@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/sdk/recovery-entrypoint-C3fydnRC.js

@@ -1,779 +0,0 @@
-import { M as parseWebAuthnRpId, o as parseEmailOtpChallengeId } from "./domainIds-lcrFg6Sa.js";
-import "./validation-gat4LEKm.js";
-import "./errors-93h9uAW9.js";
-import { i as base64UrlEncode } from "./base64-Clm8C-e9.js";
-import { r as secureRandomId } from "./secureRandomId-BORsmdS4.js";
-import "./sessionPolicy-DO-MkL65.js";
-import "./ecdsaPresignLifecycle-Bfx2AQKb.js";
-import "./capabilityKinds-hvYqa6S_.js";
-import { h as sha256HexUtf8, p as sha256Bytes } from "./chains-BMh3btVo.js";
-import "./signerDomain-IEAVrOrc.js";
-import { f as parseRecoveryCodeReservationId, m as decodeEmailOtpRecoveryKey } from "./wallet-recovery-BX61-79p.js";
-import "./evmFamilyEcdsaIdentity-CqGafQsI.js";
-import "./walletAuthority-DD9T25F6.js";
-import "./encoders-D8d07vpx.js";
-import "./registrationIds-DLSdEKSv.js";
-import { a as buildEmailOtpEnvelopeFactor, c as buildPasskeyEnvelopeFactor } from "./passkey-custody-UUHbC0pk.js";
-import { u as IndexedDBManager } from "./walletCustodyEcdsaContinuity-CF4bv9OI.js";
-import "./keccak-DUL3d8SF.js";
-import "./signingSessionSeal-Cu-GHm6y.js";
-import "./registrationSignerPlan-DhV8VAob.js";
-import "./registrationIntent-4zwk16zQ.js";
-import { a as finalizeWalletRecoveryGoogleEmailOtp, c as isDurablePasskeyPayload, d as prepareWalletRecoveryWithCode, l as finalizeWalletRecovery, n as promoteWalletRecoveryCommit, o as verifyWalletRecoveryEmailOtp, r as restoreAndPublishWalletRecoveryCommit, s as verifyWalletRecoveryGoogle, t as createAwaitingWalletRecoveryCommit, u as buildWalletRecoveryCeremonyCustodyJson } from "./walletRecoveryCommit-AI1AtIRP.js";
-//#region src/SeamsWeb/operations/recovery/walletRecovery.ts
-const RECOVERY_PREPARE_RETRY_TTL_MS = 300 * 1e3;
-function assertNever(value) {
-	throw new Error(`Unhandled wallet recovery branch: ${String(value)}`);
-}
-function isGooglePreparedWalletRecovery(prepared) {
-	return prepared.target.kind === "google_email_otp";
-}
-function recoveryFinalizationOperation(operation, handle) {
-	if (!operation || operation.stage === "prepared" || operation.stage === "google_verified" || operation.walletId !== handle.walletId || operation.target.kind !== handle.target.kind) return null;
-	switch (operation.target.kind) {
-		case "passkey": return handle.kind === "credential_created" && handle.target.kind === "passkey" && operation.target.rpId === handle.target.rpId ? operation : null;
-		case "google_email_otp": return handle.kind === "email_otp_verified" && handle.target.kind === "google_email_otp" && operation.target.googleProvider === handle.target.googleProvider ? operation : null;
-	}
-}
-function createReservationId() {
-	return parseRecoveryCodeReservationId(secureRandomId("wallet-recovery-reservation", 32, "wallet recovery operation reservations"));
-}
-function pendingPrepareKey(recoveryCodeDigestB64u) {
-	return recoveryCodeDigestB64u;
-}
-const CONSUMED_RECOVERY_CODE_DIGESTS_SESSION_KEY = "seams:recovery:consumed-code-digests";
-function readConsumedRecoveryCodeDigests() {
-	try {
-		const raw = JSON.parse(sessionStorage.getItem(CONSUMED_RECOVERY_CODE_DIGESTS_SESSION_KEY) ?? "[]");
-		if (!Array.isArray(raw)) return /* @__PURE__ */ new Set();
-		return new Set(raw.filter((value) => typeof value === "string"));
-	} catch {
-		return /* @__PURE__ */ new Set();
-	}
-}
-function rememberConsumedRecoveryCodeDigest(digests, digest) {
-	digests.add(digest);
-	try {
-		sessionStorage.setItem(CONSUMED_RECOVERY_CODE_DIGESTS_SESSION_KEY, JSON.stringify([...digests].slice(-32)));
-	} catch {}
-}
-function zeroizeBuffer(buffer) {
-	if (buffer && buffer.byteLength > 0) new Uint8Array(buffer).fill(0);
-}
-function disposeRecoveryOperation(operation) {
-	operation.recoveryCodeBytes.fill(0);
-	switch (operation.stage) {
-		case "prepared":
-		case "google_verified": return;
-		case "credential_created":
-			zeroizeBuffer(operation.replacement.factorSecret);
-			return;
-		case "email_otp_verified":
-		case "manifest_recovered":
-			zeroizeBuffer(operation.replacement.kind === "passkey" ? operation.replacement.factorSecret : operation.replacement.factor.factorSecret);
-			return;
-	}
-}
-function refused() {
-	return { kind: "refused" };
-}
-function isCredentialDismissal(error) {
-	if (typeof error !== "object" || error === null) return false;
-	const name = Reflect.get(error, "name");
-	return name === "NotAllowedError" || name === "AbortError";
-}
-function credentialCreatedOperation(current, replacement) {
-	if (current.target.kind !== "passkey" || !current.prepared.registration) throw new Error("passkey recovery registration is unavailable");
-	return {
-		stage: "credential_created",
-		recoveryOperationId: current.recoveryOperationId,
-		walletId: current.walletId,
-		relayUrl: current.relayUrl,
-		target: current.target,
-		prepared: current.prepared,
-		custodyJson: current.custodyJson,
-		recoveryCodeBytes: current.recoveryCodeBytes,
-		replacement: {
-			kind: "passkey",
-			registration: replacement.registration,
-			credentialIdB64u: replacement.credentialIdB64u,
-			factorSecret: replacement.factorSecret
-		}
-	};
-}
-function emailOtpVerifiedOperation(current, replacement) {
-	return {
-		stage: "email_otp_verified",
-		recoveryOperationId: current.recoveryOperationId,
-		walletId: current.walletId,
-		relayUrl: current.relayUrl,
-		target: current.target,
-		prepared: current.prepared,
-		custodyJson: current.custodyJson,
-		recoveryCodeBytes: current.recoveryCodeBytes,
-		replacement
-	};
-}
-function passkeyRecoveryReplacementFactor(operation) {
-	const registration = operation.prepared.registration;
-	if (!registration) throw new Error("passkey recovery registration is unavailable");
-	return {
-		replacementId: registration.replacementId,
-		walletAuthMethodId: registration.walletAuthMethodId,
-		factor: buildPasskeyEnvelopeFactor({
-			rpId: registration.rpId,
-			credentialIdB64u: operation.replacement.credentialIdB64u
-		}),
-		factorSecret: operation.replacement.factorSecret
-	};
-}
-function passkeyRecoveryChallengeId(operation) {
-	const registration = operation.prepared.registration;
-	if (!registration) throw new Error("passkey recovery registration is unavailable");
-	return registration.challengeId;
-}
-function passkeyManifestRecoveredOperation(current, recovered) {
-	return {
-		stage: "manifest_recovered",
-		recoveryOperationId: current.recoveryOperationId,
-		walletId: current.walletId,
-		relayUrl: current.relayUrl,
-		target: current.target,
-		prepared: current.prepared,
-		custodyJson: current.custodyJson,
-		recoveryCodeBytes: current.recoveryCodeBytes,
-		replacement: current.replacement,
-		recovered
-	};
-}
-function emailOtpManifestRecoveredOperation(current, recovered) {
-	return {
-		stage: "manifest_recovered",
-		recoveryOperationId: current.recoveryOperationId,
-		walletId: current.walletId,
-		relayUrl: current.relayUrl,
-		target: current.target,
-		prepared: current.prepared,
-		custodyJson: current.custodyJson,
-		recoveryCodeBytes: current.recoveryCodeBytes,
-		replacement: current.replacement,
-		recovered
-	};
-}
-function manifestRecoveredOperationFromRecovered(current, recovered) {
-	switch (current.stage) {
-		case "credential_created": return passkeyManifestRecoveredOperation(current, recovered);
-		case "email_otp_verified": return emailOtpManifestRecoveredOperation(current, recovered);
-		default: return assertNever(current);
-	}
-}
-function isPasskeyFinalizedWalletRecoveryPromotion(promotion) {
-	return promotion.authMethod.kind === "passkey";
-}
-function isPasskeyManifestRecovery(operation) {
-	return operation.target.kind === "passkey" && operation.replacement.kind === "passkey";
-}
-function isEmailOtpManifestRecovery(operation) {
-	return operation.target.kind === "google_email_otp" && operation.replacement.kind === "email_otp";
-}
-async function releaseRecoveryEmailOtpFactorFromWorker(input) {
-	return await input.context.signingEngine.getSignerWorkerContext().requestWorkerOperation({
-		kind: "emailOtp",
-		request: {
-			type: "releaseWalletRecoveryEmailOtpFactor",
-			payload: {
-				relayUrl: input.relayUrl,
-				walletId: String(input.walletId),
-				recoveryOperationId: input.recoveryOperationId,
-				reservationId: input.reservationId
-			}
-		}
-	});
-}
-async function finalizePasskeyRecovery(operation) {
-	const registration = operation.prepared.registration;
-	if (!registration) throw new Error("passkey recovery registration is unavailable");
-	return await finalizeWalletRecovery({
-		relayUrl: operation.relayUrl,
-		walletId: operation.walletId,
-		reservationId: operation.prepared.reservationId,
-		recoveryOperationId: operation.prepared.recoveryOperationId,
-		targetDeviceId: operation.prepared.targetDeviceId,
-		targetAuthorityId: operation.prepared.targetAuthorityId,
-		targetWalletAuthMethodId: operation.prepared.targetWalletAuthMethodId,
-		challengeId: registration.challengeId,
-		replacementId: registration.replacementId,
-		webauthnRegistration: operation.replacement.registration,
-		replacementEnvelope: operation.recovered.replacementEnvelope,
-		ecdsaMaterialPossessionProofs: operation.recovered.ecdsaKeySets.map((keySet) => ({
-			keySetId: keySet.entry.keySetId,
-			proof: keySet.activation.possessionProof
-		}))
-	});
-}
-var WalletRecoveryCoordinator = class {
-	constructor(rpc = null) {
-		this.rpc = rpc;
-	}
-	#operations = /* @__PURE__ */ new Map();
-	#finalizations = /* @__PURE__ */ new Map();
-	#credentialPrompts = /* @__PURE__ */ new Map();
-	#pendingPrepareReservations = /* @__PURE__ */ new Map();
-	#operationRetryKeys = /* @__PURE__ */ new Map();
-	#consumedRecoveryCodeDigests = readConsumedRecoveryCodeDigests();
-	async prepareWithCode(input) {
-		this.#pruneExpired();
-		if (input.signal.aborted) return refused();
-		if (input.target.kind === "passkey") {
-			const rpId = parseWebAuthnRpId(input.context.signingEngine.getRpId());
-			if (!rpId.ok || rpId.value !== input.target.rpId) return refused();
-		}
-		let recoveryCodeBytes = null;
-		try {
-			recoveryCodeBytes = decodeEmailOtpRecoveryKey(input.recoveryCode);
-			const recoveryCodeDigestB64u = base64UrlEncode(await sha256Bytes(recoveryCodeBytes));
-			if (this.#consumedRecoveryCodeDigests.has(recoveryCodeDigestB64u)) return { kind: "consumed" };
-			const retryKey = pendingPrepareKey(recoveryCodeDigestB64u);
-			const pending = this.#pendingPrepareReservations.get(retryKey);
-			const reservationId = pending?.expiresAtMs && pending.expiresAtMs > Date.now() ? pending.reservationId : createReservationId();
-			const prepared = await prepareWalletRecoveryWithCode({
-				relayUrl: input.relayUrl,
-				target: input.target,
-				recoveryCodeB64u: base64UrlEncode(recoveryCodeBytes),
-				reservationId
-			});
-			if (prepared.kind !== "prepared") {
-				if (prepared.kind === "retryable_conflict" || prepared.kind === "transport_uncertain") this.#pendingPrepareReservations.set(retryKey, {
-					reservationId,
-					expiresAtMs: Date.now() + RECOVERY_PREPARE_RETRY_TTL_MS
-				});
-				else this.#pendingPrepareReservations.delete(retryKey);
-				return prepared;
-			}
-			this.#pendingPrepareReservations.delete(retryKey);
-			if (input.signal.aborted) {
-				this.#pendingPrepareReservations.set(retryKey, {
-					reservationId: prepared.reservationId,
-					expiresAtMs: prepared.reservationExpiresAtMs
-				});
-				return refused();
-			}
-			const recoveryOperationId = secureRandomId("wallet-recovery-operation", 24, "wallet recovery client operation handles");
-			this.#operations.set(recoveryOperationId, {
-				stage: "prepared",
-				recoveryOperationId,
-				walletId: prepared.walletId,
-				relayUrl: input.relayUrl,
-				target: input.target,
-				prepared,
-				custodyJson: buildWalletRecoveryCeremonyCustodyJson({
-					walletId: prepared.walletId,
-					prepared
-				}),
-				recoveryCodeBytes
-			});
-			this.#operationRetryKeys.set(recoveryOperationId, retryKey);
-			recoveryCodeBytes = null;
-			return {
-				kind: "prepared",
-				recoveryOperationId,
-				walletId: prepared.walletId,
-				target: input.target
-			};
-		} catch {
-			return refused();
-		} finally {
-			recoveryCodeBytes?.fill(0);
-		}
-	}
-	createPasskey(input) {
-		this.#pruneExpired();
-		const current = this.#operations.get(input.operation.recoveryOperationId);
-		if (!current || current.stage !== "prepared" || current.walletId !== input.operation.walletId || current.target.kind !== "passkey" || input.operation.target.kind !== "passkey" || current.target.rpId !== input.operation.target.rpId || this.#credentialPrompts.has(current.recoveryOperationId)) return Promise.resolve({ kind: "refused" });
-		if (!current.prepared.registration) return Promise.resolve({ kind: "refused" });
-		const promptController = new AbortController();
-		this.#credentialPrompts.set(current.recoveryOperationId, promptController);
-		let credentialPromise;
-		try {
-			credentialPromise = input.context.signingEngine.createWalletRecoveryReplacementCredential({
-				walletId: current.walletId,
-				registration: current.prepared.registration,
-				cancellation: {
-					kind: "abort_signal",
-					signal: promptController.signal
-				}
-			});
-		} catch {
-			this.cancel(current.recoveryOperationId);
-			return Promise.resolve({ kind: "refused" });
-		}
-		return this.#finishCredentialCreation({
-			current,
-			credentialPromise,
-			promptController
-		});
-	}
-	async verifyGoogle(input) {
-		this.#pruneExpired();
-		const current = this.#operations.get(input.operation.recoveryOperationId);
-		if (!this.rpc || !current || current.stage !== "prepared" || current.target.kind !== "google_email_otp" || input.operation.target.kind !== "google_email_otp" || current.walletId !== input.operation.walletId || current.target.googleProvider !== input.operation.target.googleProvider || current.relayUrl !== input.relayUrl) return refused();
-		const prepared = current.prepared;
-		if (!isGooglePreparedWalletRecovery(prepared)) return refused();
-		try {
-			const verified = await this.rpc.verifyGoogle({
-				relayUrl: current.relayUrl,
-				recoveryOperationId: prepared.recoveryOperationId,
-				reservationId: prepared.reservationId,
-				idToken: input.idToken
-			});
-			if (verified.kind !== "verified") return verified;
-			if (verified.recoveryOperationId !== prepared.recoveryOperationId) return { kind: "transport_uncertain" };
-			const handle = {
-				kind: "google_verified",
-				recoveryOperationId: current.recoveryOperationId,
-				walletId: current.walletId,
-				target: current.target,
-				challengeId: verified.challengeId,
-				delivery: verified.delivery,
-				expiresAtMs: verified.expiresAtMs
-			};
-			const next = {
-				stage: "google_verified",
-				recoveryOperationId: current.recoveryOperationId,
-				walletId: current.walletId,
-				relayUrl: current.relayUrl,
-				target: current.target,
-				prepared,
-				custodyJson: current.custodyJson,
-				recoveryCodeBytes: current.recoveryCodeBytes,
-				verification: handle
-			};
-			this.#operations.set(next.recoveryOperationId, next);
-			return handle;
-		} catch {
-			return { kind: "transport_uncertain" };
-		}
-	}
-	async verifyEmailOtp(input) {
-		this.#pruneExpired();
-		const current = this.#operations.get(input.operation.recoveryOperationId);
-		if (!this.rpc || !current || current.stage !== "google_verified" || current.walletId !== input.operation.walletId || current.target.kind !== "google_email_otp" || input.operation.target.kind !== "google_email_otp" || current.verification.challengeId !== input.operation.challengeId || input.challengeId !== input.operation.challengeId) return refused();
-		const challengeId = parseEmailOtpChallengeId(input.challengeId);
-		if (!challengeId.ok) return refused();
-		try {
-			const verified = await this.rpc.verifyEmailOtp({
-				relayUrl: current.relayUrl,
-				recoveryOperationId: current.prepared.recoveryOperationId,
-				reservationId: current.prepared.reservationId,
-				challengeId: challengeId.value,
-				otpCode: input.otpCode
-			});
-			if (verified.kind !== "verified") return verified;
-			if (verified.recoveryOperationId !== current.prepared.recoveryOperationId || verified.challengeId !== input.challengeId) return { kind: "transport_uncertain" };
-			const released = await releaseRecoveryEmailOtpFactorFromWorker({
-				context: input.context,
-				relayUrl: current.relayUrl,
-				walletId: current.walletId,
-				recoveryOperationId: current.prepared.recoveryOperationId,
-				reservationId: String(current.prepared.reservationId)
-			});
-			if (released.kind === "existing") {
-				if (released.recoveryOperationId !== String(current.prepared.recoveryOperationId) || released.reservationId !== String(current.prepared.reservationId) || released.factorSecret32.byteLength !== 32) {
-					zeroizeBuffer(released.factorSecret32);
-					return { kind: "transport_uncertain" };
-				}
-				const next = emailOtpVerifiedOperation(current, {
-					kind: "email_otp",
-					factor: {
-						replacementId: String(current.prepared.recoveryOperationId),
-						walletAuthMethodId: current.prepared.targetWalletAuthMethodId,
-						factor: buildEmailOtpEnvelopeFactor({
-							enrollmentId: released.enrollmentId,
-							enrollmentSealKeyVersion: released.enrollmentSealKeyVersion
-						}),
-						factorSecret: released.factorSecret32
-					},
-					enrollment: {
-						kind: "existing",
-						enrollmentId: released.enrollmentId,
-						enrollmentSealKeyVersion: released.enrollmentSealKeyVersion
-					},
-					providerSubject: released.providerSubject,
-					verifiedEmail: released.verifiedEmail,
-					registrationAuthorityId: input.challengeId
-				});
-				this.#operations.set(next.recoveryOperationId, next);
-				return {
-					kind: "email_otp_verified",
-					recoveryOperationId: next.recoveryOperationId,
-					walletId: next.walletId,
-					target: next.target,
-					challengeId: input.challengeId
-				};
-			}
-			if (released.kind !== "create") return released;
-			if (released.recoveryOperationId !== String(current.prepared.recoveryOperationId) || released.reservationId !== String(current.prepared.reservationId)) return { kind: "transport_uncertain" };
-			const clientSecret32 = crypto.getRandomValues(new Uint8Array(32));
-			let factorSecret = null;
-			try {
-				const material = await input.context.signingEngine.prepareEmailOtpRegistrationEnrollmentMaterialInternal({
-					relayUrl: current.relayUrl,
-					walletId: current.walletId,
-					userId: released.providerSubject,
-					clientSecret32
-				});
-				factorSecret = clientSecret32.slice().buffer;
-				const next = emailOtpVerifiedOperation(current, {
-					kind: "email_otp",
-					factor: {
-						replacementId: String(current.prepared.recoveryOperationId),
-						walletAuthMethodId: current.prepared.targetWalletAuthMethodId,
-						factor: buildEmailOtpEnvelopeFactor({
-							enrollmentId: material.enrollmentId,
-							enrollmentSealKeyVersion: material.enrollmentSealKeyVersion
-						}),
-						factorSecret
-					},
-					enrollment: {
-						kind: "create",
-						enrollmentId: material.enrollmentId,
-						providerSubject: released.providerSubject,
-						verifiedEmail: released.verifiedEmail,
-						material: material.emailOtpEnrollment
-					},
-					providerSubject: released.providerSubject,
-					verifiedEmail: released.verifiedEmail,
-					registrationAuthorityId: input.challengeId
-				});
-				this.#operations.set(next.recoveryOperationId, next);
-				factorSecret = null;
-				return {
-					kind: "email_otp_verified",
-					recoveryOperationId: next.recoveryOperationId,
-					walletId: next.walletId,
-					target: next.target,
-					challengeId: input.challengeId
-				};
-			} finally {
-				clientSecret32.fill(0);
-				if (factorSecret) zeroizeBuffer(factorSecret);
-			}
-		} catch {
-			return { kind: "refused" };
-		}
-	}
-	async finalize(input) {
-		const finalizationKey = String(input.operation.recoveryOperationId);
-		const inFlight = this.#finalizations.get(finalizationKey);
-		if (inFlight) return inFlight;
-		const attempt = this.#finalizeOnce(input).finally(() => {
-			this.#finalizations.delete(finalizationKey);
-		});
-		this.#finalizations.set(finalizationKey, attempt);
-		return attempt;
-	}
-	async #finalizeOnce(input) {
-		this.#pruneExpired();
-		let current = recoveryFinalizationOperation(this.#operations.get(input.operation.recoveryOperationId), input.operation);
-		if (!current) return refused();
-		try {
-			if (current.stage === "credential_created" || current.stage === "email_otp_verified") {
-				const replacementFactor = current.stage === "credential_created" ? passkeyRecoveryReplacementFactor(current) : current.replacement.factor;
-				const recovered = await input.context.signingEngine.recoverWalletCustodyManifest({
-					walletId: current.walletId,
-					prepared: current.prepared,
-					custodyJson: current.custodyJson,
-					recoveryCodeBytes: current.recoveryCodeBytes,
-					replacementFactor,
-					recoveryChallengeId: current.stage === "credential_created" ? passkeyRecoveryChallengeId(current) : String(current.prepared.recoveryOperationId),
-					relayUrl: current.relayUrl
-				});
-				if (this.#operations.get(current.recoveryOperationId) !== current) {
-					disposeRecoveryOperation(current);
-					return refused();
-				}
-				if (current.prepared.reservationExpiresAtMs <= Date.now()) {
-					this.cancel(current.recoveryOperationId);
-					return refused();
-				}
-				current.recoveryCodeBytes.fill(0);
-				zeroizeBuffer(current.stage === "credential_created" ? current.replacement.factorSecret : current.replacement.factor.factorSecret);
-				current = manifestRecoveredOperationFromRecovered(current, recovered);
-				this.#operations.set(current.recoveryOperationId, current);
-			}
-			if (current.stage === "manifest_recovered") {
-				if (!isPasskeyManifestRecovery(current) && !isEmailOtpManifestRecovery(current)) return { kind: "transport_uncertain" };
-				if (current.target.kind === "google_email_otp" && !this.rpc) return { kind: "refused" };
-				const awaitingCommit = await createAwaitingWalletRecoveryCommit({ operation: current });
-				if (this.#operations.get(current.recoveryOperationId) !== current) return { kind: "transport_uncertain" };
-				await IndexedDBManager.putPendingWalletRecoveryCommit(awaitingCommit.pending);
-				const finalized = isPasskeyManifestRecovery(current) ? await finalizePasskeyRecovery(current) : this.rpc ? await this.rpc.finalizeEmailOtp({
-					relayUrl: current.relayUrl,
-					walletId: current.walletId,
-					recoveryOperationId: current.prepared.recoveryOperationId,
-					reservationId: current.prepared.reservationId,
-					targetDeviceId: current.prepared.targetDeviceId,
-					targetAuthorityId: current.prepared.targetAuthorityId,
-					targetWalletAuthMethodId: current.prepared.targetWalletAuthMethodId,
-					expectedProviderSubject: current.replacement.providerSubject,
-					expectedEmailHashHex: await sha256HexUtf8(current.replacement.verifiedEmail),
-					expectedRegistrationAuthorityId: current.replacement.registrationAuthorityId,
-					replacementEnvelope: current.recovered.replacementEnvelope,
-					ecdsaMaterialPossessionProofs: current.recovered.ecdsaKeySets.map((keySet) => ({
-						keySetId: keySet.entry.keySetId,
-						proof: keySet.activation.possessionProof
-					})),
-					emailOtpEnrollment: current.replacement.enrollment.kind === "create" ? {
-						kind: "create",
-						material: current.replacement.enrollment.material
-					} : null
-				}) : { kind: "refused" };
-				if (finalized.kind === "refused") {
-					await IndexedDBManager.deletePendingWalletRecoveryCommit(current.prepared.recoveryOperationId);
-					if (this.#operations.get(current.recoveryOperationId) === current) this.cancel(current.recoveryOperationId);
-					return finalized;
-				}
-				if (this.#operations.get(current.recoveryOperationId) !== current) return finalized.kind === "promoted" ? { kind: "transport_uncertain" } : finalized;
-				if (finalized.kind !== "promoted") return finalized;
-				if (current.replacement.kind === "passkey" && finalized.authMethod.credentialIdB64u !== current.replacement.credentialIdB64u) return { kind: "transport_uncertain" };
-				let commitPromotion;
-				if (isDurablePasskeyPayload(awaitingCommit.payload)) {
-					if (!isPasskeyFinalizedWalletRecoveryPromotion(finalized)) return { kind: "transport_uncertain" };
-					commitPromotion = {
-						kind: "passkey",
-						payload: awaitingCommit.payload,
-						promotion: finalized
-					};
-				} else {
-					if (isPasskeyFinalizedWalletRecoveryPromotion(finalized)) return { kind: "transport_uncertain" };
-					commitPromotion = {
-						kind: "google_email_otp",
-						payload: awaitingCommit.payload,
-						promotion: finalized
-					};
-				}
-				await restoreAndPublishWalletRecoveryCommit({
-					pending: await promoteWalletRecoveryCommit({
-						awaiting: awaitingCommit.pending,
-						promotion: commitPromotion
-					}),
-					payload: commitPromotion.payload
-				});
-			}
-			const consumedCodeDigest = this.#operationRetryKeys.get(current.recoveryOperationId);
-			if (consumedCodeDigest) rememberConsumedRecoveryCodeDigest(this.#consumedRecoveryCodeDigests, consumedCodeDigest);
-			this.#operations.delete(current.recoveryOperationId);
-			this.#operationRetryKeys.delete(current.recoveryOperationId);
-			disposeRecoveryOperation(current);
-			return {
-				kind: "ready_for_sign_in",
-				walletId: current.walletId
-			};
-		} catch {
-			return { kind: "transport_uncertain" };
-		}
-	}
-	async #finishCredentialCreation(input) {
-		try {
-			const replacement = await input.credentialPromise;
-			if (this.#operations.get(input.current.recoveryOperationId) !== input.current || input.promptController.signal.aborted) {
-				zeroizeBuffer(replacement.factorSecret);
-				return { kind: "dismissed" };
-			}
-			if (input.current.prepared.reservationExpiresAtMs <= Date.now()) {
-				zeroizeBuffer(replacement.factorSecret);
-				this.cancel(input.current.recoveryOperationId);
-				return { kind: "refused" };
-			}
-			const next = credentialCreatedOperation(input.current, replacement);
-			this.#operations.set(next.recoveryOperationId, next);
-			return {
-				kind: "credential_created",
-				recoveryOperationId: next.recoveryOperationId,
-				walletId: next.walletId,
-				target: next.target
-			};
-		} catch (error) {
-			if (input.promptController.signal.aborted || isCredentialDismissal(error)) return { kind: "dismissed" };
-			return { kind: "transport_uncertain" };
-		} finally {
-			if (this.#credentialPrompts.get(input.current.recoveryOperationId) === input.promptController) this.#credentialPrompts.delete(input.current.recoveryOperationId);
-		}
-	}
-	cancel(recoveryOperationId) {
-		this.#credentialPrompts.get(recoveryOperationId)?.abort();
-		this.#credentialPrompts.delete(recoveryOperationId);
-		const operation = this.#operations.get(recoveryOperationId);
-		if (!operation) return;
-		const retryKey = this.#operationRetryKeys.get(recoveryOperationId);
-		this.#operationRetryKeys.delete(recoveryOperationId);
-		if (retryKey && operation.prepared.reservationExpiresAtMs > Date.now()) this.#pendingPrepareReservations.set(retryKey, {
-			reservationId: operation.prepared.reservationId,
-			expiresAtMs: operation.prepared.reservationExpiresAtMs
-		});
-		this.#operations.delete(recoveryOperationId);
-		disposeRecoveryOperation(operation);
-	}
-	#pruneExpired() {
-		const nowMs = Date.now();
-		for (const [retryKey, pending] of this.#pendingPrepareReservations) if (pending.expiresAtMs <= nowMs) this.#pendingPrepareReservations.delete(retryKey);
-		for (const [operationId, operation] of this.#operations) {
-			if (operation.prepared.reservationExpiresAtMs > nowMs) continue;
-			this.#credentialPrompts.get(operationId)?.abort();
-			this.#credentialPrompts.delete(operationId);
-			this.#operations.delete(operationId);
-			this.#operationRetryKeys.delete(operationId);
-			disposeRecoveryOperation(operation);
-		}
-	}
-};
-//#endregion
-//#region src/SeamsWeb/walletIframe/host/recovery-entrypoint.ts
-var CoordinatorHostedRecoveryPort = class {
-	#coordinator = new WalletRecoveryCoordinator({
-		verifyGoogle: verifyWalletRecoveryGoogle,
-		verifyEmailOtp: verifyWalletRecoveryEmailOtp,
-		finalizeEmailOtp: finalizeWalletRecoveryGoogleEmailOtp
-	});
-	constructor(context, relayUrl) {
-		this.context = context;
-		this.relayUrl = relayUrl;
-		const rpId = parseWebAuthnRpId(context.signingEngine.getRpId());
-		if (!rpId.ok) throw new Error(`wallet recovery RP ID ${rpId.error.message}`);
-		this.#passkeyRpId = rpId.value;
-	}
-	#passkeyRpId;
-	targetFor(kind) {
-		switch (kind) {
-			case "passkey": return {
-				kind,
-				rpId: this.#passkeyRpId
-			};
-			case "google_email_otp": return {
-				kind,
-				googleProvider: "google"
-			};
-		}
-	}
-	async prepare(input) {
-		const result = await this.#coordinator.prepareWithCode({
-			context: this.context,
-			relayUrl: this.relayUrl,
-			recoveryCode: input.recoveryCode,
-			target: input.target,
-			signal: input.signal
-		});
-		if (result.kind !== "prepared") return result;
-		if (result.target.kind === "passkey") return {
-			kind: "hosted_recovery_prepared",
-			recoveryOperationId: result.recoveryOperationId,
-			walletId: result.walletId,
-			target: result.target
-		};
-		return {
-			kind: "hosted_recovery_prepared",
-			recoveryOperationId: result.recoveryOperationId,
-			walletId: result.walletId,
-			target: result.target
-		};
-	}
-	createPasskey(operation) {
-		return this.#createPasskey({
-			kind: "prepared",
-			recoveryOperationId: operation.recoveryOperationId,
-			walletId: operation.walletId,
-			target: operation.target
-		});
-	}
-	async verifyGoogle(operation, idToken) {
-		const result = await this.#coordinator.verifyGoogle({
-			relayUrl: this.relayUrl,
-			operation: {
-				kind: "prepared",
-				recoveryOperationId: operation.recoveryOperationId,
-				walletId: operation.walletId,
-				target: operation.target
-			},
-			idToken
-		});
-		if (result.kind !== "google_verified") return result;
-		return {
-			kind: "hosted_recovery_google_verified",
-			recoveryOperationId: result.recoveryOperationId,
-			walletId: result.walletId,
-			target: result.target,
-			challengeId: result.challengeId,
-			delivery: result.delivery,
-			expiresAtMs: result.expiresAtMs
-		};
-	}
-	async verifyEmailOtp(operation, input) {
-		const result = await this.#coordinator.verifyEmailOtp({
-			context: this.context,
-			operation: {
-				kind: "google_verified",
-				recoveryOperationId: operation.recoveryOperationId,
-				walletId: operation.walletId,
-				target: operation.target,
-				challengeId: operation.challengeId,
-				delivery: operation.delivery,
-				expiresAtMs: operation.expiresAtMs
-			},
-			challengeId: input.challengeId,
-			otpCode: input.otpCode
-		});
-		if (result.kind !== "email_otp_verified") return result;
-		return {
-			kind: "hosted_recovery_email_otp_verified",
-			recoveryOperationId: result.recoveryOperationId,
-			walletId: result.walletId,
-			target: result.target,
-			challengeId: result.challengeId
-		};
-	}
-	async finalize(operation) {
-		if (operation.kind === "hosted_recovery_credential_created") return await this.#coordinator.finalize({
-			context: this.context,
-			operation: {
-				kind: "credential_created",
-				recoveryOperationId: operation.recoveryOperationId,
-				walletId: operation.walletId,
-				target: operation.target
-			}
-		});
-		return await this.#coordinator.finalize({
-			context: this.context,
-			operation: {
-				kind: "email_otp_verified",
-				recoveryOperationId: operation.recoveryOperationId,
-				walletId: operation.walletId,
-				target: operation.target,
-				challengeId: operation.challengeId
-			}
-		});
-	}
-	async cancel(operation) {
-		this.#coordinator.cancel(operation.recoveryOperationId);
-	}
-	async #createPasskey(operation) {
-		const result = await this.#coordinator.createPasskey({
-			context: this.context,
-			operation
-		});
-		if (result.kind !== "credential_created") return result;
-		return this.#hostedCredentialCreated(result);
-	}
-	#hostedCredentialCreated(result) {
-		return {
-			kind: "hosted_recovery_credential_created",
-			recoveryOperationId: result.recoveryOperationId,
-			walletId: result.walletId,
-			target: result.target
-		};
-	}
-};
-function createHostedRecoveryPort(input) {
-	return new CoordinatorHostedRecoveryPort(input.context, input.relayUrl);
-}
-//#endregion
-export { createHostedRecoveryPort };