@laceio/sdk 0.1.1-canary.3 → 0.1.1

package/dist/create-add-accounts-Brqk84vF.js

@@ -1,102 +0,0 @@
-import { n as import_buffer, r as init__polyfill_buffer_patch } from "./_polyfill-buffer-patch-yNxN4d5E.js";
-import { t as SecretBox } from "./secret-box-DUR0ACYz.js";
-import { CustomError } from "ts-custom-error";
-//#region ../../packages/contract/network/src/resolve-blockchain-network-targets.ts
-/**
-* Returns a function that resolves an optional set of Lace
-* {@link BlockchainNetworkId} values to chain-specific representations using a
-* lookup map, with the same semantics as the in-memory wallet integrations:
-*
-* - `targets` undefined → all supported targets (the provided default list)
-* - empty set → throws
-* - non-empty set → each id must exist in the map or throws
-*/
-const createBlockchainNetworkTargetResolver = (supportedByBlockchainNetworkId, defaultForAllSupported) => (targets) => {
-	if (targets === void 0) return [...defaultForAllSupported];
-	if (targets.size === 0) throw new Error("Empty target networks");
-	return Array.from(targets, (id) => {
-		const resolved = supportedByBlockchainNetworkId.get(id);
-		if (resolved === void 0) throw new Error(`Invalid network id: ${id}`);
-		return resolved;
-	});
-};
-//#endregion
-//#region ../../packages/contract/in-memory/src/create-add-accounts.ts
-init__polyfill_buffer_patch();
-/**
-* Thrown when adding an account on a new blockchain requires deriving a
-* root key from the mnemonic, but the wallet has none (Nami-imported).
-*/
-var RecoveryPhraseUnavailableError = class extends CustomError {
-	constructor() {
-		super("Cannot derive a new blockchain root key: this wallet has no mnemonic stored");
-	}
-};
-/**
-* Creates a type-safe function to get blockchain-specific data from a wallet.
-*/
-const createGetBlockchainData = (blockchainName) => (wallet) => {
-	return wallet.blockchainSpecific[blockchainName];
-};
-/**
-* Factory function that creates a standardized `addAccounts` implementation.
-*
-* Handles both scenarios:
-* - Existing blockchain: uses wallet's blockchainSpecific data to derive the accounts
-* - New blockchain: decrypts wallet's recoveryPhrase, creates blockchain data, creates accounts
-*
-* Returns a wallet with merged accounts and blockchainSpecific data.
-*
-* @example
-* ```typescript
-* export const addAccounts = createAddAccounts({
-*   blockchainName: 'Cardano',
-*   createAccounts,
-*   createBlockchainSpecificWalletData,
-* });
-* ```
-*/
-const createAddAccounts = ({ blockchainName, createAccounts, createBlockchainSpecificWalletData }) => {
-	const getBlockchainData = createGetBlockchainData(blockchainName);
-	return async (props, dependencies) => {
-		const { wallet, accountIndex, password, accountName, targetNetworks } = props;
-		let blockchainSpecificData = getBlockchainData(wallet);
-		let newBlockchainSpecificWalletData;
-		if (!blockchainSpecificData) {
-			if (!wallet.encryptedRecoveryPhrase) throw new RecoveryPhraseUnavailableError();
-			const recoveryPhraseBytes = await SecretBox.open(import_buffer.Buffer.from(wallet.encryptedRecoveryPhrase, "hex"), password);
-			const recoveryPhraseBuffer = import_buffer.Buffer.from(recoveryPhraseBytes);
-			try {
-				const recoveryPhrase = recoveryPhraseBuffer.toString("utf8").split(" ");
-				blockchainSpecificData = await createBlockchainSpecificWalletData({
-					walletId: wallet.walletId,
-					password,
-					recoveryPhrase
-				}, dependencies);
-				newBlockchainSpecificWalletData = blockchainSpecificData;
-			} finally {
-				recoveryPhraseBytes.fill(0);
-				recoveryPhraseBuffer.fill(0);
-			}
-		}
-		const newAccounts = await createAccounts({
-			blockchainSpecific: blockchainSpecificData,
-			accountIndex,
-			walletId: wallet.walletId,
-			blockchainName,
-			password,
-			accountName,
-			targetNetworks
-		}, dependencies);
-		return { wallet: {
-			...wallet,
-			accounts: [...wallet.accounts, ...newAccounts],
-			...newBlockchainSpecificWalletData && { blockchainSpecific: {
-				...wallet.blockchainSpecific,
-				[blockchainName]: newBlockchainSpecificWalletData
-			} }
-		} };
-	};
-};
-//#endregion
-export { createBlockchainNetworkTargetResolver as n, createAddAccounts as t };

package/dist/create-add-accounts-DzXIh7Ot.cjs

@@ -1,114 +0,0 @@
-require("./rolldown-runtime-Br2OG8yv.cjs");
-const require__polyfill_buffer_patch = require("./_polyfill-buffer-patch-CM8X7JiY.cjs");
-const require_secret_box = require("./secret-box-DrjLZuS1.cjs");
-let ts_custom_error = require("ts-custom-error");
-//#region ../../packages/contract/network/src/resolve-blockchain-network-targets.ts
-/**
-* Returns a function that resolves an optional set of Lace
-* {@link BlockchainNetworkId} values to chain-specific representations using a
-* lookup map, with the same semantics as the in-memory wallet integrations:
-*
-* - `targets` undefined → all supported targets (the provided default list)
-* - empty set → throws
-* - non-empty set → each id must exist in the map or throws
-*/
-const createBlockchainNetworkTargetResolver = (supportedByBlockchainNetworkId, defaultForAllSupported) => (targets) => {
-	if (targets === void 0) return [...defaultForAllSupported];
-	if (targets.size === 0) throw new Error("Empty target networks");
-	return Array.from(targets, (id) => {
-		const resolved = supportedByBlockchainNetworkId.get(id);
-		if (resolved === void 0) throw new Error(`Invalid network id: ${id}`);
-		return resolved;
-	});
-};
-//#endregion
-//#region ../../packages/contract/in-memory/src/create-add-accounts.ts
-require__polyfill_buffer_patch.init__polyfill_buffer_patch();
-/**
-* Thrown when adding an account on a new blockchain requires deriving a
-* root key from the mnemonic, but the wallet has none (Nami-imported).
-*/
-var RecoveryPhraseUnavailableError = class extends ts_custom_error.CustomError {
-	constructor() {
-		super("Cannot derive a new blockchain root key: this wallet has no mnemonic stored");
-	}
-};
-/**
-* Creates a type-safe function to get blockchain-specific data from a wallet.
-*/
-const createGetBlockchainData = (blockchainName) => (wallet) => {
-	return wallet.blockchainSpecific[blockchainName];
-};
-/**
-* Factory function that creates a standardized `addAccounts` implementation.
-*
-* Handles both scenarios:
-* - Existing blockchain: uses wallet's blockchainSpecific data to derive the accounts
-* - New blockchain: decrypts wallet's recoveryPhrase, creates blockchain data, creates accounts
-*
-* Returns a wallet with merged accounts and blockchainSpecific data.
-*
-* @example
-* ```typescript
-* export const addAccounts = createAddAccounts({
-*   blockchainName: 'Cardano',
-*   createAccounts,
-*   createBlockchainSpecificWalletData,
-* });
-* ```
-*/
-const createAddAccounts = ({ blockchainName, createAccounts, createBlockchainSpecificWalletData }) => {
-	const getBlockchainData = createGetBlockchainData(blockchainName);
-	return async (props, dependencies) => {
-		const { wallet, accountIndex, password, accountName, targetNetworks } = props;
-		let blockchainSpecificData = getBlockchainData(wallet);
-		let newBlockchainSpecificWalletData;
-		if (!blockchainSpecificData) {
-			if (!wallet.encryptedRecoveryPhrase) throw new RecoveryPhraseUnavailableError();
-			const recoveryPhraseBytes = await require_secret_box.SecretBox.open(require__polyfill_buffer_patch.import_buffer.Buffer.from(wallet.encryptedRecoveryPhrase, "hex"), password);
-			const recoveryPhraseBuffer = require__polyfill_buffer_patch.import_buffer.Buffer.from(recoveryPhraseBytes);
-			try {
-				const recoveryPhrase = recoveryPhraseBuffer.toString("utf8").split(" ");
-				blockchainSpecificData = await createBlockchainSpecificWalletData({
-					walletId: wallet.walletId,
-					password,
-					recoveryPhrase
-				}, dependencies);
-				newBlockchainSpecificWalletData = blockchainSpecificData;
-			} finally {
-				recoveryPhraseBytes.fill(0);
-				recoveryPhraseBuffer.fill(0);
-			}
-		}
-		const newAccounts = await createAccounts({
-			blockchainSpecific: blockchainSpecificData,
-			accountIndex,
-			walletId: wallet.walletId,
-			blockchainName,
-			password,
-			accountName,
-			targetNetworks
-		}, dependencies);
-		return { wallet: {
-			...wallet,
-			accounts: [...wallet.accounts, ...newAccounts],
-			...newBlockchainSpecificWalletData && { blockchainSpecific: {
-				...wallet.blockchainSpecific,
-				[blockchainName]: newBlockchainSpecificWalletData
-			} }
-		} };
-	};
-};
-//#endregion
-Object.defineProperty(exports, "createAddAccounts", {
-	enumerable: true,
-	get: function() {
-		return createAddAccounts;
-	}
-});
-Object.defineProperty(exports, "createBlockchainNetworkTargetResolver", {
-	enumerable: true,
-	get: function() {
-		return createBlockchainNetworkTargetResolver;
-	}
-});

package/dist/device-commitment-hex.vo-5wFtQvDS.js

@@ -1,26 +0,0 @@
-//#region ../../packages/contract/passport/src/value-objects/device-commitment-hex.vo.ts
-const DEVICE_COMMITMENT_BYTE_LENGTH = 32;
-const LOWERCASE_HEX_PATTERN = /^[0-9a-f]+$/;
-/**
-* Thrown when a value is not a lowercase hex encoding of exactly
-* DEVICE_COMMITMENT_BYTE_LENGTH bytes.
-*/
-var DeviceCommitmentHexError = class extends Error {
-	code = "invalid-length";
-	constructor(message) {
-		super(message);
-		this.name = "DeviceCommitmentHexError";
-	}
-};
-/**
-* Checks that a string is 32 bytes of lowercase hex and types it as a device
-* commitment.
-*
-* @throws {@link DeviceCommitmentHexError} when it is not.
-*/
-const DeviceCommitmentHex = (value) => {
-	if (value.length !== DEVICE_COMMITMENT_BYTE_LENGTH * 2 || !LOWERCASE_HEX_PATTERN.test(value)) throw new DeviceCommitmentHexError(`DeviceCommitmentHex expects ${DEVICE_COMMITMENT_BYTE_LENGTH} bytes as lowercase hex, got "${value}"`);
-	return value;
-};
-//#endregion
-export { DeviceCommitmentHex as t };

package/dist/device-commitment-hex.vo-CT3RmAug.cjs

@@ -1,31 +0,0 @@
-//#region ../../packages/contract/passport/src/value-objects/device-commitment-hex.vo.ts
-const DEVICE_COMMITMENT_BYTE_LENGTH = 32;
-const LOWERCASE_HEX_PATTERN = /^[0-9a-f]+$/;
-/**
-* Thrown when a value is not a lowercase hex encoding of exactly
-* DEVICE_COMMITMENT_BYTE_LENGTH bytes.
-*/
-var DeviceCommitmentHexError = class extends Error {
-	code = "invalid-length";
-	constructor(message) {
-		super(message);
-		this.name = "DeviceCommitmentHexError";
-	}
-};
-/**
-* Checks that a string is 32 bytes of lowercase hex and types it as a device
-* commitment.
-*
-* @throws {@link DeviceCommitmentHexError} when it is not.
-*/
-const DeviceCommitmentHex = (value) => {
-	if (value.length !== DEVICE_COMMITMENT_BYTE_LENGTH * 2 || !LOWERCASE_HEX_PATTERN.test(value)) throw new DeviceCommitmentHexError(`DeviceCommitmentHex expects ${DEVICE_COMMITMENT_BYTE_LENGTH} bytes as lowercase hex, got "${value}"`);
-	return value;
-};
-//#endregion
-Object.defineProperty(exports, "DeviceCommitmentHex", {
-	enumerable: true,
-	get: function() {
-		return DeviceCommitmentHex;
-	}
-});

package/dist/device-readers-70i7tQqU.cjs

@@ -1,8 +0,0 @@
-require("./rolldown-runtime-Br2OG8yv.cjs");
-require("./_polyfill-buffer-patch-CM8X7JiY.cjs");
-require("./codecs-Cswkg7Tm.cjs");
-const require_device_readers = require("./device-readers-CIgYZN7f.cjs");
-exports.assertJoiningDevice = require_device_readers.assertJoiningDevice;
-exports.derivesEntry = require_device_readers.derivesEntry;
-exports.deviceEntryOf = require_device_readers.deviceEntryOf;
-exports.resolveLiveReaders = require_device_readers.resolveLiveReaders;

package/dist/device-readers-B7--ezKM.js

@@ -1,4 +0,0 @@
-import "./_polyfill-buffer-patch-yNxN4d5E.js";
-import "./codecs-Dc1Krpbt.js";
-import { i as resolveLiveReaders, n as derivesEntry, r as deviceEntryOf, t as assertJoiningDevice } from "./device-readers-BWOmz9eD.js";
-export { assertJoiningDevice, derivesEntry, deviceEntryOf, resolveLiveReaders };

package/dist/device-readers-BWOmz9eD.js

@@ -1,145 +0,0 @@
-import { n as HexBytes, t as ByteArray } from "./bytes.vo-BB7_4JK6.js";
-import { H as isSealableX25519Key } from "./grant-rules-_xJHAT2M.js";
-import { f as DeviceReaderInvalidError } from "./errors-DIJTAsLa.js";
-import { t as decodeDevicePublicKey } from "./envelopes-BkH1Qdxk.js";
-import { a as pureCircuits } from "./acc-module-Cmj8EsIb.js";
-//#region ../../packages/module/passport-account/src/acc/device-readers.ts
-/**
-* How many use counters of each registered device are tried for its live
-* entry, as far as the use-counter rescan probes a device's own counter.
-*/
-const DEVICE_ENTRY_SCAN_LIMIT = 4096n;
-/**
-* The rolling entries a compressed device key derives in a scope, with
-* the key decoded once for every counter tried, or undefined for a key
-* that is no Jubjub point.
-*/
-const entriesOf = ({ address, epoch }, devicePublicKey) => {
-	const point = decodeDevicePublicKey(devicePublicKey);
-	if (!point) return void 0;
-	const account = { bytes: ByteArray.fromHex(HexBytes(address)) };
-	return (counter) => HexBytes.fromByteArray(pureCircuits.derive_device_entry_with_jubjub(account, point, epoch, counter));
-};
-/**
-* The rolling entry a compressed device key derives at one use counter,
-* as lowercase hex, or undefined for a key that is no Jubjub point.
-*/
-const deviceEntryOf = (scope, devicePublicKey, counter) => entriesOf(scope, devicePublicKey)?.(counter);
-/**
-* Whether a compressed device key derives `entryHex` at any use counter
-* up to {@link DEVICE_ENTRY_SCAN_LIMIT}: whether it is the key of the
-* device holding that entry.
-*/
-const derivesEntry = (scope, devicePublicKey, entryHex) => {
-	const entryAt = entriesOf(scope, devicePublicKey);
-	if (!entryAt) return false;
-	for (let counter = 0n; counter < DEVICE_ENTRY_SCAN_LIMIT; counter++) if (entryAt(counter) === entryHex) return true;
-	return false;
-};
-/**
-* Holds a joining device's keys to the entry it is enrolled under: its
-* reader key must be one the account seals to, and its device key a
-* Jubjub point whose entry at use counter 0, the counter a fresh device
-* starts from, is the commitment being added, so the account keys are
-* never sealed to a reader paired with another device's key.
-*
-* @throws {@link DeviceReaderInvalidError} when the reader key is not
-* sealable, the device key is no point, or its first entry is not the
-* commitment.
-*/
-const assertJoiningDevice = (scope, reader, commitmentHex) => {
-	if (!isSealableX25519Key(reader.readerPublicKey) || deviceEntryOf(scope, reader.devicePublicKey, 0n) !== commitmentHex.toLowerCase()) throw new DeviceReaderInvalidError();
-};
-/**
-* The live entry of each device key that derives one, by key. Every key
-* is decoded once and the keys are tried in lockstep, one use counter at
-* a time from 0, so each resolves at its lowest live counter. The scan
-* ends at {@link DEVICE_ENTRY_SCAN_LIMIT} or once every `sought` entry
-* is matched: an entry derives from one device key only, so no key still
-* unresolved can derive a sought entry after that.
-*/
-const liveEntries = ({ scope, devicePublicKeys, isLive, sought }) => {
-	const found = /* @__PURE__ */ new Map();
-	const unmatched = new Set(sought);
-	let unresolved = [...devicePublicKeys].flatMap((key) => {
-		const entryAt = entriesOf(scope, key);
-		return entryAt ? [{
-			key,
-			entryAt
-		}] : [];
-	});
-	for (let counter = 0n; counter < DEVICE_ENTRY_SCAN_LIMIT && unresolved.length > 0 && unmatched.size > 0; counter++) unresolved = unresolved.filter(({ key, entryAt }) => {
-		const entryHex = entryAt(counter);
-		if (!isLive(entryHex)) return true;
-		found.set(key, {
-			counter,
-			entryHex
-		});
-		unmatched.delete(entryHex);
-		return false;
-	});
-	return found;
-};
-/** Adds `value` to the set `map` holds under `key`. */
-const addTo = (map, key, value) => {
-	map.set(key, (map.get(key) ?? /* @__PURE__ */ new Set()).add(value));
-};
-/**
-* The registered devices that are enrolled now, each with its live entry:
-* every device key is tried at use counters from 0 until it derives an
-* entry the ledger's device set holds, at most
-* {@link DEVICE_ENTRY_SCAN_LIMIT} of them, and the scan stops once every
-* allowed entry and the target are matched, so registrations it has not
-* resolved by then can derive none of them. A registration whose key
-* derives no live entry is left out, as one a device wrote before it was
-* enrolled, one of a removed device, or one planted with a key of
-* nobody's. One device's registration written twice counts once.
-* Registrations whose live entry is not allowed are set apart first, so a
-* removed device's own registrations never weigh on the rest. Among the
-* others, which one is genuine cannot be told apart when they conflict,
-* so none of a conflict is sealed to: a reader key registered for two
-* live devices is left out, and a live device claimed by two reader keys
-* keeps none of them. Every allowed entry left without a reader, that
-* way or for want of any registration, is reported dropped, so the user
-* sees every device that gets no new key and has to be enrolled again.
-*/
-const resolveLiveReaders = ({ scope, registered, isLive, allowed, target }) => {
-	const resolved = /* @__PURE__ */ new Map();
-	const outside = [];
-	const entriesOfReader = /* @__PURE__ */ new Map();
-	const readersOfEntry = /* @__PURE__ */ new Map();
-	const live = liveEntries({
-		scope,
-		devicePublicKeys: new Set(registered.map(({ devicePublicKey }) => devicePublicKey)),
-		isLive,
-		sought: target === void 0 ? allowed : new Set([...allowed, target])
-	});
-	for (const device of registered) {
-		const entry = live.get(device.devicePublicKey);
-		if (!entry) continue;
-		const candidate = {
-			reader: {
-				...device,
-				epoch: scope.epoch,
-				counter: entry.counter
-			},
-			entryHex: entry.entryHex
-		};
-		if (!allowed.has(entry.entryHex)) {
-			outside.push(candidate);
-			continue;
-		}
-		resolved.set(`${device.readerPublicKey}:${entry.entryHex}`, candidate);
-		addTo(entriesOfReader, device.readerPublicKey, entry.entryHex);
-		addTo(readersOfEntry, entry.entryHex, device.readerPublicKey);
-	}
-	const readers = [...resolved.values()].filter(({ reader, entryHex }) => (entriesOfReader.get(reader.readerPublicKey)?.size ?? 0) === 1 && (readersOfEntry.get(entryHex)?.size ?? 0) === 1);
-	const kept = new Set(readers.map(({ entryHex }) => entryHex));
-	return {
-		readers,
-		dropped: [...allowed].filter((entry) => !kept.has(entry)),
-		outside
-	};
-};
-//#endregion
-export { resolveLiveReaders as i, derivesEntry as n, deviceEntryOf as r, assertJoiningDevice as t };

package/dist/device-readers-CIgYZN7f.cjs

@@ -1,168 +0,0 @@
-const require_bytes_vo = require("./bytes.vo-BNRquqaO.cjs");
-const require_grant_rules = require("./grant-rules-7Zqi_3BN.cjs");
-const require_errors = require("./errors-BZ8hnhCM.cjs");
-const require_envelopes = require("./envelopes-ETZEJS_O.cjs");
-const require_acc_module = require("./acc-module-4iIUv6My.cjs");
-//#region ../../packages/module/passport-account/src/acc/device-readers.ts
-/**
-* How many use counters of each registered device are tried for its live
-* entry, as far as the use-counter rescan probes a device's own counter.
-*/
-const DEVICE_ENTRY_SCAN_LIMIT = 4096n;
-/**
-* The rolling entries a compressed device key derives in a scope, with
-* the key decoded once for every counter tried, or undefined for a key
-* that is no Jubjub point.
-*/
-const entriesOf = ({ address, epoch }, devicePublicKey) => {
-	const point = require_envelopes.decodeDevicePublicKey(devicePublicKey);
-	if (!point) return void 0;
-	const account = { bytes: require_bytes_vo.ByteArray.fromHex(require_bytes_vo.HexBytes(address)) };
-	return (counter) => require_bytes_vo.HexBytes.fromByteArray(require_acc_module.pureCircuits.derive_device_entry_with_jubjub(account, point, epoch, counter));
-};
-/**
-* The rolling entry a compressed device key derives at one use counter,
-* as lowercase hex, or undefined for a key that is no Jubjub point.
-*/
-const deviceEntryOf = (scope, devicePublicKey, counter) => entriesOf(scope, devicePublicKey)?.(counter);
-/**
-* Whether a compressed device key derives `entryHex` at any use counter
-* up to {@link DEVICE_ENTRY_SCAN_LIMIT}: whether it is the key of the
-* device holding that entry.
-*/
-const derivesEntry = (scope, devicePublicKey, entryHex) => {
-	const entryAt = entriesOf(scope, devicePublicKey);
-	if (!entryAt) return false;
-	for (let counter = 0n; counter < DEVICE_ENTRY_SCAN_LIMIT; counter++) if (entryAt(counter) === entryHex) return true;
-	return false;
-};
-/**
-* Holds a joining device's keys to the entry it is enrolled under: its
-* reader key must be one the account seals to, and its device key a
-* Jubjub point whose entry at use counter 0, the counter a fresh device
-* starts from, is the commitment being added, so the account keys are
-* never sealed to a reader paired with another device's key.
-*
-* @throws {@link DeviceReaderInvalidError} when the reader key is not
-* sealable, the device key is no point, or its first entry is not the
-* commitment.
-*/
-const assertJoiningDevice = (scope, reader, commitmentHex) => {
-	if (!require_grant_rules.isSealableX25519Key(reader.readerPublicKey) || deviceEntryOf(scope, reader.devicePublicKey, 0n) !== commitmentHex.toLowerCase()) throw new require_errors.DeviceReaderInvalidError();
-};
-/**
-* The live entry of each device key that derives one, by key. Every key
-* is decoded once and the keys are tried in lockstep, one use counter at
-* a time from 0, so each resolves at its lowest live counter. The scan
-* ends at {@link DEVICE_ENTRY_SCAN_LIMIT} or once every `sought` entry
-* is matched: an entry derives from one device key only, so no key still
-* unresolved can derive a sought entry after that.
-*/
-const liveEntries = ({ scope, devicePublicKeys, isLive, sought }) => {
-	const found = /* @__PURE__ */ new Map();
-	const unmatched = new Set(sought);
-	let unresolved = [...devicePublicKeys].flatMap((key) => {
-		const entryAt = entriesOf(scope, key);
-		return entryAt ? [{
-			key,
-			entryAt
-		}] : [];
-	});
-	for (let counter = 0n; counter < DEVICE_ENTRY_SCAN_LIMIT && unresolved.length > 0 && unmatched.size > 0; counter++) unresolved = unresolved.filter(({ key, entryAt }) => {
-		const entryHex = entryAt(counter);
-		if (!isLive(entryHex)) return true;
-		found.set(key, {
-			counter,
-			entryHex
-		});
-		unmatched.delete(entryHex);
-		return false;
-	});
-	return found;
-};
-/** Adds `value` to the set `map` holds under `key`. */
-const addTo = (map, key, value) => {
-	map.set(key, (map.get(key) ?? /* @__PURE__ */ new Set()).add(value));
-};
-/**
-* The registered devices that are enrolled now, each with its live entry:
-* every device key is tried at use counters from 0 until it derives an
-* entry the ledger's device set holds, at most
-* {@link DEVICE_ENTRY_SCAN_LIMIT} of them, and the scan stops once every
-* allowed entry and the target are matched, so registrations it has not
-* resolved by then can derive none of them. A registration whose key
-* derives no live entry is left out, as one a device wrote before it was
-* enrolled, one of a removed device, or one planted with a key of
-* nobody's. One device's registration written twice counts once.
-* Registrations whose live entry is not allowed are set apart first, so a
-* removed device's own registrations never weigh on the rest. Among the
-* others, which one is genuine cannot be told apart when they conflict,
-* so none of a conflict is sealed to: a reader key registered for two
-* live devices is left out, and a live device claimed by two reader keys
-* keeps none of them. Every allowed entry left without a reader, that
-* way or for want of any registration, is reported dropped, so the user
-* sees every device that gets no new key and has to be enrolled again.
-*/
-const resolveLiveReaders = ({ scope, registered, isLive, allowed, target }) => {
-	const resolved = /* @__PURE__ */ new Map();
-	const outside = [];
-	const entriesOfReader = /* @__PURE__ */ new Map();
-	const readersOfEntry = /* @__PURE__ */ new Map();
-	const live = liveEntries({
-		scope,
-		devicePublicKeys: new Set(registered.map(({ devicePublicKey }) => devicePublicKey)),
-		isLive,
-		sought: target === void 0 ? allowed : new Set([...allowed, target])
-	});
-	for (const device of registered) {
-		const entry = live.get(device.devicePublicKey);
-		if (!entry) continue;
-		const candidate = {
-			reader: {
-				...device,
-				epoch: scope.epoch,
-				counter: entry.counter
-			},
-			entryHex: entry.entryHex
-		};
-		if (!allowed.has(entry.entryHex)) {
-			outside.push(candidate);
-			continue;
-		}
-		resolved.set(`${device.readerPublicKey}:${entry.entryHex}`, candidate);
-		addTo(entriesOfReader, device.readerPublicKey, entry.entryHex);
-		addTo(readersOfEntry, entry.entryHex, device.readerPublicKey);
-	}
-	const readers = [...resolved.values()].filter(({ reader, entryHex }) => (entriesOfReader.get(reader.readerPublicKey)?.size ?? 0) === 1 && (readersOfEntry.get(entryHex)?.size ?? 0) === 1);
-	const kept = new Set(readers.map(({ entryHex }) => entryHex));
-	return {
-		readers,
-		dropped: [...allowed].filter((entry) => !kept.has(entry)),
-		outside
-	};
-};
-//#endregion
-Object.defineProperty(exports, "assertJoiningDevice", {
-	enumerable: true,
-	get: function() {
-		return assertJoiningDevice;
-	}
-});
-Object.defineProperty(exports, "derivesEntry", {
-	enumerable: true,
-	get: function() {
-		return derivesEntry;
-	}
-});
-Object.defineProperty(exports, "deviceEntryOf", {
-	enumerable: true,
-	get: function() {
-		return deviceEntryOf;
-	}
-});
-Object.defineProperty(exports, "resolveLiveReaders", {
-	enumerable: true,
-	get: function() {
-		return resolveLiveReaders;
-	}
-});