@swivy/web 0.0.0-stage → 1.0.1

package/dist/packages/web/src/index.js

@@ -0,0 +1,1331 @@
+import { browserSupportsWebAuthn, browserSupportsWebAuthnAutofill, platformAuthenticatorIsAvailable, startAuthentication, startRegistration, } from "@simplewebauthn/browser";
+import { generateExportRecipientKeyPair, openSealedExport } from "@swivy/core";
+import { createOfflineTransactionSigningEnvelope, createOfflineTransactionSigningResponseEnvelope, decodeOfflineSigningEnvelope, encodeOfflineSigningEnvelope, verifyOfflineSigningEnvelopeSignature, } from "@swivy/core";
+import { clearDeviceShare, createBrowserSplitWalletMaterial, decodeRecoveryPackage, exportPrivateKeyFromShares, loadDeviceShare, parseServerShareRecord, signMessageLocallyWithShares, signTransactionLocallyWithShares, signTypedDataLocallyWithShares, storeDeviceShare, } from "./local-wallet.js";
+export class SwivyWebAuthnError extends Error {
+    name = "SwivyWebAuthnError";
+    code;
+    operation;
+    retryable;
+    recoveryHint;
+    browserErrorName;
+    rawMessage;
+    cause;
+    constructor(params) {
+        super(params.userMessage);
+        this.code = params.code;
+        this.operation = params.operation;
+        this.retryable = params.retryable;
+        this.recoveryHint = params.recoveryHint;
+        this.browserErrorName = params.browserErrorName ?? null;
+        this.rawMessage = params.rawMessage ?? null;
+        this.cause = params.cause;
+    }
+}
+export function isSwivyWebAuthnError(error) {
+    return error instanceof SwivyWebAuthnError;
+}
+function parseJsonResponseBody(response, text) {
+    if (!text) {
+        return {};
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        const contentType = response.headers.get("content-type") ?? "";
+        if (response.ok) {
+            throw new Error(contentType ? `invalid_json_response:${contentType}` : "invalid_json_response");
+        }
+        throw new Error(`http_${response.status}_non_json_response`);
+    }
+}
+function resolveResponseErrorMessage(response, payload) {
+    if (typeof payload?.error === "string" && payload.error) {
+        return payload.error;
+    }
+    if (typeof payload?.error?.message === "string" && payload.error.message) {
+        return payload.error.message;
+    }
+    if (typeof payload?.message === "string" && payload.message) {
+        return payload.message;
+    }
+    return response.statusText || `http_${response.status}`;
+}
+function containsPattern(value, patterns) {
+    return patterns.some((pattern) => value.includes(pattern));
+}
+function normalizeWebAuthnOperationLabel(operation) {
+    switch (operation) {
+        case "passkey_registration":
+            return "passkey registration";
+        case "intent_approval":
+            return "passkey approval";
+        case "wallet_reconstruction":
+            return "wallet reconstruction approval";
+        case "account_export":
+            return "wallet export approval";
+        case "session_delegation":
+            return "delegated session approval";
+        case "recovery":
+            return "account recovery approval";
+        default:
+            return "passkey request";
+    }
+}
+function normalizeWebAuthnErrorCode(name, message) {
+    if (name === "securityerror"
+        || containsPattern(message, [
+            "rp id",
+            "rpid",
+            "origin",
+            "same origin",
+            "registrable domain suffix",
+        ])) {
+        return "webauthn_wrong_origin";
+    }
+    if (name === "invalidstateerror"
+        || containsPattern(message, [
+            "already registered",
+            "already exists",
+            "credential already",
+        ])) {
+        return "webauthn_credential_already_registered";
+    }
+    if (containsPattern(message, [
+        "challenge_expired",
+        "challenge expired",
+        "stale challenge",
+        "challenge already used",
+        "challenge consumed",
+        "challenge is no longer valid",
+        "expired challenge",
+    ])) {
+        return "webauthn_stale_challenge";
+    }
+    if (containsPattern(message, [
+        "no credential",
+        "credential not found",
+        "credential is not recognized",
+        "credential not recognized",
+        "unknown credential",
+        "no passkeys available",
+        "no passkey available",
+        "no matching credential",
+    ])) {
+        return "webauthn_missing_credential";
+    }
+    if (name === "aborterror"
+        || containsPattern(message, [
+            "timed out or was not allowed",
+            "operation either timed out or was not allowed",
+            "cancelled",
+            "canceled",
+            "aborted",
+            "dismissed",
+            "timed out",
+        ])) {
+        return "webauthn_canceled";
+    }
+    if (name === "notallowederror") {
+        return "webauthn_not_allowed";
+    }
+    return "webauthn_failed";
+}
+function buildWebAuthnErrorMetadata(code, operation) {
+    const operationLabel = normalizeWebAuthnOperationLabel(operation);
+    switch (code) {
+        case "webauthn_not_supported":
+            return {
+                userMessage: "Passkeys are not supported in this browser or device.",
+                retryable: false,
+                recoveryHint: "Retry from a browser and device that support WebAuthn passkeys.",
+            };
+        case "webauthn_wrong_origin":
+            return {
+                userMessage: `This ${operationLabel} was started from the wrong browser origin.`,
+                retryable: false,
+                recoveryHint: "Open the expected auth domain and verify the configured WebAuthn RP ID and allowed origins.",
+            };
+        case "webauthn_stale_challenge":
+            return {
+                userMessage: `This ${operationLabel} has expired or was already used.`,
+                retryable: true,
+                recoveryHint: "Start a fresh passkey challenge and try again.",
+            };
+        case "webauthn_missing_credential":
+            return {
+                userMessage: `No matching passkey was available for this ${operationLabel}.`,
+                retryable: true,
+                recoveryHint: "Use the device that enrolled the passkey, or enroll a new passkey from an active session.",
+            };
+        case "webauthn_canceled":
+            return {
+                userMessage: `The ${operationLabel} was canceled or timed out before completion.`,
+                retryable: true,
+                recoveryHint: "Retry the passkey prompt and complete it on the device authenticator.",
+            };
+        case "webauthn_credential_already_registered":
+            return {
+                userMessage: "This passkey is already registered for the current account.",
+                retryable: false,
+                recoveryHint: "Reuse the active passkey instead of enrolling it again.",
+            };
+        case "webauthn_not_allowed":
+            return {
+                userMessage: `The browser or authenticator did not allow this ${operationLabel}.`,
+                retryable: true,
+                recoveryHint: "Retry and make sure the browser can access the expected passkey authenticator.",
+            };
+        case "webauthn_failed":
+        default:
+            return {
+                userMessage: `The ${operationLabel} failed.`,
+                retryable: true,
+                recoveryHint: "Retry once. If it fails again, inspect the browser and server logs for the passkey flow.",
+            };
+    }
+}
+function toSwivyWebAuthnError(error, operation) {
+    if (isSwivyWebAuthnError(error)) {
+        return error;
+    }
+    const browserErrorName = typeof error === "object" && error && "name" in error && typeof error.name === "string"
+        ? error.name
+        : null;
+    const rawMessage = typeof error === "object" && error && "message" in error && typeof error.message === "string"
+        ? error.message
+        : error instanceof Error
+            ? error.message
+            : typeof error === "string"
+                ? error
+                : null;
+    const code = normalizeWebAuthnErrorCode(browserErrorName?.toLowerCase() ?? "", rawMessage?.toLowerCase() ?? "");
+    const metadata = buildWebAuthnErrorMetadata(code, operation);
+    return new SwivyWebAuthnError({
+        code,
+        operation,
+        browserErrorName,
+        rawMessage,
+        cause: error,
+        ...metadata,
+    });
+}
+export class SwivyBrowserClient {
+    config;
+    sessionToken;
+    sessionTokenListeners = new Set();
+    sessionPersistence;
+    embeddedWalletStorage;
+    embeddedWalletStorageKeyPrefix;
+    constructor(config) {
+        this.config = config;
+        this.sessionPersistence = this.resolveSessionPersistence();
+        this.embeddedWalletStorage = this.resolveEmbeddedWalletStorage();
+        this.embeddedWalletStorageKeyPrefix =
+            config.embeddedWalletStorageKeyPrefix ?? "swivy:embedded-wallet-share";
+        this.sessionToken = config.sessionToken ?? this.sessionPersistence?.load();
+    }
+    getSessionToken() {
+        return this.sessionToken;
+    }
+    setSessionToken(token) {
+        this.sessionToken = token;
+        if (token) {
+            this.sessionPersistence?.save(token);
+        }
+        else {
+            this.sessionPersistence?.clear();
+        }
+        for (const listener of this.sessionTokenListeners) {
+            listener(token);
+        }
+    }
+    clearSessionToken() {
+        this.setSessionToken(undefined);
+    }
+    onSessionTokenChange(listener) {
+        this.sessionTokenListeners.add(listener);
+        return () => {
+            this.sessionTokenListeners.delete(listener);
+        };
+    }
+    async requestEmailCode(email, externalUserId) {
+        return this.request("/v1/runtime/auth/email/request", {
+            method: "POST",
+            body: { email, externalUserId },
+        });
+    }
+    async verifyEmailCode(email, code, externalUserId) {
+        const payload = await this.request("/v1/runtime/auth/email/verify", {
+            method: "POST",
+            body: { email, code, externalUserId },
+        });
+        this.setSessionToken(payload.sessionToken);
+        return payload;
+    }
+    async verifyEmailCodeAndBootstrapWallets(email, code, externalUserId) {
+        const payload = (await this.verifyEmailCode(email, code, externalUserId));
+        return this.bootstrapEmbeddedWallets(payload);
+    }
+    /** Create a new account with a passkey only (Privy signupWithPasskey). */
+    async signupWithPasskey(options = {}) {
+        this.assertWebAuthnSupport("passkey_registration");
+        const started = await this.request("/v1/runtime/auth/passkeys/signup/start", {
+            method: "POST",
+            body: { displayName: options.displayName },
+        });
+        const registrationResponse = await startRegistration({ optionsJSON: started.options });
+        const payload = await this.request("/v1/runtime/auth/passkeys/signup/finish", {
+            method: "POST",
+            body: { challengeId: started.challengeId, registrationResponse },
+        });
+        this.setSessionToken(payload.sessionToken);
+        return payload;
+    }
+    /** Log in with any passkey registered for this app (Privy loginWithPasskey). */
+    async loginWithPasskey(options = {}) {
+        this.assertWebAuthnSupport("login");
+        const started = await this.request("/v1/runtime/auth/passkeys/login/start", { method: "POST", body: {} });
+        const authenticationResponse = await startAuthentication({
+            optionsJSON: started.options,
+            useBrowserAutofill: options.useBrowserAutofill,
+        });
+        const payload = await this.request("/v1/runtime/auth/passkeys/login/verify", {
+            method: "POST",
+            body: { challengeId: started.challengeId, authenticationResponse },
+        });
+        this.setSessionToken(payload.sessionToken);
+        return payload;
+    }
+    /** Send a login code by SMS (Privy loginWithSMS, step 1). Phone in E.164, e.g. +14155550123. */
+    async requestSmsCode(phoneNumber) {
+        return this.request("/v1/runtime/auth/sms/request", { method: "POST", body: { phoneNumber } });
+    }
+    async verifySmsCode(challengeId, code) {
+        const payload = await this.request("/v1/runtime/auth/sms/verify", {
+            method: "POST",
+            body: { challengeId, code },
+        });
+        this.setSessionToken(payload.sessionToken);
+        return payload;
+    }
+    async exchangeOidcToken(token) {
+        const payload = await this.request("/v1/runtime/auth/oidc/exchange", {
+            method: "POST",
+            body: { token },
+        });
+        this.setSessionToken(payload.sessionToken);
+        return payload;
+    }
+    async exchangeOidcTokenAndBootstrapWallets(token) {
+        const payload = (await this.exchangeOidcToken(token));
+        return this.bootstrapEmbeddedWallets(payload);
+    }
+    async requestWalletLogin(options) {
+        return this.request("/v1/runtime/auth/wallet/request", {
+            method: "POST",
+            body: options,
+        });
+    }
+    async verifyWalletLogin(options) {
+        const payload = await this.request("/v1/runtime/auth/wallet/verify", {
+            method: "POST",
+            body: options,
+        });
+        this.setSessionToken(payload.sessionToken);
+        return payload;
+    }
+    async verifyWalletLoginAndBootstrapWallets(options) {
+        const payload = (await this.verifyWalletLogin(options));
+        return this.bootstrapEmbeddedWallets(payload);
+    }
+    async authenticate(options) {
+        const session = options.method === "oidc"
+            ? await this.exchangeOidcTokenAndBootstrapWallets(options.token)
+            : options.method === "wallet"
+                ? await this.verifyWalletLoginAndBootstrapWallets({
+                    chain: options.chain,
+                    address: options.address,
+                    challengeId: options.challengeId,
+                    signature: options.signature,
+                })
+                : await this.verifyEmailCodeAndBootstrapWallets(options.email, options.code, options.externalUserId);
+        return this.attachWalletTools(session);
+    }
+    async hydrateRuntimeSession() {
+        const session = await this.bootstrapEmbeddedWallets();
+        return this.attachWalletTools(session);
+    }
+    async startTotp(label = "Authenticator app") {
+        return this.request("/v1/runtime/mfa/totp/start", {
+            method: "POST",
+            body: { label },
+            runtime: true,
+        });
+    }
+    async verifyTotp(authMethodId, code) {
+        return this.request("/v1/runtime/mfa/totp/verify", {
+            method: "POST",
+            body: { authMethodId, code },
+            runtime: true,
+        });
+    }
+    async startSmsEnrollment(phoneNumber, label = "SMS") {
+        return this.request("/v1/runtime/mfa/sms/start", {
+            method: "POST",
+            body: { phoneNumber, label },
+            runtime: true,
+        });
+    }
+    async verifySmsEnrollment(authMethodId, challengeId, code) {
+        return this.request("/v1/runtime/mfa/sms/verify", {
+            method: "POST",
+            body: { authMethodId, challengeId, code },
+            runtime: true,
+        });
+    }
+    async getMe() {
+        return this.request("/v1/runtime/me", { method: "GET", runtime: true });
+    }
+    async createManagedAccount(chain, options) {
+        const normalizedOptions = typeof options === "string" ? { label: options } : options;
+        if (normalizedOptions?.custodyMode === "split_custody" && !normalizedOptions.splitCustody) {
+            return this.createBrowserSplitWallet(chain, { label: normalizedOptions.label });
+        }
+        return this.request("/v1/runtime/accounts/managed", {
+            method: "POST",
+            body: { chain, ...normalizedOptions },
+            runtime: true,
+        });
+    }
+    async listAccounts() {
+        return this.request("/v1/runtime/accounts", { method: "GET", runtime: true });
+    }
+    async listWalletTools() {
+        return this.request("/v1/runtime/tools", { method: "GET", runtime: true });
+    }
+    async createLifiQuote(body) {
+        return this.request("/v1/runtime/tools/lifi/quote", {
+            method: "POST",
+            body,
+            runtime: true,
+        });
+    }
+    async createJupiterQuote(body) {
+        return this.request("/v1/runtime/tools/jupiter/quote", {
+            method: "POST",
+            body,
+            runtime: true,
+        });
+    }
+    async createSwapQuote(body) {
+        return this.request("/v1/runtime/swaps/quote", {
+            method: "POST",
+            body,
+            runtime: true,
+        });
+    }
+    async listEmbeddedWallets() {
+        const payload = await this.listAccounts();
+        return payload.managedAccounts;
+    }
+    async getManagedAccount(chain, options) {
+        const payload = await this.listAccounts();
+        return (payload.managedAccounts.find((account) => account.chain === chain &&
+            (!options?.purpose || ((account.purpose ?? "agent") === options.purpose))) ?? null);
+    }
+    async getEmbeddedWallet(chain) {
+        return this.getManagedAccount(chain);
+    }
+    async ensureManagedAccount(chain, options) {
+        const normalizedOptions = typeof options === "string" ? { label: options } : options;
+        const purpose = normalizedOptions?.purpose ??
+            (normalizedOptions?.custodyMode === "split_custody" ? "personal" : "agent");
+        const existing = await this.getManagedAccount(chain, {
+            purpose,
+        });
+        if (existing) {
+            return {
+                account: existing,
+                existing: true,
+            };
+        }
+        if (normalizedOptions?.custodyMode === "split_custody" && !normalizedOptions.splitCustody) {
+            return this.ensureBrowserSplitWallet(chain, { label: normalizedOptions.label });
+        }
+        const created = await this.createManagedAccount(chain, normalizedOptions);
+        return {
+            account: created.account,
+            existing: Boolean(created.existing),
+            attestation: created.attestation,
+        };
+    }
+    async ensureEmbeddedWallet(chain, options) {
+        return this.ensureManagedAccount(chain, options);
+    }
+    async bootstrapEmbeddedWallets(payload) {
+        const sessionPayload = payload ?? (await this.getMe());
+        const missingChains = this.getMissingSplitCustodyChains(sessionPayload);
+        if (missingChains.length === 0) {
+            return sessionPayload;
+        }
+        this.requireEmbeddedWalletStorage();
+        for (const chain of missingChains) {
+            await this.createBrowserSplitWallet(chain, {
+                label: chain === "evm" ? "EVM Wallet" : "Solana Wallet",
+            });
+        }
+        const accounts = await this.listAccounts();
+        return {
+            ...sessionPayload,
+            managedAccounts: accounts.managedAccounts,
+            linkedWallets: accounts.linkedWallets,
+        };
+    }
+    async createChallenge(authMethodId, purpose) {
+        return this.request("/v1/runtime/mfa/challenges", {
+            method: "POST",
+            body: { authMethodId, purpose },
+            runtime: true,
+        });
+    }
+    async verifyChallenge(challengeId, payload) {
+        return this.request("/v1/runtime/mfa/challenges/verify", {
+            method: "POST",
+            body: { challengeId, ...payload },
+            runtime: true,
+        });
+    }
+    async isWebAuthnSupported() {
+        return browserSupportsWebAuthn();
+    }
+    async isPlatformAuthenticatorAvailable() {
+        return platformAuthenticatorIsAvailable();
+    }
+    async isWebAuthnAutofillSupported() {
+        return browserSupportsWebAuthnAutofill();
+    }
+    async startPasskeyRegistration(label = "Passkey") {
+        return this.request("/v1/runtime/mfa/passkeys/register/start", {
+            method: "POST",
+            body: { label },
+            runtime: true,
+        });
+    }
+    async finishPasskeyRegistration(authMethodId, challengeId, registrationResponse) {
+        return this.request("/v1/runtime/mfa/passkeys/register/finish", {
+            method: "POST",
+            body: { authMethodId, challengeId, registrationResponse },
+            runtime: true,
+        });
+    }
+    async enrollPasskey(label = "Passkey", options) {
+        this.assertWebAuthnSupport("passkey_registration");
+        try {
+            const started = await this.startPasskeyRegistration(label);
+            const registrationResponse = await startRegistration({
+                optionsJSON: started.options,
+                useAutoRegister: options?.useAutoRegister,
+            });
+            const completed = await this.finishPasskeyRegistration(started.authMethod.id, started.challengeId, registrationResponse);
+            return {
+                ...completed,
+                started,
+                registrationResponse,
+            };
+        }
+        catch (error) {
+            throw toSwivyWebAuthnError(error, "passkey_registration");
+        }
+    }
+    async ensurePasskey(label = "Passkey", options) {
+        const me = (await this.getMe());
+        const existing = (me.authMethods ?? []).find((method) => method.type === "passkey" && method.active);
+        if (existing) {
+            return {
+                authMethod: existing,
+                existing: true,
+            };
+        }
+        const enrollment = await this.enrollPasskey(label, options);
+        const authMethod = (enrollment.authMethod
+            ?? enrollment.started.authMethod);
+        return {
+            authMethod,
+            existing: false,
+            enrollment,
+        };
+    }
+    async completePasskeyChallenge(challengeId, optionsJSON, operation, options) {
+        this.assertWebAuthnSupport(operation);
+        try {
+            const authenticationResponse = await startAuthentication({
+                optionsJSON,
+                useBrowserAutofill: options?.useBrowserAutofill,
+                verifyBrowserAutofillInput: options?.verifyBrowserAutofillInput,
+            });
+            const verification = await this.verifyChallenge(challengeId, {
+                authenticationResponse,
+            });
+            return {
+                verification,
+                authenticationResponse,
+            };
+        }
+        catch (error) {
+            throw toSwivyWebAuthnError(error, operation);
+        }
+    }
+    async approveWithPasskey(authMethodId, purpose, options) {
+        try {
+            const challenge = (await this.createChallenge(authMethodId, purpose));
+            if (!challenge.options) {
+                throw new Error("passkey challenge options missing");
+            }
+            const completed = await this.completePasskeyChallenge(challenge.challengeId, challenge.options, purpose, options);
+            return {
+                challenge,
+                ...completed,
+            };
+        }
+        catch (error) {
+            throw toSwivyWebAuthnError(error, purpose);
+        }
+    }
+    async approveWalletReconstructionWithPasskey(authMethodId, options) {
+        return this.approveWithPasskey(authMethodId, "wallet_reconstruction", options);
+    }
+    async prepareLocalWalletWithPasskey(accountId, options = {}) {
+        const account = await this.requireManagedAccountById(accountId);
+        if (account.custodyMode !== "split_custody") {
+            throw new Error("local_wallet_requires_split_custody");
+        }
+        const passkey = options.authMethodId
+            ? {
+                authMethod: {
+                    id: options.authMethodId,
+                    type: "passkey",
+                    label: "Provided passkey",
+                    active: true,
+                },
+                existing: true,
+            }
+            : await this.ensurePasskey(options.passkeyLabel ?? "Primary passkey", {
+                useAutoRegister: options.useAutoRegister,
+            });
+        const approval = await this.approveWalletReconstructionWithPasskey(passkey.authMethod.id, options);
+        return {
+            account,
+            passkey,
+            approval,
+        };
+    }
+    async createSigningIntent(body) {
+        return this.request("/v1/runtime/intents/signing", {
+            method: "POST",
+            body,
+            runtime: true,
+        });
+    }
+    async createTransactionIntent(body) {
+        return this.request("/v1/runtime/intents/transactions", {
+            method: "POST",
+            body,
+            runtime: true,
+        });
+    }
+    async getIntent(intentId) {
+        return this.request(`/v1/runtime/intents/${intentId}`, {
+            method: "GET",
+            runtime: true,
+        });
+    }
+    async waitForIntent(intentId, options = {}) {
+        const timeoutMs = options.timeoutMs ?? 30_000;
+        const pollIntervalMs = options.pollIntervalMs ?? 1_000;
+        const startedAt = Date.now();
+        for (;;) {
+            if (options.signal?.aborted) {
+                throw new Error("intent_wait_aborted");
+            }
+            const payload = (await this.getIntent(intentId));
+            const intent = payload.intent;
+            if (intent.status === "completed" || intent.status === "failed") {
+                return intent;
+            }
+            if (Date.now() - startedAt >= timeoutMs) {
+                throw new Error("intent_wait_timeout");
+            }
+            await this.delay(pollIntervalMs, options.signal);
+        }
+    }
+    async createSigningIntentAndWait(body, options) {
+        const payload = (await this.createSigningIntent(body));
+        return this.waitForIntent(payload.intent.id, options);
+    }
+    async signMessageAndWait(body, options) {
+        return this.createSigningIntentAndWait(body, options);
+    }
+    async signTypedDataAndWait(body, options) {
+        return this.createSigningIntentAndWait({
+            accountId: body.accountId,
+            chain: "evm",
+            challengeId: body.challengeId,
+            payload: {
+                typedData: body.typedData,
+            },
+        }, options);
+    }
+    async signTransactionAndWait(body, options) {
+        return this.createSigningIntentAndWait(body, options);
+    }
+    async createTransactionIntentAndWait(body, options) {
+        const payload = (await this.createTransactionIntent(body));
+        return this.waitForIntent(payload.intent.id, options);
+    }
+    async executeTransactionAndWait(body, options) {
+        return this.createTransactionIntentAndWait(body, options);
+    }
+    async exportManagedAccount(accountId, challengeId) {
+        // The key comes back HPKE-sealed to a one-time key made here, so it is never in
+        // clear on the wire or in the API; it is opened locally.
+        const recipient = generateExportRecipientKeyPair();
+        const payload = await this.request(`/v1/runtime/accounts/${accountId}/export`, {
+            method: "POST",
+            body: { challengeId, recipientPublicKey: recipient.publicKeyBase64 },
+            runtime: true,
+        });
+        if (!payload.encryption) {
+            // An older API ignored recipientPublicKey and sent the key in clear: refuse it.
+            throw new Error("sealed_export_not_supported_by_server");
+        }
+        const { encryption, ...rest } = payload;
+        // Pin what the server says it bound the ciphertext to.
+        if (encryption.info !== "swivy-export-v1" || !String(encryption.aad).startsWith(`swivy-export:${accountId}:`)) {
+            throw new Error("sealed_export_binding_mismatch");
+        }
+        return { ...rest, privateKey: openSealedExport(encryption, recipient.privateKey) };
+    }
+    async rawSign(accountId, challengeId, payload) {
+        return this.request(`/v1/runtime/accounts/${accountId}/raw-sign`, {
+            method: "POST",
+            body: {
+                challengeId,
+                payload,
+            },
+            runtime: true,
+        });
+    }
+    async getAccountCustody(accountId) {
+        return this.request(`/v1/runtime/accounts/${accountId}/custody`, {
+            method: "GET",
+            runtime: true,
+        });
+    }
+    async enableSplitCustody(accountId, splitCustody) {
+        return this.request(`/v1/runtime/accounts/${accountId}/custody/split`, {
+            method: "POST",
+            body: splitCustody,
+            runtime: true,
+        });
+    }
+    async createSessionGrant(body) {
+        return this.request("/v1/runtime/session-grants", {
+            method: "POST",
+            body,
+            runtime: true,
+        });
+    }
+    async listSessionGrants() {
+        return this.request("/v1/runtime/session-grants", {
+            method: "GET",
+            runtime: true,
+        });
+    }
+    async revokeSessionGrant(grantId) {
+        return this.request(`/v1/runtime/session-grants/${grantId}/revoke`, {
+            method: "POST",
+            runtime: true,
+        });
+    }
+    async createBrowserSplitWallet(chain, options) {
+        this.requireEmbeddedWalletStorage();
+        const material = await createBrowserSplitWalletMaterial(chain, {
+            label: options?.label,
+        });
+        const payload = await this.request("/v1/runtime/accounts/managed", {
+            method: "POST",
+            body: {
+                chain,
+                purpose: "personal",
+                label: options?.label,
+                custodyMode: "split_custody",
+                browserProvisioning: material.provisioning,
+            },
+            runtime: true,
+        });
+        storeDeviceShare(this.embeddedWalletStorage, this.embeddedWalletStorageKeyPrefix, payload.account.id, material.deviceShare);
+        return {
+            account: payload.account,
+            attestation: payload.attestation,
+            existing: Boolean(payload.existing),
+            recoveryPackage: material.recoveryPackage,
+            deviceShare: {
+                ...material.deviceShare,
+                accountId: payload.account.id,
+            },
+            recoveryShare: material.recoveryShare,
+        };
+    }
+    async ensureBrowserSplitWallet(chain, options) {
+        const existing = await this.getManagedAccount(chain, { purpose: "personal" });
+        if (existing) {
+            const deviceShare = this.getLocalEmbeddedWalletShare(existing.id);
+            if (!deviceShare) {
+                throw new Error("local_embedded_wallet_share_missing");
+            }
+            return {
+                account: existing,
+                existing: true,
+                deviceShare,
+            };
+        }
+        return this.createBrowserSplitWallet(chain, options);
+    }
+    async getServerShare(accountId, challengeId) {
+        return this.request(`/v1/runtime/accounts/${accountId}/custody/server-share`, {
+            method: "POST",
+            body: { challengeId },
+            runtime: true,
+        });
+    }
+    hasLocalEmbeddedWallet(accountId) {
+        return Boolean(this.getLocalEmbeddedWalletShare(accountId));
+    }
+    clearLocalEmbeddedWallet(accountId) {
+        if (!this.embeddedWalletStorage) {
+            return;
+        }
+        clearDeviceShare(this.embeddedWalletStorage, this.embeddedWalletStorageKeyPrefix, accountId);
+    }
+    getLocalEmbeddedWalletShare(accountId) {
+        if (!this.embeddedWalletStorage) {
+            return null;
+        }
+        return loadDeviceShare(this.embeddedWalletStorage, this.embeddedWalletStorageKeyPrefix, accountId);
+    }
+    async exportEmbeddedWalletLocally(accountId, options = {}) {
+        const account = await this.requireManagedAccountById(accountId);
+        const { deviceShare, serverShare } = await this.loadReconstructionShares(accountId, options);
+        const exported = exportPrivateKeyFromShares(account.chain, deviceShare, serverShare);
+        return {
+            accountId,
+            chain: account.chain,
+            privateKey: exported.privateKey,
+            publicKey: exported.publicKey,
+            address: exported.address,
+            local: true,
+        };
+    }
+    async exportEmbeddedWalletLocallyWithPasskey(accountId, authMethodId, options = {}) {
+        const prepared = await this.prepareLocalWalletWithPasskey(accountId, {
+            ...options,
+            authMethodId,
+        });
+        const result = await this.exportEmbeddedWalletLocally(accountId, {
+            challengeId: prepared.approval.challenge.challengeId,
+            recoveryPackage: options.recoveryPackage,
+        });
+        return {
+            approval: prepared.approval,
+            result,
+        };
+    }
+    async signMessageLocally(body, options = {}) {
+        const { deviceShare, serverShare } = await this.loadReconstructionShares(body.accountId, options);
+        const result = await signMessageLocallyWithShares({
+            chain: body.chain,
+            first: deviceShare,
+            second: serverShare,
+            ...body.payload,
+        });
+        const signedResult = {
+            accountId: body.accountId,
+            chain: body.chain,
+            signature: result.signature,
+            signerAddress: result.address,
+            signerPublicKey: result.publicKey,
+        };
+        await this.reportLocalSigningActivity({
+            accountId: body.accountId,
+            chain: body.chain,
+            signingKind: "message",
+            challengeId: options.challengeId,
+            signerAddress: signedResult.signerAddress,
+            signerPublicKey: signedResult.signerPublicKey,
+        });
+        return signedResult;
+    }
+    async signMessageLocallyWithPasskey(body, authMethodId, options = {}) {
+        const prepared = await this.prepareLocalWalletWithPasskey(body.accountId, {
+            ...options,
+            authMethodId,
+        });
+        const result = await this.signMessageLocally(body, {
+            challengeId: prepared.approval.challenge.challengeId,
+            recoveryPackage: options.recoveryPackage,
+        });
+        return {
+            approval: prepared.approval,
+            result,
+        };
+    }
+    async signTypedDataLocally(body, options = {}) {
+        const { deviceShare, serverShare } = await this.loadReconstructionShares(body.accountId, options);
+        const result = await signTypedDataLocallyWithShares({
+            first: deviceShare,
+            second: serverShare,
+            typedData: body.typedData,
+        });
+        const signedResult = {
+            accountId: body.accountId,
+            chain: "evm",
+            signature: result.signature,
+            signerAddress: result.address,
+            signerPublicKey: result.publicKey,
+        };
+        await this.reportLocalSigningActivity({
+            accountId: body.accountId,
+            chain: "evm",
+            signingKind: "typed_data",
+            challengeId: options.challengeId,
+            signerAddress: signedResult.signerAddress,
+            signerPublicKey: signedResult.signerPublicKey,
+        });
+        return signedResult;
+    }
+    async signTypedDataLocallyWithPasskey(body, authMethodId, options = {}) {
+        const prepared = await this.prepareLocalWalletWithPasskey(body.accountId, {
+            ...options,
+            authMethodId,
+        });
+        const result = await this.signTypedDataLocally(body, {
+            challengeId: prepared.approval.challenge.challengeId,
+            recoveryPackage: options.recoveryPackage,
+        });
+        return {
+            approval: prepared.approval,
+            result,
+        };
+    }
+    async signTransactionLocally(body, options = {}) {
+        const { deviceShare, serverShare } = await this.loadReconstructionShares(body.accountId, options);
+        const result = await signTransactionLocallyWithShares({
+            chain: body.chain,
+            first: deviceShare,
+            second: serverShare,
+            transaction: body.payload.transaction,
+            serializedTransactionBase64: body.payload.serializedTransactionBase64,
+        });
+        const signedResult = {
+            accountId: body.accountId,
+            chain: body.chain,
+            signedPayload: result.signedPayload,
+            signature: result.signature,
+            signerAddress: result.address,
+            signerPublicKey: result.publicKey,
+        };
+        await this.reportLocalSigningActivity({
+            accountId: body.accountId,
+            chain: body.chain,
+            signingKind: "transaction",
+            challengeId: options.challengeId,
+            signerAddress: signedResult.signerAddress,
+            signerPublicKey: signedResult.signerPublicKey,
+            signedPayloadPresent: Boolean(signedResult.signedPayload),
+        });
+        return signedResult;
+    }
+    async signTransactionLocallyWithPasskey(body, authMethodId, options = {}) {
+        const prepared = await this.prepareLocalWalletWithPasskey(body.accountId, {
+            ...options,
+            authMethodId,
+        });
+        const result = await this.signTransactionLocally(body, {
+            challengeId: prepared.approval.challenge.challengeId,
+            recoveryPackage: options.recoveryPackage,
+        });
+        return {
+            approval: prepared.approval,
+            result,
+        };
+    }
+    async createOfflineTransactionSigningEnvelope(body) {
+        const account = await this.requireManagedAccountById(body.accountId);
+        if (account.custodyMode !== "split_custody") {
+            throw new Error("offline_signing_requires_split_custody");
+        }
+        if (account.chain !== body.chain) {
+            throw new Error("offline_signing_chain_mismatch");
+        }
+        const session = (await this.getMe());
+        const offlineSigningPolicy = session.environmentPolicy?.offlineSigningPolicy;
+        if (!offlineSigningPolicy?.enabled) {
+            throw new Error("offline_signing_disabled");
+        }
+        if (offlineSigningPolicy.bluetoothMeshEnabled === false) {
+            throw new Error("offline_signing_bluetooth_mesh_disabled");
+        }
+        if (offlineSigningPolicy.maxEnvelopeTtlSeconds
+            && body.expiresAt
+            && Date.parse(String(body.expiresAt)) - Date.now() > offlineSigningPolicy.maxEnvelopeTtlSeconds * 1000) {
+            throw new Error("offline_signing_ttl_exceeds_policy");
+        }
+        const envelope = await createOfflineTransactionSigningEnvelope({
+            accountId: body.accountId,
+            chain: body.chain,
+            expiresAt: body.expiresAt,
+            payload: body.payload,
+            requester: body.requester ?? {
+                appId: this.config.appId ?? this.config.environmentId,
+            },
+            policySnapshot: {
+                enabled: offlineSigningPolicy.enabled === true,
+                bluetoothMeshEnabled: offlineSigningPolicy.bluetoothMeshEnabled === true,
+                requireSplitCustody: offlineSigningPolicy.requireSplitCustody !== false,
+                requirePasskeyApproval: offlineSigningPolicy.requirePasskeyApproval !== false,
+                allowRecoveryPackageSigning: offlineSigningPolicy.allowRecoveryPackageSigning === true,
+                maxEnvelopeTtlSeconds: offlineSigningPolicy.maxEnvelopeTtlSeconds ?? null,
+            },
+            pairingKeyId: this.config.offlineSigningPairingKeyId,
+            pairingSecret: this.config.offlineSigningPairingSecret,
+            metadata: body.metadata,
+        });
+        await this.reportOfflineSigningActivity({
+            eventType: "offline_signing.request.created",
+            accountId: body.accountId,
+            envelopeId: envelope.id,
+            chain: body.chain,
+            network: body.payload.network ?? null,
+            transport: envelope.transport,
+            signed: Boolean(envelope.requestSignature),
+            policySnapshotHash: envelope.policySnapshot?.hash ?? null,
+        });
+        return envelope;
+    }
+    async signOfflineTransactionSigningEnvelope(envelope, options = {}) {
+        const requestEnvelope = typeof envelope === "string"
+            ? decodeOfflineSigningEnvelope(envelope)
+            : envelope;
+        if (requestEnvelope.type !== "swivy.offline_transaction_signing_request") {
+            throw new Error("offline_signing_request_required");
+        }
+        if (this.hasSeenOfflineSigningRequest(requestEnvelope.id)) {
+            throw new Error("offline_signing_replay_detected");
+        }
+        const pairingSecret = options.pairingSecret ?? this.config.offlineSigningPairingSecret;
+        if (options.requireSignature !== false) {
+            if (!pairingSecret) {
+                throw new Error("offline_signing_pairing_secret_required");
+            }
+            const verified = await verifyOfflineSigningEnvelopeSignature(requestEnvelope, pairingSecret);
+            if (!verified) {
+                throw new Error("offline_signing_request_signature_invalid");
+            }
+        }
+        if (requestEnvelope.expiresAt && Date.parse(requestEnvelope.expiresAt) <= Date.now()) {
+            throw new Error("offline_signing_request_expired");
+        }
+        if (requestEnvelope.policySnapshot?.requirePasskeyApproval && !options.localApproval) {
+            throw new Error("offline_signing_local_passkey_approval_required");
+        }
+        if (requestEnvelope.policySnapshot?.allowRecoveryPackageSigning === false
+            && options.recoveryPackage) {
+            throw new Error("offline_signing_recovery_package_not_allowed");
+        }
+        const { deviceShare, serverShare } = await this.loadReconstructionShares(requestEnvelope.accountId, options);
+        const result = await signTransactionLocallyWithShares({
+            chain: requestEnvelope.chain,
+            first: deviceShare,
+            second: serverShare,
+            transaction: requestEnvelope.payload.transaction,
+            serializedTransactionBase64: requestEnvelope.payload.serializedTransactionBase64,
+        });
+        this.markOfflineSigningRequestSeen(requestEnvelope.id);
+        await this.reportOfflineSigningActivity({
+            eventType: "offline_signing.request.signed",
+            accountId: requestEnvelope.accountId,
+            envelopeId: requestEnvelope.id,
+            chain: requestEnvelope.chain,
+            network: requestEnvelope.payload.network ?? null,
+            transport: requestEnvelope.transport,
+            signerAddress: result.address,
+            signerPublicKey: result.publicKey,
+            signedPayloadPresent: true,
+            policySnapshotHash: requestEnvelope.policySnapshot?.hash ?? null,
+            localApprovalType: options.localApproval?.type ?? null,
+            metadata: options.metadata ?? {},
+        });
+        return createOfflineTransactionSigningResponseEnvelope({
+            request: requestEnvelope,
+            signedPayload: result.signedPayload,
+            signature: result.signature,
+            signerAddress: result.address,
+            signerPublicKey: result.publicKey,
+            metadata: options.metadata,
+        });
+    }
+    encodeOfflineSigningEnvelope(envelope) {
+        return encodeOfflineSigningEnvelope(envelope);
+    }
+    decodeOfflineSigningEnvelope(envelope) {
+        return decodeOfflineSigningEnvelope(envelope);
+    }
+    async importOfflineTransactionSigningResponse(envelope, options = {}) {
+        const responseEnvelope = typeof envelope === "string"
+            ? decodeOfflineSigningEnvelope(envelope)
+            : envelope;
+        if (responseEnvelope.type !== "swivy.offline_transaction_signing_response") {
+            throw new Error("offline_signing_response_required");
+        }
+        return this.request("/v1/runtime/offline-signing/responses/import", {
+            method: "POST",
+            runtime: true,
+            body: {
+                requestId: responseEnvelope.requestId,
+                accountId: responseEnvelope.accountId,
+                chain: responseEnvelope.chain,
+                network: options.network ?? null,
+                signedPayload: responseEnvelope.signedPayload,
+                signature: responseEnvelope.signature,
+                signerAddress: responseEnvelope.signerAddress,
+                signerPublicKey: responseEnvelope.signerPublicKey,
+                policySnapshotHash: options.policySnapshotHash ?? null,
+                broadcast: options.broadcast === true,
+                metadata: {
+                    ...(responseEnvelope.metadata ?? {}),
+                    ...(options.metadata ?? {}),
+                },
+            },
+        });
+    }
+    async request(path, options) {
+        const headers = {
+            "x-swivy-app-id": this.config.appId ?? this.config.environmentId ?? "",
+            "x-swivy-publishable-key": this.config.publishableKey ?? this.config.apiKey ?? "",
+        };
+        if (!headers["x-swivy-app-id"] || !headers["x-swivy-publishable-key"]) {
+            throw new Error("Swivy appId and publishableKey are required");
+        }
+        if (options.body !== undefined) {
+            headers["content-type"] = "application/json";
+        }
+        if (options.runtime) {
+            if (!this.sessionToken) {
+                throw new Error("session token is required");
+            }
+            headers.authorization = `Bearer ${this.sessionToken}`;
+        }
+        const response = await fetch(`${this.config.baseUrl}${path}`, {
+            method: options.method,
+            headers,
+            body: options.body !== undefined ? JSON.stringify(options.body) : undefined,
+        });
+        const text = await response.text();
+        const payload = parseJsonResponseBody(response, text);
+        if (!response.ok) {
+            throw new Error(resolveResponseErrorMessage(response, payload));
+        }
+        return payload;
+    }
+    assertWebAuthnSupport(operation) {
+        if (!browserSupportsWebAuthn()) {
+            throw new SwivyWebAuthnError({
+                code: "webauthn_not_supported",
+                operation,
+                cause: new Error("webauthn_not_supported"),
+                browserErrorName: "UnsupportedError",
+                rawMessage: "webauthn_not_supported",
+                ...buildWebAuthnErrorMetadata("webauthn_not_supported", operation),
+            });
+        }
+    }
+    resolveSessionPersistence() {
+        const configured = this.config.sessionPersistence ?? "memory";
+        if (configured === "memory") {
+            return undefined;
+        }
+        if (typeof configured === "object") {
+            return configured;
+        }
+        const storage = configured === "localStorage" ? globalThis.localStorage : globalThis.sessionStorage;
+        if (!storage) {
+            return undefined;
+        }
+        const key = this.config.sessionStorageKey ?? "swivy:session-token";
+        return {
+            load: () => storage.getItem(key) ?? undefined,
+            save: (token) => {
+                storage.setItem(key, token);
+            },
+            clear: () => {
+                storage.removeItem(key);
+            },
+        };
+    }
+    resolveEmbeddedWalletStorage() {
+        if (this.config.embeddedWalletStorage) {
+            return this.config.embeddedWalletStorage;
+        }
+        if (typeof globalThis.localStorage === "undefined") {
+            return undefined;
+        }
+        return globalThis.localStorage;
+    }
+    requireEmbeddedWalletStorage() {
+        if (!this.embeddedWalletStorage) {
+            throw new Error("embedded_wallet_storage_unavailable");
+        }
+        return this.embeddedWalletStorage;
+    }
+    getMissingSplitCustodyChains(payload) {
+        const policy = payload.environmentPolicy;
+        const walletPolicy = policy?.walletPolicy;
+        if (!walletPolicy?.allowManagedAccounts
+            || !walletPolicy.allowSplitCustody
+            || !walletPolicy.autoCreateManagedAccounts
+            || walletPolicy.defaultCustodyMode !== "split_custody") {
+            return [];
+        }
+        const allowedChains = new Set((policy?.allowedChains ?? []));
+        const managedChains = (walletPolicy.managedAccountChains ?? []).filter((chain) => allowedChains.size === 0 || allowedChains.has(chain));
+        const existingChains = new Set((payload.managedAccounts ?? []).map((account) => account.chain));
+        return managedChains.filter((chain) => !existingChains.has(chain));
+    }
+    async attachWalletTools(payload) {
+        const walletTools = await this.listWalletTools();
+        return {
+            ...payload,
+            walletTools: walletTools.tools ?? [],
+        };
+    }
+    async requireManagedAccountById(accountId) {
+        const payload = await this.listAccounts();
+        const account = payload.managedAccounts.find((candidate) => candidate.id === accountId);
+        if (!account) {
+            throw new Error("managed_account_not_found");
+        }
+        return account;
+    }
+    async loadReconstructionShares(accountId, options) {
+        const storage = this.requireEmbeddedWalletStorage();
+        const storedDeviceShare = loadDeviceShare(storage, this.embeddedWalletStorageKeyPrefix, accountId);
+        const recoveryShare = options.recoveryPackage
+            ? decodeRecoveryPackage(options.recoveryPackage)
+            : null;
+        if (storedDeviceShare && recoveryShare) {
+            return {
+                deviceShare: storedDeviceShare,
+                serverShare: recoveryShare,
+            };
+        }
+        const deviceShare = storedDeviceShare ?? recoveryShare;
+        if (!deviceShare) {
+            throw new Error("local_embedded_wallet_share_missing");
+        }
+        if (!options.challengeId) {
+            throw new Error("wallet_reconstruction_challenge_required");
+        }
+        const payload = await this.getServerShare(accountId, options.challengeId);
+        const serverShare = await parseServerShareRecord(payload.serverShare.encryptedPayload, deviceShare);
+        return {
+            deviceShare,
+            serverShare,
+        };
+    }
+    async reportLocalSigningActivity(params) {
+        try {
+            await this.request(`/v1/runtime/accounts/${params.accountId}/local-signing-events`, {
+                method: "POST",
+                runtime: true,
+                body: {
+                    chain: params.chain,
+                    signingKind: params.signingKind,
+                    challengeId: params.challengeId,
+                    signerAddress: params.signerAddress,
+                    signerPublicKey: params.signerPublicKey,
+                    signedPayloadPresent: params.signedPayloadPresent,
+                },
+            });
+        }
+        catch {
+            // Local signing should not fail just because best-effort audit reporting did.
+        }
+    }
+    offlineSigningReplayStorageKey() {
+        return `${this.embeddedWalletStorageKeyPrefix}:offline-signing-seen`;
+    }
+    hasSeenOfflineSigningRequest(requestId) {
+        const storage = this.resolveEmbeddedWalletStorage();
+        if (!storage) {
+            return false;
+        }
+        try {
+            const raw = storage.getItem(this.offlineSigningReplayStorageKey());
+            const seen = raw ? JSON.parse(raw) : {};
+            return Boolean(seen && typeof seen === "object" && seen[requestId]);
+        }
+        catch {
+            return false;
+        }
+    }
+    markOfflineSigningRequestSeen(requestId) {
+        const storage = this.resolveEmbeddedWalletStorage();
+        if (!storage) {
+            return;
+        }
+        try {
+            const key = this.offlineSigningReplayStorageKey();
+            const raw = storage.getItem(key);
+            const seen = raw ? JSON.parse(raw) : {};
+            const entries = Object.entries({
+                ...(seen && typeof seen === "object" ? seen : {}),
+                [requestId]: new Date().toISOString(),
+            }).slice(-100);
+            storage.setItem(key, JSON.stringify(Object.fromEntries(entries)));
+        }
+        catch {
+            // Replay cache failures should not expose key material or break local signing.
+        }
+    }
+    async reportOfflineSigningActivity(params) {
+        try {
+            await this.request("/v1/runtime/offline-signing/events", {
+                method: "POST",
+                runtime: true,
+                body: params,
+            });
+        }
+        catch {
+            // Offline signing must not fail just because best-effort audit reporting did.
+        }
+    }
+    async delay(ms, signal) {
+        await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                cleanup();
+                resolve();
+            }, ms);
+            const onAbort = () => {
+                cleanup();
+                reject(new Error("intent_wait_aborted"));
+            };
+            const cleanup = () => {
+                clearTimeout(timer);
+                signal?.removeEventListener("abort", onAbort);
+            };
+            signal?.addEventListener("abort", onAbort, { once: true });
+        });
+    }
+}