@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/react/shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.js

@@ -1,251 +0,0 @@
-import { requireTrimmedString } from "../utils/validation.js";
-import { parseEmailOtpProviderUserId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../utils/domainIds.js";
-import { parseDeviceId } from "../authorization/capabilityKinds.js";
-import { parseWalletAuthMethodRecordV2 } from "../utils/walletAuthMethodRecord.js";
-import { isActiveRecoveredWalletAuthorityV1, parseWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../authorization/walletAuthority.js";
-//#region ../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.ts
-function buildWalletRecoveryCommittedProjectionV1(input) {
-	if (input.kind === "passkey") return buildPasskeyProjection(input);
-	return buildGoogleEmailOtpProjection(input);
-}
-function buildPasskeyProjection(input) {
-	const projection = {
-		version: "wallet_recovery_committed_projection_v1",
-		storeVersion: requireTrimmedString(input.storeVersion, "storeVersion", "is invalid"),
-		walletId: input.walletId,
-		recoveryOperationId: input.recoveryOperationId,
-		targetDeviceId: input.targetDeviceId,
-		targetAuthorityId: input.targetAuthorityId,
-		targetWalletAuthMethodId: input.targetWalletAuthMethodId,
-		authority: input.authority,
-		kind: "passkey",
-		authMethod: input.authMethod,
-		target: {
-			kind: "passkey",
-			rpId: input.authMethod.rpId,
-			credentialIdB64u: input.authMethod.credentialIdB64u
-		}
-	};
-	assertProjectionShape(projection);
-	return projection;
-}
-function buildGoogleEmailOtpProjection(input) {
-	const projection = {
-		version: "wallet_recovery_committed_projection_v1",
-		storeVersion: requireTrimmedString(input.storeVersion, "storeVersion", "is invalid"),
-		walletId: input.walletId,
-		recoveryOperationId: input.recoveryOperationId,
-		targetDeviceId: input.targetDeviceId,
-		targetAuthorityId: input.targetAuthorityId,
-		targetWalletAuthMethodId: input.targetWalletAuthMethodId,
-		authority: input.authority,
-		kind: "google_email_otp",
-		authMethod: input.authMethod,
-		target: {
-			kind: "google_email_otp",
-			provider: "google",
-			providerSubject: input.providerSubject,
-			emailHashHex: requireEmailHash(input.emailHashHex),
-			registrationAuthorityId: requireTrimmedString(input.registrationAuthorityId, "registrationAuthorityId", "is invalid"),
-			enrollment: parseEnrollmentReference(input.enrollment)
-		}
-	};
-	assertProjectionShape(projection);
-	return projection;
-}
-async function parseWalletRecoveryCommittedProjectionV1(raw, expected) {
-	const record = parseWalletRecoveryCommittedProjectionWireV1(raw);
-	if (record.version !== "wallet_recovery_committed_projection_v1") throw new Error("wallet recovery committed projection version is invalid");
-	if (record.kind !== expected.kind) throw new Error("wallet recovery committed projection target changed");
-	const walletId = requireParsed(parseWalletId(record.walletId), "walletId");
-	const recoveryOperationId = requireParsed(parseWalletRecoveryOperationId(record.recoveryOperationId), "recoveryOperationId");
-	const targetDeviceId = requireParsed(parseDeviceId(record.targetDeviceId), "targetDeviceId");
-	const targetAuthorityId = requireParsed(parseWalletAuthorityId(record.targetAuthorityId), "targetAuthorityId");
-	const targetWalletAuthMethodId = requireParsed(parseWalletAuthMethodId(record.targetWalletAuthMethodId), "targetWalletAuthMethodId");
-	const authorityResult = parseWalletAuthorityV1(record.authority);
-	if (!authorityResult.ok) throw new Error("wallet recovery authority projection is invalid");
-	const authority = authorityResult.value;
-	if (authority.state !== "active" || !isActiveRecoveredWalletAuthorityV1(authority) || !await walletAuthorityDigestsMatchV1(authority)) throw new Error("wallet recovery authority projection digest or lifecycle is invalid");
-	const authMethod = parseWalletAuthMethodRecordV2(record.authMethod);
-	if (!authMethod || authMethod.status !== "active") throw new Error("wallet recovery auth method projection is invalid");
-	const common = {
-		version: "wallet_recovery_committed_projection_v1",
-		storeVersion: requireTrimmedString(record.storeVersion, "storeVersion", "is invalid"),
-		walletId,
-		recoveryOperationId,
-		targetDeviceId,
-		targetAuthorityId,
-		targetWalletAuthMethodId,
-		authority
-	};
-	if (expected.kind === "passkey") {
-		if (authMethod.kind !== "passkey") throw new Error("wallet recovery target method family changed");
-		const target = parsePasskeyTarget(record.target);
-		const projection = {
-			...common,
-			kind: "passkey",
-			authMethod,
-			target
-		};
-		assertExpectedIdentity(projection, expected);
-		assertProjectionShape(projection);
-		return projection;
-	}
-	if (authMethod.kind !== "email_otp") throw new Error("wallet recovery target method family changed");
-	const target = parseGoogleEmailOtpTarget(record.target);
-	const projection = {
-		...common,
-		kind: "google_email_otp",
-		authMethod,
-		target
-	};
-	assertExpectedIdentity(projection, expected);
-	assertProjectionShape(projection);
-	return projection;
-}
-function parsePasskeyTarget(raw) {
-	const record = parseWalletRecoveryPasskeyTargetWireV1(raw);
-	if (record.kind !== "passkey") throw new Error("wallet recovery passkey target is invalid");
-	return {
-		kind: "passkey",
-		rpId: requireParsed(parseWebAuthnRpId(record.rpId), "target.rpId"),
-		credentialIdB64u: requireParsed(parseWebAuthnCredentialIdB64u(record.credentialIdB64u), "target.credentialIdB64u")
-	};
-}
-function parseGoogleEmailOtpTarget(raw) {
-	const record = parseWalletRecoveryGoogleEmailOtpTargetWireV1(raw);
-	if (record.kind !== "google_email_otp" || record.provider !== "google") throw new Error("wallet recovery Google Email OTP target is invalid");
-	return {
-		kind: "google_email_otp",
-		provider: "google",
-		providerSubject: requireParsed(parseEmailOtpProviderUserId(record.providerSubject), "target.providerSubject"),
-		emailHashHex: requireEmailHash(record.emailHashHex),
-		registrationAuthorityId: requireTrimmedString(record.registrationAuthorityId, "target.registrationAuthorityId", "is invalid"),
-		enrollment: parseEnrollmentReference(record.enrollment)
-	};
-}
-function parseEnrollmentReference(raw) {
-	const record = parseWalletRecoveryEmailOtpEnrollmentWireV1(raw);
-	if (record.kind !== "email_otp_enrollment_reference_v1") throw new Error("wallet recovery Email OTP enrollment is invalid");
-	return {
-		kind: "email_otp_enrollment_reference_v1",
-		enrollmentId: requireTrimmedString(record.enrollmentId, "enrollment.enrollmentId", "is invalid"),
-		enrollmentSealKeyVersion: requireTrimmedString(record.enrollmentSealKeyVersion, "enrollment.enrollmentSealKeyVersion", "is invalid")
-	};
-}
-function assertExpectedIdentity(projection, expected) {
-	if (projection.kind !== expected.kind || projection.walletId !== expected.walletId || projection.recoveryOperationId !== expected.recoveryOperationId || projection.targetDeviceId !== expected.targetDeviceId || projection.targetAuthorityId !== expected.targetAuthorityId || projection.targetWalletAuthMethodId !== expected.targetWalletAuthMethodId) throw new Error("wallet recovery committed projection identity changed");
-	if (projection.kind === "passkey" && expected.kind === "passkey") {
-		if (projection.target.rpId !== expected.rpId || projection.target.credentialIdB64u !== expected.credentialIdB64u) throw new Error("wallet recovery passkey target changed");
-		return;
-	}
-	if (projection.kind !== "google_email_otp" || expected.kind !== "google_email_otp") throw new Error("wallet recovery target identity changed");
-	if (projection.target.providerSubject !== expected.providerSubject || projection.target.emailHashHex !== expected.emailHashHex || projection.target.registrationAuthorityId !== expected.registrationAuthorityId || projection.target.enrollment.enrollmentId !== expected.enrollment.enrollmentId || projection.target.enrollment.enrollmentSealKeyVersion !== expected.enrollment.enrollmentSealKeyVersion) throw new Error("wallet recovery Google Email OTP target changed");
-}
-function assertProjectionShape(projection) {
-	if (projection.authority.walletId !== projection.walletId || projection.authority.authorityId !== projection.targetAuthorityId || projection.authority.principal.deviceId !== projection.targetDeviceId || projection.authority.provenance.kind !== "wallet_recovery" || projection.authority.provenance.recoveryOperationId !== projection.recoveryOperationId || projection.authority.provenance.continuityAuthorityId === projection.targetAuthorityId || projection.authMethod.walletId !== projection.walletId || projection.authMethod.walletAuthorityId !== projection.targetAuthorityId || projection.authMethod.walletAuthMethodId !== projection.targetWalletAuthMethodId || projection.authMethod.status !== "active") throw new Error("wallet recovery committed projection relations are invalid");
-	if (projection.kind === "passkey") {
-		if (projection.authMethod.kind !== "passkey" || projection.target.rpId !== projection.authMethod.rpId || projection.target.credentialIdB64u !== projection.authMethod.credentialIdB64u) throw new Error("wallet recovery passkey projection relations are invalid");
-		return;
-	}
-	if (projection.authMethod.kind !== "email_otp" || projection.target.emailHashHex !== projection.authMethod.emailHashHex || projection.target.registrationAuthorityId !== projection.authMethod.registrationAuthorityId) throw new Error("wallet recovery Google Email OTP projection relations are invalid");
-}
-function parseWalletRecoveryCommittedProjectionWireV1(value) {
-	const record = inspectRawObject(value);
-	if (record === null) throw new Error("wallet recovery committed projection must be an object");
-	requireExactFields(record, [
-		"version",
-		"kind",
-		"storeVersion",
-		"walletId",
-		"recoveryOperationId",
-		"targetDeviceId",
-		"targetAuthorityId",
-		"targetWalletAuthMethodId",
-		"authority",
-		"authMethod",
-		"target"
-	], "wallet recovery committed projection");
-	return {
-		version: Reflect.get(record, "version"),
-		kind: Reflect.get(record, "kind"),
-		storeVersion: Reflect.get(record, "storeVersion"),
-		walletId: Reflect.get(record, "walletId"),
-		recoveryOperationId: Reflect.get(record, "recoveryOperationId"),
-		targetDeviceId: Reflect.get(record, "targetDeviceId"),
-		targetAuthorityId: Reflect.get(record, "targetAuthorityId"),
-		targetWalletAuthMethodId: Reflect.get(record, "targetWalletAuthMethodId"),
-		authority: Reflect.get(record, "authority"),
-		authMethod: Reflect.get(record, "authMethod"),
-		target: Reflect.get(record, "target")
-	};
-}
-function parseWalletRecoveryPasskeyTargetWireV1(value) {
-	const record = inspectRawObject(value);
-	if (record === null) throw new Error("wallet recovery passkey target must be an object");
-	requireExactFields(record, [
-		"kind",
-		"rpId",
-		"credentialIdB64u"
-	], "wallet recovery passkey target");
-	return {
-		kind: Reflect.get(record, "kind"),
-		rpId: Reflect.get(record, "rpId"),
-		credentialIdB64u: Reflect.get(record, "credentialIdB64u")
-	};
-}
-function parseWalletRecoveryGoogleEmailOtpTargetWireV1(value) {
-	const record = inspectRawObject(value);
-	if (record === null) throw new Error("wallet recovery Google Email OTP target must be an object");
-	requireExactFields(record, [
-		"kind",
-		"provider",
-		"providerSubject",
-		"emailHashHex",
-		"registrationAuthorityId",
-		"enrollment"
-	], "wallet recovery Google Email OTP target");
-	return {
-		kind: Reflect.get(record, "kind"),
-		provider: Reflect.get(record, "provider"),
-		providerSubject: Reflect.get(record, "providerSubject"),
-		emailHashHex: Reflect.get(record, "emailHashHex"),
-		registrationAuthorityId: Reflect.get(record, "registrationAuthorityId"),
-		enrollment: Reflect.get(record, "enrollment")
-	};
-}
-function parseWalletRecoveryEmailOtpEnrollmentWireV1(value) {
-	const record = inspectRawObject(value);
-	if (record === null) throw new Error("wallet recovery Email OTP enrollment must be an object");
-	requireExactFields(record, [
-		"kind",
-		"enrollmentId",
-		"enrollmentSealKeyVersion"
-	], "wallet recovery Email OTP enrollment");
-	return {
-		kind: Reflect.get(record, "kind"),
-		enrollmentId: Reflect.get(record, "enrollmentId"),
-		enrollmentSealKeyVersion: Reflect.get(record, "enrollmentSealKeyVersion")
-	};
-}
-function inspectRawObject(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function requireExactFields(record, expected, label) {
-	const expectedSet = new Set(expected);
-	const actual = Object.keys(record);
-	if (actual.length !== expected.length || actual.some((field) => !expectedSet.has(field))) throw new Error(`${label} contains unexpected fields`);
-}
-function requireParsed(result, label) {
-	if (!result.ok) throw new Error(`${label} is invalid`);
-	return result.value;
-}
-function requireEmailHash(value) {
-	const hash = requireTrimmedString(value, "emailHashHex", "is invalid");
-	if (!/^[0-9a-f]{64}$/.test(hash)) throw new Error("emailHashHex is invalid");
-	return hash;
-}
-//#endregion
-export { buildWalletRecoveryCommittedProjectionV1, parseWalletRecoveryCommittedProjectionV1 };
-
-//# sourceMappingURL=walletRecoveryCommittedProjection.js.map

package/dist/esm/react/shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js

@@ -1,153 +0,0 @@
-import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { requireRecord } from "../utils/validation.js";
-import { parseDigestB64u, sha256DigestB64u } from "../utils/canonicalPrimitives.js";
-//#region ../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.ts
-const POSSESSION_CHALLENGE_DOMAIN_V1 = "seams/wallet-recovery/ecdsa-existing-material-possession/v1";
-const POSSESSION_PROOF_SCHEME_V1 = "secp256k1_bip340_sha256_v1";
-function requireExactKeys(record, label, keys) {
-	const allowed = new Set(keys);
-	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not a supported field`);
-	for (const key of keys) if (!Object.hasOwn(record, key)) throw new Error(`${label}.${key} is required`);
-}
-function requireVisibleIdentifier(value, label) {
-	if (typeof value !== "string" || value.length === 0 || value.trim() !== value) throw new Error(`${label} must be a non-empty canonical identifier`);
-	for (let index = 0; index < value.length; index += 1) {
-		const code = value.charCodeAt(index);
-		if (code < 33 || code > 126) throw new Error(`${label} must contain visible ASCII bytes`);
-	}
-	return value;
-}
-function isEcdsaKeySetId(value) {
-	return value.startsWith("evm_family_ecdsa:") && value.length > 17;
-}
-function requireEcdsaKeySetId(value, label) {
-	const keySetId = requireVisibleIdentifier(value, label);
-	if (!isEcdsaKeySetId(keySetId)) throw new Error(`${label} must identify an ECDSA key set`);
-	return keySetId;
-}
-function requireDigest(value, label) {
-	try {
-		return parseDigestB64u(value);
-	} catch {
-		throw new Error(`${label} must be canonical base64url for 32 bytes`);
-	}
-}
-function requireCompressedPublicKey(value, label) {
-	if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(`${label} must be canonical base64url`);
-	let bytes;
-	try {
-		bytes = base64UrlDecode(value);
-	} catch {
-		throw new Error(`${label} must be valid base64url`);
-	}
-	if (bytes.length !== 33 || bytes[0] !== 2 && bytes[0] !== 3 || base64UrlEncode(bytes) !== value) throw new Error(`${label} must be canonical compressed secp256k1 public key bytes`);
-	return value;
-}
-function requirePositiveSafeInteger(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
-	return value;
-}
-function requireSignature64(value, label) {
-	if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(`${label} must be canonical base64url`);
-	let bytes;
-	try {
-		bytes = base64UrlDecode(value);
-	} catch {
-		throw new Error(`${label} must be valid base64url`);
-	}
-	if (bytes.length !== 64 || base64UrlEncode(bytes) !== value) throw new Error(`${label} must be canonical base64url for 64 bytes`);
-	return value;
-}
-function parseWalletRecoveryEcdsaPossessionChallengeV1(value) {
-	const record = requireRecord(value, "walletRecoveryEcdsaPossessionChallenge");
-	requireExactKeys(record, "walletRecoveryEcdsaPossessionChallenge", [
-		"kind",
-		"walletId",
-		"reservationId",
-		"replacementId",
-		"keySetId",
-		"keyHandle",
-		"recordedKeyManifestDigestB64u",
-		"publicCapabilityDigestB64u",
-		"authorityRefDigestB64u",
-		"derivationClientSharePublicKey33B64u",
-		"expectedServerGeneration",
-		"expiresAtMs",
-		"serverNonceB64u"
-	]);
-	if (record.kind !== "wallet_recovery_ecdsa_possession_challenge_v1") throw new Error("walletRecoveryEcdsaPossessionChallenge.kind is invalid");
-	const keySetId = requireEcdsaKeySetId(record.keySetId, "walletRecoveryEcdsaPossessionChallenge.keySetId");
-	return {
-		kind: "wallet_recovery_ecdsa_possession_challenge_v1",
-		walletId: requireVisibleIdentifier(record.walletId, "walletRecoveryEcdsaPossessionChallenge.walletId"),
-		reservationId: requireVisibleIdentifier(record.reservationId, "walletRecoveryEcdsaPossessionChallenge.reservationId"),
-		replacementId: requireVisibleIdentifier(record.replacementId, "walletRecoveryEcdsaPossessionChallenge.replacementId"),
-		keySetId,
-		keyHandle: requireVisibleIdentifier(record.keyHandle, "walletRecoveryEcdsaPossessionChallenge.keyHandle"),
-		recordedKeyManifestDigestB64u: requireDigest(record.recordedKeyManifestDigestB64u, "walletRecoveryEcdsaPossessionChallenge.recordedKeyManifestDigestB64u"),
-		publicCapabilityDigestB64u: requireDigest(record.publicCapabilityDigestB64u, "walletRecoveryEcdsaPossessionChallenge.publicCapabilityDigestB64u"),
-		authorityRefDigestB64u: requireDigest(record.authorityRefDigestB64u, "walletRecoveryEcdsaPossessionChallenge.authorityRefDigestB64u"),
-		derivationClientSharePublicKey33B64u: requireCompressedPublicKey(record.derivationClientSharePublicKey33B64u, "walletRecoveryEcdsaPossessionChallenge.derivationClientSharePublicKey33B64u"),
-		expectedServerGeneration: requireVisibleIdentifier(record.expectedServerGeneration, "walletRecoveryEcdsaPossessionChallenge.expectedServerGeneration"),
-		expiresAtMs: requirePositiveSafeInteger(record.expiresAtMs, "walletRecoveryEcdsaPossessionChallenge.expiresAtMs"),
-		serverNonceB64u: requireDigest(record.serverNonceB64u, "walletRecoveryEcdsaPossessionChallenge.serverNonceB64u")
-	};
-}
-function parseWalletRecoveryEcdsaPossessionProofV1(value) {
-	const record = requireRecord(value, "walletRecoveryEcdsaPossessionProof");
-	requireExactKeys(record, "walletRecoveryEcdsaPossessionProof", [
-		"kind",
-		"scheme",
-		"signature64B64u"
-	]);
-	if (record.kind !== "wallet_recovery_ecdsa_possession_proof_v1") throw new Error("walletRecoveryEcdsaPossessionProof.kind is invalid");
-	if (record.scheme !== POSSESSION_PROOF_SCHEME_V1) throw new Error("walletRecoveryEcdsaPossessionProof.scheme is invalid");
-	return {
-		kind: "wallet_recovery_ecdsa_possession_proof_v1",
-		scheme: POSSESSION_PROOF_SCHEME_V1,
-		signature64B64u: requireSignature64(record.signature64B64u, "walletRecoveryEcdsaPossessionProof.signature64B64u")
-	};
-}
-function walletRecoveryEcdsaPossessionChallengeCanonicalBytesV1(challenge) {
-	const parsed = parseWalletRecoveryEcdsaPossessionChallengeV1(challenge);
-	const fields = [
-		POSSESSION_CHALLENGE_DOMAIN_V1,
-		POSSESSION_PROOF_SCHEME_V1,
-		parsed.walletId,
-		parsed.reservationId,
-		parsed.replacementId,
-		parsed.keySetId,
-		parsed.keyHandle,
-		base64UrlDecode(parsed.recordedKeyManifestDigestB64u),
-		base64UrlDecode(parsed.publicCapabilityDigestB64u),
-		base64UrlDecode(parsed.authorityRefDigestB64u),
-		base64UrlDecode(parsed.derivationClientSharePublicKey33B64u),
-		parsed.expectedServerGeneration,
-		base64UrlDecode(parsed.serverNonceB64u),
-		expiryBytes(parsed.expiresAtMs)
-	];
-	const output = [];
-	for (const field of fields) {
-		const bytes = typeof field === "string" ? new TextEncoder().encode(field) : field;
-		const length = bytes.length;
-		if (length > 4294967295) throw new Error("wallet recovery possession field is too large");
-		output.push(length >>> 24 & 255, length >>> 16 & 255, length >>> 8 & 255, length & 255, ...bytes);
-	}
-	return Uint8Array.from(output);
-}
-function expiryBytes(value) {
-	let remaining = BigInt(value);
-	const bytes = new Uint8Array(8);
-	for (let index = bytes.length - 1; index >= 0; index -= 1) {
-		bytes[index] = Number(remaining & 255n);
-		remaining >>= 8n;
-	}
-	return bytes;
-}
-async function walletRecoveryEcdsaPossessionChallengeDigestB64uV1(challenge) {
-	return sha256DigestB64u(walletRecoveryEcdsaPossessionChallengeCanonicalBytesV1(challenge));
-}
-//#endregion
-export { parseWalletRecoveryEcdsaPossessionChallengeV1, parseWalletRecoveryEcdsaPossessionProofV1, walletRecoveryEcdsaPossessionChallengeDigestB64uV1 };
-
-//# sourceMappingURL=walletRecoveryEcdsaPossession.js.map

package/dist/esm/react/shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.js

@@ -1,84 +0,0 @@
-import { requireRecord } from "../utils/validation.js";
-import { parseWalletId } from "../utils/domainIds.js";
-import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u } from "../passkey-custody/primitives.js";
-import "../passkey-custody/index.js";
-import { parseDerivedWalletRecoveryKeyId } from "./recoveryKeyId.js";
-import "./recoveryCodes.js";
-//#region ../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.ts
-function buildWalletCustodySeedRecoveryEntry(args) {
-	return {
-		custodySecretKind: "wallet_custody_seed_v1",
-		nonceB64u: args.nonceB64u,
-		wrappedCustodySecretB64u: args.wrappedCustodySecretB64u,
-		aadHashB64u: args.aadHashB64u
-	};
-}
-/**
-* Parses the worker's factor-neutral rotation projection at the request
-* boundary. It deliberately accepts no lifecycle or timestamp fields; those
-* are server-owned and are added only while replacing the durable set.
-*/
-function parseWalletRecoverySetRotationWireV1(raw, options) {
-	const label = options.label || "walletRecoverySetRotation";
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, ROTATION_SET_FIELDS, label);
-	const walletId = parseWalletId(record.walletId);
-	if (!walletId.ok) throw new Error(`${label}.walletId ${walletId.error.message}`);
-	if (String(walletId.value) !== String(options.expectedWalletId)) throw new Error(`${label}.walletId is outside the authenticated wallet`);
-	if (!Array.isArray(record.manifestKekWraps)) throw new Error(`${label}.manifestKekWraps must be an array`);
-	if (record.manifestKekWraps.length !== 10) throw new Error(`${label}.manifestKekWraps must carry exactly 10 recovery-code wraps`);
-	const manifestKekWraps = record.manifestKekWraps.map((rawWrap, index) => {
-		const wrap = requireRecord(rawWrap, `${label}.manifestKekWraps[${index}]`);
-		rejectUnknownFields(wrap, ROTATION_WRAP_FIELDS, `${label}.manifestKekWraps[${index}]`);
-		return {
-			recoveryKeyId: parseDerivedWalletRecoveryKeyId(wrap.recoveryKeyId, `${label}.manifestKekWraps[${index}].recoveryKeyId`),
-			nonceB64u: parseEnvelopeNonceB64u(wrap.nonceB64u, `${label}.manifestKekWraps[${index}].nonceB64u`),
-			ciphertextB64u: parseEnvelopeCiphertextB64u(wrap.ciphertextB64u, `${label}.manifestKekWraps[${index}].ciphertextB64u`),
-			aadHashB64u: parseDigestField(wrap.aadHashB64u, `${label}.manifestKekWraps[${index}].aadHashB64u`)
-		};
-	});
-	const seen = /* @__PURE__ */ new Set();
-	for (const wrap of manifestKekWraps) {
-		const id = String(wrap.recoveryKeyId);
-		if (!seen.add(id)) throw new Error(`${label} contains duplicate recovery key ids`);
-	}
-	if (!Array.isArray(record.entries) || record.entries.length !== 1) throw new Error(`${label}.entries must carry exactly one wallet custody seed entry`);
-	const entry = parseWalletRecoveryEnvelopeEntry(record.entries[0], `${label}.entries[0]`);
-	return {
-		walletId: walletId.value,
-		manifestKekWraps,
-		entry
-	};
-}
-const RECOVERY_ENTRY_FIELDS = [
-	"custodySecretKind",
-	"nonceB64u",
-	"wrappedCustodySecretB64u",
-	"aadHashB64u"
-];
-const ROTATION_WRAP_FIELDS = [
-	"recoveryKeyId",
-	"nonceB64u",
-	"ciphertextB64u",
-	"aadHashB64u"
-];
-const ROTATION_SET_FIELDS = [
-	"walletId",
-	"manifestKekWraps",
-	"entries"
-];
-function parseWalletRecoveryEnvelopeEntry(raw, label) {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, RECOVERY_ENTRY_FIELDS, label);
-	if (record.custodySecretKind !== "wallet_custody_seed_v1") throw new Error(`${label}.custodySecretKind must be wallet_custody_seed_v1; lane holder shares are reprovisioned, not recovered`);
-	return buildWalletCustodySeedRecoveryEntry({
-		nonceB64u: parseEnvelopeNonceB64u(record.nonceB64u, `${label}.nonceB64u`),
-		wrappedCustodySecretB64u: parseEnvelopeCiphertextB64u(record.wrappedCustodySecretB64u, `${label}.wrappedCustodySecretB64u`),
-		aadHashB64u: parseDigestField(record.aadHashB64u, `${label}.aadHashB64u`)
-	});
-}
-//#endregion
-export { buildWalletCustodySeedRecoveryEntry, parseWalletRecoveryEnvelopeEntry, parseWalletRecoverySetRotationWireV1 };
-
-//# sourceMappingURL=walletRecoveryEnvelopeSet.js.map

package/dist/esm/react/shared-ts/src/wallet-recovery/walletRecoveryRotation.js

@@ -1,64 +0,0 @@
-import { parseWalletId } from "../utils/domainIds.js";
-import { parseDigestField, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u } from "../passkey-custody/primitives.js";
-import "../passkey-custody/index.js";
-import { parseDerivedWalletRecoveryKeyId } from "./recoveryKeyId.js";
-import "./recoveryCodes.js";
-import { parseWalletRecoverySetRotationWireV1 } from "./walletRecoveryEnvelopeSet.js";
-//#region ../shared-ts/src/wallet-recovery/walletRecoveryRotation.ts
-function rotationRecord(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function rotationString(value, label) {
-	const parsed = typeof value === "string" ? value.trim() : "";
-	if (!parsed) throw new Error(`${label} is required`);
-	return parsed;
-}
-function parseWalletRecoverySetRotationWorkerResultV1(value) {
-	const result = rotationRecord(value, "rotation worker result");
-	if (!Array.isArray(result.recoveryManifestKekWraps) || result.recoveryManifestKekWraps.length !== 10) throw new Error(`rotation worker result must contain exactly 10 recovery wraps`);
-	return {
-		walletId: rotationString(result.walletId, "rotation worker walletId"),
-		recoveryManifestKekWraps: result.recoveryManifestKekWraps.map((raw, index) => {
-			const wrap = rotationRecord(raw, `rotation worker wrap ${index}`);
-			return {
-				recoveryKeyId: rotationString(wrap.recoveryKeyId, `rotation worker wrap ${index} recoveryKeyId`),
-				nonceB64u: rotationString(wrap.nonceB64u, `rotation worker wrap ${index} nonceB64u`),
-				ciphertextB64u: rotationString(wrap.ciphertextB64u, `rotation worker wrap ${index} ciphertextB64u`),
-				aadHashB64u: rotationString(wrap.aadHashB64u, `rotation worker wrap ${index} aadHashB64u`)
-			};
-		}),
-		recoveryEntryNonceB64u: rotationString(result.recoveryEntryNonceB64u, "rotation worker recoveryEntryNonceB64u"),
-		recoveryEntryCiphertextB64u: rotationString(result.recoveryEntryCiphertextB64u, "rotation worker recoveryEntryCiphertextB64u"),
-		recoveryEntryAadHashB64u: rotationString(result.recoveryEntryAadHashB64u, "rotation worker recoveryEntryAadHashB64u")
-	};
-}
-/** Projects the Rust/WASM result into the server's full-set wire shape. */
-function walletRecoverySetRotationWireFromWorkerResultV1(value) {
-	const result = parseWalletRecoverySetRotationWorkerResultV1(value);
-	const walletId = parseWalletId(result.walletId);
-	if (!walletId.ok) throw new Error(`rotation worker wallet id is invalid: ${walletId.error.message}`);
-	const entry = {
-		custodySecretKind: "wallet_custody_seed_v1",
-		nonceB64u: parseEnvelopeNonceB64u(result.recoveryEntryNonceB64u, "rotation.entry.nonceB64u"),
-		wrappedCustodySecretB64u: parseEnvelopeCiphertextB64u(result.recoveryEntryCiphertextB64u, "rotation.entry.wrappedCustodySecretB64u"),
-		aadHashB64u: parseDigestField(result.recoveryEntryAadHashB64u, "rotation.entry.aadHashB64u")
-	};
-	return parseWalletRecoverySetRotationWireV1({
-		walletId: walletId.value,
-		manifestKekWraps: result.recoveryManifestKekWraps.map((wrap) => ({
-			recoveryKeyId: parseDerivedWalletRecoveryKeyId(wrap.recoveryKeyId, "rotation.recoveryKeyId"),
-			nonceB64u: parseEnvelopeNonceB64u(wrap.nonceB64u, "rotation.wrap.nonceB64u"),
-			ciphertextB64u: parseEnvelopeCiphertextB64u(wrap.ciphertextB64u, "rotation.wrap.ciphertextB64u"),
-			aadHashB64u: parseDigestField(wrap.aadHashB64u, "rotation.wrap.aadHashB64u")
-		})),
-		entries: [entry]
-	}, {
-		expectedWalletId: walletId.value,
-		label: "rotation.workerResult"
-	});
-}
-//#endregion
-export { parseWalletRecoverySetRotationWorkerResultV1, walletRecoverySetRotationWireFromWorkerResultV1 };
-
-//# sourceMappingURL=walletRecoveryRotation.js.map

package/dist/esm/react/theme/base-styles.js

@@ -1,117 +0,0 @@
-//#region src/theme/base-styles.js
-function createThemeTokens(palette) {
-	const CHROMA_COLORS = {
-		...fromScale("yellow", palette.yellow),
-		...fromScale("blue", palette.blue),
-		...fromScale("red", palette.red),
-		...fromScale("orange", palette.orange),
-		...fromScale("violet", palette.violet),
-		...fromScale("green", palette.green)
-	};
-	const GREY_COLORS = {
-		...fromScale("grey", palette.grey),
-		...fromScale("slate", palette.slate)
-	};
-	const GRADIENTS = {
-		blue: palette.gradients?.blue,
-		red: palette.gradients?.red,
-		green: palette.gradients?.green,
-		black: palette.gradients?.black,
-		blueWhite: palette.gradients?.blueWhite,
-		sage: palette.gradients?.sage,
-		sageDeep: palette.gradients?.sageDeep
-	};
-	return {
-		CHROMA_COLORS,
-		GREY_COLORS,
-		GRADIENTS,
-		DARK_THEME: {
-			...GREY_COLORS,
-			...CHROMA_COLORS,
-			textPrimary: GREY_COLORS.grey75,
-			textSecondary: GREY_COLORS.grey500,
-			textMuted: GREY_COLORS.grey650,
-			textButton: GREY_COLORS.grey75,
-			colorBackground: GREY_COLORS.grey800,
-			surface: GREY_COLORS.slate700,
-			surface2: GREY_COLORS.slate750,
-			txDetailsBackground: GREY_COLORS.slate750,
-			surface3: GREY_COLORS.slate800,
-			surface4: GREY_COLORS.slate825,
-			primary: CHROMA_COLORS.blue650,
-			primaryHover: CHROMA_COLORS.blue600,
-			secondary: CHROMA_COLORS.violet600,
-			secondaryHover: CHROMA_COLORS.violet500,
-			accent: CHROMA_COLORS.green400,
-			buttonBackground: CHROMA_COLORS.blue500,
-			buttonHoverBackground: CHROMA_COLORS.blue450,
-			hover: GREY_COLORS.grey850,
-			active: GREY_COLORS.grey650,
-			focus: CHROMA_COLORS.blue400,
-			success: CHROMA_COLORS.blue400,
-			warning: (palette.yellow || {})["400"],
-			error: CHROMA_COLORS.red400,
-			info: CHROMA_COLORS.blue400,
-			borderPrimary: GREY_COLORS.grey650,
-			borderSecondary: GREY_COLORS.slate650,
-			borderHover: GREY_COLORS.grey600,
-			gradientPrimary: GRADIENTS.blue,
-			gradientSecondary: GRADIENTS.blueWhite,
-			gradientTertiary: GRADIENTS.black,
-			highlightPrimary: CHROMA_COLORS.blue400,
-			highlightHalo: CHROMA_COLORS.blue400,
-			highlightReceiver: CHROMA_COLORS.blue400,
-			highlightMethodName: CHROMA_COLORS.blue400,
-			highlightAmount: CHROMA_COLORS.blue400
-		},
-		LIGHT_THEME: {
-			...GREY_COLORS,
-			...CHROMA_COLORS,
-			textPrimary: GREY_COLORS.grey650,
-			textSecondary: GREY_COLORS.grey500,
-			textMuted: GREY_COLORS.grey350,
-			textButton: GREY_COLORS.grey75,
-			colorBackground: GREY_COLORS.grey50,
-			surface: GREY_COLORS.slate100,
-			surface2: GREY_COLORS.slate150,
-			txDetailsBackground: "#f8f8f7",
-			surface3: GREY_COLORS.slate200,
-			surface4: GREY_COLORS.slate250,
-			primary: CHROMA_COLORS.blue600,
-			primaryHover: CHROMA_COLORS.blue500,
-			secondary: CHROMA_COLORS.violet600,
-			secondaryHover: CHROMA_COLORS.violet500,
-			accent: CHROMA_COLORS.green400,
-			buttonBackground: CHROMA_COLORS.blue500,
-			buttonHoverBackground: CHROMA_COLORS.blue450,
-			hover: GREY_COLORS.grey100,
-			active: GREY_COLORS.grey200,
-			focus: CHROMA_COLORS.blue400,
-			success: CHROMA_COLORS.blue500,
-			warning: (palette.yellow || {})["500"],
-			error: CHROMA_COLORS.red500,
-			info: CHROMA_COLORS.blue400,
-			borderPrimary: GREY_COLORS.slate300,
-			borderSecondary: GREY_COLORS.grey300,
-			borderHover: GREY_COLORS.slate350,
-			gradientPrimary: GRADIENTS.blue,
-			gradientSecondary: GRADIENTS.blueWhite,
-			gradientTertiary: GRADIENTS.black,
-			highlightPrimary: CHROMA_COLORS.blue300,
-			highlightHalo: CHROMA_COLORS.blue350,
-			highlightReceiver: CHROMA_COLORS.blue500,
-			highlightMethodName: CHROMA_COLORS.blue500,
-			highlightAmount: CHROMA_COLORS.blue500
-		}
-	};
-}
-const fromScale = (prefix, scale) => {
-	if (!scale) return {};
-	const out = {};
-	for (const k of Object.keys(scale)) out[`${prefix}${k}`] = scale[k];
-	return out;
-};
-//#endregion
-export { createThemeTokens };
-
-//# sourceMappingURL=base-styles.js.map