tenzro-wallet 0.1.0

package/dist/custody/pairing/http-adapter.js

@@ -0,0 +1,113 @@
+/**
+ * PairingHttpAdapter — fetch-based driver against a Tenzro RPC node's
+ * `/wallet/pairing/*` endpoints. Browser-clean (fetch + JSON only).
+ *
+ * The `/wallet/*` endpoints are pre-auth: the QR pairing flow runs before
+ * the new device has any session, and the originally-paired device's auth
+ * is asserted by the passkey assertion in the body, not by an
+ * `Authorization` header. So unlike the Canton HTTP helpers, no token
+ * provider is threaded through.
+ *
+ * Wire shape per DESIGN.md §4.3.6:
+ *   POST /wallet/pairing/start    → { session_id, pairing_url, expires_at }
+ *   POST /wallet/pairing/claim    → { session_id, state }
+ *   POST /wallet/pairing/poll     → { session_id, state, claimed_public_key?, reason? }
+ *   POST /wallet/pairing/finalize → { session_id, verification_methods, threshold }
+ *   POST /wallet/pairing/cancel   → 204 No Content
+ */
+export class PairingHttpError extends Error {
+    status;
+    url;
+    body;
+    constructor(status, url, body) {
+        super(`pairing http ${status} on ${url}: ${body.length > 200 ? body.slice(0, 200) + '…' : body}`);
+        this.status = status;
+        this.url = url;
+        this.body = body;
+        this.name = 'PairingHttpError';
+    }
+}
+export class PairingHttpAdapter {
+    #cfg;
+    constructor(cfg) {
+        this.#cfg = cfg;
+    }
+    async start(req) {
+        const raw = await this.#post('/wallet/pairing/start', {
+            did: req.did,
+            ...(req.label !== undefined ? { label: req.label } : {}),
+        });
+        return {
+            sessionId: raw.session_id,
+            pairingUrl: raw.pairing_url,
+            expiresAt: raw.expires_at,
+        };
+    }
+    async claim(req) {
+        const raw = await this.#post('/wallet/pairing/claim', {
+            session_id: req.sessionId,
+            new_device_public_key: req.newDevicePublicKey,
+            assertion: {
+                credential_id: req.assertion.credentialId,
+                client_data_json: req.assertion.clientDataJson,
+                authenticator_data: req.assertion.authenticatorData,
+                signature: req.assertion.signature,
+            },
+        });
+        return { sessionId: raw.session_id, state: raw.state };
+    }
+    async poll(sessionId) {
+        const raw = await this.#post('/wallet/pairing/poll', {
+            session_id: sessionId,
+        });
+        return {
+            sessionId: raw.session_id,
+            state: raw.state,
+            ...(raw.claimed_public_key !== undefined ? { claimedPublicKey: raw.claimed_public_key } : {}),
+            ...(raw.reason !== undefined ? { reason: raw.reason } : {}),
+        };
+    }
+    async finalize(req) {
+        const raw = await this.#post('/wallet/pairing/finalize', {
+            session_id: req.sessionId,
+            original_device_assertion: {
+                credential_id: req.originalDeviceAssertion.credentialId,
+                client_data_json: req.originalDeviceAssertion.clientDataJson,
+                authenticator_data: req.originalDeviceAssertion.authenticatorData,
+                signature: req.originalDeviceAssertion.signature,
+            },
+        });
+        const methods = raw.verification_methods.map((m) => ({
+            id: m.id,
+            type: m.type,
+            controller: m.controller,
+            publicKeyMultibase: m.public_key_multibase,
+        }));
+        return {
+            sessionId: raw.session_id,
+            verificationMethods: methods,
+            threshold: raw.threshold,
+        };
+    }
+    async cancel(sessionId) {
+        await this.#post('/wallet/pairing/cancel', { session_id: sessionId });
+    }
+    // --- internals ---
+    async #post(path, body) {
+        const f = this.#cfg.fetch ?? globalThis.fetch;
+        const url = this.#cfg.baseUrl.replace(/\/+$/, '') + path;
+        const res = await f(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            throw new PairingHttpError(res.status, url, text);
+        }
+        if (res.status === 204)
+            return undefined;
+        return (await res.json());
+    }
+}
+//# sourceMappingURL=http-adapter.js.map

package/dist/custody/pairing/http-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-adapter.js","sourceRoot":"","sources":["../../../src/custody/pairing/http-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAsBH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IACA;IACA;IAHX,YACW,MAAc,EACd,GAAW,EACX,IAAY;QAErB,KAAK,CACH,gBAAgB,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAC3F,CAAC;QANO,WAAM,GAAN,MAAM,CAAQ;QACd,QAAG,GAAH,GAAG,CAAQ;QACX,SAAI,GAAJ,IAAI,CAAQ;QAKrB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AA0BD,MAAM,OAAO,kBAAkB;IACpB,IAAI,CAAoB;IAEjC,YAAY,GAAsB;QAChC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAwB;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAW,uBAAuB,EAAE;YAC9D,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QACH,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAwB;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAC1B,uBAAuB,EACvB;YACE,UAAU,EAAE,GAAG,CAAC,SAAS;YACzB,qBAAqB,EAAE,GAAG,CAAC,kBAAkB;YAC7C,SAAS,EAAE;gBACT,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,YAAY;gBACzC,gBAAgB,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc;gBAC9C,kBAAkB,EAAE,GAAG,CAAC,SAAS,CAAC,iBAAiB;gBACnD,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS;aACnC;SACF,CACF,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAW,sBAAsB,EAAE;YAC7D,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;QACH,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,CAAC,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAA2B;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAc,0BAA0B,EAAE;YACpE,UAAU,EAAE,GAAG,CAAC,SAAS;YACzB,yBAAyB,EAAE;gBACzB,aAAa,EAAE,GAAG,CAAC,uBAAuB,CAAC,YAAY;gBACvD,gBAAgB,EAAE,GAAG,CAAC,uBAAuB,CAAC,cAAc;gBAC5D,kBAAkB,EAAE,GAAG,CAAC,uBAAuB,CAAC,iBAAiB;gBACjE,SAAS,EAAE,GAAG,CAAC,uBAAuB,CAAC,SAAS;aACjD;SACF,CAAC,CAAC;QACH,MAAM,OAAO,GAAyB,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzE,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,kBAAkB,EAAE,CAAC,CAAC,oBAAoB;SAC3C,CAAC,CAAC,CAAC;QACJ,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,mBAAmB,EAAE,OAAO;YAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,IAAI,CAAC,KAAK,CAAU,wBAAwB,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,oBAAoB;IAEpB,KAAK,CAAC,KAAK,CAAO,IAAY,EAAE,IAAa;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAiB,CAAC;QACjD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAS,CAAC;IACpC,CAAC;CACF"}

package/dist/custody/pairing/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * QR pairing flow for upgrading 2-of-2 → 2-of-3 by adding a second user
+ * device (DESIGN.md §4.3.6). The `PairingPort` is the kernel-facing
+ * surface; the `PairingHttpAdapter` is the real driver against a Tenzro
+ * RPC node's `/wallet/pairing/*` endpoints.
+ */
+export type { PasskeyAssertion, PairingPort, PairingState, PairingStartRequest, PairingStartResult, PairingPollResult, PairingClaimRequest, PairingClaimResult, PairingFinalizeRequest, PairingFinalizeResult, VerificationMethod, } from './port.js';
+export { PairingHttpAdapter, PairingHttpError } from './http-adapter.js';
+export type { PairingHttpConfig } from './http-adapter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/custody/pairing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/custody/pairing/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACzE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/custody/pairing/index.js

@@ -0,0 +1,8 @@
+/**
+ * QR pairing flow for upgrading 2-of-2 → 2-of-3 by adding a second user
+ * device (DESIGN.md §4.3.6). The `PairingPort` is the kernel-facing
+ * surface; the `PairingHttpAdapter` is the real driver against a Tenzro
+ * RPC node's `/wallet/pairing/*` endpoints.
+ */
+export { PairingHttpAdapter, PairingHttpError } from "./http-adapter.js";
+//# sourceMappingURL=index.js.map

package/dist/custody/pairing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/custody/pairing/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/custody/pairing/port.d.ts

@@ -0,0 +1,121 @@
+/**
+ * PairingPort — wallet-side view of the QR pairing flow that upgrades a
+ * 2-of-2 quorum (passkey-bound device share + node-TEE share) to 2-of-3
+ * by adding a second user device. Specified in DESIGN.md §4.3.6.
+ *
+ * Flow (originally-paired device drives steps 1, 4, 5; second device
+ * drives step 3):
+ *
+ *   1. `start({did})` — POST /wallet/pairing/start
+ *      → returns `{sessionId, pairingUrl, expiresAt}`. The wallet renders
+ *      `pairingUrl` as a QR code.
+ *
+ *   2. (User scans the QR on the new device — this happens out-of-band
+ *      from the originally-paired device's perspective.)
+ *
+ *   3. (On the new device, the wallet POSTs /wallet/pairing/claim with a
+ *      passkey assertion — `claim()` below for that side of the protocol.)
+ *
+ *   4. `poll({sessionId})` — POST /wallet/pairing/poll
+ *      → repeated until `state === 'claimed' | 'expired' | 'cancelled'`.
+ *      Returns the claimed device's passkey public key once available.
+ *
+ *   5. `finalize({sessionId, originalDeviceAssertion})` —
+ *      POST /wallet/pairing/finalize. After the originally-paired device
+ *      runs its own passkey ceremony, it submits the assertion here. The
+ *      node mediates the threshold-redeal (existing key → 3 shares,
+ *      threshold updated to 2-of-3) and updates the DID Document. Returns
+ *      the post-redeal `verificationMethod` set so the wallet can update
+ *      its local DID cache.
+ *
+ * The port is intentionally opaque about how passkey assertions are
+ * obtained — that's a WebAuthn / native-platform call that lives in the
+ * host app. The port only carries the assertion bytes through to the
+ * node.
+ *
+ * Browser-clean: the adapter uses only `fetch` + the assertion bytes the
+ * caller supplies; no Node-only globals, no Buffer.
+ */
+/** A WebAuthn assertion, transport-encoded so the node can verify it. */
+export interface PasskeyAssertion {
+    /** Base64url credential id used to look up the passkey on the node. */
+    readonly credentialId: string;
+    /** Base64url client-data JSON. */
+    readonly clientDataJson: string;
+    /** Base64url authenticator data. */
+    readonly authenticatorData: string;
+    /** Base64url signature over `authenticatorData || sha256(clientDataJson)`. */
+    readonly signature: string;
+}
+export interface PairingStartRequest {
+    /** TDIP DID of the wallet that's initiating the pairing. */
+    readonly did: string;
+    /** Optional human-readable label for the pairing (shown in approver UI). */
+    readonly label?: string;
+}
+export interface PairingStartResult {
+    /** Opaque session id. The wallet uses this for `poll` and `finalize`. */
+    readonly sessionId: string;
+    /** Full URL that should be rendered as a QR code. The new device opens
+     *  this URL in any browser to start the claim ceremony. */
+    readonly pairingUrl: string;
+    /** Unix-ms timestamp when this session expires. */
+    readonly expiresAt: number;
+}
+export type PairingState = 'pending' | 'claimed' | 'finalized' | 'expired' | 'cancelled';
+export interface PairingPollResult {
+    readonly sessionId: string;
+    readonly state: PairingState;
+    /** Set once `state === 'claimed'` or later. The originally-paired
+     *  device should display this to the user before finalising, so they
+     *  can confirm they're approving the right new device. */
+    readonly claimedPublicKey?: string;
+    /** Set when `state === 'expired' | 'cancelled'`. */
+    readonly reason?: string;
+}
+export interface PairingClaimRequest {
+    readonly sessionId: string;
+    readonly assertion: PasskeyAssertion;
+    /** Public key of the new passkey, transport-encoded. The node will
+     *  attach this to the DID Document on finalization. */
+    readonly newDevicePublicKey: string;
+}
+export interface PairingClaimResult {
+    readonly sessionId: string;
+    readonly state: PairingState;
+}
+export interface PairingFinalizeRequest {
+    readonly sessionId: string;
+    /** Passkey assertion from the originally-paired device, proving it
+     *  actively consented to the redeal (rather than the node redealing
+     *  silently). */
+    readonly originalDeviceAssertion: PasskeyAssertion;
+}
+export interface VerificationMethod {
+    readonly id: string;
+    readonly type: string;
+    readonly controller: string;
+    /** Multibase-encoded public key (e.g. `z6Mk...`). */
+    readonly publicKeyMultibase: string;
+}
+export interface PairingFinalizeResult {
+    readonly sessionId: string;
+    /** Updated `verificationMethod` set after the redeal — should now hold
+     *  three entries (original device, new device, node-TEE). */
+    readonly verificationMethods: readonly VerificationMethod[];
+    /** New threshold record — expected to be `2-of-3`. */
+    readonly threshold: string;
+}
+export interface PairingPort {
+    /** Originally-paired device: mint a pairing session and get the QR URL. */
+    start(req: PairingStartRequest): Promise<PairingStartResult>;
+    /** New device: claim the session with a passkey assertion. */
+    claim(req: PairingClaimRequest): Promise<PairingClaimResult>;
+    /** Originally-paired device: poll for the new device's claim. */
+    poll(sessionId: string): Promise<PairingPollResult>;
+    /** Originally-paired device: finalise with own passkey + trigger redeal. */
+    finalize(req: PairingFinalizeRequest): Promise<PairingFinalizeResult>;
+    /** Originally-paired device: cancel a pending session. Idempotent. */
+    cancel(sessionId: string): Promise<void>;
+}
+//# sourceMappingURL=port.d.ts.map

package/dist/custody/pairing/port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"port.d.ts","sourceRoot":"","sources":["../../../src/custody/pairing/port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kCAAkC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,oCAAoC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;+DAC2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,SAAS,GACT,WAAW,GACX,SAAS,GACT,WAAW,CAAC;AAEhB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B;;8DAE0D;IAC1D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC;2DACuD;IACvD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;qBAEiB;IACjB,QAAQ,CAAC,uBAAuB,EAAE,gBAAgB,CAAC;CACpD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;iEAC6D;IAC7D,QAAQ,CAAC,mBAAmB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC5D,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,KAAK,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE7D,8DAA8D;IAC9D,KAAK,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE7D,iEAAiE;IACjE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAEpD,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEtE,sEAAsE;IACtE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C"}

package/dist/custody/pairing/port.js

@@ -0,0 +1,40 @@
+/**
+ * PairingPort — wallet-side view of the QR pairing flow that upgrades a
+ * 2-of-2 quorum (passkey-bound device share + node-TEE share) to 2-of-3
+ * by adding a second user device. Specified in DESIGN.md §4.3.6.
+ *
+ * Flow (originally-paired device drives steps 1, 4, 5; second device
+ * drives step 3):
+ *
+ *   1. `start({did})` — POST /wallet/pairing/start
+ *      → returns `{sessionId, pairingUrl, expiresAt}`. The wallet renders
+ *      `pairingUrl` as a QR code.
+ *
+ *   2. (User scans the QR on the new device — this happens out-of-band
+ *      from the originally-paired device's perspective.)
+ *
+ *   3. (On the new device, the wallet POSTs /wallet/pairing/claim with a
+ *      passkey assertion — `claim()` below for that side of the protocol.)
+ *
+ *   4. `poll({sessionId})` — POST /wallet/pairing/poll
+ *      → repeated until `state === 'claimed' | 'expired' | 'cancelled'`.
+ *      Returns the claimed device's passkey public key once available.
+ *
+ *   5. `finalize({sessionId, originalDeviceAssertion})` —
+ *      POST /wallet/pairing/finalize. After the originally-paired device
+ *      runs its own passkey ceremony, it submits the assertion here. The
+ *      node mediates the threshold-redeal (existing key → 3 shares,
+ *      threshold updated to 2-of-3) and updates the DID Document. Returns
+ *      the post-redeal `verificationMethod` set so the wallet can update
+ *      its local DID cache.
+ *
+ * The port is intentionally opaque about how passkey assertions are
+ * obtained — that's a WebAuthn / native-platform call that lives in the
+ * host app. The port only carries the assertion bytes through to the
+ * node.
+ *
+ * Browser-clean: the adapter uses only `fetch` + the assertion bytes the
+ * caller supplies; no Node-only globals, no Buffer.
+ */
+export {};
+//# sourceMappingURL=port.js.map

package/dist/custody/pairing/port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"port.js","sourceRoot":"","sources":["../../../src/custody/pairing/port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG"}

package/dist/custody/passkey-share/http-adapter.d.ts

@@ -0,0 +1,77 @@
+/**
+ * ShareEnvelopeHttpAdapter — fetch-based driver against a Tenzro RPC
+ * node's `/wallet/share/*` endpoints. Implements the `ShareEnvelopePort`
+ * port; mirrors `FrostHttpAdapter`, `MlDsaHttpAdapter`, and
+ * `PairingHttpAdapter` for shape.
+ *
+ * Wire shape per `unwrapper.ts` header + DESIGN.md §4.3.5:
+ *
+ *   GET  /wallet/share/envelope?credential_id=…&surface_key=…&scheme=…
+ *     reply = { wrapped_share_b64, alg, salt_b64 }
+ *
+ *   POST /wallet/share/escrow/challenge
+ *     body  = { credential_id, surface_key, scheme }
+ *     reply = { nonce, expires_at }
+ *
+ *   POST /wallet/share/escrow/unwrap
+ *     body  = { credential_id, surface_key, scheme, nonce,
+ *               assertion: { credential_id, client_data_json,
+ *                            authenticator_data, signature } }
+ *     reply = { wrapped_share_b64, pepper_b64 }
+ *
+ * Bytes on the wire are standard base64 (RFC 4648 §4) — same convention
+ * the FROST + Canton adapters use. The `_b64` suffix is load-bearing.
+ *
+ * The `/wallet/share/*` endpoints are pre-auth: the envelope and escrow
+ * routes are authenticated by the passkey assertion in the body itself
+ * (escrow path) or by the credential id + surface-key tuple (envelope
+ * path; the wrapped share is useless without the PRF/largeBlob output).
+ * The optional `headers` callback exists for hosts that still want to
+ * attach a session token for rate-limiting or tracing.
+ *
+ * The `assertion` fields ship as base64url strings (matches WebAuthn's
+ * native shape from `navigator.credentials.get`), not base64 — the host's
+ * WebAuthn glue produces them already-encoded; the adapter passes them
+ * through verbatim.
+ *
+ * Browser-clean: `fetch` only.
+ */
+import type { PasskeyAssertion, ShareEnvelopePort, ShareUnwrapRequest } from './unwrapper.js';
+export interface ShareEnvelopeHttpConfig {
+    /** Base URL of the Tenzro RPC node, e.g. `https://rpc.tenzro.network`. */
+    readonly baseUrl: string;
+    /** Optional `fetch` override for tests. */
+    readonly fetch?: typeof fetch;
+    /**
+     * Per-request headers. Optional — the routes are pre-auth, but a host
+     * may still want to attach `X-Trace-Id` or similar.
+     */
+    readonly headers?: () => Promise<Record<string, string>> | Record<string, string>;
+}
+export declare class ShareEnvelopeHttpError extends Error {
+    readonly status: number;
+    readonly url: string;
+    readonly body: string;
+    constructor(status: number, url: string, body: string);
+}
+export declare class ShareEnvelopeHttpAdapter implements ShareEnvelopePort {
+    #private;
+    constructor(cfg: ShareEnvelopeHttpConfig);
+    fetchEnvelope(req: ShareUnwrapRequest): Promise<{
+        wrappedShare: Uint8Array;
+        alg: string;
+        salt: Uint8Array;
+    }>;
+    startEscrow(req: ShareUnwrapRequest): Promise<{
+        nonce: string;
+        expiresAt: number;
+    }>;
+    finishEscrow(req: ShareUnwrapRequest & {
+        readonly assertion: PasskeyAssertion;
+        readonly nonce: string;
+    }): Promise<{
+        wrappedShare: Uint8Array;
+        pepper: Uint8Array;
+    }>;
+}
+//# sourceMappingURL=http-adapter.d.ts.map

package/dist/custody/passkey-share/http-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-adapter.d.ts","sourceRoot":"","sources":["../../../src/custody/passkey-share/http-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE9F,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnF;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAE7C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAFZ,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM;CAKxB;AAkBD,qBAAa,wBAAyB,YAAW,iBAAiB;;gBAGpD,GAAG,EAAE,uBAAuB;IAIlC,aAAa,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC;QACpD,YAAY,EAAE,UAAU,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,UAAU,CAAC;KAClB,CAAC;IAcI,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAClD,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IASI,YAAY,CAChB,GAAG,EAAE,kBAAkB,GAAG;QACxB,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;QACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,GACA,OAAO,CAAC;QAAE,YAAY,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;CAuC7D"}

package/dist/custody/passkey-share/http-adapter.js

@@ -0,0 +1,125 @@
+/**
+ * ShareEnvelopeHttpAdapter — fetch-based driver against a Tenzro RPC
+ * node's `/wallet/share/*` endpoints. Implements the `ShareEnvelopePort`
+ * port; mirrors `FrostHttpAdapter`, `MlDsaHttpAdapter`, and
+ * `PairingHttpAdapter` for shape.
+ *
+ * Wire shape per `unwrapper.ts` header + DESIGN.md §4.3.5:
+ *
+ *   GET  /wallet/share/envelope?credential_id=…&surface_key=…&scheme=…
+ *     reply = { wrapped_share_b64, alg, salt_b64 }
+ *
+ *   POST /wallet/share/escrow/challenge
+ *     body  = { credential_id, surface_key, scheme }
+ *     reply = { nonce, expires_at }
+ *
+ *   POST /wallet/share/escrow/unwrap
+ *     body  = { credential_id, surface_key, scheme, nonce,
+ *               assertion: { credential_id, client_data_json,
+ *                            authenticator_data, signature } }
+ *     reply = { wrapped_share_b64, pepper_b64 }
+ *
+ * Bytes on the wire are standard base64 (RFC 4648 §4) — same convention
+ * the FROST + Canton adapters use. The `_b64` suffix is load-bearing.
+ *
+ * The `/wallet/share/*` endpoints are pre-auth: the envelope and escrow
+ * routes are authenticated by the passkey assertion in the body itself
+ * (escrow path) or by the credential id + surface-key tuple (envelope
+ * path; the wrapped share is useless without the PRF/largeBlob output).
+ * The optional `headers` callback exists for hosts that still want to
+ * attach a session token for rate-limiting or tracing.
+ *
+ * The `assertion` fields ship as base64url strings (matches WebAuthn's
+ * native shape from `navigator.credentials.get`), not base64 — the host's
+ * WebAuthn glue produces them already-encoded; the adapter passes them
+ * through verbatim.
+ *
+ * Browser-clean: `fetch` only.
+ */
+export class ShareEnvelopeHttpError extends Error {
+    status;
+    url;
+    body;
+    constructor(status, url, body) {
+        super(`share http ${status} on ${url}: ${body.length > 200 ? body.slice(0, 200) + '…' : body}`);
+        this.status = status;
+        this.url = url;
+        this.body = body;
+        this.name = 'ShareEnvelopeHttpError';
+    }
+}
+export class ShareEnvelopeHttpAdapter {
+    #cfg;
+    constructor(cfg) {
+        this.#cfg = cfg;
+    }
+    async fetchEnvelope(req) {
+        const qs = new URLSearchParams({
+            credential_id: req.credentialId,
+            surface_key: req.surfaceKeyId,
+            scheme: req.scheme,
+        });
+        const raw = await this.#request('GET', `envelope?${qs.toString()}`);
+        return {
+            wrappedShare: base64ToBytes(raw.wrapped_share_b64),
+            alg: raw.alg,
+            salt: base64ToBytes(raw.salt_b64),
+        };
+    }
+    async startEscrow(req) {
+        const raw = await this.#request('POST', 'escrow/challenge', {
+            credential_id: req.credentialId,
+            surface_key: req.surfaceKeyId,
+            scheme: req.scheme,
+        });
+        return { nonce: raw.nonce, expiresAt: raw.expires_at };
+    }
+    async finishEscrow(req) {
+        const raw = await this.#request('POST', 'escrow/unwrap', {
+            credential_id: req.credentialId,
+            surface_key: req.surfaceKeyId,
+            scheme: req.scheme,
+            nonce: req.nonce,
+            assertion: {
+                credential_id: req.assertion.credentialId,
+                client_data_json: req.assertion.clientDataJson,
+                authenticator_data: req.assertion.authenticatorData,
+                signature: req.assertion.signature,
+            },
+        });
+        return {
+            wrappedShare: base64ToBytes(raw.wrapped_share_b64),
+            pepper: base64ToBytes(raw.pepper_b64),
+        };
+    }
+    // --- internals ---
+    async #request(method, action, body) {
+        const f = this.#cfg.fetch ?? globalThis.fetch;
+        const url = this.#cfg.baseUrl.replace(/\/+$/, '') + `/wallet/share/${action}`;
+        const extraHeaders = this.#cfg.headers ? await this.#cfg.headers() : {};
+        const headers = { ...extraHeaders };
+        if (method === 'POST')
+            headers['content-type'] = 'application/json';
+        const res = await f(url, {
+            method,
+            headers,
+            ...(method === 'POST' ? { body: JSON.stringify(body ?? {}) } : {}),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => '');
+            throw new ShareEnvelopeHttpError(res.status, url, text);
+        }
+        if (res.status === 204)
+            return undefined;
+        return (await res.json());
+    }
+}
+// ─── base64 helpers ───────────────────────────────────────────────────────
+function base64ToBytes(b64) {
+    const bin = atob(b64);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+//# sourceMappingURL=http-adapter.js.map

package/dist/custody/passkey-share/http-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-adapter.js","sourceRoot":"","sources":["../../../src/custody/passkey-share/http-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAgBH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAEpC;IACA;IACA;IAHX,YACW,MAAc,EACd,GAAW,EACX,IAAY;QAErB,KAAK,CAAC,cAAc,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAJvF,WAAM,GAAN,MAAM,CAAQ;QACd,QAAG,GAAH,GAAG,CAAQ;QACX,SAAI,GAAJ,IAAI,CAAQ;QAGrB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAkBD,MAAM,OAAO,wBAAwB;IAC1B,IAAI,CAA0B;IAEvC,YAAY,GAA4B;QACtC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAuB;QAKzC,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC;YAC7B,aAAa,EAAE,GAAG,CAAC,YAAY;YAC/B,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAc,KAAK,EAAE,YAAY,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACjF,OAAO;YACL,YAAY,EAAE,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAClD,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;SAClC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAuB;QAIvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAe,MAAM,EAAE,kBAAkB,EAAE;YACxE,aAAa,EAAE,GAAG,CAAC,YAAY;YAC/B,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,GAGC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAkB,MAAM,EAAE,eAAe,EAAE;YACxE,aAAa,EAAE,GAAG,CAAC,YAAY;YAC/B,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE;gBACT,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,YAAY;gBACzC,gBAAgB,EAAE,GAAG,CAAC,SAAS,CAAC,cAAc;gBAC9C,kBAAkB,EAAE,GAAG,CAAC,SAAS,CAAC,iBAAiB;gBACnD,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS;aACnC;SACF,CAAC,CAAC;QACH,OAAO;YACL,YAAY,EAAE,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAClD,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;SACtC,CAAC;IACJ,CAAC;IAED,oBAAoB;IAEpB,KAAK,CAAC,QAAQ,CAAO,MAAsB,EAAE,MAAc,EAAE,IAAc;QACzE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,iBAAiB,MAAM,EAAE,CAAC;QAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,GAA2B,EAAE,GAAG,YAAY,EAAE,CAAC;QAC5D,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACvB,MAAM;YACN,OAAO;YACP,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAiB,CAAC;QACjD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAS,CAAC;IACpC,CAAC;CACF;AAED,6EAA6E;AAE7E,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/custody/passkey-share/index.d.ts

@@ -0,0 +1,7 @@
+export { PasskeyShareUnwrapper } from './unwrapper.js';
+export type { PasskeyShareUnwrapperOptions, ShareUnwrapMode, ShareUnwrapRequest, PasskeyCapabilities, PasskeyAuthenticatorAdapter, PasskeyAssertion, ShareEnvelopePort, FrostBackend, } from './unwrapper.js';
+export { ShareEnvelopeHttpAdapter, ShareEnvelopeHttpError, } from './http-adapter.js';
+export type { ShareEnvelopeHttpConfig } from './http-adapter.js';
+export { WebAuthnAuthenticatorAdapter } from './webauthn-adapter.js';
+export type { CredentialsContainer, PublicKeyCredentialLike, PublicKeyCredentialRequestOptionsLike, WebAuthnAdapterConfig, } from './webauthn-adapter.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/custody/passkey-share/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/custody/passkey-share/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EACV,4BAA4B,EAC5B,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,qCAAqC,EACrC,qBAAqB,GACtB,MAAM,uBAAuB,CAAC"}

package/dist/custody/passkey-share/index.js

@@ -0,0 +1,4 @@
+export { PasskeyShareUnwrapper } from "./unwrapper.js";
+export { ShareEnvelopeHttpAdapter, ShareEnvelopeHttpError, } from "./http-adapter.js";
+export { WebAuthnAuthenticatorAdapter } from "./webauthn-adapter.js";
+//# sourceMappingURL=index.js.map

package/dist/custody/passkey-share/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/custody/passkey-share/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAWvD,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC"}