@seams/wallet 0.7.3 → 0.8.0

package/dist/public/sdk/wallet-recovery-BX61-79p.js

@@ -1,1902 +0,0 @@
-import { A as parseWalletRecoveryOperationId, D as parseWalletAuthorityId, M as parseWebAuthnRpId, O as parseWalletId, T as parseWalletAuthMethodId, j as parseWebAuthnCredentialIdB64u, n as hasWhitespaceOrControlCharacters, s as parseEmailOtpProviderUserId } from "./domainIds-lcrFg6Sa.js";
-import { _ as requireRecord, y as requireTrimmedString } from "./validation-gat4LEKm.js";
-import { i as base64UrlEncode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
-import { C as parseEnvelopeNonceB64u, I as rejectUnknownFields, S as parseEnvelopeCiphertextB64u, b as parseDigestField } from "./sessionPolicy-DO-MkL65.js";
-import { l as parseDeviceId } from "./capabilityKinds-hvYqa6S_.js";
-import { f as alphabetizeStringify, m as sha256BytesUtf8, p as sha256Bytes } from "./chains-BMh3btVo.js";
-import { a as sha256DigestB64u, n as parseCorrelationId, r as parseDigestB64u } from "./canonicalPrimitives-BTHWz80v.js";
-import { m as walletAuthorityDigestsMatchV1, o as isActiveRecoveredWalletAuthorityV1, u as parseWalletAuthorityV1, w as parseWalletAuthMethodRecordV2 } from "./walletAuthority-DD9T25F6.js";
-//#region ../../node_modules/idb/build/index.js
-const instanceOfAny = (object, constructors) => constructors.some((c) => object instanceof c);
-let idbProxyableTypes;
-let cursorAdvanceMethods;
-function getIdbProxyableTypes() {
-	return idbProxyableTypes || (idbProxyableTypes = [
-		IDBDatabase,
-		IDBObjectStore,
-		IDBIndex,
-		IDBCursor,
-		IDBTransaction
-	]);
-}
-function getCursorAdvanceMethods() {
-	return cursorAdvanceMethods || (cursorAdvanceMethods = [
-		IDBCursor.prototype.advance,
-		IDBCursor.prototype.continue,
-		IDBCursor.prototype.continuePrimaryKey
-	]);
-}
-const transactionDoneMap = /* @__PURE__ */ new WeakMap();
-const transformCache = /* @__PURE__ */ new WeakMap();
-const reverseTransformCache = /* @__PURE__ */ new WeakMap();
-function promisifyRequest(request) {
-	const promise = new Promise((resolve, reject) => {
-		const unlisten = () => {
-			request.removeEventListener("success", success);
-			request.removeEventListener("error", error);
-		};
-		const success = () => {
-			resolve(wrap(request.result));
-			unlisten();
-		};
-		const error = () => {
-			reject(request.error);
-			unlisten();
-		};
-		request.addEventListener("success", success);
-		request.addEventListener("error", error);
-	});
-	reverseTransformCache.set(promise, request);
-	return promise;
-}
-function cacheDonePromiseForTransaction(tx) {
-	if (transactionDoneMap.has(tx)) return;
-	const done = new Promise((resolve, reject) => {
-		const unlisten = () => {
-			tx.removeEventListener("complete", complete);
-			tx.removeEventListener("error", error);
-			tx.removeEventListener("abort", error);
-		};
-		const complete = () => {
-			resolve();
-			unlisten();
-		};
-		const error = () => {
-			reject(tx.error || new DOMException("AbortError", "AbortError"));
-			unlisten();
-		};
-		tx.addEventListener("complete", complete);
-		tx.addEventListener("error", error);
-		tx.addEventListener("abort", error);
-	});
-	transactionDoneMap.set(tx, done);
-}
-let idbProxyTraps = {
-	get(target, prop, receiver) {
-		if (target instanceof IDBTransaction) {
-			if (prop === "done") return transactionDoneMap.get(target);
-			if (prop === "store") return receiver.objectStoreNames[1] ? void 0 : receiver.objectStore(receiver.objectStoreNames[0]);
-		}
-		return wrap(target[prop]);
-	},
-	set(target, prop, value) {
-		target[prop] = value;
-		return true;
-	},
-	has(target, prop) {
-		if (target instanceof IDBTransaction && (prop === "done" || prop === "store")) return true;
-		return prop in target;
-	}
-};
-function replaceTraps(callback) {
-	idbProxyTraps = callback(idbProxyTraps);
-}
-function wrapFunction(func) {
-	if (getCursorAdvanceMethods().includes(func)) return function(...args) {
-		func.apply(unwrap(this), args);
-		return wrap(this.request);
-	};
-	return function(...args) {
-		return wrap(func.apply(unwrap(this), args));
-	};
-}
-function transformCachableValue(value) {
-	if (typeof value === "function") return wrapFunction(value);
-	if (value instanceof IDBTransaction) cacheDonePromiseForTransaction(value);
-	if (instanceOfAny(value, getIdbProxyableTypes())) return new Proxy(value, idbProxyTraps);
-	return value;
-}
-function wrap(value) {
-	if (value instanceof IDBRequest) return promisifyRequest(value);
-	if (transformCache.has(value)) return transformCache.get(value);
-	const newValue = transformCachableValue(value);
-	if (newValue !== value) {
-		transformCache.set(value, newValue);
-		reverseTransformCache.set(newValue, value);
-	}
-	return newValue;
-}
-const unwrap = (value) => reverseTransformCache.get(value);
-/**
-* Open a database.
-*
-* @param name Name of the database.
-* @param version Schema version.
-* @param callbacks Additional callbacks.
-*/
-function openDB(name, version, { blocked, upgrade, blocking, terminated } = {}) {
-	const request = indexedDB.open(name, version);
-	const openPromise = wrap(request);
-	if (upgrade) request.addEventListener("upgradeneeded", (event) => {
-		upgrade(wrap(request.result), event.oldVersion, event.newVersion, wrap(request.transaction), event);
-	});
-	if (blocked) request.addEventListener("blocked", (event) => blocked(event.oldVersion, event.newVersion, event));
-	openPromise.then((db) => {
-		if (terminated) db.addEventListener("close", () => terminated());
-		if (blocking) db.addEventListener("versionchange", (event) => blocking(event.oldVersion, event.newVersion, event));
-	}).catch(() => {});
-	return openPromise;
-}
-const readMethods = [
-	"get",
-	"getKey",
-	"getAll",
-	"getAllKeys",
-	"count"
-];
-const writeMethods = [
-	"put",
-	"add",
-	"delete",
-	"clear"
-];
-const cachedMethods = /* @__PURE__ */ new Map();
-function getMethod(target, prop) {
-	if (!(target instanceof IDBDatabase && !(prop in target) && typeof prop === "string")) return;
-	if (cachedMethods.get(prop)) return cachedMethods.get(prop);
-	const targetFuncName = prop.replace(/FromIndex$/, "");
-	const useIndex = prop !== targetFuncName;
-	const isWrite = writeMethods.includes(targetFuncName);
-	if (!(targetFuncName in (useIndex ? IDBIndex : IDBObjectStore).prototype) || !(isWrite || readMethods.includes(targetFuncName))) return;
-	const method = async function(storeName, ...args) {
-		const tx = this.transaction(storeName, isWrite ? "readwrite" : "readonly");
-		let target = tx.store;
-		if (useIndex) target = target.index(args.shift());
-		return (await Promise.all([target[targetFuncName](...args), isWrite && tx.done]))[0];
-	};
-	cachedMethods.set(prop, method);
-	return method;
-}
-replaceTraps((oldTraps) => ({
-	...oldTraps,
-	get: (target, prop, receiver) => getMethod(target, prop) || oldTraps.get(target, prop, receiver),
-	has: (target, prop) => !!getMethod(target, prop) || oldTraps.has(target, prop)
-}));
-const advanceMethodProps = [
-	"continue",
-	"continuePrimaryKey",
-	"advance"
-];
-const methodMap = {};
-const advanceResults = /* @__PURE__ */ new WeakMap();
-const ittrProxiedCursorToOriginalProxy = /* @__PURE__ */ new WeakMap();
-const cursorIteratorTraps = { get(target, prop) {
-	if (!advanceMethodProps.includes(prop)) return target[prop];
-	let cachedFunc = methodMap[prop];
-	if (!cachedFunc) cachedFunc = methodMap[prop] = function(...args) {
-		advanceResults.set(this, ittrProxiedCursorToOriginalProxy.get(this)[prop](...args));
-	};
-	return cachedFunc;
-} };
-async function* iterate(...args) {
-	let cursor = this;
-	if (!(cursor instanceof IDBCursor)) cursor = await cursor.openCursor(...args);
-	if (!cursor) return;
-	cursor = cursor;
-	const proxiedCursor = new Proxy(cursor, cursorIteratorTraps);
-	ittrProxiedCursorToOriginalProxy.set(proxiedCursor, cursor);
-	reverseTransformCache.set(proxiedCursor, unwrap(cursor));
-	while (cursor) {
-		yield proxiedCursor;
-		cursor = await (advanceResults.get(proxiedCursor) || cursor.continue());
-		advanceResults.delete(proxiedCursor);
-	}
-}
-function isIteratorProp(target, prop) {
-	return prop === Symbol.asyncIterator && instanceOfAny(target, [
-		IDBIndex,
-		IDBObjectStore,
-		IDBCursor
-	]) || prop === "iterate" && instanceOfAny(target, [IDBIndex, IDBObjectStore]);
-}
-replaceTraps((oldTraps) => ({
-	...oldTraps,
-	get(target, prop, receiver) {
-		if (isIteratorProp(target, prop)) return iterate;
-		return oldTraps.get(target, prop, receiver);
-	},
-	has(target, prop) {
-		return isIteratorProp(target, prop) || oldTraps.has(target, prop);
-	}
-}));
-//#endregion
-//#region src/core/indexedDB/schemaNames.ts
-const SEAMS_WALLET_DB_NAME = "seams_wallet";
-const SEAMS_WALLET_STORES = {
-	appState: "app_state",
-	wallets: "wallets",
-	walletAuthorities: "wallet_authorities",
-	walletAuthMethods: "wallet_auth_methods",
-	walletAuthoritySignerMaterials: "wallet_authority_signer_materials",
-	walletAuthorityExportRoots: "wallet_authority_export_roots",
-	walletAuthorityInstallationReceipts: "wallet_authority_installation_receipts",
-	walletSelections: "wallet_selections",
-	walletSigners: "wallet_signers",
-	nearAccountProjections: "near_accounts",
-	signerOpsOutbox: "signer_ops_outbox",
-	nonceLaneLeases: "nonce_lane_leases",
-	nonceLaneLocks: "nonce_lane_locks",
-	keyMaterial: "key_material",
-	signingSessionSeals: "signing_session_seals",
-	signingSessionRestoreLeases: "signing_session_restore_leases",
-	pendingWalletRecoveryCodeBackups: "email_otp_pending_recovery_code_backups",
-	walletSessionAuthorizations: "wallet_session_authorizations",
-	ecdsaCapabilityManifests: "ecdsa_capability_manifests",
-	ecdsaCurrentCapabilityManifests: "ecdsa_current_capability_manifests",
-	ecdsaRoleLocalMaterial: "ecdsa_role_local_material",
-	ecdsaActivationCommitJournals: "ecdsa_activation_commit_journals",
-	ecdsaMaterialSealingKeys: "ecdsa_material_sealing_keys",
-	ecdsaClientPresignatures: "ecdsa_client_presignatures"
-};
-const SEAMS_WALLET_INDEXES = {
-	profileId: "profile_id",
-	credentialId: "credential_id",
-	credentialIdB64u: "credential_id_b64u",
-	profileIdCredentialId: "profile_id_credential_id",
-	profileIdSignerSlot: "profile_id_signer_slot",
-	updatedAt: "updated_at",
-	walletId: "wallet_id",
-	walletIdRpId: "wallet_id_rp_id",
-	walletIdKind: "wallet_id_kind",
-	walletKindNearSignerSlot: "wallet_kind_near_signer_slot",
-	walletKindNearEd25519SigningKeyId: "wallet_kind_near_ed25519_signing_key_id",
-	walletKindChainTargetKeyHandle: "wallet_kind_chain_target_key_handle",
-	walletKindChainTargetKeyFacts: "wallet_kind_chain_target_key_facts",
-	walletSignerId: "wallet_signer_id",
-	nearEd25519SigningKeyId: "near_ed25519_signing_key_id",
-	nearAccountId: "near_account_id",
-	rpId: "rp_id",
-	rpIdCredentialId: "rp_id_credential_id",
-	chainIdKey: "chain_id_key",
-	chainIdKeyAccountAddress: "chain_id_key_account_address",
-	profileIdChainIdKey: "profile_id_chain_id_key",
-	chainIdKeyAccountAddressStatus: "chain_id_key_account_address_status",
-	chainTargetKey: "chain_target_key",
-	keyHandle: "key_handle",
-	thresholdOwnerAddress: "threshold_owner_address",
-	ecdsaThresholdKeyId: "ecdsa_threshold_key_id",
-	status: "status",
-	nextAttemptAt: "next_attempt_at",
-	statusNextAttemptAt: "status_next_attempt_at",
-	idempotencyKey: "idempotency_key",
-	laneKey: "lane_key",
-	accountId: "account_id",
-	state: "state",
-	expiresAtMs: "expires_at_ms",
-	recoveryCodesIssuedAtMs: "recovery_codes_issued_at_ms",
-	laneState: "lane_state",
-	walletExpiresAt: "wallet_expires_at",
-	ownerId: "owner_id",
-	chainIdKeyKeyKind: "chain_id_key_key_kind",
-	publicKey: "public_key",
-	userId: "user_id",
-	authMethod: "auth_method",
-	curve: "curve",
-	signingRootId: "signing_root_id",
-	signingRootVersion: "signing_root_version",
-	walletSigningRootAuthMethod: "wallet_signing_root_auth_method",
-	ed25519ThresholdSessionId: "ed25519_threshold_session_id",
-	ecdsaThresholdSessionId: "ecdsa_threshold_session_id",
-	thresholdSessionId: "threshold_session_id",
-	exactSigningLaneIdentityKey: "exact_signing_lane_identity_key",
-	budgetReservationKey: "budget_reservation_key",
-	authSubjectId: "auth_subject_id",
-	enrollmentId: "enrollment_id",
-	walletIdEnrollmentId: "wallet_id_enrollment_id",
-	walletIdAuthSubjectId: "wallet_id_auth_subject_id",
-	walletIdAuthSubjectIdEnrollmentId: "wallet_id_auth_subject_id_enrollment_id",
-	authIdentifierKey: "auth_identifier_key",
-	kindRpIdAuthIdentifier: "kind_rp_id_auth_identifier",
-	passkeyRpIdCredentialId: "passkey_rp_id_credential_id",
-	capabilityWallet: "capability_wallet",
-	capabilityWalletAuthorityState: "capability_wallet_authority_state",
-	capabilityWalletAuthority: "capability_wallet_authority",
-	walletAuthorityId: "wallet_authority_id",
-	walletAuthMethodId: "wallet_auth_method_id",
-	walletIdAuthorityId: "wallet_id_authority_id",
-	walletIdAuthorityStatus: "wallet_id_authority_status",
-	walletIdAuthMethodId: "wallet_id_auth_method_id",
-	walletAuthorityAuthMethodId: "wallet_authority_auth_method_id",
-	activationId: "activation_id",
-	walletAuthorityActivationId: "wallet_authority_activation_id",
-	walletIdDeviceId: "wallet_id_device_id",
-	packageSetDigest: "package_set_digest",
-	walletKeyId: "wallet_key_id",
-	walletIdLockGeneration: "wallet_id_lock_generation",
-	authorityDigest: "authority_digest",
-	revocationEpoch: "revocation_epoch",
-	poolIdentityKey: "pool_identity_key",
-	walletMaterialActivationId: "wallet_material_activation_id"
-};
-const SEAMS_WALLET_SCHEMA_MANIFEST = [
-	{
-		store: SEAMS_WALLET_STORES.appState,
-		keyPath: "key",
-		indexes: []
-	},
-	{
-		store: SEAMS_WALLET_STORES.wallets,
-		keyPath: "wallet_id",
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.rpId,
-				keyPath: "rp_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.status,
-				keyPath: "status",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.updatedAt,
-				keyPath: "updated_at",
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.walletAuthorities,
-		keyPath: "authority_id",
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.walletId,
-				keyPath: "wallet_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletAuthorityId,
-				keyPath: "authority_id",
-				unique: true
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletIdAuthorityId,
-				keyPath: ["wallet_id", "authority_id"],
-				unique: true
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletIdAuthorityStatus,
-				keyPath: ["wallet_id", "state"],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletIdDeviceId,
-				keyPath: ["wallet_id", "device_id"],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.updatedAt,
-				keyPath: "updated_at",
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.walletAuthMethods,
-		keyPath: "wallet_auth_method_id",
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.walletId,
-				keyPath: "wallet_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletIdKind,
-				keyPath: ["wallet_id", "kind"],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.authMethod,
-				keyPath: "auth_method",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.rpId,
-				keyPath: "rp_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.authIdentifierKey,
-				keyPath: "auth_identifier_key",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.kindRpIdAuthIdentifier,
-				keyPath: [
-					"kind",
-					"rp_id",
-					"auth_identifier_key"
-				],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.passkeyRpIdCredentialId,
-				keyPath: [
-					"kind",
-					"rp_id",
-					"credential_id_b64u"
-				],
-				unique: true
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.status,
-				keyPath: "status",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletAuthorityId,
-				keyPath: "wallet_authority_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletIdAuthMethodId,
-				keyPath: ["wallet_id", "wallet_auth_method_id"],
-				unique: true
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletIdAuthorityStatus,
-				keyPath: [
-					"wallet_id",
-					"wallet_authority_id",
-					"status"
-				],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.updatedAt,
-				keyPath: "updated_at",
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.walletAuthoritySignerMaterials,
-		keyPath: [
-			"wallet_authority_id",
-			"wallet_auth_method_id",
-			"activation_id"
-		],
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.walletAuthorityId,
-				keyPath: "wallet_authority_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletAuthorityAuthMethodId,
-				keyPath: ["wallet_authority_id", "wallet_auth_method_id"],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.activationId,
-				keyPath: "activation_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletAuthorityActivationId,
-				keyPath: ["wallet_authority_id", "activation_id"],
-				unique: true
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.walletAuthorityExportRoots,
-		keyPath: [
-			"wallet_authority_id",
-			"wallet_auth_method_id",
-			"wallet_key_id"
-		],
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.walletAuthorityId,
-				keyPath: "wallet_authority_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletAuthorityAuthMethodId,
-				keyPath: ["wallet_authority_id", "wallet_auth_method_id"],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletKeyId,
-				keyPath: "wallet_key_id",
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.walletAuthorityInstallationReceipts,
-		keyPath: "authority_id",
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.walletAuthorityId,
-				keyPath: "authority_id",
-				unique: true
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletId,
-				keyPath: "wallet_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletAuthMethodId,
-				keyPath: "wallet_auth_method_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletIdDeviceId,
-				keyPath: ["wallet_id", "device_id"],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.packageSetDigest,
-				keyPath: "package_set_digest_b64u",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.updatedAt,
-				keyPath: "installed_at_ms",
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.walletSelections,
-		keyPath: "wallet_id",
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.walletId,
-				keyPath: "wallet_id",
-				unique: true
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletAuthMethodId,
-				keyPath: "wallet_auth_method_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletIdLockGeneration,
-				keyPath: ["wallet_id", "lock_generation"],
-				unique: true
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.walletSigners,
-		keyPath: "wallet_signer_id",
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.walletId,
-				keyPath: "wallet_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletIdKind,
-				keyPath: ["wallet_id", "kind"],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletKindNearSignerSlot,
-				keyPath: [
-					"wallet_id",
-					"kind",
-					"near_signer_slot"
-				],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletKindNearEd25519SigningKeyId,
-				keyPath: [
-					"wallet_id",
-					"kind",
-					"near_ed25519_signing_key_id"
-				],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletKindChainTargetKeyHandle,
-				keyPath: [
-					"wallet_id",
-					"kind",
-					"chain_target_key",
-					"key_handle"
-				],
-				unique: true
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletKindChainTargetKeyFacts,
-				keyPath: [
-					"wallet_id",
-					"kind",
-					"chain_target_key",
-					"ecdsa_threshold_key_id"
-				],
-				unique: true
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.chainTargetKey,
-				keyPath: "chain_target_key",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.keyHandle,
-				keyPath: "key_handle",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.thresholdOwnerAddress,
-				keyPath: "threshold_owner_address",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.status,
-				keyPath: "status",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.updatedAt,
-				keyPath: "updated_at",
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.nearAccountProjections,
-		keyPath: [
-			"wallet_id",
-			"near_account_id",
-			"signer_slot"
-		],
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.nearAccountId,
-				keyPath: "near_account_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.profileId,
-				keyPath: "profile_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.publicKey,
-				keyPath: "public_key",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.updatedAt,
-				keyPath: "updated_at",
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.signerOpsOutbox,
-		keyPath: "op_id",
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.status,
-				keyPath: "status",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.nextAttemptAt,
-				keyPath: "next_attempt_at",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.statusNextAttemptAt,
-				keyPath: ["status", "next_attempt_at"],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.idempotencyKey,
-				keyPath: "idempotency_key",
-				unique: true
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletId,
-				keyPath: "wallet_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.chainTargetKey,
-				keyPath: "chain_target_key",
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.nonceLaneLeases,
-		keyPath: "lease_id",
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.laneKey,
-				keyPath: "lane_key",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletId,
-				keyPath: "wallet_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.nearAccountId,
-				keyPath: "near_account_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.state,
-				keyPath: "state",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.expiresAtMs,
-				keyPath: "expires_at_ms",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.laneState,
-				keyPath: ["lane_key", "state"],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletExpiresAt,
-				keyPath: ["wallet_id", "expires_at_ms"],
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.nonceLaneLocks,
-		keyPath: "lock_key",
-		indexes: [{
-			name: SEAMS_WALLET_INDEXES.expiresAtMs,
-			keyPath: "expires_at_ms",
-			unique: false
-		}, {
-			name: SEAMS_WALLET_INDEXES.ownerId,
-			keyPath: "owner_id",
-			unique: false
-		}]
-	},
-	{
-		store: SEAMS_WALLET_STORES.keyMaterial,
-		keyPath: "key_material_id",
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.walletId,
-				keyPath: "wallet_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletSignerId,
-				keyPath: "wallet_signer_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.chainTargetKey,
-				keyPath: "chain_target_key",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.keyHandle,
-				keyPath: "key_handle",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.publicKey,
-				keyPath: "public_key",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.updatedAt,
-				keyPath: "updated_at",
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.signingSessionSeals,
-		keyPath: "store_key",
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.walletId,
-				keyPath: "wallet_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.authMethod,
-				keyPath: "auth_method",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.curve,
-				keyPath: "curve",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.ed25519ThresholdSessionId,
-				keyPath: "ed25519_threshold_session_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.ecdsaThresholdSessionId,
-				keyPath: "ecdsa_threshold_session_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.thresholdSessionId,
-				keyPath: "threshold_session_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.enrollmentId,
-				keyPath: "enrollmentId",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.keyHandle,
-				keyPath: "key_handle",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.chainTargetKey,
-				keyPath: "chain_target_key",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.exactSigningLaneIdentityKey,
-				keyPath: "exact_signing_lane_identity_key",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.expiresAtMs,
-				keyPath: "expires_at_ms",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.updatedAt,
-				keyPath: "updated_at",
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.signingSessionRestoreLeases,
-		keyPath: "lease_key",
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.thresholdSessionId,
-				keyPath: "threshold_session_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.ownerId,
-				keyPath: "owner_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.expiresAtMs,
-				keyPath: "expires_at_ms",
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.pendingWalletRecoveryCodeBackups,
-		keyPath: ["wallet_id", "enrollment_id"],
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.walletId,
-				keyPath: "wallet_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.enrollmentId,
-				keyPath: "enrollment_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletIdEnrollmentId,
-				keyPath: ["wallet_id", "enrollment_id"],
-				unique: true
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.recoveryCodesIssuedAtMs,
-				keyPath: "recovery_codes_issued_at_ms",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.status,
-				keyPath: "status",
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.walletSessionAuthorizations,
-		keyPath: "wallet_session_id",
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.walletId,
-				keyPath: "wallet_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletAuthorityId,
-				keyPath: "wallet_authority_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletAuthMethodId,
-				keyPath: "wallet_auth_method_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.authorityDigest,
-				keyPath: "authority_digest_b64u",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.revocationEpoch,
-				keyPath: "authority_revocation_epoch",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.status,
-				keyPath: "status",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.expiresAtMs,
-				keyPath: "expires_at_ms",
-				unique: false
-			}
-		]
-	},
-	{
-		store: SEAMS_WALLET_STORES.ecdsaCapabilityManifests,
-		keyPath: "manifest_id",
-		indexes: [{
-			name: SEAMS_WALLET_INDEXES.capabilityWallet,
-			keyPath: ["capability_ref", "wallet_id"],
-			unique: false
-		}, {
-			name: SEAMS_WALLET_INDEXES.capabilityWalletAuthorityState,
-			keyPath: [
-				"capability_ref",
-				"wallet_id",
-				"authority_digest",
-				"manifest_state"
-			],
-			unique: false
-		}]
-	},
-	{
-		store: SEAMS_WALLET_STORES.ecdsaCurrentCapabilityManifests,
-		keyPath: [
-			"capability_ref",
-			"wallet_id",
-			"authority_digest"
-		],
-		indexes: [{
-			name: SEAMS_WALLET_INDEXES.walletId,
-			keyPath: "wallet_id",
-			unique: false
-		}]
-	},
-	{
-		store: SEAMS_WALLET_STORES.ecdsaRoleLocalMaterial,
-		keyPath: "durable_material_ref",
-		indexes: []
-	},
-	{
-		store: SEAMS_WALLET_STORES.ecdsaActivationCommitJournals,
-		keyPath: "journal_id",
-		indexes: [{
-			name: SEAMS_WALLET_INDEXES.capabilityWalletAuthority,
-			keyPath: [
-				"capability_ref",
-				"wallet_id",
-				"authority_digest"
-			],
-			unique: true
-		}]
-	},
-	{
-		store: SEAMS_WALLET_STORES.ecdsaMaterialSealingKeys,
-		keyPath: "key_id",
-		indexes: []
-	},
-	{
-		store: SEAMS_WALLET_STORES.ecdsaClientPresignatures,
-		keyPath: "record_id",
-		indexes: [
-			{
-				name: SEAMS_WALLET_INDEXES.poolIdentityKey,
-				keyPath: "pool_identity_key",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletId,
-				keyPath: "wallet_id",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletMaterialActivationId,
-				keyPath: ["wallet_id", "material_activation_id"],
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.expiresAtMs,
-				keyPath: "expires_at_ms",
-				unique: false
-			},
-			{
-				name: SEAMS_WALLET_INDEXES.walletExpiresAt,
-				keyPath: ["wallet_id", "expires_at_ms"],
-				unique: false
-			}
-		]
-	}
-];
-//#endregion
-//#region src/core/indexedDB/seamsWalletDB/schema.ts
-const SEAMS_WALLET_DB_CONFIG = {
-	dbName: SEAMS_WALLET_DB_NAME,
-	dbVersion: 24
-};
-function keyPathForIndexedDB(keyPath) {
-	return typeof keyPath === "string" ? keyPath : [...keyPath];
-}
-function createCanonicalStore(db, definition) {
-	const store = db.createObjectStore(definition.store, { keyPath: keyPathForIndexedDB(definition.keyPath) });
-	for (const index of definition.indexes) store.createIndex(index.name, keyPathForIndexedDB(index.keyPath), { unique: index.unique });
-}
-function upgradeSeamsWalletDBSchema(db) {
-	for (const definition of SEAMS_WALLET_SCHEMA_MANIFEST) {
-		if (db.objectStoreNames.contains(definition.store)) continue;
-		createCanonicalStore(db, definition);
-	}
-}
-//#endregion
-//#region src/core/indexedDB/seamsWalletDB/manager.ts
-const INDEXED_DB_BLOCKED_OPEN_TIMEOUT_MS = 3e3;
-const INDEXED_DB_OPEN_TIMEOUT_MS = 8e3;
-const INDEXED_DB_TRANSACTION_TIMEOUT_MS = 8e3;
-function seamsWalletDbOpenBlockedError(dbName) {
-	return /* @__PURE__ */ new Error(`[SeamsWalletDBManager] IndexedDB open is blocked for ${dbName}. Close other tabs using this app and retry.`);
-}
-function indexedDbTimeoutError(message) {
-	return new Error(message);
-}
-async function withTimeout(promise, ms, error, onTimeout) {
-	let settled = false;
-	let timeout = null;
-	const timeoutPromise = new Promise((_resolve, reject) => {
-		timeout = setTimeout(() => {
-			if (settled) return;
-			onTimeout?.();
-			reject(error);
-		}, ms);
-	});
-	try {
-		return await Promise.race([promise, timeoutPromise]);
-	} finally {
-		settled = true;
-		if (timeout) clearTimeout(timeout);
-	}
-}
-async function runIndexedDbTransactionTask(context, task) {
-	const result = await task(context);
-	await context.tx.done;
-	return result;
-}
-var SeamsWalletDBManager = class {
-	constructor(config = SEAMS_WALLET_DB_CONFIG) {
-		this.dbPromise = null;
-		this.disabled = false;
-		this.config = config;
-	}
-	getDbName() {
-		return this.config.dbName;
-	}
-	setDbName(dbName) {
-		if (this.config.dbName === dbName) return;
-		this.close();
-		this.config = {
-			...this.config,
-			dbName
-		};
-	}
-	setDisabled(disabled) {
-		this.disabled = disabled;
-		if (disabled) this.close();
-	}
-	isDisabled() {
-		return this.disabled;
-	}
-	close() {
-		if (this.dbPromise) {
-			this.dbPromise.then((db) => db.close()).catch(() => void 0);
-			this.dbPromise = null;
-		}
-	}
-	async getDB() {
-		if (this.disabled) throw new Error("[SeamsWalletDBManager] IndexedDB is disabled in this environment.");
-		if (!this.dbPromise) {
-			const dbName = this.config.dbName;
-			const dbVersion = this.config.dbVersion;
-			let blockedTimer = null;
-			let rejectBlockedOpen = null;
-			const blockedOpen = new Promise((_resolve, reject) => {
-				rejectBlockedOpen = reject;
-			});
-			const openPromise = openDB(dbName, dbVersion, {
-				upgrade(db) {
-					upgradeSeamsWalletDBSchema(db);
-				},
-				blocked() {
-					console.warn("[SeamsWalletDBManager] IndexedDB open is blocked.", {
-						dbName,
-						dbVersion
-					});
-					blockedTimer = setTimeout(() => {
-						rejectBlockedOpen?.(seamsWalletDbOpenBlockedError(dbName));
-					}, INDEXED_DB_BLOCKED_OPEN_TIMEOUT_MS);
-				},
-				blocking: () => {
-					console.warn("[SeamsWalletDBManager] IndexedDB connection is blocking an upgrade.", {
-						dbName,
-						dbVersion
-					});
-					this.close();
-				},
-				terminated() {
-					console.warn("[SeamsWalletDBManager] IndexedDB connection has been terminated.", {
-						dbName,
-						dbVersion
-					});
-				}
-			});
-			this.dbPromise = withTimeout(Promise.race([openPromise, blockedOpen]).finally(() => {
-				if (blockedTimer) clearTimeout(blockedTimer);
-			}), INDEXED_DB_OPEN_TIMEOUT_MS, indexedDbTimeoutError(`[SeamsWalletDBManager] IndexedDB open timed out for ${dbName}. Close other tabs using this app and retry.`)).catch((error) => {
-				this.dbPromise = null;
-				openPromise.then((db) => db.close()).catch(() => void 0);
-				throw error;
-			});
-		}
-		return await this.dbPromise;
-	}
-	async runTransaction(stores, mode, task, options) {
-		const db = await withTimeout(this.getDB(), INDEXED_DB_OPEN_TIMEOUT_MS, indexedDbTimeoutError(`[SeamsWalletDBManager] IndexedDB connection timed out for ${this.config.dbName}. Close other tabs using this app and retry.`));
-		const tx = db.transaction([...stores], mode, options);
-		const context = {
-			db,
-			tx,
-			store(name) {
-				return tx.objectStore(name);
-			}
-		};
-		try {
-			return await withTimeout(runIndexedDbTransactionTask(context, task), INDEXED_DB_TRANSACTION_TIMEOUT_MS, indexedDbTimeoutError(`[SeamsWalletDBManager] IndexedDB transaction timed out for ${this.config.dbName}. Close other tabs using this app and retry.`), () => {
-				try {
-					tx.abort();
-				} catch {}
-			});
-		} catch (error) {
-			try {
-				tx.abort();
-			} catch {}
-			await tx.done.catch(() => void 0);
-			throw error;
-		}
-	}
-};
-//#endregion
-//#region src/core/indexedDB/singletons.ts
-const seamsWalletDB = new SeamsWalletDBManager();
-const EMAIL_OTP_RECOVERY_KEY_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-const RECOVERY_KEY_DECODE = Object.freeze(Array.from(EMAIL_OTP_RECOVERY_KEY_ALPHABET).reduce((acc, char, index) => {
-	acc[char] = index;
-	return acc;
-}, {}));
-function isDecimalOnly(value) {
-	if (!value) return false;
-	for (let i = 0; i < value.length; i++) {
-		const code = value.charCodeAt(i);
-		if (code < 48 || code > 57) return false;
-	}
-	return true;
-}
-function encodeEmailOtpRecoveryKeyBytes(bytes) {
-	if (bytes.byteLength !== 20) throw new Error("Email OTP recovery key bytes must be exactly 20 bytes");
-	let bitBuffer = 0;
-	let bitsAvailable = 0;
-	let normalized = "";
-	for (let i = 0; i < bytes.byteLength; i++) {
-		bitBuffer = bitBuffer << 8 | bytes[i];
-		bitsAvailable += 8;
-		while (bitsAvailable >= 5) {
-			bitsAvailable -= 5;
-			normalized += EMAIL_OTP_RECOVERY_KEY_ALPHABET[bitBuffer >> bitsAvailable & 31];
-			bitBuffer &= (1 << bitsAvailable) - 1;
-		}
-	}
-	return normalized;
-}
-function formatEmailOtpRecoveryKey(normalizedKey) {
-	const normalized = normalizeEmailOtpRecoveryKey(normalizedKey);
-	const groups = [];
-	let offset = 0;
-	for (let i = 0; i < 8; i++) {
-		groups.push(normalized.slice(offset, offset + 4));
-		offset += 4;
-	}
-	return groups.join("-");
-}
-function buildEmailOtpRecoveryCodeSet(keys) {
-	if (keys.length !== 10) throw new Error(`Email OTP recovery code set must contain 10 keys`);
-	return [
-		formatEmailOtpRecoveryKey(keys[0]),
-		formatEmailOtpRecoveryKey(keys[1]),
-		formatEmailOtpRecoveryKey(keys[2]),
-		formatEmailOtpRecoveryKey(keys[3]),
-		formatEmailOtpRecoveryKey(keys[4]),
-		formatEmailOtpRecoveryKey(keys[5]),
-		formatEmailOtpRecoveryKey(keys[6]),
-		formatEmailOtpRecoveryKey(keys[7]),
-		formatEmailOtpRecoveryKey(keys[8]),
-		formatEmailOtpRecoveryKey(keys[9])
-	];
-}
-function normalizeEmailOtpRecoveryKey(input) {
-	const normalized = String(input || "").replace(/[\s-]/g, "").toUpperCase();
-	if (normalized.length !== 32) throw new Error("Email OTP recovery key must be 32 Crockford Base32 characters");
-	if (isDecimalOnly(normalized)) throw new Error("Email OTP recovery key must not be decimal-only");
-	for (let i = 0; i < normalized.length; i++) if (RECOVERY_KEY_DECODE[normalized[i]] === void 0) throw new Error("Email OTP recovery key contains unsupported characters");
-	return normalized;
-}
-function decodeEmailOtpRecoveryKey(input) {
-	const normalized = normalizeEmailOtpRecoveryKey(input);
-	const out = new Uint8Array(20);
-	let bitBuffer = 0;
-	let bitsAvailable = 0;
-	let offset = 0;
-	for (let i = 0; i < normalized.length; i++) {
-		bitBuffer = bitBuffer << 5 | RECOVERY_KEY_DECODE[normalized[i]];
-		bitsAvailable += 5;
-		if (bitsAvailable >= 8) {
-			bitsAvailable -= 8;
-			out[offset] = bitBuffer >> bitsAvailable & 255;
-			bitBuffer &= (1 << bitsAvailable) - 1;
-			offset += 1;
-		}
-	}
-	return out;
-}
-//#endregion
-//#region ../shared-ts/src/wallet-recovery/recoveryCodeReservation.ts
-const WALLET_RECOVERY_KEY_LIFECYCLE_DOMAIN_V1 = "seams/wallet-recovery/key-lifecycle/v1";
-/** One protocol lifecycle below a wallet-scoped recovery reservation. */
-async function deriveWalletRecoveryKeyLifecycleId(input) {
-	const keySetId = String(input.keySetId || "").trim();
-	if (!/^(near_ed25519|evm_family_ecdsa):\S+$/.test(keySetId)) throw new Error("wallet recovery key-set id is invalid");
-	return parseCorrelationId(`wallet-recovery-key-v1:${base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-		domain: WALLET_RECOVERY_KEY_LIFECYCLE_DOMAIN_V1,
-		reservationId: input.reservationId,
-		keySetId
-	})))}`);
-}
-function parseRecoveryCodeReservationId(value) {
-	if (typeof value !== "string" || value.length === 0 || value.length > 512 || value.trim() !== value || hasWhitespaceOrControlCharacters(value)) throw new Error("recovery code reservation id must be a compact opaque identifier");
-	return value;
-}
-//#endregion
-//#region ../shared-ts/src/wallet-recovery/walletRecoveryCommittedProjection.ts
-function buildWalletRecoveryCommittedProjectionV1(input) {
-	if (input.kind === "passkey") return buildPasskeyProjection(input);
-	return buildGoogleEmailOtpProjection(input);
-}
-function buildPasskeyProjection(input) {
-	const projection = {
-		version: "wallet_recovery_committed_projection_v1",
-		storeVersion: requireTrimmedString(input.storeVersion, "storeVersion", "is invalid"),
-		walletId: input.walletId,
-		recoveryOperationId: input.recoveryOperationId,
-		targetDeviceId: input.targetDeviceId,
-		targetAuthorityId: input.targetAuthorityId,
-		targetWalletAuthMethodId: input.targetWalletAuthMethodId,
-		authority: input.authority,
-		kind: "passkey",
-		authMethod: input.authMethod,
-		target: {
-			kind: "passkey",
-			rpId: input.authMethod.rpId,
-			credentialIdB64u: input.authMethod.credentialIdB64u
-		}
-	};
-	assertProjectionShape(projection);
-	return projection;
-}
-function buildGoogleEmailOtpProjection(input) {
-	const projection = {
-		version: "wallet_recovery_committed_projection_v1",
-		storeVersion: requireTrimmedString(input.storeVersion, "storeVersion", "is invalid"),
-		walletId: input.walletId,
-		recoveryOperationId: input.recoveryOperationId,
-		targetDeviceId: input.targetDeviceId,
-		targetAuthorityId: input.targetAuthorityId,
-		targetWalletAuthMethodId: input.targetWalletAuthMethodId,
-		authority: input.authority,
-		kind: "google_email_otp",
-		authMethod: input.authMethod,
-		target: {
-			kind: "google_email_otp",
-			provider: "google",
-			providerSubject: input.providerSubject,
-			emailHashHex: requireEmailHash(input.emailHashHex),
-			registrationAuthorityId: requireTrimmedString(input.registrationAuthorityId, "registrationAuthorityId", "is invalid"),
-			enrollment: parseEnrollmentReference(input.enrollment)
-		}
-	};
-	assertProjectionShape(projection);
-	return projection;
-}
-async function parseWalletRecoveryCommittedProjectionV1(raw, expected) {
-	const record = parseWalletRecoveryCommittedProjectionWireV1(raw);
-	if (record.version !== "wallet_recovery_committed_projection_v1") throw new Error("wallet recovery committed projection version is invalid");
-	if (record.kind !== expected.kind) throw new Error("wallet recovery committed projection target changed");
-	const walletId = requireParsed(parseWalletId(record.walletId), "walletId");
-	const recoveryOperationId = requireParsed(parseWalletRecoveryOperationId(record.recoveryOperationId), "recoveryOperationId");
-	const targetDeviceId = requireParsed(parseDeviceId(record.targetDeviceId), "targetDeviceId");
-	const targetAuthorityId = requireParsed(parseWalletAuthorityId(record.targetAuthorityId), "targetAuthorityId");
-	const targetWalletAuthMethodId = requireParsed(parseWalletAuthMethodId(record.targetWalletAuthMethodId), "targetWalletAuthMethodId");
-	const authorityResult = parseWalletAuthorityV1(record.authority);
-	if (!authorityResult.ok) throw new Error("wallet recovery authority projection is invalid");
-	const authority = authorityResult.value;
-	if (authority.state !== "active" || !isActiveRecoveredWalletAuthorityV1(authority) || !await walletAuthorityDigestsMatchV1(authority)) throw new Error("wallet recovery authority projection digest or lifecycle is invalid");
-	const authMethod = parseWalletAuthMethodRecordV2(record.authMethod);
-	if (!authMethod || authMethod.status !== "active") throw new Error("wallet recovery auth method projection is invalid");
-	const common = {
-		version: "wallet_recovery_committed_projection_v1",
-		storeVersion: requireTrimmedString(record.storeVersion, "storeVersion", "is invalid"),
-		walletId,
-		recoveryOperationId,
-		targetDeviceId,
-		targetAuthorityId,
-		targetWalletAuthMethodId,
-		authority
-	};
-	if (expected.kind === "passkey") {
-		if (authMethod.kind !== "passkey") throw new Error("wallet recovery target method family changed");
-		const target = parsePasskeyTarget(record.target);
-		const projection = {
-			...common,
-			kind: "passkey",
-			authMethod,
-			target
-		};
-		assertExpectedIdentity(projection, expected);
-		assertProjectionShape(projection);
-		return projection;
-	}
-	if (authMethod.kind !== "email_otp") throw new Error("wallet recovery target method family changed");
-	const target = parseGoogleEmailOtpTarget(record.target);
-	const projection = {
-		...common,
-		kind: "google_email_otp",
-		authMethod,
-		target
-	};
-	assertExpectedIdentity(projection, expected);
-	assertProjectionShape(projection);
-	return projection;
-}
-function parsePasskeyTarget(raw) {
-	const record = parseWalletRecoveryPasskeyTargetWireV1(raw);
-	if (record.kind !== "passkey") throw new Error("wallet recovery passkey target is invalid");
-	return {
-		kind: "passkey",
-		rpId: requireParsed(parseWebAuthnRpId(record.rpId), "target.rpId"),
-		credentialIdB64u: requireParsed(parseWebAuthnCredentialIdB64u(record.credentialIdB64u), "target.credentialIdB64u")
-	};
-}
-function parseGoogleEmailOtpTarget(raw) {
-	const record = parseWalletRecoveryGoogleEmailOtpTargetWireV1(raw);
-	if (record.kind !== "google_email_otp" || record.provider !== "google") throw new Error("wallet recovery Google Email OTP target is invalid");
-	return {
-		kind: "google_email_otp",
-		provider: "google",
-		providerSubject: requireParsed(parseEmailOtpProviderUserId(record.providerSubject), "target.providerSubject"),
-		emailHashHex: requireEmailHash(record.emailHashHex),
-		registrationAuthorityId: requireTrimmedString(record.registrationAuthorityId, "target.registrationAuthorityId", "is invalid"),
-		enrollment: parseEnrollmentReference(record.enrollment)
-	};
-}
-function parseEnrollmentReference(raw) {
-	const record = parseWalletRecoveryEmailOtpEnrollmentWireV1(raw);
-	if (record.kind !== "email_otp_enrollment_reference_v1") throw new Error("wallet recovery Email OTP enrollment is invalid");
-	return {
-		kind: "email_otp_enrollment_reference_v1",
-		enrollmentId: requireTrimmedString(record.enrollmentId, "enrollment.enrollmentId", "is invalid"),
-		enrollmentSealKeyVersion: requireTrimmedString(record.enrollmentSealKeyVersion, "enrollment.enrollmentSealKeyVersion", "is invalid")
-	};
-}
-function assertExpectedIdentity(projection, expected) {
-	if (projection.kind !== expected.kind || projection.walletId !== expected.walletId || projection.recoveryOperationId !== expected.recoveryOperationId || projection.targetDeviceId !== expected.targetDeviceId || projection.targetAuthorityId !== expected.targetAuthorityId || projection.targetWalletAuthMethodId !== expected.targetWalletAuthMethodId) throw new Error("wallet recovery committed projection identity changed");
-	if (projection.kind === "passkey" && expected.kind === "passkey") {
-		if (projection.target.rpId !== expected.rpId || projection.target.credentialIdB64u !== expected.credentialIdB64u) throw new Error("wallet recovery passkey target changed");
-		return;
-	}
-	if (projection.kind !== "google_email_otp" || expected.kind !== "google_email_otp") throw new Error("wallet recovery target identity changed");
-	if (projection.target.providerSubject !== expected.providerSubject || projection.target.emailHashHex !== expected.emailHashHex || projection.target.registrationAuthorityId !== expected.registrationAuthorityId || projection.target.enrollment.enrollmentId !== expected.enrollment.enrollmentId || projection.target.enrollment.enrollmentSealKeyVersion !== expected.enrollment.enrollmentSealKeyVersion) throw new Error("wallet recovery Google Email OTP target changed");
-}
-function assertProjectionShape(projection) {
-	if (projection.authority.walletId !== projection.walletId || projection.authority.authorityId !== projection.targetAuthorityId || projection.authority.principal.deviceId !== projection.targetDeviceId || projection.authority.provenance.kind !== "wallet_recovery" || projection.authority.provenance.recoveryOperationId !== projection.recoveryOperationId || projection.authority.provenance.continuityAuthorityId === projection.targetAuthorityId || projection.authMethod.walletId !== projection.walletId || projection.authMethod.walletAuthorityId !== projection.targetAuthorityId || projection.authMethod.walletAuthMethodId !== projection.targetWalletAuthMethodId || projection.authMethod.status !== "active") throw new Error("wallet recovery committed projection relations are invalid");
-	if (projection.kind === "passkey") {
-		if (projection.authMethod.kind !== "passkey" || projection.target.rpId !== projection.authMethod.rpId || projection.target.credentialIdB64u !== projection.authMethod.credentialIdB64u) throw new Error("wallet recovery passkey projection relations are invalid");
-		return;
-	}
-	if (projection.authMethod.kind !== "email_otp" || projection.target.emailHashHex !== projection.authMethod.emailHashHex || projection.target.registrationAuthorityId !== projection.authMethod.registrationAuthorityId) throw new Error("wallet recovery Google Email OTP projection relations are invalid");
-}
-function parseWalletRecoveryCommittedProjectionWireV1(value) {
-	const record = inspectRawObject(value);
-	if (record === null) throw new Error("wallet recovery committed projection must be an object");
-	requireExactFields(record, [
-		"version",
-		"kind",
-		"storeVersion",
-		"walletId",
-		"recoveryOperationId",
-		"targetDeviceId",
-		"targetAuthorityId",
-		"targetWalletAuthMethodId",
-		"authority",
-		"authMethod",
-		"target"
-	], "wallet recovery committed projection");
-	return {
-		version: Reflect.get(record, "version"),
-		kind: Reflect.get(record, "kind"),
-		storeVersion: Reflect.get(record, "storeVersion"),
-		walletId: Reflect.get(record, "walletId"),
-		recoveryOperationId: Reflect.get(record, "recoveryOperationId"),
-		targetDeviceId: Reflect.get(record, "targetDeviceId"),
-		targetAuthorityId: Reflect.get(record, "targetAuthorityId"),
-		targetWalletAuthMethodId: Reflect.get(record, "targetWalletAuthMethodId"),
-		authority: Reflect.get(record, "authority"),
-		authMethod: Reflect.get(record, "authMethod"),
-		target: Reflect.get(record, "target")
-	};
-}
-function parseWalletRecoveryPasskeyTargetWireV1(value) {
-	const record = inspectRawObject(value);
-	if (record === null) throw new Error("wallet recovery passkey target must be an object");
-	requireExactFields(record, [
-		"kind",
-		"rpId",
-		"credentialIdB64u"
-	], "wallet recovery passkey target");
-	return {
-		kind: Reflect.get(record, "kind"),
-		rpId: Reflect.get(record, "rpId"),
-		credentialIdB64u: Reflect.get(record, "credentialIdB64u")
-	};
-}
-function parseWalletRecoveryGoogleEmailOtpTargetWireV1(value) {
-	const record = inspectRawObject(value);
-	if (record === null) throw new Error("wallet recovery Google Email OTP target must be an object");
-	requireExactFields(record, [
-		"kind",
-		"provider",
-		"providerSubject",
-		"emailHashHex",
-		"registrationAuthorityId",
-		"enrollment"
-	], "wallet recovery Google Email OTP target");
-	return {
-		kind: Reflect.get(record, "kind"),
-		provider: Reflect.get(record, "provider"),
-		providerSubject: Reflect.get(record, "providerSubject"),
-		emailHashHex: Reflect.get(record, "emailHashHex"),
-		registrationAuthorityId: Reflect.get(record, "registrationAuthorityId"),
-		enrollment: Reflect.get(record, "enrollment")
-	};
-}
-function parseWalletRecoveryEmailOtpEnrollmentWireV1(value) {
-	const record = inspectRawObject(value);
-	if (record === null) throw new Error("wallet recovery Email OTP enrollment must be an object");
-	requireExactFields(record, [
-		"kind",
-		"enrollmentId",
-		"enrollmentSealKeyVersion"
-	], "wallet recovery Email OTP enrollment");
-	return {
-		kind: Reflect.get(record, "kind"),
-		enrollmentId: Reflect.get(record, "enrollmentId"),
-		enrollmentSealKeyVersion: Reflect.get(record, "enrollmentSealKeyVersion")
-	};
-}
-function inspectRawObject(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function requireExactFields(record, expected, label) {
-	const expectedSet = new Set(expected);
-	const actual = Object.keys(record);
-	if (actual.length !== expected.length || actual.some((field) => !expectedSet.has(field))) throw new Error(`${label} contains unexpected fields`);
-}
-function requireParsed(result, label) {
-	if (!result.ok) throw new Error(`${label} is invalid`);
-	return result.value;
-}
-function requireEmailHash(value) {
-	const hash = requireTrimmedString(value, "emailHashHex", "is invalid");
-	if (!/^[0-9a-f]{64}$/.test(hash)) throw new Error("emailHashHex is invalid");
-	return hash;
-}
-//#endregion
-//#region ../shared-ts/src/wallet-recovery/recoveryKeyId.ts
-/** The prefix plus unpadded base64url over one SHA-256 digest. */
-const DERIVED_WALLET_RECOVERY_KEY_ID_PATTERN = /^wallet-rkid-v1-[A-Za-z0-9_-]{43}$/;
-function parseDerivedWalletRecoveryKeyId(value, label = "recoveryKeyId") {
-	if (typeof value !== "string" || !DERIVED_WALLET_RECOVERY_KEY_ID_PATTERN.test(value)) throw new Error(`${label} must be a derived wallet recovery key id`);
-	return value;
-}
-//#endregion
-//#region ../shared-ts/src/wallet-recovery/recoveryCodeIssuance.ts
-/**
-* Mints ten codes from the platform CSPRNG.
-*
-* No id is derived here. The ceremony derives each code's id from the wallet
-* and the code bytes as it seals the wrap, so there is exactly one definition
-* of what an id is and a caller cannot supply one that names the wrong wrap.
-*/
-function issueWalletRecoveryCodes() {
-	const codes = [];
-	const codeBytes = [];
-	for (let index = 0; index < 10; index += 1) {
-		const bytes = randomCodeBytes();
-		codeBytes.push(bytes);
-		codes.push(formatEmailOtpRecoveryKey(encodeEmailOtpRecoveryKeyBytes(bytes)));
-	}
-	return {
-		codes,
-		codeBytes
-	};
-}
-/** Zeroizes the issued byte copies once the ceremony has wrapped them. */
-function zeroizeIssuedWalletRecoveryCodes(issued) {
-	for (const bytes of issued.codeBytes) bytes.fill(0);
-}
-function randomCodeBytes() {
-	const crypto = globalThis.crypto;
-	if (!crypto?.getRandomValues) throw new Error("a secure random source is required to issue wallet recovery codes");
-	return crypto.getRandomValues(new Uint8Array(20));
-}
-//#endregion
-//#region ../shared-ts/src/wallet-recovery/recoveryCodeLocator.ts
-const RECOVERY_CODE_LOCATOR_CONTEXT_V1 = "seams/wallet-recovery/code-locator/v1";
-function parseRecoveryCodeLocatorV1(value, label = "recoveryCodeLocator") {
-	try {
-		return parseDigestB64u(value);
-	} catch (error) {
-		throw new Error(`${label} ${error instanceof Error ? error.message : "must be a canonical digest"}`);
-	}
-}
-async function deriveRecoveryCodeLocatorV1FromBytes(codeBytes) {
-	if (!(codeBytes instanceof Uint8Array) || codeBytes.length !== 20) throw new Error(`recovery code bytes must be exactly 20 bytes`);
-	let tuple = null;
-	try {
-		const contextBytes = new TextEncoder().encode(RECOVERY_CODE_LOCATOR_CONTEXT_V1);
-		tuple = new Uint8Array(8 + contextBytes.length + codeBytes.length);
-		const view = new DataView(tuple.buffer);
-		view.setUint32(0, contextBytes.length, false);
-		tuple.set(contextBytes, 4);
-		view.setUint32(4 + contextBytes.length, codeBytes.length, false);
-		tuple.set(codeBytes, 8 + contextBytes.length);
-		return parseRecoveryCodeLocatorV1(base64UrlEncode(await sha256Bytes(tuple)));
-	} finally {
-		tuple?.fill(0);
-	}
-}
-//#endregion
-//#region ../shared-ts/src/wallet-recovery/walletRecoveryEnvelopeSet.ts
-function buildWalletCustodySeedRecoveryEntry(args) {
-	return {
-		custodySecretKind: "wallet_custody_seed_v1",
-		nonceB64u: args.nonceB64u,
-		wrappedCustodySecretB64u: args.wrappedCustodySecretB64u,
-		aadHashB64u: args.aadHashB64u
-	};
-}
-/**
-* Parses the worker's factor-neutral rotation projection at the request
-* boundary. It deliberately accepts no lifecycle or timestamp fields; those
-* are server-owned and are added only while replacing the durable set.
-*/
-function parseWalletRecoverySetRotationWireV1(raw, options) {
-	const label = options.label || "walletRecoverySetRotation";
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, ROTATION_SET_FIELDS, label);
-	const walletId = parseWalletId(record.walletId);
-	if (!walletId.ok) throw new Error(`${label}.walletId ${walletId.error.message}`);
-	if (String(walletId.value) !== String(options.expectedWalletId)) throw new Error(`${label}.walletId is outside the authenticated wallet`);
-	if (!Array.isArray(record.manifestKekWraps)) throw new Error(`${label}.manifestKekWraps must be an array`);
-	if (record.manifestKekWraps.length !== 10) throw new Error(`${label}.manifestKekWraps must carry exactly 10 recovery-code wraps`);
-	const manifestKekWraps = record.manifestKekWraps.map((rawWrap, index) => {
-		const wrap = requireRecord(rawWrap, `${label}.manifestKekWraps[${index}]`);
-		rejectUnknownFields(wrap, ROTATION_WRAP_FIELDS, `${label}.manifestKekWraps[${index}]`);
-		return {
-			recoveryKeyId: parseDerivedWalletRecoveryKeyId(wrap.recoveryKeyId, `${label}.manifestKekWraps[${index}].recoveryKeyId`),
-			nonceB64u: parseEnvelopeNonceB64u(wrap.nonceB64u, `${label}.manifestKekWraps[${index}].nonceB64u`),
-			ciphertextB64u: parseEnvelopeCiphertextB64u(wrap.ciphertextB64u, `${label}.manifestKekWraps[${index}].ciphertextB64u`),
-			aadHashB64u: parseDigestField(wrap.aadHashB64u, `${label}.manifestKekWraps[${index}].aadHashB64u`)
-		};
-	});
-	const seen = /* @__PURE__ */ new Set();
-	for (const wrap of manifestKekWraps) {
-		const id = String(wrap.recoveryKeyId);
-		if (!seen.add(id)) throw new Error(`${label} contains duplicate recovery key ids`);
-	}
-	if (!Array.isArray(record.entries) || record.entries.length !== 1) throw new Error(`${label}.entries must carry exactly one wallet custody seed entry`);
-	const entry = parseWalletRecoveryEnvelopeEntry(record.entries[0], `${label}.entries[0]`);
-	return {
-		walletId: walletId.value,
-		manifestKekWraps,
-		entry
-	};
-}
-const RECOVERY_ENTRY_FIELDS = [
-	"custodySecretKind",
-	"nonceB64u",
-	"wrappedCustodySecretB64u",
-	"aadHashB64u"
-];
-const ROTATION_WRAP_FIELDS = [
-	"recoveryKeyId",
-	"nonceB64u",
-	"ciphertextB64u",
-	"aadHashB64u"
-];
-const ROTATION_SET_FIELDS = [
-	"walletId",
-	"manifestKekWraps",
-	"entries"
-];
-function parseWalletRecoveryEnvelopeEntry(raw, label) {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, RECOVERY_ENTRY_FIELDS, label);
-	if (record.custodySecretKind !== "wallet_custody_seed_v1") throw new Error(`${label}.custodySecretKind must be wallet_custody_seed_v1; lane holder shares are reprovisioned, not recovered`);
-	return buildWalletCustodySeedRecoveryEntry({
-		nonceB64u: parseEnvelopeNonceB64u(record.nonceB64u, `${label}.nonceB64u`),
-		wrappedCustodySecretB64u: parseEnvelopeCiphertextB64u(record.wrappedCustodySecretB64u, `${label}.wrappedCustodySecretB64u`),
-		aadHashB64u: parseDigestField(record.aadHashB64u, `${label}.aadHashB64u`)
-	});
-}
-//#endregion
-//#region ../shared-ts/src/wallet-recovery/walletRecoveryRotation.ts
-function rotationRecord(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function rotationString(value, label) {
-	const parsed = typeof value === "string" ? value.trim() : "";
-	if (!parsed) throw new Error(`${label} is required`);
-	return parsed;
-}
-function parseWalletRecoverySetRotationWorkerResultV1(value) {
-	const result = rotationRecord(value, "rotation worker result");
-	if (!Array.isArray(result.recoveryManifestKekWraps) || result.recoveryManifestKekWraps.length !== 10) throw new Error(`rotation worker result must contain exactly 10 recovery wraps`);
-	return {
-		walletId: rotationString(result.walletId, "rotation worker walletId"),
-		recoveryManifestKekWraps: result.recoveryManifestKekWraps.map((raw, index) => {
-			const wrap = rotationRecord(raw, `rotation worker wrap ${index}`);
-			return {
-				recoveryKeyId: rotationString(wrap.recoveryKeyId, `rotation worker wrap ${index} recoveryKeyId`),
-				nonceB64u: rotationString(wrap.nonceB64u, `rotation worker wrap ${index} nonceB64u`),
-				ciphertextB64u: rotationString(wrap.ciphertextB64u, `rotation worker wrap ${index} ciphertextB64u`),
-				aadHashB64u: rotationString(wrap.aadHashB64u, `rotation worker wrap ${index} aadHashB64u`)
-			};
-		}),
-		recoveryEntryNonceB64u: rotationString(result.recoveryEntryNonceB64u, "rotation worker recoveryEntryNonceB64u"),
-		recoveryEntryCiphertextB64u: rotationString(result.recoveryEntryCiphertextB64u, "rotation worker recoveryEntryCiphertextB64u"),
-		recoveryEntryAadHashB64u: rotationString(result.recoveryEntryAadHashB64u, "rotation worker recoveryEntryAadHashB64u")
-	};
-}
-/** Projects the Rust/WASM result into the server's full-set wire shape. */
-function walletRecoverySetRotationWireFromWorkerResultV1(value) {
-	const result = parseWalletRecoverySetRotationWorkerResultV1(value);
-	const walletId = parseWalletId(result.walletId);
-	if (!walletId.ok) throw new Error(`rotation worker wallet id is invalid: ${walletId.error.message}`);
-	const entry = {
-		custodySecretKind: "wallet_custody_seed_v1",
-		nonceB64u: parseEnvelopeNonceB64u(result.recoveryEntryNonceB64u, "rotation.entry.nonceB64u"),
-		wrappedCustodySecretB64u: parseEnvelopeCiphertextB64u(result.recoveryEntryCiphertextB64u, "rotation.entry.wrappedCustodySecretB64u"),
-		aadHashB64u: parseDigestField(result.recoveryEntryAadHashB64u, "rotation.entry.aadHashB64u")
-	};
-	return parseWalletRecoverySetRotationWireV1({
-		walletId: walletId.value,
-		manifestKekWraps: result.recoveryManifestKekWraps.map((wrap) => ({
-			recoveryKeyId: parseDerivedWalletRecoveryKeyId(wrap.recoveryKeyId, "rotation.recoveryKeyId"),
-			nonceB64u: parseEnvelopeNonceB64u(wrap.nonceB64u, "rotation.wrap.nonceB64u"),
-			ciphertextB64u: parseEnvelopeCiphertextB64u(wrap.ciphertextB64u, "rotation.wrap.ciphertextB64u"),
-			aadHashB64u: parseDigestField(wrap.aadHashB64u, "rotation.wrap.aadHashB64u")
-		})),
-		entries: [entry]
-	}, {
-		expectedWalletId: walletId.value,
-		label: "rotation.workerResult"
-	});
-}
-//#endregion
-//#region ../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.ts
-const POSSESSION_CHALLENGE_DOMAIN_V1 = "seams/wallet-recovery/ecdsa-existing-material-possession/v1";
-const POSSESSION_PROOF_SCHEME_V1 = "secp256k1_bip340_sha256_v1";
-function requireExactKeys(record, label, keys) {
-	const allowed = new Set(keys);
-	for (const key of Object.keys(record)) if (!allowed.has(key)) throw new Error(`${label}.${key} is not a supported field`);
-	for (const key of keys) if (!Object.hasOwn(record, key)) throw new Error(`${label}.${key} is required`);
-}
-function requireVisibleIdentifier(value, label) {
-	if (typeof value !== "string" || value.length === 0 || value.trim() !== value) throw new Error(`${label} must be a non-empty canonical identifier`);
-	for (let index = 0; index < value.length; index += 1) {
-		const code = value.charCodeAt(index);
-		if (code < 33 || code > 126) throw new Error(`${label} must contain visible ASCII bytes`);
-	}
-	return value;
-}
-function isEcdsaKeySetId(value) {
-	return value.startsWith("evm_family_ecdsa:") && value.length > 17;
-}
-function requireEcdsaKeySetId(value, label) {
-	const keySetId = requireVisibleIdentifier(value, label);
-	if (!isEcdsaKeySetId(keySetId)) throw new Error(`${label} must identify an ECDSA key set`);
-	return keySetId;
-}
-function requireDigest(value, label) {
-	try {
-		return parseDigestB64u(value);
-	} catch {
-		throw new Error(`${label} must be canonical base64url for 32 bytes`);
-	}
-}
-function requireCompressedPublicKey(value, label) {
-	if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(`${label} must be canonical base64url`);
-	let bytes;
-	try {
-		bytes = base64UrlDecode(value);
-	} catch {
-		throw new Error(`${label} must be valid base64url`);
-	}
-	if (bytes.length !== 33 || bytes[0] !== 2 && bytes[0] !== 3 || base64UrlEncode(bytes) !== value) throw new Error(`${label} must be canonical compressed secp256k1 public key bytes`);
-	return value;
-}
-function requirePositiveSafeInteger(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
-	return value;
-}
-function requireSignature64(value, label) {
-	if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(`${label} must be canonical base64url`);
-	let bytes;
-	try {
-		bytes = base64UrlDecode(value);
-	} catch {
-		throw new Error(`${label} must be valid base64url`);
-	}
-	if (bytes.length !== 64 || base64UrlEncode(bytes) !== value) throw new Error(`${label} must be canonical base64url for 64 bytes`);
-	return value;
-}
-function parseWalletRecoveryEcdsaPossessionChallengeV1(value) {
-	const record = requireRecord(value, "walletRecoveryEcdsaPossessionChallenge");
-	requireExactKeys(record, "walletRecoveryEcdsaPossessionChallenge", [
-		"kind",
-		"walletId",
-		"reservationId",
-		"replacementId",
-		"keySetId",
-		"keyHandle",
-		"recordedKeyManifestDigestB64u",
-		"publicCapabilityDigestB64u",
-		"authorityRefDigestB64u",
-		"derivationClientSharePublicKey33B64u",
-		"expectedServerGeneration",
-		"expiresAtMs",
-		"serverNonceB64u"
-	]);
-	if (record.kind !== "wallet_recovery_ecdsa_possession_challenge_v1") throw new Error("walletRecoveryEcdsaPossessionChallenge.kind is invalid");
-	const keySetId = requireEcdsaKeySetId(record.keySetId, "walletRecoveryEcdsaPossessionChallenge.keySetId");
-	return {
-		kind: "wallet_recovery_ecdsa_possession_challenge_v1",
-		walletId: requireVisibleIdentifier(record.walletId, "walletRecoveryEcdsaPossessionChallenge.walletId"),
-		reservationId: requireVisibleIdentifier(record.reservationId, "walletRecoveryEcdsaPossessionChallenge.reservationId"),
-		replacementId: requireVisibleIdentifier(record.replacementId, "walletRecoveryEcdsaPossessionChallenge.replacementId"),
-		keySetId,
-		keyHandle: requireVisibleIdentifier(record.keyHandle, "walletRecoveryEcdsaPossessionChallenge.keyHandle"),
-		recordedKeyManifestDigestB64u: requireDigest(record.recordedKeyManifestDigestB64u, "walletRecoveryEcdsaPossessionChallenge.recordedKeyManifestDigestB64u"),
-		publicCapabilityDigestB64u: requireDigest(record.publicCapabilityDigestB64u, "walletRecoveryEcdsaPossessionChallenge.publicCapabilityDigestB64u"),
-		authorityRefDigestB64u: requireDigest(record.authorityRefDigestB64u, "walletRecoveryEcdsaPossessionChallenge.authorityRefDigestB64u"),
-		derivationClientSharePublicKey33B64u: requireCompressedPublicKey(record.derivationClientSharePublicKey33B64u, "walletRecoveryEcdsaPossessionChallenge.derivationClientSharePublicKey33B64u"),
-		expectedServerGeneration: requireVisibleIdentifier(record.expectedServerGeneration, "walletRecoveryEcdsaPossessionChallenge.expectedServerGeneration"),
-		expiresAtMs: requirePositiveSafeInteger(record.expiresAtMs, "walletRecoveryEcdsaPossessionChallenge.expiresAtMs"),
-		serverNonceB64u: requireDigest(record.serverNonceB64u, "walletRecoveryEcdsaPossessionChallenge.serverNonceB64u")
-	};
-}
-function parseWalletRecoveryEcdsaPossessionProofV1(value) {
-	const record = requireRecord(value, "walletRecoveryEcdsaPossessionProof");
-	requireExactKeys(record, "walletRecoveryEcdsaPossessionProof", [
-		"kind",
-		"scheme",
-		"signature64B64u"
-	]);
-	if (record.kind !== "wallet_recovery_ecdsa_possession_proof_v1") throw new Error("walletRecoveryEcdsaPossessionProof.kind is invalid");
-	if (record.scheme !== POSSESSION_PROOF_SCHEME_V1) throw new Error("walletRecoveryEcdsaPossessionProof.scheme is invalid");
-	return {
-		kind: "wallet_recovery_ecdsa_possession_proof_v1",
-		scheme: POSSESSION_PROOF_SCHEME_V1,
-		signature64B64u: requireSignature64(record.signature64B64u, "walletRecoveryEcdsaPossessionProof.signature64B64u")
-	};
-}
-function walletRecoveryEcdsaPossessionChallengeCanonicalBytesV1(challenge) {
-	const parsed = parseWalletRecoveryEcdsaPossessionChallengeV1(challenge);
-	const fields = [
-		POSSESSION_CHALLENGE_DOMAIN_V1,
-		POSSESSION_PROOF_SCHEME_V1,
-		parsed.walletId,
-		parsed.reservationId,
-		parsed.replacementId,
-		parsed.keySetId,
-		parsed.keyHandle,
-		base64UrlDecode(parsed.recordedKeyManifestDigestB64u),
-		base64UrlDecode(parsed.publicCapabilityDigestB64u),
-		base64UrlDecode(parsed.authorityRefDigestB64u),
-		base64UrlDecode(parsed.derivationClientSharePublicKey33B64u),
-		parsed.expectedServerGeneration,
-		base64UrlDecode(parsed.serverNonceB64u),
-		expiryBytes(parsed.expiresAtMs)
-	];
-	const output = [];
-	for (const field of fields) {
-		const bytes = typeof field === "string" ? new TextEncoder().encode(field) : field;
-		const length = bytes.length;
-		if (length > 4294967295) throw new Error("wallet recovery possession field is too large");
-		output.push(length >>> 24 & 255, length >>> 16 & 255, length >>> 8 & 255, length & 255, ...bytes);
-	}
-	return Uint8Array.from(output);
-}
-function expiryBytes(value) {
-	let remaining = BigInt(value);
-	const bytes = new Uint8Array(8);
-	for (let index = bytes.length - 1; index >= 0; index -= 1) {
-		bytes[index] = Number(remaining & 255n);
-		remaining >>= 8n;
-	}
-	return bytes;
-}
-async function walletRecoveryEcdsaPossessionChallengeDigestB64uV1(challenge) {
-	return sha256DigestB64u(walletRecoveryEcdsaPossessionChallengeCanonicalBytesV1(challenge));
-}
-//#endregion
-export { SEAMS_WALLET_INDEXES as _, parseWalletRecoveryEnvelopeEntry as a, zeroizeIssuedWalletRecoveryCodes as c, deriveWalletRecoveryKeyLifecycleId as d, parseRecoveryCodeReservationId as f, SEAMS_WALLET_DB_NAME as g, seamsWalletDB as h, walletRecoverySetRotationWireFromWorkerResultV1 as i, buildWalletRecoveryCommittedProjectionV1 as l, decodeEmailOtpRecoveryKey as m, parseWalletRecoveryEcdsaPossessionProofV1 as n, deriveRecoveryCodeLocatorV1FromBytes as o, buildEmailOtpRecoveryCodeSet as p, walletRecoveryEcdsaPossessionChallengeDigestB64uV1 as r, issueWalletRecoveryCodes as s, parseWalletRecoveryEcdsaPossessionChallengeV1 as t, parseWalletRecoveryCommittedProjectionV1 as u, SEAMS_WALLET_STORES as v, unwrap as y };