@laceio/sdk 0.1.1 → 0.1.2-canary.0

package/dist/create-add-accounts-Brqk84vF.js

@@ -0,0 +1,102 @@
+import { n as import_buffer, r as init__polyfill_buffer_patch } from "./_polyfill-buffer-patch-yNxN4d5E.js";
+import { t as SecretBox } from "./secret-box-DUR0ACYz.js";
+import { CustomError } from "ts-custom-error";
+//#region ../../packages/contract/network/src/resolve-blockchain-network-targets.ts
+/**
+* Returns a function that resolves an optional set of Lace
+* {@link BlockchainNetworkId} values to chain-specific representations using a
+* lookup map, with the same semantics as the in-memory wallet integrations:
+*
+* - `targets` undefined → all supported targets (the provided default list)
+* - empty set → throws
+* - non-empty set → each id must exist in the map or throws
+*/
+const createBlockchainNetworkTargetResolver = (supportedByBlockchainNetworkId, defaultForAllSupported) => (targets) => {
+	if (targets === void 0) return [...defaultForAllSupported];
+	if (targets.size === 0) throw new Error("Empty target networks");
+	return Array.from(targets, (id) => {
+		const resolved = supportedByBlockchainNetworkId.get(id);
+		if (resolved === void 0) throw new Error(`Invalid network id: ${id}`);
+		return resolved;
+	});
+};
+//#endregion
+//#region ../../packages/contract/in-memory/src/create-add-accounts.ts
+init__polyfill_buffer_patch();
+/**
+* Thrown when adding an account on a new blockchain requires deriving a
+* root key from the mnemonic, but the wallet has none (Nami-imported).
+*/
+var RecoveryPhraseUnavailableError = class extends CustomError {
+	constructor() {
+		super("Cannot derive a new blockchain root key: this wallet has no mnemonic stored");
+	}
+};
+/**
+* Creates a type-safe function to get blockchain-specific data from a wallet.
+*/
+const createGetBlockchainData = (blockchainName) => (wallet) => {
+	return wallet.blockchainSpecific[blockchainName];
+};
+/**
+* Factory function that creates a standardized `addAccounts` implementation.
+*
+* Handles both scenarios:
+* - Existing blockchain: uses wallet's blockchainSpecific data to derive the accounts
+* - New blockchain: decrypts wallet's recoveryPhrase, creates blockchain data, creates accounts
+*
+* Returns a wallet with merged accounts and blockchainSpecific data.
+*
+* @example
+* ```typescript
+* export const addAccounts = createAddAccounts({
+*   blockchainName: 'Cardano',
+*   createAccounts,
+*   createBlockchainSpecificWalletData,
+* });
+* ```
+*/
+const createAddAccounts = ({ blockchainName, createAccounts, createBlockchainSpecificWalletData }) => {
+	const getBlockchainData = createGetBlockchainData(blockchainName);
+	return async (props, dependencies) => {
+		const { wallet, accountIndex, password, accountName, targetNetworks } = props;
+		let blockchainSpecificData = getBlockchainData(wallet);
+		let newBlockchainSpecificWalletData;
+		if (!blockchainSpecificData) {
+			if (!wallet.encryptedRecoveryPhrase) throw new RecoveryPhraseUnavailableError();
+			const recoveryPhraseBytes = await SecretBox.open(import_buffer.Buffer.from(wallet.encryptedRecoveryPhrase, "hex"), password);
+			const recoveryPhraseBuffer = import_buffer.Buffer.from(recoveryPhraseBytes);
+			try {
+				const recoveryPhrase = recoveryPhraseBuffer.toString("utf8").split(" ");
+				blockchainSpecificData = await createBlockchainSpecificWalletData({
+					walletId: wallet.walletId,
+					password,
+					recoveryPhrase
+				}, dependencies);
+				newBlockchainSpecificWalletData = blockchainSpecificData;
+			} finally {
+				recoveryPhraseBytes.fill(0);
+				recoveryPhraseBuffer.fill(0);
+			}
+		}
+		const newAccounts = await createAccounts({
+			blockchainSpecific: blockchainSpecificData,
+			accountIndex,
+			walletId: wallet.walletId,
+			blockchainName,
+			password,
+			accountName,
+			targetNetworks
+		}, dependencies);
+		return { wallet: {
+			...wallet,
+			accounts: [...wallet.accounts, ...newAccounts],
+			...newBlockchainSpecificWalletData && { blockchainSpecific: {
+				...wallet.blockchainSpecific,
+				[blockchainName]: newBlockchainSpecificWalletData
+			} }
+		} };
+	};
+};
+//#endregion
+export { createBlockchainNetworkTargetResolver as n, createAddAccounts as t };

package/dist/create-add-accounts-DzXIh7Ot.cjs

@@ -0,0 +1,114 @@
+require("./rolldown-runtime-Br2OG8yv.cjs");
+const require__polyfill_buffer_patch = require("./_polyfill-buffer-patch-CM8X7JiY.cjs");
+const require_secret_box = require("./secret-box-DrjLZuS1.cjs");
+let ts_custom_error = require("ts-custom-error");
+//#region ../../packages/contract/network/src/resolve-blockchain-network-targets.ts
+/**
+* Returns a function that resolves an optional set of Lace
+* {@link BlockchainNetworkId} values to chain-specific representations using a
+* lookup map, with the same semantics as the in-memory wallet integrations:
+*
+* - `targets` undefined → all supported targets (the provided default list)
+* - empty set → throws
+* - non-empty set → each id must exist in the map or throws
+*/
+const createBlockchainNetworkTargetResolver = (supportedByBlockchainNetworkId, defaultForAllSupported) => (targets) => {
+	if (targets === void 0) return [...defaultForAllSupported];
+	if (targets.size === 0) throw new Error("Empty target networks");
+	return Array.from(targets, (id) => {
+		const resolved = supportedByBlockchainNetworkId.get(id);
+		if (resolved === void 0) throw new Error(`Invalid network id: ${id}`);
+		return resolved;
+	});
+};
+//#endregion
+//#region ../../packages/contract/in-memory/src/create-add-accounts.ts
+require__polyfill_buffer_patch.init__polyfill_buffer_patch();
+/**
+* Thrown when adding an account on a new blockchain requires deriving a
+* root key from the mnemonic, but the wallet has none (Nami-imported).
+*/
+var RecoveryPhraseUnavailableError = class extends ts_custom_error.CustomError {
+	constructor() {
+		super("Cannot derive a new blockchain root key: this wallet has no mnemonic stored");
+	}
+};
+/**
+* Creates a type-safe function to get blockchain-specific data from a wallet.
+*/
+const createGetBlockchainData = (blockchainName) => (wallet) => {
+	return wallet.blockchainSpecific[blockchainName];
+};
+/**
+* Factory function that creates a standardized `addAccounts` implementation.
+*
+* Handles both scenarios:
+* - Existing blockchain: uses wallet's blockchainSpecific data to derive the accounts
+* - New blockchain: decrypts wallet's recoveryPhrase, creates blockchain data, creates accounts
+*
+* Returns a wallet with merged accounts and blockchainSpecific data.
+*
+* @example
+* ```typescript
+* export const addAccounts = createAddAccounts({
+*   blockchainName: 'Cardano',
+*   createAccounts,
+*   createBlockchainSpecificWalletData,
+* });
+* ```
+*/
+const createAddAccounts = ({ blockchainName, createAccounts, createBlockchainSpecificWalletData }) => {
+	const getBlockchainData = createGetBlockchainData(blockchainName);
+	return async (props, dependencies) => {
+		const { wallet, accountIndex, password, accountName, targetNetworks } = props;
+		let blockchainSpecificData = getBlockchainData(wallet);
+		let newBlockchainSpecificWalletData;
+		if (!blockchainSpecificData) {
+			if (!wallet.encryptedRecoveryPhrase) throw new RecoveryPhraseUnavailableError();
+			const recoveryPhraseBytes = await require_secret_box.SecretBox.open(require__polyfill_buffer_patch.import_buffer.Buffer.from(wallet.encryptedRecoveryPhrase, "hex"), password);
+			const recoveryPhraseBuffer = require__polyfill_buffer_patch.import_buffer.Buffer.from(recoveryPhraseBytes);
+			try {
+				const recoveryPhrase = recoveryPhraseBuffer.toString("utf8").split(" ");
+				blockchainSpecificData = await createBlockchainSpecificWalletData({
+					walletId: wallet.walletId,
+					password,
+					recoveryPhrase
+				}, dependencies);
+				newBlockchainSpecificWalletData = blockchainSpecificData;
+			} finally {
+				recoveryPhraseBytes.fill(0);
+				recoveryPhraseBuffer.fill(0);
+			}
+		}
+		const newAccounts = await createAccounts({
+			blockchainSpecific: blockchainSpecificData,
+			accountIndex,
+			walletId: wallet.walletId,
+			blockchainName,
+			password,
+			accountName,
+			targetNetworks
+		}, dependencies);
+		return { wallet: {
+			...wallet,
+			accounts: [...wallet.accounts, ...newAccounts],
+			...newBlockchainSpecificWalletData && { blockchainSpecific: {
+				...wallet.blockchainSpecific,
+				[blockchainName]: newBlockchainSpecificWalletData
+			} }
+		} };
+	};
+};
+//#endregion
+Object.defineProperty(exports, "createAddAccounts", {
+	enumerable: true,
+	get: function() {
+		return createAddAccounts;
+	}
+});
+Object.defineProperty(exports, "createBlockchainNetworkTargetResolver", {
+	enumerable: true,
+	get: function() {
+		return createBlockchainNetworkTargetResolver;
+	}
+});

package/dist/{delegation-tx-builder-CRpLP6jH.cjs → delegation-tx-builder-CCjiakoy.cjs}

@@ -1,9 +1,9 @@
 require("./rolldown-runtime-Br2OG8yv.cjs");
-const require_util = require("./util-CGzqQ8IV.cjs");
-const require_bignum_vo = require("./bignum.vo-DsG3kNiZ.cjs");
-const require_const = require("./const-BDEg2Trq.cjs");
-const require_TransactionBuilder = require("./TransactionBuilder-DrB3NVTi.cjs");
-const require_account_guards_stable = require("./account-guards.stable-B1DSSh9D.cjs");
+const require_util = require("./util-Bu4W5lF4.cjs");
+const require_bignum_vo = require("./bignum.vo-hx2kuqlA.cjs");
+const require_const = require("./const-D-eZIS4n.cjs");
+const require_TransactionBuilder = require("./TransactionBuilder-CCjOn7NA.cjs");
+const require_account_guards = require("./account-guards-BtjTGxDZ.cjs");
 let _laceio_cardano_core = require("@laceio/cardano/core");
 let rxjs = require("rxjs");
 let rxjs_operators = require("rxjs/operators");
@@ -44,7 +44,7 @@ const makeBuildDelegationTx = (dependencies) => (params) => (0, rxjs.defer)(asyn
 		success: false,
 		error: /* @__PURE__ */ new Error("Protocol parameters not available")
 	};
-	require_account_guards_stable.refuseExtensionAccount(accountId, cardanoAddresses);
+	require_account_guards.refuseExtensionAccount(accountId, cardanoAddresses);
 	const availableUtxo = require_util.filterSpendableUtxos(allAccountUtxos[accountId] ?? [], unspendableAccountUtxos[accountId] ?? []);
 	const accountAddresses = cardanoAddresses.filter((addr) => addr.accountId === accountId && addr.blockchainName === "Cardano");
 	if (!accountAddresses[0]) return {

package/dist/{delegation-tx-builder-CGVqlaFE.js → delegation-tx-builder-DZFjHDS8.js}

@@ -1,8 +1,8 @@
-import { n as filterSpendableUtxos } from "./util-BaLzwa32.js";
-import { t as BigNumber } from "./bignum.vo-B0rK_PQ1.js";
-import { r as LOVELACE_TOKEN_ID } from "./const-C84qHkjp.js";
-import { t as TransactionBuilder } from "./TransactionBuilder-V6aLx4SV.js";
-import { t as refuseExtensionAccount } from "./account-guards.stable-JRQ5qx2V.js";
+import { n as filterSpendableUtxos } from "./util-Cp5cZkfK.js";
+import { t as BigNumber } from "./bignum.vo-CEXOIew0.js";
+import { r as LOVELACE_TOKEN_ID } from "./const-BJfIK_G-.js";
+import { n as TransactionBuilder } from "./TransactionBuilder-CIzdw18M.js";
+import { t as refuseExtensionAccount } from "./account-guards-D9Lu5T3W.js";
 import { Cardano } from "@laceio/cardano/core";
 import { defer, firstValueFrom, of } from "rxjs";
 import { catchError as catchError$1 } from "rxjs/operators";

package/dist/{deregistration-tx-builder-B-CrUyX6.js → deregistration-tx-builder-Bf6xAYp4.js}

@@ -1,8 +1,8 @@
-import { n as filterSpendableUtxos } from "./util-BaLzwa32.js";
-import { t as BigNumber } from "./bignum.vo-B0rK_PQ1.js";
-import { r as LOVELACE_TOKEN_ID } from "./const-C84qHkjp.js";
-import { t as TransactionBuilder } from "./TransactionBuilder-V6aLx4SV.js";
-import { t as refuseExtensionAccount } from "./account-guards.stable-JRQ5qx2V.js";
+import { n as filterSpendableUtxos } from "./util-Cp5cZkfK.js";
+import { t as BigNumber } from "./bignum.vo-CEXOIew0.js";
+import { r as LOVELACE_TOKEN_ID } from "./const-BJfIK_G-.js";
+import { n as TransactionBuilder } from "./TransactionBuilder-CIzdw18M.js";
+import { t as refuseExtensionAccount } from "./account-guards-D9Lu5T3W.js";
 import { Cardano } from "@laceio/cardano/core";
 import { defer, firstValueFrom, of } from "rxjs";
 import { catchError as catchError$1 } from "rxjs/operators";

package/dist/{deregistration-tx-builder-DZGwB4cz.cjs → deregistration-tx-builder-CQP35yex.cjs}

@@ -1,9 +1,9 @@
 require("./rolldown-runtime-Br2OG8yv.cjs");
-const require_util = require("./util-CGzqQ8IV.cjs");
-const require_bignum_vo = require("./bignum.vo-DsG3kNiZ.cjs");
-const require_const = require("./const-BDEg2Trq.cjs");
-const require_TransactionBuilder = require("./TransactionBuilder-DrB3NVTi.cjs");
-const require_account_guards_stable = require("./account-guards.stable-B1DSSh9D.cjs");
+const require_util = require("./util-Bu4W5lF4.cjs");
+const require_bignum_vo = require("./bignum.vo-hx2kuqlA.cjs");
+const require_const = require("./const-D-eZIS4n.cjs");
+const require_TransactionBuilder = require("./TransactionBuilder-CCjOn7NA.cjs");
+const require_account_guards = require("./account-guards-BtjTGxDZ.cjs");
 let _laceio_cardano_core = require("@laceio/cardano/core");
 let rxjs = require("rxjs");
 let rxjs_operators = require("rxjs/operators");
@@ -59,7 +59,7 @@ const makeBuildDeregistrationTx = (dependencies) => (params) => (0, rxjs.defer)(
 		success: false,
 		error: /* @__PURE__ */ new Error("Protocol parameters not available")
 	};
-	require_account_guards_stable.refuseExtensionAccount(accountId, cardanoAddresses);
+	require_account_guards.refuseExtensionAccount(accountId, cardanoAddresses);
 	const availableUtxo = require_util.filterSpendableUtxos(allAccountUtxos[accountId] ?? [], unspendableAccountUtxos[accountId] ?? []);
 	const accountAddresses = cardanoAddresses.filter((addr) => addr.accountId === accountId && addr.blockchainName === "Cardano");
 	if (!accountAddresses[0]) return {

package/dist/device-commitment-hex.vo-5wFtQvDS.js

@@ -0,0 +1,26 @@
+//#region ../../packages/contract/passport/src/value-objects/device-commitment-hex.vo.ts
+const DEVICE_COMMITMENT_BYTE_LENGTH = 32;
+const LOWERCASE_HEX_PATTERN = /^[0-9a-f]+$/;
+/**
+* Thrown when a value is not a lowercase hex encoding of exactly
+* DEVICE_COMMITMENT_BYTE_LENGTH bytes.
+*/
+var DeviceCommitmentHexError = class extends Error {
+	code = "invalid-length";
+	constructor(message) {
+		super(message);
+		this.name = "DeviceCommitmentHexError";
+	}
+};
+/**
+* Checks that a string is 32 bytes of lowercase hex and types it as a device
+* commitment.
+*
+* @throws {@link DeviceCommitmentHexError} when it is not.
+*/
+const DeviceCommitmentHex = (value) => {
+	if (value.length !== DEVICE_COMMITMENT_BYTE_LENGTH * 2 || !LOWERCASE_HEX_PATTERN.test(value)) throw new DeviceCommitmentHexError(`DeviceCommitmentHex expects ${DEVICE_COMMITMENT_BYTE_LENGTH} bytes as lowercase hex, got "${value}"`);
+	return value;
+};
+//#endregion
+export { DeviceCommitmentHex as t };

package/dist/device-commitment-hex.vo-CT3RmAug.cjs

@@ -0,0 +1,31 @@
+//#region ../../packages/contract/passport/src/value-objects/device-commitment-hex.vo.ts
+const DEVICE_COMMITMENT_BYTE_LENGTH = 32;
+const LOWERCASE_HEX_PATTERN = /^[0-9a-f]+$/;
+/**
+* Thrown when a value is not a lowercase hex encoding of exactly
+* DEVICE_COMMITMENT_BYTE_LENGTH bytes.
+*/
+var DeviceCommitmentHexError = class extends Error {
+	code = "invalid-length";
+	constructor(message) {
+		super(message);
+		this.name = "DeviceCommitmentHexError";
+	}
+};
+/**
+* Checks that a string is 32 bytes of lowercase hex and types it as a device
+* commitment.
+*
+* @throws {@link DeviceCommitmentHexError} when it is not.
+*/
+const DeviceCommitmentHex = (value) => {
+	if (value.length !== DEVICE_COMMITMENT_BYTE_LENGTH * 2 || !LOWERCASE_HEX_PATTERN.test(value)) throw new DeviceCommitmentHexError(`DeviceCommitmentHex expects ${DEVICE_COMMITMENT_BYTE_LENGTH} bytes as lowercase hex, got "${value}"`);
+	return value;
+};
+//#endregion
+Object.defineProperty(exports, "DeviceCommitmentHex", {
+	enumerable: true,
+	get: function() {
+		return DeviceCommitmentHex;
+	}
+});

package/dist/device-readers-CUHYoYOH.js

@@ -0,0 +1,145 @@
+import { n as HexBytes, t as ByteArray } from "./bytes.vo-BB7_4JK6.js";
+import { f as DeviceReaderInvalidError } from "./errors-DSq5wUwt.js";
+import { H as isSealableX25519Key } from "./grant-rules-By07_eDi.js";
+import { t as decodeDevicePublicKey } from "./envelopes-BGoO_v8m.js";
+import { a as pureCircuits } from "./acc-module-Cmj8EsIb.js";
+//#region ../../packages/module/passport-account/src/acc/device-readers.ts
+/**
+* How many use counters of each registered device are tried for its live
+* entry, as far as the use-counter rescan probes a device's own counter.
+*/
+const DEVICE_ENTRY_SCAN_LIMIT = 4096n;
+/**
+* The rolling entries a compressed device key derives in a scope, with
+* the key decoded once for every counter tried, or undefined for a key
+* that is no Jubjub point.
+*/
+const entriesOf = ({ address, epoch }, devicePublicKey) => {
+	const point = decodeDevicePublicKey(devicePublicKey);
+	if (!point) return void 0;
+	const account = { bytes: ByteArray.fromHex(HexBytes(address)) };
+	return (counter) => HexBytes.fromByteArray(pureCircuits.derive_device_entry_with_jubjub(account, point, epoch, counter));
+};
+/**
+* The rolling entry a compressed device key derives at one use counter,
+* as lowercase hex, or undefined for a key that is no Jubjub point.
+*/
+const deviceEntryOf = (scope, devicePublicKey, counter) => entriesOf(scope, devicePublicKey)?.(counter);
+/**
+* Whether a compressed device key derives `entryHex` at any use counter
+* up to {@link DEVICE_ENTRY_SCAN_LIMIT}: whether it is the key of the
+* device holding that entry.
+*/
+const derivesEntry = (scope, devicePublicKey, entryHex) => {
+	const entryAt = entriesOf(scope, devicePublicKey);
+	if (!entryAt) return false;
+	for (let counter = 0n; counter < DEVICE_ENTRY_SCAN_LIMIT; counter++) if (entryAt(counter) === entryHex) return true;
+	return false;
+};
+/**
+* Holds a joining device's keys to the entry it is enrolled under: its
+* reader key must be one the account seals to, and its device key a
+* Jubjub point whose entry at use counter 0, the counter a fresh device
+* starts from, is the commitment being added, so the account keys are
+* never sealed to a reader paired with another device's key.
+*
+* @throws {@link DeviceReaderInvalidError} when the reader key is not
+* sealable, the device key is no point, or its first entry is not the
+* commitment.
+*/
+const assertJoiningDevice = (scope, reader, commitmentHex) => {
+	if (!isSealableX25519Key(reader.readerPublicKey) || deviceEntryOf(scope, reader.devicePublicKey, 0n) !== commitmentHex.toLowerCase()) throw new DeviceReaderInvalidError();
+};
+/**
+* The live entry of each device key that derives one, by key. Every key
+* is decoded once and the keys are tried in lockstep, one use counter at
+* a time from 0, so each resolves at its lowest live counter. The scan
+* ends at {@link DEVICE_ENTRY_SCAN_LIMIT} or once every `sought` entry
+* is matched: an entry derives from one device key only, so no key still
+* unresolved can derive a sought entry after that.
+*/
+const liveEntries = ({ scope, devicePublicKeys, isLive, sought }) => {
+	const found = /* @__PURE__ */ new Map();
+	const unmatched = new Set(sought);
+	let unresolved = [...devicePublicKeys].flatMap((key) => {
+		const entryAt = entriesOf(scope, key);
+		return entryAt ? [{
+			key,
+			entryAt
+		}] : [];
+	});
+	for (let counter = 0n; counter < DEVICE_ENTRY_SCAN_LIMIT && unresolved.length > 0 && unmatched.size > 0; counter++) unresolved = unresolved.filter(({ key, entryAt }) => {
+		const entryHex = entryAt(counter);
+		if (!isLive(entryHex)) return true;
+		found.set(key, {
+			counter,
+			entryHex
+		});
+		unmatched.delete(entryHex);
+		return false;
+	});
+	return found;
+};
+/** Adds `value` to the set `map` holds under `key`. */
+const addTo = (map, key, value) => {
+	map.set(key, (map.get(key) ?? /* @__PURE__ */ new Set()).add(value));
+};
+/**
+* The registered devices that are enrolled now, each with its live entry:
+* every device key is tried at use counters from 0 until it derives an
+* entry the ledger's device set holds, at most
+* {@link DEVICE_ENTRY_SCAN_LIMIT} of them, and the scan stops once every
+* allowed entry and the target are matched, so registrations it has not
+* resolved by then can derive none of them. A registration whose key
+* derives no live entry is left out, as one a device wrote before it was
+* enrolled, one of a removed device, or one planted with a key of
+* nobody's. One device's registration written twice counts once.
+* Registrations whose live entry is not allowed are set apart first, so a
+* removed device's own registrations never weigh on the rest. Among the
+* others, which one is genuine cannot be told apart when they conflict,
+* so none of a conflict is sealed to: a reader key registered for two
+* live devices is left out, and a live device claimed by two reader keys
+* keeps none of them. Every allowed entry left without a reader, that
+* way or for want of any registration, is reported dropped, so the user
+* sees every device that gets no new key and has to be enrolled again.
+*/
+const resolveLiveReaders = ({ scope, registered, isLive, allowed, target }) => {
+	const resolved = /* @__PURE__ */ new Map();
+	const outside = [];
+	const entriesOfReader = /* @__PURE__ */ new Map();
+	const readersOfEntry = /* @__PURE__ */ new Map();
+	const live = liveEntries({
+		scope,
+		devicePublicKeys: new Set(registered.map(({ devicePublicKey }) => devicePublicKey)),
+		isLive,
+		sought: target === void 0 ? allowed : new Set([...allowed, target])
+	});
+	for (const device of registered) {
+		const entry = live.get(device.devicePublicKey);
+		if (!entry) continue;
+		const candidate = {
+			reader: {
+				...device,
+				epoch: scope.epoch,
+				counter: entry.counter
+			},
+			entryHex: entry.entryHex
+		};
+		if (!allowed.has(entry.entryHex)) {
+			outside.push(candidate);
+			continue;
+		}
+		resolved.set(`${device.readerPublicKey}:${entry.entryHex}`, candidate);
+		addTo(entriesOfReader, device.readerPublicKey, entry.entryHex);
+		addTo(readersOfEntry, entry.entryHex, device.readerPublicKey);
+	}
+	const readers = [...resolved.values()].filter(({ reader, entryHex }) => (entriesOfReader.get(reader.readerPublicKey)?.size ?? 0) === 1 && (readersOfEntry.get(entryHex)?.size ?? 0) === 1);
+	const kept = new Set(readers.map(({ entryHex }) => entryHex));
+	return {
+		readers,
+		dropped: [...allowed].filter((entry) => !kept.has(entry)),
+		outside
+	};
+};
+//#endregion
+export { resolveLiveReaders as i, derivesEntry as n, deviceEntryOf as r, assertJoiningDevice as t };

package/dist/device-readers-CdxS2btd.cjs

@@ -0,0 +1,168 @@
+const require_bytes_vo = require("./bytes.vo-BNRquqaO.cjs");
+const require_errors = require("./errors-BIftM8ZN.cjs");
+const require_grant_rules = require("./grant-rules-BzVTWXS7.cjs");
+const require_envelopes = require("./envelopes-CH25R-DN.cjs");
+const require_acc_module = require("./acc-module-4iIUv6My.cjs");
+//#region ../../packages/module/passport-account/src/acc/device-readers.ts
+/**
+* How many use counters of each registered device are tried for its live
+* entry, as far as the use-counter rescan probes a device's own counter.
+*/
+const DEVICE_ENTRY_SCAN_LIMIT = 4096n;
+/**
+* The rolling entries a compressed device key derives in a scope, with
+* the key decoded once for every counter tried, or undefined for a key
+* that is no Jubjub point.
+*/
+const entriesOf = ({ address, epoch }, devicePublicKey) => {
+	const point = require_envelopes.decodeDevicePublicKey(devicePublicKey);
+	if (!point) return void 0;
+	const account = { bytes: require_bytes_vo.ByteArray.fromHex(require_bytes_vo.HexBytes(address)) };
+	return (counter) => require_bytes_vo.HexBytes.fromByteArray(require_acc_module.pureCircuits.derive_device_entry_with_jubjub(account, point, epoch, counter));
+};
+/**
+* The rolling entry a compressed device key derives at one use counter,
+* as lowercase hex, or undefined for a key that is no Jubjub point.
+*/
+const deviceEntryOf = (scope, devicePublicKey, counter) => entriesOf(scope, devicePublicKey)?.(counter);
+/**
+* Whether a compressed device key derives `entryHex` at any use counter
+* up to {@link DEVICE_ENTRY_SCAN_LIMIT}: whether it is the key of the
+* device holding that entry.
+*/
+const derivesEntry = (scope, devicePublicKey, entryHex) => {
+	const entryAt = entriesOf(scope, devicePublicKey);
+	if (!entryAt) return false;
+	for (let counter = 0n; counter < DEVICE_ENTRY_SCAN_LIMIT; counter++) if (entryAt(counter) === entryHex) return true;
+	return false;
+};
+/**
+* Holds a joining device's keys to the entry it is enrolled under: its
+* reader key must be one the account seals to, and its device key a
+* Jubjub point whose entry at use counter 0, the counter a fresh device
+* starts from, is the commitment being added, so the account keys are
+* never sealed to a reader paired with another device's key.
+*
+* @throws {@link DeviceReaderInvalidError} when the reader key is not
+* sealable, the device key is no point, or its first entry is not the
+* commitment.
+*/
+const assertJoiningDevice = (scope, reader, commitmentHex) => {
+	if (!require_grant_rules.isSealableX25519Key(reader.readerPublicKey) || deviceEntryOf(scope, reader.devicePublicKey, 0n) !== commitmentHex.toLowerCase()) throw new require_errors.DeviceReaderInvalidError();
+};
+/**
+* The live entry of each device key that derives one, by key. Every key
+* is decoded once and the keys are tried in lockstep, one use counter at
+* a time from 0, so each resolves at its lowest live counter. The scan
+* ends at {@link DEVICE_ENTRY_SCAN_LIMIT} or once every `sought` entry
+* is matched: an entry derives from one device key only, so no key still
+* unresolved can derive a sought entry after that.
+*/
+const liveEntries = ({ scope, devicePublicKeys, isLive, sought }) => {
+	const found = /* @__PURE__ */ new Map();
+	const unmatched = new Set(sought);
+	let unresolved = [...devicePublicKeys].flatMap((key) => {
+		const entryAt = entriesOf(scope, key);
+		return entryAt ? [{
+			key,
+			entryAt
+		}] : [];
+	});
+	for (let counter = 0n; counter < DEVICE_ENTRY_SCAN_LIMIT && unresolved.length > 0 && unmatched.size > 0; counter++) unresolved = unresolved.filter(({ key, entryAt }) => {
+		const entryHex = entryAt(counter);
+		if (!isLive(entryHex)) return true;
+		found.set(key, {
+			counter,
+			entryHex
+		});
+		unmatched.delete(entryHex);
+		return false;
+	});
+	return found;
+};
+/** Adds `value` to the set `map` holds under `key`. */
+const addTo = (map, key, value) => {
+	map.set(key, (map.get(key) ?? /* @__PURE__ */ new Set()).add(value));
+};
+/**
+* The registered devices that are enrolled now, each with its live entry:
+* every device key is tried at use counters from 0 until it derives an
+* entry the ledger's device set holds, at most
+* {@link DEVICE_ENTRY_SCAN_LIMIT} of them, and the scan stops once every
+* allowed entry and the target are matched, so registrations it has not
+* resolved by then can derive none of them. A registration whose key
+* derives no live entry is left out, as one a device wrote before it was
+* enrolled, one of a removed device, or one planted with a key of
+* nobody's. One device's registration written twice counts once.
+* Registrations whose live entry is not allowed are set apart first, so a
+* removed device's own registrations never weigh on the rest. Among the
+* others, which one is genuine cannot be told apart when they conflict,
+* so none of a conflict is sealed to: a reader key registered for two
+* live devices is left out, and a live device claimed by two reader keys
+* keeps none of them. Every allowed entry left without a reader, that
+* way or for want of any registration, is reported dropped, so the user
+* sees every device that gets no new key and has to be enrolled again.
+*/
+const resolveLiveReaders = ({ scope, registered, isLive, allowed, target }) => {
+	const resolved = /* @__PURE__ */ new Map();
+	const outside = [];
+	const entriesOfReader = /* @__PURE__ */ new Map();
+	const readersOfEntry = /* @__PURE__ */ new Map();
+	const live = liveEntries({
+		scope,
+		devicePublicKeys: new Set(registered.map(({ devicePublicKey }) => devicePublicKey)),
+		isLive,
+		sought: target === void 0 ? allowed : new Set([...allowed, target])
+	});
+	for (const device of registered) {
+		const entry = live.get(device.devicePublicKey);
+		if (!entry) continue;
+		const candidate = {
+			reader: {
+				...device,
+				epoch: scope.epoch,
+				counter: entry.counter
+			},
+			entryHex: entry.entryHex
+		};
+		if (!allowed.has(entry.entryHex)) {
+			outside.push(candidate);
+			continue;
+		}
+		resolved.set(`${device.readerPublicKey}:${entry.entryHex}`, candidate);
+		addTo(entriesOfReader, device.readerPublicKey, entry.entryHex);
+		addTo(readersOfEntry, entry.entryHex, device.readerPublicKey);
+	}
+	const readers = [...resolved.values()].filter(({ reader, entryHex }) => (entriesOfReader.get(reader.readerPublicKey)?.size ?? 0) === 1 && (readersOfEntry.get(entryHex)?.size ?? 0) === 1);
+	const kept = new Set(readers.map(({ entryHex }) => entryHex));
+	return {
+		readers,
+		dropped: [...allowed].filter((entry) => !kept.has(entry)),
+		outside
+	};
+};
+//#endregion
+Object.defineProperty(exports, "assertJoiningDevice", {
+	enumerable: true,
+	get: function() {
+		return assertJoiningDevice;
+	}
+});
+Object.defineProperty(exports, "derivesEntry", {
+	enumerable: true,
+	get: function() {
+		return derivesEntry;
+	}
+});
+Object.defineProperty(exports, "deviceEntryOf", {
+	enumerable: true,
+	get: function() {
+		return deviceEntryOf;
+	}
+});
+Object.defineProperty(exports, "resolveLiveReaders", {
+	enumerable: true,
+	get: function() {
+		return resolveLiveReaders;
+	}
+});