{"version":3,"sources":["../src/secret/localDek.ts"],"names":[],"mappings":";;;;AAqBA,eAAsB,aAAa,KAAA,EAA0C;AAC3E,EAAA,MAAM,MAAA,GAAS,CAAC,EAAA,KAAgB,KAAA,CAAM,QAAA,GAAW,GAAG,KAAA,CAAM,QAAQ,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA,GAAK,EAAA;AAC7E,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,IAAS,YAAA,CAAa,MAAM,QAAQ,CAAA;AACxD,EAAA,MAAM,IAAA,GAAO,MAAM,KAAA,CAAM,GAAA,CAAI,MAAM,MAAM,CAAA;AACzC,EAAA,MAAM,YACJ,KAAA,CAAM,SAAA,IACL,MAAM,wBAAA,CAAyB,KAAK,EAAE,KAAA,EAAO,MAAA,CAAO,CAAA,EAAG,MAAM,MAAM,CAAA,CAAA,EAAI,MAAM,OAAO,CAAA,CAAE,GAAG,CAAA;AAC5F,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,SAAA,EAAW;AACvB,IAAA,MAAM,IAAI,MAAM,sGAAsG,CAAA;AAAA,EACxH;AACA,EAAA,MAAM,MAAM,MAAM,yBAAA,CAA0B,SAAS,CAAA,CAAE,OAAO,IAAI,CAAA;AAClE,EAAA,IAAI,aAAA,CAAc,GAAA,EAAK,KAAA,CAAM,KAAA,EAAO,YAAA,CAAa,MAAM,OAAO,CAAC,CAAA,KAAM,KAAA,CAAM,OAAA,EAAS;AAClF,IAAA,OAAA,CAAQ,GAAG,CAAA;AACX,IAAA,MAAM,IAAI,MAAM,8DAA8D,CAAA;AAAA,EAChF;AACA,EAAA,OAAO,GAAA;AACT","file":"chunk-P4OMTC6I.mjs","sourcesContent":["import type { DeviceUnwrapKey } from \"../chains/stellar/DeviceUnwrapKey\";\nimport { WebCryptoDeviceUnwrapKey } from \"../chains/stellar/WebCryptoDeviceUnwrapKey\";\nimport { zeroize, type MasterDEK } from \"./dek\";\nimport { nativeAddress, parseAppSalt, type NativeChain } from \"./derive\";\nimport type { WrapStore } from \"./DeviceSecret\";\nimport { deviceFactorFromUnwrapKey } from \"./factor\";\nimport { idbWrapStore } from \"./idbWrapStore\";\n\nexport interface LocalDekInput {\n  chain: NativeChain;\n  userId: string;\n  appSalt: string;\n  /** The account's address. The DEK is refused unless it derives it. */\n  address: string;\n  /** The same scope connect used; the vault passes the app id. */\n  keyScope?: string;\n  store?: WrapStore;\n  unwrapKey?: DeviceUnwrapKey;\n}\n\n/** Open this device's wrap of the account's DEK. Throws if this device holds none, or holds another account's. */\nexport async function readLocalDek(input: LocalDekInput): Promise<MasterDEK> {\n  const scoped = (id: string) => (input.keyScope ? `${input.keyScope}|${id}` : id);\n  const store = input.store ?? idbWrapStore(input.keyScope);\n  const wrap = await store.get(input.userId);\n  const unwrapKey =\n    input.unwrapKey ??\n    (await WebCryptoDeviceUnwrapKey.load({ keyId: scoped(`${input.userId}:${input.appSalt}`) }));\n  if (!wrap || !unwrapKey) {\n    throw new Error(\"kit/secret: this device does not hold the wallet key. Add the passkey on the device you use to sign.\");\n  }\n  const dek = await deviceFactorFromUnwrapKey(unwrapKey).unwrap(wrap);\n  if (nativeAddress(dek, input.chain, parseAppSalt(input.appSalt)) !== input.address) {\n    zeroize(dek);\n    throw new Error(\"kit/secret: the key on this device does not open this wallet\");\n  }\n  return dek;\n}\n"]}