@seams/wallet-server 0.5.0

package/dist/esm/shared-ts/src/utils/registrationIntent.js

@@ -0,0 +1,1268 @@
+import { parseEmailOtpProviderUserId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "./domainIds.js";
+import { base64UrlEncode } from "./base64.js";
+import { parseDigestB64u } from "./canonicalPrimitives.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "./digests.js";
+import "./encoders.js";
+import { parseNamedNearAccountId } from "./near.js";
+//#region ../shared-ts/src/utils/registrationIntent.ts
+async function computeWalletAuthMethodRevokeOperationFingerprintV1(input) {
+	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		version: "wallet_auth_method_revoke_operation_v1",
+		walletId: String(input.walletId),
+		targetWalletAuthMethodId: String(input.targetWalletAuthMethodId),
+		requestedAtMs: input.requestedAtMs
+	}))));
+}
+function sameWalletAuthMethodRecordV2(left, right) {
+	if (left.version !== right.version || left.walletAuthMethodId !== right.walletAuthMethodId || left.walletId !== right.walletId || left.walletAuthorityId !== right.walletAuthorityId || left.status !== right.status || left.createdAtMs !== right.createdAtMs || left.updatedAtMs !== right.updatedAtMs) return false;
+	switch (left.kind) {
+		case "passkey":
+			if (right.kind !== "passkey") return false;
+			if (left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u && left.credentialPublicKeyB64u === right.credentialPublicKeyB64u && left.counter === right.counter) break;
+			return false;
+		case "email_otp":
+			if (right.kind !== "email_otp") return false;
+			if (left.emailHashHex === right.emailHashHex && left.registrationAuthorityId === right.registrationAuthorityId) break;
+			return false;
+		default: return assertNeverWalletAuthMethodRecordV2(left, "wallet auth method kind");
+	}
+	switch (left.status) {
+		case "pending_local_install": return right.status === "pending_local_install";
+		case "active": return right.status === "active" && left.activatedAtMs === right.activatedAtMs;
+		case "revoked": return right.status === "revoked" && left.activatedAtMs === right.activatedAtMs && left.revokedAtMs === right.revokedAtMs;
+		default: return assertNeverWalletAuthMethodRecordV2(left, "wallet auth method lifecycle");
+	}
+}
+function assertNeverWalletAuthMethodRecordV2(value, label) {
+	throw new Error(`${label} branch is unsupported: ${String(value)}`);
+}
+function buildWalletAuthMethodRecordV2(input) {
+	validateWalletAuthMethodRecordV2(input);
+	if (input.kind === "passkey") switch (input.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "passkey",
+			status: "pending_local_install",
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "passkey",
+			status: "active",
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "passkey",
+			status: "revoked",
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs,
+			revokedAtMs: input.revokedAtMs
+		};
+	}
+	switch (input.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "email_otp",
+			status: "pending_local_install",
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "email_otp",
+			status: "active",
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "email_otp",
+			status: "revoked",
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs,
+			revokedAtMs: input.revokedAtMs
+		};
+	}
+}
+function parseWalletAuthMethodRecordV2(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("version" in record) || !("kind" in record) || !("status" in record)) return null;
+	const version = trimString(record.version);
+	const kind = trimString(record.kind);
+	const status = trimString(record.status);
+	if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp") return null;
+	try {
+		const common = parseWalletAuthMethodRecordV2Common(record);
+		if (kind === "passkey") {
+			if (!("rpId" in record) || !("credentialIdB64u" in record) || !("credentialPublicKeyB64u" in record) || !("counter" in record)) return null;
+			exactWalletAuthMethodV2Fields(record, "passkey", status);
+			const rpId = parseWebAuthnRpId(record.rpId);
+			const credentialIdB64u = parseWebAuthnCredentialIdB64u(record.credentialIdB64u);
+			if (!rpId.ok || !credentialIdB64u.ok || typeof record.credentialPublicKeyB64u !== "string" || !record.credentialPublicKeyB64u.trim() || Object.prototype.hasOwnProperty.call(record, "emailHashHex") || Object.prototype.hasOwnProperty.call(record, "registrationAuthorityId")) return null;
+			return buildParsedPasskeyWalletAuthMethodRecordV2({
+				common,
+				lifecycle: parseWalletAuthMethodLifecycle(record),
+				rpId: rpId.value,
+				credentialIdB64u: credentialIdB64u.value,
+				credentialPublicKeyB64u: record.credentialPublicKeyB64u,
+				counter: parseNonNegativeInteger(record.counter)
+			});
+		}
+		if (!("emailHashHex" in record) || !("registrationAuthorityId" in record)) return null;
+		exactWalletAuthMethodV2Fields(record, "email_otp", status);
+		const emailHashHex = trimString(record.emailHashHex);
+		const registrationAuthorityId = trimString(record.registrationAuthorityId);
+		if (!emailHashHex || !registrationAuthorityId || Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "credentialIdB64u") || Object.prototype.hasOwnProperty.call(record, "credentialPublicKeyB64u") || Object.prototype.hasOwnProperty.call(record, "counter")) return null;
+		return buildParsedEmailOtpWalletAuthMethodRecordV2({
+			common,
+			lifecycle: parseWalletAuthMethodLifecycle(record),
+			emailHashHex,
+			registrationAuthorityId
+		});
+	} catch {
+		return null;
+	}
+}
+function parseWalletAuthMethodRecordV2Common(raw) {
+	if (!("walletAuthMethodId" in raw) || !("walletId" in raw) || !("walletAuthorityId" in raw) || !("createdAtMs" in raw) || !("updatedAtMs" in raw)) throw new Error("wallet auth method common fields are required");
+	return {
+		version: "wallet_auth_method_v2",
+		walletAuthMethodId: parseWalletAuthMethodIdRequired(raw.walletAuthMethodId),
+		walletId: parseWalletIdRequired(raw.walletId),
+		walletAuthorityId: parseWalletAuthorityIdRequired(raw.walletAuthorityId),
+		createdAtMs: parseNonNegativeInteger(raw.createdAtMs),
+		updatedAtMs: parseNonNegativeInteger(raw.updatedAtMs)
+	};
+}
+function validateWalletAuthMethodRecordV2(value) {
+	if (value.version !== "wallet_auth_method_v2") throw new Error("wallet auth method record version is unsupported");
+	if (!value.walletAuthMethodId || !value.walletId || !value.walletAuthorityId) throw new Error("wallet auth method record identities are required");
+	if (!Number.isSafeInteger(value.createdAtMs) || value.createdAtMs < 0) throw new Error("wallet auth method createdAtMs must be a non-negative safe integer");
+	if (!Number.isSafeInteger(value.updatedAtMs) || value.updatedAtMs < value.createdAtMs) throw new Error("wallet auth method updatedAtMs must follow createdAtMs");
+	if (value.kind === "passkey") {
+		if (!value.rpId || !value.credentialIdB64u || !value.credentialPublicKeyB64u.trim()) throw new Error("passkey wallet auth method fields are required");
+		if (!Number.isSafeInteger(value.counter) || value.counter < 0) throw new Error("passkey authenticator counter must be non-negative");
+	} else if (!value.emailHashHex.trim() || !value.registrationAuthorityId.trim()) throw new Error("email OTP wallet auth method fields are required");
+	switch (value.status) {
+		case "pending_local_install": return;
+		case "active":
+			validateNonNegativeInteger(value.activatedAtMs, "activatedAtMs");
+			return;
+		case "revoked":
+			validateNonNegativeInteger(value.activatedAtMs, "activatedAtMs");
+			validateNonNegativeInteger(value.revokedAtMs, "revokedAtMs");
+			if (value.revokedAtMs < value.activatedAtMs) throw new Error("revokedAtMs cannot precede activatedAtMs");
+			return;
+	}
+}
+function parseWalletAuthMethodLifecycle(raw) {
+	if (!("status" in raw)) throw new Error("wallet auth method status is required");
+	switch (raw.status) {
+		case "pending_local_install": return { status: "pending_local_install" };
+		case "active":
+			if (!("activatedAtMs" in raw)) throw new Error("wallet auth method activatedAtMs is required");
+			return {
+				status: "active",
+				activatedAtMs: parseNonNegativeInteger(raw.activatedAtMs)
+			};
+		case "revoked":
+			if (!("activatedAtMs" in raw) || !("revokedAtMs" in raw)) throw new Error("wallet auth method revocation timestamps are required");
+			return {
+				status: "revoked",
+				activatedAtMs: parseNonNegativeInteger(raw.activatedAtMs),
+				revokedAtMs: parseNonNegativeInteger(raw.revokedAtMs)
+			};
+		default: throw new Error("wallet auth method status is unsupported");
+	}
+}
+function exactWalletAuthMethodV2Fields(raw, kind, status) {
+	const fields = [
+		"version",
+		"walletAuthMethodId",
+		"walletId",
+		"walletAuthorityId",
+		"kind",
+		"status",
+		"createdAtMs",
+		"updatedAtMs"
+	];
+	if (kind === "passkey") fields.push("rpId", "credentialIdB64u", "credentialPublicKeyB64u", "counter");
+	else fields.push("emailHashHex", "registrationAuthorityId");
+	if (status === "active") fields.push("activatedAtMs");
+	if (status === "revoked") fields.push("activatedAtMs", "revokedAtMs");
+	if (status !== "pending_local_install" && status !== "active" && status !== "revoked") throw new Error("wallet auth method status is unsupported");
+	const expected = new Set(fields);
+	const actual = Object.keys(raw);
+	if (actual.length !== fields.length) throw new Error("wallet auth method record has invalid fields");
+	for (const field of actual) if (!expected.has(field)) throw new Error(`wallet auth method field ${field} is invalid`);
+}
+function buildParsedPasskeyWalletAuthMethodRecordV2(input) {
+	switch (input.lifecycle.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "passkey",
+			status: "pending_local_install",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "passkey",
+			status: "active",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			activatedAtMs: input.lifecycle.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "passkey",
+			status: "revoked",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			activatedAtMs: input.lifecycle.activatedAtMs,
+			revokedAtMs: input.lifecycle.revokedAtMs
+		};
+	}
+}
+function buildParsedEmailOtpWalletAuthMethodRecordV2(input) {
+	switch (input.lifecycle.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "email_otp",
+			status: "pending_local_install",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "email_otp",
+			status: "active",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			activatedAtMs: input.lifecycle.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "email_otp",
+			status: "revoked",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			activatedAtMs: input.lifecycle.activatedAtMs,
+			revokedAtMs: input.lifecycle.revokedAtMs
+		};
+	}
+}
+function parseWalletAuthMethodIdRequired(raw) {
+	const parsed = parseWalletAuthMethodId(raw);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseWalletIdRequired(raw) {
+	const parsed = parseWalletId(raw);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseWalletAuthorityIdRequired(raw) {
+	const parsed = parseWalletAuthorityId(raw);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseNonNegativeInteger(raw) {
+	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw new Error("value must be a non-negative safe integer");
+	return raw;
+}
+function validateNonNegativeInteger(raw, label) {
+	if (!Number.isSafeInteger(raw) || raw < 0) throw new Error(`${label} must be a non-negative safe integer`);
+}
+function walletAuthMethodRecordId(record) {
+	const parsed = parseWalletAuthMethodId(record.kind === "passkey" ? `passkey:${record.rpId}:${record.credentialIdB64u}` : `email_otp:${record.walletId}:${record.emailHashHex}`);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function walletIdFromString(value) {
+	const parsed = parseWalletId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+const SERVER_ALLOCATED_WALLET_ADJECTIVES = [
+	"alpine",
+	"amber",
+	"azure",
+	"brisk",
+	"bright",
+	"calm",
+	"cedar",
+	"cobalt",
+	"copper",
+	"coral",
+	"crimson",
+	"crystal",
+	"dawn",
+	"deep",
+	"dusky",
+	"evergreen",
+	"fair",
+	"fern",
+	"frost",
+	"gentle",
+	"glacier",
+	"glowing",
+	"golden",
+	"harbor",
+	"humble",
+	"indigo",
+	"ivory",
+	"jade",
+	"keen",
+	"lunar",
+	"maple",
+	"misty",
+	"mossy",
+	"noble",
+	"ocean",
+	"opal",
+	"polar",
+	"quiet",
+	"rapid",
+	"redwood",
+	"river",
+	"royal",
+	"sage",
+	"scarlet",
+	"serene",
+	"silver",
+	"solar",
+	"steady",
+	"stone",
+	"swift",
+	"tranquil",
+	"twilight",
+	"umber",
+	"verdant",
+	"vibrant",
+	"violet",
+	"vivid",
+	"warm",
+	"wild",
+	"willow",
+	"winter",
+	"woodland",
+	"young",
+	"zephyr"
+];
+const SERVER_ALLOCATED_WALLET_NOUNS = [
+	"anchor",
+	"arbor",
+	"atlas",
+	"aurora",
+	"badger",
+	"beacon",
+	"bloom",
+	"brook",
+	"canyon",
+	"cascade",
+	"comet",
+	"cove",
+	"crane",
+	"delta",
+	"dune",
+	"eagle",
+	"ember",
+	"falcon",
+	"feather",
+	"fjord",
+	"forest",
+	"galaxy",
+	"garden",
+	"giant",
+	"grove",
+	"harvest",
+	"heron",
+	"horizon",
+	"island",
+	"lagoon",
+	"lantern",
+	"lark",
+	"meadow",
+	"meteor",
+	"monolith",
+	"nebula",
+	"oasis",
+	"orchid",
+	"otter",
+	"peak",
+	"pebble",
+	"phoenix",
+	"pine",
+	"prism",
+	"quartz",
+	"raven",
+	"reef",
+	"ridge",
+	"sable",
+	"sequoia",
+	"shore",
+	"solstice",
+	"sparrow",
+	"star",
+	"summit",
+	"tempo",
+	"thunder",
+	"tundra",
+	"valley",
+	"vermillion",
+	"voyage",
+	"wave",
+	"wren",
+	"zenith"
+];
+const SERVER_ALLOCATED_WALLET_SUFFIX_ALPHABET = "23456789abcdefghjkmnpqrstuvwxyz";
+const SERVER_ALLOCATED_WALLET_ID_PATTERN = /^([a-z]+)-([a-z]+)-([a-z0-9]{6})$/;
+const SERVER_ALLOCATED_WALLET_ADJECTIVE_SET = new Set(SERVER_ALLOCATED_WALLET_ADJECTIVES);
+const SERVER_ALLOCATED_WALLET_NOUN_SET = new Set(SERVER_ALLOCATED_WALLET_NOUNS);
+function createServerAllocatedWalletId() {
+	return requireServerAllocatedWalletId([
+		randomServerAllocatedWalletWord(SERVER_ALLOCATED_WALLET_ADJECTIVES),
+		randomServerAllocatedWalletWord(SERVER_ALLOCATED_WALLET_NOUNS),
+		randomServerAllocatedWalletSuffix(6)
+	].join("-"));
+}
+function parseServerAllocatedWalletId(raw) {
+	const parsed = parseWalletId(raw);
+	if (!parsed.ok) return parsed;
+	const value = String(parsed.value);
+	const match = SERVER_ALLOCATED_WALLET_ID_PATTERN.exec(value);
+	const adjective = match?.[1] || "";
+	const noun = match?.[2] || "";
+	const suffix = match?.[3] || "";
+	if (!match || !SERVER_ALLOCATED_WALLET_ADJECTIVE_SET.has(adjective) || !SERVER_ALLOCATED_WALLET_NOUN_SET.has(noun) || !serverAllocatedWalletSuffixIsValid(suffix)) return {
+		ok: false,
+		error: {
+			code: "invalid",
+			message: "server-allocated walletId must match the approved readable word-word-suffix allocation format"
+		}
+	};
+	return {
+		ok: true,
+		value: parsed.value
+	};
+}
+function requireServerAllocatedWalletId(value) {
+	const parsed = parseServerAllocatedWalletId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function serverAllocatedRandomIndex(maxExclusive) {
+	if (!Number.isSafeInteger(maxExclusive) || maxExclusive <= 0 || maxExclusive > 256) throw new Error("Invalid server-allocated wallet random bound");
+	const limit = 256 - 256 % maxExclusive;
+	const byte = new Uint8Array(1);
+	for (;;) {
+		crypto.getRandomValues(byte);
+		if (byte[0] < limit) return byte[0] % maxExclusive;
+	}
+}
+function randomServerAllocatedWalletWord(words) {
+	return words[serverAllocatedRandomIndex(words.length)];
+}
+function randomServerAllocatedWalletSuffix(length) {
+	let suffix = "";
+	for (let index = 0; index < length; index += 1) suffix += SERVER_ALLOCATED_WALLET_SUFFIX_ALPHABET[serverAllocatedRandomIndex(31)];
+	return suffix;
+}
+function serverAllocatedWalletSuffixIsValid(suffix) {
+	if (suffix.length !== 6) return false;
+	for (const character of suffix) if (!SERVER_ALLOCATED_WALLET_SUFFIX_ALPHABET.includes(character)) return false;
+	return true;
+}
+function nearEd25519SigningKeyIdFromString(value) {
+	const normalized = String(value || "").trim();
+	if (!normalized) throw new Error("nearEd25519SigningKeyId is required");
+	return normalized;
+}
+function parseNearEd25519SigningKeyId(value) {
+	if (typeof value !== "string") throw new Error("nearEd25519SigningKeyId must be a string");
+	return nearEd25519SigningKeyIdFromString(value);
+}
+function nearEd25519SigningKeyIdFromWalletId(walletId) {
+	return nearEd25519SigningKeyIdFromString(String(walletId));
+}
+async function computeGeneratedImplicitNearEd25519SigningKeyId(input) {
+	return nearEd25519SigningKeyIdFromString(`ed25519ks_${base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		kind: input.kind,
+		walletId: String(input.walletId),
+		authorityScope: input.authorityScope,
+		signingRootId: input.signingRootId,
+		signingRootVersion: input.signingRootVersion,
+		signerSlot: input.signerSlot,
+		participantIds: [...input.participantIds],
+		keyPurpose: input.keyPurpose,
+		keyVersion: input.keyVersion,
+		derivationVersion: input.derivationVersion
+	})))}`);
+}
+async function computeAddSignerNearEd25519SigningKeyId(input) {
+	return nearEd25519SigningKeyIdFromString(`ed25519ks_${base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+		kind: input.kind,
+		walletId: String(input.walletId),
+		signingRootId: input.signingRootId,
+		signingRootVersion: input.signingRootVersion,
+		signerSlot: input.signerSlot,
+		participantIds: [...input.participantIds],
+		keyPurpose: input.keyPurpose,
+		keyVersion: input.keyVersion,
+		derivationVersion: input.derivationVersion
+	})))}`);
+}
+function emailOtpProviderUserIdFromRegistrationAuthority(authority) {
+	const parsed = parseEmailOtpProviderUserId(authority.providerSubject);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function registrationEd25519AuthorityScopeFromAuthority(authority) {
+	switch (authority.kind) {
+		case "passkey": return {
+			kind: "passkey",
+			rpId: authority.rpId
+		};
+		case "email_otp": return {
+			kind: "email_otp",
+			provider: authority.proofKind === "google_sso_registration" ? "google" : "email",
+			providerUserId: emailOtpProviderUserIdFromRegistrationAuthority(authority)
+		};
+		default: return authority;
+	}
+}
+async function computeRegistrationNearEd25519SigningKeyId(input) {
+	switch (input.ed25519.accountProvisioning.kind) {
+		case "implicit_account": return await computeGeneratedImplicitNearEd25519SigningKeyId({
+			kind: "generated_implicit_near_ed25519_signing_key_v1",
+			walletId: requireServerAllocatedWalletId(input.walletId),
+			authorityScope: input.authorityScope,
+			signingRootId: input.signingRootId,
+			signingRootVersion: input.signingRootVersion,
+			signerSlot: input.ed25519.signerSlot,
+			participantIds: input.ed25519.participantIds,
+			keyPurpose: input.ed25519.keyPurpose,
+			keyVersion: input.ed25519.keyVersion,
+			derivationVersion: input.ed25519.derivationVersion
+		});
+		case "sponsored_named_account": return nearEd25519SigningKeyIdFromWalletId(input.walletId);
+		default: return input.ed25519.accountProvisioning;
+	}
+}
+function registrationIntentGrantFromString(value) {
+	return String(value || "").trim();
+}
+function addAuthMethodIntentGrantFromString(value) {
+	return String(value || "").trim();
+}
+function addSignerIntentGrantFromString(value) {
+	return String(value || "").trim();
+}
+function serializeRegistrationIntentV1(intent) {
+	return alphabetizeStringify(intent);
+}
+function serializeAddSignerIntentV1(intent) {
+	return alphabetizeStringify(intent);
+}
+function serializeAddAuthMethodIntentV1(intent) {
+	return alphabetizeStringify(intent);
+}
+async function computeRegistrationIntentDigestB64u(intent) {
+	return base64UrlEncode(await sha256BytesUtf8(serializeRegistrationIntentV1(intent)));
+}
+async function computeAddSignerIntentDigestB64u(intent) {
+	return base64UrlEncode(await sha256BytesUtf8(serializeAddSignerIntentV1(intent)));
+}
+async function computeAddAuthMethodIntentDigestB64u(intent) {
+	return base64UrlEncode(await sha256BytesUtf8(serializeAddAuthMethodIntentV1(intent)));
+}
+function inspectRawObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function trimString(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+function normalizePositiveInteger(raw, fallback) {
+	const value = typeof raw === "number" ? raw : Number(raw);
+	return Number.isFinite(value) && value >= 1 ? Math.floor(value) : fallback;
+}
+function collectPositiveParticipantIds(raw) {
+	if (!Array.isArray(raw)) return [];
+	const participantIds = [];
+	for (const id of raw) {
+		const numericId = Number(id);
+		if (Number.isInteger(numericId) && numericId > 0) participantIds.push(numericId);
+	}
+	return participantIds;
+}
+function normalizeUnknownArray(raw) {
+	return Array.isArray(raw) ? raw : [];
+}
+function normalizeRegistrationNearAccountProvisioning(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("kind" in record)) return null;
+	switch (trimString(record.kind)) {
+		case "implicit_account":
+			if (Object.prototype.hasOwnProperty.call(record, "requestedAccountId") || Object.prototype.hasOwnProperty.call(record, "sponsor")) return null;
+			return {
+				kind: "implicit_account",
+				accountIdSource: "ed25519_public_key"
+			};
+		case "sponsored_named_account": {
+			if (Object.prototype.hasOwnProperty.call(record, "accountIdSource") || !("requestedAccountId" in record)) return null;
+			const parsed = parseNamedNearAccountId(record.requestedAccountId);
+			if (!parsed.ok) return null;
+			return {
+				kind: "sponsored_named_account",
+				requestedAccountId: parsed.value,
+				sponsor: "relayer"
+			};
+		}
+		default: return null;
+	}
+}
+function normalizeRegistrationEcdsaSpec(value) {
+	if (!value) return null;
+	if (!("participantIds" in value) || !("chainTargets" in value)) return null;
+	const participantIds = collectPositiveParticipantIds(value.participantIds);
+	const chainTargets = normalizeUnknownArray(value.chainTargets);
+	if (participantIds.length === 0 || chainTargets.length === 0) return null;
+	return {
+		participantIds,
+		chainTargets
+	};
+}
+const REGISTRATION_NEAR_ED25519_KEY_PURPOSE = "near_tx";
+const NEAR_ED25519_YAO_KEY_VERSION_V1 = "router-ab-ed25519-yao-v1";
+function registrationSignerBranchKeyFromString(value) {
+	const normalized = trimString(value);
+	if (!normalized) throw new Error("registration signer branch key is required");
+	return normalized;
+}
+function registrationNearEd25519BranchKey(signerSlot) {
+	return registrationSignerBranchKeyFromString(`near_ed25519:slot:${signerSlot}`);
+}
+function registrationEvmFamilyEcdsaTargetKey(target) {
+	return alphabetizeStringify(target);
+}
+function registrationEvmFamilyEcdsaBranchKey(chainTargets) {
+	return registrationSignerBranchKeyFromString(`evm_family_ecdsa:${chainTargets.map(registrationEvmFamilyEcdsaTargetKey).join("|")}`);
+}
+function registrationSignerPlanFromRequests(signers) {
+	return registrationSignerPlanFromBranches(signers.map(registrationSignerPlanBranchFromRequest));
+}
+function registrationSignerPlanFromBranches(branches) {
+	if (branches.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signer set must include at least one signer"
+	};
+	const nearSlots = /* @__PURE__ */ new Set();
+	const ecdsaTargetKeys = /* @__PURE__ */ new Set();
+	const branchKeys = /* @__PURE__ */ new Set();
+	for (const branch of branches) {
+		const duplicate = findRegistrationSignerPlanDuplicate({
+			branch,
+			nearSlots,
+			ecdsaTargetKeys,
+			branchKeys
+		});
+		if (duplicate) return duplicate;
+	}
+	return {
+		ok: true,
+		value: {
+			kind: "signer_set",
+			branches
+		}
+	};
+}
+function registrationSignerPlanBranchFromRequest(signer) {
+	switch (signer.kind) {
+		case "near_ed25519": return {
+			kind: "near_ed25519",
+			branchKey: registrationNearEd25519BranchKey(signer.signerSlot),
+			accountProvisioning: signer.accountProvisioning,
+			signerSlot: signer.signerSlot,
+			participantIds: signer.participantIds,
+			keyPurpose: REGISTRATION_NEAR_ED25519_KEY_PURPOSE,
+			keyVersion: NEAR_ED25519_YAO_KEY_VERSION_V1,
+			derivationVersion: signer.derivationVersion
+		};
+		case "evm_family_ecdsa": return {
+			kind: "evm_family_ecdsa",
+			branchKey: registrationEvmFamilyEcdsaBranchKey(signer.chainTargets),
+			participantIds: signer.participantIds,
+			chainTargets: signer.chainTargets
+		};
+		default: return assertNeverRegistrationSignerRequest(signer);
+	}
+}
+function findRegistrationSignerPlanDuplicate(input) {
+	switch (input.branch.kind) {
+		case "near_ed25519":
+			if (input.nearSlots.has(input.branch.signerSlot)) return {
+				ok: false,
+				code: "invalid_body",
+				message: "duplicate near_ed25519 signer slot is invalid"
+			};
+			input.nearSlots.add(input.branch.signerSlot);
+			break;
+		case "evm_family_ecdsa":
+			{
+				const duplicateTarget = findDuplicateRegistrationEcdsaTarget(input.branch, input.ecdsaTargetKeys);
+				if (duplicateTarget) return duplicateTarget;
+			}
+			break;
+		default: return assertNeverRegistrationSignerPlanBranch(input.branch);
+	}
+	return findDuplicateRegistrationSignerBranch(input.branch, input.branchKeys);
+}
+function findDuplicateRegistrationSignerBranch(branch, branchKeys) {
+	const branchKey = String(branch.branchKey);
+	if (branchKeys.has(branchKey)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "duplicate signer branch is invalid"
+	};
+	branchKeys.add(branchKey);
+	return null;
+}
+function findDuplicateRegistrationEcdsaTarget(branch, ecdsaTargetKeys) {
+	for (const target of branch.chainTargets) {
+		const targetKey = registrationEvmFamilyEcdsaTargetKey(target);
+		if (ecdsaTargetKeys.has(targetKey)) return {
+			ok: false,
+			code: "invalid_body",
+			message: "duplicate evm_family_ecdsa chain target is invalid"
+		};
+		ecdsaTargetKeys.add(targetKey);
+	}
+	return null;
+}
+function normalizeRegistrationSignerRequest(raw) {
+	const record = inspectRawObject(raw);
+	if (!record) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signer set entry must be an object"
+	};
+	if (!("kind" in record)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "unsupported registration signer kind"
+	};
+	switch (trimString(record.kind)) {
+		case "near_ed25519": return normalizeRegistrationNearEd25519SignerRequest(record);
+		case "evm_family_ecdsa": return normalizeRegistrationEvmFamilyEcdsaSignerRequest(record);
+		default: return {
+			ok: false,
+			code: "invalid_body",
+			message: "unsupported registration signer kind"
+		};
+	}
+}
+function normalizeRegistrationNearEd25519SignerRequest(raw) {
+	if (Object.prototype.hasOwnProperty.call(raw, "keyPurpose") || Object.prototype.hasOwnProperty.call(raw, "keyVersion")) return {
+		ok: false,
+		code: "invalid_body",
+		message: "near_ed25519 signer spec cannot include protocol key fields"
+	};
+	if (Object.prototype.hasOwnProperty.call(raw, "nearAccountId") || Object.prototype.hasOwnProperty.call(raw, "createNearAccount")) return {
+		ok: false,
+		code: "invalid_body",
+		message: "near_ed25519 signer spec is invalid"
+	};
+	const accountProvisioning = normalizeRegistrationNearAccountProvisioning("accountProvisioning" in raw ? raw.accountProvisioning : void 0);
+	const signerSlot = normalizePositiveInteger("signerSlot" in raw ? raw.signerSlot : void 0, 0);
+	const derivationVersion = Number("derivationVersion" in raw ? raw.derivationVersion : void 0);
+	const participantIds = collectPositiveParticipantIds("participantIds" in raw ? raw.participantIds : void 0);
+	if (!accountProvisioning || signerSlot < 1 || participantIds.length === 0 || derivationVersion !== 1) return {
+		ok: false,
+		code: "invalid_body",
+		message: "near_ed25519 signer spec is invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "near_ed25519",
+			accountProvisioning,
+			signerSlot,
+			participantIds,
+			derivationVersion
+		}
+	};
+}
+function normalizeRegistrationEvmFamilyEcdsaSignerRequest(raw) {
+	const ecdsa = normalizeRegistrationEcdsaSpec(raw);
+	if (!ecdsa) return {
+		ok: false,
+		code: "invalid_body",
+		message: "evm_family_ecdsa signer spec is invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "evm_family_ecdsa",
+			participantIds: ecdsa.participantIds,
+			chainTargets: ecdsa.chainTargets
+		}
+	};
+}
+function normalizeRegistrationSignerSetPlan(raw) {
+	if (!("signers" in raw) || !Array.isArray(raw.signers)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection.signers must be an array"
+	};
+	const signers = [];
+	for (const rawSigner of raw.signers) {
+		const signer = normalizeRegistrationSignerRequest(rawSigner);
+		if (!signer.ok) return signer;
+		signers.push(signer.value);
+	}
+	return registrationSignerPlanFromRequests(signers);
+}
+function normalizeRegistrationSignerPlan(raw) {
+	const record = inspectRawObject(raw);
+	if (!record) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection must be an object"
+	};
+	if (!("kind" in record)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection.kind must be signer_set"
+	};
+	if (trimString(record.kind) === "signer_set") return normalizeRegistrationSignerSetPlan(record);
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection.kind must be signer_set"
+	};
+}
+function registrationSignerPlanFromSelection(selection) {
+	return registrationSignerPlanFromRequests(selection.signers);
+}
+function findRegistrationSignerPlanNearEd25519Branch(plan) {
+	for (const branch of plan.branches) if (branch.kind === "near_ed25519") return branch;
+	return null;
+}
+function findRegistrationSignerPlanEvmFamilyEcdsaBranch(plan) {
+	for (const branch of plan.branches) if (branch.kind === "evm_family_ecdsa") return branch;
+	return null;
+}
+function registrationSignerSetSelectionFromPlan(plan, options = {}) {
+	const signers = [];
+	for (const branch of plan.branches) {
+		const signer = registrationSignerRequestFromPlanBranchForSelection(branch, options);
+		if (!signer.ok) return signer;
+		signers.push(signer.value);
+	}
+	return {
+		ok: true,
+		value: {
+			kind: "signer_set",
+			signers
+		}
+	};
+}
+function registrationSignerRequestFromPlanBranchForSelection(branch, options) {
+	switch (branch.kind) {
+		case "near_ed25519": return {
+			ok: true,
+			value: registrationNearEd25519RequestFromPlanBranch(branch)
+		};
+		case "evm_family_ecdsa": return registrationEvmFamilyEcdsaRequestFromPlanBranch(branch, options);
+		default: return assertNeverRegistrationSignerPlanBranch(branch);
+	}
+}
+function registrationNearEd25519RequestFromPlanBranch(branch) {
+	return {
+		kind: "near_ed25519",
+		accountProvisioning: branch.accountProvisioning,
+		signerSlot: branch.signerSlot,
+		participantIds: [...branch.participantIds],
+		derivationVersion: branch.derivationVersion
+	};
+}
+function registrationEvmFamilyEcdsaRequestFromPlanBranch(branch, options) {
+	const chainTargets = registrationEcdsaChainTargetsFromPlanBranch(branch, options);
+	if (!chainTargets) return {
+		ok: false,
+		code: "invalid_body",
+		message: "registration ECDSA chainTargets are invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "evm_family_ecdsa",
+			participantIds: [...branch.participantIds],
+			chainTargets
+		}
+	};
+}
+function registrationEcdsaChainTargetsFromPlanBranch(branch, options) {
+	if (!options.normalizeEcdsaChainTarget) return [...branch.chainTargets];
+	const chainTargets = [];
+	for (const target of branch.chainTargets) {
+		const normalized = options.normalizeEcdsaChainTarget(target);
+		if (!normalized) return null;
+		chainTargets.push(normalized);
+	}
+	return chainTargets;
+}
+function assertNeverRegistrationSignerRequest(value) {
+	throw new Error(`Unsupported registration signer request: ${String(value)}`);
+}
+function assertNeverRegistrationSignerPlanBranch(value) {
+	throw new Error(`Unsupported registration signer plan branch: ${String(value)}`);
+}
+function normalizeAddSignerSelection(raw, options) {
+	const record = inspectRawObject(raw);
+	if (!record) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signerSelection must be an object"
+	};
+	if (!("mode" in record)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "unsupported add-signer mode"
+	};
+	const mode = trimString(record.mode);
+	if (mode === "ecdsa") return normalizeAddSignerEcdsaSelection("ecdsa" in record ? record.ecdsa : void 0, options);
+	if (mode === "ed25519") return normalizeAddSignerEd25519Selection("ed25519" in record ? record.ed25519 : void 0);
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "unsupported add-signer mode"
+	};
+}
+function normalizeAddSignerEcdsaSelection(raw, options) {
+	const ecdsaRecord = inspectRawObject(raw);
+	const participantIds = collectPositiveParticipantIds(ecdsaRecord && "participantIds" in ecdsaRecord ? ecdsaRecord.participantIds : void 0);
+	const chainTargets = normalizeAddSignerEcdsaChainTargets(ecdsaRecord && "chainTargets" in ecdsaRecord ? ecdsaRecord.chainTargets : void 0, options);
+	if (participantIds.length === 0 || chainTargets.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ecdsa add-signer spec is invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			mode: "ecdsa",
+			ecdsa: {
+				chainTargets,
+				participantIds
+			}
+		}
+	};
+}
+function normalizeAddSignerEcdsaChainTargets(raw, options) {
+	if (!Array.isArray(raw)) return [];
+	const chainTargets = [];
+	for (const target of raw) {
+		const normalized = options.normalizeEcdsaChainTarget(target);
+		if (!normalized) return [];
+		chainTargets.push(normalized);
+	}
+	return chainTargets;
+}
+function normalizeAddSignerEd25519Selection(raw) {
+	const ed25519Record = inspectRawObject(raw);
+	const ed25519Mode = trimString(ed25519Record && "mode" in ed25519Record ? ed25519Record.mode : void 0);
+	const signerSlot = normalizePositiveInteger(ed25519Record && "signerSlot" in ed25519Record ? ed25519Record.signerSlot : void 0, 1);
+	const keyPurpose = trimString(ed25519Record && "keyPurpose" in ed25519Record ? ed25519Record.keyPurpose : void 0);
+	const keyVersion = trimString(ed25519Record && "keyVersion" in ed25519Record ? ed25519Record.keyVersion : void 0);
+	const derivationVersion = normalizePositiveInteger(ed25519Record && "derivationVersion" in ed25519Record ? ed25519Record.derivationVersion : void 0, 0);
+	const participantIds = collectPositiveParticipantIds(ed25519Record && "participantIds" in ed25519Record ? ed25519Record.participantIds : void 0);
+	if (!keyPurpose || !keyVersion || !derivationVersion || participantIds.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ed25519 add-signer spec is invalid"
+	};
+	if (ed25519Mode === "create_implicit_near_account") return {
+		ok: true,
+		value: {
+			mode: "ed25519",
+			ed25519: {
+				mode: ed25519Mode,
+				signerSlot,
+				participantIds,
+				keyPurpose,
+				keyVersion,
+				derivationVersion
+			}
+		}
+	};
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "unsupported add-signer mode"
+	};
+}
+function normalizeRegistrationAuthMethodInput(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("kind" in record)) return null;
+	const kind = trimString(record.kind);
+	if (kind === "passkey") {
+		const rpId = parseWebAuthnRpId("rpId" in record ? record.rpId : void 0);
+		if (!rpId.ok || Object.prototype.hasOwnProperty.call(record, "email") || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "challengeId")) return null;
+		return {
+			kind: "passkey",
+			rpId: rpId.value,
+			..."authenticatorOptions" in record && record.authenticatorOptions !== void 0 ? { authenticatorOptions: record.authenticatorOptions } : {}
+		};
+	}
+	if (kind === "email_otp") {
+		const proofKind = trimString("proofKind" in record ? record.proofKind : void 0);
+		const email = trimString("email" in record ? record.email : void 0);
+		const providerSubject = trimString("providerSubject" in record ? record.providerSubject : void 0);
+		if (!email || !providerSubject || Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "authenticatorOptions")) return null;
+		if (proofKind === "otp_challenge") {
+			const otpCode = trimString("otpCode" in record ? record.otpCode : void 0);
+			const challengeId = trimString("challengeId" in record ? record.challengeId : void 0);
+			if (!otpCode || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationAttemptId") || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationOfferId") || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationCandidateId")) return null;
+			return {
+				kind: "email_otp",
+				proofKind: "otp_challenge",
+				email,
+				providerSubject,
+				otpCode,
+				...challengeId ? { challengeId } : {}
+			};
+		}
+		if (proofKind === "google_sso_registration") {
+			const googleEmailOtpRegistrationAttemptId = trimString("googleEmailOtpRegistrationAttemptId" in record ? record.googleEmailOtpRegistrationAttemptId : void 0);
+			const googleEmailOtpRegistrationOfferId = trimString("googleEmailOtpRegistrationOfferId" in record ? record.googleEmailOtpRegistrationOfferId : void 0);
+			const googleEmailOtpRegistrationCandidateId = trimString("googleEmailOtpRegistrationCandidateId" in record ? record.googleEmailOtpRegistrationCandidateId : void 0);
+			if (!googleEmailOtpRegistrationAttemptId || !googleEmailOtpRegistrationOfferId || !googleEmailOtpRegistrationCandidateId || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "challengeId")) return null;
+			return {
+				kind: "email_otp",
+				proofKind: "google_sso_registration",
+				email,
+				providerSubject,
+				googleEmailOtpRegistrationAttemptId,
+				googleEmailOtpRegistrationOfferId,
+				googleEmailOtpRegistrationCandidateId
+			};
+		}
+		return null;
+	}
+	return null;
+}
+function normalizeAddAuthMethodInput(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("kind" in record)) return null;
+	const kind = trimString(record.kind);
+	if (kind === "passkey") {
+		const rpId = parseWebAuthnRpId("rpId" in record ? record.rpId : void 0);
+		if (!rpId.ok || Object.prototype.hasOwnProperty.call(record, "email") || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "challengeId") || Object.prototype.hasOwnProperty.call(record, "authenticatorOptions")) return null;
+		return {
+			kind: "passkey",
+			rpId: rpId.value
+		};
+	}
+	if (kind === "email_otp") {
+		const email = trimString("email" in record ? record.email : void 0);
+		if (!email || Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "challengeId") || Object.prototype.hasOwnProperty.call(record, "authenticatorOptions")) return null;
+		return {
+			kind: "email_otp",
+			email
+		};
+	}
+	return null;
+}
+function normalizeAddAuthMethodIntentCaller(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("caller" in record)) return null;
+	const caller = trimString(record.caller);
+	if (caller === "linked_device_ceremony") {
+		if (Object.prototype.hasOwnProperty.call(record, "source")) return null;
+		return { caller: "linked_device_ceremony" };
+	}
+	if (caller !== "same_device_addition") return null;
+	const source = inspectRawObject("source" in record ? record.source : void 0);
+	if (!source) return null;
+	const walletAuthorityId = parseWalletAuthorityId("walletAuthorityId" in source ? source.walletAuthorityId : void 0);
+	const walletAuthMethodId = parseWalletAuthMethodId("walletAuthMethodId" in source ? source.walletAuthMethodId : void 0);
+	const walletSessionId = trimString("walletSessionId" in source ? source.walletSessionId : void 0);
+	const authorityDigestB64u = trimString("authorityDigestB64u" in source ? source.authorityDigestB64u : void 0);
+	const revocationEpoch = "revocationEpoch" in source ? source.revocationEpoch : void 0;
+	if (!walletAuthorityId.ok || !walletAuthMethodId.ok || !walletSessionId || !authorityDigestB64u || typeof revocationEpoch !== "number" || !Number.isSafeInteger(revocationEpoch) || revocationEpoch < 0) return null;
+	return {
+		caller: "same_device_addition",
+		source: {
+			walletAuthorityId: walletAuthorityId.value,
+			walletAuthMethodId: walletAuthMethodId.value,
+			walletSessionId,
+			authorityDigestB64u,
+			revocationEpoch
+		}
+	};
+}
+function sameRegistrationIntentNumberArray(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) if (!Number.isSafeInteger(left[index]) || left[index] !== right[index]) return false;
+	return true;
+}
+function sameAddSignerIntentChainTargetV1(left, right) {
+	switch (left.kind) {
+		case "evm": return right.kind === "evm" && left.namespace === right.namespace && left.chainId === right.chainId && left.networkSlug === right.networkSlug;
+		case "tempo": return right.kind === "tempo" && left.chainId === right.chainId && left.networkSlug === right.networkSlug;
+		default: return assertNeverThresholdEcdsaAddSignerChainTarget(left);
+	}
+}
+function assertNeverThresholdEcdsaAddSignerChainTarget(value) {
+	throw new Error(`Unsupported add-signer chain target: ${String(value)}`);
+}
+function sameAddSignerSelectionV1(left, right) {
+	if (left.mode !== right.mode) return false;
+	switch (left.mode) {
+		case "ed25519": return right.mode === "ed25519" && left.ed25519.mode === right.ed25519.mode && left.ed25519.signerSlot === right.ed25519.signerSlot && sameRegistrationIntentNumberArray(left.ed25519.participantIds, right.ed25519.participantIds) && left.ed25519.keyPurpose === right.ed25519.keyPurpose && left.ed25519.keyVersion === right.ed25519.keyVersion && left.ed25519.derivationVersion === right.ed25519.derivationVersion;
+		case "ecdsa":
+			if (right.mode !== "ecdsa" || left.ecdsa.chainTargets.length !== right.ecdsa.chainTargets.length) return false;
+			for (let index = 0; index < left.ecdsa.chainTargets.length; index += 1) if (!sameAddSignerIntentChainTargetV1(left.ecdsa.chainTargets[index], right.ecdsa.chainTargets[index])) return false;
+			return sameRegistrationIntentNumberArray(left.ecdsa.participantIds, right.ecdsa.participantIds);
+		default: return assertNeverAddSignerSelection(left);
+	}
+}
+function assertNeverAddSignerSelection(value) {
+	throw new Error(`Unsupported add-signer selection: ${String(value)}`);
+}
+function sameRegistrationIntentRuntimePolicyScope(left, right) {
+	if (left === void 0 || right === void 0) return left === right;
+	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
+}
+function sameAddSignerIntentV1(left, right) {
+	return left.version === right.version && left.walletId === right.walletId && sameAddSignerSelectionV1(left.signerSelection, right.signerSelection) && sameRegistrationIntentRuntimePolicyScope(left.runtimePolicyScope, right.runtimePolicyScope) && left.nonceB64u === right.nonceB64u;
+}
+function normalizeEmailOtpRegistrationProof(raw) {
+	const record = inspectRawObject(raw);
+	if (!record) return null;
+	const version = trimString("version" in record ? record.version : void 0);
+	const proofKind = trimString("proofKind" in record ? record.proofKind : void 0);
+	const providerSubject = trimString("providerSubject" in record ? record.providerSubject : void 0);
+	const email = trimString("email" in record ? record.email : void 0).toLowerCase();
+	const registrationIntentDigestB64u = trimString("registrationIntentDigestB64u" in record ? record.registrationIntentDigestB64u : void 0);
+	if (version !== "email_otp_registration_proof_v1" || !providerSubject || !email || !registrationIntentDigestB64u) return null;
+	if (proofKind === "otp_challenge") {
+		const challengeId = trimString("challengeId" in record ? record.challengeId : void 0);
+		const otpCode = trimString("otpCode" in record ? record.otpCode : void 0);
+		const otpChannel = trimString("otpChannel" in record ? record.otpChannel : void 0);
+		if (!challengeId || !otpCode || otpChannel !== "email_otp" || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationAttemptId") || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationOfferId") || Object.prototype.hasOwnProperty.call(record, "googleEmailOtpRegistrationCandidateId")) return null;
+		return {
+			version: "email_otp_registration_proof_v1",
+			proofKind: "otp_challenge",
+			providerSubject,
+			email,
+			challengeId,
+			otpCode,
+			otpChannel: "email_otp",
+			registrationIntentDigestB64u
+		};
+	}
+	if (proofKind === "google_sso_registration") {
+		const googleEmailOtpRegistrationAttemptId = trimString("googleEmailOtpRegistrationAttemptId" in record ? record.googleEmailOtpRegistrationAttemptId : void 0);
+		const googleEmailOtpRegistrationOfferId = trimString("googleEmailOtpRegistrationOfferId" in record ? record.googleEmailOtpRegistrationOfferId : void 0);
+		const googleEmailOtpRegistrationCandidateId = trimString("googleEmailOtpRegistrationCandidateId" in record ? record.googleEmailOtpRegistrationCandidateId : void 0);
+		if (!googleEmailOtpRegistrationAttemptId || !googleEmailOtpRegistrationOfferId || !googleEmailOtpRegistrationCandidateId || Object.prototype.hasOwnProperty.call(record, "challengeId") || Object.prototype.hasOwnProperty.call(record, "otpCode") || Object.prototype.hasOwnProperty.call(record, "otpChannel")) return null;
+		return {
+			version: "email_otp_registration_proof_v1",
+			proofKind: "google_sso_registration",
+			providerSubject,
+			email,
+			googleEmailOtpRegistrationAttemptId,
+			googleEmailOtpRegistrationOfferId,
+			googleEmailOtpRegistrationCandidateId,
+			registrationIntentDigestB64u
+		};
+	}
+	return null;
+}
+//#endregion
+export { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, buildWalletAuthMethodRecordV2, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, computeAddSignerNearEd25519SigningKeyId, computeRegistrationIntentDigestB64u, computeRegistrationNearEd25519SigningKeyId, computeWalletAuthMethodRevokeOperationFingerprintV1, createServerAllocatedWalletId, findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, nearEd25519SigningKeyIdFromString, normalizeAddAuthMethodInput, normalizeAddAuthMethodIntentCaller, normalizeAddSignerSelection, normalizeEmailOtpRegistrationProof, normalizeRegistrationAuthMethodInput, normalizeRegistrationSignerPlan, parseNearEd25519SigningKeyId, parseWalletAuthMethodRecordV2, registrationEd25519AuthorityScopeFromAuthority, registrationIntentGrantFromString, registrationNearEd25519BranchKey, registrationSignerBranchKeyFromString, registrationSignerPlanFromSelection, registrationSignerSetSelectionFromPlan, sameAddSignerIntentV1, sameWalletAuthMethodRecordV2, walletAuthMethodRecordId, walletIdFromString };
+
+//# sourceMappingURL=registrationIntent.js.map