exportWallet
Disclose key material once, to an authorized secure recipient.
Status
Proposed target SDK behavior for implementation. It is not an available SDK, export protocol, or evidence that export is supported.
Business action#
Authorize an encrypted export of the wallet's network-scoped signing material to one explicit recipient.
Proposed call#
exportWallet(
input: ExportWalletInput,
options?: CallOptions,
): Promise<Operation<ExportWalletResult>>
TypeScript uses requestId, walletId, recipientEncryptionIdentity, actor, purpose, and optional authorization. Result bytes remain recipient-bound encrypted data with explicit encoding metadata.
async def export_wallet(
input: ExportWalletInput,
*,
options: CallOptions | None = None,
) -> Operation[ExportWalletResult]: ...
Python uses request_id, wallet_id, recipient_encryption_identity, actor, purpose, and optional authorization. Byte results do not pass through an implicit text decode.
ExportWallet(
ctx context.Context,
input *ExportWalletInput,
) (*Operation[ExportWalletResult], error)
Go uses RequestID, WalletID and RecipientEncryptionIdentity; returned byte slices are caller-owned copies. A context error after SDK dispatch is an unknown disclosure outcome until GetOperation resolves it, even when backend acceptance was not observed.
Required input: requestId, walletId, recipient encryption identity, actor, stated purpose and mode-appropriate owner/service authorization. No mnemonic-export result is promised.
Result and durable recovery#
Success returns wallet ID, recipient-bound encrypted bundle metadata and a controlled delivery result. The result is never plaintext and does not delete, transfer or revoke the source wallet.
The request ID binds immutable wallet, recipient, actor, purpose and required authority context; authorization responses are accumulated separately. Same-ID/same-material replay recovers the original encrypted export for the same authorized recipient within the retained result horizon, without creating a new export or exposing plaintext. If a specifically named field is intentionally nonrecoverable, the implementation contract must identify it before release and getOperation must fail clearly rather than fabricate or regenerate it. Changed material conflicts, and unknown outcome never authorizes a second export.
Authorization and failures#
The SDK uses the mode-appropriate handler once or returns requiresAction; it cannot do both. Login is not export consent or server authority. Embedded export uses owner authorization; server export, if policy permits it at all, uses service/admin authority and limits. The response binds exact mode, wallet, purpose and recipient. Denial/expiry yields no bundle; raw signing material never appears in normal state/logs.
Acceptance#
- Positive: only the intended recipient can use the encrypted export and the same encrypted result remains recoverable after restart within its published retention.
- Negative: no plaintext appears in transport diagnostics or examples; retry does not create a second disclosure; export cannot be described as mnemonic export or wallet deletion.