@seams/wallet 0.12.0 → 0.13.1

package/dist/public/wallet-assets.manifest.json

@@ -1,14 +1,14 @@
 {
   "schemaVersion": 1,
   "packageName": "@seams/wallet",
-  "packageVersion": "0.12.0",
+  "packageVersion": "0.13.1",
   "assetRoot": "dist/public",
   "sdkBasePath": "/sdk",
   "walletServicePath": "/wallet-service",
   "headersManifest": "headers.manifest.json",
   "versionSkewContract": {
     "kind": "wallet_iframe_protocol_handshake",
-    "packageVersion": "0.12.0",
+    "packageVersion": "0.13.1",
     "protocolVersion": "15.0.0",
     "readyPayloadField": "protocolVersion",
     "failureMode": "typed_error",
@@ -970,8 +970,8 @@
       ]
     },
     {
-      "route": "/sdk/host-CHQwi-Nm.js",
-      "sourceFile": "sdk/host-CHQwi-Nm.js",
+      "route": "/sdk/host-BAeJh9rB.js",
+      "sourceFile": "sdk/host-BAeJh9rB.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1426,8 +1426,8 @@
       ]
     },
     {
-      "route": "/sdk/presignaturePool-CLHu7HaU.js",
-      "sourceFile": "sdk/presignaturePool-CLHu7HaU.js",
+      "route": "/sdk/presignaturePool-Bkk6bLFB.js",
+      "sourceFile": "sdk/presignaturePool-Bkk6bLFB.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1810,8 +1810,8 @@
       ]
     },
     {
-      "route": "/sdk/routerAbNormalSigning-DVKFBYgV.js",
-      "sourceFile": "sdk/routerAbNormalSigning-DVKFBYgV.js",
+      "route": "/sdk/routerAbNormalSigning-B35zb-P-.js",
+      "sourceFile": "sdk/routerAbNormalSigning-B35zb-P-.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1834,8 +1834,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-auth-DtpRz88X.js",
-      "sourceFile": "sdk/runtime-auth-DtpRz88X.js",
+      "route": "/sdk/runtime-auth-D7VqiZeg.js",
+      "sourceFile": "sdk/runtime-auth-D7VqiZeg.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1858,8 +1858,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-device-link-DXjabXJb.js",
-      "sourceFile": "sdk/runtime-device-link-DXjabXJb.js",
+      "route": "/sdk/runtime-device-link-BKc_MD5V.js",
+      "sourceFile": "sdk/runtime-device-link-BKc_MD5V.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1882,8 +1882,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-ecdsa-tempo-DlKMIbyP.js",
-      "sourceFile": "sdk/runtime-ecdsa-tempo-DlKMIbyP.js",
+      "route": "/sdk/runtime-ecdsa-tempo-DC51NDrh.js",
+      "sourceFile": "sdk/runtime-ecdsa-tempo-DC51NDrh.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1906,8 +1906,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-email-otp-BBPghU2G.js",
-      "sourceFile": "sdk/runtime-email-otp-BBPghU2G.js",
+      "route": "/sdk/runtime-email-otp-C-wopKFf.js",
+      "sourceFile": "sdk/runtime-email-otp-C-wopKFf.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1930,8 +1930,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-export-pw-xJL8o.js",
-      "sourceFile": "sdk/runtime-export-pw-xJL8o.js",
+      "route": "/sdk/runtime-export-BtGy8BKi.js",
+      "sourceFile": "sdk/runtime-export-BtGy8BKi.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1954,8 +1954,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-near-B-vYxGjl.js",
-      "sourceFile": "sdk/runtime-near-B-vYxGjl.js",
+      "route": "/sdk/runtime-near-nq8pgRAl.js",
+      "sourceFile": "sdk/runtime-near-nq8pgRAl.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -1978,8 +1978,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-preferences-D-hY0RfC.js",
-      "sourceFile": "sdk/runtime-preferences-D-hY0RfC.js",
+      "route": "/sdk/runtime-preferences-778ZfMmT.js",
+      "sourceFile": "sdk/runtime-preferences-778ZfMmT.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2002,8 +2002,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-recovery-codes-rLR4Guy4.js",
-      "sourceFile": "sdk/runtime-recovery-codes-rLR4Guy4.js",
+      "route": "/sdk/runtime-recovery-B-JsRiN0.js",
+      "sourceFile": "sdk/runtime-recovery-B-JsRiN0.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2026,8 +2026,8 @@
       ]
     },
     {
-      "route": "/sdk/runtime-recovery-Vg1ND2nl.js",
-      "sourceFile": "sdk/runtime-recovery-Vg1ND2nl.js",
+      "route": "/sdk/runtime-recovery-codes-rLR4Guy4.js",
+      "sourceFile": "sdk/runtime-recovery-codes-rLR4Guy4.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2074,8 +2074,8 @@
       ]
     },
     {
-      "route": "/sdk/secp256k1-C-AETUpI.js",
-      "sourceFile": "sdk/secp256k1-C-AETUpI.js",
+      "route": "/sdk/secp256k1-CYQS0rj-.js",
+      "sourceFile": "sdk/secp256k1-CYQS0rj-.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2146,8 +2146,8 @@
       ]
     },
     {
-      "route": "/sdk/shared-6bpRPbcM.js",
-      "sourceFile": "sdk/shared-6bpRPbcM.js",
+      "route": "/sdk/shared-B6BCLs8L.js",
+      "sourceFile": "sdk/shared-B6BCLs8L.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2242,8 +2242,8 @@
       ]
     },
     {
-      "route": "/sdk/signEvmFamily-M0trbeZe.js",
-      "sourceFile": "sdk/signEvmFamily-M0trbeZe.js",
+      "route": "/sdk/signEvmFamily-ttVfV0qm.js",
+      "sourceFile": "sdk/signEvmFamily-ttVfV0qm.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",
@@ -2386,8 +2386,8 @@
       ]
     },
     {
-      "route": "/sdk/signNear-DGUQZ44s.js",
-      "sourceFile": "sdk/signNear-DGUQZ44s.js",
+      "route": "/sdk/signNear-bcWIHxEY.js",
+      "sourceFile": "sdk/signNear-bcWIHxEY.js",
       "owner": "wallet_sdk_asset",
       "routeClass": "javascript",
       "contentType": "text/javascript; charset=utf-8",

package/dist/public/wallet-service/index.html

@@ -5,14 +5,14 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>Web3Authn Wallet Service</title>
     <!-- Surface styles are external so strict CSP can keep style-src 'self' -->
-    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.12.0" />
+    <link rel="stylesheet" href="/sdk/wallet-ui.css?v=0.13.1" />
     <!-- Minimal shims some ESM bundles expect (externalized to enable strict CSP) -->
-    <script src="/sdk/wallet-shims.js?v=0.12.0"></script>
+    <script src="/sdk/wallet-shims.js?v=0.13.1"></script>
     <!-- Hint the browser to fetch the host script earlier -->
-    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.12.0" crossorigin>
+    <link rel="modulepreload" href="/sdk/wallet-iframe-host-runtime.js?v=0.13.1" crossorigin>
   </head>
   <body>
     <!-- sdkBasePath points to the SDK root (e.g. '/sdk'). Load the host directly. -->
-    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.12.0"></script>
+    <script type="module" src="/sdk/wallet-iframe-host-runtime.js?v=0.13.1"></script>
   </body>
 </html>

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/ui/auth-menu/AuthMenuSurface.d.ts

@@ -2,6 +2,11 @@
 import { Component, type ComponentChildren } from 'preact';
 import type { CspStylesheetManager } from '../../../../../core/browser/walletIframe/csp-stylesheet';
 import { type AuthMenuIntent, type AuthMenuViewModel } from '../../auth-menu/domain';
+/** The part of the recovery code the input's selection covers, in code characters. */
+type RecoveryCodeSelection = {
+    readonly start: number;
+    readonly end: number;
+};
 type AuthMenuSurfaceProps = {
     readonly viewModel: AuthMenuViewModel;
     readonly element: HTMLElement;
@@ -11,10 +16,18 @@ type AuthMenuSurfaceProps = {
 type AccountMenuState = 'closed' | 'open' | 'closing';
 type AuthMenuSurfaceState = {
     accountMenu: AccountMenuState;
-    recoveryCaret: number | null;
+    recoverySelection: RecoveryCodeSelection | null;
+    recoveryRejection: {
+        readonly characters: readonly string[];
+        readonly parity: 0 | 1;
+    } | null;
 };
 export declare class AuthMenuSurface extends Component<AuthMenuSurfaceProps, AuthMenuSurfaceState> {
     state: AuthMenuSurfaceState;
+    private recoveryDrawnCode;
+    private recoveryArrival;
+    private recoveryArrivalTimer;
+    private recoveryRejectionTimer;
     private accountMenuExitTimer;
     private accountMenuChoice;
     private previouslyFocusedElement;
@@ -67,9 +80,14 @@ export declare class AuthMenuSurface extends Component<AuthMenuSurfaceProps, Aut
     private onLinkDeviceOpen;
     private onRecoveryOpen;
     private onRecoveryCodeInput;
-    private onRecoveryCaretMove;
+    private onRecoverySelectionMove;
+    private onRecoveryCodeClick;
+    private showRecoveryRejection;
+    private clearRecoveryRejection;
+    private recoveryCodeArrival;
+    private endRecoveryArrival;
     private onRecoveryCodeBlur;
-    private syncRecoveryCaret;
+    private syncRecoverySelection;
     private onRecoverySubmit;
     private onRecoveryPasskeySelected;
     private onRecoveryGoogleSelected;

package/dist/types/wallet/src/SeamsWeb/walletIframe/host/ui/auth-menu/linkDeviceBadge.d.ts

@@ -0,0 +1,18 @@
+/** @jsxImportSource preact */
+import type { ComponentChildren } from 'preact';
+import type { AuthMenuLinkDeviceState } from '../../auth-menu/domain';
+type LinkDeviceRingPhase = 'waiting' | 'idle' | 'approved';
+export declare function linkDeviceDotRing(phase: LinkDeviceRingPhase, glyph?: ComponentChildren): ComponentChildren;
+export type AuthMenuLinkDeviceEmailOtpState = Extract<AuthMenuLinkDeviceState, {
+    kind: 'email_otp_required';
+}>;
+type LinkDeviceEmailOtpPresentation = {
+    readonly ring: LinkDeviceRingPhase;
+    readonly heading: string;
+    readonly status: string;
+    readonly pending: boolean;
+    readonly tone: 'neutral' | 'error';
+};
+export declare function linkDeviceEmailOtpPresentation(activation: AuthMenuLinkDeviceEmailOtpState['state']): LinkDeviceEmailOtpPresentation;
+export {};
+//# sourceMappingURL=linkDeviceBadge.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "type": "module",
   "description": "Seams web and runtime TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",

package/dist/esm/sdk/routerAbNormalSigning-DVKFBYgV.js

@@ -1 +0,0 @@
-import{c as e,h as t,k as n}from"./chains-C_X_fNuS.js";import{A as r,D as i,j as a,k as o}from"./primitives-CqrjmIAH.js";import{i as s,r as c,t as l}from"./base64-DW79QA0h.js";import{n as u}from"./sessionPolicy-CBTZQe1n.js";import{d,h as f}from"./capabilityKinds-N8xo_IEh.js";import{$t as p,Qt as m,U as h,W as g,Z as _,ct as v,lt as y}from"./emailOtpEcdsaDerivationIdentity-p0C1CQva.js";import{t as b}from"./authenticatorOptions-C9aCKgeF.js";import{r as x,t as ee}from"./walletSessionAuthorizationStatus-BLyzJbU8.js";import{t as S}from"./authorizationAdmission-CGinGhXH.js";import{n as te}from"./walletSessionFailure-YuhraC3P.js";const C={enabled:!0,targetDepth:5,lowWatermark:4,maxRefillInFlight:1,refillAttemptTimeoutMs:3e4},ne={network:{chains:[{network:`near-testnet`,rpcUrl:`https://rpc.testnet.fastnear.com`,explorerUrl:`https://testnet.nearblocks.io`},{network:`tempo-testnet`,rpcUrl:`https://rpc.moderato.tempo.xyz`,explorerUrl:`https://explore.tempo.xyz`,chainId:42431},{network:`arc-testnet`,rpcUrl:`https://rpc.testnet.arc.network`,explorerUrl:`https://testnet.arcscan.app`,chainId:5042002},{network:`ethereum-sepolia`,rpcUrl:`https://ethereum-sepolia-rpc.publicnode.com`,explorerUrl:`https://sepolia.etherscan.io`,chainId:11155111}],relayer:{accountId:``,url:``,routes:{delegateAction:`/signed-delegate`}}},registration:{mode:`managed`,projectEnvironmentId:``,publishableKey:``,paymentMode:`disabled`,nearAccountProvisioning:{kind:`implicit_account`}},signing:{sessionDefaults:{ttlMs:u,remainingUses:3},emailOtp:{authPolicy:`session`},sessionPersistenceMode:`none`,sessionSeal:{mode:`none`},routerAb:{normalSigning:{mode:`disabled`}},routerAbEcdsaDerivation:{presignaturePool:C},thresholdEcdsa:{provisioningDefaults:{tempo:{enabled:!0,signingSession:{kind:`jwt`,ttlMs:u,remainingUses:3}},evm:{enabled:!0,signingSession:{kind:`jwt`,ttlMs:u,remainingUses:3}}}}},wallet:{mode:`iframe`,iframe:{origin:`https://wallet.example.localhost`,servicePath:`/wallet-service`,sdkBasePath:`/sdk`,walletHostVariant:`runtime`,rpIdOverride:`example.localhost`}},webauthn:{authenticatorOptions:{userVerification:b.Preferred,originPolicy:{single:void 0,all_subdomains:!0,multiple:void 0}}},ui:{appearance:{theme:{id:`default`,mode:`dark`,colors:{}},palette:`default`}}};async function re(e,t){let r=n(t,`ECDSA prepare response`);if(r.kind!==e.authorization.kind)throw Error(`ECDSA prepare authorization kind does not match the request`);let i=await h(e,r.signing);if(e.authorization.kind===`operation_step_up`){if(Object.keys(r).some(w))throw Error(`Invalid step-up prepare response`);return{kind:`operation_step_up`,signing:i}}if(Object.keys(r).some(ie))throw Error(`Invalid Wallet Session prepare response`);let a=n(r.session_status,`ECDSA prepare session status`),o=d(a.quotaId),s=f(e.authorization.wallet_session_id);if(!o.ok||!s.ok)throw Error(`Invalid prepare session identity`);let c=x(a,{walletSessionId:s.value,quotaId:o.value});if(!c||c.status!==`active`||c.authorization.walletId!==e.scope.wallet_id)throw Error(`ECDSA prepare did not return the admitted Wallet Session`);return{kind:`reusable_wallet_session`,signing:i,sessionStatus:c}}function w(e){return e!==`kind`&&e!==`signing`}function ie(e){return w(e)&&e!==`session_status`}var T=class extends Error{constructor(e){super(`Router A/B signing ${e.path} returned HTTP ${e.status}: ${e.message||e.code}`),this.name=`RouterAbSigningRequestError`,this.code=e.code,this.path=e.path,this.status=e.status}};function ae(e){let t=String(e.code||``).trim(),n=`Router A/B signing ${e.path} returned HTTP ${e.status}: ${e.message||t||`unknown admission failure`}`;if(e.authorizationDecision?.kind===`step_up_required`)return new S({kind:`exhausted`,source:`server_prepare`,detail:n},e.authorizationDecision);switch(t){case`wallet_budget_exhausted`:return new S({kind:`exhausted`,source:`server_prepare`,detail:n},e.authorizationDecision);case`wallet_budget_in_flight`:case`wallet_budget_reserved`:return new S({kind:`in_flight`,source:`server_prepare`,detail:n,retryAfterMs:150});default:return null}}function E(e,t){let n=Math.floor(Number(e));if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} must be a positive integer`);return n}function D(e,t,n){if(!Array.isArray(e))throw Error(`${t} must be a byte array`);let r=e.map(e=>Number(e));if(!r.every(e=>Number.isInteger(e)&&e>=0&&e<=255))throw Error(`${t} must contain bytes`);if(n!==void 0&&r.length!==n)throw Error(`${t} must contain ${n} bytes`);return r}function O(e,n){let r=t(e,n);if(c(r).length!==32)throw Error(`${n} must decode to 32 bytes`);return r}function k(e,n){let r=t(e,n);if(c(r).length===0)throw Error(`${n} must decode to non-empty bytes`);return r}function A(e,n){let r=t(e,n),i;try{i=l(r)}catch{i=c(r)}if(i.length!==32)throw Error(`${n} must decode to 32 bytes`);return s(i)}function j(e){return{bytes:[...D([...e],`digest bytes`,32)]}}function M(e,t){return s(Uint8Array.from(D(e.bytes,t)))}async function oe(t){return s(await Q(new TextEncoder().encode(e(t))))}function se(e){let n=t(e.message,`nep413.message`),r=t(e.recipient,`nep413.recipient`),i=c(A(e.nonce,`nep413.nonce`)),a=e.callbackUrl==null?void 0:t(e.callbackUrl,`callbackUrl`),o=[];return Z(o,2147484061),q(o,n),Y(o,i),q(o,r),a?(o.push(1),q(o,a)):o.push(0),s(Uint8Array.from(o))}async function ce(e){let n={scope:I(e.scope,`scope`),expires_at_ms:E(e.expiresAtMs,`expiresAtMs`),display_digest:j(c(O(e.displayDigestB64u,`displayDigestB64u`))),intent:{kind:`near_transaction_v1`,operation_id:t(e.operationId,`operationId`),operation_fingerprint:t(e.operationFingerprint,`operationFingerprint`),near_account_id:t(e.nearAccountId,`nearAccountId`),near_network_id:e.nearNetworkId,transactions:e.transactions.map((e,n)=>({receiver_id:t(e.receiverId,`transactions[${n}].receiverId`),action_fingerprint:t(e.actionFingerprint,`transactions[${n}].actionFingerprint`)})),unsigned_transaction_borsh_b64u:k(e.unsignedTransactionBorshB64u,`unsignedTransactionBorshB64u`)},signing_payload:{kind:`near_unsigned_transaction_borsh_v1`,unsigned_transaction_borsh_b64u:k(e.unsignedTransactionBorshB64u,`unsignedTransactionBorshB64u`),expected_signing_digest_b64u:O(e.expectedSigningDigestB64u,`expectedSigningDigestB64u`)}};return{request:n,admissionMaterial:await P(n)}}async function le(e){let n=A(e.nonce,`nonce`),r=e.callbackUrl==null?void 0:t(e.callbackUrl,`callbackUrl`),i=se({message:e.message,recipient:e.recipient,nonce:n,...r?{callbackUrl:r}:{}}),a={scope:I(e.scope,`scope`),expires_at_ms:E(e.expiresAtMs,`expiresAtMs`),display_digest:j(c(O(e.displayDigestB64u,`displayDigestB64u`))),intent:{kind:`nep413_v1`,operation_id:t(e.operationId,`operationId`),operation_fingerprint:t(e.operationFingerprint,`operationFingerprint`),near_account_id:t(e.nearAccountId,`nearAccountId`),near_network_id:e.nearNetworkId,recipient:t(e.recipient,`recipient`),message:t(e.message,`message`),nonce_b64u:n,...r?{callback_url:r}:{}},signing_payload:{kind:`nep413_message_v1`,canonical_message_b64u:i,expected_signing_digest_b64u:O(e.expectedSigningDigestB64u,`expectedSigningDigestB64u`)}};return{request:a,admissionMaterial:await P(a)}}async function ue(e){let n=k(e.delegate.canonicalDelegateBorshB64u,`canonicalDelegateBorshB64u`),r={scope:I(e.scope,`scope`),expires_at_ms:E(e.expiresAtMs,`expiresAtMs`),display_digest:j(c(O(e.displayDigestB64u,`displayDigestB64u`))),intent:{kind:`near_delegate_action_v1`,operation_id:t(e.operationId,`operationId`),operation_fingerprint:t(e.operationFingerprint,`operationFingerprint`),near_account_id:t(e.nearAccountId,`nearAccountId`),near_network_id:e.nearNetworkId,delegate:{sender_id:t(e.delegate.senderId,`delegate.senderId`),receiver_id:t(e.delegate.receiverId,`delegate.receiverId`),public_key:t(e.delegate.publicKey,`delegate.publicKey`),nonce:t(e.delegate.nonce,`delegate.nonce`),max_block_height:t(e.delegate.maxBlockHeight,`delegate.maxBlockHeight`),action_fingerprint:t(e.delegate.actionFingerprint,`delegate.actionFingerprint`),canonical_delegate_borsh_b64u:n}},signing_payload:{kind:`near_delegate_action_v1`,canonical_delegate_borsh_b64u:n,expected_signing_digest_b64u:O(e.expectedSigningDigestB64u,`expectedSigningDigestB64u`)}};return{request:r,admissionMaterial:await P(r)}}function N(e){let n=I(e.scope,`scope`),r={scope:n,expires_at_ms:E(e.expiresAtMs,`expiresAtMs`),prepare_binding:{server_round1_handle:t(e.prepareResponse.server_round1_handle,`server_round1_handle`),round1_binding_digest:L(e.prepareResponse.round1_binding_digest,`round1_binding_digest`),intent_digest:L(e.admissionMaterial.intentDigest,`intent_digest`),signing_payload_digest:L(e.admissionMaterial.signingPayloadDigest,`signing_payload_digest`)},protocol:{kind:`ed25519_two_party_frost_finalize_v1`,client_commitments:z(e.clientCommitments,`clientCommitments`),server_commitments:z(e.prepareResponse.server_commitments,`serverCommitments`),client_verifying_share_b64u:t(e.clientVerifyingShareB64u,`clientVerifyingShareB64u`),server_verifying_share_b64u:t(e.prepareResponse.server_verifying_share_b64u,`serverVerifyingShareB64u`),client_signature_share_b64u:t(e.clientSignatureShareB64u,`clientSignatureShareB64u`)}};if(n.authorization.kind===`reusable_wallet_session`&&e.prepareResponse.scope.authorization.kind===`reusable_wallet_session`)return{...r,scope:{...n,authorization:n.authorization},authorized_operation:V(e.prepareResponse.authorized_operation,`authorized_operation`)};if(n.authorization.kind===`operation_step_up`&&e.prepareResponse.scope.authorization.kind===`operation_step_up`)return{...r,scope:{...n,authorization:n.authorization},authorized_operation:H(e.prepareResponse.authorized_operation,`authorized_operation`)};throw Error(`Router A/B normal-signing authorization changed after prepare`)}async function P(e){let t=j(await Q(Se(e.intent))),n=j(await Q(Ce(e.signing_payload))),r=j(await Q(we(e.signing_payload))),i=c(Te(e.signing_payload));if(!De(r.bytes,i))throw Error(`Router A/B normal-signing expected signing digest drift`);return{intentDigest:t,signingPayloadDigest:n,admittedSigningDigest:r}}function F(e,t,n){let r=Object.keys(e).sort(),i=[...t].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${n} has invalid fields`)}function I(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);F(r,[`request_id`,`account_id`,`authorization`,`material_activation`,`signing_worker_id`],n);let i={request_id:t(r.request_id,`${n}.request_id`),account_id:t(r.account_id,`${n}.account_id`),authorization:p(r.authorization),material_activation:m(r.material_activation),signing_worker_id:t(r.signing_worker_id,`${n}.signing_worker_id`)};if(i.material_activation.signing_worker!==i.signing_worker_id)throw Error(`${n} material activation SigningWorker mismatch`);return i}function L(e,t){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`${t} must be an object`);return{bytes:D(n.bytes,`${t}.bytes`,32)}}function R(e,t){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`${t} must be an object`);let r=D(n.bytes,`${t}.bytes`);if(r.length===0)throw Error(`${t}.bytes must be non-empty`);return{bytes:r}}function z(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);return{hiding:t(r.hiding,`${n}.hiding`),binding:t(r.binding,`${n}.binding`)}}function B(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);return{server_id:t(r.server_id,`${n}.server_id`),key_epoch:t(r.key_epoch,`${n}.key_epoch`),recipient_encryption_key:t(r.recipient_encryption_key,`${n}.recipient_encryption_key`)}}function V(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);F(r,[`kind`,`authorized_operation_id`,`operation_id`,`capability_kind`,`operation_kind`,`lane_digest_b64u`,`intent_digest_b64u`,`display_digest_b64u`,`operation_fingerprint_digest`],n);let i=t(r.kind,`${n}.kind`);if(i!==`reusable_wallet_session_authorized_operation_v1`)throw Error(`${n}.kind is invalid`);let a=t(r.capability_kind,`${n}.capability_kind`);if(a!==`near_ed25519_mpc_signing`)throw Error(`${n}.capability_kind is invalid`);let o=t(r.operation_kind,`${n}.operation_kind`);if(o!==`near.sign_transaction`&&o!==`near.sign_delegate_action`&&o!==`near.sign_nep413_message`)throw Error(`${n}.operation_kind is invalid`);return{kind:i,authorized_operation_id:t(r.authorized_operation_id,`${n}.authorized_operation_id`),operation_id:t(r.operation_id,`${n}.operation_id`),capability_kind:a,operation_kind:o,lane_digest_b64u:O(r.lane_digest_b64u,`${n}.lane_digest_b64u`),intent_digest_b64u:O(r.intent_digest_b64u,`${n}.intent_digest_b64u`),display_digest_b64u:O(r.display_digest_b64u,`${n}.display_digest_b64u`),operation_fingerprint_digest:O(r.operation_fingerprint_digest,`${n}.operation_fingerprint_digest`)}}function H(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);if(F(r,[`kind`,`authorization_session_id`,`evidence_set_digest`,`authorized_operation_id`,`operation_id`,`capability_kind`,`operation_kind`,`lane_digest_b64u`,`intent_digest_b64u`,`display_digest_b64u`,`operation_fingerprint_digest`],n),t(r.kind,`${n}.kind`)!==`verified_step_up_authorized_operation_v1`)throw Error(`${n}.kind is invalid`);if(t(r.capability_kind,`${n}.capability_kind`)!==`near_ed25519_mpc_signing`)throw Error(`${n}.capability_kind is invalid`);let i=t(r.operation_kind,`${n}.operation_kind`);if(i!==`near.sign_transaction`&&i!==`near.sign_delegate_action`&&i!==`near.sign_nep413_message`)throw Error(`${n}.operation_kind is invalid`);return{kind:`verified_step_up_authorized_operation_v1`,authorization_session_id:t(r.authorization_session_id,`${n}.authorization_session_id`),evidence_set_digest:O(r.evidence_set_digest,`${n}.evidence_set_digest`),authorized_operation_id:t(r.authorized_operation_id,`${n}.authorized_operation_id`),operation_id:t(r.operation_id,`${n}.operation_id`),capability_kind:`near_ed25519_mpc_signing`,operation_kind:i,lane_digest_b64u:O(r.lane_digest_b64u,`${n}.lane_digest_b64u`),intent_digest_b64u:O(r.intent_digest_b64u,`${n}.intent_digest_b64u`),display_digest_b64u:O(r.display_digest_b64u,`${n}.display_digest_b64u`),operation_fingerprint_digest:O(r.operation_fingerprint_digest,`${n}.operation_fingerprint_digest`)}}function U(e){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`Router A/B normal-signing prepare response must be an object`);let r=t(n.signature_scheme,`signature_scheme`);if(r!==`ed25519_v1`)throw Error(`Unsupported Router A/B normal-signing signature scheme: ${r}`);let i=I(n.scope,`scope`),a={scope:i,signing_payload_digest:L(n.signing_payload_digest,`signing_payload_digest`),round1_binding_digest:L(n.round1_binding_digest,`round1_binding_digest`),signing_worker:B(n.signing_worker,`signing_worker`),server_round1_handle:t(n.server_round1_handle,`server_round1_handle`),server_commitments:z(n.server_commitments,`server_commitments`),server_verifying_share_b64u:t(n.server_verifying_share_b64u,`server_verifying_share_b64u`),signature_scheme:`ed25519_v1`,prepared_at_ms:E(n.prepared_at_ms,`prepared_at_ms`),expires_at_ms:E(n.expires_at_ms,`expires_at_ms`)};switch(i.authorization.kind){case`reusable_wallet_session`:return F(n,[`scope`,`signing_payload_digest`,`round1_binding_digest`,`signing_worker`,`server_round1_handle`,`server_commitments`,`server_verifying_share_b64u`,`signature_scheme`,`prepared_at_ms`,`expires_at_ms`,`authorized_operation`],`Router A/B reusable Wallet Session prepare response`),{...a,scope:{...i,authorization:i.authorization},authorized_operation:V(n.authorized_operation,`authorized_operation`)};case`operation_step_up`:return F(n,[`scope`,`signing_payload_digest`,`round1_binding_digest`,`signing_worker`,`server_round1_handle`,`server_commitments`,`server_verifying_share_b64u`,`signature_scheme`,`prepared_at_ms`,`expires_at_ms`,`authorized_operation`],`Router A/B operation step-up prepare response`),{...a,scope:{...i,authorization:i.authorization},authorized_operation:H(n.authorized_operation,`authorized_operation`)}}}function de(e){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`Router A/B normal-signing response must be an object`);F(n,[`scope`,`signing_payload_digest`,`signing_worker`,`signature_scheme`,`signature`,`signed_at_ms`],`Router A/B normal-signing response`);let r=t(n.signature_scheme,`signature_scheme`);if(r!==`ed25519_v1`)throw Error(`Unsupported Router A/B normal-signing signature scheme: ${r}`);return{scope:I(n.scope,`scope`),signing_payload_digest:L(n.signing_payload_digest,`signing_payload_digest`),signing_worker:B(n.signing_worker,`signing_worker`),signature_scheme:`ed25519_v1`,signature:R(n.signature,`signature`),signed_at_ms:E(n.signed_at_ms,`signed_at_ms`)}}function fe(e){let t=e.credential.kind===`wallet_session_opaque`?{token:e.credential.walletSessionToken,home:e.credential.home}:null;return i({...t?{headers:o(t)}:{},body:e.body})}function pe(e){if(!e.trim())return null;try{let t=JSON.parse(e),n=t&&typeof t==`object`?t:null;if(!n)return null;let r=String(n.code||``).trim(),i=String(n.message||``).trim();if(!r)return null;let a=n.authorization_decision===void 0?void 0:me(n.authorization_decision);return{code:r,message:i,...a?{authorizationDecision:a}:{}}}catch{return null}}function me(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`Router A/B owner-operation authorization decision is invalid`);let t=e,n=t.kind;if(n===`step_up_required`){W(t,[`kind`,`reason`,`step_up`],`owner-operation step-up decision`);let e=t.reason;if(e!==`wallet_session_missing`&&e!==`wallet_session_expired`&&e!==`wallet_session_exhausted`&&e!==`wallet_session_ended`&&e!==`wallet_session_superseded`)throw Error(`owner-operation step-up decision reason is invalid`);let r=t.step_up;return r&&typeof r==`object`&&!Array.isArray(r)&&`operation_digests`in r?{kind:n,reason:e,step_up:_(r)}:{kind:n,reason:e,step_up:he(r)}}if(n===`denied`){if(W(t,[`kind`,`denial`],`owner-operation denial decision`),!t.denial||typeof t.denial!=`object`||Array.isArray(t.denial))throw Error(`owner-operation denial is invalid`);let e=t.denial;W(e,[`code`,`message`],`owner-operation denial`);let r=e.code;if(r!==`invalid_identity`&&r!==`invalid_authority`&&r!==`invalid_operation`&&r!==`inactive_material`&&r!==`replayed_step_up`&&r!==`authorization_unavailable`)throw Error(`owner-operation denial code is invalid`);if(typeof e.message!=`string`||e.message.trim()!==e.message)throw Error(`owner-operation denial message is invalid`);return{kind:n,denial:{code:r,message:e.message}}}if(n===`authorized`){if(W(t,[`kind`,`operation`,`source`],`owner-operation decision`),!t.operation||typeof t.operation!=`object`||Array.isArray(t.operation))throw Error(`owner-operation authorized operation is invalid`);let e=t.operation;if(W(e,[`kind`,`operation_id`,`authorized_operation_id`,`operation_fingerprint_digest`],`owner-operation authorized operation`),e.kind!==`authorized_operation`||typeof e.operation_id!=`string`||typeof e.authorized_operation_id!=`string`||typeof e.operation_fingerprint_digest!=`string`)throw Error(`owner-operation authorized operation is invalid`);if(!t.source||typeof t.source!=`object`||Array.isArray(t.source))throw Error(`owner-operation authorized source is invalid`);let r=t.source;if(W(r,[`kind`,`wallet_session_id`,`quota_id`],`owner-operation authorized source`),r.kind!==`reusable_wallet_session`||typeof r.wallet_session_id!=`string`||typeof r.quota_id!=`string`)throw Error(`owner-operation authorized source is invalid`);return{kind:n,operation:{kind:`authorized_operation`,operation_id:e.operation_id,authorized_operation_id:e.authorized_operation_id,operation_fingerprint_digest:e.operation_fingerprint_digest},source:{kind:`reusable_wallet_session`,wallet_session_id:r.wallet_session_id,quota_id:r.quota_id}}}throw Error(`owner-operation authorization decision kind is invalid`)}function he(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`Ed25519 operation step-up preparation is invalid`);let t=e;W(t,[`wallet_id`,`operation_kind`,`operation_id`,`request_id`,`account_id`,`material_activation`,`signing_worker_id`,`near_account_id`,`signer_slot`,`participant_ids`,`expires_at_ms`],`Ed25519 owner-operation step-up preparation`);let n=t.operation_kind;if(n!==`near.sign_transaction`&&n!==`near.sign_delegate_action`&&n!==`near.sign_nep413_message`)throw Error(`Ed25519 operation step-up kind is invalid`);if(typeof t.wallet_id!=`string`||typeof t.operation_id!=`string`||typeof t.request_id!=`string`||typeof t.account_id!=`string`||typeof t.signing_worker_id!=`string`||typeof t.near_account_id!=`string`||!Number.isSafeInteger(t.signer_slot)||!Number.isSafeInteger(t.expires_at_ms)||!Array.isArray(t.participant_ids)||t.participant_ids.length!==2||!t.participant_ids.every(e=>Number.isSafeInteger(e)&&Number(e)>0))throw Error(`Ed25519 operation step-up preparation fields are invalid`);let[r,i]=t.participant_ids,a=t.signer_slot,o=t.expires_at_ms;if(typeof r!=`number`||typeof i!=`number`||typeof a!=`number`||typeof o!=`number`)throw Error(`Ed25519 operation step-up participants are invalid`);return{wallet_id:t.wallet_id,operation_kind:n,operation_id:t.operation_id,request_id:t.request_id,account_id:t.account_id,material_activation:m(t.material_activation),signing_worker_id:t.signing_worker_id,near_account_id:t.near_account_id,signer_slot:a,participant_ids:[r,i],expires_at_ms:o}}function W(e,t,n){let r=new Set(t);for(let t of Object.keys(e))if(!r.has(t))throw Error(`${n} contains unsupported field ${t}`);for(let r of t)if(!Object.hasOwn(e,r))throw Error(`${n} is missing ${r}`)}function ge(e){let t=pe(e.bodyText);return t?ae({code:t.code,message:t.message,path:e.path,status:e.status,authorizationDecision:t.authorizationDecision})||te({code:t.code,message:`Router A/B signing ${e.path} returned HTTP ${e.status}: ${t.message}`})||new T({code:t.code,message:t.message,path:e.path,status:e.status}):Error(`Router A/B signing ${e.path} returned HTTP ${e.status}${e.bodyText?`: ${e.bodyText}`:``}`)}async function G(e){if(typeof fetch!=`function`)throw Error(`fetch is not available for Router A/B normal-signing request`);let n=a(t(e.relayServerUrl,`relayServerUrl`)),i=await r(new Request(`${n}${e.path}`,{...fe({credential:e.credential,body:e.body}),signal:e.signal}));try{e.onServerTiming?.(i.headers.get(`Server-Timing`))}catch{}if(!i.ok){let t=await i.text().catch(()=>``),n=ge({path:e.path,status:i.status,bodyText:t});throw e.credential.kind===`wallet_session_opaque`&&n instanceof S&&n.failure.kind===`exhausted`&&ee.forgetCredential(e.credential.walletSessionToken),n}return e.parse(await i.json())}function _e(e,t){let r=n(t,`Ed25519 prepare response`);if(r.kind!==e.scope.authorization.kind)throw Error(`Ed25519 prepare authorization kind does not match the request`);let i=U(r.signing);if(e.scope.authorization.kind===`operation_step_up`)return W(r,[`kind`,`signing`],`Ed25519 step-up prepare response`),{kind:`operation_step_up`,signing:i};W(r,[`kind`,`signing`,`session_status`],`Ed25519 session prepare response`);let a=n(r.session_status,`Ed25519 prepare session status`),o=f(e.scope.authorization.wallet_session_id),s=d(a.quotaId);if(!o.ok||!s.ok)throw Error(`Invalid Ed25519 prepare session identity`);let c=x(a,{walletSessionId:o.value,quotaId:s.value});if(!c||c.status!==`active`)throw Error(`Ed25519 prepare did not return an active Wallet Session`);return{kind:`reusable_wallet_session`,signing:i,sessionStatus:c}}async function ve(e){return G({relayServerUrl:e.relayServerUrl,path:`/router-ab/ed25519/sign/prepare`,credential:e.credential,body:e.request,parse:_e.bind(null,e.request)})}async function ye(e){return await y(e.request),G({relayServerUrl:e.relayServerUrl,path:`/router-ab/ecdsa-derivation/sign/prepare`,onServerTiming:e.onServerTiming,credential:e.credential,body:e.request,parse:re.bind(null,e.request)})}async function be(e){return G({relayServerUrl:e.relayServerUrl,path:`/router-ab/ed25519/sign`,credential:e.credential,body:e.request,parse:de})}async function xe(e){return await v(e.request),G({relayServerUrl:e.relayServerUrl,path:`/router-ab/ecdsa-derivation/sign`,onServerTiming:e.onServerTiming,credential:e.credential,body:e.request,parse:t=>g(e.request,t)})}function Se(e){let t=[];switch(J(t,$(`router-ab-protocol/ed25519-normal-signing/intent/v2`)),e.kind){case`near_transaction_v1`:J(t,$(`near_transaction_v1`)),K(t,e),X(t,e.transactions.length);for(let n of e.transactions)J(t,$(n.receiver_id)),J(t,$(n.action_fingerprint));return J(t,$(e.unsigned_transaction_borsh_b64u)),Uint8Array.from(t);case`nep413_v1`:return J(t,$(`nep413_v1`)),K(t,e),J(t,$(e.recipient)),J(t,$(e.message)),J(t,$(e.nonce_b64u)),Ee(t,e.callback_url),Uint8Array.from(t);case`near_delegate_action_v1`:return J(t,$(`near_delegate_action_v1`)),K(t,e),J(t,$(e.delegate.sender_id)),J(t,$(e.delegate.receiver_id)),J(t,$(e.delegate.public_key)),J(t,$(e.delegate.nonce)),J(t,$(e.delegate.max_block_height)),J(t,$(e.delegate.action_fingerprint)),J(t,$(e.delegate.canonical_delegate_borsh_b64u)),Uint8Array.from(t)}}function Ce(e){let t=[];switch(J(t,$(`router-ab-protocol/ed25519-normal-signing/payload/v2`)),e.kind){case`near_unsigned_transaction_borsh_v1`:return J(t,$(`near_unsigned_transaction_borsh_v1`)),J(t,$(e.unsigned_transaction_borsh_b64u)),J(t,$(e.expected_signing_digest_b64u)),Uint8Array.from(t);case`nep413_message_v1`:return J(t,$(`nep413_message_v1`)),J(t,$(e.canonical_message_b64u)),J(t,$(e.expected_signing_digest_b64u)),Uint8Array.from(t);case`near_delegate_action_v1`:return J(t,$(`near_delegate_action_v1`)),J(t,$(e.canonical_delegate_borsh_b64u)),J(t,$(e.expected_signing_digest_b64u)),Uint8Array.from(t)}}function we(e){switch(e.kind){case`near_unsigned_transaction_borsh_v1`:return c(e.unsigned_transaction_borsh_b64u);case`nep413_message_v1`:return c(e.canonical_message_b64u);case`near_delegate_action_v1`:return c(e.canonical_delegate_borsh_b64u)}}function Te(e){switch(e.kind){case`near_unsigned_transaction_borsh_v1`:case`nep413_message_v1`:case`near_delegate_action_v1`:return e.expected_signing_digest_b64u}}function K(e,t){J(e,$(t.operation_id)),J(e,$(t.operation_fingerprint)),J(e,$(t.near_account_id)),J(e,$(t.near_network_id))}function Ee(e,t){t?(e.push(1),J(e,$(t))):e.push(0)}function q(e,t){let n=$(t);Z(e,n.length),Y(e,n)}function J(e,t){X(e,t.length),Y(e,t)}function Y(e,t){for(let n of t)e.push(n)}function X(e,t){e.push(t>>>24&255,t>>>16&255,t>>>8&255,t&255)}function Z(e,t){e.push(t&255,t>>>8&255,t>>>16&255,t>>>24&255)}async function Q(e){let t=globalThis.crypto?.subtle;if(!t)throw Error(`Web Crypto SHA-256 is unavailable for Router A/B normal signing`);let n=new Uint8Array(e.length);return n.set(e),new Uint8Array(await t.digest(`SHA-256`,n.buffer))}function $(e){return new TextEncoder().encode(e)}function De(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}export{N as a,ye as c,oe as d,C as f,le as i,ve as l,ue as n,xe as o,ne as p,ce as r,be as s,T as t,M as u};