@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/platform/browser/createBrowserPlatformRuntime.js

@@ -1,535 +0,0 @@
-import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
-import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../shared-ts/src/utils/signingSessionSeal.js";
-import { toRpId } from "../../signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
-import { getPrfFirstB64uFromCredential } from "../../signingEngine/webauthnAuth/credentials/credentialExtensions.js";
-import { getSignerWorkerOperationCoreCode, getSignerWorkerOperationErrorCode } from "../../signingEngine/workerManager/workerTypes.js";
-import { parseEcdsaRoleLocalBindingDigest, parseEcdsaRoleLocalDurableMaterialRef, parseEcdsaRoleLocalMaterialHandle } from "../../signingEngine/session/keyMaterialBrands.js";
-import { closeRouterAbEcdsaRegistrationCeremonyWasm, createRouterAbEcdsaRegistrationCeremonyWasm, finalizeEcdsaClientBootstrapCommandWasm, finalizeRouterAbEcdsaRegistrationActivationWasm, persistInitialCanonicalEcdsaActivationWasm, prepareEcdsaClientBootstrapCommandWasm, storeEcdsaRoleLocalSigningMaterialWasm, verifyRouterAbEcdsaRegistrationClientProofsWasm } from "../../signingEngine/threshold/crypto/ecdsaDerivationClientWasm.js";
-import { ecdsaRoleLocalReadyRecordMatchesInput, ecdsaRoleLocalReadyRecordStorageKey, parseEcdsaRoleLocalReadyRecord, serializeEcdsaRoleLocalReadyRecord } from "../../signingEngine/session/persistence/ecdsaRoleLocalRecords.js";
-import { errorMessage } from "../../../shared-ts/src/utils/errors.js";
-import { serializeAuthenticationCredentialWithPRF, serializeRegistrationCredentialWithPRF } from "../../signingEngine/webauthnAuth/credentials/helpers.js";
-import { IndexedDBManager } from "../../indexedDB/index.js";
-import { parseGeneratedFinalizeEcdsaClientBootstrapOutput, parseGeneratedPrepareEcdsaClientBootstrapOutput, toGeneratedFinalizeEcdsaClientBootstrapCommand, toGeneratedPrepareEcdsaClientBootstrapCommand } from "../signerCoreCommandAdapters.js";
-//#region src/core/platform/browser/createBrowserPlatformRuntime.ts
-function unavailable(message) {
-	return {
-		ok: false,
-		code: "unavailable",
-		message
-	};
-}
-function signerCryptoInvocationFailure(code, message) {
-	return {
-		ok: false,
-		failure: "invocation",
-		code,
-		message
-	};
-}
-function signerCryptoCommandFailure(code, message) {
-	return {
-		ok: false,
-		failure: "command",
-		code,
-		message
-	};
-}
-function decodeBase64UrlArrayBuffer(value) {
-	const decoded = base64UrlDecode(value);
-	const out = new ArrayBuffer(decoded.byteLength);
-	new Uint8Array(out).set(decoded);
-	return out;
-}
-function browserPasskeyCreationOptions(options) {
-	return {
-		challenge: decodeBase64UrlArrayBuffer(options.challengeB64u),
-		rp: {
-			id: options.rpId,
-			name: options.rpId
-		},
-		user: {
-			id: decodeBase64UrlArrayBuffer(options.user.idB64u),
-			name: options.user.name,
-			displayName: options.user.displayName
-		},
-		pubKeyCredParams: options.pubKeyCredParams.map((parameter) => ({
-			type: parameter.type,
-			alg: parameter.alg
-		})),
-		authenticatorSelection: options.authenticatorSelection,
-		timeout: options.timeoutMs,
-		attestation: options.attestation,
-		excludeCredentials: options.excludeCredentials.map((credential) => ({
-			type: credential.type,
-			id: decodeBase64UrlArrayBuffer(credential.id)
-		})),
-		extensions: { prf: { eval: {
-			first: base64UrlDecode(options.extensions.prf.eval.firstB64u),
-			second: base64UrlDecode(options.extensions.prf.eval.secondB64u)
-		} } }
-	};
-}
-function isNativeBindingFailureMessage(message) {
-	return /wasm (initialization|initialize|instantiation)|webassembly|module_or_path|failed to (load|compile|instantiate) wasm|derivation client wasm initialization failed/i.test(message);
-}
-function mapSignerCryptoInvocationError(error) {
-	const code = getSignerWorkerOperationErrorCode(error);
-	const coreCode = getSignerWorkerOperationCoreCode(error);
-	const message = errorMessage(error);
-	if (coreCode === "ECDSA_DERIVATION_WASM_INIT_FAILURE") return signerCryptoInvocationFailure("native_binding_failure", message);
-	if (isNativeBindingFailureMessage(message)) return signerCryptoInvocationFailure("native_binding_failure", message);
-	switch (code) {
-		case "TIMEOUT": return signerCryptoInvocationFailure("timeout", message);
-		case "WORKER_POSTMESSAGE_ERROR":
-		case "WORKER_PROTOCOL_ERROR":
-		case "WORKER_RUNTIME_ERROR": return signerCryptoInvocationFailure("worker_transport_failure", message);
-		default: break;
-	}
-	if (/timed out/i.test(message)) return signerCryptoInvocationFailure("timeout", message);
-	if (/postMessage|worker runtime|worker response|worker protocol|Malformed worker|Unknown worker/i.test(message)) return signerCryptoInvocationFailure("worker_transport_failure", message);
-	return null;
-}
-function mapFinalizeEcdsaCommandError(error) {
-	const message = errorMessage(error);
-	if (/relayer|public identity|group public key|ethereum address|threshold public key/i.test(message)) return signerCryptoCommandFailure("public_identity_mismatch", message);
-	return signerCryptoCommandFailure("invalid_pending_state", message);
-}
-function createBrowserDurableRecordStore(indexedDB) {
-	return {
-		kind: "durable_record_store",
-		async loadEcdsaRoleLocalReadyRecord(input) {
-			const storageKey = ecdsaRoleLocalReadyRecordStorageKey(input);
-			try {
-				const stored = await indexedDB.getAppState(storageKey);
-				if (stored !== void 0 && stored !== null) {
-					const parsed = parseEcdsaRoleLocalReadyRecord(stored);
-					if (!ecdsaRoleLocalReadyRecordMatchesInput({
-						record: parsed,
-						input
-					})) return {
-						ok: true,
-						value: {
-							kind: "malformed",
-							cleanup: {
-								...input,
-								reason: "Stored ECDSA role-local record identity does not match lookup input"
-							},
-							message: "Stored ECDSA role-local record identity does not match lookup input"
-						}
-					};
-					return {
-						ok: true,
-						value: {
-							kind: "found",
-							record: parsed
-						}
-					};
-				}
-				return {
-					ok: true,
-					value: { kind: "not_found" }
-				};
-			} catch (error) {
-				const message = errorMessage(error);
-				return {
-					ok: true,
-					value: {
-						kind: "malformed",
-						cleanup: {
-							...input,
-							reason: message
-						},
-						message
-					}
-				};
-			}
-		},
-		async persistEcdsaRoleLocalReadyRecord(input) {
-			try {
-				const record = parseEcdsaRoleLocalReadyRecord(input.record);
-				if (!ecdsaRoleLocalReadyRecordMatchesInput({
-					record,
-					input: input.storageKeyFacts
-				})) return {
-					ok: false,
-					code: "invalid_record",
-					message: "ECDSA role-local ready record identity does not match storageKeyFacts"
-				};
-				await indexedDB.setAppState(ecdsaRoleLocalReadyRecordStorageKey(input.storageKeyFacts), serializeEcdsaRoleLocalReadyRecord(record));
-				return {
-					ok: true,
-					value: { kind: "persisted" }
-				};
-			} catch (error) {
-				return {
-					ok: false,
-					code: "invalid_record",
-					message: errorMessage(error)
-				};
-			}
-		},
-		async cleanupMalformedEcdsaRoleLocalRecord(input) {
-			try {
-				await indexedDB.setAppState(ecdsaRoleLocalReadyRecordStorageKey(input), null);
-				return {
-					ok: true,
-					value: { kind: "deleted" }
-				};
-			} catch (error) {
-				return {
-					ok: false,
-					code: "unavailable",
-					message: errorMessage(error)
-				};
-			}
-		}
-	};
-}
-function createBrowserSecureSecretStore() {
-	return {
-		kind: "secure_secret_store",
-		async seal() {
-			return unavailable("Browser secure secret store is not wired yet");
-		},
-		async unseal() {
-			return unavailable("Browser secure secret store is not wired yet");
-		},
-		async delete() {
-			return unavailable("Browser secure secret store is not wired yet");
-		}
-	};
-}
-function authenticatorFailure(error) {
-	if (error instanceof DOMException) {
-		if (error.name === "NotAllowedError") return {
-			ok: false,
-			code: "not_allowed",
-			message: error.message || "Passkey operation was not allowed"
-		};
-		return {
-			ok: false,
-			code: "platform_error",
-			message: error.message || error.name
-		};
-	}
-	return {
-		ok: false,
-		code: "platform_error",
-		message: error instanceof Error ? error.message : String(error)
-	};
-}
-function prfExtensionInput() {
-	return { prf: { eval: {
-		first: PASSKEY_PRF_FIRST_SALT_V1,
-		second: PASSKEY_PRF_SECOND_SALT_V1
-	} } };
-}
-function requiredPrfFailure() {
-	return {
-		ok: false,
-		code: "prf_unavailable",
-		message: "Required passkey PRF.first output is unavailable"
-	};
-}
-function requiredPrfSerializationFailure(error) {
-	if (/Missing PRF/i.test(errorMessage(error))) return requiredPrfFailure();
-	return null;
-}
-function isPublicKeyCredential(value) {
-	return Boolean(value && typeof value === "object" && "rawId" in value && "response" in value && typeof value.getClientExtensionResults === "function");
-}
-async function runBrowserCredentialOperation(kind, publicKey, credentials) {
-	if (kind === "create") return credentials.create({ publicKey });
-	return credentials.get({ publicKey });
-}
-function createBrowserAuthenticatorPort(credentials) {
-	return {
-		kind: "authenticator",
-		async run(operation) {
-			if (!credentials) return {
-				ok: false,
-				code: "unavailable",
-				message: "navigator.credentials is unavailable"
-			};
-			try {
-				switch (operation.kind) {
-					case "create_passkey": {
-						const registrationOptions = operation.registrationOptions;
-						const credential = await runBrowserCredentialOperation("create", browserPasskeyCreationOptions(registrationOptions), credentials);
-						if (!isPublicKeyCredential(credential)) return {
-							ok: false,
-							code: "invalid_credential",
-							message: "Passkey creation returned an invalid credential"
-						};
-						let serialized;
-						try {
-							serialized = serializeRegistrationCredentialWithPRF({ credential });
-						} catch (error) {
-							if (operation.requirePrfFirst) {
-								const prfFailure = requiredPrfSerializationFailure(error);
-								if (prfFailure) return prfFailure;
-							}
-							throw error;
-						}
-						const prfFirstB64u = getPrfFirstB64uFromCredential(serialized);
-						if (operation.requirePrfFirst && !prfFirstB64u) return requiredPrfFailure();
-						if (operation.requirePrfFirst) {
-							const requiredPrfFirstB64u = prfFirstB64u || "";
-							return {
-								ok: true,
-								operation: "create_passkey",
-								requirePrfFirst: true,
-								credential: serialized,
-								credentialIdB64u: serialized.rawId,
-								rawIdB64u: serialized.rawId,
-								rpId: toRpId(registrationOptions.rpId),
-								prf: {
-									kind: "required",
-									prfFirstB64u: requiredPrfFirstB64u
-								}
-							};
-						}
-						return {
-							ok: true,
-							operation: "create_passkey",
-							requirePrfFirst: false,
-							credential: serialized,
-							credentialIdB64u: serialized.rawId,
-							rawIdB64u: serialized.rawId,
-							rpId: toRpId(registrationOptions.rpId),
-							prf: prfFirstB64u ? {
-								kind: "available_without_requirement",
-								prfFirstB64u
-							} : { kind: "not_requested_or_unavailable" }
-						};
-					}
-					case "get_passkey": {
-						const credential = await runBrowserCredentialOperation("get", {
-							rpId: operation.rpId,
-							challenge: decodeBase64UrlArrayBuffer(operation.challengeB64u),
-							allowCredentials: [{
-								type: "public-key",
-								id: decodeBase64UrlArrayBuffer(operation.credentialIdB64u)
-							}],
-							userVerification: "preferred",
-							extensions: prfExtensionInput()
-						}, credentials);
-						if (!isPublicKeyCredential(credential)) return {
-							ok: false,
-							code: "invalid_credential",
-							message: "Passkey assertion returned an invalid credential"
-						};
-						let serialized;
-						try {
-							serialized = serializeAuthenticationCredentialWithPRF({ credential });
-						} catch (error) {
-							if (operation.requirePrfFirst) {
-								const prfFailure = requiredPrfSerializationFailure(error);
-								if (prfFailure) return prfFailure;
-							}
-							throw error;
-						}
-						const prfFirstB64u = getPrfFirstB64uFromCredential(serialized);
-						if (operation.requirePrfFirst && !prfFirstB64u) return requiredPrfFailure();
-						if (operation.requirePrfFirst) {
-							const requiredPrfFirstB64u = prfFirstB64u || "";
-							return {
-								ok: true,
-								operation: "get_passkey",
-								requirePrfFirst: true,
-								credential: serialized,
-								credentialIdB64u: serialized.rawId,
-								rawIdB64u: serialized.rawId,
-								rpId: operation.rpId,
-								prf: {
-									kind: "required",
-									prfFirstB64u: requiredPrfFirstB64u
-								}
-							};
-						}
-						return {
-							ok: true,
-							operation: "get_passkey",
-							requirePrfFirst: false,
-							credential: serialized,
-							credentialIdB64u: serialized.rawId,
-							rawIdB64u: serialized.rawId,
-							rpId: operation.rpId,
-							prf: prfFirstB64u ? {
-								kind: "available_without_requirement",
-								prfFirstB64u
-							} : { kind: "not_requested_or_unavailable" }
-						};
-					}
-				}
-			} catch (error) {
-				return authenticatorFailure(error);
-			}
-		}
-	};
-}
-function createBrowserSignerCryptoPort(workerCtx) {
-	return {
-		kind: "signer_crypto",
-		async createRouterAbEcdsaRegistrationCeremony(input) {
-			if (!workerCtx) throw new Error("ECDSA derivation client worker context is unavailable");
-			return createRouterAbEcdsaRegistrationCeremonyWasm({
-				command: input,
-				workerCtx
-			});
-		},
-		async verifyRouterAbEcdsaRegistrationClientProofs(input) {
-			if (!workerCtx) throw new Error("ECDSA derivation client worker context is unavailable");
-			return verifyRouterAbEcdsaRegistrationClientProofsWasm({
-				command: input,
-				workerCtx
-			});
-		},
-		async persistInitialCanonicalEcdsaActivation(input) {
-			if (!workerCtx) throw new Error("ECDSA derivation client worker context is unavailable");
-			return persistInitialCanonicalEcdsaActivationWasm({
-				command: input,
-				workerCtx
-			});
-		},
-		async finalizeRouterAbEcdsaRegistrationActivation(input) {
-			if (!workerCtx) throw new Error("ECDSA derivation client worker context is unavailable");
-			return finalizeRouterAbEcdsaRegistrationActivationWasm({
-				command: input,
-				workerCtx
-			});
-		},
-		async closeRouterAbEcdsaRegistrationCeremony(input) {
-			if (!workerCtx) throw new Error("ECDSA derivation client worker context is unavailable");
-			return closeRouterAbEcdsaRegistrationCeremonyWasm({
-				command: input,
-				workerCtx
-			});
-		},
-		async prepareEcdsaClientBootstrap(input) {
-			if (!workerCtx) return signerCryptoInvocationFailure("unavailable", "ECDSA client bootstrap worker context is unavailable");
-			try {
-				return {
-					ok: true,
-					value: parseGeneratedPrepareEcdsaClientBootstrapOutput(await prepareEcdsaClientBootstrapCommandWasm({
-						command: toGeneratedPrepareEcdsaClientBootstrapCommand(input),
-						workerCtx
-					}))
-				};
-			} catch (error) {
-				const message = errorMessage(error);
-				if (message.includes("unsupported ECDSA bootstrap secret source")) return signerCryptoCommandFailure("unsupported_secret_source", message);
-				return mapSignerCryptoInvocationError(error) || signerCryptoCommandFailure("crypto_failure", message);
-			}
-		},
-		async finalizeEcdsaClientBootstrap(input) {
-			if (input.pendingStateBlob.kind !== "ecdsa_role_local_pending_state_blob_v1" || input.pendingStateBlob.curve !== "secp256k1" || input.pendingStateBlob.encoding !== "base64url" || input.pendingStateBlob.producer !== "signer_core") return signerCryptoCommandFailure("invalid_pending_state", "ECDSA client bootstrap pending blob envelope is invalid");
-			if (!workerCtx) return signerCryptoInvocationFailure("unavailable", "ECDSA client bootstrap worker context is unavailable");
-			try {
-				return {
-					ok: true,
-					value: parseGeneratedFinalizeEcdsaClientBootstrapOutput(await finalizeEcdsaClientBootstrapCommandWasm({
-						command: toGeneratedFinalizeEcdsaClientBootstrapCommand(input),
-						workerCtx
-					}))
-				};
-			} catch (error) {
-				return mapSignerCryptoInvocationError(error) || mapFinalizeEcdsaCommandError(error);
-			}
-		},
-		async storeEcdsaRoleLocalSigningMaterial(input) {
-			if (input.stateBlob.kind !== "ecdsa_role_local_state_blob_v1" || input.stateBlob.curve !== "secp256k1" || input.stateBlob.encoding !== "base64url" || input.stateBlob.producer !== "signer_core") return signerCryptoCommandFailure("invalid_ready_state", "ECDSA role-local ready blob envelope is invalid");
-			if (!workerCtx) return signerCryptoInvocationFailure("unavailable", "ECDSA role-local material worker context is unavailable");
-			try {
-				const stored = await storeEcdsaRoleLocalSigningMaterialWasm({
-					materialHandle: input.handle.materialHandle,
-					bindingDigest: input.handle.bindingDigest,
-					stateBlob: input.stateBlob,
-					workerCtx
-				});
-				return {
-					ok: true,
-					value: { handle: {
-						kind: "ecdsa_role_local_worker_handle_v1",
-						materialHandle: parseEcdsaRoleLocalMaterialHandle(stored.materialHandle),
-						durableMaterialRef: parseEcdsaRoleLocalDurableMaterialRef(stored.materialHandle),
-						bindingDigest: parseEcdsaRoleLocalBindingDigest(stored.bindingDigest)
-					} }
-				};
-			} catch (error) {
-				return mapSignerCryptoInvocationError(error) || signerCryptoCommandFailure("crypto_failure", errorMessage(error));
-			}
-		}
-	};
-}
-function createBrowserHttpTransport(fetchImpl) {
-	return {
-		kind: "http_transport",
-		async request(input) {
-			if (!fetchImpl) return {
-				ok: false,
-				code: "network_error",
-				message: "fetch is unavailable"
-			};
-			const controller = new AbortController();
-			const timeout = input.timeoutMs && input.timeoutMs > 0 ? setTimeout(() => controller.abort(), input.timeoutMs) : null;
-			try {
-				const response = await fetchImpl(input.url, {
-					method: input.method,
-					headers: input.headers,
-					body: input.body == null ? void 0 : JSON.stringify(input.body),
-					signal: controller.signal
-				});
-				const body = (response.headers.get("content-type") || "").includes("application/json") ? await response.json().catch(() => null) : await response.text().catch(() => "");
-				return {
-					ok: true,
-					value: {
-						status: response.status,
-						body
-					}
-				};
-			} catch (error) {
-				return {
-					ok: false,
-					code: controller.signal.aborted ? "timeout" : "network_error",
-					message: error instanceof Error ? error.message : String(error)
-				};
-			} finally {
-				if (timeout) clearTimeout(timeout);
-			}
-		}
-	};
-}
-function createBrowserClock(nowMs) {
-	return {
-		kind: "clock",
-		nowMs: nowMs || (() => Date.now())
-	};
-}
-function createBrowserRandomSource(cryptoImpl) {
-	return {
-		kind: "random_source",
-		randomBytes(length) {
-			if (!cryptoImpl?.getRandomValues) throw new Error("Browser crypto.getRandomValues is unavailable");
-			const bytes = new Uint8Array(length);
-			cryptoImpl.getRandomValues(bytes);
-			return bytes;
-		}
-	};
-}
-function createBrowserPlatformRuntime(deps = {}) {
-	return {
-		kind: "browser",
-		storage: createBrowserDurableRecordStore(deps.indexedDB || IndexedDBManager),
-		secrets: createBrowserSecureSecretStore(),
-		authenticator: createBrowserAuthenticatorPort(deps.credentials || globalThis.navigator?.credentials),
-		signerCrypto: createBrowserSignerCryptoPort(deps.workerCtx),
-		http: createBrowserHttpTransport(deps.fetch || globalThis.fetch?.bind(globalThis)),
-		clock: createBrowserClock(deps.nowMs),
-		random: createBrowserRandomSource(deps.crypto || globalThis.crypto)
-	};
-}
-//#endregion
-export { createBrowserPlatformRuntime };
-
-//# sourceMappingURL=createBrowserPlatformRuntime.js.map

package/dist/esm/core/platform/secretSources.js

@@ -1,111 +0,0 @@
-import { thresholdEcdsaChainTargetFromRequest, toWalletId } from "../signingEngine/interfaces/ecdsaChainTarget.js";
-import { toRpId } from "../signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
-import { toEmailOtpAuthSubjectId } from "../signingEngine/session/identity/emailOtpEcdsaDerivationIdentity.js";
-//#region src/core/platform/secretSources.ts
-const clientSecretSourceBrand = Symbol("ClientSecretSource");
-const emailOtpWorkerSessionHandleBrand = Symbol("EmailOtpWorkerSessionHandle");
-function requirePlatformString(value, field) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`[platform] ${field} is required`);
-	return normalized;
-}
-function requirePlatformObject(value, field) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`[platform] ${field} must be an object`);
-	return value;
-}
-function buildWebAuthnPrfFirstSecretSource(input) {
-	return buildWebAuthnPrfFirstSecretSourceFromParts({
-		prfFirstB64u: input.prf.prfFirstB64u,
-		rpId: input.rpId,
-		credentialIdB64u: input.credentialIdB64u
-	});
-}
-function buildWebAuthnPrfFirstSecretSourceFromParts(input) {
-	return {
-		kind: "webauthn_prf_first",
-		prfFirstB64u: requirePlatformString(input.prfFirstB64u, "prfFirstB64u"),
-		rpId: input.rpId,
-		credentialIdB64u: requirePlatformString(input.credentialIdB64u, "credentialIdB64u"),
-		[clientSecretSourceBrand]: "webauthn_prf_first"
-	};
-}
-function buildEmailOtpWorkerIssuedSessionHandle(input) {
-	const sessionId = requirePlatformString(input.sessionId, "sessionId");
-	switch (input.action) {
-		case "threshold_ecdsa_bootstrap": return {
-			kind: "email_otp_worker_session_handle_v1",
-			sessionId,
-			walletId: input.walletId,
-			keyHandle: requirePlatformString(input.keyHandle, "keyHandle"),
-			authSubjectId: input.authSubjectId,
-			action: "threshold_ecdsa_bootstrap",
-			operation: input.operation,
-			chainTarget: input.chainTarget,
-			[emailOtpWorkerSessionHandleBrand]: "email_otp_worker_session_handle"
-		};
-		case "threshold_ed25519_session": return {
-			kind: "email_otp_worker_session_handle_v1",
-			sessionId,
-			walletId: input.walletId,
-			rpId: input.rpId,
-			authSubjectId: input.authSubjectId,
-			action: "threshold_ed25519_session",
-			operation: input.operation,
-			[emailOtpWorkerSessionHandleBrand]: "email_otp_worker_session_handle"
-		};
-		default: {
-			const exhaustive = input;
-			throw new Error(`[platform] unsupported email OTP worker-issued handle action: ${String(exhaustive)}`);
-		}
-	}
-}
-function parseEmailOtpWorkerIssuedSessionHandle(input) {
-	const payload = requirePlatformObject(input, "email OTP worker-issued session handle");
-	const kind = requirePlatformString(String(payload.kind || ""), "email OTP worker-issued handle kind");
-	if (kind !== "email_otp_worker_session_handle_v1") throw new Error(`[platform] unsupported email OTP worker-issued handle kind: ${kind}`);
-	const action = requirePlatformString(String(payload.action || ""), "email OTP worker-issued handle action");
-	const operation = requirePlatformString(String(payload.operation || ""), "email OTP worker-issued handle operation");
-	if (operation !== "registration" && operation !== "wallet_unlock" && operation !== "sign" && operation !== "export") throw new Error(`[platform] unsupported email OTP worker-issued handle operation: ${operation}`);
-	const normalizedOperation = operation;
-	const base = {
-		sessionId: requirePlatformString(String(payload.sessionId || ""), "email OTP worker-issued handle sessionId"),
-		walletId: toWalletId(payload.walletId),
-		authSubjectId: toEmailOtpAuthSubjectId(payload.authSubjectId),
-		operation: normalizedOperation
-	};
-	if (action === "threshold_ecdsa_bootstrap") {
-		if ("rpId" in payload) throw new Error("[platform] email OTP ECDSA worker-issued handles cannot include rpId");
-		if (normalizedOperation === "registration") throw new Error("[platform] registration Email OTP ECDSA worker-issued handles are retired");
-		const chainTarget = thresholdEcdsaChainTargetFromRequest(requirePlatformObject(payload.chainTarget, "email OTP worker-issued handle chainTarget"));
-		if ("evmFamilySigningKeySlotId" in payload) throw new Error("[platform] runtime Email OTP ECDSA handles cannot include evmFamilySigningKeySlotId");
-		return buildEmailOtpWorkerIssuedSessionHandle({
-			...base,
-			action,
-			operation: normalizedOperation,
-			keyHandle: requirePlatformString(String(payload.keyHandle || ""), "email OTP worker-issued handle keyHandle"),
-			chainTarget
-		});
-	}
-	if (action === "threshold_ed25519_session") {
-		if ("chainTarget" in payload) throw new Error("[platform] email OTP Ed25519 worker-issued handles cannot include chainTarget");
-		if ("evmFamilySigningKeySlotId" in payload || "keyHandle" in payload) throw new Error("[platform] email OTP Ed25519 worker-issued handles cannot include ECDSA key identity");
-		return buildEmailOtpWorkerIssuedSessionHandle({
-			...base,
-			action,
-			rpId: toRpId(payload.rpId)
-		});
-	}
-	throw new Error(`[platform] unsupported email OTP worker-issued handle action: ${action}`);
-}
-function isEmailOtpEcdsaExportWorkerIssuedSessionHandle(handle) {
-	return handle.action === "threshold_ecdsa_bootstrap" && handle.operation === "export";
-}
-function parseEmailOtpEcdsaExportWorkerIssuedSessionHandle(input) {
-	const handle = parseEmailOtpWorkerIssuedSessionHandle(input);
-	if (!isEmailOtpEcdsaExportWorkerIssuedSessionHandle(handle)) throw new Error("[platform] Email OTP ECDSA export requires an export worker handle");
-	return handle;
-}
-//#endregion
-export { buildWebAuthnPrfFirstSecretSource, parseEmailOtpEcdsaExportWorkerIssuedSessionHandle, parseEmailOtpWorkerIssuedSessionHandle };
-
-//# sourceMappingURL=secretSources.js.map