@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/signingEngine/session/routerAbSigningWalletSession.js

@@ -1,119 +0,0 @@
-import { parseThresholdEd25519SessionId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-//#region src/core/signingEngine/session/routerAbSigningWalletSession.ts
-function nonEmptyString(value) {
-	return String(value || "").trim();
-}
-function positiveInteger(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : 0;
-}
-function normalizeActiveSessionNowMs(nowMs) {
-	const normalized = Math.floor(Number(nowMs));
-	return Number.isSafeInteger(normalized) && normalized >= 0 ? normalized : null;
-}
-function inactiveSigningSessionState(args) {
-	if (args.expiresAtMs <= args.nowMs) return { kind: "expired" };
-	if (args.remainingUses <= 0) return { kind: "exhausted" };
-	return null;
-}
-function buildWalletSessionOpaqueAuth(tokenRaw) {
-	const walletSessionToken = nonEmptyString(tokenRaw);
-	if (!walletSessionToken) return null;
-	return {
-		kind: "wallet_session_opaque",
-		walletSessionToken,
-		credential: {
-			kind: "wallet_session_opaque",
-			walletSessionToken
-		}
-	};
-}
-function buildRouterAbEd25519SigningWalletSession(input) {
-	const auth = buildWalletSessionOpaqueAuth(nonEmptyString(input.walletSessionToken));
-	if (!auth) return {
-		ok: false,
-		reason: "missing_wallet_session_token"
-	};
-	const walletId = nonEmptyString(input.walletId);
-	const nearAccountId = nonEmptyString(input.nearAccountId);
-	const nearEd25519SigningKeyId = nonEmptyString(input.nearEd25519SigningKeyId);
-	if (!walletId || !nearAccountId || !nearEd25519SigningKeyId) return {
-		ok: false,
-		reason: "wallet_binding_mismatch"
-	};
-	const walletSessionId = parseWalletSessionId(input.walletSessionId);
-	const authorizationId = parseWalletSessionAuthorizationId(input.authorizationId);
-	const quotaId = parseMpcWalletSigningQuotaId(input.quotaId);
-	const thresholdSessionId = parseThresholdEd25519SessionId(input.thresholdSessionId);
-	if (!walletSessionId.ok) return {
-		ok: false,
-		reason: "missing_session_identity"
-	};
-	if (!authorizationId.ok) return {
-		ok: false,
-		reason: "missing_session_identity"
-	};
-	if (!quotaId.ok) return {
-		ok: false,
-		reason: "missing_quota_id"
-	};
-	if (!thresholdSessionId.ok) return {
-		ok: false,
-		reason: "missing_threshold_session_id"
-	};
-	const operationNowMs = normalizeActiveSessionNowMs(input.nowMs);
-	const remainingUses = positiveInteger(input.remainingUses);
-	const expiresAtMs = positiveInteger(input.expiresAtMs);
-	if (operationNowMs == null || !Number.isSafeInteger(input.remainingUses) || !Number.isSafeInteger(input.expiresAtMs) || input.remainingUses < 0 || input.expiresAtMs <= 0) return {
-		ok: false,
-		reason: "invalid_budget"
-	};
-	const lifecycle = inactiveSigningSessionState({
-		remainingUses: Math.max(0, Math.floor(input.remainingUses)),
-		expiresAtMs: Math.max(0, Math.floor(input.expiresAtMs)),
-		nowMs: operationNowMs
-	});
-	if (lifecycle?.kind === "expired") return {
-		ok: false,
-		reason: "expired"
-	};
-	if (lifecycle?.kind === "exhausted") return {
-		ok: false,
-		reason: "exhausted"
-	};
-	let signingRoot;
-	try {
-		signingRoot = signingRootScopeFromRuntimePolicyScope(input.runtimePolicyScope);
-	} catch {
-		return {
-			ok: false,
-			reason: "missing_signing_root"
-		};
-	}
-	if (signingRoot.signingRootId !== nonEmptyString(input.signingRootId) || signingRoot.signingRootVersion !== nonEmptyString(input.signingRootVersion)) return {
-		ok: false,
-		reason: "signing_root_mismatch"
-	};
-	return {
-		ok: true,
-		value: {
-			curve: "ed25519",
-			auth,
-			walletSessionId: walletSessionId.value,
-			authorizationId: authorizationId.value,
-			quotaId: quotaId.value,
-			thresholdSessionId: thresholdSessionId.value,
-			remainingUses,
-			expiresAtMs,
-			runtimePolicyScope: input.runtimePolicyScope,
-			signingRootId: signingRoot.signingRootId,
-			signingRootVersion: nonEmptyString(signingRoot.signingRootVersion),
-			routerAbNormalSigning: input.routerAbNormalSigning
-		}
-	};
-}
-//#endregion
-export { buildRouterAbEd25519SigningWalletSession };
-
-//# sourceMappingURL=routerAbSigningWalletSession.js.map

package/dist/esm/core/signingEngine/session/sealedRecovery/exactRecordLookup.js

@@ -1,148 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
-import { normalizeSealedRecoveryRecord } from "./recoveryRecord.js";
-//#region src/core/signingEngine/session/sealedRecovery/exactRecordLookup.ts
-function sameString(left, right) {
-	return String(left ?? "").trim() === String(right ?? "").trim();
-}
-function sameStringLower(left, right) {
-	return String(left ?? "").trim().toLowerCase() === String(right ?? "").trim().toLowerCase();
-}
-function sameParticipantIds(left, right) {
-	if (left.length !== right.length) return false;
-	return left.every((participantId, index) => Number(participantId) === Number(right[index]));
-}
-function ecdsaRestoreRecordLaneIdentityMismatchReasons(record, lane) {
-	const reasons = [];
-	const signer = lane.signer;
-	if (!sameString(record.walletId, signer.walletId)) reasons.push("wallet_id");
-	if (!thresholdEcdsaChainTargetsEqual(record.chainTarget, signer.chainTarget)) reasons.push("chain_target");
-	if (!sameString(record.keyHandle, signer.keyHandle)) reasons.push("key_handle");
-	if (!sameString(record.ecdsaThresholdKeyId, signer.key.ecdsaThresholdKeyId)) reasons.push("ecdsa_threshold_key_id");
-	if (!sameString(record.signingRootId, signer.key.signingRootId)) reasons.push("signing_root_id");
-	if (!sameString(record.signingRootVersion, signer.key.signingRootVersion)) reasons.push("signing_root_version");
-	if (!sameStringLower(record.ethereumAddress, signer.key.thresholdOwnerAddress)) reasons.push("threshold_owner_address");
-	if (!sameParticipantIds(record.participantIds, signer.key.participantIds)) reasons.push("participant_ids");
-	if (record.authMethod !== lane.auth.kind) reasons.push("auth_method");
-	if (record.authMethod === "passkey") {
-		if (lane.auth.kind !== "passkey") {
-			reasons.push("passkey_auth_branch");
-			return reasons;
-		}
-		if (!sameString(record.authority.verifier.rpId, lane.auth.rpId)) reasons.push("rp_id");
-		if (!sameString(record.authority.factor.credentialIdB64u, lane.auth.credentialIdB64u)) reasons.push("credential_id");
-		return reasons;
-	}
-	if (lane.auth.kind !== "email_otp") {
-		reasons.push("email_otp_auth_branch");
-		return reasons;
-	}
-	if (!sameString(record.emailOtpAuthority.factor.providerUserId, lane.auth.providerSubjectId)) reasons.push("provider_subject_id");
-	return reasons;
-}
-function logEcdsaRestoreIdentityMismatch(args) {
-	console.warn("[SigningSessionRestore] ECDSA restore identity mismatch", JSON.stringify({
-		reasons: args.reasons,
-		record: {
-			authMethod: args.record.authMethod,
-			walletId: args.record.walletId,
-			source: args.record.source,
-			chainTarget: thresholdEcdsaChainTargetKey(args.record.chainTarget),
-			keyHandle: args.record.keyHandle,
-			ecdsaThresholdKeyId: args.record.ecdsaThresholdKeyId,
-			signingRootId: args.record.signingRootId,
-			signingRootVersion: args.record.signingRootVersion,
-			ethereumAddress: args.record.ethereumAddress,
-			participantIds: args.record.participantIds
-		},
-		lane: {
-			authMethod: args.lane.auth.kind,
-			walletId: args.lane.signer.walletId,
-			chainTarget: thresholdEcdsaChainTargetKey(args.lane.signer.chainTarget),
-			keyHandle: args.lane.signer.keyHandle,
-			ecdsaThresholdKeyId: args.lane.signer.key.ecdsaThresholdKeyId,
-			signingRootId: args.lane.signer.key.signingRootId,
-			signingRootVersion: args.lane.signer.key.signingRootVersion,
-			thresholdOwnerAddress: args.lane.signer.key.thresholdOwnerAddress,
-			participantIds: args.lane.signer.key.participantIds
-		}
-	}, null, 2));
-}
-function exactPurposeForAcceptedRecord(input, record) {
-	if (record.authMethod !== input.authMethod || !thresholdEcdsaChainTargetsEqual(record.chainTarget, input.chainTarget) || record.thresholdSessionId !== input.thresholdSessionId) return null;
-	const lane = input.materialRestoreIdentity.lane;
-	const mismatchReasons = ecdsaRestoreRecordLaneIdentityMismatchReasons(record, lane);
-	if (mismatchReasons.length > 0) {
-		logEcdsaRestoreIdentityMismatch({
-			record,
-			lane,
-			reasons: mismatchReasons
-		});
-		return null;
-	}
-	if (!sameString(record.ecdsaThresholdKeyId, input.materialRestoreIdentity.ecdsaThresholdKeyId) || !sameString(record.walletId, lane.signer.walletId) || !sameString(record.keyHandle, lane.signer.keyHandle)) return null;
-	if (!mpcMaterialActivationRefsEqual(record.roleLocalMaterialRef.materialActivation, lane.signer.materialActivation)) return null;
-	return {
-		record,
-		purpose: {
-			walletId: input.walletId,
-			authMethod: input.authMethod,
-			curve: "ecdsa",
-			chainTarget: input.chainTarget,
-			materialActivation: record.roleLocalMaterialRef.materialActivation,
-			thresholdSessionId: record.thresholdSessionId,
-			reason: input.reason
-		}
-	};
-}
-function buildRestoreWorkItemLookupResult(input, record) {
-	const normalized = normalizeSealedRecoveryRecord(record, {
-		allowExpired: false,
-		allowExhausted: false
-	});
-	if (normalized.kind === "rejected") return {
-		kind: "rejected",
-		rejection: normalized.rejection
-	};
-	const workItem = exactPurposeForAcceptedRecord(input, normalized.record);
-	return workItem ? {
-		kind: "matched",
-		workItem
-	} : { kind: "not_applicable" };
-}
-function listedPurposeForAcceptedRecord(args) {
-	if (!thresholdEcdsaChainTargetsEqual(args.record.chainTarget, args.requestedChainTarget)) return [];
-	return [{
-		record: args.record,
-		purpose: {
-			walletId: args.walletId,
-			authMethod: args.record.authMethod,
-			curve: "ecdsa",
-			chainTarget: args.requestedChainTarget,
-			materialActivation: args.record.roleLocalMaterialRef.materialActivation,
-			thresholdSessionId: args.record.thresholdSessionId,
-			reason: args.reason
-		}
-	}];
-}
-function buildRestoreWorkItemLookupResultsForListedRecord(args) {
-	const normalized = normalizeSealedRecoveryRecord(args.record);
-	if (normalized.kind === "rejected") return [{
-		kind: "rejected",
-		rejection: normalized.rejection
-	}];
-	const workItems = listedPurposeForAcceptedRecord({
-		walletId: args.walletId,
-		record: normalized.record,
-		reason: args.reason,
-		requestedChainTarget: args.requestedChainTarget
-	});
-	return workItems.length ? workItems.map((workItem) => ({
-		kind: "matched",
-		workItem
-	})) : [{ kind: "not_applicable" }];
-}
-//#endregion
-export { buildRestoreWorkItemLookupResult, buildRestoreWorkItemLookupResultsForListedRecord };
-
-//# sourceMappingURL=exactRecordLookup.js.map

package/dist/esm/core/signingEngine/session/sealedRecovery/recoveryRecord.js

@@ -1,248 +0,0 @@
-import { thresholdEcdsaChainTargetFromRequest } from "../../interfaces/ecdsaChainTarget.js";
-import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { normalizeThresholdRuntimePolicyScope } from "../../threshold/sessionPolicy.js";
-import { parseEcdsaRoleLocalPersistedMaterialRef } from "../keyMaterialBrands.js";
-import { buildPasskeyWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-//#region src/core/signingEngine/session/sealedRecovery/recoveryRecord.ts
-function normalizeNonEmptyString(value) {
-	return String(value ?? "").trim() || null;
-}
-function normalizeParticipantIds(value) {
-	if (!Array.isArray(value)) return [];
-	return value.map((participantId) => Math.floor(Number(participantId))).filter((participantId) => Number.isFinite(participantId) && participantId > 0);
-}
-function normalizeRouterAbEcdsaDerivationNormalSigningState(value) {
-	try {
-		return parseRouterAbEcdsaDerivationNormalSigningStateV1(value);
-	} catch {
-		return null;
-	}
-}
-function normalizeRouterAbEcdsaDerivationPublicCapability(value) {
-	try {
-		return parseRouterAbEcdsaDerivationPublicCapabilityV1(value);
-	} catch {
-		return null;
-	}
-}
-function normalizeEcdsaRestoreSource(value) {
-	switch (value) {
-		case "login":
-		case "registration":
-		case "manual-bootstrap":
-		case "email_otp": return value;
-		default: return null;
-	}
-}
-function normalizePasskeyEcdsaRestoreSource(value) {
-	const source = normalizeEcdsaRestoreSource(value);
-	return source && source !== "email_otp" ? source : null;
-}
-function normalizeRawObject(value) {
-	return value && typeof value === "object" ? value : null;
-}
-function normalizeThresholdSessionIds(record) {
-	return normalizeRawObject(record.thresholdSessionIds) || {};
-}
-function normalizeEthereumAddress(value) {
-	const normalized = String(value || "").trim().toLowerCase();
-	return /^0x[0-9a-f]{40}$/.test(normalized) ? normalized : null;
-}
-function buildPasskeyAuthorityForSealedRecord(args) {
-	try {
-		return buildPasskeyWalletAuthAuthority(args);
-	} catch {
-		return null;
-	}
-}
-function resolveSigningRootBinding(args) {
-	const explicitSigningRootId = normalizeNonEmptyString(args.rawSigningRootId);
-	const explicitSigningRootVersion = normalizeNonEmptyString(args.rawSigningRootVersion);
-	let runtimeSigningRootId = null;
-	let runtimeSigningRootVersion = null;
-	if (args.runtimePolicyScope) try {
-		const scope = signingRootScopeFromRuntimePolicyScope(args.runtimePolicyScope);
-		runtimeSigningRootId = normalizeNonEmptyString(scope.signingRootId);
-		runtimeSigningRootVersion = normalizeNonEmptyString(scope.signingRootVersion);
-	} catch {}
-	if (explicitSigningRootId && runtimeSigningRootId && explicitSigningRootId !== runtimeSigningRootId) return null;
-	if (explicitSigningRootVersion && runtimeSigningRootVersion && explicitSigningRootVersion !== runtimeSigningRootVersion) return null;
-	const signingRootId = explicitSigningRootId || runtimeSigningRootId;
-	const signingRootVersion = explicitSigningRootVersion || runtimeSigningRootVersion;
-	if (signingRootId && signingRootVersion) return {
-		signingRootId,
-		signingRootVersion
-	};
-	return null;
-}
-function hasRawSigningRootBinding(record) {
-	return Boolean(normalizeNonEmptyString(record.signingRootId) || normalizeNonEmptyString(record.signingRootVersion));
-}
-function hasRawLegacySealedRecoveryIdentity(record) {
-	return Boolean(normalizeNonEmptyString(record.subjectId) || normalizeNonEmptyString(record.userId));
-}
-function safeSummary(record) {
-	const thresholdSessionIds = normalizeThresholdSessionIds(record);
-	return {
-		authMethod: record.authMethod,
-		curve: record.curve,
-		storeKey: record.storeKey,
-		walletId: record.walletId || null,
-		thresholdSessionIds,
-		issuedAtMs: record.issuedAtMs,
-		expiresAtMs: record.expiresAtMs,
-		remainingUses: record.remainingUses,
-		updatedAtMs: record.updatedAtMs,
-		hasEcdsaRestore: Boolean(record.ecdsaRestore)
-	};
-}
-function reject(record, reason) {
-	return {
-		kind: "rejected",
-		rejection: {
-			kind: "rejected_sealed_recovery_record",
-			storeKey: normalizeNonEmptyString(record.storeKey),
-			walletId: normalizeNonEmptyString(record.walletId),
-			reason,
-			safeSummary: safeSummary(record)
-		}
-	};
-}
-function normalizeSealedRecoveryRecord(raw, options = {}) {
-	const thresholdSessionIds = normalizeThresholdSessionIds(raw);
-	const ecdsaRestore = normalizeRawObject(raw.ecdsaRestore);
-	const storeKey = normalizeNonEmptyString(raw.storeKey);
-	const walletId = normalizeNonEmptyString(raw.walletId);
-	const sealedSecretB64u = normalizeNonEmptyString(raw.sealedSecretB64u);
-	const issuedAtMs = Math.floor(Number(raw.issuedAtMs) || 0);
-	const expiresAtMs = Math.floor(Number(raw.expiresAtMs) || 0);
-	const remainingUses = Math.floor(Number(raw.remainingUses) || 0);
-	const updatedAtMs = Math.floor(Number(raw.updatedAtMs) || 0);
-	if (raw.authMethod !== "passkey" && raw.authMethod !== "email_otp" || raw.curve !== "ecdsa") return reject(raw, "unsupported_record");
-	if (!storeKey || !walletId || !sealedSecretB64u) return reject(raw, "missing_identity");
-	if (expiresAtMs <= 0 || updatedAtMs <= 0 || issuedAtMs <= 0) return reject(raw, "missing_restore_metadata");
-	if (hasRawLegacySealedRecoveryIdentity(raw)) return reject(raw, "invalid_identity");
-	if (!options.allowExpired && expiresAtMs <= Date.now()) return reject(raw, "expired");
-	if (!options.allowExhausted && raw.authMethod !== "passkey" && remainingUses <= 0) return reject(raw, "exhausted");
-	const thresholdSessionId = normalizeNonEmptyString(thresholdSessionIds.ecdsa);
-	const restore = ecdsaRestore;
-	const runtimePolicyScope = normalizeThresholdRuntimePolicyScope(restore?.runtimePolicyScope);
-	const signingRootBinding = resolveSigningRootBinding({
-		runtimePolicyScope,
-		rawSigningRootId: restore?.signingRootId,
-		rawSigningRootVersion: restore?.signingRootVersion
-	});
-	const relayerUrl = normalizeNonEmptyString(raw.relayerUrl);
-	const passkeyRpId = raw.authMethod === "passkey" ? normalizeNonEmptyString(restore?.rpId) : null;
-	const passkeySource = raw.authMethod === "passkey" ? normalizePasskeyEcdsaRestoreSource(restore?.source) : null;
-	const emailOtpSource = raw.authMethod === "email_otp" && normalizeEcdsaRestoreSource(restore?.source) === "email_otp" ? "email_otp" : null;
-	const credentialIdB64u = normalizeNonEmptyString(restore?.credentialIdB64u);
-	const providerSubjectId = normalizeNonEmptyString(restore?.providerSubjectId);
-	const emailHashHex = normalizeNonEmptyString(restore?.emailHashHex);
-	const relayerKeyId = normalizeNonEmptyString(restore?.relayerKeyId);
-	const keyHandle = normalizeNonEmptyString(restore?.keyHandle);
-	const ecdsaThresholdKeyId = normalizeNonEmptyString(restore?.ecdsaThresholdKeyId);
-	const ethereumAddress = normalizeEthereumAddress(restore?.ethereumAddress);
-	const thresholdEcdsaPublicKeyB64u = normalizeNonEmptyString(restore?.thresholdEcdsaPublicKeyB64u);
-	const participantIds = normalizeParticipantIds(restore?.participantIds);
-	const routerAbEcdsaDerivationNormalSigning = normalizeRouterAbEcdsaDerivationNormalSigningState(restore?.routerAbEcdsaDerivationNormalSigning);
-	const publicCapability = normalizeRouterAbEcdsaDerivationPublicCapability(restore?.publicCapability);
-	let roleLocalMaterialRef = null;
-	try {
-		roleLocalMaterialRef = parseEcdsaRoleLocalPersistedMaterialRef(restore?.roleLocalMaterialRef);
-	} catch {
-		roleLocalMaterialRef = null;
-	}
-	const clientVerifyingShareB64u = normalizeNonEmptyString(restore?.clientVerifyingShareB64u);
-	const passkeyClientVerifyingShareB64u = raw.authMethod === "passkey" ? clientVerifyingShareB64u : null;
-	if (restore?.sessionKind != null) return reject(raw, "invalid_identity");
-	if (hasRawSigningRootBinding(raw)) return reject(raw, "invalid_identity");
-	if (!thresholdSessionId || !signingRootBinding) return reject(raw, "missing_identity");
-	if (!restore?.chainTarget) return reject(raw, "wrong_chain_target");
-	let chainTarget;
-	try {
-		chainTarget = thresholdEcdsaChainTargetFromRequest(restore.chainTarget);
-	} catch {
-		return reject(raw, "wrong_chain_target");
-	}
-	if (!relayerUrl || raw.authMethod === "passkey" && !passkeySource || raw.authMethod === "email_otp" && !emailOtpSource || raw.authMethod === "passkey" && !passkeyRpId || raw.authMethod === "passkey" && !credentialIdB64u || raw.authMethod === "email_otp" && (!providerSubjectId || !emailHashHex) || !ecdsaThresholdKeyId || !relayerKeyId || !keyHandle || !ethereumAddress || !thresholdEcdsaPublicKeyB64u || !runtimePolicyScope || !routerAbEcdsaDerivationNormalSigning || !publicCapability || !participantIds.length || !roleLocalMaterialRef || raw.authMethod === "passkey" && !passkeyClientVerifyingShareB64u) return reject(raw, "missing_restore_metadata");
-	const passkeyAuthority = raw.authMethod === "passkey" ? buildPasskeyAuthorityForSealedRecord({
-		walletId,
-		rpId: passkeyRpId,
-		credentialIdB64u
-	}) : null;
-	const authority = parseWalletAuthAuthorityRef(restore.authority);
-	const parsedAuthority = parseEmailOtpWalletAuthAuthority(restore.emailOtpAuthority);
-	const emailOtpAuthority = raw.authMethod === "email_otp" && authority && parsedAuthority && parsedAuthority.walletId === walletId && parsedAuthority.factor.provider === restore.provider && parsedAuthority.factor.providerUserId === providerSubjectId && parsedAuthority.verifier.emailHashHex === emailHashHex ? parsedAuthority : null;
-	if (raw.authMethod === "passkey" && !passkeyAuthority || raw.authMethod === "email_otp" && !emailOtpAuthority) return reject(raw, "invalid_identity");
-	return {
-		kind: "accepted",
-		record: raw.authMethod === "passkey" ? {
-			storeKey,
-			walletId,
-			authMethod: "passkey",
-			curve: "ecdsa",
-			thresholdSessionId,
-			sealedSecretB64u,
-			issuedAtMs,
-			expiresAtMs,
-			remainingUses,
-			updatedAtMs,
-			...normalizeNonEmptyString(raw.keyVersion) ? { keyVersion: normalizeNonEmptyString(raw.keyVersion) } : {},
-			...normalizeNonEmptyString(raw.groupId) ? { groupId: normalizeNonEmptyString(raw.groupId) } : {},
-			chainTarget,
-			source: passkeySource,
-			authority: passkeyAuthority,
-			signingRootId: signingRootBinding.signingRootId,
-			signingRootVersion: signingRootBinding.signingRootVersion,
-			keyHandle,
-			ecdsaThresholdKeyId,
-			ethereumAddress,
-			thresholdEcdsaPublicKeyB64u,
-			participantIds,
-			relayerUrl,
-			relayerKeyId,
-			runtimePolicyScope,
-			routerAbEcdsaDerivationNormalSigning,
-			publicCapability,
-			clientVerifyingShareB64u: passkeyClientVerifyingShareB64u,
-			roleLocalMaterialRef
-		} : {
-			storeKey,
-			walletId,
-			authMethod: "email_otp",
-			curve: "ecdsa",
-			thresholdSessionId,
-			sealedSecretB64u,
-			issuedAtMs,
-			expiresAtMs,
-			remainingUses,
-			updatedAtMs,
-			...normalizeNonEmptyString(raw.keyVersion) ? { keyVersion: normalizeNonEmptyString(raw.keyVersion) } : {},
-			...normalizeNonEmptyString(raw.groupId) ? { groupId: normalizeNonEmptyString(raw.groupId) } : {},
-			chainTarget,
-			source: "email_otp",
-			authority,
-			emailOtpAuthority,
-			signingRootId: signingRootBinding.signingRootId,
-			signingRootVersion: signingRootBinding.signingRootVersion,
-			keyHandle,
-			ecdsaThresholdKeyId,
-			ethereumAddress,
-			thresholdEcdsaPublicKeyB64u,
-			participantIds,
-			relayerUrl,
-			relayerKeyId,
-			runtimePolicyScope,
-			routerAbEcdsaDerivationNormalSigning,
-			publicCapability,
-			...clientVerifyingShareB64u ? { clientVerifyingShareB64u } : {},
-			roleLocalMaterialRef
-		}
-	};
-}
-//#endregion
-export { normalizeSealedRecoveryRecord };
-
-//# sourceMappingURL=recoveryRecord.js.map