@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js

@@ -1,258 +0,0 @@
-import { parseCapabilityInstanceRef, parseWalletAuthMethodId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
-import { parseUnixMs } from "../../../shared-ts/src/passkey-custody/primitives.js";
-import { isWalletCustodySeedBinding } from "../../../shared-ts/src/passkey-custody/custodySecretBinding.js";
-import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../../../shared-ts/src/passkey-custody/index.js";
-import { requestWalletCustodyCeremonyOperation } from "./ceremonyStepRunner.js";
-//#region src/core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.ts
-let currentCapability = null;
-let currentCapabilityTransport = null;
-let currentCapabilityExpiryTimer = null;
-let currentUpgradedEnvelopeSink = null;
-function setUnlockedCustodyEnvelopeUpgradeSinkV1(sink) {
-	currentUpgradedEnvelopeSink = sink;
-}
-/**
-* Hands a returned upgrade to the sink, and never lets it affect the unlock.
-*
-* An invalid optional upgrade is dropped by the worker-response parser. A
-* missing sink or throwing sink leaves the stored V2 row standing and the
-* wallet working; the next unlock reseals and tries again.
-*/
-function forwardUpgradedEnvelope(capability) {
-	const sink = currentUpgradedEnvelopeSink;
-	if (!sink) return;
-	if (capability.kind !== "unlocked_wallet_ed25519_export_root_capability_v1") return;
-	const upgraded = capability.upgradedEnvelope;
-	if (upgraded === void 0) return;
-	try {
-		sink({
-			walletId: capability.walletId,
-			walletAuthMethodId: capability.walletAuthMethodId,
-			walletSessionId: capability.walletSessionId,
-			envelope: upgraded
-		});
-	} catch (error) {
-		console.warn("[walletCustody] the upgraded custody envelope was not forwarded:", error instanceof Error ? error.message : String(error || "unknown error"));
-	}
-}
-const MAX_EXPIRY_TIMER_DELAY_MS = 2147483647;
-function walletCustodyCeremonyTransportFromWorkerContextV1(workerContext) {
-	return { requestOperation: requestWalletCustodyCeremonyOperation.bind(void 0, workerContext) };
-}
-function clearCurrentCapabilityExpiryTimer() {
-	if (currentCapabilityExpiryTimer === null) return;
-	clearTimeout(currentCapabilityExpiryTimer);
-	currentCapabilityExpiryTimer = null;
-}
-function clearCurrentCapabilityReference() {
-	clearCurrentCapabilityExpiryTimer();
-	currentCapability = null;
-	currentCapabilityTransport = null;
-}
-function scheduleCurrentCapabilityExpiry(capability, transport) {
-	clearCurrentCapabilityExpiryTimer();
-	const delayMs = Math.max(0, capability.expiresAtMs - Date.now());
-	currentCapabilityExpiryTimer = setTimeout(() => {
-		currentCapabilityExpiryTimer = null;
-		if (currentCapability !== capability || currentCapabilityTransport !== transport) return;
-		if (capability.expiresAtMs > Date.now()) {
-			scheduleCurrentCapabilityExpiry(capability, transport);
-			return;
-		}
-		destroyUnlockedWalletEd25519ExportRootCapabilitiesV1(transport, {
-			kind: "capability",
-			capabilityHandleId: capability.capabilityHandleId
-		});
-	}, Math.min(delayMs, MAX_EXPIRY_TIMER_DELAY_MS));
-}
-function parseCapabilityReference(value) {
-	if (!isPlainObject(value)) return null;
-	if (value.kind === "unlocked_linked_device_ed25519_client_root_capability_v1") return parseLinkedDeviceClientRootCapabilityReference(value);
-	const fields = Object.keys(value);
-	const hasUpgradedEnvelope = fields.includes("upgradedEnvelope");
-	const expectedFields = hasUpgradedEnvelope ? [
-		"kind",
-		"capabilityHandleId",
-		"walletId",
-		"walletAuthMethodId",
-		"walletSessionId",
-		"expiresAtMs",
-		"upgradedEnvelope"
-	] : [
-		"kind",
-		"capabilityHandleId",
-		"walletId",
-		"walletAuthMethodId",
-		"walletSessionId",
-		"expiresAtMs"
-	];
-	if (fields.length !== expectedFields.length || fields.some((field) => !expectedFields.includes(field))) return null;
-	if (value.kind !== "unlocked_wallet_ed25519_export_root_capability_v1") return null;
-	const capabilityHandleId = parseCapabilityInstanceRef(value.capabilityHandleId);
-	const walletId = parseWalletId(value.walletId);
-	const walletAuthMethodId = parseWalletAuthMethodId(value.walletAuthMethodId);
-	const walletSessionId = parseWalletSessionId(value.walletSessionId);
-	if (!capabilityHandleId.ok || !walletId.ok || !walletAuthMethodId.ok || !walletSessionId.ok) return null;
-	let expiresAtMs;
-	try {
-		expiresAtMs = parseUnixMs(value.expiresAtMs, "unlocked Ed25519 export-root capability expiry");
-	} catch {
-		return null;
-	}
-	let upgradedEnvelope;
-	if (hasUpgradedEnvelope) try {
-		upgradedEnvelope = parsePasskeyCustodyEnvelopeRecord(value.upgradedEnvelope);
-	} catch {}
-	return {
-		kind: "unlocked_wallet_ed25519_export_root_capability_v1",
-		capabilityHandleId: capabilityHandleId.value,
-		walletId: walletId.value,
-		walletAuthMethodId: walletAuthMethodId.value,
-		walletSessionId: walletSessionId.value,
-		expiresAtMs,
-		...upgradedEnvelope ? { upgradedEnvelope } : {}
-	};
-}
-/** A linked device's reference: the same public facts, no envelope upgrade. */
-function parseLinkedDeviceClientRootCapabilityReference(value) {
-	const expectedFields = [
-		"kind",
-		"capabilityHandleId",
-		"walletId",
-		"walletAuthMethodId",
-		"walletSessionId",
-		"expiresAtMs"
-	];
-	const fields = Object.keys(value);
-	if (fields.length !== expectedFields.length || fields.some((field) => !expectedFields.includes(field))) return null;
-	const capabilityHandleId = parseCapabilityInstanceRef(value.capabilityHandleId);
-	const walletId = parseWalletId(value.walletId);
-	const walletAuthMethodId = parseWalletAuthMethodId(value.walletAuthMethodId);
-	const walletSessionId = parseWalletSessionId(value.walletSessionId);
-	if (!capabilityHandleId.ok || !walletId.ok || !walletAuthMethodId.ok || !walletSessionId.ok) return null;
-	let expiresAtMs;
-	try {
-		expiresAtMs = parseUnixMs(value.expiresAtMs, "unlocked Ed25519 Client-root capability expiry");
-	} catch {
-		return null;
-	}
-	return {
-		kind: "unlocked_linked_device_ed25519_client_root_capability_v1",
-		capabilityHandleId: capabilityHandleId.value,
-		walletId: walletId.value,
-		walletAuthMethodId: walletAuthMethodId.value,
-		walletSessionId: walletSessionId.value,
-		expiresAtMs
-	};
-}
-/**
-* Opens this device's own custody envelope inside the worker with the factor
-* secret already present in the calling operation, and records the returned
-* reference as the current capability. A wallet custody seed yields the
-* seed-backed capability; a linked device's Client-root envelope yields the
-* linked-device capability, which only linking accepts.
-* The caller still owns `existingFactorSecret` and zeroes it; the worker zeroes
-* its own copy.
-*
-* Call only after the owner Wallet Session named here is active. Establishing
-* adds no authenticator or OTP interaction.
-*/
-async function establishUnlockedWalletEd25519ExportRootCapabilityV1(transport, input) {
-	const binding = input.existingEnvelope.binding;
-	if (!isWalletCustodySeedBinding(binding) && binding.kind !== "ed25519_yao_client_root_v1") return;
-	const workerFactorSecret = input.existingFactorSecret.slice();
-	let established;
-	try {
-		established = await transport.requestOperation({
-			kind: "walletCustodyCeremony",
-			request: {
-				type: "establishUnlockedWalletEd25519ExportRootCapability",
-				payload: {
-					existingEnvelope: input.existingEnvelope,
-					existingFactorSecret: workerFactorSecret.buffer,
-					walletId: input.walletId,
-					walletAuthMethodId: input.walletAuthMethodId,
-					walletSessionId: input.walletSessionId,
-					expiresAtMs: input.expiresAtMs
-				},
-				transfer: [workerFactorSecret.buffer]
-			}
-		});
-	} finally {
-		if (workerFactorSecret.byteLength > 0) workerFactorSecret.fill(0);
-	}
-	const capability = parseCapabilityReference(established);
-	if (capability === null) throw new Error("unlocked Ed25519 export-root capability worker returned no reference");
-	clearCurrentCapabilityExpiryTimer();
-	currentCapability = capability;
-	currentCapabilityTransport = transport;
-	scheduleCurrentCapabilityExpiry(capability, transport);
-	forwardUpgradedEnvelope(capability);
-	return capability;
-}
-/**
-* The current seed-backed capability for this exact wallet, or undefined when
-* the wallet has none — never a prompt, and never a stale or expired
-* reference. A linked device's Client-root capability is never returned here:
-* seed reseals and auth-method additions cannot use it.
-*/
-function readUnlockedWalletEd25519ExportRootCapabilityV1(walletId) {
-	const capability = readUnlockedEd25519ExportRootLinkingCapabilityV1(walletId);
-	return capability?.kind === "unlocked_wallet_ed25519_export_root_capability_v1" ? capability : void 0;
-}
-/**
-* The current capability a device approving a link seals the export root
-* from, of either kind, for this exact wallet — never a prompt, and never a
-* stale or expired reference.
-*/
-function readUnlockedEd25519ExportRootLinkingCapabilityV1(walletId) {
-	const capability = currentCapability;
-	if (!capability) return void 0;
-	if (capability.walletId !== walletId) return void 0;
-	if (capability.expiresAtMs <= Date.now()) {
-		const transport = currentCapabilityTransport;
-		if (transport) destroyUnlockedWalletEd25519ExportRootCapabilitiesV1(transport, {
-			kind: "capability",
-			capabilityHandleId: capability.capabilityHandleId
-		});
-		else clearCurrentCapabilityReference();
-		return;
-	}
-	return capability;
-}
-/**
-* Drops the local reference without a worker round-trip. This is the
-* worker-reset path: a terminated worker has already lost its handle memory,
-* and holding a reference to it would let the linking preflight pass against a
-* handle that no longer exists.
-*/
-function dropUnlockedWalletEd25519ExportRootCapabilityReferenceV1() {
-	clearCurrentCapabilityReference();
-}
-/**
-* Destroys worker-held capabilities in the given scope and drops the local
-* reference when it falls inside that scope. Failures to reach the worker are
-* absorbed after dropping the local reference: a torn-down or resetting worker
-* has already lost its handle memory, which is the destruction this call
-* wants.
-*/
-async function destroyUnlockedWalletEd25519ExportRootCapabilitiesV1(transport, scope) {
-	const capability = currentCapability;
-	if (capability !== null && (scope.kind === "all" || scope.kind === "capability" && scope.capabilityHandleId === capability.capabilityHandleId || scope.kind === "wallet" && scope.walletId === capability.walletId || scope.kind === "wallet_session" && scope.walletSessionId === capability.walletSessionId)) clearCurrentCapabilityReference();
-	try {
-		await transport.requestOperation({
-			kind: "walletCustodyCeremony",
-			request: {
-				type: "destroyUnlockedWalletEd25519ExportRootCapabilities",
-				payload: { scope }
-			}
-		});
-	} catch {}
-}
-//#endregion
-export { destroyUnlockedWalletEd25519ExportRootCapabilitiesV1, dropUnlockedWalletEd25519ExportRootCapabilityReferenceV1, establishUnlockedWalletEd25519ExportRootCapabilityV1, readUnlockedEd25519ExportRootLinkingCapabilityV1, readUnlockedWalletEd25519ExportRootCapabilityV1, setUnlockedCustodyEnvelopeUpgradeSinkV1, walletCustodyCeremonyTransportFromWorkerContextV1 };
-
-//# sourceMappingURL=unlockedEd25519ExportRootCapability.js.map

package/dist/esm/core/signingEngine/walletCustody/walletRecoveryCredential.js

@@ -1,23 +0,0 @@
-import { parseWebAuthnCredentialIdB64u } from "../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-//#region src/core/signingEngine/walletCustody/walletRecoveryCredential.ts
-function recoveryFactorSecret(registration) {
-	const first = registration.clientExtensionResults.prf?.results?.first;
-	if (typeof first !== "string" || !first) throw new Error("the replacement passkey returned no wallet-custody PRF output");
-	const secret = base64UrlDecode(first);
-	if (secret.length !== 32) throw new Error("the replacement passkey returned an invalid wallet-custody PRF output");
-	return Uint8Array.from(secret).buffer;
-}
-function walletRecoveryReplacementCredentialFromRegistrationV1(registration) {
-	const credentialId = parseWebAuthnCredentialIdB64u(String(registration.rawId || registration.id || "").trim());
-	if (!credentialId.ok) throw new Error(`replacement passkey credential id ${credentialId.error.message}`);
-	return {
-		registration,
-		credentialIdB64u: credentialId.value,
-		factorSecret: recoveryFactorSecret(registration)
-	};
-}
-//#endregion
-export { walletRecoveryReplacementCredentialFromRegistrationV1 };
-
-//# sourceMappingURL=walletRecoveryCredential.js.map

package/dist/esm/core/signingEngine/walletCustody/walletRecoveryEcdsa.js

@@ -1,75 +0,0 @@
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import { sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { signWalletRecoveryEcdsaMaterialPossessionProofWasm } from "../threshold/crypto/ecdsaDerivationClientWasm.js";
-import { parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbServerIdentityV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { parseWalletRecoveryEcdsaPossessionChallengeV1, walletRecoveryEcdsaPossessionChallengeDigestB64uV1 } from "../../../shared-ts/src/wallet-recovery/walletRecoveryEcdsaPossession.js";
-//#region src/core/signingEngine/walletCustody/walletRecoveryEcdsa.ts
-function ethereumAddressFromAddress20B64u(value) {
-	const address = base64UrlDecode(value);
-	if (address.length !== 20) throw new Error("wallet recovery ECDSA identity has an invalid address");
-	return `0x${Array.from(address, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
-}
-function requireCurrentActivationMatchesCapability(input) {
-	const activation = input.activationReceipt.ecdsa_activation;
-	if (activation.context.application_binding_digest_b64u !== input.publicCapability.context.application_binding_digest_b64u || !sameRouterAbEcdsaDerivationPublicIdentityV1(activation.public_identity, input.publicCapability.public_identity) || !sameRouterAbServerIdentityV1(activation.signing_worker, input.publicCapability.signer_set.selected_server) || !sameRouterAbMpcMaterialActivationRef(activation.material_activation, input.publicCapability.material_activation) || activation.activation_epoch !== input.publicCapability.activation_epoch || input.activationReceipt.server_generation !== input.serverGeneration) throw new Error("wallet recovery ECDSA activation changed its registered capability");
-}
-function requirePossessionChallengeMatchesEntry(input) {
-	const identity = input.publicCapability.public_identity;
-	if (input.challenge.walletId !== input.walletId || input.challenge.reservationId !== input.reservationId || input.challenge.replacementId !== input.replacementId || input.challenge.keySetId !== input.entry.keySetId || input.challenge.keyHandle !== input.entry.keyHandle || input.challenge.recordedKeyManifestDigestB64u !== input.entry.recordedKeyManifestDigestB64u || input.challenge.expectedServerGeneration !== String(input.entry.recoveryBasis.serverGeneration) || input.challenge.derivationClientSharePublicKey33B64u !== identity.derivation_client_share_public_key33_b64u) throw new Error("wallet recovery ECDSA possession challenge changed its registered identity");
-}
-function requireRecoveredPublicFactsMatch(input) {
-	const identity = input.publicCapability.public_identity;
-	if (input.publicFacts.contextBinding32B64u !== identity.context_binding_b64u || input.publicFacts.derivationClientSharePublicKey33B64u !== identity.derivation_client_share_public_key33_b64u || input.publicFacts.clientVerifyingShare33B64u !== identity.derivation_client_share_public_key33_b64u || input.publicFacts.relayerPublicKey33B64u !== identity.server_public_key33_b64u || input.publicFacts.groupPublicKey33B64u !== identity.threshold_public_key33_b64u || input.publicFacts.clientShareRetryCounter !== identity.client_share_retry_counter || input.publicFacts.relayerShareRetryCounter !== identity.server_share_retry_counter || input.publicFacts.ethereumAddress !== ethereumAddressFromAddress20B64u(identity.ethereum_address20_b64u)) throw new Error("wallet recovery ECDSA custody public facts changed the capability");
-}
-function readyStateBlobFromRecoveryOutput(stateBlobB64u) {
-	const stateBlob = stateBlobB64u.trim();
-	if (!stateBlob) throw new Error("wallet recovery ECDSA returned no ready state blob");
-	return {
-		kind: "ecdsa_role_local_state_blob_v1",
-		curve: "secp256k1",
-		encoding: "base64url",
-		producer: "signer_core",
-		stateBlobB64u: stateBlob
-	};
-}
-async function signRecoveredWalletCustodyEcdsa(input) {
-	const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(input.entry.recoveryBasis.publicCapability);
-	const activationReceipt = parseRouterAbEcdsaRegistrationActivationReceiptV1(input.entry.recoveryBasis.activationReceipt);
-	requireCurrentActivationMatchesCapability({
-		activationReceipt,
-		publicCapability,
-		serverGeneration: String(input.entry.recoveryBasis.serverGeneration)
-	});
-	const challenge = parseWalletRecoveryEcdsaPossessionChallengeV1(input.entry.recoveryBasis.possessionChallenge);
-	requirePossessionChallengeMatchesEntry({
-		challenge,
-		entry: input.entry,
-		walletId: input.walletId,
-		reservationId: input.reservationId,
-		replacementId: input.replacementId,
-		publicCapability
-	});
-	const publicCapabilityDigestB64u = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(publicCapability)));
-	if (challenge.publicCapabilityDigestB64u !== publicCapabilityDigestB64u) throw new Error("wallet recovery ECDSA possession challenge changed the capability digest");
-	requireRecoveredPublicFactsMatch({
-		publicFacts: input.publicFacts,
-		publicCapability
-	});
-	const signed = await signWalletRecoveryEcdsaMaterialPossessionProofWasm({
-		workerCtx: input.workerCtx,
-		challenge,
-		stateBlob: readyStateBlobFromRecoveryOutput(input.readyStateBlobB64u)
-	});
-	const challengeDigestB64u = await walletRecoveryEcdsaPossessionChallengeDigestB64uV1(challenge);
-	if (signed.challengeDigestB64u !== challengeDigestB64u || signed.derivationClientSharePublicKey33B64u !== challenge.derivationClientSharePublicKey33B64u) throw new Error("wallet recovery ECDSA possession proof changed its challenge binding");
-	return {
-		activationReceipt,
-		publicCapability,
-		possessionProof: signed.proof
-	};
-}
-//#endregion
-export { signRecoveredWalletCustodyEcdsa };
-
-//# sourceMappingURL=walletRecoveryEcdsa.js.map

package/dist/esm/core/signingEngine/walletCustody/walletRecoveryEd25519.js

@@ -1,129 +0,0 @@
-import { buildMpcMaterialActivationRef, parseMpcLifecycleBindingRef, parseMpcMaterialActivationId } from "../../../shared-ts/src/utils/domainIds.js";
-import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
-import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { deriveWalletRecoveryKeyLifecycleId, parseRecoveryCodeReservationId } from "../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
-//#region src/core/signingEngine/walletCustody/walletRecoveryEd25519.ts
-async function buildEd25519RecoveryAdmissionRequestV1(input) {
-	const currentActivation = routerAbMpcMaterialActivationRefFromWire(input.currentScope.material_activation);
-	const activationId = parseMpcMaterialActivationId(secureRandomId("wallet-recovery-ed25519-material-activation", 32, "wallet recovery Ed25519 activation identities"));
-	const lifecycleBinding = parseMpcLifecycleBindingRef(`${input.lifecycleId}:material-activation`);
-	if (!activationId.ok || !lifecycleBinding.ok) throw new Error("wallet recovery Ed25519 material activation identity is invalid");
-	const materialActivation = buildMpcMaterialActivationRef({
-		activationId: activationId.value,
-		capability: currentActivation.capability,
-		materialOwner: currentActivation.materialOwner,
-		keyBinding: currentActivation.keyBinding,
-		lifecycleBinding: lifecycleBinding.value,
-		signingWorker: currentActivation.signingWorker
-	});
-	const replacementCapabilityBinding = new Uint8Array(32);
-	globalThis.crypto.getRandomValues(replacementCapabilityBinding);
-	try {
-		return requireParsed(parseRouterAbEd25519YaoRecoveryAdmissionRequestV1({
-			scope: {
-				lifecycle_id: input.lifecycleId,
-				root_share_epoch: input.currentScope.root_share_epoch,
-				account_id: input.currentScope.account_id,
-				threshold_session_id: input.thresholdSessionId,
-				signer_set_id: input.currentScope.signer_set_id,
-				signing_worker_id: input.currentScope.signing_worker_id,
-				material_activation: routerAbMpcMaterialActivationRefToWire(materialActivation)
-			},
-			active_material_activation: input.currentScope.material_activation,
-			application_binding: input.applicationBinding,
-			participant_ids: input.participantIds,
-			active_capability_binding: input.activeCapabilityBinding,
-			replacement_capability_binding: [...replacementCapabilityBinding],
-			registered_public_key: input.registeredPublicKey
-		}), "wallet recovery Ed25519 admission request is invalid");
-	} finally {
-		replacementCapabilityBinding.fill(0);
-	}
-}
-function equalBytes(left, right) {
-	if (left.length !== right.length) return false;
-	let difference = 0;
-	for (let index = 0; index < left.length; index += 1) difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
-	return difference === 0;
-}
-function requireParsed(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label}: ${parsed.message}`);
-	return parsed.value;
-}
-async function buildWalletRecoveryEd25519AdmissionRequestV1(input) {
-	const lifecycleId = await deriveWalletRecoveryKeyLifecycleId({
-		reservationId: parseRecoveryCodeReservationId(input.reservationId),
-		keySetId: input.entry.keySetId
-	});
-	return await buildEd25519RecoveryAdmissionRequestV1({
-		lifecycleId,
-		thresholdSessionId: `${lifecycleId}:threshold-session`,
-		currentScope: input.entry.recoveryBasis.scope,
-		applicationBinding: input.entry.recoveryBasis.applicationBinding,
-		participantIds: input.entry.recoveryBasis.participantIds,
-		activeCapabilityBinding: input.entry.recoveryBasis.activeCapabilityBinding,
-		registeredPublicKey: input.entry.recoveryBasis.registeredPublicKey
-	});
-}
-async function buildWalletSessionEd25519RecoveryAdmissionRequestV1(input) {
-	return await buildEd25519RecoveryAdmissionRequestV1({
-		lifecycleId: secureRandomId("wallet-session-ed25519-recovery", 32, "wallet-session Ed25519 recovery lifecycles"),
-		thresholdSessionId: input.basis.lifecycle.thresholdSessionId,
-		currentScope: {
-			root_share_epoch: input.basis.lifecycle.rootShareEpoch,
-			account_id: input.basis.lifecycle.accountId,
-			signer_set_id: input.basis.lifecycle.signerSetId,
-			signing_worker_id: input.basis.lifecycle.signingWorkerId,
-			material_activation: routerAbMpcMaterialActivationRefToWire(input.basis.materialActivation)
-		},
-		applicationBinding: input.basis.applicationBinding,
-		participantIds: input.basis.participantIds,
-		activeCapabilityBinding: input.basis.activeCapabilityBinding,
-		registeredPublicKey: input.basis.registeredPublicKey
-	});
-}
-async function admitWalletRecoveryEd25519V1(input) {
-	const response = await input.transport.send({
-		kind: "recovery_admit",
-		path: ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1,
-		body: input.request
-	});
-	if (!response.ok) throw new Error(`Router Ed25519 recovery admission failed: ${response.message}`);
-	const receipt = requireParsed(parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1(response.value), "Router Ed25519 recovery admission is invalid");
-	if (receipt.binding.lifecycle.lifecycle_id !== input.request.scope.lifecycle_id || !sameRouterAbMpcMaterialActivationRef(receipt.binding.material_activation, input.request.scope.material_activation)) throw new Error("Router Ed25519 recovery admission changed the requested lifecycle");
-	return {
-		request: input.request,
-		receipt
-	};
-}
-async function executeWalletRecoveryEd25519RoundV1(input) {
-	const executeRequest = requireParsed(parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1(JSON.parse(input.executeRequestJson)), "wallet recovery Ed25519 execute request is invalid");
-	const response = await input.transport.send({
-		kind: "recovery_execute",
-		path: ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1,
-		body: executeRequest
-	});
-	if (!response.ok) throw new Error(`Router Ed25519 recovery execute failed: ${response.message}`);
-	const result = requireParsed(parseRouterAbEd25519YaoRecoveryActivationResultV1(response.value), "Router Ed25519 recovery result is invalid");
-	return JSON.stringify(result);
-}
-async function activateWalletRecoveryEd25519V1(input) {
-	const result = requireParsed(parseRouterAbEd25519YaoRecoveryActivationResultV1(JSON.parse(input.protocolResultJson)), "Router Ed25519 recovery result is invalid");
-	const response = await input.transport.send({
-		kind: "recovery_activate",
-		path: ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1,
-		body: {
-			binding: result.binding,
-			public_receipt: result.public_receipt
-		}
-	});
-	if (!response.ok) throw new Error(`Router Ed25519 recovery activation failed: ${response.message}`);
-	const receipt = requireParsed(parseRouterAbEd25519YaoRecoveryActivationReceiptV1(response.value), "Router Ed25519 recovery activation is invalid");
-	if (!equalBytes(receipt.active_capability_binding, input.request.replacement_capability_binding) || !equalBytes(receipt.retired_capability_binding, input.request.active_capability_binding) || !equalBytes(receipt.public_receipt.transcript, result.public_receipt.transcript) || !equalBytes(receipt.public_receipt.registered_public_key, result.public_receipt.registered_public_key) || !equalBytes(receipt.public_receipt.signing_worker_verifying_share, result.public_receipt.signing_worker_verifying_share) || receipt.public_receipt.state_epoch !== result.public_receipt.state_epoch || !sameRouterAbMpcMaterialActivationRef(receipt.public_receipt.material_activation, input.request.scope.material_activation)) throw new Error("Router Ed25519 recovery activation changed the requested identity");
-	return receipt;
-}
-//#endregion
-export { activateWalletRecoveryEd25519V1, admitWalletRecoveryEd25519V1, buildWalletRecoveryEd25519AdmissionRequestV1, buildWalletSessionEd25519RecoveryAdmissionRequestV1, executeWalletRecoveryEd25519RoundV1 };
-
-//# sourceMappingURL=walletRecoveryEd25519.js.map

package/dist/esm/core/signingEngine/walletCustody/walletRecoveryManifest.js

@@ -1,178 +0,0 @@
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { recoverEvmFamilyCustodyV1, recoverNearEd25519CustodyV1 } from "./registrationCeremony.js";
-import { RouterAbEd25519YaoHttpActivationTransportV1 } from "../threshold/ed25519/yaoClient.js";
-import { walletRecoveryEd25519ActiveClientMetadataV1 } from "./ceremonyActiveClientMetadata.js";
-import { activateWalletRecoveryEd25519V1, admitWalletRecoveryEd25519V1, buildWalletRecoveryEd25519AdmissionRequestV1, executeWalletRecoveryEd25519RoundV1 } from "./walletRecoveryEd25519.js";
-import { signRecoveredWalletCustodyEcdsa } from "./walletRecoveryEcdsa.js";
-import { buildRecoveredCustodyEnvelopeRecord } from "./recoveryReplacementEnvelope.js";
-//#region src/core/signingEngine/walletCustody/walletRecoveryManifest.ts
-function replacementForEntry(input) {
-	if (input.entryIndex !== 0) return { kind: "preserve_existing" };
-	return {
-		kind: "reseal_replacement_factor",
-		factorJson: JSON.stringify({
-			envelopeId: input.replacementFactor.replacementId,
-			walletAuthMethodId: input.replacementFactor.walletAuthMethodId,
-			factor: input.replacementFactor.factor
-		}),
-		factorSecret: input.replacementFactor.factorSecret.slice(0)
-	};
-}
-function recoveryCodeBuffer(bytes) {
-	return Uint8Array.from(bytes).buffer;
-}
-function zeroizeFactorReplacement(replacement) {
-	if (replacement.kind === "reseal_replacement_factor") new Uint8Array(replacement.factorSecret).fill(0);
-}
-function ethereumAddressFromAddress20B64u(value) {
-	const address = base64UrlDecode(value);
-	if (address.length !== 20) throw new Error("wallet recovery ECDSA identity has an invalid address");
-	return `0x${Array.from(address, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
-}
-function requireMatchingEcdsaBootstrap(input) {
-	const identity = input.entry.recoveryBasis.publicCapability.public_identity;
-	if (input.bootstrap.contextBinding32B64u !== identity.context_binding_b64u || input.bootstrap.clientSharePublicKey33B64u !== identity.derivation_client_share_public_key33_b64u || input.bootstrap.clientShareRetryCounter !== identity.client_share_retry_counter) throw new Error(`wallet recovery changed ECDSA identity for ${input.entry.keySetId}`);
-}
-function recordReplacementEnvelope(input) {
-	if (!input.candidate) return input.current;
-	if (input.current) throw new Error("wallet recovery produced more than one replacement envelope");
-	return input.candidate;
-}
-async function recoverWalletCustodyManifestV1(input) {
-	const nearKeySets = [];
-	const ecdsaKeySets = [];
-	let replacementEnvelope = null;
-	for (const [entryIndex, entry] of input.prepared.keyManifest.entries.entries()) {
-		let copiedRecoveryCode = null;
-		let factorReplacement = null;
-		try {
-			const recoveryCode = recoveryCodeBuffer(input.recoveryCodeBytes);
-			copiedRecoveryCode = recoveryCode;
-			const replacement = replacementForEntry({
-				entryIndex,
-				replacementFactor: input.replacementFactor
-			});
-			factorReplacement = replacement;
-			switch (entry.kind) {
-				case "near_ed25519": {
-					const transport = new RouterAbEd25519YaoHttpActivationTransportV1({
-						routerOrigin: new URL(input.relayUrl).origin,
-						authorization: {
-							kind: "recovery_challenge",
-							challengeId: input.recoveryChallengeId
-						},
-						fetch: globalThis.fetch
-					});
-					const request = await buildWalletRecoveryEd25519AdmissionRequestV1({
-						reservationId: input.prepared.reservationId,
-						entry
-					});
-					const admitted = await admitWalletRecoveryEd25519V1({
-						request,
-						transport
-					});
-					const recovered = await recoverNearEd25519CustodyV1({
-						runStep: input.runStep,
-						walletId: input.walletId,
-						custodyJson: input.custodyJson,
-						recoveryCode,
-						recordedKeyManifestDigestB64u: entry.recordedKeyManifestDigestB64u,
-						factorReplacement: replacement,
-						nearEd25519SigningKeyId: entry.recoveryBasis.applicationBinding.near_ed25519_signing_key_id,
-						yaoAdmission: admitted.receipt,
-						yaoApplication: admitted.request.application_binding,
-						participantIds: admitted.request.participant_ids,
-						registeredPublicKeyB64u: base64UrlEncode(Uint8Array.from(entry.recoveryBasis.registeredPublicKey)),
-						runRouterRound: (executeRequestJson) => executeWalletRecoveryEd25519RoundV1({
-							executeRequestJson,
-							transport
-						}),
-						activateRouterRecovery: (protocolResultJson) => activateWalletRecoveryEd25519V1({
-							request,
-							protocolResultJson,
-							transport
-						})
-					});
-					if (!recovered.localMaterial) throw new Error("wallet recovery produced no NEAR local material");
-					replacementEnvelope = recordReplacementEnvelope({
-						current: replacementEnvelope,
-						candidate: recovered.recoveryReplacementEnvelope
-					});
-					nearKeySets.push({
-						entry,
-						metadata: walletRecoveryEd25519ActiveClientMetadataV1({
-							admissionRequest: request,
-							activationResultJson: recovered.activationResultJson,
-							activationReceipt: recovered.activationReceipt
-						}),
-						localMaterial: recovered.localMaterial
-					});
-					break;
-				}
-				case "evm_family_ecdsa": {
-					const recovered = await recoverEvmFamilyCustodyV1({
-						runStep: input.runStep,
-						walletId: input.walletId,
-						custodyJson: input.custodyJson,
-						recoveryCode,
-						recordedKeyManifestDigestB64u: entry.recordedKeyManifestDigestB64u,
-						factorReplacement: replacement,
-						evmFamilySigningKeySlotId: entry.evmFamilySigningKeySlotId,
-						applicationBindingDigestB64u: entry.recoveryBasis.publicCapability.context.application_binding_digest_b64u,
-						registeredClientRootPublicKey33B64u: entry.recoveryBasis.clientRootPublicKey33B64u,
-						resolveRelayerPublicIdentity: async (bootstrap) => {
-							requireMatchingEcdsaBootstrap({
-								entry,
-								bootstrap
-							});
-							return JSON.stringify({
-								relayerKeyId: entry.recoveryBasis.publicCapability.signer_set.selected_server.server_id,
-								relayerPublicKey33B64u: entry.recoveryBasis.publicCapability.public_identity.server_public_key33_b64u,
-								groupPublicKey33B64u: entry.recoveryBasis.publicCapability.public_identity.threshold_public_key33_b64u,
-								ethereumAddress: ethereumAddressFromAddress20B64u(entry.recoveryBasis.publicCapability.public_identity.ethereum_address20_b64u),
-								relayerShareRetryCounter: entry.recoveryBasis.publicCapability.public_identity.server_share_retry_counter
-							});
-						}
-					});
-					const completedActivation = await signRecoveredWalletCustodyEcdsa({
-						entry,
-						walletId: input.walletId,
-						reservationId: input.prepared.reservationId,
-						replacementId: input.replacementFactor.replacementId,
-						readyStateBlobB64u: recovered.readyStateBlobB64u,
-						publicFacts: recovered.publicFacts,
-						workerCtx: input.workerCtx
-					});
-					replacementEnvelope = recordReplacementEnvelope({
-						current: replacementEnvelope,
-						candidate: recovered.recoveryReplacementEnvelope
-					});
-					ecdsaKeySets.push({
-						entry,
-						activation: completedActivation,
-						readyStateBlobB64u: recovered.readyStateBlobB64u,
-						publicFacts: recovered.publicFacts
-					});
-					break;
-				}
-			}
-		} finally {
-			if (factorReplacement) zeroizeFactorReplacement(factorReplacement);
-			if (copiedRecoveryCode) new Uint8Array(copiedRecoveryCode).fill(0);
-		}
-	}
-	if (!replacementEnvelope) throw new Error("wallet recovery produced no replacement custody envelope");
-	return {
-		replacementEnvelope: buildRecoveredCustodyEnvelopeRecord({
-			expectedWalletId: input.walletId,
-			replacement: replacementEnvelope,
-			activatedAtMs: (input.nowMs ?? Date.now)()
-		}),
-		nearKeySets,
-		ecdsaKeySets
-	};
-}
-//#endregion
-export { recoverWalletCustodyManifestV1 };
-
-//# sourceMappingURL=walletRecoveryManifest.js.map