId: requireWalletRecoveryOperationId(payload.recoveryOperationId),
-			targetDeviceId: String(payload.targetDeviceId),
-			targetAuthorityId: String(payload.targetAuthorityId),
-			targetWalletAuthMethodId: String(payload.targetWalletAuthMethodId),
-			replacementId: payload.replacementId,
-			replacementEnvelope: payload.replacementEnvelope,
-			fetchImpl: input.fetchImpl
-		});
-		if (promotion.kind !== "promoted") return promotion;
-		return {
-			kind: "passkey",
-			payload,
-			promotion
-		};
-	}
-	const promotion = await replayWalletRecoveryGoogleEmailOtp({
-		relayUrl: input.relayUrl,
-		recoveryOperationId: requireWalletRecoveryOperationId(payload.recoveryOperationId),
-		reservationId: payload.reservationId,
-		walletId: payload.walletId,
-		targetDeviceId: payload.targetDeviceId,
-		targetAuthorityId: payload.targetAuthorityId,
-		targetWalletAuthMethodId: payload.targetWalletAuthMethodId,
-		expectedProviderSubject: payload.providerSubject,
-		expectedEmailHashHex: payload.emailHashHex,
-		expectedRegistrationAuthorityId: payload.registrationAuthorityId,
-		replacementEnvelope: payload.replacementEnvelope,
-		fetchImpl: input.fetchImpl
-	});
-	if (promotion.kind !== "promoted") return promotion;
-	return {
-		kind: "google_email_otp",
-		payload,
-		promotion
-	};
-}
-function isWalletRecoveryCommitPromotion(value) {
-	return value.kind === "passkey" || value.kind === "google_email_otp";
-}
-async function resumeAwaitingCommit(input) {
-	const replay = await replayPromotedCommit(input);
-	if (isWalletRecoveryCommitPromotion(replay) || replay.kind !== "refused") return replay;
-	return await finalizeAwaitingCommit(input);
-}
-function passkeyAuthority(payload, projection) {
-	return {
-		walletId: payload.walletId,
-		factor: {
-			kind: "passkey",
-			credentialIdB64u: projection.target.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: projection.target.rpId
-		},
-		bindingId: projection.authMethod.walletAuthMethodId
-	};
-}
-function emailAuthority(payload, projection) {
-	const base = buildEmailOtpWalletAuthAuthority({
-		walletId: payload.walletId,
-		provider: "google",
-		providerUserId: payload.providerSubject,
-		emailHashHex: payload.emailHashHex
-	});
-	return {
-		walletId: base.walletId,
-		factor: base.factor,
-		verifier: base.verifier,
-		bindingId: projection.authMethod.walletAuthMethodId
-	};
-}
-async function recoveryAuthorityRef(payload, projection) {
-	if (isDurablePasskeyPayload(payload)) {
-		if (projection.kind !== "passkey") throw new Error("wallet recovery projection branch changed");
-		return walletAuthAuthorityRef({ authority: passkeyAuthority(payload, projection) });
-	}
-	if (projection.kind !== "google_email_otp") throw new Error("wallet recovery projection branch changed");
-	return walletAuthAuthorityRef({ authority: emailAuthority(payload, projection) });
-}
-async function prepareEcdsaWalletContinuity(input) {
-	const keys = [];
-	const ecdsaContinuity = [];
-	for (const keySet of input.payload.ecdsaKeySets) {
-		const entry = keySet.entry;
-		const basis = entry.recoveryBasis;
-		const relayerKeyId = await computeEcdsaDerivationRoleLocalRelayerKeyId({
-			walletId: input.payload.walletId,
-			signingRootId: basis.signingRootId,
-			signingRootVersion: basis.signingRootVersion
-		});
-		const prepared = await prepareWalletCustodyEcdsaContinuity({
-			authority: input.authority,
-			chainTargets: basis.chainTargets,
-			walletId: String(input.payload.walletId),
-			keyHandle: entry.keyHandle,
-			ecdsaThresholdKeyId: basis.ecdsaThresholdKeyId,
-			signingRootId: basis.signingRootId,
-			signingRootVersion: basis.signingRootVersion,
-			relayerKeyId,
-			participantIds: basis.participantIds,
-			publicCapability: basis.publicCapability,
-			activationReceipt: basis.activationReceipt,
-			runtimePolicyScope: basis.runtimePolicyScope,
-			readyStateBlobB64u: keySet.readyStateBlobB64u,
-			publicFacts: keySet.publicFacts
-		});
-		ecdsaContinuity.push(prepared);
-		for (const chainTarget of basis.chainTargets) keys.push(ecdsaWalletKey({
-			payload: input.payload,
-			keySet,
-			chainTarget,
-			materialRef: prepared.roleLocalMaterialRef,
-			relayerKeyId
-		}));
-	}
-	return {
-		walletKeys: keys,
-		ecdsaContinuity
-	};
-}
-function ecdsaWalletKey(input) {
-	const entry = input.keySet.entry;
-	const basis = entry.recoveryBasis;
-	const facts = input.keySet.publicFacts;
-	const roleLocalPublicFacts = buildEcdsaRoleLocalPublicFacts({
-		walletId: input.payload.walletId,
-		chainTarget: input.chainTarget,
-		keyHandle: entry.keyHandle,
-		ecdsaThresholdKeyId: basis.ecdsaThresholdKeyId,
-		signingRootId: basis.signingRootId,
-		signingRootVersion: basis.signingRootVersion,
-		applicationBindingDigestB64u: basis.publicCapability.context.application_binding_digest_b64u,
-		clientParticipantId: 1,
-		relayerParticipantId: 2,
-		participantIds: basis.participantIds,
-		contextBinding32B64u: facts.contextBinding32B64u,
-		derivationClientSharePublicKey33B64u: facts.derivationClientSharePublicKey33B64u,
-		relayerPublicKey33B64u: facts.relayerPublicKey33B64u,
-		groupPublicKey33B64u: facts.groupPublicKey33B64u,
-		ethereumAddress: facts.ethereumAddress,
-		publicCapability: basis.publicCapability
-	});
-	return {
-		keyScope: "evm-family",
-		chainTarget: input.chainTarget,
-		walletId: String(input.payload.walletId),
-		evmFamilySigningKeySlotId: entry.evmFamilySigningKeySlotId,
-		keyHandle: entry.keyHandle,
-		ecdsaThresholdKeyId: basis.ecdsaThresholdKeyId,
-		signingRootId: basis.signingRootId,
-		signingRootVersion: basis.signingRootVersion,
-		thresholdEcdsaPublicKeyB64u: facts.groupPublicKey33B64u,
-		thresholdOwnerAddress: facts.ethereumAddress,
-		relayerKeyId: input.relayerKeyId,
-		relayerVerifyingShareB64u: facts.relayerPublicKey33B64u,
-		participantIds: basis.participantIds,
-		publicCapability: basis.publicCapability,
-		roleLocalMaterialRef: input.materialRef,
-		ecdsaRoleLocalPublicFacts: roleLocalPublicFacts
-	};
-}
-function nearKeySet(input) {
-	if (input.nearKeySets.length !== 1) throw new Error("wallet recovery requires exactly one NEAR key set");
-	return input.nearKeySets[0];
-}
-function nearCredentialTransports(payload) {
-	return [...payload.registration.response.transports];
-}
-function nearOperationalPublicKey(payload) {
-	return `ed25519:${base58Encode(base64UrlDecode(nearKeySet(payload).binding.registeredPublicKeyB64u))}`;
-}
-function ed25519PublicCapabilityReference(payload, keySet) {
-	const thresholdSessionId = parseThresholdEd25519SessionId(keySet.thresholdSessionId);
-	if (!thresholdSessionId.ok) throw new Error("recovery NEAR threshold session id is invalid");
-	return {
-		walletId: payload.walletId,
-		nearAccountId: toAccountId(keySet.binding.nearAccountId),
-		thresholdSessionId: thresholdSessionId.value,
-		runtimePolicyScope: keySet.runtimePolicyScope,
-		materialActivation: routerAbMpcMaterialActivationRefFromWire(keySet.materialActivation)
-	};
-}
-async function buildRecoveryPublication(input) {
-	if (isDurablePasskeyPayload(input.payload)) {
-		if (input.projection.kind !== "passkey") throw new Error("wallet recovery projection branch changed");
-		const common = {
-			walletId: input.payload.walletId,
-			rpId: input.projection.target.rpId,
-			credentialIdB64u: input.projection.target.credentialIdB64u,
-			credentialPublicKeyB64u: input.projection.authMethod.credentialPublicKeyB64u,
-			transports: nearCredentialTransports(input.payload),
-			walletKeys: input.walletKeys
-		};
-		if (input.payload.nearKeySets.length === 0) return prepareWalletRecoveryPasskeyPublication({
-			kind: "evm_family_ecdsa",
-			...common
-		});
-		const near = nearKeySet(input.payload);
-		return prepareWalletRecoveryPasskeyPublication({
-			kind: "near_ed25519",
-			...common,
-			nearAccountId: toAccountId(near.binding.nearAccountId),
-			nearEd25519SigningKeyId: near.binding.nearEd25519SigningKeyId,
-			signerSlot: near.binding.signerSlot,
-			operationalPublicKey: nearOperationalPublicKey(input.payload),
-			relayerKeyId: near.binding.signingWorkerId,
-			participantIds: near.binding.participantIds,
-			custodyMaterials: input.payload.nearKeySets.map((keySet) => ({
-				binding: keySet.binding,
-				sealed: keySet.sealed
-			}))
-		});
-	}
-	if (input.projection.kind !== "google_email_otp") throw new Error("wallet recovery projection branch changed");
-	const localAuthority = emailAuthority(input.payload, input.projection);
-	const common = {
-		walletId: input.payload.walletId,
-		email: input.payload.verifiedEmail,
-		registrationAuthorityId: input.payload.registrationAuthorityId,
-		authority: localAuthority,
-		walletKeys: input.walletKeys
-	};
-	if (input.payload.nearKeySets.length === 0) return prepareWalletRecoveryEmailOtpPublication({
-		kind: "evm_family_ecdsa",
-		...common
-	});
-	const near = nearKeySet(input.payload);
-	return prepareWalletRecoveryEmailOtpPublication({
-		kind: "near_ed25519",
-		...common,
-		nearAccountId: toAccountId(near.binding.nearAccountId),
-		nearEd25519SigningKeyId: near.binding.nearEd25519SigningKeyId,
-		signerSlot: near.binding.signerSlot,
-		operationalPublicKey: nearOperationalPublicKey(input.payload),
-		relayerKeyId: near.binding.signingWorkerId,
-		participantIds: near.binding.participantIds,
-		custodyMaterials: input.payload.nearKeySets.map((keySet) => ({
-			binding: keySet.binding,
-			sealed: keySet.sealed
-		}))
-	});
-}
-async function restoreAndPublishWalletRecoveryCommit(input) {
-	const projection = input.pending.projection;
-	const authority = await recoveryAuthorityRef(input.payload, projection);
-	const continuity = await prepareEcdsaWalletContinuity({
-		payload: input.payload,
-		authority
-	});
-	const registration = await buildRecoveryPublication({
-		payload: input.payload,
-		projection,
-		walletKeys: continuity.walletKeys
-	});
-	await IndexedDBManager.publishPendingWalletRecoveryCommit({
-		pending: input.pending,
-		authority: projection.authority,
-		authMethod: projection.authMethod,
-		registration,
-		ecdsaContinuity: continuity.ecdsaContinuity,
-		ed25519PublicCapabilityReferences: input.payload.nearKeySets.map((keySet) => ed25519PublicCapabilityReference(input.payload, keySet))
-	});
-}
-async function resumePendingWalletRecoveries(input) {
-	const pending = await IndexedDBManager.listPendingWalletRecoveryCommits();
-	const results = [];
-	for (const record of pending) try {
-		const payload = await decryptWalletRecoveryDurablePayload(record);
-		const promotion = record.stage === "awaiting_server_promotion" ? await resumeAwaitingCommit({
-			relayUrl: input.relayUrl,
-			payload,
-			fetchImpl: input.fetchImpl
-		}) : await replayPromotedCommit({
-			relayUrl: input.relayUrl,
-			payload,
-			fetchImpl: input.fetchImpl
-		});
-		if (!isWalletRecoveryCommitPromotion(promotion)) {
-			if (promotion.kind === "refused") {
-				await IndexedDBManager.deletePendingWalletRecoveryCommit(record.recoveryOperationId);
-				results.push({
-					kind: "discarded",
-					recoveryOperationId: String(record.recoveryOperationId)
-				});
-				continue;
-			}
-			results.push({
-				kind: "pending",
-				recoveryOperationId: String(record.recoveryOperationId),
-				failure: promotion
-			});
-			continue;
-		}
-		const commitPromotion = promotion;
-		const projection = committedProjectionFromPromotion(commitPromotion);
-		const promoted = record.stage === "awaiting_server_promotion" ? await IndexedDBManager.advancePendingWalletRecoveryCommit({
-			awaiting: record,
-			promoted: promotedPendingWalletRecoveryCommit(record, commitPromotion.payload, projection, record.updatedAtMs + 1)
-		}) : record;
-		if (record.stage === "server_promoted" && !await sameWalletRecoveryCommittedProjectionV1(record.projection, projection)) throw new Error("wallet recovery replay projection changed");
-		await restoreAndPublishWalletRecoveryCommit({
-			pending: promoted,
-			payload: commitPromotion.payload
-		});
-		results.push({
-			kind: "completed",
-			recoveryOperationId: String(record.recoveryOperationId)
-		});
-	} catch (error) {
-		console.warn("[SeamsWeb] pending wallet recovery replay failed before classification:", String(record.recoveryOperationId), error instanceof Error ? error.message : String(error || "unknown error"));
-		results.push({
-			kind: "corrupt",
-			recoveryOperationId: String(record.recoveryOperationId)
-		});
-	}
-	return results;
-}
-async function createAwaitingWalletRecoveryCommit(input) {
-	const payload = await walletRecoveryDurablePayloadFromOperation(input.operation);
-	return {
-		payload,
-		pending: awaitingPendingWalletRecoveryCommit(payload, await encryptWalletRecoveryDurablePayload(payload), input.nowMs)
-	};
-}
-async function promoteWalletRecoveryCommit(input) {
-	const projection = committedProjectionFromPromotion(input.promotion);
-	return IndexedDBManager.advancePendingWalletRecoveryCommit({
-		awaiting: input.awaiting,
-		promoted: promotedPendingWalletRecoveryCommit(input.awaiting, input.promotion.payload, projection, input.awaiting.updatedAtMs + 1)
-	});
-}
-//#endregion
-export { finalizeWalletRecoveryGoogleEmailOtp as a, isDurablePasskeyPayload as c, prepareWalletRecoveryWithCode as d, resumePendingWalletRecoveries as i, finalizeWalletRecovery as l, promoteWalletRecoveryCommit as n, verifyWalletRecoveryEmailOtp as o, restoreAndPublishWalletRecoveryCommit as r, verifyWalletRecoveryGoogle as s, createAwaitingWalletRecoveryCommit as t, buildWalletRecoveryCeremonyCustodyJson as u };