@laceio/sdk 0.1.1-canary.2 → 0.1.1

package/dist/gated-call-DjoRPqn1.js

@@ -1,695 +0,0 @@
-import { n as HexBytes, t as ByteArray } from "./bytes.vo-BB7_4JK6.js";
-import { d as DeviceEntryNotFoundError, l as CreationArtefactMismatchError, o as AuthorityNotRetiredError, s as AuthorityRetiredError, t as AccountContractMissingError } from "./errors-DIJTAsLa.js";
-import { t as GRANTEE_WITHDRAWAL_CIRCUITS } from "./grant-circuits-swuzEdUl.js";
-import { n as submitTx, r as submitWithDustRetry, t as assertSubmitted } from "./submit-D_yxYM_T.js";
-import { a as pureCircuits, i as ledger, r as expectedVk, t as Contract } from "./acc-module-Cmj8EsIb.js";
-import { n as JubjubDevice, r as authArgs } from "./signer-DGluibtn.js";
-//#region ../../packages/contract/passport/src/value-objects/use-counter.vo.ts
-/** Types a bigint as an authoriser's use counter. It checks nothing. */
-const UseCounter = (value) => value;
-//#endregion
-//#region ../../packages/contract/passport/src/value-objects/device-epoch.vo.ts
-/** Types a bigint as a device authoriser's epoch. It checks nothing. */
-const DeviceEpoch = (value) => value;
-//#endregion
-//#region ../../packages/module/passport-account/src/acc/verifier-key-insert.ts
-/**
-* The operation version the vendored contract's verifier keys belong to.
-* The compiler this module pins emits keys under the v7 header, which the
-* ledger files under operation version 'v4'; the midnight-js maintenance
-* helpers still assume 'v3' and refuse these keys before a transaction
-* exists, so the insert is built against the ledger directly.
-*/
-const VERIFIER_KEY_OPERATION_VERSION = "v4";
-/** The header every verifier key of the pinned compiler starts with. */
-const VERIFIER_KEY_HEADER = "midnight:verifier-key[v7]:";
-const headerOf = (verifierKey) => new TextDecoder().decode(verifierKey.subarray(0, 26));
-/**
-* Refuses a verifier key under any other header, naming the operation.
-* The ledger would refuse it too, but only once a transaction is being
-* built, after the key has been downloaded and a wave planned around it.
-*/
-const assertVerifierKeyHeader = (operation, verifierKey) => {
-	const header = headerOf(verifierKey);
-	if (header !== VERIFIER_KEY_HEADER) throw new Error(`The verifier key of '${operation}' is not a ${VERIFIER_KEY_HEADER} key, got '${header}'`);
-};
-/**
-* The maintenance update entry that installs one operation's verifier
-* key under the operation version the pinned compiler's keys belong to.
-*/
-const verifierKeyInsert = (ledger, operation, verifierKey) => {
-	assertVerifierKeyHeader(operation, verifierKey);
-	return new ledger.VerifierKeyInsert(operation, new ledger.ContractOperationVersionedVerifierKey(VERIFIER_KEY_OPERATION_VERSION, verifierKey));
-};
-//#endregion
-//#region ../../packages/module/passport-account/src/acc/wave-plan.ts
-/**
-* Most verifier key bytes one transaction may carry. A deploy or
-* maintenance update above it is refused by the node for exhausting the
-* block limits, so the roster is split into waves packed under this
-* figure. The budget is a packing heuristic over the measured key sizes,
-* not the node's own weight check.
-*/
-const VERIFIER_BYTE_BUDGET = 15e3;
-const sizeOf = (sizes, operation) => {
-	const size = sizes.get(operation);
-	if (size === void 0) throw new Error(`No verifier key size for operation '${operation}'`);
-	return size;
-};
-const assertBudget = (budget) => {
-	if (!Number.isFinite(budget) || budget <= 0) throw new Error(`The verifier byte budget must be a positive number, got ${budget}`);
-};
-/**
-* Packs the operations greedily, in order, into batches no larger than
-* the budget. Greedy over one fixed order keeps the plan deterministic
-* for a given roster and key set, so a retry computes the same waves.
-*/
-const packOperations = (operations, sizes, budget) => {
-	const batches = [];
-	let current = {
-		operations: [],
-		verifierBytes: 0
-	};
-	for (const operation of operations) {
-		const size = sizeOf(sizes, operation);
-		if (size > budget) throw new Error(`The verifier key of '${operation}' (${size} bytes) exceeds the ${budget} byte wave budget`);
-		if (current.verifierBytes + size > budget) {
-			batches.push(current);
-			current = {
-				operations: [],
-				verifierBytes: 0
-			};
-		}
-		current.operations.push(operation);
-		current.verifierBytes += size;
-	}
-	if (current.operations.length > 0) batches.push(current);
-	return batches;
-};
-/**
-* The maintenance waves for the given batches. Retirement rides on the
-* last of them, the last update that needs the authority; with nothing
-* left to install, a retire-only update is the whole of it.
-*/
-const toMaintenanceWaves = (batches, shouldRetire) => {
-	const waves = batches.map((batch) => ({
-		kind: "maintenance",
-		...batch,
-		retiresAuthority: false
-	}));
-	if (!shouldRetire) return waves;
-	const last = waves.at(-1);
-	if (last) last.retiresAuthority = true;
-	else waves.push({
-		kind: "maintenance",
-		operations: [],
-		verifierBytes: 0,
-		retiresAuthority: true
-	});
-	return waves;
-};
-/**
-* Plans a fresh deployment: the deploy carries the longest prefix of the
-* roster under the budget, and every later wave is one maintenance update
-* with the next batch. The order is the roster's, so the activation
-* circuit lands in the deploy and the account is usable as early as the
-* waves allow.
-*/
-const planDeployWaves = (operations, sizes, { retireAuthority, budget = VERIFIER_BYTE_BUDGET }) => {
-	assertBudget(budget);
-	const [deploy, ...rest] = packOperations(operations, sizes, budget);
-	if (!deploy) throw new Error("A deployment needs at least one operation");
-	return [{
-		kind: "deploy",
-		...deploy,
-		retiresAuthority: false
-	}, ...toMaintenanceWaves(rest, retireAuthority)];
-};
-/**
-* Plans the waves a deployed contract still needs: the roster operations
-* not yet installed, packed as maintenance updates, and the retirement
-* when the account is to be locked and its authority is still live.
-* Installed operations are read from chain rather than from any local
-* count, so a wave that landed without being recorded is never sent
-* twice.
-*
-* @throws {@link AuthorityRetiredError} when operations are missing but
-* the authority is already retired: nothing can install them any more.
-*/
-const planResumeWaves = ({ operations, sizes, installed, isAuthorityRetired, retireAuthority, budget = VERIFIER_BYTE_BUDGET }) => {
-	assertBudget(budget);
-	const installedSet = new Set(installed);
-	const missing = operations.filter((operation) => !installedSet.has(operation));
-	if (isAuthorityRetired) {
-		if (missing.length > 0) throw new AuthorityRetiredError(`The maintenance authority is retired and ${missing.length} operations are not installed: ${missing.join(", ")}`);
-		return [];
-	}
-	return toMaintenanceWaves(packOperations(missing, sizes, budget), retireAuthority);
-};
-//#endregion
-//#region ../../packages/module/passport-account/src/acc/deploy.ts
-/** Every impure circuit of the jubjub arm, activation included. */
-const JUBJUB_ARM_CIRCUITS = ["activate_initial_device", ...[
-	"withdraw_unshielded",
-	"append_inbox",
-	"withdraw_shielded",
-	"withdraw_shielded_to_contract",
-	"rotate_enc_key",
-	"add_device",
-	"remove_device"
-]].map((base) => `${base}_with_jubjub`);
-/** Permissionless deposit circuits shared by all arms. */
-const SHARED_CIRCUITS = ["deposit_unshielded", "deposit_shielded"];
-/**
-* The scoped grant circuits: the lifecycle a jubjub device authorises,
-* then the withdrawals of a jubjub grantee and of a secp256k1 grantee.
-*/
-const GRANT_CIRCUITS = [
-	...[
-		"issue_grant",
-		"revoke_grant",
-		"revoke_all_grants"
-	].map((base) => `${base}_with_jubjub`),
-	...GRANTEE_WITHDRAWAL_CIRCUITS["jubjub-schnorr"],
-	...GRANTEE_WITHDRAWAL_CIRCUITS["secp256k1-ecdsa"]
-];
-/**
-* The complete operation set this module deploys, in installation order:
-* the deposits, the jubjub device arm and the grant circuits. The device
-* arm is jubjub only: the compiled contract also carries k256 and P-256
-* device arms, their grant lifecycles and the recovery circuits, and none
-* of their verifier keys are installed, so on an account deployed here
-* only jubjub devices can ever authorise. A grant may name a jubjub or a
-* secp256k1 grantee, so the withdrawals of both grantee arms are
-* installed.
-*/
-const DEPLOYED_OPERATIONS = [
-	...SHARED_CIRCUITS,
-	...JUBJUB_ARM_CIRCUITS,
-	...GRANT_CIRCUITS
-];
-const ACTIVATE_INITIAL_DEVICE_CIRCUIT = "activate_initial_device_with_jubjub";
-const SALT_LENGTH = 32;
-const RECOVERY_WRAP_LENGTH = 64;
-const PRIVATE_STATE_ID_LENGTH$1 = 8;
-/** Three days, the veto window published with the throwaway recovery. */
-const VETO_WINDOW_SECONDS = 259200n;
-const DEPLOY_TX_TTL_MS = 6e4;
-/** How long a landed wave may take to show in the indexer's state. */
-const AUTHORITY_POLL_ATTEMPTS = 60;
-const AUTHORITY_POLL_DELAY_MS = 2e3;
-/** How long a landed deploy may take to appear in the indexer at all. */
-const INDEXED_POLL_ATTEMPTS = 30;
-const defaultSleep = async (ms) => new Promise((resolve) => {
-	setTimeout(resolve, ms);
-});
-/**
-* The contract's witness implementations over {@link AccountPrivateState}.
-* `held_coin` serves the exact qualified coin a shielded spend consumes;
-* a color the store has not captured cannot be spent by a conforming
-* client, so the witness refuses it.
-*/
-const accountWitnesses = { held_coin: (context, color) => {
-	const key = HexBytes.fromByteArray(color);
-	const stored = context.privateState.coins[key];
-	if (!stored) throw new Error(`held_coin witness: no coin for color ${key} in the local store`);
-	return [context.privateState, {
-		nonce: ByteArray.fromHex(HexBytes(stored.nonceHex)),
-		color: ByteArray.fromHex(HexBytes(stored.colorHex)),
-		value: BigInt(stored.value),
-		mt_index: BigInt(stored.mtIndex)
-	}];
-} };
-/** The private state a handle starts from: no captured coins yet. */
-const initialAccountPrivateState = () => ({ coins: {} });
-const transactionTtl = () => new Date(Date.now() + DEPLOY_TX_TTL_MS);
-const defaultRandomBytes = (length) => crypto.getRandomValues(new Uint8Array(length));
-const importChainModules = async () => Promise.all([
-	import("@midnight-ntwrk/midnight-js-contracts"),
-	import("@midnightntwrk/ledger-v9"),
-	import("@midnight-ntwrk/midnight-js-network-id"),
-	import("@midnight-ntwrk/compact-js/effect/CompiledContract")
-]);
-/**
-* Names the verifier keys this build installs: the lowercase hex sha256
-* over each roster operation's name and the sha256 pin of its verifier
-* key, in installation order. A deployment records it once the deploy
-* lands, and a resume compares it before any wave, so an account never
-* holds verifier keys of two builds.
-*/
-const deployedVerifierKeysDigest = async () => {
-	const pins = DEPLOYED_OPERATIONS.map((operation) => {
-		const pin = expectedVk[operation];
-		if (!pin) throw new Error(`No verifier key pin for '${operation}'`);
-		return `${operation}:${pin}`;
-	});
-	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(pins.join("\n")));
-	return HexBytes.fromByteArray(new Uint8Array(digest));
-};
-/**
-* The verifier key of every roster operation, downloaded through the zk
-* config provider so each one is checked against its pin and its header,
-* and the sizes the wave plan is computed from. The plan follows the
-* real keys, so a roster or key-size change re-plans itself.
-*/
-const loadVerifierKeys = async (providers, operations) => {
-	const zkConfig = providers.zkConfigProvider;
-	const keys = new Map(await Promise.all(operations.map(async (operation) => {
-		const key = await zkConfig.getVerifierKey(operation);
-		assertVerifierKeyHeader(operation, key);
-		return [operation, key];
-	})));
-	return {
-		keys,
-		sizes: new Map([...keys].map(([operation, key]) => [operation, key.length]))
-	};
-};
-const queryContractState = async ({ providers, address }) => providers.publicDataProvider.queryContractState(address);
-/** The contract state as the indexer serves it, which must exist. */
-const readProvidedState = async (chain) => {
-	const state = await queryContractState(chain);
-	if (!state) throw new AccountContractMissingError(`No live Account Custody Contract found at ${chain.address}.`);
-	return state;
-};
-/**
-* The contract state as it stands on chain, read as the ledger's class.
-* The public data provider hands back a compact-runtime state; the two
-* bridge by serialisation.
-*/
-const readContractState = async (chain) => chain.ledger.ContractState.deserialize((await readProvidedState(chain)).serialize());
-/**
-* Blocks until the indexer serves the contract the deploy created. The
-* deploy is final once its submission settles, but the indexer can lag
-* the block it landed in, and the first wave reads the authority counter
-* from it.
-*/
-const awaitContractIndexed = async (chain, sleep) => {
-	for (let attempt = 0; attempt < INDEXED_POLL_ATTEMPTS; attempt++) {
-		if (await queryContractState(chain)) return;
-		await sleep(AUTHORITY_POLL_DELAY_MS);
-	}
-	throw new AccountContractMissingError(`The Account Custody Contract deployed at ${chain.address} never appeared in the indexer.`);
-};
-/**
-* Blocks until the chain shows the counter a wave advanced the authority
-* to. The next update must be built against the advanced counter, and
-* the indexer can lag the block the wave landed in.
-*/
-const awaitAuthorityCounter = async (chain, expected, sleep) => {
-	for (let attempt = 0; attempt < AUTHORITY_POLL_ATTEMPTS; attempt++) {
-		const { maintenanceAuthority } = await readContractState(chain);
-		if (maintenanceAuthority.counter >= expected) return;
-		await sleep(AUTHORITY_POLL_DELAY_MS);
-	}
-	throw new Error(`The maintenance authority counter of ${chain.address} never reached ${expected}`);
-};
-const verifierKeyOf = (verifierKeys, operation) => {
-	const key = verifierKeys.get(operation);
-	if (!key) throw new Error(`No verifier key loaded for '${operation}'`);
-	return key;
-};
-/**
-* Submits the maintenance waves in order, each one update carrying its
-* batch of verifier key inserts, signed by the maintenance authority key.
-* The counter is read from chain before every update because each
-* applied update advances it, and a wave that retires the authority
-* installs the unsatisfiable committee at the counter its own application
-* leaves behind.
-*/
-const installWaves = async ({ providers, ledger, address, networkId, waves, verifierKeys, authorityKey, sleep }) => {
-	const chain = {
-		providers,
-		ledger,
-		address
-	};
-	for (const [index, wave] of waves.entries()) {
-		const { maintenanceAuthority } = await readContractState(chain);
-		const counter = maintenanceAuthority.counter;
-		const updates = wave.operations.map((operation) => verifierKeyInsert(ledger, operation, verifierKeyOf(verifierKeys, operation)));
-		if (wave.retiresAuthority) updates.push(new ledger.ReplaceAuthority(new ledger.ContractMaintenanceAuthority([], 1, counter + 1n)));
-		const update = new ledger.MaintenanceUpdate(address, updates, counter);
-		const signed = update.addSignature(0n, ledger.signData(authorityKey, update.dataToSign));
-		const waveTx = ledger.Transaction.fromParts(networkId.getNetworkId(), void 0, void 0, ledger.Intent.new(transactionTtl()).addMaintenanceUpdate(signed));
-		assertSubmitted(`Verifier key wave ${index + 1} of ${waves.length}`, await submitTx(providers, { unprovenTx: waveTx }));
-		await awaitAuthorityCounter(chain, counter + 1n, sleep);
-	}
-};
-/**
-* Connects to the deployed contract and returns the account with its
-* activation call. The connection checks the pinned circuits' keys on
-* chain, so it runs only once every wave is in.
-*/
-const toDeployedAccount = async ({ providers, findContract, compiledContract, address, publicKey, salt, privateStateId, isActivated }) => {
-	const found = await findContract(providers, {
-		contractAddress: address,
-		compiledContract,
-		privateStateId,
-		initialPrivateState: initialAccountPrivateState()
-	});
-	return {
-		address,
-		salt,
-		isActivated,
-		activate: async () => {
-			const finalized = await submitWithDustRetry(async () => found.callTx[ACTIVATE_INITIAL_DEVICE_CIRCUIT](publicKey, salt));
-			assertSubmitted("Account activation", finalized);
-			return finalized;
-		}
-	};
-};
-const compileAccountContract = (CompiledContract) => CompiledContract.make("account", Contract).pipe(CompiledContract.withWitnesses(accountWitnesses));
-const privateStateIdFrom = (randomBytes) => `account-${HexBytes.fromByteArray(randomBytes(PRIVATE_STATE_ID_LENGTH$1))}`;
-/**
-* The state the deploy carries: the constructor's data and maintenance
-* authority with only the first wave's operations, each one's verifier
-* key set from the downloaded, header-checked bytes. The pipeline's own
-* state is not reused as is because compact-js fills verifier keys only
-* for the circuits the zk config provider lists, the manifest-pinned
-* ones, so the deposits would land without a key.
-*/
-const toDeployedState = ({ ledger, fullState, operations, verifierKeys }) => {
-	const deployedState = new ledger.ContractState();
-	deployedState.data = fullState.data;
-	deployedState.maintenanceAuthority = fullState.maintenanceAuthority;
-	for (const name of operations) {
-		const operation = fullState.operation(name);
-		if (!operation) throw new Error(`Compiled account contract has no operation '${name}'`);
-		operation.verifierKey = verifierKeyOf(verifierKeys, name);
-		deployedState.setOperation(name, operation);
-	}
-	return deployedState;
-};
-/**
-* Deploys a fresh Account Custody Contract carrying the deposits, the
-* jubjub device arm and the grant circuits, including the secp256k1
-* grantee withdrawals, and returns its address, the boot salt, and the
-* activation call.
-*
-* The constructor cannot insert the initial device entry (the contract
-* address does not exist yet inside it), so it stores a salted boot
-* commitment over the authoriser's public key with no device entry yet;
-* `activate` presents the same key and salt to install the real entry
-* once every wave is in.
-*
-* The constructor also publishes the account's recovery material: a
-* recovery public key, the wrap its secret is sealed under, and the veto
-* window a recovery must survive. This module offers no recovery, so it
-* publishes a throwaway: a fresh jubjub key whose secret is discarded
-* here and a three day window. No secret is sealed, so the wrap is left
-* empty: all zero bytes are the unambiguous "no container" encoding,
-* whereas random bytes would be indistinguishable on chain from a sealed
-* viewing secret. Nobody holds the secret, so the account is recoverable
-* by nobody, exactly as before the contract gained the field.
-*
-* The roster's verifier keys exceed what one transaction may carry, so
-* the deployment runs in waves: the deploy carries the budgeted prefix of
-* the roster, and each later wave is one maintenance update inserting
-* the next batch, signed by the maintenance authority the deploy minted.
-* `onDeployed` is called between the deploy and the first update with
-* what a retry needs ({@link PendingDeployment}), so an interruption
-* leaves a deployment {@link resumeAccountDeployment} can finish.
-*
-* The maintenance authority's signing key is total custody: it can
-* replace any operation's verifier key and release the account's assets
-* around the device seam. `lockAccount` decides its fate, explicitly:
-*
-* - `true`: the last wave also replaces the authority with an
-*   unsatisfiable one (empty committee at threshold 1). No maintenance
-*   update can ever be signed again, so the device seam becomes the only
-*   way to move the account's assets. The cost is that the account can
-*   never receive a future arm's circuits.
-* - `false`: the deploy-time authority stays live on-chain, but this
-*   implementation discards its signing key once the account is
-*   activated; the key is held only for the duration of the flow and in
-*   the pending record a retry reads. Keeping the authority live is the
-*   caller's informed choice, accepted knowing the key amounts to full
-*   custody wherever it survives.
-*/
-const deployAccount = async ({ providers, authoriser, encPublicKey, lockAccount, onDeployed, randomBytes = defaultRandomBytes, sleep = defaultSleep }) => {
-	const [contracts, ledger, networkId, CompiledContract] = await importChainModules();
-	const publicKey = await authoriser.devicePublicKey();
-	const salt = randomBytes(SALT_LENGTH);
-	const bootCommitment = pureCircuits.derive_boot_commitment_with_jubjub(salt, publicKey);
-	const recoveryPublicKey = JubjubDevice.generate().pk;
-	const recoveryWrap = new Uint8Array(RECOVERY_WRAP_LENGTH);
-	const privateStateId = privateStateIdFrom(randomBytes);
-	const compiledContract = compileAccountContract(CompiledContract);
-	const createDeployTransaction = contracts.createUnprovenDeployTx;
-	const deployData = await createDeployTransaction(providers, {
-		compiledContract,
-		initialPrivateState: initialAccountPrivateState(),
-		args: [
-			bootCommitment,
-			encPublicKey,
-			recoveryPublicKey,
-			recoveryWrap,
-			VETO_WINDOW_SECONDS
-		]
-	});
-	const fullState = ledger.ContractState.deserialize(deployData.public.initialContractState.serialize());
-	const { keys: verifierKeys, sizes } = await loadVerifierKeys(providers, DEPLOYED_OPERATIONS);
-	const verifierKeysDigest = await deployedVerifierKeysDigest();
-	const [deployWave, ...maintenanceWaves] = planDeployWaves(DEPLOYED_OPERATIONS, sizes, { retireAuthority: lockAccount });
-	const deploy = new ledger.ContractDeploy(toDeployedState({
-		ledger,
-		fullState,
-		operations: deployWave.operations,
-		verifierKeys
-	}));
-	const address = String(deploy.address);
-	assertSubmitted("Account deploy", await submitTx(providers, { unprovenTx: ledger.Transaction.fromParts(networkId.getNetworkId(), void 0, void 0, ledger.Intent.new(transactionTtl()).addDeploy(deploy)) }));
-	const authorityKey = deployData.private.signingKey;
-	await onDeployed(address, {
-		operations: [...DEPLOYED_OPERATIONS],
-		lockAccount,
-		verifierKeysDigest,
-		saltHex: HexBytes.fromByteArray(salt),
-		authorityKey
-	});
-	await awaitContractIndexed({
-		providers,
-		ledger,
-		address
-	}, sleep);
-	await installWaves({
-		providers,
-		ledger,
-		address,
-		networkId,
-		waves: maintenanceWaves,
-		verifierKeys,
-		authorityKey,
-		sleep
-	});
-	return toDeployedAccount({
-		providers,
-		findContract: contracts.findDeployedContract,
-		compiledContract,
-		address,
-		publicKey,
-		salt,
-		privateStateId,
-		isActivated: false
-	});
-};
-/**
-* Finishes a deployment whose waves were interrupted. The operations the
-* contract already holds are read from chain, the waves still missing
-* are planned from the pending roster and submitted, and the account is
-* returned with its activation call; a deployment that only missed its
-* activation plans no wave at all. A deployment the chain shows already
-* activated, because the creation died between its activation and its
-* final record write, installs nothing and is returned as activated. The
-* lock choice is the one made when the deployment began; a locked
-* deployment the chain shows activated is checked to have retired its
-* authority, since the flow retires it before it activates. A deployment
-* recorded under other verifier key pins than this build installs is
-* refused before the chain is read.
-*
-* @throws {@link CreationArtefactMismatchError} when the recorded
-* verifier key digest is missing or is not this build's.
-* @throws {@link AuthorityNotRetiredError} when the deployment was to lock
-* the account and the chain shows it activated with the authority live.
-* @throws {@link AuthorityRetiredError} when operations are missing but
-* the authority has already been retired, which no update can mend.
-* @throws {@link AccountContractMissingError} when the address holds no
-* live contract.
-*/
-const resumeAccountDeployment = async ({ providers, authoriser, address, pending, randomBytes = defaultRandomBytes, sleep = defaultSleep }) => {
-	if (pending.verifierKeysDigest !== await deployedVerifierKeysDigest()) throw new CreationArtefactMismatchError(`The unfinished creation of the account at ${address} was started under other verifier key pins than this build installs, so it cannot be resumed.`);
-	const [contracts, ledger$1, networkId, CompiledContract] = await importChainModules();
-	const publicKey = await authoriser.devicePublicKey();
-	const chain = {
-		providers,
-		ledger: ledger$1,
-		address
-	};
-	const provided = await readProvidedState(chain);
-	const isActivated = ledger(provided.data).booted;
-	const onChain = ledger$1.ContractState.deserialize(provided.serialize());
-	const isAuthorityRetired = onChain.maintenanceAuthority.committee.length === 0;
-	if (isActivated && pending.lockAccount && !isAuthorityRetired) throw new AuthorityNotRetiredError(`The account at ${address} was created to be locked and is activated, but its maintenance authority is still live.`);
-	if (!isActivated) {
-		const { keys: verifierKeys, sizes } = await loadVerifierKeys(providers, pending.operations);
-		const waves = planResumeWaves({
-			operations: pending.operations,
-			sizes,
-			installed: onChain.operations().map(String),
-			isAuthorityRetired,
-			retireAuthority: pending.lockAccount
-		});
-		await installWaves({
-			...chain,
-			networkId,
-			waves,
-			verifierKeys,
-			authorityKey: pending.authorityKey,
-			sleep
-		});
-	}
-	return toDeployedAccount({
-		providers,
-		findContract: contracts.findDeployedContract,
-		compiledContract: compileAccountContract(CompiledContract),
-		address,
-		publicKey,
-		salt: ByteArray.fromHex(HexBytes(pending.saltHex)),
-		privateStateId: privateStateIdFrom(randomBytes),
-		isActivated
-	});
-};
-//#endregion
-//#region ../../packages/module/passport-account/src/acc/use-counter.ts
-/** How far past the last known counter the rescan probes. */
-const RESCAN_LIMIT = 4096n;
-/**
-* Candidates batched per deviceCommitments call. 64 keeps a typical rescan
-* (small counter drift) at one ceremony while it caps a full-window miss at
-* 64 ceremonies instead of 4096, and the per-chunk membership check stops
-* the scan before the remaining commitments are ever computed.
-*/
-const RESCAN_CHUNK = 64n;
-const isLiveEntry = (ledgerState, commitmentHex) => ledgerState.devices.member(ByteArray.fromHex(HexBytes(commitmentHex)));
-const probeInBatches = async (deviceCommitments, { ledgerState, address, epoch, from, to }) => {
-	for (let chunkStart = from; chunkStart < to; chunkStart += RESCAN_CHUNK) {
-		const counters = [];
-		const chunkEnd = chunkStart + RESCAN_CHUNK < to ? chunkStart + RESCAN_CHUNK : to;
-		for (let candidate = chunkStart; candidate < chunkEnd; candidate++) counters.push(UseCounter(candidate));
-		const commitments = await deviceCommitments(address, epoch, counters);
-		for (const [index, useCounter] of counters.entries()) {
-			const commitmentHex = commitments[index];
-			if (isLiveEntry(ledgerState, commitmentHex)) return {
-				useCounter,
-				commitmentHex
-			};
-		}
-	}
-};
-const probeOneByOne = async ({ ledgerState, authoriser, address, epoch, from, to }) => {
-	for (let candidate = from; candidate < to; candidate++) {
-		const useCounter = UseCounter(candidate);
-		const commitmentHex = await authoriser.deviceCommitment(address, epoch, useCounter);
-		if (isLiveEntry(ledgerState, commitmentHex)) return {
-			useCounter,
-			commitmentHex
-		};
-	}
-};
-const probeWindow = async (props) => {
-	const { deviceCommitments } = props.authoriser;
-	return deviceCommitments ? probeInBatches(deviceCommitments, props) : probeOneByOne(props);
-};
-/**
-* Recovers the device's current use counter from chain. The Account
-* Custody Contract stores one rolling entry per device, positioned at the
-* counter of its next authorisation, so the local counter can fall behind
-* after out-of-band calls or lost state. Candidate counters are probed
-* from the last known value (0 when unknown): the commitment computed for
-* each candidate is tested for membership in the on-chain device set, and
-* the first live entry wins. That window ends after RESCAN_LIMIT
-* candidates, and only then are the counters below the anchor probed,
-* from 0 up to it: a device removed and re-enrolled gets a fresh entry at
-* a low counter while the persisted anchor still holds the old high one,
-* and without the second pass such a device reads as revoked. A device
-* with no entry in either pass is not registered on the account, has been
-* revoked, or holds a counter beyond the probed window (a synced passkey
-* used heavily on another device can outrun RESCAN_LIMIT between
-* sign-ins here); the miss raises DeviceEntryNotFoundError, which names
-* that ambiguity. An authoriser exposing deviceCommitments is probed in
-* RESCAN_CHUNK batches so one key ceremony covers a whole chunk of
-* candidates; otherwise each candidate costs one deviceCommitment call.
-*/
-const resolveUseCounter = async ({ ledgerState, authoriser, address, knownUseCounter }) => {
-	const epoch = DeviceEpoch(ledgerState.device_epoch);
-	const anchor = knownUseCounter ?? 0n;
-	const probe = async (from, to) => probeWindow({
-		ledgerState,
-		authoriser,
-		address,
-		epoch,
-		from,
-		to
-	});
-	const ahead = await probe(anchor, anchor + RESCAN_LIMIT);
-	if (ahead) return ahead;
-	const behind = await probe(0n, anchor);
-	if (behind) return behind;
-	throw new DeviceEntryNotFoundError(`No live device entry on the ledger within ${RESCAN_LIMIT} counters of the last known one (${anchor}), nor below it; the device is not registered on this account, or its counter has moved beyond the probed window.`);
-};
-//#endregion
-//#region ../../packages/module/passport-account/src/acc/gated-call.ts
-const PRIVATE_STATE_ID_LENGTH = 8;
-/**
-* Connects to a deployed Account Custody Contract and returns the handle
-* gated calls run through. The private state starts without the account
-* encryption secret: the device-management and grant lifecycle circuits
-* consume no witnesses, so no coin or encryption key material is needed.
-* Shielded flows will seed the viewing secret when they arrive.
-*/
-const connectAccountHandle = async (providers, contractAddress) => {
-	const [contracts, CompiledContract] = await Promise.all([import("@midnight-ntwrk/midnight-js-contracts"), import("@midnight-ntwrk/compact-js/effect/CompiledContract")]);
-	const compiledContract = CompiledContract.make("account", Contract).pipe(CompiledContract.withWitnesses(accountWitnesses));
-	const findContract = contracts.findDeployedContract;
-	return findContract(providers, {
-		contractAddress,
-		compiledContract,
-		privateStateId: `account-${HexBytes.fromByteArray(crypto.getRandomValues(new Uint8Array(PRIVATE_STATE_ID_LENGTH)))}`,
-		initialPrivateState: initialAccountPrivateState()
-	});
-};
-/**
-* Executes one authorised circuit call against a deployed Account Custody
-* Contract: resolves the device's current use counter from the ledger,
-* has the authoriser sign the call over the observed auth nonce, submits
-* the circuit with the authorising material appended as its trailing
-* arguments (pk, use counter, announcement, closing scalar, grind nonce),
-* and returns the counter the device holds after the accepted call: the
-* consumed one plus one.
-*
-* A transaction that lands with a failing status rejects instead of
-* returning: the contract applied nothing, so no counter may advance and
-* no roster change may be recorded for it.
-*/
-const executeGatedCall = async ({ handle, authoriser, circuit, args, address, ledgerState, knownUseCounter }) => {
-	const call = handle.callTx[circuit];
-	if (!call) throw new Error(`Account contract handle has no circuit '${circuit}'`);
-	const { useCounter } = await resolveUseCounter({
-		ledgerState,
-		authoriser,
-		address,
-		knownUseCounter
-	});
-	const authorisation = await authoriser.authorise({
-		account: address,
-		circuit,
-		args,
-		witnessValues: [],
-		authNonce: ledgerState.auth_nonce,
-		useCounter
-	});
-	const finalized = await submitWithDustRetry(async () => call(...args, ...authArgs(authorisation)));
-	assertSubmitted(`Call to ${circuit}`, finalized);
-	return UseCounter(useCounter + 1n);
-};
-//#endregion
-export { resumeAccountDeployment as a, deployAccount as i, executeGatedCall as n, DeviceEpoch as o, resolveUseCounter as r, UseCounter as s, connectAccountHandle as t };