@laceio/sdk 0.1.0 → 0.1.1-canary.0

package/dist/init-X6m_cqDy.js

@@ -0,0 +1,2353 @@
+import "./_polyfill-buffer-patch-JcrfT1gU.js";
+import { n as HexBytes, t as ByteArray } from "./bytes.vo-CziaOsba.js";
+import { B as GrantScopeSalt, V as GrantId, i as granteePoint, r as circuitScope, z as GrantSlot } from "./grant-rules-qLrKUIR3.js";
+import { i as AccAddress, t as createMidnightProviders } from "./providers-C1MsxfMA.js";
+import { a as resumeAccountDeployment, i as deployAccount, o as DeviceEpoch, r as resolveUseCounter, s as UseCounter } from "./gated-call-CcsuW9L5.js";
+import { i as accManifest } from "./artefact-loader-D0T2f6F7.js";
+import { t as TokenColor } from "./token-color.vo-CItgoOjw.js";
+import { A as RecordUnreadableError, E as NotAuthorisedError, O as ReadUnavailableError, S as GrantRosterUnsettledError, T as NoAccountError, _ as GrantNotFoundError, b as GrantRevocationPendingError, h as GrantIssueRejectedError, i as AccountNotFoundError, j as RemovalTargetNotFoundError, k as RecordCorruptedError, m as EncryptionKeyMismatchError, n as AccountCreationPendingError, p as DeviceRosterInvalidError, r as AccountExistsError, t as AccountContractMissingError, u as CreationLockMismatchError, w as LastDeviceError, x as GrantRevokedError, y as GrantOriginMissingError } from "./errors-pkQdxW-7.js";
+import { a as isDeviceRegistration, b as validateGrantScope, i as isAddressedTo, n as deviceEnvelopes, o as isLaceRecord, r as encodeDevicePublicKey } from "./envelopes-B3QCzo5p.js";
+import { n as ROTATE_ENC_KEY_CIRCUIT, t as APPEND_INBOX_CIRCUIT } from "./enc-key-circuits-0Dud78IB.js";
+import { a as prepareIssueGrant, i as originHash, n as grantObjectCommit, o as prepareRevokeAllGrants, s as prepareRevokeGrant, t as deriveGrantId } from "./grants-CYY0AquW.js";
+import { i as ledger } from "./acc-module-ur8CkBd1.js";
+import { i as resolveLiveReaders, t as assertJoiningDevice } from "./device-readers-b4g2j3QL.js";
+import { a as submitAccountCall, i as readAccountLedger, n as isNotAuthorisedAbort, o as withRefreshedLocalDevice, r as queryAccountLedger, s as createIndexerClient } from "./account-call-CoCq3V55.js";
+import { EMPTY, Observable, catchError, concat, concatMap, defaultIfEmpty, defer, exhaustMap, filter, firstValueFrom, map, merge, mergeMap, of, withLatestFrom } from "rxjs";
+//#region ../../packages/module/passport-account/src/acc/device-circuits.ts
+/**
+* The gated circuits the device flows authorise, named once so the flow
+* that submits a call and the signer that scopes a key session to it
+* agree on the circuit.
+*/
+const ADD_DEVICE_CIRCUIT = "add_device_with_jubjub";
+const REMOVE_DEVICE_CIRCUIT = "remove_device_with_jubjub";
+//#endregion
+//#region ../../packages/module/passport-account/src/acc/pending-deployment.ts
+/** Whether a record's pending creation carries the whole deployment, not only its marker. */
+const isPendingDeployment = (pending) => "authorityKey" in pending;
+/**
+* The refusal of a creation that resumes an unfinished one under another
+* lock choice than `recorded`, the one it was started with, which the
+* message names so a retry can repeat it.
+*/
+const lockChoiceMismatch = (recorded) => new CreationLockMismatchError(`The unfinished Passport account creation was started with lockAccount ${recorded}; resume it with the same lock choice.`);
+//#endregion
+//#region ../../packages/module/passport-account/src/store/envelope.ts
+/** AES-GCM is specified for 96-bit IVs; each seal draws a fresh one. */
+const IV_LENGTH = 12;
+const utf8 = (value) => new TextEncoder().encode(value);
+/** Whether a stored value has the sealed envelope layout. */
+const isSealedRecord = (value) => {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return candidate.v === 1 && typeof candidate.iv === "string" && typeof candidate.ciphertext === "string";
+};
+/**
+* Encrypts a record into a {@link SealedRecord} under the given key,
+* marking the envelope pending when asked.
+*/
+const sealRecord = async (key, record, { pending = false } = {}) => {
+	const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+	const ciphertext = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, key, utf8(JSON.stringify(record)));
+	return {
+		v: 1,
+		iv: HexBytes.fromByteArray(iv),
+		ciphertext: HexBytes.fromByteArray(new Uint8Array(ciphertext)),
+		...pending ? { pending: true } : {}
+	};
+};
+/**
+* Decrypts a {@link SealedRecord} back into the record it sealed. Any
+* failure to open - a tampered ciphertext, a mismatched key, or a
+* malformed envelope - throws RecordCorruptedError.
+*/
+const openRecord = async (key, sealed) => {
+	try {
+		const plaintext = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: ByteArray.fromHex(HexBytes(sealed.iv))
+		}, key, ByteArray.fromHex(HexBytes(sealed.ciphertext)));
+		return JSON.parse(new TextDecoder().decode(plaintext));
+	} catch {
+		throw new RecordCorruptedError();
+	}
+};
+//#endregion
+//#region ../../packages/module/passport-account/src/store/account-record.ts
+const COLLECTION_ID = "passport-account";
+const ACCOUNT_RECORD_KEY = "account";
+/**
+* An {@link AccountRecordStore} over the platform key-value storage,
+* namespaced under its own collection. With a `keyProvider` the record is
+* sealed at rest and only sealed envelopes are readable. What a sealed
+* record reads as without a `keyProvider` is the caller's choice:
+* 'skip' (the default) reads it as undefined, for the ceremony-free
+* restore peek that cannot open it by design; 'error' raises
+* RecordUnreadableError, for the flows where a missing storage key is a
+* persistence misconfiguration that must not look like an absent
+* account. Without a `keyProvider` (the dev authoriser) the record
+* persists in plaintext, which holds no secret once the account is
+* complete; while a creation is unfinished it holds the contract's
+* maintenance authority key (see {@link PassportAccountRecord}), so the
+* dev authoriser is for development and tests only.
+*/
+const createAccountRecordStore = (createKeyValueStorage, keyProvider, { onSealedWithoutKey = "skip" } = {}) => {
+	const storage = createKeyValueStorage({ collectionId: COLLECTION_ID });
+	const open = async (keyOf, value) => isSealedRecord(value) ? openRecord(await keyOf(), value) : void 0;
+	const stored = () => storage.getValues([ACCOUNT_RECORD_KEY]).pipe(map(([value]) => value), defaultIfEmpty(void 0));
+	const isPending = (record) => record.deployment !== void 0;
+	const presenceOf = (value) => {
+		if (value === void 0) return "absent";
+		return (isSealedRecord(value) ? value.pending === true : isPending(value)) ? "pending" : "complete";
+	};
+	return {
+		read: () => keyProvider ? stored().pipe(concatMap(async (value) => open(keyProvider, value))) : stored().pipe(map((value) => {
+			if (!isSealedRecord(value)) return value;
+			if (onSealedWithoutKey === "error") throw new RecordUnreadableError();
+		})),
+		write: (record) => keyProvider ? defer(async () => sealRecord(await keyProvider(), record, { pending: isPending(record) })).pipe(mergeMap((sealed) => storage.setValue(ACCOUNT_RECORD_KEY, sealed))) : storage.setValue(ACCOUNT_RECORD_KEY, record),
+		presence: () => stored().pipe(map(presenceOf))
+	};
+};
+/**
+* The promise view of an {@link AccountRecordStore}, for the flows. A
+* storage that completes without emitting (destroyed mid-flow) reads as
+* absent and writes as done, mirroring the stream contract so a flow
+* never hangs on it.
+*/
+const toAccountRecords = (store) => ({
+	read: async () => firstValueFrom(store.read(), { defaultValue: void 0 }),
+	write: async (record) => firstValueFrom(store.write(record), { defaultValue: void 0 }),
+	presence: async () => firstValueFrom(store.presence(), { defaultValue: "absent" })
+});
+//#endregion
+//#region ../../packages/module/passport-account/src/acc/inbox-walk.ts
+const defaultLoadLedger = async () => import("@midnightntwrk/ledger-v9");
+/** The entries the contract holds, in inbox order, the Lace records included. */
+const inboxEntries = (ledgerState) => {
+	const entries = [];
+	for (let ordinal = 0n; ordinal < ledgerState.inbox_count; ordinal += 1n) if (ledgerState.inbox.member(ordinal)) entries.push(ledgerState.inbox.lookup(ordinal));
+	return entries;
+};
+/**
+* The commitment the chain carries for a coin the account received,
+* recomputed with the ledger's own output construction: a contract-owned
+* output of this coin towards the account address, which is exactly what
+* a depositor builds and the contract claims. A description the ledger
+* refuses to commit to is no candidate.
+*/
+const toCandidate = ({ ZswapOutput }, address, { coin, entry }) => {
+	try {
+		return {
+			coin,
+			commitment: ZswapOutput.newContractOwned({
+				type: HexBytes.fromByteArray(coin.color),
+				nonce: HexBytes.fromByteArray(coin.nonce),
+				value: coin.value
+			}, void 0, address).commitment.toLowerCase(),
+			entry
+		};
+	} catch {
+		return null;
+	}
+};
+/**
+* The tree index of every shielded output the chain created for the
+* account, by commitment, read from the ledger events of the transactions
+* that acted on the contract. A deposit is one such action, so its
+* transaction is among them.
+*/
+const receivedOutputs = async (address, indexer) => {
+	const actions = await indexer.enumerateContractActions(address);
+	const hashes = [...new Set(actions.map((action) => action.txHash))];
+	const outputs = await Promise.all(hashes.map(async (hash) => indexer.queryShieldedOutputs(hash)));
+	const recipient = address.toLowerCase();
+	return new Map(outputs.flat().filter((output) => output.contractAddress === recipient).map((output) => [output.commitment, output.index]));
+};
+/**
+* Walks the account's inbox the way the custody standard prescribes:
+* every entry other than the Lace records, which hold the account keys
+* and the grant bookkeeping rather than coins, is opened with the
+* encryption secrets, each coin that opens is verified by recomputing
+* its commitment and finding it among the outputs the chain created for
+* the account, and the index that output took in the commitment tree is
+* captured with it. Anyone can append any
+* bytes to the inbox, so an entry that does not open, or opens to a coin
+* the chain never created for this account, is skipped as noise and
+* counted, never raised. Two entries describing the same coin, as a
+* re-encryption after a key rotation leaves behind, yield one holding,
+* read from the first entry that described it. An empty inbox, or one
+* with nothing that opens, is answered without loading the ledger or
+* reading the chain's history. A ledger binding that fails to load is a
+* failure of the walk itself, not of any entry, so it is raised rather
+* than reported as an inbox of noise.
+*/
+const walkInbox = async ({ address, ledgerState, indexer, openEntries, loadLedger = defaultLoadLedger }) => {
+	const entries = inboxEntries(ledgerState).filter((entry) => !isLaceRecord(entry));
+	const nothing = (skippedEntries) => ({
+		holdings: [],
+		holdingEntries: [],
+		skippedEntries
+	});
+	if (entries.length === 0) return nothing(0);
+	const coins = await openEntries(entries);
+	if (coins.every((coin) => coin === null)) return nothing(entries.length);
+	const ledger = await loadLedger();
+	const candidates = coins.map((coin, ordinal) => coin && toCandidate(ledger, address, {
+		coin,
+		entry: entries[ordinal]
+	}));
+	if (candidates.every((candidate) => candidate === null)) return nothing(entries.length);
+	const outputs = await receivedOutputs(address, indexer);
+	const holdings = /* @__PURE__ */ new Map();
+	const holdingEntries = /* @__PURE__ */ new Map();
+	let skippedEntries = 0;
+	for (const candidate of candidates) {
+		const index = candidate && outputs.get(candidate.commitment);
+		if (!candidate || index === void 0) {
+			skippedEntries += 1;
+			continue;
+		}
+		if (holdings.has(candidate.commitment)) continue;
+		holdings.set(candidate.commitment, {
+			color: TokenColor(HexBytes.fromByteArray(candidate.coin.color)),
+			value: candidate.coin.value.toString(),
+			commitment: candidate.commitment,
+			index: Number(index)
+		});
+		holdingEntries.set(candidate.commitment, candidate.entry);
+	}
+	return {
+		holdings: [...holdings.values()],
+		holdingEntries: [...holdingEntries.values()],
+		skippedEntries
+	};
+};
+//#endregion
+//#region ../../packages/module/passport-account/src/flows/key-session.ts
+/**
+* Runs an operation under a single key ceremony, so a flow that reaches
+* for the device key several times costs one user prompt instead of one
+* per authoriser call. `flow` names the flow for an authoriser that
+* presents it before the ceremony. An authoriser with no interactive
+* ceremony exposes no session, and the operation runs directly. The
+* session function is used detached, so implementations must not rely on
+* `this`.
+*/
+const inKeySession = async (authoriser, flow, operation) => {
+	const { withKeySession } = authoriser;
+	return withKeySession ? withKeySession(operation, flow) : operation();
+};
+//#endregion
+//#region ../../packages/module/passport-account/src/acc/enc-key-rotation.ts
+/** Prepares `rotate_enc_key_with_jubjub` over the raw 32-byte X25519 key `enc_key` is replaced with. */
+const prepareRotateEncKey = (newKey) => ({
+	circuit: ROTATE_ENC_KEY_CIRCUIT,
+	args: [newKey]
+});
+/** Prepares `append_inbox_with_jubjub` over one inbox entry: a re-encrypted coin or a Lace record. */
+const prepareAppendInbox = (entry) => ({
+	circuit: APPEND_INBOX_CIRCUIT,
+	args: [entry]
+});
+//#endregion
+//#region ../../packages/module/passport-account/src/flows/rotation.ts
+/**
+* How long an accepted call is given to show in the indexer's view of the
+* ledger, which can lag the block the call landed in.
+*/
+const LEDGER_POLL_ATTEMPTS = 30;
+const LEDGER_POLL_DELAY_MS = 1e3;
+const sleep$1 = async (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+/**
+* The encryption key's view members, which a rotation and a read grant's
+* issue need: the re-encryption a rotation moves the holdings through
+* and the sealing a grantee receives the secret by.
+*
+* @throws {@link ReadUnavailableError} when the key offers either not,
+* as a key that only opens entries does.
+*/
+const viewCapability = (encryptionKey) => {
+	const { reencryptInbox, sealView } = encryptionKey;
+	if (!reencryptInbox || !sealView) throw new ReadUnavailableError();
+	return {
+		reencryptInbox,
+		sealView
+	};
+};
+/** Resolves this device's reader and device keys, inside the caller's key session. */
+const readLocalDevice = async ({ passportAuthoriser, passportEncryptionKey, passportNetwork }) => ({
+	readerPublicKey: await passportEncryptionKey.readerPublicKey(passportNetwork.networkId),
+	devicePublicKey: encodeDevicePublicKey(await passportAuthoriser.devicePublicKey())
+});
+/** Reads the inbox and this device's keyring of the account from its ledger. */
+const readAccountInbox = (account, ledgerState, readerPublicKey) => {
+	const entries = inboxEntries(ledgerState);
+	return {
+		entries,
+		keyring: {
+			account: AccAddress(account),
+			encKey: ledgerState.enc_key,
+			envelopes: deviceEnvelopes(entries, readerPublicKey)
+		}
+	};
+};
+/**
+* The device entries the ledger holds, as lowercase hex, less `except`:
+* the devices a rotation may seal the new secret to, which a key session
+* names to the user before it opens.
+*
+* @throws {@link DeviceRosterInvalidError} when there are more than
+* {@link MAX_DEVICE_ENTRIES}, which no signer would accept.
+*/
+const liveDeviceEntries = (ledgerState, except) => {
+	const entries = [...ledgerState.devices].map((entry) => HexBytes.fromByteArray(entry)).filter((entry) => entry !== except?.toLowerCase());
+	if (entries.length > 64) throw new DeviceRosterInvalidError(`The account holds ${entries.length} device entries, more than the 64 a rotation names.`);
+	return entries;
+};
+/**
+* The ledger once the indexer reflects a call that advanced the auth
+* nonce past `authNonce`. A chain of gated calls must have each bind the
+* nonce the previous one left behind, which the indexer can serve a
+* moment late.
+*
+* @throws {@link GrantRosterUnsettledError} when the indexer never
+* reflects the call within the polling window.
+*/
+const awaitAdvancedLedger = async (indexer, address, authNonce) => {
+	for (let attempt = 0; attempt < LEDGER_POLL_ATTEMPTS; attempt++) {
+		const ledgerState = await queryAccountLedger(indexer, address);
+		if (ledgerState.auth_nonce > authNonce) return ledgerState;
+		await sleep$1(LEDGER_POLL_DELAY_MS);
+	}
+	throw new GrantRosterUnsettledError(`The ledger of ${address} never reflected the accepted call.`);
+};
+/**
+* Starts a chain of gated calls at `start`. Each accepted call reports
+* the counter it advanced this device to, then waits for the indexer to
+* reflect it, so the next call binds the auth nonce it left; the local
+* roster row follows the entry each call leaves it on.
+*/
+const callChain = ({ account, start, indexer, seams, onProgress, onAdvanced }) => {
+	let current = start;
+	const submit = async (call) => {
+		const { advancedCounter, localCommitmentHex } = await submitAccountCall({
+			circuit: call.circuit,
+			args: call.args,
+			account,
+			localUseCounter: current.localUseCounter,
+			ledgerState: current.ledgerState,
+			onStage: onProgress
+		}, seams);
+		const localUseCounter = advancedCounter.toString();
+		await onAdvanced(localUseCounter);
+		current = {
+			ledgerState: await awaitAdvancedLedger(indexer, account.address, current.ledgerState.auth_nonce),
+			localUseCounter,
+			devices: withRefreshedLocalDevice(current.devices, localCommitmentHex)
+		};
+	};
+	return {
+		submit,
+		append: async (stage, entries) => {
+			if (entries.length > 0) onProgress(stage);
+			for (const entry of entries) await submit(prepareAppendInbox(entry));
+		},
+		position: () => current
+	};
+};
+/** The registrations of an inbox, by hex. */
+const registrationsOf = (entries) => new Set(entries.filter(isDeviceRegistration).map((entry) => HexBytes.fromByteArray(entry)));
+/**
+* The roster a rotation seals to: the registrations the live roster key
+* opens, resolved against the ledger's device set so only a registration
+* whose device key derives a live entry counts, and only one whose entry
+* is among `devices`. A registration naming nobody's live device is
+* passed over, and named devices left without a reader, by a conflict or
+* for want of a registration, are reported dropped, see
+* {@link resolveLiveReaders}; this device, sealed to regardless, is never
+* reported dropped. The registration whose live entry is `target`, the
+* entry a removal takes out, is named so no reader paired with its device
+* is sealed to.
+*/
+const sealedRoster = async ({ account, encryptionKey, networkId, local, ledgerState, inbox, devices, target, localEntry }) => {
+	const registered = (await encryptionKey.openInbox(networkId, inbox.keyring, inbox.entries.filter(isDeviceRegistration))).flatMap((opened) => opened?.kind === "device" ? [opened.device] : []);
+	const self = HexBytes.fromByteArray(local.readerPublicKey);
+	const { readers, dropped, outside } = resolveLiveReaders({
+		scope: {
+			address: account.address,
+			epoch: ledgerState.device_epoch
+		},
+		registered,
+		isLive: (entryHex) => ledgerState.devices.member(ByteArray.fromHex(HexBytes(entryHex))),
+		allowed: new Set(devices),
+		target
+	});
+	const removed = outside.find(({ entryHex }) => entryHex === target);
+	return {
+		readers: readers.filter(({ reader }) => reader.readerPublicKey !== self).map(({ reader }) => reader),
+		dropped: dropped.filter((entry) => entry !== localEntry),
+		...removed ? { removed: {
+			devicePublicKey: removed.reader.devicePublicKey,
+			epoch: removed.reader.epoch,
+			counter: removed.reader.counter
+		} } : {}
+	};
+};
+/**
+* Rotates the account encryption key to a fresh random secret and
+* re-encrypts every live holding towards it, as the scoped grants
+* standard requires before a read grant is issued and after one is
+* revoked, and as a device removal requires so the removed device reads
+* nothing newer. The holdings are walked with the keyring of the ledger's
+* `enc_key` from the position the chain is at, a keyring this device's
+* envelopes do not open rejecting with EncryptionKeyMismatchError before
+* anything is submitted. The encryption key draws the new secret and
+* seals it, with the roster key, to this device and to every registered
+* device that is enrolled now and among `devices`, and answers the
+* ciphertexts alone: one envelope per device and, when the roster key is
+* fresh, one registration each. Should any registration the live roster
+* key opens land while the rotation runs, as another device's enrolment
+* does, the rotation refuses with DeviceRosterInvalidError before
+* `enc_key` is replaced, so a device enrolled meanwhile is never left
+* without the new key; registrations that open under no roster key are
+* noise and do not stop it. Devices whose registrations conflict are
+* left out and reported in the result. The holdings are
+* re-encrypted towards the new key, the envelopes and registrations are
+* appended, `enc_key` is replaced through `rotate_enc_key_with_jubjub`,
+* and each re-encrypted holding is appended, one gated call each, all in
+* the key session the caller holds. The envelopes land ahead of the
+* rotation, so no device is left without the key the chain then holds;
+* a rotation interrupted after it leaves holdings under the previous
+* key, which every device still opens from its older envelopes and the
+* next rotation re-encrypts. The previous secret is never derived again
+* by anyone: entries sealed towards it stay readable to whoever held it,
+* and nothing newer is.
+*/
+const rotateEncKey = async ({ account, encryptionKey, view, local, chain, indexer, networkId, onProgress, devices, rotateRoster, target }) => {
+	const { ledgerState } = chain.position();
+	const inbox = readAccountInbox(account.address, ledgerState, local.readerPublicKey);
+	const { entries, keyring } = inbox;
+	const { holdingEntries } = await walkInbox({
+		address: account.address,
+		ledgerState,
+		indexer,
+		openEntries: async (coinEntries) => (await encryptionKey.openInbox(networkId, keyring, coinEntries)).map((opened) => opened?.kind === "coin" ? opened.coin : null)
+	});
+	const { readers, dropped, removed } = await sealedRoster({
+		account,
+		encryptionKey,
+		networkId,
+		local,
+		ledgerState,
+		inbox,
+		devices,
+		target,
+		localEntry: chain.position().devices.find((device) => device.isLocal)?.commitmentHex.toLowerCase()
+	});
+	const keys = await encryptionKey.createKeys(networkId, {
+		devicePublicKey: local.devicePublicKey,
+		keyring,
+		registrations: entries.filter(isDeviceRegistration),
+		readers,
+		...rotateRoster === void 0 ? {} : { rotateRoster },
+		...removed ? { removed } : {}
+	});
+	const reencrypted = (await view.reencryptInbox(networkId, {
+		keyring,
+		to: keys.encKey
+	}, holdingEntries)).filter((entry) => entry !== null);
+	onProgress("rotating");
+	for (const entry of [...keys.envelopes, ...keys.registrations]) await chain.submit(prepareAppendInbox(entry));
+	const before = registrationsOf(entries);
+	const appended = registrationsOf(keys.registrations);
+	const landed = inboxEntries(chain.position().ledgerState).filter((entry) => isDeviceRegistration(entry) && !before.has(HexBytes.fromByteArray(entry)) && !appended.has(HexBytes.fromByteArray(entry)));
+	if (landed.length > 0 && (await encryptionKey.openInbox(networkId, keyring, landed)).some((opened) => opened?.kind === "device")) throw new DeviceRosterInvalidError(`Registrations landed in the inbox of ${account.address} while its keys rotated; rotate again.`);
+	await chain.submit(prepareRotateEncKey(keys.encKey));
+	await chain.append("reencrypting", reencrypted);
+	return {
+		encKey: keys.encKey,
+		dropped,
+		keyring: {
+			account: AccAddress(account.address),
+			encKey: keys.encKey,
+			envelopes: keys.envelopes.filter((envelope) => isAddressedTo(envelope, local.readerPublicKey))
+		}
+	};
+};
+/**
+* Seals the live secret of `keyring` to each read grant's read key, with
+* the grant record that keeps each seal on chain for this device. A
+* grant the key refuses to seal to, an expired key session included, is
+* listed unsealed rather than failing a rotation that already landed, or
+* as revocation pending when the key refuses it with
+* GrantRevocationPendingError.
+*/
+const sealViews = async ({ view, networkId, keyring, account, targets }) => {
+	const sealedEncKey = HexBytes.fromByteArray(keyring.encKey);
+	const result = {
+		sealed: [],
+		unsealed: [],
+		revocationPending: [],
+		entries: []
+	};
+	for (const target of targets) {
+		let refusal;
+		const delivery = await view.sealView(networkId, keyring, {
+			...target,
+			account
+		}).catch((error) => {
+			refusal = error;
+		});
+		if (!delivery) {
+			(refusal instanceof GrantRevocationPendingError ? result.revocationPending : result.unsealed).push(target.grantId);
+			continue;
+		}
+		result.sealed.push({
+			...target,
+			seal: HexBytes.fromByteArray(delivery.seal),
+			sealedEncKey
+		});
+		result.entries.push(delivery.entry);
+	}
+	return result;
+};
+//#endregion
+//#region ../../packages/module/passport-account/src/flows/stored-grants.ts
+/**
+* The slot each stored grant was derived under, keyed by id, as the
+* roster decoder takes them.
+*/
+const storedGrantSlots = (stored) => new Map(Object.entries(stored ?? {}).map(([id, { slot }]) => [GrantId(id), GrantSlot(slot)]));
+/**
+* The opening of each stored grant whose object fields were kept, keyed by
+* id, as the roster decoder attaches them. A read grant whose seal this
+* client holds carries it in the opening's view, with the `enc_key` whose
+* secret it seals.
+*/
+const storedGrantOpenings = (stored) => new Map(Object.entries(stored ?? {}).flatMap(([id, grant]) => grant.object ? [[GrantId(id), {
+	scopeSalt: GrantScopeSalt(grant.scopeSalt),
+	granteePublicKey: grant.granteePublicKey,
+	origin: grant.origin,
+	color: TokenColor(grant.object.color),
+	recipient: grant.object.recipient,
+	maxCoinValue: grant.object.maxCoinValue,
+	...grant.view?.seal === void 0 || grant.view.sealedEncKey === void 0 ? {} : { view: {
+		readPublicKey: grant.view.readPublicKey,
+		seal: grant.view.seal,
+		sealedEncKey: grant.view.sealedEncKey
+	} }
+}]] : []));
+/**
+* The stored grants with the view of one grant replaced: its read key
+* and, when given, the seal towards it of the secret of `sealedEncKey`.
+*/
+const withStoredGrantView = (stored, grantId, view) => {
+	const grant = stored[grantId];
+	if (!grant) return stored;
+	return {
+		...stored,
+		[grantId]: {
+			...grant,
+			view
+		}
+	};
+};
+/**
+* The read grants this client holds the read key of and the chain still
+* lists active, other than `except`: the grants a rotation seals the new
+* secret to again. A read grant issued by another client has no stored
+* key here, so it is not among them.
+*/
+const liveStoredReadGrants = (stored, roster, except) => {
+	const active = new Set(roster.filter((record) => record.active && record.scope.read).map(({ id }) => id));
+	return Object.entries(stored ?? {}).flatMap(([id, grant]) => grant.view && active.has(GrantId(id)) && id !== except ? [{
+		grantId: GrantId(id),
+		readPublicKey: grant.view.readPublicKey
+	}] : []);
+};
+/**
+* The active read grants this client holds the read key of whose stored
+* seal does not hold the secret of `encKey`, the ledger's current one:
+* their grantees read nothing newer until a rotation seals to them again
+* or they are issued again. A read grant issued by another client has no
+* stored key here, so it is not among them.
+*/
+const unsealedStoredReadGrants = (stored, roster, encKey) => liveStoredReadGrants(stored, roster).filter(({ grantId }) => stored?.[grantId]?.view?.sealedEncKey !== encKey).map(({ grantId }) => grantId);
+/** The stored grants with one more entry, under its grant id. */
+const withStoredGrant = (stored, grantId, grant) => ({
+	...stored,
+	[grantId]: grant
+});
+/**
+* The record a completed account persists: its identity, this device's
+* use counter, the grant bookkeeping when there is any, and the roster of
+* devices the account keys were sealed to when it is known. It never
+* carries a deployment, so a write of it completes a pending record.
+*/
+const completedRecord = ({ address, bindingVersion }, localUseCounter, { grants }) => ({
+	address,
+	bindingVersion,
+	localUseCounter,
+	...grants ? { grants } : {}
+});
+/**
+* The stored grants with the seals of a rotation applied: each sealed
+* grant's view carries its new seal and the `enc_key` it holds, and each
+* unsealed one keeps its read key alone.
+*/
+const withSealedViews = (stored, { sealed, unsealed }) => {
+	if (!stored) return stored;
+	let next = stored;
+	for (const { grantId, readPublicKey, seal, sealedEncKey } of sealed) next = withStoredGrantView(next, grantId, {
+		readPublicKey,
+		seal,
+		sealedEncKey
+	});
+	for (const grantId of unsealed) {
+		const readPublicKey = next[grantId]?.view?.readPublicKey;
+		if (readPublicKey !== void 0) next = withStoredGrantView(next, grantId, { readPublicKey });
+	}
+	return next;
+};
+/** Each grant's parts by id, the later of two parts of a kind winning. */
+const partsByGrant = (parts) => {
+	const byGrant = /* @__PURE__ */ new Map();
+	for (const part of parts) {
+		const held = byGrant.get(part.grantId) ?? {};
+		byGrant.set(part.grantId, {
+			...held,
+			[part.part]: part
+		});
+	}
+	return byGrant;
+};
+/**
+* Whether a grant's bookkeeping opens its on-chain commitments under the
+* account at `address`: the id derives from the account, the grantee
+* key, the origin and the slot, the object commitment from the salt and
+* the object fields, and the read key hashes to the one the contract
+* holds, or is absent for a grant that does not read. Anyone can append
+* any bytes to the inbox, and another client of the account issuing to
+* the same grantee from the same origin lands on the same id with its
+* own salt, so this check, not where the bookkeeping came from, is what
+* makes it trusted.
+*/
+const opensOnChain = async (record, fields, address) => {
+	try {
+		const grantId = deriveGrantId({
+			contractAddress: ByteArray.fromHex(HexBytes(address)),
+			granteePublicKey: granteePoint({
+				scheme: "jubjub-schnorr",
+				publicKey: fields.granteePublicKey
+			}),
+			originHash: await originHash(fields.origin),
+			slot: GrantSlot(fields.slot)
+		});
+		const encoded = circuitScope({
+			grantee: {
+				scheme: "jubjub-schnorr",
+				publicKey: fields.granteePublicKey
+			},
+			operations: [],
+			color: TokenColor(fields.object.color),
+			recipient: fields.object.recipient,
+			maxCoinValue: fields.object.maxCoinValue,
+			perCallCap: "0",
+			cap: "0",
+			expiresAt: null,
+			...fields.readPublicKey === void 0 ? {} : { readPublicKey: fields.readPublicKey }
+		});
+		return grantId === record.id && grantObjectCommit(ByteArray.fromHex(HexBytes(fields.scopeSalt)), encoded) === record.scope.objectCommit && HexBytes.fromByteArray(encoded.readPkHash) === record.scope.readPkHash && fields.readPublicKey !== void 0 === record.scope.read;
+	} catch {
+		return false;
+	}
+};
+/**
+* The stored grants narrowed to the ones that still open what the chain
+* holds under their id, or undefined once none is left. A grant the
+* chain no longer holds is dropped, and so is one whose kept fields do
+* not open its commitments: the entry an issue wrote before a call that
+* never landed, once another client of the account issued over the same
+* id, or an entry written before the object fields were kept, which
+* cannot be checked. A revoked grant stays in the contract's map as a
+* tombstone, so its slot and salt are kept until a revoke-all clears the
+* map or a new grant overwrites the id.
+*/
+const retainStoredGrants = async (stored, roster, address) => {
+	if (!stored) return void 0;
+	const retained = {};
+	for (const record of roster) {
+		const grant = stored[record.id];
+		if (!grant?.object) continue;
+		if (await opensOnChain(record, {
+			...grant,
+			object: grant.object,
+			...grant.view === void 0 ? {} : { readPublicKey: grant.view.readPublicKey }
+		}, address)) retained[record.id] = grant;
+	}
+	return Object.keys(retained).length > 0 ? retained : void 0;
+};
+/**
+* The bookkeeping of grants this device issued, rebuilt from the grant
+* records it opened in the inbox, for the grants the chain still holds:
+* each grant whose parts open its on-chain commitments under this
+* account and origin, with its read key and, when the newest view record
+* holds the seal of the ledger's `enc_key`, that seal. A grant whose
+* parts do not check out, or whose grant or object part is missing, is
+* left out. Undefined when nothing is rebuilt.
+*/
+const rebuildStoredGrants = async (parts, roster, scope) => {
+	const byGrant = partsByGrant(parts);
+	const rebuilt = {};
+	for (const record of roster) {
+		const held = byGrant.get(record.id);
+		if (!held?.grant || !held.object) continue;
+		const { grant, object, view } = held;
+		if (!await opensOnChain(record, {
+			...grant,
+			origin: scope.origin,
+			object: object.object
+		}, scope.address)) continue;
+		const readPublicKey = grant.readPublicKey;
+		const isCurrent = view !== void 0 && scope.encKey.startsWith(view.encKeyPrefix);
+		rebuilt[record.id] = {
+			slot: grant.slot,
+			scopeSalt: grant.scopeSalt,
+			granteePublicKey: grant.granteePublicKey,
+			origin: scope.origin,
+			object: object.object,
+			...readPublicKey === void 0 ? {} : { view: isCurrent ? {
+				readPublicKey,
+				seal: view.seal,
+				sealedEncKey: scope.encKey
+			} : { readPublicKey } }
+		};
+	}
+	return Object.keys(rebuilt).length > 0 ? rebuilt : void 0;
+};
+/**
+* The record's bookkeeping with every rebuilt grant it lacks added: what
+* the record holds is kept, so a record that survived is never
+* overwritten by the chain's copy, except for a view whose seal is not of
+* `encKey`, the ledger's current one, when the rebuilt view's seal is:
+* the record write after a rotation can be lost while its seal reached
+* the inbox. Run over the bookkeeping {@link retainStoredGrants} checked,
+* a rebuilt grant takes the place of an entry that did not open.
+*/
+const withRebuiltGrants = (stored, rebuilt, encKey) => {
+	if (!rebuilt) return stored;
+	const merged = {
+		...rebuilt,
+		...stored
+	};
+	for (const [id, fromChain] of Object.entries(rebuilt)) {
+		const held = stored?.[id];
+		if (held && held.view?.sealedEncKey !== encKey && fromChain.view?.sealedEncKey === encKey) merged[id] = {
+			...held,
+			view: fromChain.view
+		};
+	}
+	return merged;
+};
+//#endregion
+//#region ../../packages/module/passport-account/src/flows/create-account.ts
+/** The initial device entry is inserted at epoch 0 with use counter 0. */
+const INITIAL_DEVICE_EPOCH = DeviceEpoch(0n);
+const INITIAL_USE_COUNTER_VALUE = "0";
+/**
+* The record of a creation left unfinished on this device, read inside
+* the session once presence reported one. A record that opens without a
+* pending deployment, or that this authoriser cannot open, refuses with
+* AccountExistsError: it names an account that must not be created over.
+* A record that carries only the marker of its creation, which a hosted
+* signer shows no flow but the creation, cannot be resumed and is
+* refused, as is one started under another lock choice than
+* `lockAccount`, with CreationLockMismatchError naming the recorded one.
+*/
+const pendingRecord = async (accountRecords, lockAccount) => {
+	const record = await accountRecords.read();
+	if (!record?.deployment) throw new AccountExistsError();
+	if (!isPendingDeployment(record.deployment)) throw new Error(`The unfinished creation of the account at ${record.address} was read without its deployment, so it cannot be resumed.`);
+	if (record.deployment.lockAccount !== lockAccount) throw lockChoiceMismatch(record.deployment.lockAccount);
+	return {
+		...record,
+		deployment: record.deployment
+	};
+};
+/**
+* Runs the deployment: a fresh one, which draws the account keys first,
+* deploys with their `enc_key` and records the pending deployment, with
+* this device's envelope and registration, as soon as the deploy lands
+* so an interruption can be resumed; or the remaining waves of a
+* recorded one, with the key entries it recorded.
+*/
+const deploy = async ({ providers, lockAccount, pending, local, context: { seams, accountRecords } }) => {
+	const { passportAuthoriser, passportEncryptionKey, passportNetwork } = seams;
+	if (pending) return {
+		deployed: await resumeAccountDeployment({
+			providers,
+			authoriser: passportAuthoriser,
+			address: pending.address,
+			pending: pending.deployment
+		}),
+		pending: pending.deployment
+	};
+	const keys = await passportEncryptionKey.createKeys(passportNetwork.networkId, { devicePublicKey: local.devicePublicKey });
+	const keyEntries = [...keys.envelopes, ...keys.registrations].map((entry) => HexBytes.fromByteArray(entry));
+	const progress = {};
+	const deployed = await deployAccount({
+		providers,
+		authoriser: passportAuthoriser,
+		encPublicKey: keys.encKey,
+		lockAccount,
+		onDeployed: async (address, deployment) => {
+			progress.recorded = {
+				...deployment,
+				keyEntries
+			};
+			await accountRecords.write({
+				address,
+				bindingVersion: accManifest.bindingVersion,
+				localUseCounter: INITIAL_USE_COUNTER_VALUE,
+				deployment: progress.recorded
+			});
+		}
+	});
+	if (!progress.recorded) throw new Error("The deployment landed without reporting its progress.");
+	return {
+		deployed,
+		pending: progress.recorded
+	};
+};
+/**
+* Creates a Passport account: the passkey ceremony (implicit in the first
+* authoriser use), the account keys drawn through the encryption key
+* seam, the Account Custody Contract deployment in waves with sponsored
+* fees, the initial device activation, the delivery of the account keys
+* to this device's inbox, and the local persistence of the account
+* record. Every step runs inside one key session, so the whole flow costs
+* a single ceremony rather than one per authoriser call. The flow never
+* holds the encryption secret: the seam draws it at random, seals it to
+* this device's reader key and hands back only its public key, which the
+* constructor takes as `enc_key`, with this device's envelope and its
+* registration under a fresh roster key; once the device is active, both
+* are appended to the inbox, one gated call each, so the account keys
+* live on chain from the start.
+*
+* Progress is reported through `onProgress`: 'deploying' once the
+* authoriser has produced the device key, 'proving' and 'sponsoring' from
+* inside each transaction submission (a transaction proves first, then
+* the sponsor balances it), 'activating' before the activation call and
+* 'recording' before the key entries are appended. The record is written
+* before the promise resolves, so a process that dies right after still
+* recognises the account on next startup.
+*
+* The flow runs to completion once started: cancelling mid-deploy could
+* orphan a contract the sponsor already paid for. The caller's flow gate
+* is what keeps a second request from starting one. Should the process
+* die between waves anyway, the record written when the deploy landed
+* names the contract, what it still needs and the key entries, and the
+* next create request on this device resumes from the operations the
+* chain holds, activates once every wave is in and appends whichever key
+* entry the inbox still lacks; a creation that died after its activation
+* landed resumes from there. A resumed creation finishes exactly as it
+* began, with the keys recorded then: a request under another lock choice
+* than the recorded one is refused with CreationLockMismatchError, and a
+* build pinning other verifier keys than the recorded deployment with
+* CreationArtefactMismatchError, both before any wave. The session names
+* the lock choice, so an authoriser that asks consent first shows it; a
+* hosted signer refuses the same lock mismatch itself, and a resume
+* started from another origin than the creation it resumes.
+*
+* A device already holding a completed account record refuses with
+* AccountExistsError before the ceremony runs: the record is the only
+* pointer to the deployed contract and there is no recovery path, so
+* creating over it would orphan the existing account. Presence is read
+* without opening the record, and it tells a completed record from an
+* unfinished one, so a sealed record blocks the flow without costing a
+* prompt and only a record the flow may resume is opened, inside the
+* session, where it costs no extra prompt.
+*/
+const createAccount = async ({ lockAccount }, context) => {
+	const { seams, accountRecords, onProgress } = context;
+	const presence = await accountRecords.presence();
+	if (presence === "complete") throw new AccountExistsError();
+	const { passportAuthoriser, passportNetwork, passportProver, passportSponsor } = seams;
+	return inKeySession(passportAuthoriser, {
+		kind: "create-account",
+		lockAccount
+	}, async () => {
+		const local = await readLocalDevice(seams);
+		const pending = presence === "pending" ? await pendingRecord(accountRecords, lockAccount) : void 0;
+		onProgress("deploying");
+		const { deployed, pending: deployment } = await deploy({
+			providers: await createMidnightProviders({
+				network: passportNetwork,
+				prover: passportProver,
+				sponsor: passportSponsor,
+				onStage: onProgress
+			}),
+			lockAccount,
+			pending,
+			local,
+			context
+		});
+		if (!deployed.isActivated) {
+			onProgress("activating");
+			await deployed.activate();
+		}
+		const account = {
+			address: deployed.address,
+			bindingVersion: accManifest.bindingVersion,
+			status: "ready",
+			networkId: passportNetwork.networkId
+		};
+		const startCounter = pending?.localUseCounter ?? INITIAL_USE_COUNTER_VALUE;
+		const { indexer, ledgerState } = await readAccountLedger(deployed.address, passportNetwork);
+		const held = new Set(inboxEntries(ledgerState).map((entry) => HexBytes.fromByteArray(entry)));
+		const chain = callChain({
+			account,
+			start: {
+				ledgerState,
+				localUseCounter: startCounter,
+				devices: [{
+					commitmentHex: await passportAuthoriser.deviceCommitment(AccAddress(deployed.address), INITIAL_DEVICE_EPOCH, UseCounter(BigInt(startCounter))),
+					isLocal: true
+				}]
+			},
+			indexer,
+			seams,
+			onProgress,
+			onAdvanced: async (localUseCounter) => accountRecords.write({
+				address: account.address,
+				bindingVersion: account.bindingVersion,
+				localUseCounter,
+				deployment
+			})
+		});
+		await chain.append("recording", deployment.keyEntries.filter((entry) => !held.has(entry)).map((entry) => ByteArray.fromHex(HexBytes(entry))));
+		const { localUseCounter, devices } = chain.position();
+		const counter = localUseCounter ?? startCounter;
+		await accountRecords.write(completedRecord(account, counter, {}));
+		return {
+			account,
+			devices,
+			localUseCounter: counter,
+			grants: [],
+			encKey: HexBytes.fromByteArray(ledgerState.enc_key)
+		};
+	});
+};
+//#endregion
+//#region ../../packages/module/passport-account/src/acc/read-grants.ts
+const NO_SLOTS = /* @__PURE__ */ new Map();
+const NO_OPENINGS = /* @__PURE__ */ new Map();
+/** The slot reported for a grant whose slot this client never learned. */
+const UNKNOWN_SLOT = GrantSlot(0);
+const toNumber = (field, value) => {
+	if (value > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error(`Grant field ${field} exceeds the safe integer range`);
+	return Number(value);
+};
+const toOperations = (scope) => {
+	const operations = [];
+	if (scope.op_withdraw_unshielded) operations.push("withdraw-unshielded");
+	if (scope.op_withdraw_shielded) operations.push("withdraw-shielded");
+	if (scope.op_withdraw_shielded_to_contract) operations.push("withdraw-shielded-to-contract");
+	return operations;
+};
+const toScope = (scope) => ({
+	operations: toOperations(scope),
+	read: scope.read,
+	objectCommit: HexBytes.fromByteArray(scope.object_commit),
+	perCallCap: scope.per_call_cap.toString(),
+	cap: scope.cap.toString(),
+	expiresAt: scope.expires_at === 0n ? null : toNumber("expires_at", scope.expires_at),
+	rpCommit: HexBytes.fromByteArray(scope.rp_commit),
+	readPkHash: HexBytes.fromByteArray(scope.read_pk_hash),
+	window: scope.window_len === 0n ? null : {
+		lengthSeconds: toNumber("window_len", scope.window_len),
+		cap: scope.window_cap.toString()
+	},
+	callerCommit: HexBytes.fromByteArray(scope.caller_commit)
+});
+const toRecord = (id, record, { slot, opening }) => ({
+	id,
+	slot,
+	active: record.active,
+	epoch: toNumber("epoch", record.epoch),
+	generation: toNumber("gen", record.gen),
+	issuedAt: toNumber("issued_at", record.issued_at),
+	scope: toScope(record.scope),
+	spentWindow: {
+		start: toNumber("window_start", record.window_start),
+		spent: record.window_spent.toString()
+	},
+	...opening ? { opening } : {}
+});
+/**
+* Decodes the account's grant roster from the ledger's grants map, in the
+* map's order. Plain fields decode to the read model's numbers and
+* decimal strings, commitments stay as hex, and an expiry or window of
+* zero reads as none. A revoked grant stays in the map as an inactive
+* tombstone and is listed as such. The contract stores no slot: the
+* caller supplies the slots of the grants it issued, and a grant issued by
+* another client of the account reports slot 0. The openings the caller
+* holds are attached to their grants.
+*/
+const readGrants = (ledgerState, slots = NO_SLOTS, openings = NO_OPENINGS) => Array.from(ledgerState.grants, ([rawId, record]) => {
+	const id = GrantId(HexBytes.fromByteArray(rawId));
+	return toRecord(id, record, {
+		slot: slots.get(id) ?? UNKNOWN_SLOT,
+		opening: openings.get(id)
+	});
+});
+//#endregion
+//#region ../../packages/module/passport-account/src/flows/devices.ts
+/**
+* Contract aborts meaning the removal would leave the account without an
+* authorising device: the caller rule and the redundant count floor.
+*/
+const LAST_DEVICE_ABORTS = ["failed assert: cannot remove the authorising device", "failed assert: cannot remove last device"];
+/**
+* Types a raw contract abort by the assert message the Account Custody
+* Contract raises; anything unrecognised passes through unchanged.
+* An unknown-entry abort on the remove circuit is attributed to the
+* removal target, not the caller: the circuit checks the caller first,
+* and the caller's entry was resolved against live ledger state inside
+* the same gate, so only a mid-flight roll of the caller's own entry
+* could produce it, while a stale target commitment always does.
+*/
+const classifyContractAbort$1 = (error, circuit) => {
+	const message = error instanceof Error ? error.message : String(error);
+	if (LAST_DEVICE_ABORTS.some((abort) => message.includes(abort))) return new LastDeviceError(message);
+	if (message.includes("failed assert: unknown device entry")) return circuit === "remove_device_with_jubjub" ? new RemovalTargetNotFoundError(message) : new NotAuthorisedError(message);
+	if (isNotAuthorisedAbort(message)) return new NotAuthorisedError(message);
+	return error;
+};
+/**
+* Whether any read grant of the account is live: its grantees hold the
+* live account secret, so a device handed the keys while one is live
+* gets a fresh secret first.
+*/
+const hasLiveReadGrant = (ledgerState) => readGrants(ledgerState).some((record) => record.active && record.scope.read);
+/** The devices list with the enrolled commitment appended. */
+const withDevice = (devices, commitmentHex) => [...devices, {
+	commitmentHex,
+	isLocal: false
+}];
+/** The devices list with the revoked commitment dropped. */
+const withoutDevice = (devices, commitmentHex) => devices.filter((device) => device.commitmentHex !== commitmentHex);
+/** A device's entry as the call that targets it takes it. */
+const entryArgument = (commitmentHex) => ByteArray.fromHex(HexBytes(commitmentHex.toLowerCase()));
+/** The counter the chain left this device at, or the one it started from. */
+const chainCounter = (chain, input) => chain.position().localUseCounter ?? input.localUseCounter ?? "0";
+/**
+* Opens what a device flow runs on inside its key session: the grant
+* bookkeeping of the record, read where it costs no extra prompt so every
+* write keeps it, and a chain of gated calls from the ledger read ahead
+* of the session, each persisting the counter it advanced this device to
+* before the next call. The bookkeeping is checked against the ledger
+* first, so an entry that does not open the grant the chain holds under
+* its id, as one an issue wrote before a call that never landed, is
+* neither re-sealed to nor kept.
+*/
+const openDeviceSession = async (input, { ledgerState, indexer }, { seams, accountRecords, onProgress }) => {
+	const { account, devices, localUseCounter } = input;
+	let grants = await retainStoredGrants((await accountRecords.read())?.grants, readGrants(ledgerState), account.address);
+	const write = async (counter) => accountRecords.write(completedRecord(account, counter, { grants }));
+	const chain = callChain({
+		account,
+		start: {
+			ledgerState,
+			localUseCounter,
+			devices
+		},
+		indexer,
+		seams,
+		onProgress,
+		onAdvanced: write
+	});
+	return {
+		grants,
+		chain,
+		keep: async (next) => {
+			grants = next;
+			await write(chainCounter(chain, input));
+		}
+	};
+};
+/**
+* Enrols a new device key on the account. `commitmentHex` carries the new
+* device's entry commitment, derived out of band by the joining device;
+* the local device authorises `add_device_with_jubjub` through the
+* gated-call pattern. The roster gains the commitment on success only,
+* marked as remote, and the same result moves the local device's own row
+* to the successor entry the call left it on, so the roster and the use
+* counter never disagree about where this device stands.
+*
+* When `reader` names the joining device's reader and device keys, the
+* account keys are delivered to it in the same session: its device key
+* must derive the enrolled commitment at use counter 0 and its reader key
+* must be one the account seals to, both checked before any prompt. The
+* encryption key seals the live secret and the roster key to the reader
+* key, and the envelope and the device's registration under the roster
+* key are appended to the inbox, one gated call each, ahead of the
+* enrolment, so an enrolment that lands never leaves the device without
+* its keys; until it lands the registration names no live entry and a
+* rotation passes over it. While any read grant is live its grantees
+* hold the live secret, and one could seal it to the joining reader with
+* a roster key of its own ahead of the genuine envelope, so the account
+* keys are rotated first in the same session, with a fresh roster key,
+* as a removal rotates them, the joining device handed the new secret no
+* grantee has seen, and the live read grants this client holds the read
+* key of sealed it after; with no live read grant only enrolled devices
+* hold the secret, and the live keys are handed over as they are. The
+* joining device then signs in and reads the holdings with its own
+* passkey alone. Without `reader` the
+* device can authorise but reads nothing until some device delivers it
+* the keys.
+*
+* The advanced counter is persisted to the account record after every
+* call, before the roster is returned, so the next flow rescans from a
+* fresh anchor. A failure leaves the roster unreturned.
+*
+* A rejected authorisation (bad signature, malformed key, or a caller
+* entry the on-chain set no longer holds) rejects with NotAuthorisedError;
+* a record whose address holds no live contract rejects with
+* AccountContractMissingError; joining keys that do not match the entry
+* reject with DeviceReaderInvalidError. The transactions' proving and
+* sponsoring stages and 'recording' are reported through `onProgress`.
+*/
+const addDevice = async ({ reader, ...input }, context) => {
+	const { seams, onProgress } = context;
+	const { account, commitmentHex } = input;
+	const { networkId } = seams.passportNetwork;
+	try {
+		const ledger = await readAccountLedger(account.address, seams.passportNetwork);
+		if (reader) assertJoiningDevice({
+			address: account.address,
+			epoch: ledger.ledgerState.device_epoch
+		}, reader, commitmentHex);
+		const view = reader && hasLiveReadGrant(ledger.ledgerState) ? viewCapability(seams.passportEncryptionKey) : void 0;
+		const devices = view ? liveDeviceEntries(ledger.ledgerState) : void 0;
+		return await inKeySession(seams.passportAuthoriser, {
+			kind: "add-device",
+			commitmentHex,
+			account: AccAddress(account.address),
+			...reader ? { reader } : {},
+			...devices ? { devices } : {}
+		}, async () => {
+			const { grants, chain, keep } = await openDeviceSession(input, ledger, context);
+			let rotated;
+			if (reader) {
+				const local = await readLocalDevice(seams);
+				if (view && devices) rotated = await rotateEncKey({
+					account,
+					encryptionKey: seams.passportEncryptionKey,
+					view,
+					local,
+					chain,
+					indexer: ledger.indexer,
+					networkId,
+					onProgress,
+					devices,
+					rotateRoster: true
+				});
+				const delivery = await seams.passportEncryptionKey.sealToDevice(networkId, rotated?.keyring ?? readAccountInbox(account.address, chain.position().ledgerState, local.readerPublicKey).keyring, {
+					...reader,
+					epoch: ledger.ledgerState.device_epoch,
+					counter: 0n
+				});
+				await chain.append("recording", [delivery.envelope, delivery.registration]);
+				if (view && rotated) {
+					const views = await sealViews({
+						view,
+						networkId,
+						keyring: rotated.keyring,
+						account: AccAddress(account.address),
+						targets: liveStoredReadGrants(grants, readGrants(chain.position().ledgerState))
+					});
+					await keep(withSealedViews(grants, views));
+					await chain.append("recording", views.entries);
+				}
+			}
+			await chain.submit({
+				circuit: ADD_DEVICE_CIRCUIT,
+				args: [entryArgument(commitmentHex)]
+			});
+			return {
+				devices: withDevice(chain.position().devices, commitmentHex),
+				localUseCounter: chainCounter(chain, input),
+				...rotated ? {
+					encKey: HexBytes.fromByteArray(rotated.encKey),
+					droppedDevices: rotated.dropped
+				} : {}
+			};
+		});
+	} catch (error) {
+		throw classifyContractAbort$1(error, ADD_DEVICE_CIRCUIT);
+	}
+};
+/**
+* Refuses a removal the contract would refuse before any prompt: a
+* target the on-chain device set does not hold, and the local device,
+* which cannot remove itself. The rotation a removal runs comes first,
+* so a removal refused only after it would have cost the target device
+* its keys for nothing.
+*
+* @throws {@link RemovalTargetNotFoundError} when the target is gone.
+* @throws {@link LastDeviceError} when the target is this device.
+*/
+const assertRemovable = ({ devices, commitmentHex }, { ledgerState }) => {
+	if (!ledgerState.devices.member(entryArgument(commitmentHex))) throw new RemovalTargetNotFoundError(`The account holds no device entry ${commitmentHex}.`);
+	if (devices.find((device) => device.isLocal)?.commitmentHex.toLowerCase() === commitmentHex.toLowerCase()) throw new LastDeviceError("The device that authorises a removal cannot remove itself.");
+};
+/**
+* Revokes a device key from the account and rotates the account keys so
+* the removed device reads nothing newer. `commitmentHex` names the
+* target by its current entry commitment, which is the literal set
+* element the contract removes; the local device authorises
+* `remove_device_with_jubjub` through the gated-call pattern.
+*
+* Ahead of the removal, in the same session, the encryption key is
+* rotated with a fresh roster key and sealed only to this device and to
+* the registered devices whose device key derives a live entry other
+* than the target, which the key session names to the user before it
+* opens; the live holdings are re-encrypted towards it, and it is sealed
+* again to every live read grant this client holds the read key of, each
+* seal kept on chain in a grant record. The removed device's envelopes
+* stay in the inbox and keep opening the secrets they held, but none
+* opens the new one, and the registrations under the old roster key no
+* longer count, any it planted for itself included. A roster in which
+* two readers claim one live device, or one reader two, refuses with
+* DeviceRosterInvalidError rather than guess.
+*
+* The roster drops the commitment on success only, and the same result
+* moves the local device's own row to the successor entry the call left
+* it on. The advanced counter is persisted to the account record after
+* every call. The contract's own guards surface as typed errors: a
+* removal that would strand the account (the authorising device, or the
+* count floor) rejects with LastDeviceError, a rejected authorisation
+* (bad signature or malformed key) with NotAuthorisedError, and a target
+* entry that is no longer in the on-chain set with
+* RemovalTargetNotFoundError; the target's presence and the local device
+* are checked before any prompt, and an encryption key that cannot
+* rotate refuses with ReadUnavailableError before any prompt too. The
+* rotation's stages, 'recording' and the transactions' proving and
+* sponsoring are reported through `onProgress`.
+*/
+const removeDevice = async (input, context) => {
+	const { seams, onProgress } = context;
+	const { account, commitmentHex } = input;
+	const { networkId } = seams.passportNetwork;
+	try {
+		const view = viewCapability(seams.passportEncryptionKey);
+		const ledger = await readAccountLedger(account.address, seams.passportNetwork);
+		assertRemovable(input, ledger);
+		const devices = liveDeviceEntries(ledger.ledgerState, commitmentHex);
+		return await inKeySession(seams.passportAuthoriser, {
+			kind: "remove-device",
+			commitmentHex,
+			account: AccAddress(account.address),
+			devices
+		}, async () => {
+			const { grants, chain, keep } = await openDeviceSession(input, ledger, context);
+			const rotated = await rotateEncKey({
+				account,
+				encryptionKey: seams.passportEncryptionKey,
+				view,
+				local: await readLocalDevice(seams),
+				chain,
+				indexer: ledger.indexer,
+				networkId,
+				onProgress,
+				devices,
+				rotateRoster: true,
+				target: commitmentHex.toLowerCase()
+			});
+			const views = await sealViews({
+				view,
+				networkId,
+				keyring: rotated.keyring,
+				account: AccAddress(account.address),
+				targets: liveStoredReadGrants(grants, readGrants(chain.position().ledgerState))
+			});
+			await keep(withSealedViews(grants, views));
+			await chain.append("recording", views.entries);
+			await chain.submit({
+				circuit: REMOVE_DEVICE_CIRCUIT,
+				args: [entryArgument(commitmentHex)]
+			});
+			return {
+				devices: withoutDevice(chain.position().devices, commitmentHex),
+				localUseCounter: chainCounter(chain, input),
+				encKey: HexBytes.fromByteArray(rotated.encKey),
+				droppedDevices: rotated.dropped
+			};
+		});
+	} catch (error) {
+		throw classifyContractAbort$1(error, REMOVE_DEVICE_CIRCUIT);
+	}
+};
+//#endregion
+//#region ../../packages/module/passport-account/src/flows/grants.ts
+/** Contract abort naming a grant the grants map does not hold. */
+const UNKNOWN_GRANT_ABORT = "failed assert: unknown grant";
+/** Contract abort refusing a revoke over a grant already inactive. */
+const GRANT_NOT_LIVE_ABORT = "failed assert: grant not live";
+/** Contract abort refusing an issue over a grant id that is still active. */
+const GRANT_ACTIVE_ABORT = "failed assert: grant already active";
+/**
+* How long an accepted call is given to show in the indexer's view of the
+* grants map, which can lag the block the call landed in.
+*/
+const ROSTER_POLL_ATTEMPTS = 30;
+const ROSTER_POLL_DELAY_MS = 1e3;
+const MILLISECONDS_PER_SECOND = 1e3;
+const sleep = async (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+const isActive = (roster, grantId) => roster.some((record) => record.id === grantId && record.active);
+const activeCount = (roster) => roster.filter((record) => record.active).length;
+const nowSeconds = () => Math.floor(Date.now() / MILLISECONDS_PER_SECOND);
+/**
+* Types a raw contract abort by the assert message the Account Custody
+* Contract raises; anything unrecognised passes through unchanged. An
+* unknown-entry abort can only come from the caller check here, since no
+* grant circuit names a device entry.
+*/
+const classifyContractAbort = (error) => {
+	const message = error instanceof Error ? error.message : String(error);
+	if (message.includes(UNKNOWN_GRANT_ABORT)) return new GrantNotFoundError(message);
+	if (message.includes(GRANT_NOT_LIVE_ABORT)) return new GrantRevokedError(message);
+	if (message.includes(GRANT_ACTIVE_ABORT)) return new GrantIssueRejectedError(message);
+	if (message.includes("failed assert: unknown device entry") || isNotAuthorisedAbort(message)) return new NotAuthorisedError(message);
+	return error;
+};
+/**
+* Refuses a device whose storage holds no account record before any
+* ceremony. The gate only runs a call over an account in state, so an
+* absent record means the storage was cleared underneath it.
+*/
+const assertRecordPresent = async (accountRecords) => {
+	if (await accountRecords.presence() === "absent") throw new AccountNotFoundError("No Passport account record is stored on this device.");
+};
+/**
+* The stored record of the account a grant call acts on, read inside the
+* session where it costs no extra prompt. Presence was checked ahead of
+* the session, so a missing record here vanished in between.
+*/
+const storedRecord = async (accountRecords) => {
+	const record = await accountRecords.read();
+	if (!record) throw new AccountNotFoundError("No Passport account record is stored on this device.");
+	return record;
+};
+/**
+* The ledger state once the indexer reflects the accepted call, with the
+* roster read from it. The submission settled in a block, but the
+* indexer can serve the state from before it for a moment, and a roster
+* read then would deny the call its own result.
+*
+* @throws {@link GrantRosterUnsettledError} when the indexer never
+* reflects the call within the polling window.
+*/
+const awaitSettledRoster = async ({ indexer, address, slots, openings, isSettled }) => {
+	for (let attempt = 0; attempt < ROSTER_POLL_ATTEMPTS; attempt++) {
+		const ledgerState = await queryAccountLedger(indexer, address);
+		const roster = readGrants(ledgerState, slots, openings);
+		if (isSettled(roster)) return {
+			ledgerState,
+			roster
+		};
+		await sleep(ROSTER_POLL_DELAY_MS);
+	}
+	throw new GrantRosterUnsettledError(`The grant roster of ${address} never reflected the accepted call.`);
+};
+/**
+* Runs one gated grant call inside a single key session, so the use
+* counter rescan and the authorisation cost one ceremony rather than one
+* per authoriser call. A device whose storage holds no record is refused
+* ahead of the session. The record is read inside it, where it costs no
+* extra prompt, its grant bookkeeping narrowed to the grants whose kept
+* fields open what the ledger read before the call holds under their id,
+* so an entry an issue wrote before a call that never landed is neither
+* an opening nor a re-seal target. It is rewritten with the advanced
+* counter and the grant bookkeeping after every call, so a roster is
+* never published ahead of the record that anchors the next rescan and
+* names the slots. A call
+* that keeps its bookkeeping ahead of the submission writes it once more
+* before it, under the counter the record holds. A call that rotates the
+* encryption key does so in the same session ahead of its own circuit.
+* The other live read grants are sealed the new secret right after the
+* rotation lands, their seals kept in the record and on chain before the
+* call is submitted, so they keep reading whatever the call's outcome.
+* Once the roster shows an issued grant active, its bookkeeping is
+* appended to the inbox, sealed to this device alone, and the grantee of
+* a read grant is sealed the new secret, the seal kept the same way. The
+* wait for the indexer is reported as 'confirming' and the appends as
+* 'recording'. The contract's own aborts surface as typed errors;
+* anything else, and a failing on-chain status in particular, rejects
+* unchanged with the counter unmoved.
+*/
+const runGrantCall = async ({ config: { call, flow, nextStoredGrants, writeBeforeCall, isSettled, rotation, reseal, issued }, input: { account, devices, localUseCounter }, ledger: { indexer, ledgerState }, roster: listed, context: { seams, accountRecords, onProgress } }) => {
+	const { networkId } = seams.passportNetwork;
+	const accountAddress = AccAddress(account.address);
+	try {
+		await assertRecordPresent(accountRecords);
+		const rotationDevices = rotation ? liveDeviceEntries(ledgerState) : void 0;
+		return await inKeySession(seams.passportAuthoriser, rotationDevices ? {
+			...flow,
+			devices: rotationDevices
+		} : flow, async () => {
+			const record = await storedRecord(accountRecords);
+			let stored = nextStoredGrants(await retainStoredGrants(record.grants, listed, account.address));
+			const write = async (counter) => accountRecords.write(completedRecord(account, counter, { grants: stored }));
+			if (writeBeforeCall) await write(record.localUseCounter);
+			const chain = callChain({
+				account,
+				start: {
+					ledgerState,
+					localUseCounter,
+					devices
+				},
+				indexer,
+				seams,
+				onProgress,
+				onAdvanced: write
+			});
+			const counter = () => chain.position().localUseCounter ?? record.localUseCounter;
+			const roster = (state) => readGrants(state, storedGrantSlots(stored), storedGrantOpenings(stored));
+			let rotated;
+			let unsealedGrantIds = [];
+			let revocationPendingGrantIds = [];
+			if (rotation) {
+				rotated = await rotateEncKey({
+					account,
+					encryptionKey: seams.passportEncryptionKey,
+					view: rotation,
+					local: await readLocalDevice(seams),
+					chain,
+					indexer,
+					networkId,
+					onProgress,
+					devices: rotationDevices ?? []
+				});
+				if (reseal) {
+					const views = await sealViews({
+						view: rotation,
+						networkId,
+						keyring: rotated.keyring,
+						account: accountAddress,
+						targets: liveStoredReadGrants(stored, roster(chain.position().ledgerState), reseal.except)
+					});
+					stored = withSealedViews(stored, views);
+					unsealedGrantIds = views.unsealed;
+					revocationPendingGrantIds = views.revocationPending;
+					await write(counter());
+					await chain.append("recording", views.entries);
+				}
+			}
+			await chain.submit(call);
+			onProgress("confirming");
+			const settled = await awaitSettledRoster({
+				indexer,
+				address: account.address,
+				slots: storedGrantSlots(stored),
+				openings: storedGrantOpenings(stored),
+				isSettled
+			});
+			let grants = settled.roster;
+			if (issued) {
+				const entries = await seams.passportEncryptionKey.sealGrant(networkId, accountAddress, issued.bookkeeping);
+				if (rotation && rotated && issued.readPublicKey !== void 0) {
+					const views = await sealViews({
+						view: rotation,
+						networkId,
+						keyring: rotated.keyring,
+						account: accountAddress,
+						targets: [{
+							grantId: issued.bookkeeping.grantId,
+							readPublicKey: issued.readPublicKey
+						}]
+					});
+					stored = withSealedViews(stored, views);
+					unsealedGrantIds = [...unsealedGrantIds, ...views.unsealed];
+					revocationPendingGrantIds = [...revocationPendingGrantIds, ...views.revocationPending];
+					entries.push(...views.entries);
+					await write(counter());
+					grants = roster(settled.ledgerState);
+				}
+				await chain.append("recording", entries);
+			}
+			return {
+				grants,
+				devices: chain.position().devices,
+				localUseCounter: counter(),
+				...rotated ? {
+					encKey: HexBytes.fromByteArray(rotated.encKey),
+					droppedDevices: rotated.dropped
+				} : {},
+				unsealedGrantIds,
+				revocationPendingGrantIds
+			};
+		});
+	} catch (error) {
+		throw classifyContractAbort(error);
+	}
+};
+/**
+* Issues a scoped grant to an agent key. The scope is checked against the
+* rules the contract asserts before any prompt: a shielded operation
+* needs read, a read grant needs a canonical read public key, a rolling
+* window is refused because the contract reserves its bounds, and a
+* grant beyond sixteen active ones is refused as Lace's limit. Each
+* refusal is a GrantScopeInvalidError or GrantLimitReachedError and costs
+* no ceremony; a host with no relying party id is refused with
+* GrantOriginMissingError before the chain is read, and a read grant
+* with ReadUnavailableError when the encryption key held here cannot
+* share the viewing secret. The grant id is derived from the account,
+* the grantee key, the hash of this host's relying party id and the
+* first slot free for that pair, and the scope salt is drawn fresh; the
+* local device then authorises `issue_grant_with_jubjub` over the id and
+* the salted scope digest, which binds the hash of the read key. The key
+* session is opened with the account, the slot, the salt and the digest
+* beside the id and the scope, so an authoriser that does not share this
+* flow's memory can re-derive both before it signs.
+*
+* A read grant delivers the account's viewing secret, and read is total:
+* the grantee sees every shielded holding, current and future, until the
+* key is rotated again. So the key is rotated first, in the same session:
+* a fresh random secret is sealed to every device, the live holdings are
+* re-encrypted towards it, its public key replaces `enc_key`, and only
+* then is the grant issued, so the grantee reads nothing of the
+* account's spent history. Right after the rotation lands the new secret
+* is sealed to every other live read grant this client holds the key of,
+* so they keep reading even should the issue fail, and once the grant
+* shows active it is sealed to the grantee's read key; the seals join
+* the bookkeeping, and the grantee's reaches it through the agent
+* policy, never the chain. A grantee seal the key seam refuses after the
+* grant landed leaves the grant active and unsealed, named among the
+* result's unsealed grants, rather than failing the issue.
+*
+* The slot and salt are kept in the account record, since the contract
+* stores neither, together with the object fields its commitment hides
+* (colour, recipient and coin bound) and the read key, which the grantee
+* needs to open it and which reach the roster as the grant's opening.
+* They are written before the call is submitted: a grant that lands
+* without its salt could never be opened for its grantee. A call that
+* never lands leaves a stale entry, which the next sign-in prunes against
+* the chain and a later issue over the same id overwrites. Once the
+* grant shows active the same bookkeeping, and each seal, is appended to
+* the inbox in grant records only this device opens, so a sign-in after
+* the record is lost rebuilds it. The roster is read back from chain
+* once the grant shows active in it.
+*
+* A grant id the contract still holds active rejects with
+* GrantIssueRejectedError, and a rejected authorisation with
+* NotAuthorisedError. The transaction's proving and sponsoring stages,
+* the rotation, the wait for the indexer and the appends are reported
+* through `onProgress`.
+*/
+const issueGrant = async ({ scope, ...input }, context) => {
+	const { rpId, seams } = context;
+	if (rpId === void 0) throw new GrantOriginMissingError();
+	const view = scope.read ? viewCapability(seams.passportEncryptionKey) : null;
+	const { account } = input;
+	const ledger = await readAccountLedger(account.address, seams.passportNetwork);
+	const roster = readGrants(ledger.ledgerState);
+	validateGrantScope(scope, {
+		nowSeconds: nowSeconds(),
+		grantCount: activeCount(roster)
+	});
+	const { grantId, slot, scopeSalt, scopeDigest, call } = prepareIssueGrant({
+		contractAddress: ByteArray.fromHex(HexBytes(account.address)),
+		scope,
+		originHash: await originHash(rpId),
+		roster
+	});
+	const readPublicKey = view ? scope.readPublicKey : void 0;
+	const object = {
+		color: scope.color,
+		recipient: scope.recipient,
+		maxCoinValue: scope.maxCoinValue
+	};
+	return {
+		grantId,
+		...await runGrantCall({
+			config: {
+				call,
+				flow: {
+					kind: "issue-grant",
+					grantId,
+					scope,
+					account: AccAddress(account.address),
+					slot,
+					scopeSalt,
+					scopeDigest
+				},
+				nextStoredGrants: (stored) => withStoredGrant(stored, grantId, {
+					slot,
+					scopeSalt,
+					granteePublicKey: scope.grantee.publicKey,
+					origin: rpId,
+					object,
+					...readPublicKey === void 0 ? {} : { view: { readPublicKey } }
+				}),
+				writeBeforeCall: true,
+				isSettled: (settled) => isActive(settled, grantId),
+				...view && readPublicKey !== void 0 ? {
+					rotation: view,
+					reseal: { except: grantId }
+				} : {},
+				issued: {
+					bookkeeping: {
+						grantId,
+						slot,
+						scopeSalt,
+						granteePublicKey: scope.grantee.publicKey,
+						object,
+						...readPublicKey === void 0 ? {} : { readPublicKey }
+					},
+					...readPublicKey === void 0 ? {} : { readPublicKey }
+				}
+			},
+			input,
+			ledger,
+			roster,
+			context
+		})
+	};
+};
+/**
+* The stored grants with the seal of one grant dropped, its read key
+* kept: a revoked read grant's seal holds a secret the rotation that
+* follows retires.
+*/
+const withoutSeal = (stored, grantId) => {
+	const view = stored?.[grantId]?.view;
+	return stored && view ? withStoredGrantView(stored, grantId, { readPublicKey: view.readPublicKey }) : stored;
+};
+/**
+* Revokes one grant by its id. A grant the chain does not hold is refused
+* with GrantNotFoundError before any prompt, and one it lists inactive
+* with GrantRevokedError; the same errors type the contract's own aborts
+* should the grant vanish or be revoked elsewhere in between. The local
+* device authorises `revoke_grant_with_jubjub`. The grant stays in the
+* roster as an inactive tombstone, so its stored slot and salt are kept,
+* and the roster is read back from chain once the grant shows inactive.
+*
+* Revoking a read grant also rotates the encryption key, in the same
+* session ahead of the revocation: a fresh random secret is sealed to
+* every device and the live holdings are re-encrypted towards it, so the
+* revoked grantee keeps what it already read and nothing newer, and
+* right after the rotation lands the new secret is sealed again to every
+* other read grant this client holds the read key of, ahead of the
+* revocation. A read grant is refused with ReadUnavailableError before
+* any prompt when the encryption key held here cannot re-encrypt and
+* seal.
+*/
+const revokeGrant = async ({ grantId, ...input }, context) => {
+	const { account } = input;
+	const ledger = await readAccountLedger(account.address, context.seams.passportNetwork);
+	const roster = readGrants(ledger.ledgerState);
+	const listed = roster.find((record) => record.id === grantId);
+	if (!listed) throw new GrantNotFoundError(`The account at ${account.address} holds no grant ${grantId}.`);
+	if (!listed.active) throw new GrantRevokedError(`The grant ${grantId} of the account at ${account.address} is already revoked.`);
+	const rotation = listed.scope.read ? viewCapability(context.seams.passportEncryptionKey) : void 0;
+	return runGrantCall({
+		config: {
+			call: prepareRevokeGrant(grantId),
+			flow: {
+				kind: "revoke-grant",
+				grantId,
+				account: AccAddress(account.address),
+				...rotation ? { read: true } : {}
+			},
+			nextStoredGrants: (stored) => rotation ? withoutSeal(stored, grantId) : stored,
+			writeBeforeCall: false,
+			isSettled: (settled) => !isActive(settled, grantId),
+			...rotation ? {
+				rotation,
+				reseal: { except: grantId }
+			} : {}
+		},
+		input,
+		ledger,
+		roster,
+		context
+	});
+};
+/**
+* Revokes every grant the account has issued: the local device
+* authorises `revoke_all_grants_with_jubjub`, which clears the grants
+* map and advances the grant generation. The record's grant bookkeeping
+* is dropped with the map, and the roster is read back from chain once
+* it lists nothing, tombstones included. While any read grant is live,
+* the encryption key is rotated in the same session ahead of the call
+* and the live holdings are re-encrypted, so no revoked grantee reads
+* on; with every grant gone there is nobody to re-seal to. The rotation
+* is refused with ReadUnavailableError before any prompt when the
+* encryption key held here cannot re-encrypt.
+*/
+const revokeAllGrants = async (input, context) => {
+	const { account } = input;
+	const ledger = await readAccountLedger(account.address, context.seams.passportNetwork);
+	const roster = readGrants(ledger.ledgerState);
+	const rotation = roster.some((record) => record.active && record.scope.read) ? viewCapability(context.seams.passportEncryptionKey) : void 0;
+	return runGrantCall({
+		config: {
+			call: prepareRevokeAllGrants(),
+			flow: {
+				kind: "revoke-all-grants",
+				account: AccAddress(account.address),
+				...rotation ? { read: true } : {}
+			},
+			nextStoredGrants: () => void 0,
+			writeBeforeCall: false,
+			isSettled: (settled) => settled.length === 0,
+			...rotation ? { rotation } : {}
+		},
+		input,
+		ledger,
+		roster,
+		context
+	});
+};
+//#endregion
+//#region ../../packages/module/passport-account/src/flows/holdings.ts
+/**
+* Reads the account's shielded holdings from public chain data: the
+* contract's inbox is walked with the account secrets this device's own
+* envelopes deliver, the one deriving the ledger's `enc_key` first and
+* the older ones after it, so a coin a racing sender or an interrupted
+* rotation left under an earlier key is still found, and each coin that
+* opens is kept only once its commitment is found among the outputs the
+* chain created for the account, with the tree index it took. The
+* envelopes are opened inside one key session, so the walk costs one
+* ceremony however many entries the inbox holds, and none at all when
+* it holds no coin to open; only the opened coin descriptions reach this
+* flow, never a secret. Nothing is written: no record, no chain call.
+*
+* A record whose address holds no live contract rejects with
+* AccountContractMissingError, and an inbox holding no envelope of this
+* device that opens the ledger's `enc_key` with EncryptionKeyMismatchError
+* rather than an inbox read as empty. An entry that fails to open or
+* describes a coin the chain never created is skipped and counted, never
+* an error; the account keys and grant bookkeeping the inbox also holds
+* are not coins and are not counted.
+*
+* Reports no intermediate stage: the ceremony and the indexer reads all
+* settle before there is anything to report.
+*/
+const readShieldedHoldings = async ({ account }, { seams }) => {
+	const { passportAuthoriser, passportEncryptionKey, passportNetwork } = seams;
+	const indexer = createIndexerClient({
+		indexerUrl: passportNetwork.indexerUrl,
+		indexerWsUrl: passportNetwork.indexerWsUrl
+	});
+	const ledgerState = await queryAccountLedger(indexer, account.address);
+	const { holdings, skippedEntries } = await walkInbox({
+		address: account.address,
+		ledgerState,
+		indexer,
+		openEntries: async (entries) => inKeySession(passportAuthoriser, { kind: "read-holdings" }, async () => {
+			const { keyring } = readAccountInbox(account.address, ledgerState, await passportEncryptionKey.readerPublicKey(passportNetwork.networkId));
+			return (await passportEncryptionKey.openInbox(passportNetwork.networkId, keyring, entries)).map((entry) => entry?.kind === "coin" ? entry.coin : null);
+		})
+	});
+	return {
+		holdings,
+		skippedEntries
+	};
+};
+//#endregion
+//#region ../../packages/module/passport-account/src/flows/sign-in.ts
+/**
+* The account's whole device roster, read from the on-chain device set.
+* Entries are opaque rolling commitments, so a remote entry carries no
+* identity beyond its commitment: only the local device can be named, by
+* the commitment its own rescan resolved.
+*/
+const toDeviceRoster = (entries, localCommitmentHex) => Array.from(entries, (entry) => {
+	const commitmentHex = HexBytes.fromByteArray(entry);
+	return {
+		commitmentHex,
+		isLocal: commitmentHex === localCommitmentHex
+	};
+});
+/**
+* Refuses a record whose creation is still unfinished on chain. A record
+* that carries a pending deployment names a contract that may still miss
+* verifier keys, its initial device or the entries that deliver the
+* account keys, which only the create flow can complete; but a creation
+* that appended its key entries and then died before its final record
+* write left a usable account behind, and the chain's boot flag and inbox
+* tell the two apart.
+*/
+const assertCreationComplete = (record, isActivated, entries) => {
+	const { deployment } = record;
+	if (deployment === void 0) return;
+	const held = new Set(entries.map((entry) => HexBytes.fromByteArray(entry)));
+	if (!isActivated || deployment.keyEntries.some((entry) => !held.has(entry))) throw new AccountCreationPendingError(`The account at ${record.address} is deployed but not yet ready; resume the creation on this device, from the site that started it.`);
+};
+/** The grant record parts the Lace records of an inbox opened to. */
+const grantPartsOf = (opened) => opened.flatMap((entry) => entry?.kind === "grant" ? [entry.record] : []);
+/**
+* Recognises an existing Passport account on this device: the passkey
+* ceremony (implicit in the first authoriser use) proves the device key,
+* the persisted account record names the Account Custody Contract, the
+* indexer confirms the contract is live, this device's own envelopes in
+* the contract's inbox open a secret deriving the `enc_key` the contract
+* advertises, and the use-counter rescan restores this device's roster
+* position from the on-chain device set. The account secret is never
+* read from the record or derived from the passkey: it is random, and
+* this device reaches it only through an envelope sealed to its reader
+* key, so a device enrolled with its own passkey signs in without the
+* record of the device that created the account. The roster is rebuilt
+* from every entry in the device set, so a device enrolled elsewhere
+* survives a reload; only the local entry is named, the rest are opaque
+* commitments. The grant roster is read from the contract's grants map
+* the same way, with the slots and openings the record kept for the
+* grants this client issued; a grant the record lacks, as after the
+* record was lost, is rebuilt from the grant records this device keeps in
+* the inbox once they open its on-chain commitments under this host's
+* relying party id, its seal kept only while it holds the live secret.
+* A grant the record holds is kept only while its fields open the
+* commitments the chain holds under its id, so an entry an issue wrote
+* before a call that never landed gives way to the grant another client
+* of the account issued over the same id, and a rebuilt grant takes its
+* place when there is one. The live read grants whose kept seal does not
+* hold the live secret, as after an issue that failed before its seal,
+* are reported as unsealed.
+* The devices registered under the live roster key are kept in the
+* record as the roster the next rotation seals to. The whole chain runs
+* inside one key session, so it costs a single ceremony rather than one
+* per authoriser call.
+*
+* The healed counter is written back to the persisted record before this
+* resolves, so the next sign-in rescans from a fresh anchor instead of the
+* creation-time one. That write also completes a record a creation left
+* pending after its key entries landed, dropping the deployment and the
+* authority key it carries, and drops the bookkeeping of grants the chain
+* no longer holds or whose commitments it does not open. A missing record
+* raises AccountNotFoundError, a record whose address holds no live
+* contract raises AccountContractMissingError,
+* a record whose creation is unfinished on chain raises
+* AccountCreationPendingError, and an inbox holding no envelope of this
+* device that opens the live `enc_key`, as for a device never handed the
+* keys or removed since, raises EncryptionKeyMismatchError before the
+* rescan runs; rediscovering an account by name service when no record is
+* persisted is a separate flow and out of scope here.
+*
+* signIn reports no intermediate stage: the ceremony, the indexer read and
+* the rescan all settle before there is anything to report.
+*/
+const signIn = async ({ seams, accountRecords, rpId }) => {
+	const { passportAuthoriser, passportEncryptionKey, passportNetwork } = seams;
+	return inKeySession(passportAuthoriser, { kind: "sign-in" }, async () => {
+		const local = await readLocalDevice(seams);
+		const record = await accountRecords.read();
+		if (!record) throw new AccountNotFoundError("No Passport account record is stored on this device.");
+		const state = await createIndexerClient({
+			indexerUrl: passportNetwork.indexerUrl,
+			indexerWsUrl: passportNetwork.indexerWsUrl
+		}).queryContractState(record.address);
+		if (!state) throw new AccountContractMissingError(`No live Account Custody Contract found at ${record.address}.`);
+		const ledgerState = ledger(state.data);
+		const { entries, keyring } = readAccountInbox(record.address, ledgerState, local.readerPublicKey);
+		assertCreationComplete(record, ledgerState.booted, entries);
+		if (keyring.envelopes.length === 0) throw new EncryptionKeyMismatchError(`The inbox of the account at ${record.address} holds no envelope for this device.`);
+		const grantParts = grantPartsOf(await passportEncryptionKey.openInbox(passportNetwork.networkId, keyring, entries.filter(isLaceRecord)));
+		const { useCounter, commitmentHex } = await resolveUseCounter({
+			ledgerState,
+			authoriser: passportAuthoriser,
+			address: AccAddress(record.address),
+			knownUseCounter: UseCounter(BigInt(record.localUseCounter))
+		});
+		const devices = toDeviceRoster(ledgerState.devices, commitmentHex);
+		const encKey = HexBytes.fromByteArray(ledgerState.enc_key);
+		const onChain = readGrants(ledgerState);
+		const stored = withRebuiltGrants(await retainStoredGrants(record.grants, onChain, record.address), rpId === void 0 ? void 0 : await rebuildStoredGrants(grantParts, onChain, {
+			address: record.address,
+			origin: rpId,
+			encKey
+		}), encKey);
+		const grants = readGrants(ledgerState, storedGrantSlots(stored), storedGrantOpenings(stored));
+		const localUseCounter = useCounter.toString();
+		await accountRecords.write(completedRecord(record, localUseCounter, { grants: stored }));
+		return {
+			account: {
+				address: record.address,
+				bindingVersion: record.bindingVersion,
+				status: "ready",
+				networkId: passportNetwork.networkId
+			},
+			devices,
+			localUseCounter,
+			grants,
+			encKey,
+			unsealedGrantIds: unsealedStoredReadGrants(stored, onChain, encKey)
+		};
+	});
+};
+//#endregion
+//#region ../../packages/module/passport-account/src/store/dependencies.ts
+/**
+* Runs a flow as a cold stream of its events. `run` is invoked once per
+* subscription with a progress sink that emits synchronously as the flow
+* reports; the resolution emits 'done' and completes, and a rejection
+* errors the stream. Unsubscribing only stops delivery: the running
+* promise is not cancelled, because a flow must run to completion once
+* started (abandoning it mid-deploy could orphan a sponsored contract).
+*/
+const observeFlow = (run) => new Observable((subscriber) => {
+	let isDelivering = true;
+	run((stage) => {
+		if (isDelivering) subscriber.next({
+			type: "progress",
+			stage
+		});
+	}).then((result) => {
+		if (!isDelivering) return;
+		subscriber.next({
+			type: "done",
+			result
+		});
+		subscriber.complete();
+	}, (error) => {
+		if (isDelivering) subscriber.error(error);
+	});
+	return () => {
+		isDelivering = false;
+	};
+});
+/**
+* The context a flow runs under, drawn from the side-effect dependency
+* bag: the five seams, the record store and the relying party id. An
+* injected store is used as is; otherwise the store is built over the
+* platform storage and keyed by the authoriser, so a record sealed by one
+* authoriser is only ever written through it. The sealed-record options
+* apply to that built store; signIn and the grant flows pass
+* `onSealedWithoutKey: 'error'` so a sealed record found without a
+* storage key surfaces as record-unreadable rather than as an absent
+* account.
+*/
+const toFlowContext = ({ createKeyValueStorage, passportAuthoriser, passportEncryptionKey, passportNetwork, passportProver, passportSponsor }, onProgress, { store, rpId, ...recordOptions }) => ({
+	seams: {
+		passportAuthoriser,
+		passportEncryptionKey,
+		passportNetwork,
+		passportProver,
+		passportSponsor
+	},
+	accountRecords: toAccountRecords(store ?? createAccountRecordStore(createKeyValueStorage, passportAuthoriser.storageKey, recordOptions)),
+	onProgress,
+	rpId
+});
+/**
+* Maps the platform capabilities passed to `createPassportAccountModule`
+* onto the `passport-dependency` contract, and exposes the platform-neutral
+* flows observable-based. The flows are promise functions; wrapping them
+* here rather than in the side effects is what keeps promise handling out
+* of the side effects, so they compose the flows as plain streams and stay
+* testable on a virtual scheduler. The relying party id defaults to the
+* page's hostname, as the passkey ceremony's does.
+*/
+const createDependencies = ({ authoriser, encryptionKey, sponsor, prover, network, accountRecordStore, rpId = globalThis.location?.hostname }) => {
+	const host = {
+		store: accountRecordStore,
+		rpId
+	};
+	const recordRequired = {
+		...host,
+		onSealedWithoutKey: "error"
+	};
+	return {
+		passportAuthoriser: authoriser,
+		passportEncryptionKey: encryptionKey,
+		passportSponsor: sponsor,
+		passportProver: prover,
+		passportNetwork: network,
+		passportFlows: {
+			createAccount: (input, dependencies) => observeFlow(async (onProgress) => createAccount(input, toFlowContext(dependencies, onProgress, host))),
+			signIn: (dependencies) => observeFlow(async (onProgress) => signIn(toFlowContext(dependencies, onProgress, recordRequired))),
+			addDevice: (input, dependencies) => observeFlow(async (onProgress) => addDevice(input, toFlowContext(dependencies, onProgress, host))),
+			removeDevice: (input, dependencies) => observeFlow(async (onProgress) => removeDevice(input, toFlowContext(dependencies, onProgress, host))),
+			issueGrant: (input, dependencies) => observeFlow(async (onProgress) => issueGrant(input, toFlowContext(dependencies, onProgress, recordRequired))),
+			revokeGrant: (input, dependencies) => observeFlow(async (onProgress) => revokeGrant(input, toFlowContext(dependencies, onProgress, recordRequired))),
+			revokeAllGrants: (input, dependencies) => observeFlow(async (onProgress) => revokeAllGrants(input, toFlowContext(dependencies, onProgress, recordRequired))),
+			readShieldedHoldings: (input, dependencies) => observeFlow(async (onProgress) => readShieldedHoldings(input, toFlowContext(dependencies, onProgress, host)))
+		}
+	};
+};
+//#endregion
+//#region ../../packages/module/passport-account/src/store/side-effects/flow-actions.ts
+/**
+* The flow error a failure reports: the error's own typed code when it
+* carries one, otherwise the flow's fallback code.
+*/
+const toFlowError = (error, fallbackCode) => ({
+	code: error instanceof Object && "code" in error && typeof error.code === "string" ? error.code : fallbackCode,
+	message: error instanceof Error ? error.message : String(error)
+});
+/**
+* Maps a flow's events onto the passport flow state: each stage to
+* setFlow, the result to its publishing actions followed by
+* setFlow('ready'), and a failure to its `onFailed` actions followed by
+* a single setFlowError, so a flow always settles in 'ready' or 'error'.
+*/
+const flowActions = (events$, { actions, fallbackCode, onDone, onFailed = [] }) => events$.pipe(mergeMap((event) => event.type === "progress" ? [actions.passport.setFlow(event.stage)] : [...onDone(event.result), actions.passport.setFlow("ready")]), catchError((error) => of(...onFailed, actions.passport.setFlowError(toFlowError(error, fallbackCode)))));
+//#endregion
+//#region ../../packages/module/passport-account/src/store/side-effects/passport-flows.ts
+/** Flow error code for creation failures that carry no typed code of their own. */
+const CREATE_ACCOUNT_FALLBACK_ERROR_CODE = "account-create-failed";
+/** Flow error code for sign-in failures that carry no typed code of their own. */
+const SIGN_IN_FALLBACK_ERROR_CODE = "account-sign-in-failed";
+/** Flow error codes for device call failures that carry no typed code of their own. */
+const ADD_DEVICE_FALLBACK_ERROR_CODE = "device-add-failed";
+const REMOVE_DEVICE_FALLBACK_ERROR_CODE = "device-remove-failed";
+/** Flow error codes for grant call failures that carry no typed code of their own. */
+const ISSUE_GRANT_FALLBACK_ERROR_CODE = "grant-issue-failed";
+const REVOKE_GRANT_FALLBACK_ERROR_CODE = "grant-revoke-failed";
+const REVOKE_ALL_GRANTS_FALLBACK_ERROR_CODE = "grant-revoke-all-failed";
+/** Flow error code for holdings reads that carry no typed code of their own. */
+const READ_HOLDINGS_FALLBACK_ERROR_CODE = "holdings-read-failed";
+/**
+* Flows an account call may start from. 'error' is a settled state, not
+* an operation in progress, so a call that failed can be retried without
+* a fresh sign-in ceremony; every other non-ready flow is an operation
+* left unfinished, whose account and use counter cannot be trusted yet.
+*/
+const SETTLED_FLOWS = ["error", "ready"];
+/**
+* The actions that publish a roster a flow left behind: the devices, then
+* the counter the local row sits at. Both land ahead of 'ready', in the
+* order the flows have always published them.
+*/
+const publishDeviceRoster = (actions) => ({ devices, localUseCounter }) => [actions.passport.setDevices(devices), actions.passport.setLocalUseCounter(localUseCounter)];
+/**
+* The actions that publish what a grant call left behind: the device
+* roster and counter it advanced, the `enc_key` a rotation it ran stepped
+* the encryption key to and the devices it left without the new key, the
+* grant roster, then the read grants the
+* call could not seal the viewing secret to, empty when it sealed all,
+* and those the signer refused because their revocation is pending.
+*/
+const publishGrantRoster = (actions) => ({ grants, encKey, unsealedGrantIds, revocationPendingGrantIds, droppedDevices, ...roster }) => [
+	...publishDeviceRoster(actions)(roster),
+	...encKey === void 0 ? [] : [actions.passport.setEncKey(encKey)],
+	...droppedDevices === void 0 ? [] : [actions.passport.setDroppedDevices(droppedDevices)],
+	actions.passport.setGrants(grants),
+	actions.passport.setUnsealedGrantIds(unsealedGrantIds),
+	actions.passport.setRevocationPendingGrantIds(revocationPendingGrantIds)
+];
+/**
+* The actions that publish an issued grant: the rosters, then the id of
+* the grant, last so a consumer reacting to it finds the record in state.
+*/
+const publishIssuedGrant = (actions) => ({ grantId, ...roster }) => [...publishGrantRoster(actions)(roster), actions.passport.setLastIssuedGrantId(grantId)];
+/**
+* The actions that publish an account a flow left ready: the account,
+* its device roster and counter, the `enc_key` its encryption key is
+* at, then its grant roster.
+*/
+const publishAccountState = (actions) => ({ account, grants, encKey, ...roster }) => [
+	actions.passport.setAccount(account),
+	...publishDeviceRoster(actions)(roster),
+	actions.passport.setEncKey(encKey),
+	actions.passport.setGrants(grants)
+];
+/**
+* The actions that publish an account a sign-in recognised: the account
+* state, see {@link publishAccountState}, then the read grants whose kept
+* seal does not hold the live viewing secret, and no grants pending a
+* revocation, which only a grant call learns from the signer.
+*/
+const publishRecognisedAccount = (actions) => ({ unsealedGrantIds, ...state }) => [
+	...publishAccountState(actions)(state),
+	actions.passport.setUnsealedGrantIds(unsealedGrantIds),
+	actions.passport.setRevocationPendingGrantIds([])
+];
+/**
+* A device or grant call may rotate the account keys before it fails, so
+* the `enc_key` state holds may be the one rotated away: it is forgotten
+* until the next sign-in or rotation publishes it again, rather than let
+* a stale seal pass as current. The read grants an earlier call reported
+* unsealed or pending revocation were judged against that key, so they
+* are emptied with it.
+*/
+const forgetKeyState = (actions) => [
+	actions.passport.clearEncKey(),
+	actions.passport.setUnsealedGrantIds([]),
+	actions.passport.setRevocationPendingGrantIds([])
+];
+/**
+* The createAccount flow behind the createAccount action, as the actions it
+* publishes: each reported stage as setFlow, then the created account, its
+* one-device roster, this device's counter and its empty grant roster,
+* then 'ready'. The flow itself persists the account record before it
+* resolves, so the account is never published ahead of the record that
+* recognises it.
+*/
+const runCreateAccount = (input, dependencies) => {
+	const { actions, passportFlows } = dependencies;
+	return flowActions(passportFlows.createAccount(input, dependencies), {
+		actions,
+		fallbackCode: CREATE_ACCOUNT_FALLBACK_ERROR_CODE,
+		onDone: publishAccountState(actions)
+	});
+};
+/**
+* The signIn flow behind the signIn action, as the actions it publishes:
+* the recognised account, its whole device roster, this device's healed
+* use counter, the grant roster and its unsealed read grants, then
+* 'ready'. The flow itself persists the healed counter before it
+* resolves, so the record is never left behind the state it publishes.
+*/
+const runSignIn = (dependencies) => {
+	const { actions, passportFlows } = dependencies;
+	return flowActions(passportFlows.signIn(dependencies), {
+		actions,
+		fallbackCode: SIGN_IN_FALLBACK_ERROR_CODE,
+		onDone: publishRecognisedAccount(actions)
+	});
+};
+/**
+* The actions that publish what a device call left behind: its roster and
+* counter, then, when it rotated the account keys, the `enc_key` it
+* stepped to and the devices it left without the new key.
+*/
+const publishDeviceCall = (actions) => ({ encKey, droppedDevices, ...roster }) => [
+	...publishDeviceRoster(actions)(roster),
+	...encKey === void 0 ? [] : [actions.passport.setEncKey(encKey)],
+	...droppedDevices === void 0 ? [] : [actions.passport.setDroppedDevices(droppedDevices)]
+];
+/**
+* The addDevice flow behind its action: what the call left behind, see
+* {@link publishDeviceCall}, then 'ready'. The joining device's keys
+* travel with the request when the action names them.
+*/
+const addDeviceCall = {
+	start: ({ commitmentHex, reader }, input, dependencies) => dependencies.passportFlows.addDevice({
+		commitmentHex,
+		...reader ? { reader } : {},
+		...input
+	}, dependencies),
+	onDone: publishDeviceCall,
+	fallbackCode: ADD_DEVICE_FALLBACK_ERROR_CODE,
+	onFailed: forgetKeyState
+};
+/**
+* The removeDevice flow behind its action: what the call left behind, see
+* {@link publishDeviceCall}, then 'ready'.
+*/
+const removeDeviceCall = {
+	start: ({ commitmentHex }, input, dependencies) => dependencies.passportFlows.removeDevice({
+		commitmentHex,
+		...input
+	}, dependencies),
+	onDone: publishDeviceCall,
+	fallbackCode: REMOVE_DEVICE_FALLBACK_ERROR_CODE,
+	onFailed: forgetKeyState
+};
+/**
+* The issueGrant flow behind its action: the rosters the call left
+* behind and the issued grant's id, then 'ready'.
+*/
+const issueGrantCall = {
+	start: (scope, input, dependencies) => dependencies.passportFlows.issueGrant({
+		scope,
+		...input
+	}, dependencies),
+	onDone: publishIssuedGrant,
+	fallbackCode: ISSUE_GRANT_FALLBACK_ERROR_CODE,
+	onFailed: forgetKeyState
+};
+/** The revokeGrant flow behind its action: the rosters it left behind, then 'ready'. */
+const revokeGrantCall = {
+	start: ({ grantId }, input, dependencies) => dependencies.passportFlows.revokeGrant({
+		grantId,
+		...input
+	}, dependencies),
+	onDone: publishGrantRoster,
+	fallbackCode: REVOKE_GRANT_FALLBACK_ERROR_CODE,
+	onFailed: forgetKeyState
+};
+/** The revokeAllGrants flow behind its action: the rosters it left behind, then 'ready'. */
+const revokeAllGrantsCall = {
+	start: (_payload, input, dependencies) => dependencies.passportFlows.revokeAllGrants(input, dependencies),
+	onDone: publishGrantRoster,
+	fallbackCode: REVOKE_ALL_GRANTS_FALLBACK_ERROR_CODE,
+	onFailed: forgetKeyState
+};
+/**
+* The readShieldedHoldings flow behind its action: the holdings the walk
+* verified, then 'ready'. The skip count is the flow's to report, not the
+* store's to keep: a skipped entry is noise the inbox will carry forever.
+*/
+const readShieldedHoldingsCall = {
+	start: (_payload, input, dependencies) => dependencies.passportFlows.readShieldedHoldings(input, dependencies),
+	onDone: (actions) => ({ holdings }) => [actions.passport.setShieldedHoldings(holdings)],
+	fallbackCode: READ_HOLDINGS_FALLBACK_ERROR_CODE
+};
+/**
+* An account call behind its action, as the actions it publishes: what
+* the call left behind, then 'ready', or, when it fails, the actions
+* undoing what state may wrongly claim, then the error. The flow itself
+* persists the counter before it resolves.
+*
+* Requires an account and a settled flow: with no account in state, or
+* with an operation left unfinished, the flow is never called (so the
+* chain and the key session are never touched) and the call settles in
+* 'error' with 'no-account'. The refusal still runs behind the gate, so
+* it enters 'ceremony' first like any accepted request and clears the
+* error a previous flow left behind.
+*/
+const runAccountCall = ({ start, onDone, fallbackCode, onFailed }, { payload, flow, account, devices, localUseCounter }, dependencies) => {
+	const { actions } = dependencies;
+	if (!account || !SETTLED_FLOWS.includes(flow)) return of(actions.passport.setFlowError(toFlowError(new NoAccountError(), fallbackCode)));
+	return flowActions(start(payload, {
+		account,
+		devices,
+		localUseCounter
+	}, dependencies), {
+		actions,
+		fallbackCode,
+		onDone: onDone(actions),
+		...onFailed ? { onFailed: onFailed(actions) } : {}
+	});
+};
+/**
+* One start per dispatched account call action, each carrying the state
+* the call needs. State is sampled when the action arrives rather than
+* when the shared gate starts the call, so a call reads the account,
+* roster and counter the user acted on.
+*/
+const accountCallStarts = ({ config, trigger$, stateObservables: { passport: { selectAccount$, selectDevices$, selectFlow$, selectLocalUseCounter$ } }, dependencies }) => trigger$.pipe(withLatestFrom(selectFlow$, selectAccount$, selectDevices$, selectLocalUseCounter$), map(([{ payload }, flow, account, devices, localUseCounter]) => () => runAccountCall(config, {
+	payload,
+	flow,
+	account,
+	devices,
+	localUseCounter
+}, dependencies)));
+/**
+* Runs whichever passport flow was requested: {@link runCreateAccount}
+* behind the createAccount action, {@link runSignIn} behind signIn, and
+* {@link runAccountCall} behind addDevice, removeDevice, issueGrant,
+* revokeGrant, revokeAllGrants and readShieldedHoldings.
+*
+* Every flow owns the same account record, the same device key and the
+* same flow state, and each chain call resolves the account's use counter
+* and auth nonce, so they must never overlap: two calls resolving the same
+* counter both spend the same entry, one transaction is rejected, and the
+* loser reports its own failure over state the winner already moved on.
+* A holdings read spends no entry, but it opens the same key session and
+* reports through the same flow state, so it runs behind the same gate.
+* One exhaustMap over the merged starts, rather than one per action,
+* makes them mutually exclusive: a dispatch arriving while any flow is in
+* flight emits nothing at all, and the next one is only accepted once the
+* running flow settles. Dropping it silently is the stance exhaustMap
+* already took for a repeated dispatch of one action; a flow the user
+* never saw start is not a failure to report.
+*
+* Because only the gate knows which requests it accepted, it also owns
+* the entry into 'ceremony': the trigger reducers are pure, so a dropped
+* request cannot overwrite the running flow's state, and setFlow clears
+* the error a previous flow left behind. The emission is synchronous on
+* the accepted start, so a consumer sees the ceremony within the same
+* dispatch cycle as the trigger.
+*
+* The flow state cannot carry this guard the other way round: state
+* reaches a side effect before the action does, and an inner flow is
+* still subscribed while its own terminal setFlow('ready') is delivered,
+* so a reducer reading the flow back cannot tell a request the gate will
+* accept from one it will drop.
+*/
+const runPassportFlow = ({ passport: { addDevice$, createAccount$, issueGrant$, readShieldedHoldings$, removeDevice$, revokeAllGrants$, revokeGrant$, signIn$ } }, stateObservables, dependencies) => merge(createAccount$.pipe(map(({ payload }) => () => runCreateAccount(payload, dependencies))), signIn$.pipe(map(() => () => runSignIn(dependencies))), accountCallStarts({
+	config: addDeviceCall,
+	trigger$: addDevice$,
+	stateObservables,
+	dependencies
+}), accountCallStarts({
+	config: removeDeviceCall,
+	trigger$: removeDevice$,
+	stateObservables,
+	dependencies
+}), accountCallStarts({
+	config: issueGrantCall,
+	trigger$: issueGrant$,
+	stateObservables,
+	dependencies
+}), accountCallStarts({
+	config: revokeGrantCall,
+	trigger$: revokeGrant$,
+	stateObservables,
+	dependencies
+}), accountCallStarts({
+	config: revokeAllGrantsCall,
+	trigger$: revokeAllGrants$,
+	stateObservables,
+	dependencies
+}), accountCallStarts({
+	config: readShieldedHoldingsCall,
+	trigger$: readShieldedHoldings$,
+	stateObservables,
+	dependencies
+})).pipe(exhaustMap((start) => concat(of(dependencies.actions.passport.setFlow("ceremony")), start())));
+//#endregion
+//#region ../../packages/module/passport-account/src/store/side-effects/restore-account.ts
+/** Whether a stored record names an activated account rather than a deployment in progress. */
+const isActivatedRecord = (record) => record !== void 0 && record.deployment === void 0;
+/**
+* The grant roster of the restored account, read from chain with the
+* slots the record kept. The read needs no ceremony, but it does need
+* the indexer: a contract it does not serve, or a read it fails, leaves
+* the roster empty rather than failing the restore, and the next sign-in
+* or grant call reads it again.
+*/
+const restoreGrants = (record, { indexerUrl, indexerWsUrl }, actions) => defer(async () => createIndexerClient({
+	indexerUrl,
+	indexerWsUrl
+}).queryContractState(record.address)).pipe(filter((state) => state !== null && state !== void 0), map((state) => actions.passport.setGrants(readGrants(ledger(state.data), storedGrantSlots(record.grants)))), catchError(() => EMPTY));
+/**
+* Rehydrates the persisted account record into the store on startup, so a
+* returning user's account is recognised without a new passkey ceremony.
+* Only a record whose activation succeeded is restored, hence status
+* 'ready'; a record still carrying a pending deployment names no usable
+* account and is left for the create flow to resume, or for sign-in to
+* complete once the chain shows it activated. The device set is not
+* persisted and is rebuilt from chain by the device-management flows; the
+* grant roster is read from chain here, once the account is published,
+* so a consumer lists grants without a ceremony. A record sealed by a
+* passkey authoriser cannot be opened without a ceremony, and a ceremony
+* cannot run without a user gesture, so no storage key is passed here: a
+* sealed record reads as absent and the sign-in flow recognises the
+* account instead.
+*/
+const restorePassportAccount = (_actionObservables, _stateObservables, { actions, createKeyValueStorage, passportNetwork }) => createAccountRecordStore(createKeyValueStorage).read().pipe(filter(isActivatedRecord), mergeMap((record) => concat(of(actions.passport.setAccount({
+	address: record.address,
+	bindingVersion: record.bindingVersion,
+	status: "ready",
+	networkId: passportNetwork.networkId
+}), actions.passport.setLocalUseCounter(record.localUseCounter)), restoreGrants(record, passportNetwork, actions))));
+//#endregion
+//#region ../../packages/module/passport-account/src/store/init.ts
+/**
+* Builds the passport-account module's store initializer for the given
+* platform capabilities: the mutually exclusive passport flows behind the
+* createAccount, signIn, addDevice, removeDevice, issueGrant, revokeGrant
+* and revokeAllGrants actions, and the restore of a previously created
+* account from its persisted record.
+*/
+const createInit = (props) => () => ({
+	sideEffects: [runPassportFlow, restorePassportAccount],
+	sideEffectDependencies: createDependencies(props)
+});
+//#endregion
+export { createInit };