@hwlt/era-connect 0.1.0

package/dist/shared-B8Wc7ViU.js

@@ -0,0 +1,1472 @@
+import { sha256 } from "@noble/hashes/sha2";
+//#region src/core/errors.ts
+/** Every error thrown by this SDK. `code` is stable API; `message` is not. */
+var EraSdkError = class extends Error {
+	constructor(code, message, details) {
+		super(message);
+		this.name = "EraSdkError";
+		this.code = code;
+		if (details !== void 0) this.details = details;
+	}
+};
+//#endregion
+//#region src/cbor/model.ts
+const cbUint = (value) => {
+	const v = typeof value === "number" ? BigInt(value) : value;
+	if (v < 0n) throw new EraSdkError("invalid-props", "cbUint: negative value");
+	return {
+		kind: "uint",
+		value: v
+	};
+};
+const cbBytes = (value) => ({
+	kind: "bytes",
+	value
+});
+const cbText = (value) => ({
+	kind: "text",
+	value
+});
+const cbArray = (items) => ({
+	kind: "array",
+	items
+});
+const cbBool = (value) => ({
+	kind: "bool",
+	value
+});
+const cbTag = (tag, value) => ({
+	kind: "tag",
+	tag,
+	value
+});
+/** Integer-keyed map in the given entry order (the shape every ERA payload uses). */
+const cbMap = (entries) => ({
+	kind: "map",
+	entries: entries.map(([k, v]) => [cbUint(k), v])
+});
+/** Strip any tag wrappers (tag-37 UUID echoes, tag-304 keypaths, ...). */
+function stripTags(value) {
+	let v = value;
+	while (v.kind === "tag") v = v.value;
+	return v;
+}
+/** Look up an integer key in a map value. Tag-agnostic on the VALUE is the caller's choice. */
+function mapGet(map, key) {
+	if (map.kind !== "map") return void 0;
+	const k = BigInt(key);
+	for (const [ek, ev] of map.entries) if (ek.kind === "uint" && ek.value === k) return ev;
+}
+function asUint(value) {
+	if (!value) return void 0;
+	const v = stripTags(value);
+	return v.kind === "uint" ? v.value : void 0;
+}
+function asBytes(value) {
+	if (!value) return void 0;
+	const v = stripTags(value);
+	return v.kind === "bytes" ? v.value : void 0;
+}
+function asText(value) {
+	if (!value) return void 0;
+	const v = stripTags(value);
+	return v.kind === "text" ? v.value : void 0;
+}
+function asArray(value) {
+	if (!value) return void 0;
+	const v = stripTags(value);
+	return v.kind === "array" ? v.items : void 0;
+}
+function asMap(value) {
+	if (!value) return void 0;
+	const v = stripTags(value);
+	return v.kind === "map" ? v : void 0;
+}
+function asBool(value) {
+	if (!value) return void 0;
+	const v = stripTags(value);
+	return v.kind === "bool" ? v.value : void 0;
+}
+//#endregion
+//#region src/registry/keypath.ts
+const PATH_LEVEL = /^(\d+)('?)$/;
+const HARDENED_OFFSET = 2147483648;
+/** Parse `m/44'/60'/0'/0/5` into levels. Throws `invalid-props` on anything else. */
+function parsePath(path) {
+	if (!path.startsWith("m/")) throw new EraSdkError("invalid-props", `derivation path must start with "m/": ${path}`);
+	const segments = path.slice(2).split("/");
+	const levels = [];
+	for (const segment of segments) {
+		const match = PATH_LEVEL.exec(segment);
+		if (!match) throw new EraSdkError("invalid-props", `bad derivation path segment "${segment}"`);
+		const index = Number(match[1]);
+		if (!Number.isSafeInteger(index) || index >= HARDENED_OFFSET) throw new EraSdkError("invalid-props", `derivation index out of range in "${segment}"`);
+		levels.push({
+			index,
+			hardened: match[2] === "'"
+		});
+	}
+	if (levels.length === 0) throw new EraSdkError("invalid-props", "derivation path has no levels");
+	return levels;
+}
+function formatPath(levels) {
+	return `m/${levels.map((l) => `${l.index}${l.hardened ? "'" : ""}`).join("/")}`;
+}
+function pathEquals(a, b) {
+	if (a.length !== b.length) return false;
+	return a.every((l, i) => l.index === b[i].index && l.hardened === b[i].hardened);
+}
+/** Flat `[index, hardened, index, hardened, ...]` component list. */
+function pathComponentsCbor(levels) {
+	const items = [];
+	for (const level of levels) items.push(cbUint(level.index), cbBool(level.hardened));
+	return cbArray(items);
+}
+/** A `crypto-keypath` (tag 304): `{1: components, 2: xfp}` (key 2 omitted when no xfp). */
+function keypath304(levels, xfp) {
+	const entries = [[1, pathComponentsCbor(levels)]];
+	if (xfp !== void 0) entries.push([2, cbUint(xfp)]);
+	return cbTag(304, cbMap(entries));
+}
+/** Parse the flat component list of a `crypto-keypath` back into levels (null on malformed). */
+function parsePathComponents(value) {
+	const items = asArray(value);
+	if (!items || items.length % 2 !== 0) return null;
+	const levels = [];
+	for (let i = 0; i < items.length; i += 2) {
+		const index = asUint(items[i]);
+		const hardened = asBool(items[i + 1]);
+		if (index === void 0 || hardened === void 0 || index >= BigInt(HARDENED_OFFSET)) return null;
+		levels.push({
+			index: Number(index),
+			hardened
+		});
+	}
+	return levels;
+}
+/** Normalize an xfp given as a u32 int or an 8-hex string into a u32 number. */
+function normalizeXfp(xfp) {
+	if (typeof xfp === "number") {
+		if (!Number.isSafeInteger(xfp) || xfp < 0 || xfp > 4294967295) throw new EraSdkError("invalid-props", "xfp must be an unsigned 32-bit integer");
+		return xfp;
+	}
+	const hex = xfp.startsWith("0x") ? xfp.slice(2) : xfp;
+	if (!/^[0-9a-fA-F]{1,8}$/.test(hex)) throw new EraSdkError("invalid-props", "xfp string must be up to 8 hex characters");
+	return Number.parseInt(hex, 16);
+}
+/** Lowercase 8-hex form of an xfp (the display / Tron wire form). */
+function xfpToHex(xfp) {
+	return xfp.toString(16).padStart(8, "0");
+}
+//#endregion
+//#region src/core/bytes.ts
+/** Byte helpers. `Uint8Array` end-to-end; no Buffer, no Node built-ins. */
+function concatBytes(...arrays) {
+	let total = 0;
+	for (const a of arrays) total += a.length;
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const a of arrays) {
+		out.set(a, offset);
+		offset += a.length;
+	}
+	return out;
+}
+/** Constant-shape byte equality (length check + full loop). */
+function equalBytes(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
+	return diff === 0;
+}
+/** Big-endian unsigned 32-bit. */
+function u32be(value) {
+	const out = /* @__PURE__ */ new Uint8Array(4);
+	out[0] = value >>> 24 & 255;
+	out[1] = value >>> 16 & 255;
+	out[2] = value >>> 8 & 255;
+	out[3] = value & 255;
+	return out;
+}
+const HEX_CHARS = "0123456789abcdef";
+function bytesToHex(bytes) {
+	let out = "";
+	for (const b of bytes) out += HEX_CHARS[b >>> 4] + HEX_CHARS[b & 15];
+	return out;
+}
+function hexToBytes(hex) {
+	let h = hex;
+	if (h.startsWith("0x") || h.startsWith("0X")) h = h.slice(2);
+	if (h.length % 2 !== 0) throw new Error("hex string has odd length");
+	const out = new Uint8Array(h.length / 2);
+	for (let i = 0; i < out.length; i++) {
+		const byte = Number.parseInt(h.slice(i * 2, i * 2 + 2), 16);
+		if (Number.isNaN(byte)) throw new Error("hex string has non-hex characters");
+		out[i] = byte;
+	}
+	return out;
+}
+function bytesToBigint(bytes) {
+	let out = 0n;
+	for (const b of bytes) out = out << 8n | BigInt(b);
+	return out;
+}
+/** UTF-8 encode without TextEncoder (absent on older Hermes). */
+function utf8Encode(text) {
+	const out = [];
+	for (let i = 0; i < text.length; i++) {
+		let code = text.charCodeAt(i);
+		if (code < 128) out.push(code);
+		else if (code < 2048) out.push(192 | code >> 6, 128 | code & 63);
+		else if (code < 55296 || code >= 57344) out.push(224 | code >> 12, 128 | code >> 6 & 63, 128 | code & 63);
+		else {
+			i++;
+			if (i >= text.length) throw new Error("unpaired surrogate in string");
+			const next = text.charCodeAt(i);
+			code = 65536 + ((code & 1023) << 10 | next & 1023);
+			out.push(240 | code >> 18, 128 | code >> 12 & 63, 128 | code >> 6 & 63, 128 | code & 63);
+		}
+	}
+	return new Uint8Array(out);
+}
+/**
+* STRICT UTF-8 decode without TextDecoder (absent on older Hermes). Throws on
+* malformed input, including overlong encodings, surrogate code points and
+* values past U+10FFFF — a lenient decoder would let a hostile reply smuggle
+* bytes that render as different text than they compare as.
+*/
+function utf8Decode(bytes) {
+	let out = "";
+	let i = 0;
+	while (i < bytes.length) {
+		const b0 = bytes[i];
+		if (b0 < 128) {
+			out += String.fromCharCode(b0);
+			i += 1;
+			continue;
+		}
+		let extra;
+		let code;
+		let minCode;
+		if ((b0 & 224) === 192) {
+			extra = 1;
+			code = b0 & 31;
+			minCode = 128;
+		} else if ((b0 & 240) === 224) {
+			extra = 2;
+			code = b0 & 15;
+			minCode = 2048;
+		} else if ((b0 & 248) === 240) {
+			extra = 3;
+			code = b0 & 7;
+			minCode = 65536;
+		} else throw new Error("malformed UTF-8");
+		if (i + extra >= bytes.length) throw new Error("truncated UTF-8");
+		for (let k = 1; k <= extra; k++) {
+			const bk = bytes[i + k];
+			if ((bk & 192) !== 128) throw new Error("malformed UTF-8 continuation");
+			code = code << 6 | bk & 63;
+		}
+		if (code < minCode) throw new Error("overlong UTF-8 encoding");
+		if (code >= 55296 && code <= 57343) throw new Error("UTF-8 encodes a surrogate");
+		if (code > 1114111) throw new Error("UTF-8 code point out of range");
+		if (code > 65535) {
+			code -= 65536;
+			out += String.fromCharCode(55296 + (code >> 10), 56320 + (code & 1023));
+		} else out += String.fromCharCode(code);
+		i += 1 + extra;
+	}
+	return out;
+}
+/** ASCII decode (used for replies that carry text as raw bytes). Throws on non-ASCII. */
+function asciiDecode(bytes) {
+	let out = "";
+	for (const b of bytes) {
+		if (b > 127) throw new Error("non-ASCII byte");
+		out += String.fromCharCode(b);
+	}
+	return out;
+}
+//#endregion
+//#region src/cbor/encode.ts
+/**
+* Deterministic CBOR encoder: definite lengths only, minimal-width integer
+* heads, map entries in insertion order. This matches, byte for byte, what the
+* reference implementation produces and what the device firmware parses — the
+* exact bytes are pinned by golden-vector tests, which is why this encoder is
+* hand-rolled rather than delegated to a dependency's release cadence.
+*
+* It deliberately cannot emit floats, indefinite lengths or exotic simple
+* values: the protocol never uses them.
+*/
+function cborEncode(value) {
+	const parts = [];
+	writeValue(value, parts, 0);
+	return concatBytes(...parts);
+}
+const MAX_DEPTH$1 = 16;
+function writeValue(value, parts, depth) {
+	if (depth > MAX_DEPTH$1) throw new EraSdkError("malformed-cbor", "cbor encode: nesting too deep");
+	switch (value.kind) {
+		case "uint":
+			parts.push(head(0, value.value));
+			return;
+		case "nint":
+			if (value.value < 0n) throw new EraSdkError("malformed-cbor", "nint holds the magnitude");
+			parts.push(head(1, value.value));
+			return;
+		case "bytes":
+			parts.push(head(2, BigInt(value.value.length)), value.value);
+			return;
+		case "text": {
+			const utf8 = utf8Encode(value.value);
+			parts.push(head(3, BigInt(utf8.length)), utf8);
+			return;
+		}
+		case "array":
+			parts.push(head(4, BigInt(value.items.length)));
+			for (const item of value.items) writeValue(item, parts, depth + 1);
+			return;
+		case "map":
+			parts.push(head(5, BigInt(value.entries.length)));
+			for (const [k, v] of value.entries) {
+				writeValue(k, parts, depth + 1);
+				writeValue(v, parts, depth + 1);
+			}
+			return;
+		case "tag":
+			parts.push(head(6, BigInt(value.tag)));
+			writeValue(value.value, parts, depth + 1);
+			return;
+		case "bool":
+			parts.push(new Uint8Array([value.value ? 245 : 244]));
+			return;
+		case "null":
+			parts.push(new Uint8Array([246]));
+			return;
+	}
+}
+/** Major-type head with a minimal-width argument. */
+function head(major, arg) {
+	if (arg < 0n) throw new EraSdkError("malformed-cbor", "cbor head: negative argument");
+	const m = major << 5;
+	if (arg < 24n) return new Uint8Array([m | Number(arg)]);
+	if (arg <= 255n) return new Uint8Array([m | 24, Number(arg)]);
+	if (arg <= 65535n) {
+		const n = Number(arg);
+		return new Uint8Array([
+			m | 25,
+			n >>> 8,
+			n & 255
+		]);
+	}
+	if (arg <= 4294967295n) {
+		const n = Number(arg);
+		return new Uint8Array([
+			m | 26,
+			n >>> 24 & 255,
+			n >>> 16 & 255,
+			n >>> 8 & 255,
+			n & 255
+		]);
+	}
+	if (arg <= 18446744073709551615n) {
+		const out = /* @__PURE__ */ new Uint8Array(9);
+		out[0] = m | 27;
+		let v = arg;
+		for (let i = 8; i >= 1; i--) {
+			out[i] = Number(v & 255n);
+			v >>= 8n;
+		}
+		return out;
+	}
+	throw new EraSdkError("malformed-cbor", "cbor head: argument exceeds 64 bits");
+}
+//#endregion
+//#region src/cbor/decode.ts
+/**
+* Hardened CBOR decoder for scanned (attacker-controlled) payloads.
+*
+* Policy, enforced as defaults rather than options:
+*  - definite lengths only (indefinite refused);
+*  - no floats, no simple values beyond bool/null;
+*  - duplicate map keys refused;
+*  - nesting depth capped;
+*  - lengths bounds-checked before any allocation;
+*  - trailing bytes after the top-level item refused.
+*
+* Unknown tags are surfaced as `tag` wrappers, never dropped — the tag-37
+* request-id echo is compared tag-agnostically by the callers.
+*/
+function cborDecode(bytes) {
+	const reader = new Reader(bytes);
+	const value = reader.readValue(0);
+	if (reader.offset !== bytes.length) throw err("trailing bytes after the top-level item");
+	return value;
+}
+const MAX_DEPTH = 16;
+function err(message) {
+	return new EraSdkError("malformed-cbor", `cbor: ${message}`);
+}
+var Reader = class {
+	constructor(bytes) {
+		this.bytes = bytes;
+		this.offset = 0;
+	}
+	readValue(depth) {
+		if (depth > MAX_DEPTH) throw err("nesting too deep");
+		const initial = this.readByte();
+		const major = initial >>> 5;
+		const info = initial & 31;
+		switch (major) {
+			case 0: return {
+				kind: "uint",
+				value: this.readArg(info)
+			};
+			case 1: return {
+				kind: "nint",
+				value: this.readArg(info)
+			};
+			case 2: {
+				const len = this.readLength(info);
+				return {
+					kind: "bytes",
+					value: this.readBytes(len)
+				};
+			}
+			case 3: {
+				const len = this.readLength(info);
+				const raw = this.readBytes(len);
+				let text;
+				try {
+					text = utf8Decode(raw);
+				} catch {
+					throw err("text string is not valid UTF-8");
+				}
+				return {
+					kind: "text",
+					value: text
+				};
+			}
+			case 4: {
+				const len = this.readLength(info);
+				if (len > this.bytes.length - this.offset) throw err("array length exceeds input");
+				const items = [];
+				for (let i = 0; i < len; i++) items.push(this.readValue(depth + 1));
+				return {
+					kind: "array",
+					items
+				};
+			}
+			case 5: {
+				const len = this.readLength(info);
+				if (len * 2 > this.bytes.length - this.offset) throw err("map length exceeds input");
+				const entries = [];
+				const seenKeys = /* @__PURE__ */ new Set();
+				for (let i = 0; i < len; i++) {
+					const key = this.readValue(depth + 1);
+					const keyId = bytesToHex(cborEncode(key));
+					if (seenKeys.has(keyId)) throw err("duplicate map key");
+					seenKeys.add(keyId);
+					entries.push([key, this.readValue(depth + 1)]);
+				}
+				return {
+					kind: "map",
+					entries
+				};
+			}
+			case 6: {
+				const tag = this.readArg(info);
+				if (tag > 4294967295n) throw err("tag exceeds 32 bits");
+				return {
+					kind: "tag",
+					tag: Number(tag),
+					value: this.readValue(depth + 1)
+				};
+			}
+			case 7:
+				if (info === 20) return {
+					kind: "bool",
+					value: false
+				};
+				if (info === 21) return {
+					kind: "bool",
+					value: true
+				};
+				if (info === 22) return { kind: "null" };
+				throw err(`unsupported simple/float value (info ${info})`);
+			default: throw err("unreachable major type");
+		}
+	}
+	readByte() {
+		const b = this.bytes[this.offset];
+		if (b === void 0) throw err("truncated input");
+		this.offset += 1;
+		return b;
+	}
+	/** Argument of a head. Refuses indefinite (31) and reserved (28-30). */
+	readArg(info) {
+		if (info < 24) return BigInt(info);
+		if (info === 24) return BigInt(this.readByte());
+		if (info === 25) {
+			const hi = this.readByte();
+			return BigInt(hi << 8 | this.readByte());
+		}
+		if (info === 26) {
+			let v = 0n;
+			for (let i = 0; i < 4; i++) v = v << 8n | BigInt(this.readByte());
+			return v;
+		}
+		if (info === 27) {
+			let v = 0n;
+			for (let i = 0; i < 8; i++) v = v << 8n | BigInt(this.readByte());
+			return v;
+		}
+		if (info === 31) throw err("indefinite lengths are refused");
+		throw err(`reserved additional info ${info}`);
+	}
+	readLength(info) {
+		const len = this.readArg(info);
+		if (len > BigInt(this.bytes.length - this.offset)) throw err("length exceeds input");
+		return Number(len);
+	}
+	readBytes(length) {
+		const end = this.offset + length;
+		const out = this.bytes.slice(this.offset, end);
+		this.offset = end;
+		return out;
+	}
+};
+//#endregion
+//#region src/ur/crc32.ts
+/** IEEE CRC-32 (polynomial 0xEDB88320), table-driven, result as unsigned. */
+const TABLE = (() => {
+	const table = /* @__PURE__ */ new Uint32Array(256);
+	for (let i = 0; i < 256; i++) {
+		let c = i;
+		for (let k = 0; k < 8; k++) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+		table[i] = c >>> 0;
+	}
+	return table;
+})();
+function crc32(bytes) {
+	let crc = 4294967295;
+	for (const byte of bytes) crc = crc >>> 8 ^ TABLE[(crc ^ byte) & 255];
+	return (crc ^ 4294967295) >>> 0;
+}
+//#endregion
+//#region src/ur/bytewords.ts
+/**
+* Bytewords codec (minimal style only), per BCR-2020-012.
+*
+* Decode hardening (each of these used to turn malformed input into plausible
+* bytes in naive implementations):
+*  - a letter pair that is not a byteword is a refusal, never a fallback byte;
+*  - a body shorter than the four CRC words plus one byte is a refusal;
+*  - the trailing CRC32 (big-endian) is verified and stripped.
+*
+* The checksum is unkeyed and is not an authentication control — whoever
+* prints the QR prints the CRC too. What it buys is that garbage stops being
+* accepted as data, which frame dedup and reassembly downstream both assume.
+*/
+const BYTE_WORDS = "ableacidalsoapexaquaarchatomauntawayaxisbackbaldbarnbeltbetabiasbluebodybragbrewbulbbuzzcalmcashcatschefcityclawcodecolacookcostcruxcurlcuspcyandarkdatadaysdelidicedietdoordowndrawdropdrumdulldutyeacheasyechoedgeepicevenexamexiteyesfactfairfernfigsfilmfishfizzflapflewfluxfoxyfreefrogfuelfundgalagamegeargemsgiftgirlglowgoodgraygrimgurugushgyrohalfhanghardhawkheathelphighhillholyhopehornhutsicedideaidleinchinkyintoirisironitemjadejazzjoinjoltjowljudojugsjumpjunkjurykeepkenokeptkeyskickkilnkingkitekiwiknoblamblavalazyleaflegsliarlimplionlistlogoloudloveluaulucklungmainmanymathmazememomenumeowmildmintmissmonknailnavyneednewsnextnoonnotenumbobeyoboeomitonyxopenovalowlspaidpartpeckplaypluspoempoolposepuffpumapurrquadquizraceramprealredorichroadrockroofrubyruinrunsrustsafesagascarsetssilkskewslotsoapsolosongstubsurfswantacotasktaxitenttiedtimetinytoiltombtoystriptunatwinuglyundouniturgeuservastveryvetovialvibeviewvisavoidvowswallwandwarmwaspwavewaxywebswhatwhenwhizwolfworkyankyawnyellyogayurtzapszerozestzinczonezoom";
+const DIM = 26;
+const A = "a".charCodeAt(0);
+/** Lookup keyed on (first letter, last letter); -1 = not a byteword. */
+const LOOKUP = (() => {
+	const table = (/* @__PURE__ */ new Int16Array(676)).fill(-1);
+	for (let i = 0; i < 256; i++) {
+		const word = BYTE_WORDS.slice(i * 4, i * 4 + 4);
+		const x = word.charCodeAt(0) - A;
+		const y = word.charCodeAt(3) - A;
+		table[y * DIM + x] = i;
+	}
+	return table;
+})();
+function bytewordsEncode(data) {
+	const buf = concatBytes(data, u32be(crc32(data)));
+	let out = "";
+	for (const byte of buf) {
+		const word = BYTE_WORDS.slice(byte * 4, byte * 4 + 4);
+		out += word[0] + word[3];
+	}
+	return out;
+}
+function bytewordsDecode(body) {
+	if (body.length % 2 !== 0) throw new EraSdkError("malformed-bytewords", "bytewords: odd number of letters");
+	const words = new Uint8Array(body.length / 2);
+	for (let i = 0; i < words.length; i++) {
+		const x = body.charCodeAt(i * 2) - A;
+		const y = body.charCodeAt(i * 2 + 1) - A;
+		if (x < 0 || x >= DIM || y < 0 || y >= DIM) throw new EraSdkError("malformed-bytewords", "bytewords: letter out of range");
+		const value = LOOKUP[y * DIM + x];
+		if (value < 0) throw new EraSdkError("malformed-bytewords", "bytewords: not a byteword");
+		words[i] = value;
+	}
+	if (words.length < 5) throw new EraSdkError("malformed-bytewords", "bytewords: shorter than a checksum plus one byte");
+	const bodyBytes = words.slice(0, words.length - 4);
+	const declared = (words[words.length - 4] << 24 | words[words.length - 3] << 16 | words[words.length - 2] << 8 | words[words.length - 1]) >>> 0;
+	if (crc32(bodyBytes) !== declared) throw new EraSdkError("checksum-mismatch", "bytewords: checksum mismatch");
+	return bodyBytes;
+}
+//#endregion
+//#region src/ur/ur.ts
+/** An immutable Uniform Resource: a registry type string plus its CBOR payload. */
+var Ur = class {
+	constructor(type, cbor) {
+		if (!/^[a-z][a-z0-9-]*$/.test(type)) throw new EraSdkError("invalid-props", `"${type}" is not a valid UR type`);
+		this.type = type;
+		this.cbor = cbor;
+	}
+	/** The whole UR as one single-part `ur:` string, lowercase (the loggable form). */
+	toString() {
+		return `ur:${this.type}/${bytewordsEncode(this.cbor)}`;
+	}
+	/** The single-part wire form, uppercase (QR alphanumeric mode). */
+	toWireString() {
+		return this.toString().toUpperCase();
+	}
+};
+const UR_GRAMMAR = /^ur:([a-z-]+)(\/(\d+-\d+))?\/([a-z]+)$/;
+/**
+* Parse one `ur:` string into (type, sequence, decoded payload).
+*
+* An ABSENT sequence segment means a single-part UR. A segment that is present
+* but unreadable (a number too wide, `0-0`) is a malformed frame and throws —
+* promoting it to "single-part" would send a broken fragment down the branch
+* that completes a scan.
+*/
+function parseUrString(text) {
+	const lower = text.toLowerCase();
+	const match = UR_GRAMMAR.exec(lower);
+	if (!match) throw new EraSdkError("not-a-ur", "not a ur: string");
+	const type = match[1];
+	const seqSegment = match[3];
+	const payload = bytewordsDecode(match[4]);
+	if (seqSegment === void 0) return {
+		type,
+		seq: null,
+		payload
+	};
+	const [numText, lengthText] = seqSegment.split("-");
+	const num = Number(numText);
+	const length = Number(lengthText);
+	if (!Number.isSafeInteger(num) || !Number.isSafeInteger(length) || num <= 0 || length <= 0) throw new EraSdkError("malformed-sequence", "unreadable ur sequence segment");
+	return {
+		type,
+		seq: {
+			num,
+			length
+		},
+		payload
+	};
+}
+/** The `ur:<type>/` prefix of a frame, without decoding the bytewords body. */
+const TYPE_PREFIX = /^ur:([a-z][a-z0-9-]*)\//;
+function urTypeOf(text) {
+	const match = TYPE_PREFIX.exec(text.toLowerCase());
+	return match ? match[1] : null;
+}
+//#endregion
+//#region src/core/rand.ts
+/**
+* 16 unpredictable bytes for a sign request id.
+*
+* A CSPRNG output, deliberately NOT a v4/v8 UUID: a UUID spends bits on the
+* wall clock and version fields, leaking the time of signing into the QR and
+* shrinking the unguessable part. The id is what a reply must echo to prove it
+* answers THIS request; it is formatted as a UUID string only where the wire
+* demands one (Tron's `signId`).
+*/
+function randomRequestId(randomBytes) {
+	if (randomBytes) {
+		const out = randomBytes(16);
+		if (!(out instanceof Uint8Array) || out.length !== 16) throw new EraSdkError("no-secure-random", "randomBytes(16) did not return 16 bytes");
+		return out;
+	}
+	const crypto = globalThis.crypto;
+	if (crypto?.getRandomValues) {
+		const out = /* @__PURE__ */ new Uint8Array(16);
+		crypto.getRandomValues(out);
+		return out;
+	}
+	throw new EraSdkError("no-secure-random", "no secure random source: install react-native-get-random-values (React Native) or pass randomBytes in the EraConnect config");
+}
+/** Render 16 bytes as a lowercase hyphenated UUID string (8-4-4-4-12). */
+function uuidStringify(bytes) {
+	if (bytes.length !== 16) throw new EraSdkError("invalid-props", "request id must be 16 bytes");
+	const hex = bytesToHex(bytes);
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+/** Accept a request id as 16 raw bytes or a hyphenated/plain 32-hex string. */
+function normalizeRequestId(id) {
+	if (id instanceof Uint8Array) {
+		if (id.length !== 16) throw new EraSdkError("invalid-props", "request id must be 16 bytes");
+		return new Uint8Array(id);
+	}
+	const hex = id.replace(/-/g, "");
+	if (!/^[0-9a-fA-F]{32}$/.test(hex)) throw new EraSdkError("invalid-props", "request id string must be a 32-hex UUID");
+	return hexToBytes(hex.toLowerCase());
+}
+//#endregion
+//#region src/ur/limits.ts
+/**
+* Bounds every field a scanned UR fragment can dictate, BEFORE that field is
+* allowed to size an allocation or a loop.
+*
+* A QR in the camera frame is attacker-controlled input: a sticker on the
+* device, a second screen, a poster. Without these bounds the fragment
+* header's `seqLength` goes straight into array allocation and into a
+* quadratic index shuffle, so ~60 characters of QR can ask the host for
+* gigabytes or minutes of work — no gzip, no multi-frame assembly, one frame.
+*
+* The numbers are generous headroom over real device traffic, NOT tight
+* protocol bounds: a cap that refuses a genuine reply is worse than the
+* denial of service it prevents.
+*/
+const UrLimits = {
+	/** Largest reassembled UR payload, in bytes. */
+	maxMessageBytes: 65536,
+	/** Largest number of source fragments a multi-part UR may declare. */
+	maxFragmentCount: 2048,
+	/** Largest single fragment payload, in bytes (QR v40 tops out at 2953). */
+	maxFragmentBytes: 4096,
+	/** Largest value for any u32 header field (`seqNum`, `checksum`). */
+	maxUint32: 4294967295
+};
+/**
+* Whether a fragment header describes a UR that could exist.
+*
+* The two inequalities are the BC-UR relation
+* `seqLength == ceil(messageLength / fragmentLength)` written without
+* division — exactly what both fountain encoders produce. They stop a header
+* from claiming thousands of fragments for a twenty-byte message.
+*
+* `seqLength >= 2`, not 1: a "multi-part" UR with a single source fragment is
+* something neither encoder can produce (both short-circuit to a single-part
+* UR), and it would defeat the two-fragment stream-binding rule with two
+* static images (`1-1` and `2-1` differ only in seqNum and both resolve to
+* fragment 0).
+*/
+function headerIsConsistent(header) {
+	const { seqNum, seqLength, messageLength, checksum, fragmentLength } = header;
+	if (seqNum < 1 || seqNum > UrLimits.maxUint32) return false;
+	if (checksum < 0 || checksum > UrLimits.maxUint32) return false;
+	if (seqLength < 2 || seqLength > UrLimits.maxFragmentCount) return false;
+	if (fragmentLength < 1 || fragmentLength > UrLimits.maxFragmentBytes) return false;
+	if (messageLength < 1 || messageLength > UrLimits.maxMessageBytes) return false;
+	if (messageLength > seqLength * fragmentLength) return false;
+	if (messageLength <= (seqLength - 1) * fragmentLength) return false;
+	return true;
+}
+//#endregion
+//#region src/ur/xoshiro.ts
+/**
+* Xoshiro256** seeded from a 32-byte digest, with the exact
+* `(x >>> 11) * 2^-53` double conversion the BC-UR fountain code uses.
+*
+* The draw sequence IS the wire protocol: the device runs the same PRNG over
+* the same seed to derive which source fragments a fountain frame covers.
+*/
+const MASK64 = (1n << 64n) - 1n;
+function rotl(x, k) {
+	return (x << k | x >> 64n - k) & MASK64;
+}
+var Xoshiro256ss = class {
+	/** Seed from a 32-byte digest split into four big-endian u64 words. */
+	constructor(digest) {
+		if (digest.length !== 32) throw new Error("xoshiro seed must be 32 bytes");
+		const word = (offset) => {
+			let v = 0n;
+			for (let i = 0; i < 8; i++) v = v << 8n | BigInt(digest[offset + i]);
+			return v;
+		};
+		this.s0 = word(0);
+		this.s1 = word(8);
+		this.s2 = word(16);
+		this.s3 = word(24);
+		if ((this.s0 | this.s1 | this.s2 | this.s3) === 0n) throw new Error("xoshiro seed must not be all zeros");
+	}
+	nextRaw64() {
+		const result = rotl(this.s1 * 5n & MASK64, 7n) * 9n & MASK64;
+		const t = this.s1 << 17n & MASK64;
+		this.s2 ^= this.s0;
+		this.s3 ^= this.s1;
+		this.s1 ^= this.s2;
+		this.s0 ^= this.s3;
+		this.s2 ^= t;
+		this.s3 = rotl(this.s3, 45n);
+		return result;
+	}
+	/** Uniform double in [0, 1): top 53 bits of the raw draw. Exact — no precision loss. */
+	nextDouble() {
+		return Number(this.nextRaw64() >> 11n) * 2 ** -53;
+	}
+};
+//#endregion
+//#region src/ur/sampler.ts
+/**
+* Which source fragments the fountain frame `seqNum` of `seqLength` covers.
+*
+* For `seqNum <= seqLength` the frame is the source fragment itself. Above
+* that, the BC-UR fountain sampler runs: seed = sha256(seqNum || checksum)
+* (both big-endian u32), Xoshiro256** drives an alias-method degree chooser
+* over `1/(i+1)` weights, then a full draw-without-replacement permutation of
+* which the first `degree` indexes are taken.
+*
+* Every draw below happens in the exact order of the reference
+* implementation. The draw order IS the wire protocol — a different (even
+* "equivalent") shuffle makes the device's fountain frames undecodable.
+*/
+function chooseFragmentIndexes(seqNum, seqLength, checksum) {
+	if (seqLength < 1 || seqLength > UrLimits.maxFragmentCount) throw new RangeError(`seqLength ${seqLength} outside 1..${UrLimits.maxFragmentCount}; cannot build fountain indexes for a UR this large`);
+	if (seqNum <= seqLength) return [seqNum - 1];
+	const rng = new Xoshiro256ss(sha256(concatBytes(u32be(seqNum), u32be(checksum))));
+	const scaled = new Array(seqLength);
+	let sum = 0;
+	for (let i = 0; i < seqLength; i++) sum += 1 / (i + 1);
+	for (let i = 0; i < seqLength; i++) scaled[i] = 1 / (i + 1) * seqLength / sum;
+	const prob = new Array(seqLength).fill(0);
+	const alias = new Array(seqLength).fill(0);
+	const small = [];
+	const large = [];
+	for (let i = seqLength - 1; i >= 0; i--) (scaled[i] < 1 ? small : large).push(i);
+	while (small.length > 0 && large.length > 0) {
+		const less = small.pop();
+		const more = large.pop();
+		prob[less] = scaled[less];
+		alias[less] = more;
+		scaled[more] = scaled[more] + scaled[less] - 1;
+		(scaled[more] < 1 ? small : large).push(more);
+	}
+	while (large.length > 0) prob[large.pop()] = 1;
+	while (small.length > 0) prob[small.pop()] = 1;
+	const c = Math.floor(rng.nextDouble() * prob.length);
+	const degree = (rng.nextDouble() < prob[c] ? c : alias[c]) + 1;
+	const remaining = [];
+	for (let i = 0; i < seqLength; i++) remaining.push(i);
+	const permutation = [];
+	while (remaining.length > 0) {
+		const index = Math.floor(rng.nextDouble() * remaining.length);
+		permutation.push(remaining.splice(index, 1)[0]);
+	}
+	return permutation.slice(0, degree);
+}
+//#endregion
+//#region src/ur/fragment.ts
+const isSimple = (fragment) => fragment.indexes.length === 1;
+/** Fragment CBOR: the definite 5-array `[seqNum, seqLen, msgLen, checksum, bytes]`. */
+function fragmentCbor(seqNum, seqLength, messageLength, checksum, part) {
+	return cborEncode(cbArray([
+		cbUint(seqNum),
+		cbUint(seqLength),
+		cbUint(messageLength),
+		cbUint(checksum),
+		cbBytes(part)
+	]));
+}
+/**
+* Parse and validate a fragment payload, or return null.
+*
+* Every field here is chosen by whoever printed the QR, and three of them size
+* allocations or loops downstream — so the bounds are checked as a set BEFORE
+* the (quadratic) fountain index derivation pays for anything.
+*/
+function tryParseFragment(type, payload) {
+	let decoded;
+	try {
+		decoded = cborDecode(payload);
+	} catch {
+		return null;
+	}
+	if (decoded.kind !== "array" || decoded.items.length !== 5) return null;
+	const seqNum = uintInRange(decoded.items[0]);
+	const seqLength = uintInRange(decoded.items[1]);
+	const messageLength = uintInRange(decoded.items[2]);
+	const checksum = uintInRange(decoded.items[3]);
+	const partValue = decoded.items[4];
+	if (seqNum === null || seqLength === null || messageLength === null || checksum === null || partValue?.kind !== "bytes") return null;
+	const part = partValue.value;
+	if (!headerIsConsistent({
+		seqNum,
+		seqLength,
+		messageLength,
+		checksum,
+		fragmentLength: part.length
+	})) return null;
+	return {
+		type,
+		seqNum,
+		seqLength,
+		messageLength,
+		checksum,
+		part,
+		indexes: chooseFragmentIndexes(seqNum, seqLength, checksum)
+	};
+}
+/** A CBOR uint in [0, 2^32), or null for anything else. */
+function uintInRange(value) {
+	if (value?.kind !== "uint") return null;
+	const big = value.value;
+	if (big < 0n || big > BigInt(UrLimits.maxUint32)) return null;
+	return Number(big);
+}
+//#endregion
+//#region src/ur/encoder.ts
+/**
+* BC-UR fountain encoder.
+*
+* Partitioning picks the LARGEST fragment length `<= maxFragmentLength` that
+* evenly covers the payload (`ceil(len/count)` for the smallest sufficient
+* `count`), and the last fragment is zero-padded to the common length — both
+* exactly as the reference encoders do, because the receiving side's header
+* consistency check assumes this relation.
+*
+* A payload that fits one fragment is emitted as the plain single-part
+* `ur:<type>/<body>` form on every call — never as a `1-1` sequence.
+*/
+var UrFountainEncoder = class {
+	constructor(ur, maxFragmentLength = 180, minFragmentLength = 10) {
+		this.seqNum = 0;
+		if (ur.cbor.length === 0) throw new EraSdkError("invalid-props", "cannot encode an empty UR payload");
+		if (maxFragmentLength < minFragmentLength || maxFragmentLength <= 0 || minFragmentLength <= 0) throw new EraSdkError("invalid-props", "invalid fragment length bounds");
+		this.ur = ur;
+		this.checksum = crc32(ur.cbor);
+		this.fragments = partition(ur.cbor, maxFragmentLength, minFragmentLength);
+	}
+	get isSinglePart() {
+		return this.fragments.length <= 1;
+	}
+	/** How many source fragments the payload was split into (1 for single-part). */
+	get fragmentCount() {
+		return this.fragments.length;
+	}
+	/** Next wire frame, uppercase. Single-part payloads return the same string every call. */
+	nextPart() {
+		if (this.isSinglePart) return this.ur.toWireString();
+		this.seqNum += 1;
+		const indexes = chooseFragmentIndexes(this.seqNum, this.fragments.length, this.checksum);
+		const first = this.fragments[0];
+		const mixed = new Uint8Array(first.length);
+		for (const index of indexes) {
+			const fragment = this.fragments[index];
+			for (let i = 0; i < mixed.length; i++) mixed[i] = mixed[i] ^ (fragment[i] ?? 0);
+		}
+		const body = fragmentCbor(this.seqNum, this.fragments.length, this.ur.cbor.length, this.checksum, mixed);
+		return `ur:${this.ur.type}/${this.seqNum}-${this.fragments.length}/${bytewordsEncode(body)}`.toUpperCase();
+	}
+};
+/** Largest `ceil(len/count) <= maxLength` split, last fragment zero-padded. */
+function partition(payload, maxLength, minLength) {
+	const maxCount = Math.ceil(payload.length / minLength);
+	let fragmentLength = payload.length;
+	for (let count = 1; count <= maxCount; count++) {
+		fragmentLength = Math.ceil(payload.length / count);
+		if (fragmentLength <= maxLength) break;
+	}
+	const fragments = [];
+	for (let offset = 0; offset < payload.length; offset += fragmentLength) {
+		const slice = payload.slice(offset, offset + fragmentLength);
+		if (slice.length < fragmentLength) {
+			const padded = new Uint8Array(fragmentLength);
+			padded.set(slice);
+			fragments.push(padded);
+		} else fragments.push(slice);
+	}
+	return fragments;
+}
+//#endregion
+//#region src/qr/animated-ur.ts
+const DEFAULT_FRAGMENT_LENGTH = 180;
+/**
+* Frame source for rendering a UR as an animated QR.
+*
+* Drive `nextFrame()` from your own ticker (~8 fps is the battle-tested
+* default) and hand each string to your QR component. Frames are UPPERCASE so
+* the QR encoder can use alphanumeric mode (~45% denser than byte mode).
+*/
+var AnimatedUr = class {
+	constructor(ur, options) {
+		this.encoder = new UrFountainEncoder(ur, options?.maxFragmentLength ?? 180);
+	}
+	/** Whether the payload fits one QR (no animation needed). */
+	get isSingleFrame() {
+		return this.encoder.isSinglePart;
+	}
+	/** The UR registry type being sent, e.g. `eth-sign-request`. */
+	get urType() {
+		return this.encoder.ur.type;
+	}
+	/** How many source fragments the payload was split into. */
+	get fragmentCount() {
+		return this.encoder.fragmentCount;
+	}
+	/** Next wire frame (uppercase). Single-frame payloads return the same string every call. */
+	nextFrame() {
+		return this.encoder.nextPart();
+	}
+	/** The whole request as ONE lowercase `ur:` string — the loggable form, not what is on screen. */
+	toString() {
+		return this.encoder.ur.toString();
+	}
+};
+//#endregion
+//#region src/ur/decoder.ts
+/**
+* BC-UR fountain decoder with hostile-input stream binding.
+*
+* The naive decoder pins its expectations to the FIRST fragment it ever sees
+* and drops everything that disagrees. That is right while the only thing in
+* front of the camera is the device — and it is exactly how one hostile QR (a
+* sticker, a poster, a second screen) used to end the whole session: it bound
+* first, and the device's real answer could never assemble.
+*
+* The cure is to make binding harder, not reversible:
+*
+*  - a stream binds only PROVISIONALLY on its first fragment, and is
+*    CONFIRMED only when a second, distinct fragment of the same stream
+*    arrives (same fingerprint, different seqNum). A static QR is one
+*    fragment forever and can never confirm itself;
+*  - a provisional binding is dropped after 32 non-matching frames — a
+*    genuine stream confirms on its very next frame, so this cannot be aimed
+*    at one;
+*  - a CONFIRMED binding is never evicted. Any recovery path is an eviction
+*    path, so there is none. A rogue fragment that poisons the XOR costs the
+*    accumulated progress (rescan one animation pass), never the binding;
+*  - a single-part UR cannot complete the scan while a confirmed multi-part
+*    assembly holds received fragments.
+*
+* What this does not defend against is an attacker who owns the camera
+* outright — if the only well-formed UR in view is theirs, it assembles. The
+* layers above (type pinning per request, request-id echo, verification
+* helpers) are what refuse that.
+*/
+var UrDecoder = class UrDecoder {
+	constructor() {
+		this.boundType = "";
+		this.seqLength = 0;
+		this.expectedMessageLength = 0;
+		this.expectedChecksum = 0;
+		this.expectedFragmentLength = 0;
+		this.confirmed = false;
+		this.framesSinceBinding = 0;
+		this.bindingSeqNum = 0;
+		this.expectedIndexes = [];
+		this.receivedIndexes = [];
+		this.mixedParts = [];
+		this.queuedParts = [];
+		this.simpleParts = [];
+		this.payload = null;
+		this.completedType = "";
+		this.lastRefusal = null;
+	}
+	get isComplete() {
+		return this.payload !== null;
+	}
+	/** The type of the bound (or completed) stream; empty until one binds. */
+	get type() {
+		return this.payload !== null ? this.completedType : this.boundType;
+	}
+	get partsExpected() {
+		return this.expectedIndexes.length;
+	}
+	get partsReceived() {
+		return this.receivedIndexes.length;
+	}
+	/** Assembly progress in [0, 1]. */
+	get progress() {
+		if (this.isComplete) return 1;
+		if (this.expectedIndexes.length === 0) return 0;
+		return this.receivedIndexes.length / this.expectedIndexes.length;
+	}
+	/** The assembled UR. Throws until `isComplete`. */
+	result() {
+		if (this.payload === null) throw new EraSdkError("incomplete-scan", "UR not fully assembled yet");
+		return new Ur(this.completedType, this.payload);
+	}
+	/**
+	* Feed one scanned frame. Returns true once the UR is fully assembled.
+	*
+	* Throws EraSdkError for frames that are not parseable URs at all
+	* (`not-a-ur`, `malformed-bytewords`, `checksum-mismatch`,
+	* `malformed-sequence`); refusals of parseable frames set [lastRefusal]
+	* and return false.
+	*/
+	receivePart(text) {
+		if (this.isComplete) return false;
+		this.lastRefusal = null;
+		const parsed = parseUrString(text);
+		if (parsed.seq === null) {
+			if (parsed.payload.length === 0 || parsed.payload.length > UrLimits.maxMessageBytes) {
+				this.lastRefusal = {
+					code: "limit-exceeded",
+					message: `single-part payload of ${parsed.payload.length} bytes is outside 1..${UrLimits.maxMessageBytes}`
+				};
+				return false;
+			}
+			if (this.confirmed && this.receivedIndexes.length > 0) {
+				this.lastRefusal = {
+					code: "fragment-mismatch",
+					message: `a single-part UR arrived while a "${this.boundType}" assembly was under way`
+				};
+				return false;
+			}
+			this.completedType = parsed.type;
+			this.payload = parsed.payload;
+			return true;
+		}
+		const fragment = tryParseFragment(parsed.type, parsed.payload);
+		if (fragment === null) {
+			this.lastRefusal = {
+				code: "limit-exceeded",
+				message: "fragment header is malformed or outside the UrLimits bounds"
+			};
+			return false;
+		}
+		if (fragment.seqNum !== parsed.seq.num || fragment.seqLength !== parsed.seq.length) {
+			this.lastRefusal = {
+				code: "fragment-mismatch",
+				message: "fragment header disagrees with the ur: path sequence"
+			};
+			return false;
+		}
+		if (!this.checkBinding(fragment)) return false;
+		this.queuedParts.push(fragment);
+		while (!this.isComplete && this.queuedParts.length > 0) this.processQueuedItem();
+		return this.isComplete;
+	}
+	fingerprintOf(type, seqLength, messageLength, checksum, fragmentLength) {
+		return `${type}|${seqLength}|${messageLength}|${checksum}|${fragmentLength}`;
+	}
+	/** Decide whether the fragment belongs to the bound stream; bind/confirm/drop per the rules above. */
+	checkBinding(fragment) {
+		const fingerprint = this.fingerprintOf(fragment.type, fragment.seqLength, fragment.messageLength, fragment.checksum, fragment.part.length);
+		if (this.boundType !== "") {
+			if (fingerprint === this.fingerprintOf(this.boundType, this.seqLength, this.expectedMessageLength, this.expectedChecksum, this.expectedFragmentLength)) {
+				if (!this.confirmed && fragment.seqNum !== this.bindingSeqNum) this.confirmed = true;
+				return true;
+			}
+			if (this.confirmed) {
+				this.lastRefusal = {
+					code: "fragment-mismatch",
+					message: "fragment belongs to a different stream than the confirmed assembly"
+				};
+				return false;
+			}
+			this.framesSinceBinding += 1;
+			if (this.framesSinceBinding < UrDecoder.framesBeforeDroppingProvisional) {
+				this.lastRefusal = {
+					code: "fragment-mismatch",
+					message: "fragment belongs to a different stream than the provisional binding"
+				};
+				return false;
+			}
+			this.discardBinding();
+		}
+		this.boundType = fragment.type;
+		this.seqLength = fragment.seqLength;
+		this.expectedMessageLength = fragment.messageLength;
+		this.expectedChecksum = fragment.checksum;
+		this.expectedFragmentLength = fragment.part.length;
+		this.bindingSeqNum = fragment.seqNum;
+		this.confirmed = false;
+		this.framesSinceBinding = 0;
+		this.expectedIndexes.length = 0;
+		for (let i = 0; i < fragment.seqLength; i++) this.expectedIndexes.push(i);
+		return true;
+	}
+	/** Drop a binding that never proved itself (provisional only). */
+	discardBinding() {
+		this.boundType = "";
+		this.seqLength = 0;
+		this.expectedMessageLength = 0;
+		this.expectedChecksum = 0;
+		this.expectedFragmentLength = 0;
+		this.confirmed = false;
+		this.framesSinceBinding = 0;
+		this.bindingSeqNum = 0;
+		this.expectedIndexes.length = 0;
+		this.receivedIndexes.length = 0;
+		this.mixedParts = [];
+		this.queuedParts.length = 0;
+		this.simpleParts.length = 0;
+	}
+	/**
+	* Throw away the accumulation, KEEPING the binding.
+	*
+	* Reached when the reassembled payload does not hash to the stream's own
+	* declared checksum — a rogue fragment that copied the visible header and
+	* poisoned the XOR. Unbinding here would hand back the eviction primitive
+	* the binding rule denies, so only the collected fragments are discarded:
+	* one pass of the animation for the genuine sender, one fragment per pass
+	* for the attacker, forever.
+	*/
+	discardAccumulation() {
+		this.expectedIndexes.length = 0;
+		if (this.seqLength > 0) for (let i = 0; i < this.seqLength; i++) this.expectedIndexes.push(i);
+		this.receivedIndexes.length = 0;
+		this.mixedParts = [];
+		this.queuedParts.length = 0;
+		this.simpleParts.length = 0;
+	}
+	processQueuedItem() {
+		const part = this.queuedParts.shift();
+		if (!part) return;
+		if (isSimple(part)) this.processSimplePart(part);
+		else this.processMixedPart(part);
+	}
+	processSimplePart(fragment) {
+		const fragmentIndex = fragment.indexes[0];
+		if (this.receivedIndexes.includes(fragmentIndex)) return;
+		this.simpleParts.push(fragment);
+		this.receivedIndexes.push(fragmentIndex);
+		if (sameMembers(this.receivedIndexes, this.expectedIndexes)) {
+			const sorted = [...this.simpleParts].sort((a, b) => a.indexes[0] - b.indexes[0]);
+			let joinedLength = 0;
+			for (const p of sorted) joinedLength += p.part.length;
+			const joined = new Uint8Array(joinedLength);
+			let offset = 0;
+			for (const p of sorted) {
+				joined.set(p.part, offset);
+				offset += p.part.length;
+			}
+			if (joined.length < this.expectedMessageLength) {
+				this.discardAccumulation();
+				return;
+			}
+			const candidate = joined.slice(0, this.expectedMessageLength);
+			if (crc32(candidate) !== this.expectedChecksum) {
+				this.discardAccumulation();
+				return;
+			}
+			this.completedType = this.boundType;
+			this.payload = candidate;
+		} else this.reduceMixedBy(fragment);
+	}
+	processMixedPart(fragment) {
+		if (this.mixedParts.some((e) => sameMembers([...e.indexes], [...fragment.indexes]))) return;
+		if (this.mixedParts.length >= UrLimits.maxFragmentCount) return;
+		let simple = fragment;
+		for (const s of this.simpleParts) simple = this.reducePartByPart(simple, s);
+		let part = simple;
+		for (const m of this.mixedParts) part = this.reducePartByPart(part, m);
+		if (isSimple(part)) this.queuedParts.push(part);
+		else {
+			this.reduceMixedBy(part);
+			this.mixedParts.push(part);
+		}
+	}
+	reduceMixedBy(fragment) {
+		const newMixed = [];
+		for (const item of this.mixedParts) {
+			const reduced = this.reducePartByPart(item, fragment);
+			if (isSimple(reduced)) this.queuedParts.push(item);
+			else newMixed.push(reduced);
+		}
+		this.mixedParts = newMixed;
+	}
+	reducePartByPart(a, b) {
+		if (!b.indexes.every((e) => a.indexes.includes(e))) return a;
+		const newIndexes = a.indexes.filter((e) => !b.indexes.includes(e));
+		const newLength = Math.max(a.part.length, b.part.length);
+		const newPart = new Uint8Array(newLength);
+		for (let i = 0; i < newLength; i++) newPart[i] = (a.part[i] ?? 0) ^ (b.part[i] ?? 0);
+		return {
+			type: a.type,
+			seqNum: a.seqNum,
+			seqLength: a.seqLength,
+			messageLength: this.expectedMessageLength,
+			checksum: crc32(a.part),
+			part: newPart,
+			indexes: newIndexes
+		};
+	}
+};
+UrDecoder.framesBeforeDroppingProvisional = 32;
+/** Order-insensitive membership equality (mirrors the reference `arraysEqual`). */
+function sameMembers(a, b) {
+	if (a.length !== b.length) return false;
+	return a.every((e) => b.includes(e));
+}
+//#endregion
+//#region src/scan/ur-scanner.ts
+/**
+* Accumulates camera frames into a UR. Synchronous and non-throwing on the
+* feed path (safe to call from camera callbacks); malformed frames come back
+* as typed rejections, never exceptions.
+*/
+var UrScanner = class UrScanner {
+	constructor(options) {
+		this.decoder = new UrDecoder();
+		this.seen = /* @__PURE__ */ new Set();
+		this.rejection = null;
+		this.expectedTypes = options?.expectedTypes ? new Set(options.expectedTypes) : null;
+	}
+	get isComplete() {
+		return this.decoder.isComplete;
+	}
+	get progress() {
+		return this.decoder.progress;
+	}
+	/** The UR type of the bound stream, or null until one binds. */
+	get urType() {
+		return this.decoder.type === "" ? null : this.decoder.type;
+	}
+	get framesReceived() {
+		return this.decoder.partsReceived;
+	}
+	get framesExpected() {
+		return this.decoder.partsExpected;
+	}
+	get lastRejection() {
+		return this.rejection;
+	}
+	/** Feed one scanned frame. */
+	receivePart(frame) {
+		if (this.decoder.isComplete) return {
+			kind: "complete",
+			ur: this.decoder.result()
+		};
+		if (this.seen.has(frame)) return { kind: "duplicate" };
+		const type = urTypeOf(frame);
+		if (type === null) return this.reject("not-a-ur", "not a UR frame");
+		if (this.expectedTypes && !this.expectedTypes.has(type)) {
+			const shown = type.length > 32 ? `${type.slice(0, 32)}…` : type;
+			return this.reject("wrong-ur-type", `ignored a "${shown}" frame; expected ${[...this.expectedTypes].join(" or ")}`);
+		}
+		if (this.seen.size < UrScanner.maxRememberedFrames) this.seen.add(frame);
+		let complete;
+		try {
+			complete = this.decoder.receivePart(frame);
+		} catch (e) {
+			const code = e instanceof EraSdkError ? e.code : "not-a-ur";
+			return this.reject(code, "unreadable UR frame");
+		}
+		if (this.decoder.lastRefusal) return this.reject(this.decoder.lastRefusal.code, this.decoder.lastRefusal.message);
+		if (complete) {
+			this.rejection = null;
+			return {
+				kind: "complete",
+				ur: this.decoder.result()
+			};
+		}
+		return {
+			kind: "progress",
+			progress: this.decoder.progress,
+			framesReceived: this.decoder.partsReceived,
+			framesExpected: this.decoder.partsExpected
+		};
+	}
+	/** The assembled UR. Throws `incomplete-scan` until done. */
+	result() {
+		return this.decoder.result();
+	}
+	reject(code, message) {
+		const previous = this.rejection;
+		this.rejection = previous && previous.code === code && previous.message === message ? {
+			code,
+			message,
+			repeated: previous.repeated + 1
+		} : {
+			code,
+			message,
+			repeated: 1
+		};
+		return {
+			kind: "rejected",
+			rejection: this.rejection
+		};
+	}
+};
+UrScanner.maxRememberedFrames = 4096;
+/** A scanner whose completed UR parses into a typed result (a chain signature). */
+var TypedUrScanner = class extends UrScanner {
+	constructor(options, parseResult) {
+		super(options);
+		this.parseResult = parseResult;
+	}
+	/** Assemble + parse + validate (UR type, request-id echo) in one call. */
+	parse() {
+		return this.parseResult(this.result());
+	}
+};
+//#endregion
+//#region src/chains/shared.ts
+const DEFAULT_ORIGIN = "ERA Connect";
+function resolveContext(config) {
+	return {
+		origin: config?.origin ?? "ERA Connect",
+		randomBytes: config?.randomBytes ?? void 0,
+		maxFragmentLength: config?.maxFragmentLength ?? 180
+	};
+}
+function makeSignRequest(args) {
+	const { ur, requestId, replyTypes, context, parse } = args;
+	return {
+		ur,
+		requestId,
+		replyTypes,
+		warnings: args.warnings ?? [],
+		toAnimated: (options) => new AnimatedUr(ur, { maxFragmentLength: options?.maxFragmentLength ?? context.maxFragmentLength ?? 180 }),
+		scanner: () => new TypedUrScanner({ expectedTypes: replyTypes }, parse)
+	};
+}
+/** Mint or normalize a request id. */
+function resolveRequestId(context, requestId) {
+	return requestId === void 0 ? randomRequestId(context.randomBytes) : normalizeRequestId(requestId);
+}
+/** Accept a reply as a `Ur` object or a single-part `ur:` string. */
+function toUr(input) {
+	if (typeof input !== "string") return input;
+	const parsed = parseUrString(input);
+	if (parsed.seq !== null) throw new EraSdkError("invalid-props", "multi-part UR string: assemble it with the request scanner first");
+	return new Ur(parsed.type, parsed.payload);
+}
+function requireUrType(ur, expected, what) {
+	if (!expected.includes(ur.type)) {
+		const shown = ur.type.length > 32 ? `${ur.type.slice(0, 32)}…` : ur.type;
+		throw new EraSdkError("wrong-ur-type", `unexpected ${what} UR type "${shown}", expected ${expected.join(" or ")}`, {
+			received: shown,
+			expected
+		});
+	}
+}
+function requireReplyMap(ur, what) {
+	let decoded;
+	try {
+		decoded = cborDecode(ur.cbor);
+	} catch (e) {
+		throw new EraSdkError("malformed-cbor", `${what} is not readable CBOR: ${e.message}`);
+	}
+	const map = asMap(decoded);
+	if (!map) throw new EraSdkError("malformed-reply", `${what} is not a CBOR map`);
+	return map;
+}
+/**
+* The reply must echo the request id byte for byte.
+*
+* BYTES, not CBOR values: the device wraps the echo in the UUID tag (37) while
+* requests may send it untagged, so a value-level comparison would reject
+* every genuine reply. An absent echo is a reply that did not come from the
+* request in hand (the device echoes unconditionally when the request carried
+* an id) and is refused rather than tolerated.
+*/
+function requireRequestIdEcho(map, key, expected, what) {
+	const echoed = mapGet(map, key);
+	const value = echoed === void 0 ? void 0 : stripTags(echoed);
+	if (value?.kind !== "bytes") throw new EraSdkError("malformed-reply", `${what} does not echo the request id (key ${key})`);
+	if (expected !== void 0 && !equalBytes(value.value, expected)) throw new EraSdkError("request-id-mismatch", `${what} echoes a different request id — it answers another sign request, not this one`);
+	return value.value;
+}
+/** A signature whose length is inside `[min, max]`, or a typed refusal. */
+function requireSignatureBytes(value, what, min, max) {
+	const v = value === void 0 ? void 0 : stripTags(value);
+	if (v?.kind !== "bytes") throw new EraSdkError("malformed-reply", `${what} is missing the signature (key 2)`);
+	const length = v.value.length;
+	if (length < min || length > max) throw new EraSdkError("malformed-reply", `${what} signature is ${length} bytes, expected ${min === max ? `${min}` : `${min}-${max}`}`);
+	return v.value;
+}
+//#endregion
+export { utf8Encode as A, asMap as B, bytesToBigint as C, hexToBytes as D, equalBytes as E, parsePathComponents as F, cbMap as G, asUint as H, pathEquals as I, cbUint as J, cbTag as K, xfpToHex as L, keypath304 as M, normalizeXfp as N, u32be as O, parsePath as P, asArray as R, asciiDecode as S, concatBytes as T, cbArray as U, asText as V, cbBytes as W, stripTags as X, mapGet as Y, EraSdkError as Z, Ur as _, requireSignatureBytes as a, cborDecode as b, resolveRequestId as c, UrScanner as d, AnimatedUr as f, uuidStringify as g, normalizeRequestId as h, requireRequestIdEcho as i, formatPath as j, utf8Decode as k, toUr as l, UrLimits as m, makeSignRequest as n, requireUrType as o, DEFAULT_FRAGMENT_LENGTH as p, cbText as q, requireReplyMap as r, resolveContext as s, DEFAULT_ORIGIN as t, TypedUrScanner as u, parseUrString as v, bytesToHex as w, cborEncode as x, crc32 as y, asBytes as z };
+
+//# sourceMappingURL=shared-B8Wc7ViU.js.map