@seams/wallet 0.13.0 → 0.14.0

package/dist/public/sdk/{registrationAccounts-DP-32yCK.js → registrationAccounts-BQMUusdD.js}

@@ -1 +1 @@
-import"./accountIds-BzZs7YoX.js";import"./registrationSignerPlan-dY9Rp0m_.js";import"./signerDomain-DqLCvI-D.js";import{O as e,T as t,_ as n,a as r,b as i,c as a,g as o,i as s,k as c,l,o as u,r as d,s as f,t as p,v as m,w as h,x as g,y as _}from"./accountLifecycle-HEUmDLus.js";import"./registrationIds-ByuReLUc.js";function v(v){return{storeUserData:async e=>{await g(v,e)},getAllUsers:()=>s(v),getUserBySignerSlot:(e,t)=>u(v,e,t),getLastUser:()=>r(v),nearAuthenticatorsByAccount:e=>l(v,e),setLastUser:(e,t)=>m(v,e,t),activateAuthenticatedWalletState:e=>p(v,e),setWalletNearProvisioningState:e=>_(v,e),getWalletNearProvisioningState:e=>f(v,e),storeAuthenticator:e=>i(v,e),rollbackUserRegistration:e=>o(v,e),hasPasskeyCredential:e=>a(v,e),storeWalletEd25519RegistrationData:e=>t(v,e),storeWalletEd25519RecoveryRegistrationData:e=>h(v,e),storeWalletEmailOtpEd25519RegistrationData:t=>e(v,t),storeWalletEmailOtpMixedRegistrationData:e=>c(v,e),finalizeWalletEd25519SignerRegistration:e=>d(v,e),rollbackWalletEd25519SignerRegistration:e=>n(v,e)}}export{v as createRegistrationAccountsService};
+import"./accountIds-Cpvlkvbe.js";import"./registrationSignerPlan-CPzHavPM.js";import"./signerDomain-Dp7BhfmZ.js";import{O as e,T as t,_ as n,a as r,b as i,c as a,g as o,i as s,k as c,l,o as u,r as d,s as f,t as p,v as m,w as h,x as g,y as _}from"./accountLifecycle-CBOkr0vU.js";import"./registrationIds-BaK3jUS6.js";function v(v){return{storeUserData:async e=>{await g(v,e)},getAllUsers:()=>s(v),getUserBySignerSlot:(e,t)=>u(v,e,t),getLastUser:()=>r(v),nearAuthenticatorsByAccount:e=>l(v,e),setLastUser:(e,t)=>m(v,e,t),activateAuthenticatedWalletState:e=>p(v,e),setWalletNearProvisioningState:e=>_(v,e),getWalletNearProvisioningState:e=>f(v,e),storeAuthenticator:e=>i(v,e),rollbackUserRegistration:e=>o(v,e),hasPasskeyCredential:e=>a(v,e),storeWalletEd25519RegistrationData:e=>t(v,e),storeWalletEd25519RecoveryRegistrationData:e=>h(v,e),storeWalletEmailOtpEd25519RegistrationData:t=>e(v,t),storeWalletEmailOtpMixedRegistrationData:e=>c(v,e),finalizeWalletEd25519SignerRegistration:e=>d(v,e),rollbackWalletEd25519SignerRegistration:e=>n(v,e)}}export{v as createRegistrationAccountsService};

package/dist/{esm/sdk/registrationIntent-BHU5k2Q-.js → public/sdk/registrationIntent-090Zj7Iu.js}

@@ -1 +1 @@
-import{D as e,M as t,O as n,T as r,d as i,h as a,k as o,l as s,r as c,u as l}from"./domainIds-BzkGsRqO.js";import{C as u,D as ee,E as te,c as d,d as ne,k as f,u as re}from"./chains-C_X_fNuS.js";import{_ as p,d as ie,g as m,i as ae,l as h,n as oe,r as se,t as ce}from"./primitives-CqrjmIAH.js";import{i as g,r as _}from"./base64-DW79QA0h.js";import{n as le}from"./secureRandomId-LwBFx84B.js";import{A as v,C as ue,D as de,E as y,O as b,S as x,T as fe,_ as S,b as C,c as w,d as T,f as pe,g as E,h as D,l as O,m as k,n as me,o as he,p as ge,s as _e,u as A,v as ve,w as ye,x as j,y as M}from"./activeWalletSession-WdZkhtBB.js";import{d as be,f as xe,h as Se,m as Ce,p as we}from"./capabilityKinds-N8xo_IEh.js";import{a as Te,o as N,r as P}from"./canonicalPrimitives-Dsbsxgxc.js";import{i as Ee,n as De,t as Oe}from"./registrationAuthMethodInput-BBCeWDmw.js";import{a as ke}from"./registrationSignerPlan-dY9Rp0m_.js";import{a as Ae,t as je}from"./singletons-8UH3gOnZ.js";import{d as Me,f as Ne}from"./walletAuthority-BWvfaKIX.js";import{en as Pe,rn as Fe}from"./emailOtpEcdsaDerivationIdentity-p0C1CQva.js";import{A as Ie,L as Le,M as Re,N as ze,Y as Be,_ as Ve,f as He,h as Ue,j as We,p as Ge}from"./challengeDelivery-5lIu9spR.js";import{a as F,i as Ke,n as I,o as qe,r as Je,s as Ye,t as L}from"./digestEncoding-CkUc5vtR.js";import{r as Xe}from"./walletAuthMethodRecord-CnBw27ED.js";function Ze(e){return typeof e==`string`&&/^wreg_[A-Za-z0-9_-]{43}$/u.test(e)?e:null}function Qe(){return`wreg_${le(32)}`}const $e=`wallet_registration_setup:`;function et(e,t){return`${$e}${e}:${t}`}function tt(e){if(!u(e)||!u(e.value))throw Error(`Registration setup journal is invalid`);let t=e.value,r=ee(t.scopeDigest,`Registration setup scope digest`),i=ee(t.requestDigest,`Registration setup request digest`),a=Ze(t.operationId);if(!a||!/^[a-f0-9]{64}$/u.test(r)||!/^[a-f0-9]{64}$/u.test(i)||e.key!==et(r,i))throw Error(`Registration setup journal scope is invalid`);if(t.state===`pending`&&!(`walletId`in t)&&!(`registrationCeremonyId`in t))return{state:`pending`,operationId:a,scopeDigest:r,requestDigest:i};if(t.state===`accepted`){let e=n(t.walletId);if(e.ok)return{state:`accepted`,operationId:a,scopeDigest:r,requestDigest:i,walletId:e.value,registrationCeremonyId:ee(t.registrationCeremonyId,`Registration setup ceremony`)}}throw Error(`Registration setup journal state is invalid`)}async function nt(e){return ne(d({relayerUrl:e.relayerUrl.replace(/\/+$/u,``),publishableKey:e.publishableKey,environmentId:e.environmentId}))}function rt(){}var it=class{constructor(e){this.manager=e}async begin(e,t){let n=await ne(d(t)),r=et(e,n),i={state:`pending`,operationId:Qe(),scopeDigest:e,requestDigest:n},a=(await this.manager.getDB()).transaction(Ae.appState,`readwrite`),o=await a.store.get(r),s=o===void 0?i:tt(o);return o===void 0&&await a.store.put({key:r,value:s}),await a.done,s}async accept(e,t){let n=et(e.scopeDigest,e.requestDigest),r=(await this.manager.getDB()).transaction(Ae.appState,`readwrite`),i=tt(await r.store.get(n));if(i.operationId!==e.operationId||i.state===`accepted`&&(i.walletId!==t.walletId||i.registrationCeremonyId!==t.registrationCeremonyId))throw r.abort(),await r.done.catch(rt),Error(`Registration setup response changed its operation, wallet or ceremony`);let a={state:`accepted`,operationId:i.operationId,scopeDigest:i.scopeDigest,requestDigest:i.requestDigest,walletId:t.walletId,registrationCeremonyId:t.registrationCeremonyId};await r.store.put({key:n,value:a}),await r.done}async complete(e){let t=(await this.manager.getDB()).transaction(Ae.appState,`readwrite`),n=(await t.store.getAll(IDBKeyRange.bound($e,`${$e}\uffff`))).map(tt);for(let r of n)r.state===`accepted`&&r.walletId===e.walletId&&r.registrationCeremonyId===e.registrationCeremonyId&&await t.store.delete(et(r.scopeDigest,r.requestDigest));await t.done}};const at=new it(je);function ot(e){throw Error(`[LinkSessionStateV1] unsupported state: ${String(e)}`)}const st=`x25519-hkdf-sha256-chacha20poly1305-v1`,ct=/^[A-Za-z0-9_-]+$/,lt=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`registeredAtMs`],ut=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`ephemeralPublicKeyB64u`,`nonceB64u`,`sealedExportRootB64u`,`bindingDigestB64u`,`ciphertextDigestB64u`,`sealedAtMs`];function dt(e,t=`recipientPublicKeyB64u`){if(typeof e!=`string`||!ct.test(e))throw Error(`${t} must be unpadded base64url`);let n;try{n=_(e)}catch{throw Error(`${t} must be valid base64url`)}if(g(n)!==e)throw Error(`${t} must be canonical base64url`);if(n.length!==32)throw Error(`${t} must decode to a 32-byte X25519 public key`);return e}function ft(e){return{linkSessionId:e.linkSessionId,walletId:e.walletId,walletKeyId:e.walletKeyId,targetFactor:e.targetFactor,enrollmentId:e.enrollmentId,deviceId:e.deviceId,revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:e.applicationBindingDigestB64u,registeredPublicKeyB64u:e.registeredPublicKeyB64u,recipientPublicKeyB64u:e.recipientPublicKeyB64u}}function pt(e){return JSON.stringify({linkSessionId:String(e.linkSessionId),walletId:String(e.walletId),walletKeyId:String(e.walletKeyId),targetFactor:e.targetFactor,enrollmentId:String(e.enrollmentId),deviceId:String(e.deviceId),revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:String(e.applicationBindingDigestB64u),registeredPublicKeyB64u:String(e.registeredPublicKeyB64u),recipientPublicKeyB64u:String(e.recipientPublicKeyB64u)})}function mt(e){let t=_t(e,lt,`LinkedDeviceEd25519ExportRootRecipientV1`);if(t.kind!==`linked_device_ed25519_export_root_recipient_v1`)throw Error(`LinkedDeviceEd25519ExportRootRecipientV1.kind is invalid`);return vt(t.transferAlg,`LinkedDeviceEd25519ExportRootRecipientV1.transferAlg`),{kind:`linked_device_ed25519_export_root_recipient_v1`,linkSessionId:h(s(t.linkSessionId),`LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId`),walletId:h(n(t.walletId),`walletId`),walletKeyId:h(o(t.walletKeyId),`walletKeyId`),enrollmentId:h(l(t.enrollmentId),`enrollmentId`),deviceId:h(i(t.deviceId),`deviceId`),transferAlg:st,applicationBindingDigestB64u:ce(t.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:oe(t.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:gt(t.targetFactor),revocationEpoch:yt(t.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:dt(t.recipientPublicKeyB64u,`recipientPublicKeyB64u`),registeredAtMs:bt(t.registeredAtMs,`registeredAtMs`)}}function ht(e){let t=_t(e,ut,`LinkedDeviceEd25519ExportRootPackageV1`);if(t.kind!==`linked_device_ed25519_export_root_package_v1`)throw Error(`LinkedDeviceEd25519ExportRootPackageV1.kind is invalid`);vt(t.transferAlg,`LinkedDeviceEd25519ExportRootPackageV1.transferAlg`);let r=dt(t.recipientPublicKeyB64u,`recipientPublicKeyB64u`),a=dt(t.ephemeralPublicKeyB64u,`ephemeralPublicKeyB64u`);if(r===a)throw Error(`ephemeralPublicKeyB64u repeats the recipient key`);return{kind:`linked_device_ed25519_export_root_package_v1`,linkSessionId:h(s(t.linkSessionId),`linkSessionId`),walletId:h(n(t.walletId),`walletId`),walletKeyId:h(o(t.walletKeyId),`walletKeyId`),enrollmentId:h(l(t.enrollmentId),`enrollmentId`),deviceId:h(i(t.deviceId),`deviceId`),transferAlg:st,applicationBindingDigestB64u:ce(t.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:oe(t.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:gt(t.targetFactor),revocationEpoch:yt(t.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:r,ephemeralPublicKeyB64u:a,nonceB64u:ae(t.nonceB64u,`nonceB64u`),sealedExportRootB64u:se(t.sealedExportRootB64u,`sealedExportRootB64u`),bindingDigestB64u:ce(t.bindingDigestB64u,`bindingDigestB64u`),ciphertextDigestB64u:ce(t.ciphertextDigestB64u,`ciphertextDigestB64u`),sealedAtMs:bt(t.sealedAtMs,`sealedAtMs`)}}function gt(e){switch(_t(e,[`kind`],`targetFactor`).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`targetFactor.kind is unsupported`)}}function _t(e,t,n){let r=f(e,n);p(r,t,n);for(let e of t)if(r[e]===void 0)throw Error(`${n}.${e} is required`);return r}function vt(e,t){if(e!==`x25519-hkdf-sha256-chacha20poly1305-v1`)throw Error(`${t} must be ${st}`)}function yt(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function bt(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive unix-millisecond timestamp`);return e}function R(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);return e}function z(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} must not be empty`);if(n!==e)throw Error(`${t} must not be padded with whitespace`);return n}function xt(e,n){let r=t(z(e,n));if(!r.ok)throw Error(`${n} is invalid: ${r.error.message}`);return r.value}function B(e,t,n){if(e!==t)throw Error(`${n} must be ${String(t)}`);return t}function St(e){let t=`WalletAddAuthMethodRegistrationOptions`,n=R(e,t);B(n.kind,`webauthn_add_auth_method_registration_v1`,`${t}.kind`);let r=R(n.user,`${t}.user`),i=R(n.authenticatorSelection,`${t}.authenticatorSelection`),a=R(R(R(n.extensions,`${t}.extensions`).prf,`${t}.extensions.prf`).eval,`${t}.extensions.prf.eval`);if(!Array.isArray(n.pubKeyCredParams)||n.pubKeyCredParams.length!==2)throw Error(`${t}.pubKeyCredParams must list exactly two algorithms`);let[o,s]=n.pubKeyCredParams;if(B(R(o,`${t}.pubKeyCredParams[0]`).type,`public-key`,`${t}.pubKeyCredParams[0].type`),B(R(o,`${t}.pubKeyCredParams[0]`).alg,-7,`${t}.pubKeyCredParams[0].alg`),B(R(s,`${t}.pubKeyCredParams[1]`).type,`public-key`,`${t}.pubKeyCredParams[1].type`),B(R(s,`${t}.pubKeyCredParams[1]`).alg,-257,`${t}.pubKeyCredParams[1].alg`),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);let c=n.excludeCredentials.map((e,n)=>{let r=R(e,`${t}.excludeCredentials[${n}]`);return{type:B(r.type,`public-key`,`${t}.excludeCredentials[${n}].type`),id:z(r.id,`${t}.excludeCredentials[${n}].id`)}}),l=n.timeoutMs;if(typeof l!=`number`||!Number.isSafeInteger(l)||l<=0)throw Error(`${t}.timeoutMs must be a positive safe integer`);return{kind:`webauthn_add_auth_method_registration_v1`,challengeId:z(n.challengeId,`${t}.challengeId`),challengeB64u:z(n.challengeB64u,`${t}.challengeB64u`),rpId:xt(n.rpId,`${t}.rpId`),user:{idB64u:z(r.idB64u,`${t}.user.idB64u`),name:z(r.name,`${t}.user.name`),displayName:z(r.displayName,`${t}.user.displayName`)},pubKeyCredParams:[{type:`public-key`,alg:-7},{type:`public-key`,alg:-257}],authenticatorSelection:{residentKey:B(i.residentKey,`required`,`${t}.authenticatorSelection.residentKey`),userVerification:B(i.userVerification,`preferred`,`${t}.authenticatorSelection.userVerification`)},timeoutMs:l,attestation:B(n.attestation,`none`,`${t}.attestation`),extensions:{prf:{eval:{firstB64u:z(a.firstB64u,`${t}.extensions.prf.eval.firstB64u`),secondB64u:z(a.secondB64u,`${t}.extensions.prf.eval.secondB64u`)}}},excludeCredentials:c}}function Ct(e){let t=Mt(e);if(t.kind!==`committed_authority_packages_v1`)throw Error(`CommittedAuthorityPackagesV1.kind is invalid`);let n=Me(t.authority);if(!n.ok||n.value.state!==`pending_local_install`)throw Error(`CommittedAuthorityPackagesV1.authority is not pending`);let r=Xe(t.authMethod);if(!r||r.status!==`pending_local_install`)throw Error(`CommittedAuthorityPackagesV1.authMethod is not pending`);if(r.walletId!==n.value.walletId||r.walletAuthorityId!==n.value.authorityId)throw Error(`CommittedAuthorityPackagesV1 authority and auth method identities differ`);let i=Tt(t.signerPackages);wt(i,n.value.signerActivations);let a=t.ed25519ExportRootPackage===null?null:ht(t.ed25519ExportRootPackage);if(a&&(a.walletId!==n.value.walletId||a.revocationEpoch!==n.value.revocationEpoch||n.value.provenance.kind!==`device_link`||a.enrollmentId!==n.value.provenance.enrollmentId||a.linkSessionId!==n.value.provenance.linkSessionId||String(a.deviceId)!==String(n.value.principal.deviceId)))throw Error(`CommittedAuthorityPackagesV1 export root identity does not match authority`);return{kind:`committed_authority_packages_v1`,authority:n.value,authMethod:r,signerPackages:i,ed25519ExportRootPackage:a,packageSetDigestB64u:Et(t.packageSetDigestB64u)}}function wt(e,t){if(e.keyFamilies.length!==t.keyFamilies.length)throw Error(`CommittedAuthorityPackagesV1 signer families do not match authority`);for(let n=0;n<e.keyFamilies.length;n+=1)if(e.keyFamilies[n]!==t.keyFamilies[n])throw Error(`CommittedAuthorityPackagesV1 signer family order does not match authority`);if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`){if(!t.ed25519||!e.ed25519)throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation is missing`);if(!c(e.ed25519.materialActivation,t.ed25519.materialActivation))throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation does not match authority`);return}if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`){if(!t.ecdsa||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 ECDSA activation is missing`);if(!c(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 ECDSA activation does not match authority`);return}if(!t.ed25519||!t.ecdsa||!e.ed25519||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 combined activations are incomplete`);if(!c(e.ed25519.materialActivation,t.ed25519.materialActivation)||!c(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 activation references do not match authority`)}function Tt(e){let t=Nt(e);if(t.kind!==`committed_signer_package_set_v1`)throw Error(`CommittedSignerPackageSetV1.kind is invalid`);let n=jt(t.keyFamilies);if(n.length===1&&n[0]===`ed25519`){if(!(`ed25519`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:Dt(t.ed25519)}}if(n.length===1&&n[0]===`ecdsa_secp256k1`){if(!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ecdsa:Ot(t.ecdsa)}}if(!(`ed25519`in t)||!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);let r=Dt(t.ed25519),i=Ot(t.ecdsa);if(r.materialActivation.activationId===i.materialActivation.activationId)throw Error(`CommittedSignerPackageSetV1 activation references must be distinct`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:r,ecdsa:i}}function Et(e){return P(e)}function Dt(e){let t=Pt(e);if(t.kind!==`committed_ed25519_signer_package_v1`)throw Error(`CommittedEd25519SignerPackageV1.kind is invalid`);let n=At(t.materialActivation,`materialActivation`),r=Re(t.targetBinding),i=We(t.applicationBinding),a=Ie(t.activationReceipt);if(!c(n,Pe(a.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 activation receipt does not match material`);if(!c(n,Pe(r.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 target binding does not match material`);let o=kt(t.deriver_a_client_package,`deriver_a_client_package`,`deriver_a`),s=kt(t.deriver_b_client_package,`deriver_b_client_package`,`deriver_b`);if(!Be(a.transcript,o.transcript)||!Be(a.transcript,s.transcript))throw Error(`CommittedEd25519SignerPackageV1 receipt transcript does not match packages`);return{kind:`committed_ed25519_signer_package_v1`,materialActivation:n,targetBinding:r,applicationBinding:i,participantIds:Le(t.participantIds),activationReceipt:a,deriver_a_client_package:o,deriver_b_client_package:s}}function Ot(e){let t=Ft(e);if(t.kind!==`committed_ecdsa_signer_package_v1`)throw Error(`CommittedEcdsaSignerPackageV1.kind is invalid`);let n=At(t.materialActivation,`materialActivation`),r=Ge(t.activationReceipt),i=r.binding.target.activation;if(!c(n,i))throw Error(`CommittedEcdsaSignerPackageV1 receipt activation does not match material`);let a=He(t.encryptedTargetClientShare,`encryptedTargetClientShare`);if(a.recipientPublicKeyB64u!==r.binding.target.clientRecipientPublicKeyB64u)throw Error(`CommittedEcdsaSignerPackageV1 client share recipient does not match receipt`);return{kind:`committed_ecdsa_signer_package_v1`,materialActivation:n,encryptedTargetClientShare:a,activationReceipt:r}}function kt(e,t,n){let r=ze(e);if(!r.ok)throw Error(`${t} ${r.message}`);if(r.value.kind!==`activation_client`||r.value.deriver!==n)throw Error(`${t} must be an activation_client for ${n}`);return{kind:`activation_client`,deriver:n,session:r.value.session,transcript:r.value.transcript,encapsulated_key:r.value.encapsulated_key,ciphertext:r.value.ciphertext}}function At(e,t){let n=a(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function jt(e){if(!Array.isArray(e))throw Error(`CommittedSignerPackageSetV1.keyFamilies must be an array`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`CommittedSignerPackageSetV1.keyFamilies must use canonical family order`)}function Mt(e){let t=It(e);if(t===null)throw Error(`CommittedAuthorityPackagesV1 must be an object`);return V(t,[`kind`,`authority`,`authMethod`,`signerPackages`,`ed25519ExportRootPackage`,`packageSetDigestB64u`],`CommittedAuthorityPackagesV1`),{kind:Reflect.get(t,`kind`),authority:Reflect.get(t,`authority`),authMethod:Reflect.get(t,`authMethod`),signerPackages:Reflect.get(t,`signerPackages`),ed25519ExportRootPackage:Reflect.get(t,`ed25519ExportRootPackage`),packageSetDigestB64u:Reflect.get(t,`packageSetDigestB64u`)}}function Nt(e){let t=It(e);if(t===null)throw Error(`CommittedSignerPackageSetV1 must be an object`);let n=Object.keys(t),r=n.includes(`ed25519`),i=n.includes(`ecdsa`);return r&&i?(V(t,[`kind`,`keyFamilies`,`ed25519`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`),ecdsa:Reflect.get(t,`ecdsa`)}):r?(V(t,[`kind`,`keyFamilies`,`ed25519`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`)}):i?(V(t,[`kind`,`keyFamilies`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ecdsa:Reflect.get(t,`ecdsa`)}):(V(t,[`kind`,`keyFamilies`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`)})}function Pt(e){let t=It(e);if(t===null)throw Error(`CommittedEd25519SignerPackageV1 must be an object`);return V(t,[`kind`,`materialActivation`,`targetBinding`,`applicationBinding`,`participantIds`,`activationReceipt`,`deriver_a_client_package`,`deriver_b_client_package`],`CommittedEd25519SignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),targetBinding:Reflect.get(t,`targetBinding`),applicationBinding:Reflect.get(t,`applicationBinding`),participantIds:Reflect.get(t,`participantIds`),activationReceipt:Reflect.get(t,`activationReceipt`),deriver_a_client_package:Reflect.get(t,`deriver_a_client_package`),deriver_b_client_package:Reflect.get(t,`deriver_b_client_package`)}}function Ft(e){let t=It(e);if(t===null)throw Error(`CommittedEcdsaSignerPackageV1 must be an object`);return V(t,[`kind`,`materialActivation`,`encryptedTargetClientShare`,`activationReceipt`],`CommittedEcdsaSignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),encryptedTargetClientShare:Reflect.get(t,`encryptedTargetClientShare`),activationReceipt:Reflect.get(t,`activationReceipt`)}}function It(e){return typeof e==`object`&&e&&!Array.isArray(e)?e:null}function V(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length)throw Error(`${n} contains unexpected fields`);for(let e of i)if(!r.has(e))throw Error(`${n} contains unexpected fields`);for(let r of t)if(!Object.prototype.hasOwnProperty.call(e,r))throw Error(`${n}.${r} is required`)}const Lt=[`version`,`purpose`,`linkSessionId`,`linkPublicKeyB64u`,`devicePublicKeyB64u`,`requestedPermission`,`targetFactor`,`issuedAtMs`,`expiresAtMs`];function Rt(...e){return(t,n)=>{if(!e.includes(t))throw Error(`${n} is unsupported`);return t}}function zt(e,t){if(typeof e!=`string`||!/^[0-9a-f]{64}$/.test(e))throw Error(`${t} must be 32 canonical lowercase hex bytes`);return e}function H(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=_(e);if(t.length!==32||g(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be a canonical 32-byte unpadded base64url key`)}return e}function U(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=_(e);if(t.length===0||g(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be canonical unpadded base64url`)}return e}function Bt(e,t,n){let r=U(e,n),i=_(r);try{if(i.length!==t)throw Error(`${n} must encode ${t} bytes`);return r}finally{i.fill(0)}}const W=BigInt(`0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff`),Vt=W-3n,Ht=BigInt(`0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b`);function Ut(e){let t=0n;for(let n of e)t=t<<8n|BigInt(n);return t}function Wt(e){let t=Ut(e.subarray(1,33)),n=Ut(e.subarray(33,65));return t>=W||n>=W?!1:n*n%W===(t*t*t%W+Vt*t%W+Ht)%W}function Gt(e,t){let n=Bt(e,65,t),r=_(n);try{if(r[0]!==4)throw Error(`${t} must be an uncompressed SEC1 P-256 point`);if(!Wt(r))throw Error(`${t} must be an on-curve P-256 point`);return n}finally{r.fill(0)}}function Kt(e){return H(e,`LinkDevicePublicKeyB64u`)}function qt(e,t){return _e(U(e,t),t)}function Jt(e,t){if(e!==`ed25519`&&e!==`ecdsa_secp256k1`)throw Error(`${t} must identify a supported key family`);return e}function G(e,t,n){if(t<=e)throw Error(`${n}.expiresAtMs must be after issuedAtMs`)}function Yt(e){return{kind:e.kind,permissions:[...ie(e)]}}function Xt(e){let t={version:e.version,purpose:e.purpose,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:Yt(e.requestedPermission),targetFactor:e.targetFactor,issuedAtMs:e.issuedAtMs,expiresAtMs:e.expiresAtMs};return e.targetFactor.kind===`email_otp`?{...t,targetEmail:e.targetEmail}:t}function K(e,t){switch(m(e,[`kind`],t).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`${t}.kind is unsupported`)}}function Zt(){return b({kind:y(`passkey_prf`)})}function Qt(){return b({kind:y(`email_otp`)})}function $t(){return b({kind:y(`existing_enrollment`)})}function en(){return b({kind:y(`new_enrollment`)})}function tn(){return v(`kind`,[$t(),en()])}function nn(e,t){return tn()(e,t)}function rn(){return b({enrollmentSealKeyVersion:k,clientUnlockPublicKeyB64u:k,unlockKeyVersion:k,serverSealedFactorCiphertextB64u:k})}function an(e,t){let n=f(e,t);if(n.kind===`passkey_prf`)return m(n,[`kind`],t),{kind:`passkey_prf`};if(n.kind===`email_otp`){let e=nn(n.enrollment,`${t}.enrollment`),r=E(n.targetEmail,`${t}.targetEmail`);return e.kind===`existing_enrollment`?{kind:`email_otp`,targetEmail:r,enrollment:e,baseWalletAuthMethodId:C(m(n,[`kind`,`targetEmail`,`enrollment`,`baseWalletAuthMethodId`],t).baseWalletAuthMethodId,`${t}.baseWalletAuthMethodId`)}:(m(n,[`kind`,`targetEmail`,`enrollment`],t),{kind:`email_otp`,targetEmail:r,enrollment:e})}throw Error(`${t}.kind is unsupported`)}function on(e){if(e.version!==`v5`)throw Error(`QrLinkedDeviceSessionPayloadV5.version is invalid`);if(e.purpose!==`linked_device_lane_creation`)throw Error(`QrLinkedDeviceSessionPayloadV5.purpose is invalid`);let t=S(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=S(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);G(t,n,`QrLinkedDeviceSessionPayloadV5`);let r={version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:M(e.linkSessionId,`QrLinkedDeviceSessionPayloadV5.linkSessionId`),linkPublicKeyB64u:H(e.linkPublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.linkPublicKeyB64u`),devicePublicKeyB64u:H(e.devicePublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.devicePublicKeyB64u`),requestedPermission:ge(e.requestedPermission,`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:K(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`),issuedAtMs:t,expiresAtMs:n};return r.targetFactor.kind===`email_otp`?{...r,targetFactor:{kind:`email_otp`},targetEmail:E(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`)}:{...r,targetFactor:{kind:`passkey_prf`}}}function sn(e){let t=f(e,`QrLinkedDeviceSessionPayloadV5`);return on(m(t,K(t.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`).kind===`email_otp`?[...Lt,`targetEmail`]:Lt,`QrLinkedDeviceSessionPayloadV5`))}function cn(e){let t=on(Xt(e)),n={v:5,s:t.linkSessionId,l:t.linkPublicKeyB64u,d:t.devicePublicKeyB64u,a:Yt(t.requestedPermission),f:t.targetFactor.kind===`passkey_prf`?`p`:`e`,i:t.issuedAtMs,e:t.expiresAtMs};return t.targetFactor.kind===`email_otp`?JSON.stringify({...n,t:t.targetEmail}):JSON.stringify(n)}function ln(){return b({payload:sn,requestedAtMs:S})}function un(e){return ln()(e,`LinkedDeviceOwnerAuthorizationRequestV1`)}function dn(){let e=e=>b({state:y(e),deviceId:he});return[b({state:y(`displaying_qr`)}),e(`claimed`),e(`awaiting_target_factor`),e(`awaiting_source_contribution`),e(`provisioning`),b({state:y(`authority_pending_local_install`),deviceId:he,authorityId:j,packageSetDigestB64u:w}),b({state:y(`active`),deviceId:he,authorityId:j,activatedAtMs:S}),b({state:y(`failed_before_commit`),error:pn}),b({state:y(`cancelled`),cancelledAtMs:S}),b({state:y(`expired`),expiredAtMs:S})]}function fn(e){let t=f(e,`LinkSessionStateV1`).state;if(typeof t!=`string`)throw Error(`LinkSessionStateV1.state is invalid`);let n=dn().find(e=>e.shape.state.literals.includes(t));if(!n)throw Error(`LinkSessionStateV1.state ${t} is unsupported`);return n(e,`LinkSessionStateV1.${t}`)}function pn(e){let t=m(e,[`kind`,`reason`],`LinkPrecommitFailureV1`);if(t.kind!==`invalid_input`&&t.kind!==`unauthorized_source`&&t.kind!==`revoked_source`&&t.kind!==`permission_attenuation_failed`&&t.kind!==`target_factor_failed`&&t.kind!==`expired_session`&&t.kind!==`cancelled_session`&&t.kind!==`claim_conflict`&&t.kind!==`package_preparation_failed`)throw Error(`LinkPrecommitFailureV1.kind is invalid`);return{kind:t.kind,reason:k(t.reason,`LinkPrecommitFailureV1.reason`)}}function mn(){return b({kind:y(`linked_device_session_projection_v1`),linkSessionId:M,qrPayload:sn,revision:D,createdAtMs:S,updatedAtMs:S,state:fn})}function hn(e){return mn()(e,`LinkSessionProjectionV1`)}function gn(){return b({kind:y(`linked_device_session_event_v1`),linkSessionId:M,state:fn,emittedAtMs:S})}function _n(e){return gn()(e,`LinkSessionTransportEventV1`)}function vn(){return v(`outcome`,[b({outcome:y(`pending`),state:bn}),b({outcome:y(`replayed`),replay:b({state:()=>`pending`,session:bn})})])}function yn(e){return vn()(e,`LinkedDeviceApprovalResultV1`)}function bn(e){let t=fn(e);switch(t.state){case`awaiting_target_factor`:case`awaiting_source_contribution`:case`provisioning`:case`authority_pending_local_install`:return t;default:throw Error(`LinkedDeviceApprovalResultV1 state is not pending`)}}function xn(){return b({kind:y(`linked_device_session_claim_v1`),linkSessionId:M,walletId:x,enrollmentId:O,deviceId:T,devicePublicKeyB64u:H,targetFactor:K,sessionRevision:S,claimedAtMs:S,claimExpiresAtMs:S},(e,t)=>G(e.claimedAtMs,e.claimExpiresAtMs,t))}function Sn(e){return xn()(e,`LinkedDeviceSessionClaimV1`)}function Cn(){return b({kind:y(`wallet_session`),walletSessionId:fe,authorizationId:ye})}function wn(e,t=`ownerAuthorization`){if(f(e,t).kind!==`wallet_session`)throw Error(`${t}.kind is unsupported`);return Cn()(e,t)}function Tn(){return{kind:y(`linked_device_approval_v1`),linkSessionId:M,walletId:x,enrollmentId:O,deviceId:T,linkPublicKeyB64u:H,devicePublicKeyB64u:H,permission:ge,targetFactor:an,ownerAuthorization:wn,approvedAtMs:S,expiresAtMs:S}}function En(e,t){G(e.approvedAtMs,e.expiresAtMs,t)}function Dn(){return b(Tn(),En)}function On(){return b({...Tn(),sourceContribution:Ve},En)}function kn(e){let t=f(e,`LinkedDeviceApprovalV1`);return(t.sourceContribution===void 0?Dn():On())(t,`LinkedDeviceApprovalV1`)}function An(){return b({kind:y(`linked_device_approval_delivery_v1`),approval:kn})}function jn(e){return An()(e,`LinkedDeviceApprovalDeliveryV1`)}function Mn(){return{kind:y(`linked_device_target_preparation_v1`),linkSessionId:M,walletId:x,enrollmentId:O,deviceId:T,deliveryRecipientPublicKey65B64u:Gt,walletAuthMethodId:C,ed25519ExportRoot:de(Kn()),ordinarySignerMaterialRecipientRequirements:Yn,issuedAtMs:S,expiresAtMs:S}}function Nn(e,t){if(e.expiresAtMs<=e.issuedAtMs)throw Error(`${t}.expiresAtMs must follow issuedAtMs`)}function Pn(){return b({...Mn(),targetFactor:Zt(),passkeyCreationOptions:Gn,passkeyConfigurationDigestB64u:w},(e,t)=>{if(Nn(e,t),e.passkeyCreationOptions.walletAuthMethodId!==e.walletAuthMethodId)throw Error(`${t}.passkeyCreationOptions.walletAuthMethodId must match the preparation`)})}function Fn(){return b({...Mn(),targetFactor:Qt(),targetEmail:E,enrollment:$t(),baseWalletAuthMethodId:C},Nn)}function In(){return b({...Mn(),targetFactor:Qt(),targetEmail:E,enrollment:en()},Nn)}function Ln(e){let t=`LinkedDeviceTargetPreparationV1`,n=f(e,t);return K(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?Pn()(n,t):(nn(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?In():Fn())(n,t)}function Rn(){return b({kind:y(`linked_device_target_preparation_request_v1`),linkSessionId:M,deliveryRecipientPublicKey65B64u:Gt})}function zn(e){return Rn()(e,`LinkedDeviceTargetPreparationRequestV1`)}function Bn(){return b({baseWalletAuthMethodId:C,maskedEmailHint:(e,t)=>{if(typeof e!=`string`||e.length===0)throw Error(`${t} is invalid`);return e}})}function Vn(){let e=Bn(),t=t=>e(t,`LinkedDeviceEmailOtpBaseFactorChoiceV1`);return{selected:b({kind:y(`selected`),choice:t}),selection_required:b({kind:y(`selection_required`),choices:(e,n)=>{if(!Array.isArray(e)||e.length===0)throw Error(`${n} must not be empty`);let r=e.map(t);return[r[0],...r.slice(1)]}}),unavailable:b({kind:y(`unavailable`),reason:Rt(`no_active_email_otp_base_factor`)})}}function Hn(e){let t=`LinkedDeviceEmailOtpBaseFactorResolutionV1`,n=f(e,t),r=Vn();switch(n.kind){case`selected`:case`selection_required`:case`unavailable`:return r[n.kind](n,t);default:throw Error(`${t}.kind is unsupported`)}}function Un(){return b({revision:S,resolution:Hn})}function Wn(e){return Un()(e,`LinkedDeviceEmailOtpBaseFactorResolutionResultV1`)}function Gn(e,t){let n=m(e,[`kind`,`walletAuthMethodId`,`challengeId`,`challengeB64u`,`rpId`,`user`,`pubKeyCredParams`,`authenticatorSelection`,`timeoutMs`,`attestation`,`extensions`,`excludeCredentials`],t),r=C(n.walletAuthMethodId,`${t}.walletAuthMethodId`);if(m(n.user,[`idB64u`,`name`,`displayName`],`${t}.user`),m(n.authenticatorSelection,[`residentKey`,`userVerification`],`${t}.authenticatorSelection`),m(m(m(n.extensions,[`prf`],`${t}.extensions`).prf,[`eval`],`${t}.extensions.prf`).eval,[`firstB64u`,`secondB64u`],`${t}.extensions.prf.eval`),!Array.isArray(n.pubKeyCredParams))throw Error(`${t}.pubKeyCredParams must be an array`);if(n.pubKeyCredParams.forEach((e,n)=>{m(e,[`type`,`alg`],`${t}.pubKeyCredParams[${n}]`)}),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);n.excludeCredentials.forEach((e,n)=>{m(e,[`type`,`id`],`${t}.excludeCredentials[${n}]`)});let i=St(n);return{kind:i.kind,walletAuthMethodId:r,challengeId:i.challengeId,challengeB64u:i.challengeB64u,rpId:i.rpId,user:i.user,pubKeyCredParams:i.pubKeyCredParams,authenticatorSelection:i.authenticatorSelection,timeoutMs:i.timeoutMs,attestation:i.attestation,extensions:i.extensions,excludeCredentials:i.excludeCredentials}}function Kn(){return b({kind:y(`linked_device_ed25519_export_root_preparation_v1`),walletKeyId:ue,applicationBindingDigestB64u:w,registeredPublicKeyB64u:oe,revocationEpoch:D})}function qn(e,t,n){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`${n} must contain one or two entries`);let r=e.map((e,r)=>t(e,`${n}[${r}]`));if(new Set(r.map(e=>e.keyFamily)).size!==r.length)throw Error(`${n} repeats a key family`);if(new Set(r.map(e=>String(e.walletKeyId))).size!==r.length)throw Error(`${n} repeats a wallet key`);if(r.length===2&&(r[0]?.keyFamily!==`ed25519`||r[1]?.keyFamily!==`ecdsa_secp256k1`))throw Error(`${n} must be ordered Ed25519 then ECDSA`);return r}function Jn(){return b({kind:y(`ordinary_signer_material_recipient_requirement_v1`),keyFamily:Jt,walletKeyId:ue})}function Yn(e){let t=qn(e,Jn(),`LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requirements are empty`);return[n,...t.slice(1)]}const Xn=y(`ble`,`cable`,`hybrid`,`internal`,`nfc`,`smart-card`,`usb`);function Zn(e,t){let n=te(e,t).map((e,n)=>Xn(e,`${t}[${n}]`));if(new Set(n).size!==n.length)throw Error(`${t} contains duplicates`);return n}function Qn(){return b({kind:y(`linked_device_webauthn_registration_v1`),credentialIdB64u:qt,authenticatorAttachment:de(y(`platform`,`cross-platform`)),clientDataJsonB64u:U,attestationObjectB64u:U,transports:Zn})}function $n(){let e=e=>(t,n)=>{if(t!==e)throw Error(`${n} does not match its kind`);return e};return v(`kind`,[b({kind:y(`ordinary_ed25519_signer_material_recipient_request_v1`),keyFamily:e(`ed25519`),walletKeyId:ue,recipientPublicKeyB64u:(e,t)=>Bt(e,32,t)}),b({kind:y(`ordinary_ecdsa_signer_material_recipient_request_v1`),keyFamily:e(`ecdsa_secp256k1`),walletKeyId:ue,clientEphemeralPublicKey:Fe})])}function er(e){let t=qn(e,$n(),`LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requests are empty`);return[n,...t.slice(1)]}function tr(){return{kind:y(`linked_device_target_credential_registration_v1`),linkSessionId:M,walletId:x,enrollmentId:O,deviceId:T,walletAuthMethodId:C}}function nr(){return b({...tr(),targetFactor:Zt(),targetPreparationDigestB64u:w,ordinarySignerMaterialRecipientRequests:er,webauthnRegistration:Qn(),registeredAtMs:S})}function rr(){return b({...tr(),targetFactor:Qt(),targetEmail:E,targetPreparationDigestB64u:w,ordinarySignerMaterialRecipientRequests:er,emailOtpVerificationGrant:xr,registeredAtMs:S})}function ir(){return b({...tr(),targetFactor:Qt(),targetEmail:E,targetPreparationDigestB64u:w,ordinarySignerMaterialRecipientRequests:er,emailOtpVerificationGrant:xr,emailOtpEnrollment:rn(),registeredAtMs:S})}function ar(e){let t=`LinkedDeviceTargetCredentialRegistrationV1`,n=f(e,t);return K(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?nr()(n,t):(xr(n.emailOtpVerificationGrant).enrollment.kind===`new_enrollment`?ir():rr())(n,t)}function or(){return b({kind:y(`linked_device_target_credential_registration_result_v1`),outcome:y(`applied`,`replayed`),linkSessionId:M,walletId:x,enrollmentId:O,deviceId:T,walletAuthMethodId:C,targetPreparationDigestB64u:w,targetFactor:fr,ordinarySignerMaterialPreparations:Ue,ordinarySignerMaterialRecipientRequests:er,keyManifestDigestB64u:w},(e,t)=>{let{authMethod:n}=e.targetFactor;if(n.walletAuthMethodId!==e.walletAuthMethodId||n.walletId!==e.walletId)throw Error(`${t} target identity differs`)})}function sr(e){return or()(e,`LinkedDeviceTargetCredentialRegistrationResultV1`)}function cr(e,t){if(e.verifiedAtMs<e.authMethod.createdAtMs)throw Error(`${t}.verifiedAtMs precedes authMethod.createdAtMs`)}function lr(){return b({kind:y(`verified_passkey_target_v1`),authMethod:mr,verificationDigestB64u:w,verifiedAtMs:S},cr)}function ur(){return b({kind:y(`verified_email_otp_target_v1`),authMethod:gr,targetEmail:E,enrollment:$t(),baseWalletAuthMethodId:C,providerUserId:k,verificationDigestB64u:w,verifiedAtMs:S},cr)}function dr(){return b({kind:y(`verified_email_otp_target_v1`),authMethod:gr,targetEmail:E,enrollment:en(),providerUserId:k,verificationDigestB64u:w,verifiedAtMs:S},cr)}function fr(e,t){let n=f(e,t);if(n.kind===`verified_passkey_target_v1`)return lr()(n,t);if(n.kind!==`verified_email_otp_target_v1`)throw Error(`${t}.kind is invalid`);return(nn(n.enrollment,`${t}.enrollment`).kind===`existing_enrollment`?ur():dr())(n,t)}function pr(){return b({walletAuthMethodId:C,walletId:x,createdAtMs:S,kind:y(`passkey`),rpId:ve,credentialIdB64u:_e,credentialPublicKeyB64u:U,counter:D})}function mr(e,t){return pr()(e,t)}function hr(){return b({walletAuthMethodId:C,walletId:x,createdAtMs:S,kind:y(`email_otp`),emailHashHex:zt,registrationAuthorityId:k})}function gr(e,t){return hr()(e,t)}function _r(e){return{kind:y(`linked_device_email_otp_verification_grant_v1`),grantId:k,grantToken:k,challengeId:k,linkSessionId:M,walletId:x,enrollmentId:O,deviceId:T,targetPreparationDigestB64u:w,targetEmail:E,enrollment:e,emailHashHex:zt,registrationAuthorityId:k,providerUserId:k,authorityDigestB64u:w,issuedAtMs:S,expiresAtMs:S}}function vr(e,t){G(e.issuedAtMs,e.expiresAtMs,t)}function yr(){return b({..._r($t()),baseWalletAuthMethodId:C},vr)}function br(){return b(_r(en()),vr)}function xr(e){let t=`LinkedDeviceEmailOtpVerificationGrantV1`,n=f(e,t);return(nn(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?br():yr())(n,t)}function Sr(){return b({kind:y(`email_otp_factor_release_v1`),challengeId:k,enrollmentId:k,enrollmentSealKeyVersion:k,serverEphemeralPublicKey65B64u:Gt,nonce12B64u:(e,t)=>Bt(e,12,t),ciphertextB64u:U})}function Cr(e){return Sr()(e,`LinkedDeviceEmailOtpFactorReleaseEnvelopeV1`)}function wr(){return b({kind:y(`linked_device_email_otp_challenge_start_request_v1`),linkSessionId:M,workerEphemeralPublicKey65B64u:Gt})}function Tr(e){return wr()(e,`LinkedDeviceEmailOtpChallengeStartRequestV1`)}function Er(){return b({kind:y(`linked_device_email_otp_challenge_resend_request_v1`),linkSessionId:M,challengeId:k})}function Dr(e){return Er()(e,`LinkedDeviceEmailOtpChallengeResendRequestV1`)}function Or(){return b({kind:y(`linked_device_email_otp_challenge_verify_request_v1`),linkSessionId:M,challengeId:k,otpCode:(e,t)=>{if(typeof e!=`string`||!/^[0-9]{6,10}$/.test(e))throw Error(`${t} is invalid`);return e}})}function kr(e){return Or()(e,`LinkedDeviceEmailOtpChallengeVerifyRequestV1`)}function Ar(){return b({kind:y(`linked_device_email_otp_challenge_result_v1`),challengeId:k,maskedEmailHint:k,expiresAtMs:S,resendAvailableAtMs:S})}function jr(e){return Ar()(e,`LinkedDeviceEmailOtpChallengeResultV1`)}function Mr(e){let t=m(e,[`kind`,`verificationGrant`,`factorRelease`],`LinkedDeviceEmailOtpVerificationResultV1`);if(t.kind!==`linked_device_email_otp_verification_result_v1`)throw Error(`LinkedDeviceEmailOtpVerificationResultV1.kind is invalid`);let n=xr(t.verificationGrant);if(Nr(n)){if(t.factorRelease!==null)throw Error(`new linked-device Email OTP enrollment cannot carry a factor release`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:null}}let r=Cr(t.factorRelease);if(r.challengeId!==n.challengeId)throw Error(`LinkedDeviceEmailOtpVerificationResultV1 challenge binding changed`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:r}}function Nr(e){return e.enrollment.kind===`new_enrollment`}function Pr(e){let t=S(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=S(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);G(t,n,`QrLinkedDeviceSessionPayloadV5`);let r=K(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`);if(r.kind===`passkey_prf`)return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:ge(Yt(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,issuedAtMs:t,expiresAtMs:n};if(e.targetEmail===void 0)throw Error(`QrLinkedDeviceSessionPayloadV5.targetEmail is required for Email OTP`);return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:ge(Yt(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,targetEmail:E(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`),issuedAtMs:t,expiresAtMs:n}}function Fr(e){return{kind:`linked_device_session_claim_request_v1`,payload:e}}function Ir(e,t,n){let r=S(e,`${n}.approvedAtMs`),i=S(t,`${n}.expiresAtMs`);return G(r,i,n),{approvedAtMs:r,expiresAtMs:i}}function Lr(e){let t=Ir(e.approvedAtMs,e.expiresAtMs,`LinkedDeviceApprovalV1`);return kn({kind:`linked_device_approval_v1`,...e,...t})}function Rr(e){return ar({kind:`linked_device_target_credential_registration_v1`,...e})}function zr(e){return{kind:`linked_device_session_cancel_unclaimed_request_v1`,linkSessionId:e.linkSessionId,reason:`user_cancelled`,requestedAtMs:S(e.requestedAtMs,`LinkedDeviceSessionCancelUnclaimedRequestV1.requestedAtMs`)}}function Br(e){return{kind:`linked_device_session_cancel_claimed_request_v1`,...e,requestedAtMs:S(e.requestedAtMs,`LinkedDeviceSessionCancelClaimedRequestV1.requestedAtMs`)}}const Vr=[`chrome`,`safari`,`firefox`,`edge`,`other`],Hr=[`macos`,`ios`,`windows`,`android`,`linux`,`other`];function Ur(e){return typeof e==`string`&&Vr.some(t=>t===e)}function Wr(e){return typeof e==`string`&&Hr.some(t=>t===e)}function Gr(e){if(!e||typeof e!=`object`||Array.isArray(e))return null;let t=e,n=typeof t.label==`string`?t.label.trim():``;if(!n||!Ur(t.browser)||!Wr(t.os)||typeof t.synced!=`boolean`||!Array.isArray(t.transports))return null;let r=t.transports.map(e=>typeof e==`string`?e.trim():``).filter(e=>e.length>0),i=typeof t.provider==`string`?t.provider.trim():``,a=typeof t.providerLabel==`string`?t.providerLabel.trim():``;return{label:n,browser:t.browser,os:t.os,synced:t.synced,transports:r,...i?{provider:i}:{},...a?{providerLabel:a}:{}}}function Kr(e){return(t,n)=>{if(!Array.isArray(t))throw Error(`${n} is invalid`);return t.map((t,r)=>e(t,`${n}[${r}]`))}}function qr(e,t){let n=C(e,t);if(n.startsWith(`wallet-authority:`)||n.startsWith(`authority:`))throw Error(`${t} must identify a WalletAuthMethodId`);return n}function Jr(e,t){let n=D(e,t);if(n<1)throw Error(`${t} must be a positive safe integer`);return n}function Yr(e,t){let n=Gr(e);if(!n)throw Error(`${t} is invalid`);return n}function Xr(){return v(`kind`,[b({kind:y(`passkey`),walletAuthMethodId:C,credentialIdB64u:_e,device:Yr}),b({kind:y(`email_otp`),walletAuthMethodId:C,email:E})])}function Zr(e,t){return Xr()(e,t)}function Qr(){return b({deviceId:T,enrollmentId:O,walletId:x,credential:Zr,permission:ge,keyManifestDigestB64u:w,coveredWalletKeys:Kr(ue),state:y(`provisioning`,`active`,`suspended`,`expired`,`revoked`),createdAtMs:S,lastActivityAtMs:S,revocationEpoch:D})}function $r(e){return Qr()(e,`LinkedDeviceSummaryV1`)}function ei(){return b({kind:y(`linked_device_list_request_v1`),walletId:x,limit:Jr,cursor:pe})}function ti(e){return ei()(e,`LinkedDeviceListRequestV1`)}function ni(){return b({walletId:x,walletAuthorityId:j,credential:Zr,createdAtMs:S,lastActivityAtMs:S})}function ri(){let e=ni();return b({devices:Kr($r),ownerDevices:Kr(t=>e(t,`OwnerDeviceSummaryV1`)),nextCursor:pe})}function ii(e){return ri()(e,`LinkedDeviceListResultV1`)}function ai(){return b({kind:y(`linked_device_revoke_request_v1`),walletId:x,walletAuthMethodId:qr,requestedAtMs:S})}function oi(e){return ai()(e,`LinkedDeviceRevokeRequestV1`)}function si(){return b({kind:y(`not_found`,`conflict`,`unauthorized`)})}function ci(){return b({kind:y(`revoked`),walletAuthMethodId:qr,authorityId:j,revocationEpoch:D})}function li(e){let t=f(e,`LinkedDeviceRevokeResultV1`);return(t.kind===`not_found`||t.kind===`conflict`||t.kind===`unauthorized`?si():ci())(t,`LinkedDeviceRevokeResultV1`)}function ui(e){return d({domain:`seams/linked-device/wallet-session-credential-delivery-aad/v1`,aad:e})}function di(e){let t=vi(e,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`],`LinkedDeviceWalletSessionCredentialDeliveryBindingV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_binding_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryBindingV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_binding_v1`,namespace:q(t.namespace,`namespace`),orgId:q(t.orgId,`orgId`),projectId:q(t.projectId,`projectId`),envId:q(t.envId,`envId`),tenantId:J(we(t.tenantId)),principalId:J(xe(t.principalId))}}async function fi(e){return N(ui(e))}async function pi(e){return N(d({domain:`seams/linked-device/wallet-session-credential-delivery-envelope/v1`,envelope:e}))}async function mi(e){if(await fi(e.aad)!==e.aadDigestB64u)throw Error(`linked-device Wallet Session credential delivery AAD digest is invalid`);if(await pi(e.envelope)!==e.envelopeDigestB64u)throw Error(`linked-device Wallet Session credential delivery envelope digest is invalid`);if(await N(d({domain:`seams/linked-device/delivery-recipient/v1`,recipientPublicKey65B64u:e.aad.recipientPublicKey65B64u}))!==e.recipientBindingDigestB64u)throw Error(`linked-device Wallet Session credential delivery recipient binding is invalid`)}function hi(e){let t=vi(e,[`kind`,`aad`,`aadDigestB64u`,`recipientBindingDigestB64u`,`envelope`,`envelopeDigestB64u`,`installationReceiptDigestB64u`],`LinkedDeviceWalletSessionCredentialDeliveryV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_v1`,aad:gi(t.aad),aadDigestB64u:P(t.aadDigestB64u),recipientBindingDigestB64u:P(t.recipientBindingDigestB64u),envelope:_i(t.envelope),envelopeDigestB64u:P(t.envelopeDigestB64u),installationReceiptDigestB64u:P(t.installationReceiptDigestB64u)}}function gi(t){let i=vi(t,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`,`linkSessionId`,`walletId`,`authorityId`,`walletAuthMethodId`,`authorizationId`,`walletSessionId`,`quotaId`,`credentialDigestB64u`,`recipientPublicKey65B64u`,`issuedAtMs`,`expiresAtMs`],`LinkedDeviceWalletSessionCredentialDeliveryAadV1`);if(i.kind!==`linked_device_wallet_session_credential_delivery_aad_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryAadV1.kind is invalid`);let a=yi(i.issuedAtMs,`issuedAtMs`),o=yi(i.expiresAtMs,`expiresAtMs`);if(o<=a)throw Error(`expiresAtMs must be after issuedAtMs`);return{kind:`linked_device_wallet_session_credential_delivery_aad_v1`,namespace:q(i.namespace,`namespace`),orgId:q(i.orgId,`orgId`),projectId:q(i.projectId,`projectId`),envId:q(i.envId,`envId`),tenantId:J(we(i.tenantId)),principalId:J(xe(i.principalId)),linkSessionId:J(s(i.linkSessionId)),walletId:J(n(i.walletId)),authorityId:J(e(i.authorityId)),walletAuthMethodId:J(r(i.walletAuthMethodId)),authorizationId:J(Ce(i.authorizationId)),walletSessionId:J(Se(i.walletSessionId)),quotaId:J(be(i.quotaId)),credentialDigestB64u:P(i.credentialDigestB64u),recipientPublicKey65B64u:xi(i.recipientPublicKey65B64u,65),issuedAtMs:a,expiresAtMs:o}}function _i(e){let t=vi(e,[`kind`,`algorithm`,`serverEphemeralPublicKey65B64u`,`nonce12B64u`,`ciphertextB64u`],`LinkedDeviceWalletSessionCredentialEnvelopeV1`);if(t.kind!==`linked_device_wallet_session_credential_envelope_v1`||t.algorithm!==`p256-ecdh-aes256gcm-v1`)throw Error(`LinkedDeviceWalletSessionCredentialEnvelopeV1 identity is invalid`);return{kind:`linked_device_wallet_session_credential_envelope_v1`,algorithm:`p256-ecdh-aes256gcm-v1`,serverEphemeralPublicKey65B64u:xi(t.serverEphemeralPublicKey65B64u,65),nonce12B64u:xi(t.nonce12B64u,12),ciphertextB64u:bi(t.ciphertextB64u)}}function vi(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be an object`);let r=e,i=new Set(t);for(let e of Object.keys(r))if(!i.has(e))throw Error(`${n}.${e} is not supported`);for(let e of t)if(!(e in r))throw Error(`${n}.${e} is required`);return r}function q(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} is required`);return e}function yi(e,t){if(!Number.isSafeInteger(e)||Number(e)<=0)throw Error(`${t} is invalid`);return Number(e)}function bi(e){let t=q(e,`base64url`);if(g(_(t))!==t)throw Error(`base64url is not canonical`);return t}function xi(e,t){let n=bi(e),r=_(n);if(r.length!==t)throw Error(`base64url must contain ${t} bytes`);if(t===65&&r[0]!==4)throw Error(`P-256 public key is invalid`);return n}function J(e){if(!e.ok)throw Error(e.error.message);return e.value}function Si(e,t){let n=Ne(e);if(!n.ok)throw Error(`${t} ${n.error}`);return n.value}function Ci(){return b({kind:y(`local_authority_installation_receipt_v1`),authorityId:A(j),walletId:A(x),authMethodId:A(C),deviceId:A(he),packageSetDigestB64u:A(w),installedActivationRefs:Si,installedRecordSetDigestB64u:A(w),targetFactorVerificationDigestB64u:A(w),installedAtMs:A(S)})}function wi(e){return Ci()(e,`LocalAuthorityInstallationReceiptV1`)}function Ti(){return b({kind:y(`local_authority_activation_final_ack_v1`),linkSessionId:A(M),authorityId:A(j),packageSetDigestB64u:A(w),authorizationId:A(ye),walletSessionId:A(fe),credentialDigestB64u:A(w),installationReceiptDigestB64u:A(w),acknowledgedAtMs:A(S)})}function Ei(e){return Ti()(e,`LocalAuthorityActivationFinalAckV1`)}function Di(e){let t=f(e,`ActivateInstalledAuthorityResultV1`);switch(t.kind){case`active`:{p(t,[`kind`,`authority`,`authMethod`,`walletSession`,`deliveryBinding`,`sealedDelivery`],`ActivateInstalledAuthorityResultV1`);let e=Me(t.authority);if(!e.ok||e.value.state!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authority must be active`);let n=Xe(t.authMethod);if(!n||n.status!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authMethod must be active`);let r=me(t.walletSession),i=di(t.deliveryBinding),a=hi(t.sealedDelivery);if(e.value.walletId!==n.walletId||e.value.authorityId!==n.walletAuthorityId||r.walletId!==e.value.walletId||r.authorityId!==e.value.authorityId||r.authMethodId!==n.walletAuthMethodId||r.authorityDigestB64u!==e.value.authorityDigestB64u||r.authorityRevocationEpoch!==e.value.revocationEpoch||i.namespace!==a.aad.namespace||i.orgId!==a.aad.orgId||i.projectId!==a.aad.projectId||i.envId!==a.aad.envId||i.tenantId!==a.aad.tenantId||i.principalId!==a.aad.principalId||a.aad.walletId!==r.walletId||a.aad.authorityId!==r.authorityId||a.aad.walletAuthMethodId!==r.authMethodId||a.aad.authorizationId!==r.authorizationId||a.aad.quotaId!==r.quotaId||a.aad.issuedAtMs!==r.issuedAtMs||a.aad.expiresAtMs!==r.expiresAtMs)throw Error(`ActivateInstalledAuthorityResultV1 identities do not match`);return{kind:`active`,authority:e.value,authMethod:n,walletSession:r,deliveryBinding:i,sealedDelivery:a}}case`pending_local_install`:return p(t,[`kind`,`authorityId`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`pending_local_install`,authorityId:j(t.authorityId,`authorityId`),reason:Oi()(t.reason,`ActivationRetryReasonV1`)};case`integrity_error`:return p(t,[`kind`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`integrity_error`,reason:ki(t.reason)};default:throw Error(`ActivateInstalledAuthorityResultV1.kind is invalid`)}}function Oi(){return v(`kind`,[b({kind:y(`installation_receipt_not_found`)}),b({kind:y(`server_worker_activation_pending`)}),b({kind:y(`wallet_session_issuance_pending`)})])}function ki(e){let t=f(e,`LinkIntegrityFailureV1`);switch(t.kind){case`authority_id_mismatch`:return p(t,[`kind`,`expectedAuthorityId`,`actualAuthorityId`],`LinkIntegrityFailureV1`),{kind:`authority_id_mismatch`,expectedAuthorityId:j(t.expectedAuthorityId,`expectedAuthorityId`),actualAuthorityId:j(t.actualAuthorityId,`actualAuthorityId`)};case`package_set_digest_mismatch`:return p(t,[`kind`,`expectedPackageSetDigestB64u`,`actualPackageSetDigestB64u`],`LinkIntegrityFailureV1`),{kind:`package_set_digest_mismatch`,expectedPackageSetDigestB64u:w(t.expectedPackageSetDigestB64u,`expectedPackageSetDigestB64u`),actualPackageSetDigestB64u:w(t.actualPackageSetDigestB64u,`actualPackageSetDigestB64u`)};case`installation_receipt_mismatch`:if(p(t,[`kind`,`field`],`LinkIntegrityFailureV1`),t.field!==`walletId`&&t.field!==`authMethodId`&&t.field!==`deviceId`&&t.field!==`targetFactorVerificationDigestB64u`&&t.field!==`installedActivationRefs`)throw Error(`LinkIntegrityFailureV1.field is invalid`);return{kind:`installation_receipt_mismatch`,field:t.field};default:throw Error(`LinkIntegrityFailureV1.kind is invalid`)}}new TextEncoder;async function Ai(e){return N(e.token)}function ji(e){return d({domain:`seams/linked-device/local-authority-installation-receipt/v1`,receipt:e})}async function Mi(e){return N(ji(e))}function Ni(e,t){if(e===void 0)throw Error(`${t} is required`);return e}function Pi(e){return F(e.kind,`targetFactor.kind`)}function Fi(e){let t=e.pubKeyCredParams.map(e=>L([F(e.type,`passkeyCreationOptions.pubKeyCredParams.type`),F(String(e.alg),`passkeyCreationOptions.pubKeyCredParams.alg`)])),n=e.excludeCredentials.map(e=>L([F(e.type,`passkeyCreationOptions.excludeCredentials.type`),F(e.id,`passkeyCreationOptions.excludeCredentials.id`)]));return L([F(e.kind,`passkeyCreationOptions.kind`),F(e.walletAuthMethodId,`passkeyCreationOptions.walletAuthMethodId`),F(e.challengeId,`passkeyCreationOptions.challengeId`),F(e.challengeB64u,`passkeyCreationOptions.challengeB64u`),F(e.rpId,`passkeyCreationOptions.rpId`),F(e.user.idB64u,`passkeyCreationOptions.user.idB64u`),F(e.user.name,`passkeyCreationOptions.user.name`),F(e.user.displayName,`passkeyCreationOptions.user.displayName`),qe(t.length,`passkeyCreationOptions.pubKeyCredParams`),...t.map(e=>I(e,`passkeyCreationOptions.pubKeyCredParams.item`)),F(e.authenticatorSelection.residentKey,`passkeyCreationOptions.authenticatorSelection.residentKey`),F(e.authenticatorSelection.userVerification,`passkeyCreationOptions.authenticatorSelection.userVerification`),Ye(e.timeoutMs,`passkeyCreationOptions.timeoutMs`),F(e.attestation,`passkeyCreationOptions.attestation`),F(e.extensions.prf.eval.firstB64u,`passkeyCreationOptions.extensions.prf.eval.firstB64u`),F(e.extensions.prf.eval.secondB64u,`passkeyCreationOptions.extensions.prf.eval.secondB64u`),qe(n.length,`passkeyCreationOptions.excludeCredentials`),...n.map(e=>I(e,`passkeyCreationOptions.excludeCredentials.item`))])}function Ii(e){return L([F(e.kind,`recipientRequirement.kind`),F(e.keyFamily,`recipientRequirement.keyFamily`),F(e.walletKeyId,`recipientRequirement.walletKeyId`)])}function Li(e){return e===null?F(`none`,`ed25519ExportRoot.kind`):L([F(e.kind,`ed25519ExportRoot.kind`),F(e.walletKeyId,`ed25519ExportRoot.walletKeyId`),Je(e.applicationBindingDigestB64u,`ed25519ExportRoot.applicationBindingDigestB64u`),Ke(e.registeredPublicKeyB64u,`ed25519ExportRoot.registeredPublicKeyB64u`),Ye(e.revocationEpoch,`ed25519ExportRoot.revocationEpoch`)])}function Ri(e){let t=e.ordinarySignerMaterialRecipientRequirements.map(Ii),n=Bi(e)?e:void 0,r=n?.passkeyCreationOptions;if(e.targetFactor.kind===`passkey_prf`&&!r)throw Error(`passkey target preparation is missing creation options`);return L([F(`seams/linked-device/target-preparation/v1`,`domain`),F(e.kind,`kind`),F(e.linkSessionId,`linkSessionId`),F(e.walletId,`walletId`),F(e.enrollmentId,`enrollmentId`),F(e.deviceId,`deviceId`),I(Ke(e.deliveryRecipientPublicKey65B64u,`deliveryRecipientPublicKey65B64u`),`deliveryRecipientPublicKey65B64u`),F(e.walletAuthMethodId,`walletAuthMethodId`),I(Li(e.ed25519ExportRoot),`ed25519ExportRoot`),I(Pi(e.targetFactor),`targetFactor`),...r?[I(Fi(r),`passkeyCreationOptions`),Je(n.passkeyConfigurationDigestB64u,`passkeyConfigurationDigestB64u`)]:[],...zi(e),qe(t.length,`ordinarySignerMaterialRecipientRequirements`),...t.map(e=>I(e,`ordinarySignerMaterialRecipientRequirements.item`)),Ye(e.issuedAtMs,`issuedAtMs`),Ye(e.expiresAtMs,`expiresAtMs`)])}function zi(e){return Bi(e)?[]:[F(e.targetEmail,`targetEmail`),F(e.enrollment.kind,`enrollment.kind`),...e.enrollment.kind===`existing_enrollment`?[F(Ni(e.baseWalletAuthMethodId,`baseWalletAuthMethodId`),`baseWalletAuthMethodId`)]:[]]}function Bi(e){return e.targetFactor.kind===`passkey_prf`}async function Vi(e){return Te(Ri(e))}const Hi=`x-seams-linked-device-proof-v1`,Ui=6e4,Wi=6e4;async function Gi(e){return Te(Ki(e,32,`devicePublicKeyB64u`))}function Ki(e,t,n){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} is invalid`);let r;try{r=_(e)}catch{throw Error(`${n} is invalid`)}if(r.length!==t||g(r)!==e)throw Error(`${n} is invalid`);return r}var qi=(e=>(e.Unknown=`Unknown`,e.Pending=`Pending`,e.Failure=`Failure`,e))(qi||{}),Ji=(e=>(e.NotStarted=`NotStarted`,e.Started=`Started`,e.Failure=`Failure`,e))(Ji||{});function Y(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`Invalid ${t}: expected an object`);return e}function X(e,t){if(typeof e!=`string`)throw Error(`Invalid ${t}: expected a string`);return e}function Yi(e,t){if(!Array.isArray(e))throw Error(`Invalid ${t}: expected a string array`);let n=[];for(let r of e){if(typeof r!=`string`)throw Error(`Invalid ${t}: expected a string array`);n.push(r)}return n}function Xi(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`Invalid ${t}: expected a non-negative safe integer`);return e}function Zi(e,t){if(typeof e==`number`&&!Number.isSafeInteger(e))throw Error(`Invalid ${t}: expected a safe integer or decimal string`);if(typeof e!=`string`&&typeof e!=`number`||!/^\d+$/.test(String(e)))throw Error(`Invalid ${t}: expected an unsigned decimal integer`);return BigInt(e)}function Qi(e,t){return{block_height:Xi(e.block_height,`${t}.block_height`),block_hash:X(e.block_hash,`${t}.block_hash`)}}function $i(e){let t=Y(Y(e,`NEAR access key permission`).FunctionCall,`NEAR access key permission.FunctionCall`);return{FunctionCall:{allowance:X(t.allowance,`NEAR access key allowance`),receiver_id:X(t.receiver_id,`NEAR access key receiver_id`),method_names:Yi(t.method_names,`NEAR access key method_names`)}}}function ea(e){return e===`FullAccess`?e:$i(e)}function ta(e,t){return{...t,nonce:Zi(e.nonce,`NEAR access key nonce`),permission:ea(e.permission)}}function na(e){let t=Y(e,`NEAR access key response`);return ta(t,Qi(t,`NEAR access key response`))}function ra(e){let t=Y(e,`NEAR access key list response`),n=Qi(t,`NEAR access key list response`);if(!Array.isArray(t.keys))throw Error(`Invalid NEAR access key list response.keys: expected an array`);let r=[];for(let e of t.keys){let t=Y(e,`NEAR access key list entry`),i=Y(t.access_key,`NEAR access key list entry.access_key`);r.push({public_key:X(t.public_key,`NEAR access key list entry.public_key`),access_key:ta(i,n)})}return{...n,keys:r}}function ia(e){let t=Y(e,`NEAR account response`);return{...Qi(t,`NEAR account response`),amount:Zi(t.amount,`NEAR account response.amount`),locked:Zi(t.locked,`NEAR account response.locked`),code_hash:X(t.code_hash,`NEAR account response.code_hash`),storage_usage:Xi(t.storage_usage,`NEAR account response.storage_usage`),storage_paid_at:Xi(t.storage_paid_at,`NEAR account response.storage_paid_at`)}}function aa(e){let t=X(Y(e,`NEAR view code response`).code_base64,`NEAR view code response.code_base64`);if(!t)throw Error(`Invalid NEAR view code response.code_base64: empty string`);return t}function oa(e){let t=Y(Y(e,`NEAR block response`).header,`NEAR block response.header`);return{header:{hash:X(t.hash,`NEAR block response.header.hash`),height:Xi(t.height,`NEAR block response.header.height`)}}}function sa(e){let t=Y(e,`NEAR contract call response`);if(!Array.isArray(t.result))throw Error(`Invalid NEAR contract call response.result: expected bytes`);let n=[];for(let e of t.result){if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`Invalid NEAR contract call response.result: expected bytes`);n.push(e)}return{...Qi(t,`NEAR contract call response`),logs:Yi(t.logs,`NEAR contract call response.logs`),result:n}}function ca(e){let t=new TextDecoder(`utf-8`,{fatal:!0}).decode(Uint8Array.from(e));if(!t.trim())return null;try{return JSON.parse(t)}catch{return t}}function la(e,t){let n=Y(e,t),r=typeof n.error_type==`string`?n.error_type:`InvalidTxError`in n?`InvalidTxError`:`ActionError`in n?`ActionError`:`TxExecutionError`;return{error_message:typeof n.error_message==`string`?n.error_message:`NEAR execution failed`,error_type:r,...`InvalidTxError`in n?{InvalidTxError:n.InvalidTxError}:{},...`ActionError`in n?{ActionError:n.ActionError}:{}}}function ua(e,t){let n=0;for(let r of t)Object.prototype.hasOwnProperty.call(e,r)&&n++;if(n!==1)throw Error(`Invalid NEAR status: expected exactly one variant`)}function da(e){if(e===`Unknown`)return qi.Unknown;if(e===`Pending`)return qi.Pending;if(e===`Failure`)return qi.Failure;let t=Y(e,`NEAR execution status`);if(ua(t,[`SuccessValue`,`SuccessReceiptId`,`Failure`]),typeof t.SuccessValue==`string`)return{SuccessValue:t.SuccessValue};if(typeof t.SuccessReceiptId==`string`)return{SuccessReceiptId:t.SuccessReceiptId};if(`Failure`in t)return{Failure:la(t.Failure,`NEAR execution failure`)};throw Error(`Invalid NEAR execution status`)}function fa(e){if(e===`NotStarted`)return Ji.NotStarted;if(e===`Started`)return Ji.Started;if(e===`Failure`)return Ji.Failure;let t=Y(e,`NEAR final execution status`);if(ua(t,[`SuccessValue`,`Failure`]),typeof t.SuccessValue==`string`)return{SuccessValue:t.SuccessValue};if(`Failure`in t)return{Failure:la(t.Failure,`NEAR final execution failure`)};throw Error(`Invalid NEAR final execution status`)}function pa(e){let t=Y(e,`NEAR execution outcome`);return{logs:Yi(t.logs,`NEAR execution outcome.logs`),receipt_ids:Yi(t.receipt_ids,`NEAR execution outcome.receipt_ids`),gas_burnt:Xi(t.gas_burnt,`NEAR execution outcome.gas_burnt`),tokens_burnt:X(t.tokens_burnt,`NEAR execution outcome.tokens_burnt`),executor_id:X(t.executor_id,`NEAR execution outcome.executor_id`),status:da(t.status)}}function ma(e){let t=Y(e,`NEAR execution outcome with id`);return{id:X(t.id,`NEAR execution outcome id`),outcome:pa(t.outcome)}}function ha(e){switch(e){case`NONE`:case`INCLUDED`:case`INCLUDED_FINAL`:case`EXECUTED`:case`FINAL`:case`EXECUTED_OPTIMISTIC`:return e;default:throw Error(`Invalid NEAR final_execution_status`)}}function ga(e){let t=Y(e,`NEAR final execution outcome`);if(!Array.isArray(t.receipts_outcome))throw Error(`Invalid NEAR final execution outcome.receipts_outcome: expected an array`);return{final_execution_status:ha(t.final_execution_status),status:fa(t.status),transaction:{hash:X(Y(t.transaction,`NEAR final execution outcome.transaction`).hash,`NEAR final execution outcome.transaction.hash`)},transaction_outcome:ma(t.transaction_outcome),receipts_outcome:t.receipts_outcome.map(ma)}}function _a(e){return String(e||``).trim()}function va(e){return String(e||``).trim()}async function ya(e){return g(await re(d(e)))}async function ba(e){return g(await re(d(e)))}function xa(t){let n=Oe(t);if(!n||!(`caller`in n))return null;let i=Ee(n.caller);if(i===`linked_device_ceremony`)return Object.prototype.hasOwnProperty.call(n,`source`)?null:{caller:`linked_device_ceremony`};if(i!==`same_device_addition`)return null;let a=Oe(`source`in n?n.source:void 0);if(!a)return null;let o=e(`walletAuthorityId`in a?a.walletAuthorityId:void 0),s=r(`walletAuthMethodId`in a?a.walletAuthMethodId:void 0),c=Ee(`walletSessionId`in a?a.walletSessionId:void 0),l=Ee(`authorityDigestB64u`in a?a.authorityDigestB64u:void 0),u=`revocationEpoch`in a?a.revocationEpoch:void 0;return!o.ok||!s.ok||!c||!l||typeof u!=`number`||!Number.isSafeInteger(u)||u<0?null:{caller:`same_device_addition`,source:{walletAuthorityId:o.value,walletAuthMethodId:s.value,walletSessionId:c,authorityDigestB64u:l,revocationEpoch:u}}}function Sa(e,t){return e.walletAuthorityId===t.walletAuthorityId&&e.walletAuthMethodId===t.walletAuthMethodId&&e.walletSessionId===t.walletSessionId&&e.authorityDigestB64u===t.authorityDigestB64u&&e.revocationEpoch===t.revocationEpoch}function Z(e,t,n,r=[]){let i=Oe(e);if(!i)throw Error(t+` must be an object`);let a=new Set([...n,...r]),o=Object.keys(i);if(o.length<n.length||o.length>a.size)throw Error(t+` has invalid fields`);for(let e of n)if(!Object.prototype.hasOwnProperty.call(i,e))throw Error(t+`.`+e+` is required`);for(let e of o)if(!a.has(e))throw Error(t+` has invalid fields`);return i}function Q(e,t,n){if(!Object.prototype.hasOwnProperty.call(e,t))throw Error(n+`.`+t+` is required`);return Reflect.get(e,t)}function Ca(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function $(e,t,n){let r=Q(e,t,n);if(typeof r!=`string`||r.length===0||r.trim()!==r)throw Error(n+`.`+t+` must be a non-empty canonical string`);return r}function wa(e,t,n,r){let i=Q(e,t,n);if(typeof i!=`number`||!Number.isSafeInteger(i)||i<r)throw Error(n+`.`+t+` must be a safe integer`);return i}function Ta(e,t){if(!Array.isArray(e))throw Error(t+` must be an array`);return e}function Ea(e,t,n){let r=Ta(Q(e,t,n),n+`.`+t);if(r.length===0)throw Error(n+`.`+t+` must not be empty`);let i=[];for(let e=0;e<r.length;e+=1){let a=r[e];if(typeof a!=`number`||!Number.isSafeInteger(a)||a<1)throw Error(n+`.`+t+`[`+e+`] must be a positive safe integer`);i.push(a)}return i}function Da(e,t,n){return Ca(e,t)?$(e,t,n):void 0}function Oa(e,t=`addSignerIntent.signerSelection.ecdsa.chainTarget`){try{let n=Z(e,t,[`kind`],[`namespace`,`chainId`,`networkSlug`]);switch($(n,`kind`,t)){case`evm`:{let e=Z(n,t,[`kind`,`namespace`,`chainId`],[`networkSlug`]);if($(e,`namespace`,t)!==`eip155`)return null;let r=wa(e,`chainId`,t,1),i=Da(e,`networkSlug`,t);return i===void 0?{kind:`evm`,namespace:`eip155`,chainId:r}:{kind:`evm`,namespace:`eip155`,chainId:r,networkSlug:i}}case`tempo`:{let e=Z(n,t,[`kind`,`chainId`],[`networkSlug`]),r=wa(e,`chainId`,t,1),i=Da(e,`networkSlug`,t);return i===void 0?{kind:`tempo`,chainId:r}:{kind:`tempo`,chainId:r,networkSlug:i}}default:return null}}catch{return null}}function ka(e){let t=`addSignerIntent.signerSelection`,n=Z(e,t,[`mode`],[`ed25519`,`ecdsa`]);switch($(n,`mode`,t)){case`ed25519`:{let e=Z(Q(Z(n,t,[`mode`,`ed25519`]),`ed25519`,t),t+`.ed25519`,[`mode`,`signerSlot`,`participantIds`,`keyPurpose`,`keyVersion`,`derivationVersion`]);if($(e,`mode`,t+`.ed25519`)!==`create_implicit_near_account`)throw Error(t+`.ed25519.mode is unsupported`);wa(e,`signerSlot`,t+`.ed25519`,1),Ea(e,`participantIds`,t+`.ed25519`),$(e,`keyPurpose`,t+`.ed25519`),$(e,`keyVersion`,t+`.ed25519`),wa(e,`derivationVersion`,t+`.ed25519`,1);break}case`ecdsa`:{let e=Z(Q(Z(n,t,[`mode`,`ecdsa`]),`ecdsa`,t),t+`.ecdsa`,[`chainTargets`,`participantIds`]),r=Ta(Q(e,`chainTargets`,t+`.ecdsa`),t+`.ecdsa.chainTargets`);if(r.length===0)throw Error(t+`.ecdsa.chainTargets must not be empty`);for(let e of r)if(!Oa(e))throw Error(t+`.ecdsa.chainTargets contains an invalid target`);Ea(e,`participantIds`,t+`.ecdsa`);break}default:throw Error(t+`.mode is unsupported`)}let r=ke(e,{normalizeEcdsaChainTarget:Oa});if(!r.ok)throw Error(r.message);return r.value}function Aa(e){let n=`addAuthMethodIntent.authMethod`,r=Z(e,n,[`kind`],[`rpId`,`email`]);switch($(r,`kind`,n)){case`passkey`:{let e=t($(Z(r,n,[`kind`,`rpId`]),`rpId`,n));if(!e.ok)throw Error(e.error.message);break}case`email_otp`:$(Z(r,n,[`kind`,`email`]),`email`,n);break;default:throw Error(n+`.kind is unsupported`)}let i=De(e);if(!i)throw Error(n+` is invalid`);return i}function ja(t){let n=`addAuthMethodIntent.source`,i=Z(t,n,[`walletAuthorityId`,`walletAuthMethodId`,`walletSessionId`,`authorityDigestB64u`,`revocationEpoch`]),a=e($(i,`walletAuthorityId`,n)),o=r($(i,`walletAuthMethodId`,n));if(!a.ok||!o.ok)throw Error(n+` has invalid identity`);$(i,`walletSessionId`,n),$(i,`authorityDigestB64u`,n),wa(i,`revocationEpoch`,n,0)}function Ma(e,t){if(!Ca(e,`runtimePolicyScope`))return;let n=t+`.runtimePolicyScope`,r=Z(Q(e,`runtimePolicyScope`,t),n,[`orgId`,`projectId`,`envId`],[`signingRootVersion`]),i=$(r,`orgId`,n),a=$(r,`projectId`,n),o=$(r,`envId`,n),s=Da(r,`signingRootVersion`,n);return s===void 0?{orgId:i,projectId:a,envId:o}:{orgId:i,projectId:a,envId:o,signingRootVersion:s}}function Na(e,t){let r=n($(e,`walletId`,t));if(!r.ok)throw Error(r.error.message);return r.value}function Pa(e,t,n){let i=r($(e,t,n));if(!i.ok)throw Error(i.error.message);return i.value}function Fa(e){let t=`addSignerIntent`,n=Z(e,t,[`version`,`walletId`,`signerSelection`,`nonceB64u`],[`runtimePolicyScope`]);if($(n,`version`,t)!==`add_signer_intent_v1`)throw Error(t+`.version is unsupported`);let r=Na(n,t),i=Ma(n,t),a=$(n,`nonceB64u`,t),o=ka(Q(n,`signerSelection`,t));return i===void 0?{version:`add_signer_intent_v1`,walletId:r,signerSelection:o,nonceB64u:a}:{version:`add_signer_intent_v1`,walletId:r,signerSelection:o,runtimePolicyScope:i,nonceB64u:a}}function Ia(e){let t=`addAuthMethodIntent`,n=Z(e,t,[`version`,`walletId`,`authMethod`,`targetWalletAuthMethodId`,`caller`,`nonceB64u`],[`runtimePolicyScope`,`source`]);if($(n,`version`,t)!==`add_auth_method_intent_v1`)throw Error(t+`.version is unsupported`);let r=Na(n,t),i=Pa(n,`targetWalletAuthMethodId`,t),a=Aa(Q(n,`authMethod`,t)),o=Ma(n,t),s=$(n,`nonceB64u`,t);switch($(n,`caller`,t)){case`same_device_addition`:ja(Q(n,`source`,t));break;case`linked_device_ceremony`:if(Ca(n,`source`))throw Error(t+`.source is not valid for linked_device_ceremony`);break;default:throw Error(t+`.caller is unsupported`)}let c=xa(n);if(!c)throw Error(t+`.caller is invalid`);let l=o===void 0?{version:`add_auth_method_intent_v1`,walletId:r,authMethod:a,targetWalletAuthMethodId:i,nonceB64u:s}:{version:`add_auth_method_intent_v1`,walletId:r,authMethod:a,targetWalletAuthMethodId:i,runtimePolicyScope:o,nonceB64u:s};switch(c.caller){case`same_device_addition`:return{...l,caller:c.caller,source:c.source};case`linked_device_ceremony`:return{...l,caller:c.caller};default:return La(c)}}function La(e){throw Error(`Unsupported add-auth-method intent caller: ${String(e)}`)}function Ra(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(!Number.isSafeInteger(e[n])||e[n]!==t[n])return!1;return!0}function za(e,t){switch(e.kind){case`evm`:return t.kind===`evm`&&e.namespace===t.namespace&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;case`tempo`:return t.kind===`tempo`&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;default:return Ba(e)}}function Ba(e){throw Error(`Unsupported add-signer chain target: ${String(e)}`)}function Va(e,t){if(e.mode!==t.mode)return!1;switch(e.mode){case`ed25519`:return t.mode===`ed25519`&&e.ed25519.mode===t.ed25519.mode&&e.ed25519.signerSlot===t.ed25519.signerSlot&&Ra(e.ed25519.participantIds,t.ed25519.participantIds)&&e.ed25519.keyPurpose===t.ed25519.keyPurpose&&e.ed25519.keyVersion===t.ed25519.keyVersion&&e.ed25519.derivationVersion===t.ed25519.derivationVersion;case`ecdsa`:if(t.mode!==`ecdsa`||e.ecdsa.chainTargets.length!==t.ecdsa.chainTargets.length)return!1;for(let n=0;n<e.ecdsa.chainTargets.length;n+=1)if(!za(e.ecdsa.chainTargets[n],t.ecdsa.chainTargets[n]))return!1;return Ra(e.ecdsa.participantIds,t.ecdsa.participantIds);default:return Ha(e)}}function Ha(e){throw Error(`Unsupported add-signer selection: ${String(e)}`)}function Ua(e,t){return e===void 0||t===void 0?e===t:e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function Wa(e,t){return e.version===t.version&&e.walletId===t.walletId&&Va(e.signerSelection,t.signerSelection)&&Ua(e.runtimePolicyScope,t.runtimePolicyScope)&&e.nonceB64u===t.nonceB64u}function Ga(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId;case`email_otp`:return t.kind===`email_otp`&&e.email===t.email;default:return Ka(e)}}function Ka(e){throw Error(`Unsupported add-auth-method input: ${String(e)}`)}function qa(e,t){if(e.version!==t.version||e.walletId!==t.walletId||!Ga(e.authMethod,t.authMethod)||e.targetWalletAuthMethodId!==t.targetWalletAuthMethodId||!Ua(e.runtimePolicyScope,t.runtimePolicyScope)||e.nonceB64u!==t.nonceB64u)return!1;switch(e.caller){case`same_device_addition`:return t.caller===`same_device_addition`&&Sa(e.source,t.source);case`linked_device_ceremony`:return t.caller===`linked_device_ceremony`;default:return Ja(e)}}function Ja(e){throw Error(`Unsupported add-auth-method intent: ${String(e)}`)}export{Mr as $,ti as A,Pr as B,Ai as C,mi as D,wi as E,Lr as F,yn as G,hn as H,Br as I,jr as J,Wn as K,zr as L,oi as M,li as N,di as O,Gr as P,xr as Q,Fr as R,Mi as S,Ei as T,_n as U,Kt as V,jn as W,kr as X,Tr as Y,Cr as Z,Wi as _,it as _t,Ia as a,Ln as at,Gi as b,Wa as c,Ct as ct,ia as d,ft as dt,un as et,oa as f,ht as ft,ca as g,ot as gt,ga as h,pt as ht,ya as i,zn as it,ii as j,hi as k,ra as l,St as lt,sa as m,mt,va as n,Sn as nt,Fa as o,sn as ot,aa as p,dt as pt,Dr as q,ba as r,sr as rt,qa as s,cn as st,_a as t,wn as tt,na as u,st as ut,Hi as v,at as vt,Di as w,Vi as x,Ui as y,nt as yt,Rr as z};
+import{D as e,M as t,O as n,T as r,d as i,h as a,k as o,l as s,r as c,u as l}from"./domainIds-BzkGsRqO.js";import{C as u,D as ee,E as te,c as d,d as ne,k as f,u as re}from"./chains-C_X_fNuS.js";import{_ as p,d as ie,g as m,i as ae,l as h,n as oe,r as se,t as ce}from"./primitives-CqrjmIAH.js";import{i as g,r as _}from"./base64-DW79QA0h.js";import{n as le}from"./secureRandomId-LwBFx84B.js";import{A as v,C as ue,D as de,E as y,O as b,S as x,T as fe,_ as S,b as C,c as w,d as T,f as pe,g as E,h as D,l as O,m as k,n as me,o as he,p as ge,s as _e,u as A,v as ve,w as ye,x as j,y as M}from"./activeWalletSession-WdZkhtBB.js";import{d as be,f as xe,h as Se,m as Ce,p as we}from"./capabilityKinds-N8xo_IEh.js";import{a as Te,o as N,r as P}from"./canonicalPrimitives-Dsbsxgxc.js";import{i as Ee,n as De,t as Oe}from"./registrationAuthMethodInput-RbSR7R1G.js";import{a as ke}from"./registrationSignerPlan-CPzHavPM.js";import{i as Ae,t as je}from"./singletons-BXhnsqeY.js";import{d as Me,f as Ne}from"./walletAuthority-CAiGuWW2.js";import{en as Pe,rn as Fe}from"./emailOtpEcdsaDerivationIdentity-Bik0N8v9.js";import{A as Ie,L as Le,M as Re,N as ze,Y as Be,_ as Ve,f as He,h as Ue,j as We,p as Ge}from"./challengeDelivery-CATQ4u6P.js";import{a as F,i as Ke,n as I,o as qe,r as Je,s as Ye,t as L}from"./digestEncoding-BX3VW9eF.js";import{r as Xe}from"./walletAuthMethodRecord-LniOQQmj.js";function Ze(e){return typeof e==`string`&&/^wreg_[A-Za-z0-9_-]{43}$/u.test(e)?e:null}function Qe(){return`wreg_${le(32)}`}const $e=`wallet_registration_setup:`;function et(e,t){return`${$e}${e}:${t}`}function tt(e){if(!u(e)||!u(e.value))throw Error(`Registration setup journal is invalid`);let t=e.value,r=ee(t.scopeDigest,`Registration setup scope digest`),i=ee(t.requestDigest,`Registration setup request digest`),a=Ze(t.operationId);if(!a||!/^[a-f0-9]{64}$/u.test(r)||!/^[a-f0-9]{64}$/u.test(i)||e.key!==et(r,i))throw Error(`Registration setup journal scope is invalid`);if(t.state===`pending`&&!(`walletId`in t)&&!(`registrationCeremonyId`in t))return{state:`pending`,operationId:a,scopeDigest:r,requestDigest:i};if(t.state===`accepted`){let e=n(t.walletId);if(e.ok)return{state:`accepted`,operationId:a,scopeDigest:r,requestDigest:i,walletId:e.value,registrationCeremonyId:ee(t.registrationCeremonyId,`Registration setup ceremony`)}}throw Error(`Registration setup journal state is invalid`)}async function nt(e){return ne(d({relayerUrl:e.relayerUrl.replace(/\/+$/u,``),publishableKey:e.publishableKey,environmentId:e.environmentId}))}function rt(){}var it=class{constructor(e){this.manager=e}async begin(e,t){let n=await ne(d(t)),r=et(e,n),i={state:`pending`,operationId:Qe(),scopeDigest:e,requestDigest:n},a=(await this.manager.getDB()).transaction(Ae.appState,`readwrite`),o=await a.store.get(r),s=o===void 0?i:tt(o);return o===void 0&&await a.store.put({key:r,value:s}),await a.done,s}async accept(e,t){let n=et(e.scopeDigest,e.requestDigest),r=(await this.manager.getDB()).transaction(Ae.appState,`readwrite`),i=tt(await r.store.get(n));if(i.operationId!==e.operationId||i.state===`accepted`&&(i.walletId!==t.walletId||i.registrationCeremonyId!==t.registrationCeremonyId))throw r.abort(),await r.done.catch(rt),Error(`Registration setup response changed its operation, wallet or ceremony`);let a={state:`accepted`,operationId:i.operationId,scopeDigest:i.scopeDigest,requestDigest:i.requestDigest,walletId:t.walletId,registrationCeremonyId:t.registrationCeremonyId};await r.store.put({key:n,value:a}),await r.done}async complete(e){let t=(await this.manager.getDB()).transaction(Ae.appState,`readwrite`),n=(await t.store.getAll(IDBKeyRange.bound($e,`${$e}\uffff`))).map(tt);for(let r of n)r.state===`accepted`&&r.walletId===e.walletId&&r.registrationCeremonyId===e.registrationCeremonyId&&await t.store.delete(et(r.scopeDigest,r.requestDigest));await t.done}};const at=new it(je);function ot(e){throw Error(`[LinkSessionStateV1] unsupported state: ${String(e)}`)}const st=`x25519-hkdf-sha256-chacha20poly1305-v1`,ct=/^[A-Za-z0-9_-]+$/,lt=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`registeredAtMs`],ut=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`ephemeralPublicKeyB64u`,`nonceB64u`,`sealedExportRootB64u`,`bindingDigestB64u`,`ciphertextDigestB64u`,`sealedAtMs`];function dt(e,t=`recipientPublicKeyB64u`){if(typeof e!=`string`||!ct.test(e))throw Error(`${t} must be unpadded base64url`);let n;try{n=_(e)}catch{throw Error(`${t} must be valid base64url`)}if(g(n)!==e)throw Error(`${t} must be canonical base64url`);if(n.length!==32)throw Error(`${t} must decode to a 32-byte X25519 public key`);return e}function ft(e){return{linkSessionId:e.linkSessionId,walletId:e.walletId,walletKeyId:e.walletKeyId,targetFactor:e.targetFactor,enrollmentId:e.enrollmentId,deviceId:e.deviceId,revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:e.applicationBindingDigestB64u,registeredPublicKeyB64u:e.registeredPublicKeyB64u,recipientPublicKeyB64u:e.recipientPublicKeyB64u}}function pt(e){return JSON.stringify({linkSessionId:String(e.linkSessionId),walletId:String(e.walletId),walletKeyId:String(e.walletKeyId),targetFactor:e.targetFactor,enrollmentId:String(e.enrollmentId),deviceId:String(e.deviceId),revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:String(e.applicationBindingDigestB64u),registeredPublicKeyB64u:String(e.registeredPublicKeyB64u),recipientPublicKeyB64u:String(e.recipientPublicKeyB64u)})}function mt(e){let t=_t(e,lt,`LinkedDeviceEd25519ExportRootRecipientV1`);if(t.kind!==`linked_device_ed25519_export_root_recipient_v1`)throw Error(`LinkedDeviceEd25519ExportRootRecipientV1.kind is invalid`);return vt(t.transferAlg,`LinkedDeviceEd25519ExportRootRecipientV1.transferAlg`),{kind:`linked_device_ed25519_export_root_recipient_v1`,linkSessionId:h(s(t.linkSessionId),`LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId`),walletId:h(n(t.walletId),`walletId`),walletKeyId:h(o(t.walletKeyId),`walletKeyId`),enrollmentId:h(l(t.enrollmentId),`enrollmentId`),deviceId:h(i(t.deviceId),`deviceId`),transferAlg:st,applicationBindingDigestB64u:ce(t.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:oe(t.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:gt(t.targetFactor),revocationEpoch:yt(t.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:dt(t.recipientPublicKeyB64u,`recipientPublicKeyB64u`),registeredAtMs:bt(t.registeredAtMs,`registeredAtMs`)}}function ht(e){let t=_t(e,ut,`LinkedDeviceEd25519ExportRootPackageV1`);if(t.kind!==`linked_device_ed25519_export_root_package_v1`)throw Error(`LinkedDeviceEd25519ExportRootPackageV1.kind is invalid`);vt(t.transferAlg,`LinkedDeviceEd25519ExportRootPackageV1.transferAlg`);let r=dt(t.recipientPublicKeyB64u,`recipientPublicKeyB64u`),a=dt(t.ephemeralPublicKeyB64u,`ephemeralPublicKeyB64u`);if(r===a)throw Error(`ephemeralPublicKeyB64u repeats the recipient key`);return{kind:`linked_device_ed25519_export_root_package_v1`,linkSessionId:h(s(t.linkSessionId),`linkSessionId`),walletId:h(n(t.walletId),`walletId`),walletKeyId:h(o(t.walletKeyId),`walletKeyId`),enrollmentId:h(l(t.enrollmentId),`enrollmentId`),deviceId:h(i(t.deviceId),`deviceId`),transferAlg:st,applicationBindingDigestB64u:ce(t.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:oe(t.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:gt(t.targetFactor),revocationEpoch:yt(t.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:r,ephemeralPublicKeyB64u:a,nonceB64u:ae(t.nonceB64u,`nonceB64u`),sealedExportRootB64u:se(t.sealedExportRootB64u,`sealedExportRootB64u`),bindingDigestB64u:ce(t.bindingDigestB64u,`bindingDigestB64u`),ciphertextDigestB64u:ce(t.ciphertextDigestB64u,`ciphertextDigestB64u`),sealedAtMs:bt(t.sealedAtMs,`sealedAtMs`)}}function gt(e){switch(_t(e,[`kind`],`targetFactor`).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`targetFactor.kind is unsupported`)}}function _t(e,t,n){let r=f(e,n);p(r,t,n);for(let e of t)if(r[e]===void 0)throw Error(`${n}.${e} is required`);return r}function vt(e,t){if(e!==`x25519-hkdf-sha256-chacha20poly1305-v1`)throw Error(`${t} must be ${st}`)}function yt(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function bt(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive unix-millisecond timestamp`);return e}function R(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);return e}function z(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} must not be empty`);if(n!==e)throw Error(`${t} must not be padded with whitespace`);return n}function xt(e,n){let r=t(z(e,n));if(!r.ok)throw Error(`${n} is invalid: ${r.error.message}`);return r.value}function B(e,t,n){if(e!==t)throw Error(`${n} must be ${String(t)}`);return t}function St(e){let t=`WalletAddAuthMethodRegistrationOptions`,n=R(e,t);B(n.kind,`webauthn_add_auth_method_registration_v1`,`${t}.kind`);let r=R(n.user,`${t}.user`),i=R(n.authenticatorSelection,`${t}.authenticatorSelection`),a=R(R(R(n.extensions,`${t}.extensions`).prf,`${t}.extensions.prf`).eval,`${t}.extensions.prf.eval`);if(!Array.isArray(n.pubKeyCredParams)||n.pubKeyCredParams.length!==2)throw Error(`${t}.pubKeyCredParams must list exactly two algorithms`);let[o,s]=n.pubKeyCredParams;if(B(R(o,`${t}.pubKeyCredParams[0]`).type,`public-key`,`${t}.pubKeyCredParams[0].type`),B(R(o,`${t}.pubKeyCredParams[0]`).alg,-7,`${t}.pubKeyCredParams[0].alg`),B(R(s,`${t}.pubKeyCredParams[1]`).type,`public-key`,`${t}.pubKeyCredParams[1].type`),B(R(s,`${t}.pubKeyCredParams[1]`).alg,-257,`${t}.pubKeyCredParams[1].alg`),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);let c=n.excludeCredentials.map((e,n)=>{let r=R(e,`${t}.excludeCredentials[${n}]`);return{type:B(r.type,`public-key`,`${t}.excludeCredentials[${n}].type`),id:z(r.id,`${t}.excludeCredentials[${n}].id`)}}),l=n.timeoutMs;if(typeof l!=`number`||!Number.isSafeInteger(l)||l<=0)throw Error(`${t}.timeoutMs must be a positive safe integer`);return{kind:`webauthn_add_auth_method_registration_v1`,challengeId:z(n.challengeId,`${t}.challengeId`),challengeB64u:z(n.challengeB64u,`${t}.challengeB64u`),rpId:xt(n.rpId,`${t}.rpId`),user:{idB64u:z(r.idB64u,`${t}.user.idB64u`),name:z(r.name,`${t}.user.name`),displayName:z(r.displayName,`${t}.user.displayName`)},pubKeyCredParams:[{type:`public-key`,alg:-7},{type:`public-key`,alg:-257}],authenticatorSelection:{residentKey:B(i.residentKey,`required`,`${t}.authenticatorSelection.residentKey`),userVerification:B(i.userVerification,`preferred`,`${t}.authenticatorSelection.userVerification`)},timeoutMs:l,attestation:B(n.attestation,`none`,`${t}.attestation`),extensions:{prf:{eval:{firstB64u:z(a.firstB64u,`${t}.extensions.prf.eval.firstB64u`),secondB64u:z(a.secondB64u,`${t}.extensions.prf.eval.secondB64u`)}}},excludeCredentials:c}}function Ct(e){let t=Mt(e);if(t.kind!==`committed_authority_packages_v1`)throw Error(`CommittedAuthorityPackagesV1.kind is invalid`);let n=Me(t.authority);if(!n.ok||n.value.state!==`pending_local_install`)throw Error(`CommittedAuthorityPackagesV1.authority is not pending`);let r=Xe(t.authMethod);if(!r||r.status!==`pending_local_install`)throw Error(`CommittedAuthorityPackagesV1.authMethod is not pending`);if(r.walletId!==n.value.walletId||r.walletAuthorityId!==n.value.authorityId)throw Error(`CommittedAuthorityPackagesV1 authority and auth method identities differ`);let i=Tt(t.signerPackages);wt(i,n.value.signerActivations);let a=t.ed25519ExportRootPackage===null?null:ht(t.ed25519ExportRootPackage);if(a&&(a.walletId!==n.value.walletId||a.revocationEpoch!==n.value.revocationEpoch||n.value.provenance.kind!==`device_link`||a.enrollmentId!==n.value.provenance.enrollmentId||a.linkSessionId!==n.value.provenance.linkSessionId||String(a.deviceId)!==String(n.value.principal.deviceId)))throw Error(`CommittedAuthorityPackagesV1 export root identity does not match authority`);return{kind:`committed_authority_packages_v1`,authority:n.value,authMethod:r,signerPackages:i,ed25519ExportRootPackage:a,packageSetDigestB64u:Et(t.packageSetDigestB64u)}}function wt(e,t){if(e.keyFamilies.length!==t.keyFamilies.length)throw Error(`CommittedAuthorityPackagesV1 signer families do not match authority`);for(let n=0;n<e.keyFamilies.length;n+=1)if(e.keyFamilies[n]!==t.keyFamilies[n])throw Error(`CommittedAuthorityPackagesV1 signer family order does not match authority`);if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`){if(!t.ed25519||!e.ed25519)throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation is missing`);if(!c(e.ed25519.materialActivation,t.ed25519.materialActivation))throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation does not match authority`);return}if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`){if(!t.ecdsa||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 ECDSA activation is missing`);if(!c(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 ECDSA activation does not match authority`);return}if(!t.ed25519||!t.ecdsa||!e.ed25519||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 combined activations are incomplete`);if(!c(e.ed25519.materialActivation,t.ed25519.materialActivation)||!c(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 activation references do not match authority`)}function Tt(e){let t=Nt(e);if(t.kind!==`committed_signer_package_set_v1`)throw Error(`CommittedSignerPackageSetV1.kind is invalid`);let n=jt(t.keyFamilies);if(n.length===1&&n[0]===`ed25519`){if(!(`ed25519`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:Dt(t.ed25519)}}if(n.length===1&&n[0]===`ecdsa_secp256k1`){if(!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ecdsa:Ot(t.ecdsa)}}if(!(`ed25519`in t)||!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);let r=Dt(t.ed25519),i=Ot(t.ecdsa);if(r.materialActivation.activationId===i.materialActivation.activationId)throw Error(`CommittedSignerPackageSetV1 activation references must be distinct`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:r,ecdsa:i}}function Et(e){return P(e)}function Dt(e){let t=Pt(e);if(t.kind!==`committed_ed25519_signer_package_v1`)throw Error(`CommittedEd25519SignerPackageV1.kind is invalid`);let n=At(t.materialActivation,`materialActivation`),r=Re(t.targetBinding),i=We(t.applicationBinding),a=Ie(t.activationReceipt);if(!c(n,Pe(a.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 activation receipt does not match material`);if(!c(n,Pe(r.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 target binding does not match material`);let o=kt(t.deriver_a_client_package,`deriver_a_client_package`,`deriver_a`),s=kt(t.deriver_b_client_package,`deriver_b_client_package`,`deriver_b`);if(!Be(a.transcript,o.transcript)||!Be(a.transcript,s.transcript))throw Error(`CommittedEd25519SignerPackageV1 receipt transcript does not match packages`);return{kind:`committed_ed25519_signer_package_v1`,materialActivation:n,targetBinding:r,applicationBinding:i,participantIds:Le(t.participantIds),activationReceipt:a,deriver_a_client_package:o,deriver_b_client_package:s}}function Ot(e){let t=Ft(e);if(t.kind!==`committed_ecdsa_signer_package_v1`)throw Error(`CommittedEcdsaSignerPackageV1.kind is invalid`);let n=At(t.materialActivation,`materialActivation`),r=Ge(t.activationReceipt),i=r.binding.target.activation;if(!c(n,i))throw Error(`CommittedEcdsaSignerPackageV1 receipt activation does not match material`);let a=He(t.encryptedTargetClientShare,`encryptedTargetClientShare`);if(a.recipientPublicKeyB64u!==r.binding.target.clientRecipientPublicKeyB64u)throw Error(`CommittedEcdsaSignerPackageV1 client share recipient does not match receipt`);return{kind:`committed_ecdsa_signer_package_v1`,materialActivation:n,encryptedTargetClientShare:a,activationReceipt:r}}function kt(e,t,n){let r=ze(e);if(!r.ok)throw Error(`${t} ${r.message}`);if(r.value.kind!==`activation_client`||r.value.deriver!==n)throw Error(`${t} must be an activation_client for ${n}`);return{kind:`activation_client`,deriver:n,session:r.value.session,transcript:r.value.transcript,encapsulated_key:r.value.encapsulated_key,ciphertext:r.value.ciphertext}}function At(e,t){let n=a(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function jt(e){if(!Array.isArray(e))throw Error(`CommittedSignerPackageSetV1.keyFamilies must be an array`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`CommittedSignerPackageSetV1.keyFamilies must use canonical family order`)}function Mt(e){let t=It(e);if(t===null)throw Error(`CommittedAuthorityPackagesV1 must be an object`);return V(t,[`kind`,`authority`,`authMethod`,`signerPackages`,`ed25519ExportRootPackage`,`packageSetDigestB64u`],`CommittedAuthorityPackagesV1`),{kind:Reflect.get(t,`kind`),authority:Reflect.get(t,`authority`),authMethod:Reflect.get(t,`authMethod`),signerPackages:Reflect.get(t,`signerPackages`),ed25519ExportRootPackage:Reflect.get(t,`ed25519ExportRootPackage`),packageSetDigestB64u:Reflect.get(t,`packageSetDigestB64u`)}}function Nt(e){let t=It(e);if(t===null)throw Error(`CommittedSignerPackageSetV1 must be an object`);let n=Object.keys(t),r=n.includes(`ed25519`),i=n.includes(`ecdsa`);return r&&i?(V(t,[`kind`,`keyFamilies`,`ed25519`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`),ecdsa:Reflect.get(t,`ecdsa`)}):r?(V(t,[`kind`,`keyFamilies`,`ed25519`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`)}):i?(V(t,[`kind`,`keyFamilies`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ecdsa:Reflect.get(t,`ecdsa`)}):(V(t,[`kind`,`keyFamilies`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`)})}function Pt(e){let t=It(e);if(t===null)throw Error(`CommittedEd25519SignerPackageV1 must be an object`);return V(t,[`kind`,`materialActivation`,`targetBinding`,`applicationBinding`,`participantIds`,`activationReceipt`,`deriver_a_client_package`,`deriver_b_client_package`],`CommittedEd25519SignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),targetBinding:Reflect.get(t,`targetBinding`),applicationBinding:Reflect.get(t,`applicationBinding`),participantIds:Reflect.get(t,`participantIds`),activationReceipt:Reflect.get(t,`activationReceipt`),deriver_a_client_package:Reflect.get(t,`deriver_a_client_package`),deriver_b_client_package:Reflect.get(t,`deriver_b_client_package`)}}function Ft(e){let t=It(e);if(t===null)throw Error(`CommittedEcdsaSignerPackageV1 must be an object`);return V(t,[`kind`,`materialActivation`,`encryptedTargetClientShare`,`activationReceipt`],`CommittedEcdsaSignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),encryptedTargetClientShare:Reflect.get(t,`encryptedTargetClientShare`),activationReceipt:Reflect.get(t,`activationReceipt`)}}function It(e){return typeof e==`object`&&e&&!Array.isArray(e)?e:null}function V(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length)throw Error(`${n} contains unexpected fields`);for(let e of i)if(!r.has(e))throw Error(`${n} contains unexpected fields`);for(let r of t)if(!Object.prototype.hasOwnProperty.call(e,r))throw Error(`${n}.${r} is required`)}const Lt=[`version`,`purpose`,`linkSessionId`,`linkPublicKeyB64u`,`devicePublicKeyB64u`,`requestedPermission`,`targetFactor`,`issuedAtMs`,`expiresAtMs`];function Rt(...e){return(t,n)=>{if(!e.includes(t))throw Error(`${n} is unsupported`);return t}}function zt(e,t){if(typeof e!=`string`||!/^[0-9a-f]{64}$/.test(e))throw Error(`${t} must be 32 canonical lowercase hex bytes`);return e}function H(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=_(e);if(t.length!==32||g(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be a canonical 32-byte unpadded base64url key`)}return e}function U(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=_(e);if(t.length===0||g(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be canonical unpadded base64url`)}return e}function Bt(e,t,n){let r=U(e,n),i=_(r);try{if(i.length!==t)throw Error(`${n} must encode ${t} bytes`);return r}finally{i.fill(0)}}const W=BigInt(`0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff`),Vt=W-3n,Ht=BigInt(`0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b`);function Ut(e){let t=0n;for(let n of e)t=t<<8n|BigInt(n);return t}function Wt(e){let t=Ut(e.subarray(1,33)),n=Ut(e.subarray(33,65));return t>=W||n>=W?!1:n*n%W===(t*t*t%W+Vt*t%W+Ht)%W}function Gt(e,t){let n=Bt(e,65,t),r=_(n);try{if(r[0]!==4)throw Error(`${t} must be an uncompressed SEC1 P-256 point`);if(!Wt(r))throw Error(`${t} must be an on-curve P-256 point`);return n}finally{r.fill(0)}}function Kt(e){return H(e,`LinkDevicePublicKeyB64u`)}function qt(e,t){return _e(U(e,t),t)}function Jt(e,t){if(e!==`ed25519`&&e!==`ecdsa_secp256k1`)throw Error(`${t} must identify a supported key family`);return e}function G(e,t,n){if(t<=e)throw Error(`${n}.expiresAtMs must be after issuedAtMs`)}function Yt(e){return{kind:e.kind,permissions:[...ie(e)]}}function Xt(e){let t={version:e.version,purpose:e.purpose,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:Yt(e.requestedPermission),targetFactor:e.targetFactor,issuedAtMs:e.issuedAtMs,expiresAtMs:e.expiresAtMs};return e.targetFactor.kind===`email_otp`?{...t,targetEmail:e.targetEmail}:t}function K(e,t){switch(m(e,[`kind`],t).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`${t}.kind is unsupported`)}}function Zt(){return b({kind:y(`passkey_prf`)})}function Qt(){return b({kind:y(`email_otp`)})}function $t(){return b({kind:y(`existing_enrollment`)})}function en(){return b({kind:y(`new_enrollment`)})}function tn(){return v(`kind`,[$t(),en()])}function nn(e,t){return tn()(e,t)}function rn(){return b({enrollmentSealKeyVersion:k,clientUnlockPublicKeyB64u:k,unlockKeyVersion:k,serverSealedFactorCiphertextB64u:k})}function an(e,t){let n=f(e,t);if(n.kind===`passkey_prf`)return m(n,[`kind`],t),{kind:`passkey_prf`};if(n.kind===`email_otp`){let e=nn(n.enrollment,`${t}.enrollment`),r=E(n.targetEmail,`${t}.targetEmail`);return e.kind===`existing_enrollment`?{kind:`email_otp`,targetEmail:r,enrollment:e,baseWalletAuthMethodId:C(m(n,[`kind`,`targetEmail`,`enrollment`,`baseWalletAuthMethodId`],t).baseWalletAuthMethodId,`${t}.baseWalletAuthMethodId`)}:(m(n,[`kind`,`targetEmail`,`enrollment`],t),{kind:`email_otp`,targetEmail:r,enrollment:e})}throw Error(`${t}.kind is unsupported`)}function on(e){if(e.version!==`v5`)throw Error(`QrLinkedDeviceSessionPayloadV5.version is invalid`);if(e.purpose!==`linked_device_lane_creation`)throw Error(`QrLinkedDeviceSessionPayloadV5.purpose is invalid`);let t=S(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=S(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);G(t,n,`QrLinkedDeviceSessionPayloadV5`);let r={version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:M(e.linkSessionId,`QrLinkedDeviceSessionPayloadV5.linkSessionId`),linkPublicKeyB64u:H(e.linkPublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.linkPublicKeyB64u`),devicePublicKeyB64u:H(e.devicePublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.devicePublicKeyB64u`),requestedPermission:ge(e.requestedPermission,`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:K(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`),issuedAtMs:t,expiresAtMs:n};return r.targetFactor.kind===`email_otp`?{...r,targetFactor:{kind:`email_otp`},targetEmail:E(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`)}:{...r,targetFactor:{kind:`passkey_prf`}}}function sn(e){let t=f(e,`QrLinkedDeviceSessionPayloadV5`);return on(m(t,K(t.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`).kind===`email_otp`?[...Lt,`targetEmail`]:Lt,`QrLinkedDeviceSessionPayloadV5`))}function cn(e){let t=on(Xt(e)),n={v:5,s:t.linkSessionId,l:t.linkPublicKeyB64u,d:t.devicePublicKeyB64u,a:Yt(t.requestedPermission),f:t.targetFactor.kind===`passkey_prf`?`p`:`e`,i:t.issuedAtMs,e:t.expiresAtMs};return t.targetFactor.kind===`email_otp`?JSON.stringify({...n,t:t.targetEmail}):JSON.stringify(n)}function ln(){return b({payload:sn,requestedAtMs:S})}function un(e){return ln()(e,`LinkedDeviceOwnerAuthorizationRequestV1`)}function dn(){let e=e=>b({state:y(e),deviceId:he});return[b({state:y(`displaying_qr`)}),e(`claimed`),e(`awaiting_target_factor`),e(`awaiting_source_contribution`),e(`provisioning`),b({state:y(`authority_pending_local_install`),deviceId:he,authorityId:j,packageSetDigestB64u:w}),b({state:y(`active`),deviceId:he,authorityId:j,activatedAtMs:S}),b({state:y(`failed_before_commit`),error:pn}),b({state:y(`cancelled`),cancelledAtMs:S}),b({state:y(`expired`),expiredAtMs:S})]}function fn(e){let t=f(e,`LinkSessionStateV1`).state;if(typeof t!=`string`)throw Error(`LinkSessionStateV1.state is invalid`);let n=dn().find(e=>e.shape.state.literals.includes(t));if(!n)throw Error(`LinkSessionStateV1.state ${t} is unsupported`);return n(e,`LinkSessionStateV1.${t}`)}function pn(e){let t=m(e,[`kind`,`reason`],`LinkPrecommitFailureV1`);if(t.kind!==`invalid_input`&&t.kind!==`unauthorized_source`&&t.kind!==`revoked_source`&&t.kind!==`permission_attenuation_failed`&&t.kind!==`target_factor_failed`&&t.kind!==`expired_session`&&t.kind!==`cancelled_session`&&t.kind!==`claim_conflict`&&t.kind!==`package_preparation_failed`)throw Error(`LinkPrecommitFailureV1.kind is invalid`);return{kind:t.kind,reason:k(t.reason,`LinkPrecommitFailureV1.reason`)}}function mn(){return b({kind:y(`linked_device_session_projection_v1`),linkSessionId:M,qrPayload:sn,revision:D,createdAtMs:S,updatedAtMs:S,state:fn})}function hn(e){return mn()(e,`LinkSessionProjectionV1`)}function gn(){return b({kind:y(`linked_device_session_event_v1`),linkSessionId:M,state:fn,emittedAtMs:S})}function _n(e){return gn()(e,`LinkSessionTransportEventV1`)}function vn(){return v(`outcome`,[b({outcome:y(`pending`),state:bn}),b({outcome:y(`replayed`),replay:b({state:()=>`pending`,session:bn})})])}function yn(e){return vn()(e,`LinkedDeviceApprovalResultV1`)}function bn(e){let t=fn(e);switch(t.state){case`awaiting_target_factor`:case`awaiting_source_contribution`:case`provisioning`:case`authority_pending_local_install`:return t;default:throw Error(`LinkedDeviceApprovalResultV1 state is not pending`)}}function xn(){return b({kind:y(`linked_device_session_claim_v1`),linkSessionId:M,walletId:x,enrollmentId:O,deviceId:T,devicePublicKeyB64u:H,targetFactor:K,sessionRevision:S,claimedAtMs:S,claimExpiresAtMs:S},(e,t)=>G(e.claimedAtMs,e.claimExpiresAtMs,t))}function Sn(e){return xn()(e,`LinkedDeviceSessionClaimV1`)}function Cn(){return b({kind:y(`wallet_session`),walletSessionId:fe,authorizationId:ye})}function wn(e,t=`ownerAuthorization`){if(f(e,t).kind!==`wallet_session`)throw Error(`${t}.kind is unsupported`);return Cn()(e,t)}function Tn(){return{kind:y(`linked_device_approval_v1`),linkSessionId:M,walletId:x,enrollmentId:O,deviceId:T,linkPublicKeyB64u:H,devicePublicKeyB64u:H,permission:ge,targetFactor:an,ownerAuthorization:wn,approvedAtMs:S,expiresAtMs:S}}function En(e,t){G(e.approvedAtMs,e.expiresAtMs,t)}function Dn(){return b(Tn(),En)}function On(){return b({...Tn(),sourceContribution:Ve},En)}function kn(e){let t=f(e,`LinkedDeviceApprovalV1`);return(t.sourceContribution===void 0?Dn():On())(t,`LinkedDeviceApprovalV1`)}function An(){return b({kind:y(`linked_device_approval_delivery_v1`),approval:kn})}function jn(e){return An()(e,`LinkedDeviceApprovalDeliveryV1`)}function Mn(){return{kind:y(`linked_device_target_preparation_v1`),linkSessionId:M,walletId:x,enrollmentId:O,deviceId:T,deliveryRecipientPublicKey65B64u:Gt,walletAuthMethodId:C,ed25519ExportRoot:de(Kn()),ordinarySignerMaterialRecipientRequirements:Yn,issuedAtMs:S,expiresAtMs:S}}function Nn(e,t){if(e.expiresAtMs<=e.issuedAtMs)throw Error(`${t}.expiresAtMs must follow issuedAtMs`)}function Pn(){return b({...Mn(),targetFactor:Zt(),passkeyCreationOptions:Gn,passkeyConfigurationDigestB64u:w},(e,t)=>{if(Nn(e,t),e.passkeyCreationOptions.walletAuthMethodId!==e.walletAuthMethodId)throw Error(`${t}.passkeyCreationOptions.walletAuthMethodId must match the preparation`)})}function Fn(){return b({...Mn(),targetFactor:Qt(),targetEmail:E,enrollment:$t(),baseWalletAuthMethodId:C},Nn)}function In(){return b({...Mn(),targetFactor:Qt(),targetEmail:E,enrollment:en()},Nn)}function Ln(e){let t=`LinkedDeviceTargetPreparationV1`,n=f(e,t);return K(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?Pn()(n,t):(nn(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?In():Fn())(n,t)}function Rn(){return b({kind:y(`linked_device_target_preparation_request_v1`),linkSessionId:M,deliveryRecipientPublicKey65B64u:Gt})}function zn(e){return Rn()(e,`LinkedDeviceTargetPreparationRequestV1`)}function Bn(){return b({baseWalletAuthMethodId:C,maskedEmailHint:(e,t)=>{if(typeof e!=`string`||e.length===0)throw Error(`${t} is invalid`);return e}})}function Vn(){let e=Bn(),t=t=>e(t,`LinkedDeviceEmailOtpBaseFactorChoiceV1`);return{selected:b({kind:y(`selected`),choice:t}),selection_required:b({kind:y(`selection_required`),choices:(e,n)=>{if(!Array.isArray(e)||e.length===0)throw Error(`${n} must not be empty`);let r=e.map(t);return[r[0],...r.slice(1)]}}),unavailable:b({kind:y(`unavailable`),reason:Rt(`no_active_email_otp_base_factor`)})}}function Hn(e){let t=`LinkedDeviceEmailOtpBaseFactorResolutionV1`,n=f(e,t),r=Vn();switch(n.kind){case`selected`:case`selection_required`:case`unavailable`:return r[n.kind](n,t);default:throw Error(`${t}.kind is unsupported`)}}function Un(){return b({revision:S,resolution:Hn})}function Wn(e){return Un()(e,`LinkedDeviceEmailOtpBaseFactorResolutionResultV1`)}function Gn(e,t){let n=m(e,[`kind`,`walletAuthMethodId`,`challengeId`,`challengeB64u`,`rpId`,`user`,`pubKeyCredParams`,`authenticatorSelection`,`timeoutMs`,`attestation`,`extensions`,`excludeCredentials`],t),r=C(n.walletAuthMethodId,`${t}.walletAuthMethodId`);if(m(n.user,[`idB64u`,`name`,`displayName`],`${t}.user`),m(n.authenticatorSelection,[`residentKey`,`userVerification`],`${t}.authenticatorSelection`),m(m(m(n.extensions,[`prf`],`${t}.extensions`).prf,[`eval`],`${t}.extensions.prf`).eval,[`firstB64u`,`secondB64u`],`${t}.extensions.prf.eval`),!Array.isArray(n.pubKeyCredParams))throw Error(`${t}.pubKeyCredParams must be an array`);if(n.pubKeyCredParams.forEach((e,n)=>{m(e,[`type`,`alg`],`${t}.pubKeyCredParams[${n}]`)}),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);n.excludeCredentials.forEach((e,n)=>{m(e,[`type`,`id`],`${t}.excludeCredentials[${n}]`)});let i=St(n);return{kind:i.kind,walletAuthMethodId:r,challengeId:i.challengeId,challengeB64u:i.challengeB64u,rpId:i.rpId,user:i.user,pubKeyCredParams:i.pubKeyCredParams,authenticatorSelection:i.authenticatorSelection,timeoutMs:i.timeoutMs,attestation:i.attestation,extensions:i.extensions,excludeCredentials:i.excludeCredentials}}function Kn(){return b({kind:y(`linked_device_ed25519_export_root_preparation_v1`),walletKeyId:ue,applicationBindingDigestB64u:w,registeredPublicKeyB64u:oe,revocationEpoch:D})}function qn(e,t,n){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`${n} must contain one or two entries`);let r=e.map((e,r)=>t(e,`${n}[${r}]`));if(new Set(r.map(e=>e.keyFamily)).size!==r.length)throw Error(`${n} repeats a key family`);if(new Set(r.map(e=>String(e.walletKeyId))).size!==r.length)throw Error(`${n} repeats a wallet key`);if(r.length===2&&(r[0]?.keyFamily!==`ed25519`||r[1]?.keyFamily!==`ecdsa_secp256k1`))throw Error(`${n} must be ordered Ed25519 then ECDSA`);return r}function Jn(){return b({kind:y(`ordinary_signer_material_recipient_requirement_v1`),keyFamily:Jt,walletKeyId:ue})}function Yn(e){let t=qn(e,Jn(),`LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requirements are empty`);return[n,...t.slice(1)]}const Xn=y(`ble`,`cable`,`hybrid`,`internal`,`nfc`,`smart-card`,`usb`);function Zn(e,t){let n=te(e,t).map((e,n)=>Xn(e,`${t}[${n}]`));if(new Set(n).size!==n.length)throw Error(`${t} contains duplicates`);return n}function Qn(){return b({kind:y(`linked_device_webauthn_registration_v1`),credentialIdB64u:qt,authenticatorAttachment:de(y(`platform`,`cross-platform`)),clientDataJsonB64u:U,attestationObjectB64u:U,transports:Zn})}function $n(){let e=e=>(t,n)=>{if(t!==e)throw Error(`${n} does not match its kind`);return e};return v(`kind`,[b({kind:y(`ordinary_ed25519_signer_material_recipient_request_v1`),keyFamily:e(`ed25519`),walletKeyId:ue,recipientPublicKeyB64u:(e,t)=>Bt(e,32,t)}),b({kind:y(`ordinary_ecdsa_signer_material_recipient_request_v1`),keyFamily:e(`ecdsa_secp256k1`),walletKeyId:ue,clientEphemeralPublicKey:Fe})])}function er(e){let t=qn(e,$n(),`LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requests are empty`);return[n,...t.slice(1)]}function tr(){return{kind:y(`linked_device_target_credential_registration_v1`),linkSessionId:M,walletId:x,enrollmentId:O,deviceId:T,walletAuthMethodId:C}}function nr(){return b({...tr(),targetFactor:Zt(),targetPreparationDigestB64u:w,ordinarySignerMaterialRecipientRequests:er,webauthnRegistration:Qn(),registeredAtMs:S})}function rr(){return b({...tr(),targetFactor:Qt(),targetEmail:E,targetPreparationDigestB64u:w,ordinarySignerMaterialRecipientRequests:er,emailOtpVerificationGrant:xr,registeredAtMs:S})}function ir(){return b({...tr(),targetFactor:Qt(),targetEmail:E,targetPreparationDigestB64u:w,ordinarySignerMaterialRecipientRequests:er,emailOtpVerificationGrant:xr,emailOtpEnrollment:rn(),registeredAtMs:S})}function ar(e){let t=`LinkedDeviceTargetCredentialRegistrationV1`,n=f(e,t);return K(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?nr()(n,t):(xr(n.emailOtpVerificationGrant).enrollment.kind===`new_enrollment`?ir():rr())(n,t)}function or(){return b({kind:y(`linked_device_target_credential_registration_result_v1`),outcome:y(`applied`,`replayed`),linkSessionId:M,walletId:x,enrollmentId:O,deviceId:T,walletAuthMethodId:C,targetPreparationDigestB64u:w,targetFactor:fr,ordinarySignerMaterialPreparations:Ue,ordinarySignerMaterialRecipientRequests:er,keyManifestDigestB64u:w},(e,t)=>{let{authMethod:n}=e.targetFactor;if(n.walletAuthMethodId!==e.walletAuthMethodId||n.walletId!==e.walletId)throw Error(`${t} target identity differs`)})}function sr(e){return or()(e,`LinkedDeviceTargetCredentialRegistrationResultV1`)}function cr(e,t){if(e.verifiedAtMs<e.authMethod.createdAtMs)throw Error(`${t}.verifiedAtMs precedes authMethod.createdAtMs`)}function lr(){return b({kind:y(`verified_passkey_target_v1`),authMethod:mr,verificationDigestB64u:w,verifiedAtMs:S},cr)}function ur(){return b({kind:y(`verified_email_otp_target_v1`),authMethod:gr,targetEmail:E,enrollment:$t(),baseWalletAuthMethodId:C,providerUserId:k,verificationDigestB64u:w,verifiedAtMs:S},cr)}function dr(){return b({kind:y(`verified_email_otp_target_v1`),authMethod:gr,targetEmail:E,enrollment:en(),providerUserId:k,verificationDigestB64u:w,verifiedAtMs:S},cr)}function fr(e,t){let n=f(e,t);if(n.kind===`verified_passkey_target_v1`)return lr()(n,t);if(n.kind!==`verified_email_otp_target_v1`)throw Error(`${t}.kind is invalid`);return(nn(n.enrollment,`${t}.enrollment`).kind===`existing_enrollment`?ur():dr())(n,t)}function pr(){return b({walletAuthMethodId:C,walletId:x,createdAtMs:S,kind:y(`passkey`),rpId:ve,credentialIdB64u:_e,credentialPublicKeyB64u:U,counter:D})}function mr(e,t){return pr()(e,t)}function hr(){return b({walletAuthMethodId:C,walletId:x,createdAtMs:S,kind:y(`email_otp`),emailHashHex:zt,registrationAuthorityId:k})}function gr(e,t){return hr()(e,t)}function _r(e){return{kind:y(`linked_device_email_otp_verification_grant_v1`),grantId:k,grantToken:k,challengeId:k,linkSessionId:M,walletId:x,enrollmentId:O,deviceId:T,targetPreparationDigestB64u:w,targetEmail:E,enrollment:e,emailHashHex:zt,registrationAuthorityId:k,providerUserId:k,authorityDigestB64u:w,issuedAtMs:S,expiresAtMs:S}}function vr(e,t){G(e.issuedAtMs,e.expiresAtMs,t)}function yr(){return b({..._r($t()),baseWalletAuthMethodId:C},vr)}function br(){return b(_r(en()),vr)}function xr(e){let t=`LinkedDeviceEmailOtpVerificationGrantV1`,n=f(e,t);return(nn(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?br():yr())(n,t)}function Sr(){return b({kind:y(`email_otp_factor_release_v1`),challengeId:k,enrollmentId:k,enrollmentSealKeyVersion:k,serverEphemeralPublicKey65B64u:Gt,nonce12B64u:(e,t)=>Bt(e,12,t),ciphertextB64u:U})}function Cr(e){return Sr()(e,`LinkedDeviceEmailOtpFactorReleaseEnvelopeV1`)}function wr(){return b({kind:y(`linked_device_email_otp_challenge_start_request_v1`),linkSessionId:M,workerEphemeralPublicKey65B64u:Gt})}function Tr(e){return wr()(e,`LinkedDeviceEmailOtpChallengeStartRequestV1`)}function Er(){return b({kind:y(`linked_device_email_otp_challenge_resend_request_v1`),linkSessionId:M,challengeId:k})}function Dr(e){return Er()(e,`LinkedDeviceEmailOtpChallengeResendRequestV1`)}function Or(){return b({kind:y(`linked_device_email_otp_challenge_verify_request_v1`),linkSessionId:M,challengeId:k,otpCode:(e,t)=>{if(typeof e!=`string`||!/^[0-9]{6,10}$/.test(e))throw Error(`${t} is invalid`);return e}})}function kr(e){return Or()(e,`LinkedDeviceEmailOtpChallengeVerifyRequestV1`)}function Ar(){return b({kind:y(`linked_device_email_otp_challenge_result_v1`),challengeId:k,maskedEmailHint:k,expiresAtMs:S,resendAvailableAtMs:S})}function jr(e){return Ar()(e,`LinkedDeviceEmailOtpChallengeResultV1`)}function Mr(e){let t=m(e,[`kind`,`verificationGrant`,`factorRelease`],`LinkedDeviceEmailOtpVerificationResultV1`);if(t.kind!==`linked_device_email_otp_verification_result_v1`)throw Error(`LinkedDeviceEmailOtpVerificationResultV1.kind is invalid`);let n=xr(t.verificationGrant);if(Nr(n)){if(t.factorRelease!==null)throw Error(`new linked-device Email OTP enrollment cannot carry a factor release`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:null}}let r=Cr(t.factorRelease);if(r.challengeId!==n.challengeId)throw Error(`LinkedDeviceEmailOtpVerificationResultV1 challenge binding changed`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:r}}function Nr(e){return e.enrollment.kind===`new_enrollment`}function Pr(e){let t=S(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=S(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);G(t,n,`QrLinkedDeviceSessionPayloadV5`);let r=K(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`);if(r.kind===`passkey_prf`)return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:ge(Yt(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,issuedAtMs:t,expiresAtMs:n};if(e.targetEmail===void 0)throw Error(`QrLinkedDeviceSessionPayloadV5.targetEmail is required for Email OTP`);return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:ge(Yt(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,targetEmail:E(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`),issuedAtMs:t,expiresAtMs:n}}function Fr(e){return{kind:`linked_device_session_claim_request_v1`,payload:e}}function Ir(e,t,n){let r=S(e,`${n}.approvedAtMs`),i=S(t,`${n}.expiresAtMs`);return G(r,i,n),{approvedAtMs:r,expiresAtMs:i}}function Lr(e){let t=Ir(e.approvedAtMs,e.expiresAtMs,`LinkedDeviceApprovalV1`);return kn({kind:`linked_device_approval_v1`,...e,...t})}function Rr(e){return ar({kind:`linked_device_target_credential_registration_v1`,...e})}function zr(e){return{kind:`linked_device_session_cancel_unclaimed_request_v1`,linkSessionId:e.linkSessionId,reason:`user_cancelled`,requestedAtMs:S(e.requestedAtMs,`LinkedDeviceSessionCancelUnclaimedRequestV1.requestedAtMs`)}}function Br(e){return{kind:`linked_device_session_cancel_claimed_request_v1`,...e,requestedAtMs:S(e.requestedAtMs,`LinkedDeviceSessionCancelClaimedRequestV1.requestedAtMs`)}}const Vr=[`chrome`,`safari`,`firefox`,`edge`,`other`],Hr=[`macos`,`ios`,`windows`,`android`,`linux`,`other`];function Ur(e){return typeof e==`string`&&Vr.some(t=>t===e)}function Wr(e){return typeof e==`string`&&Hr.some(t=>t===e)}function Gr(e){if(!e||typeof e!=`object`||Array.isArray(e))return null;let t=e,n=typeof t.label==`string`?t.label.trim():``;if(!n||!Ur(t.browser)||!Wr(t.os)||typeof t.synced!=`boolean`||!Array.isArray(t.transports))return null;let r=t.transports.map(e=>typeof e==`string`?e.trim():``).filter(e=>e.length>0),i=typeof t.provider==`string`?t.provider.trim():``,a=typeof t.providerLabel==`string`?t.providerLabel.trim():``;return{label:n,browser:t.browser,os:t.os,synced:t.synced,transports:r,...i?{provider:i}:{},...a?{providerLabel:a}:{}}}function Kr(e){return(t,n)=>{if(!Array.isArray(t))throw Error(`${n} is invalid`);return t.map((t,r)=>e(t,`${n}[${r}]`))}}function qr(e,t){let n=C(e,t);if(n.startsWith(`wallet-authority:`)||n.startsWith(`authority:`))throw Error(`${t} must identify a WalletAuthMethodId`);return n}function Jr(e,t){let n=D(e,t);if(n<1)throw Error(`${t} must be a positive safe integer`);return n}function Yr(e,t){let n=Gr(e);if(!n)throw Error(`${t} is invalid`);return n}function Xr(){return v(`kind`,[b({kind:y(`passkey`),walletAuthMethodId:C,credentialIdB64u:_e,device:Yr}),b({kind:y(`email_otp`),walletAuthMethodId:C,email:E})])}function Zr(e,t){return Xr()(e,t)}function Qr(){return b({deviceId:T,enrollmentId:O,walletId:x,credential:Zr,permission:ge,keyManifestDigestB64u:w,coveredWalletKeys:Kr(ue),state:y(`provisioning`,`active`,`suspended`,`expired`,`revoked`),createdAtMs:S,lastActivityAtMs:S,revocationEpoch:D})}function $r(e){return Qr()(e,`LinkedDeviceSummaryV1`)}function ei(){return b({kind:y(`linked_device_list_request_v1`),walletId:x,limit:Jr,cursor:pe})}function ti(e){return ei()(e,`LinkedDeviceListRequestV1`)}function ni(){return b({walletId:x,walletAuthorityId:j,credential:Zr,createdAtMs:S,lastActivityAtMs:S})}function ri(){let e=ni();return b({devices:Kr($r),ownerDevices:Kr(t=>e(t,`OwnerDeviceSummaryV1`)),nextCursor:pe})}function ii(e){return ri()(e,`LinkedDeviceListResultV1`)}function ai(){return b({kind:y(`linked_device_revoke_request_v1`),walletId:x,walletAuthMethodId:qr,requestedAtMs:S})}function oi(e){return ai()(e,`LinkedDeviceRevokeRequestV1`)}function si(){return b({kind:y(`not_found`,`conflict`,`unauthorized`)})}function ci(){return b({kind:y(`revoked`),walletAuthMethodId:qr,authorityId:j,revocationEpoch:D})}function li(e){let t=f(e,`LinkedDeviceRevokeResultV1`);return(t.kind===`not_found`||t.kind===`conflict`||t.kind===`unauthorized`?si():ci())(t,`LinkedDeviceRevokeResultV1`)}function ui(e){return d({domain:`seams/linked-device/wallet-session-credential-delivery-aad/v1`,aad:e})}function di(e){let t=vi(e,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`],`LinkedDeviceWalletSessionCredentialDeliveryBindingV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_binding_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryBindingV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_binding_v1`,namespace:q(t.namespace,`namespace`),orgId:q(t.orgId,`orgId`),projectId:q(t.projectId,`projectId`),envId:q(t.envId,`envId`),tenantId:J(we(t.tenantId)),principalId:J(xe(t.principalId))}}async function fi(e){return N(ui(e))}async function pi(e){return N(d({domain:`seams/linked-device/wallet-session-credential-delivery-envelope/v1`,envelope:e}))}async function mi(e){if(await fi(e.aad)!==e.aadDigestB64u)throw Error(`linked-device Wallet Session credential delivery AAD digest is invalid`);if(await pi(e.envelope)!==e.envelopeDigestB64u)throw Error(`linked-device Wallet Session credential delivery envelope digest is invalid`);if(await N(d({domain:`seams/linked-device/delivery-recipient/v1`,recipientPublicKey65B64u:e.aad.recipientPublicKey65B64u}))!==e.recipientBindingDigestB64u)throw Error(`linked-device Wallet Session credential delivery recipient binding is invalid`)}function hi(e){let t=vi(e,[`kind`,`aad`,`aadDigestB64u`,`recipientBindingDigestB64u`,`envelope`,`envelopeDigestB64u`,`installationReceiptDigestB64u`],`LinkedDeviceWalletSessionCredentialDeliveryV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_v1`,aad:gi(t.aad),aadDigestB64u:P(t.aadDigestB64u),recipientBindingDigestB64u:P(t.recipientBindingDigestB64u),envelope:_i(t.envelope),envelopeDigestB64u:P(t.envelopeDigestB64u),installationReceiptDigestB64u:P(t.installationReceiptDigestB64u)}}function gi(t){let i=vi(t,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`,`linkSessionId`,`walletId`,`authorityId`,`walletAuthMethodId`,`authorizationId`,`walletSessionId`,`quotaId`,`credentialDigestB64u`,`recipientPublicKey65B64u`,`issuedAtMs`,`expiresAtMs`],`LinkedDeviceWalletSessionCredentialDeliveryAadV1`);if(i.kind!==`linked_device_wallet_session_credential_delivery_aad_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryAadV1.kind is invalid`);let a=yi(i.issuedAtMs,`issuedAtMs`),o=yi(i.expiresAtMs,`expiresAtMs`);if(o<=a)throw Error(`expiresAtMs must be after issuedAtMs`);return{kind:`linked_device_wallet_session_credential_delivery_aad_v1`,namespace:q(i.namespace,`namespace`),orgId:q(i.orgId,`orgId`),projectId:q(i.projectId,`projectId`),envId:q(i.envId,`envId`),tenantId:J(we(i.tenantId)),principalId:J(xe(i.principalId)),linkSessionId:J(s(i.linkSessionId)),walletId:J(n(i.walletId)),authorityId:J(e(i.authorityId)),walletAuthMethodId:J(r(i.walletAuthMethodId)),authorizationId:J(Ce(i.authorizationId)),walletSessionId:J(Se(i.walletSessionId)),quotaId:J(be(i.quotaId)),credentialDigestB64u:P(i.credentialDigestB64u),recipientPublicKey65B64u:xi(i.recipientPublicKey65B64u,65),issuedAtMs:a,expiresAtMs:o}}function _i(e){let t=vi(e,[`kind`,`algorithm`,`serverEphemeralPublicKey65B64u`,`nonce12B64u`,`ciphertextB64u`],`LinkedDeviceWalletSessionCredentialEnvelopeV1`);if(t.kind!==`linked_device_wallet_session_credential_envelope_v1`||t.algorithm!==`p256-ecdh-aes256gcm-v1`)throw Error(`LinkedDeviceWalletSessionCredentialEnvelopeV1 identity is invalid`);return{kind:`linked_device_wallet_session_credential_envelope_v1`,algorithm:`p256-ecdh-aes256gcm-v1`,serverEphemeralPublicKey65B64u:xi(t.serverEphemeralPublicKey65B64u,65),nonce12B64u:xi(t.nonce12B64u,12),ciphertextB64u:bi(t.ciphertextB64u)}}function vi(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be an object`);let r=e,i=new Set(t);for(let e of Object.keys(r))if(!i.has(e))throw Error(`${n}.${e} is not supported`);for(let e of t)if(!(e in r))throw Error(`${n}.${e} is required`);return r}function q(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} is required`);return e}function yi(e,t){if(!Number.isSafeInteger(e)||Number(e)<=0)throw Error(`${t} is invalid`);return Number(e)}function bi(e){let t=q(e,`base64url`);if(g(_(t))!==t)throw Error(`base64url is not canonical`);return t}function xi(e,t){let n=bi(e),r=_(n);if(r.length!==t)throw Error(`base64url must contain ${t} bytes`);if(t===65&&r[0]!==4)throw Error(`P-256 public key is invalid`);return n}function J(e){if(!e.ok)throw Error(e.error.message);return e.value}function Si(e,t){let n=Ne(e);if(!n.ok)throw Error(`${t} ${n.error}`);return n.value}function Ci(){return b({kind:y(`local_authority_installation_receipt_v1`),authorityId:A(j),walletId:A(x),authMethodId:A(C),deviceId:A(he),packageSetDigestB64u:A(w),installedActivationRefs:Si,installedRecordSetDigestB64u:A(w),targetFactorVerificationDigestB64u:A(w),installedAtMs:A(S)})}function wi(e){return Ci()(e,`LocalAuthorityInstallationReceiptV1`)}function Ti(){return b({kind:y(`local_authority_activation_final_ack_v1`),linkSessionId:A(M),authorityId:A(j),packageSetDigestB64u:A(w),authorizationId:A(ye),walletSessionId:A(fe),credentialDigestB64u:A(w),installationReceiptDigestB64u:A(w),acknowledgedAtMs:A(S)})}function Ei(e){return Ti()(e,`LocalAuthorityActivationFinalAckV1`)}function Di(e){let t=f(e,`ActivateInstalledAuthorityResultV1`);switch(t.kind){case`active`:{p(t,[`kind`,`authority`,`authMethod`,`walletSession`,`deliveryBinding`,`sealedDelivery`],`ActivateInstalledAuthorityResultV1`);let e=Me(t.authority);if(!e.ok||e.value.state!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authority must be active`);let n=Xe(t.authMethod);if(!n||n.status!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authMethod must be active`);let r=me(t.walletSession),i=di(t.deliveryBinding),a=hi(t.sealedDelivery);if(e.value.walletId!==n.walletId||e.value.authorityId!==n.walletAuthorityId||r.walletId!==e.value.walletId||r.authorityId!==e.value.authorityId||r.authMethodId!==n.walletAuthMethodId||r.authorityDigestB64u!==e.value.authorityDigestB64u||r.authorityRevocationEpoch!==e.value.revocationEpoch||i.namespace!==a.aad.namespace||i.orgId!==a.aad.orgId||i.projectId!==a.aad.projectId||i.envId!==a.aad.envId||i.tenantId!==a.aad.tenantId||i.principalId!==a.aad.principalId||a.aad.walletId!==r.walletId||a.aad.authorityId!==r.authorityId||a.aad.walletAuthMethodId!==r.authMethodId||a.aad.authorizationId!==r.authorizationId||a.aad.quotaId!==r.quotaId||a.aad.issuedAtMs!==r.issuedAtMs||a.aad.expiresAtMs!==r.expiresAtMs)throw Error(`ActivateInstalledAuthorityResultV1 identities do not match`);return{kind:`active`,authority:e.value,authMethod:n,walletSession:r,deliveryBinding:i,sealedDelivery:a}}case`pending_local_install`:return p(t,[`kind`,`authorityId`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`pending_local_install`,authorityId:j(t.authorityId,`authorityId`),reason:Oi()(t.reason,`ActivationRetryReasonV1`)};case`integrity_error`:return p(t,[`kind`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`integrity_error`,reason:ki(t.reason)};default:throw Error(`ActivateInstalledAuthorityResultV1.kind is invalid`)}}function Oi(){return v(`kind`,[b({kind:y(`installation_receipt_not_found`)}),b({kind:y(`server_worker_activation_pending`)}),b({kind:y(`wallet_session_issuance_pending`)})])}function ki(e){let t=f(e,`LinkIntegrityFailureV1`);switch(t.kind){case`authority_id_mismatch`:return p(t,[`kind`,`expectedAuthorityId`,`actualAuthorityId`],`LinkIntegrityFailureV1`),{kind:`authority_id_mismatch`,expectedAuthorityId:j(t.expectedAuthorityId,`expectedAuthorityId`),actualAuthorityId:j(t.actualAuthorityId,`actualAuthorityId`)};case`package_set_digest_mismatch`:return p(t,[`kind`,`expectedPackageSetDigestB64u`,`actualPackageSetDigestB64u`],`LinkIntegrityFailureV1`),{kind:`package_set_digest_mismatch`,expectedPackageSetDigestB64u:w(t.expectedPackageSetDigestB64u,`expectedPackageSetDigestB64u`),actualPackageSetDigestB64u:w(t.actualPackageSetDigestB64u,`actualPackageSetDigestB64u`)};case`installation_receipt_mismatch`:if(p(t,[`kind`,`field`],`LinkIntegrityFailureV1`),t.field!==`walletId`&&t.field!==`authMethodId`&&t.field!==`deviceId`&&t.field!==`targetFactorVerificationDigestB64u`&&t.field!==`installedActivationRefs`)throw Error(`LinkIntegrityFailureV1.field is invalid`);return{kind:`installation_receipt_mismatch`,field:t.field};default:throw Error(`LinkIntegrityFailureV1.kind is invalid`)}}new TextEncoder;async function Ai(e){return N(e.token)}function ji(e){return d({domain:`seams/linked-device/local-authority-installation-receipt/v1`,receipt:e})}async function Mi(e){return N(ji(e))}function Ni(e,t){if(e===void 0)throw Error(`${t} is required`);return e}function Pi(e){return F(e.kind,`targetFactor.kind`)}function Fi(e){let t=e.pubKeyCredParams.map(e=>L([F(e.type,`passkeyCreationOptions.pubKeyCredParams.type`),F(String(e.alg),`passkeyCreationOptions.pubKeyCredParams.alg`)])),n=e.excludeCredentials.map(e=>L([F(e.type,`passkeyCreationOptions.excludeCredentials.type`),F(e.id,`passkeyCreationOptions.excludeCredentials.id`)]));return L([F(e.kind,`passkeyCreationOptions.kind`),F(e.walletAuthMethodId,`passkeyCreationOptions.walletAuthMethodId`),F(e.challengeId,`passkeyCreationOptions.challengeId`),F(e.challengeB64u,`passkeyCreationOptions.challengeB64u`),F(e.rpId,`passkeyCreationOptions.rpId`),F(e.user.idB64u,`passkeyCreationOptions.user.idB64u`),F(e.user.name,`passkeyCreationOptions.user.name`),F(e.user.displayName,`passkeyCreationOptions.user.displayName`),qe(t.length,`passkeyCreationOptions.pubKeyCredParams`),...t.map(e=>I(e,`passkeyCreationOptions.pubKeyCredParams.item`)),F(e.authenticatorSelection.residentKey,`passkeyCreationOptions.authenticatorSelection.residentKey`),F(e.authenticatorSelection.userVerification,`passkeyCreationOptions.authenticatorSelection.userVerification`),Ye(e.timeoutMs,`passkeyCreationOptions.timeoutMs`),F(e.attestation,`passkeyCreationOptions.attestation`),F(e.extensions.prf.eval.firstB64u,`passkeyCreationOptions.extensions.prf.eval.firstB64u`),F(e.extensions.prf.eval.secondB64u,`passkeyCreationOptions.extensions.prf.eval.secondB64u`),qe(n.length,`passkeyCreationOptions.excludeCredentials`),...n.map(e=>I(e,`passkeyCreationOptions.excludeCredentials.item`))])}function Ii(e){return L([F(e.kind,`recipientRequirement.kind`),F(e.keyFamily,`recipientRequirement.keyFamily`),F(e.walletKeyId,`recipientRequirement.walletKeyId`)])}function Li(e){return e===null?F(`none`,`ed25519ExportRoot.kind`):L([F(e.kind,`ed25519ExportRoot.kind`),F(e.walletKeyId,`ed25519ExportRoot.walletKeyId`),Je(e.applicationBindingDigestB64u,`ed25519ExportRoot.applicationBindingDigestB64u`),Ke(e.registeredPublicKeyB64u,`ed25519ExportRoot.registeredPublicKeyB64u`),Ye(e.revocationEpoch,`ed25519ExportRoot.revocationEpoch`)])}function Ri(e){let t=e.ordinarySignerMaterialRecipientRequirements.map(Ii),n=Bi(e)?e:void 0,r=n?.passkeyCreationOptions;if(e.targetFactor.kind===`passkey_prf`&&!r)throw Error(`passkey target preparation is missing creation options`);return L([F(`seams/linked-device/target-preparation/v1`,`domain`),F(e.kind,`kind`),F(e.linkSessionId,`linkSessionId`),F(e.walletId,`walletId`),F(e.enrollmentId,`enrollmentId`),F(e.deviceId,`deviceId`),I(Ke(e.deliveryRecipientPublicKey65B64u,`deliveryRecipientPublicKey65B64u`),`deliveryRecipientPublicKey65B64u`),F(e.walletAuthMethodId,`walletAuthMethodId`),I(Li(e.ed25519ExportRoot),`ed25519ExportRoot`),I(Pi(e.targetFactor),`targetFactor`),...r?[I(Fi(r),`passkeyCreationOptions`),Je(n.passkeyConfigurationDigestB64u,`passkeyConfigurationDigestB64u`)]:[],...zi(e),qe(t.length,`ordinarySignerMaterialRecipientRequirements`),...t.map(e=>I(e,`ordinarySignerMaterialRecipientRequirements.item`)),Ye(e.issuedAtMs,`issuedAtMs`),Ye(e.expiresAtMs,`expiresAtMs`)])}function zi(e){return Bi(e)?[]:[F(e.targetEmail,`targetEmail`),F(e.enrollment.kind,`enrollment.kind`),...e.enrollment.kind===`existing_enrollment`?[F(Ni(e.baseWalletAuthMethodId,`baseWalletAuthMethodId`),`baseWalletAuthMethodId`)]:[]]}function Bi(e){return e.targetFactor.kind===`passkey_prf`}async function Vi(e){return Te(Ri(e))}const Hi=`x-seams-linked-device-proof-v1`,Ui=6e4,Wi=6e4;async function Gi(e){return Te(Ki(e,32,`devicePublicKeyB64u`))}function Ki(e,t,n){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} is invalid`);let r;try{r=_(e)}catch{throw Error(`${n} is invalid`)}if(r.length!==t||g(r)!==e)throw Error(`${n} is invalid`);return r}var qi=(e=>(e.Unknown=`Unknown`,e.Pending=`Pending`,e.Failure=`Failure`,e))(qi||{}),Ji=(e=>(e.NotStarted=`NotStarted`,e.Started=`Started`,e.Failure=`Failure`,e))(Ji||{});function Y(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`Invalid ${t}: expected an object`);return e}function X(e,t){if(typeof e!=`string`)throw Error(`Invalid ${t}: expected a string`);return e}function Yi(e,t){if(!Array.isArray(e))throw Error(`Invalid ${t}: expected a string array`);let n=[];for(let r of e){if(typeof r!=`string`)throw Error(`Invalid ${t}: expected a string array`);n.push(r)}return n}function Xi(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`Invalid ${t}: expected a non-negative safe integer`);return e}function Zi(e,t){if(typeof e==`number`&&!Number.isSafeInteger(e))throw Error(`Invalid ${t}: expected a safe integer or decimal string`);if(typeof e!=`string`&&typeof e!=`number`||!/^\d+$/.test(String(e)))throw Error(`Invalid ${t}: expected an unsigned decimal integer`);return BigInt(e)}function Qi(e,t){return{block_height:Xi(e.block_height,`${t}.block_height`),block_hash:X(e.block_hash,`${t}.block_hash`)}}function $i(e){let t=Y(Y(e,`NEAR access key permission`).FunctionCall,`NEAR access key permission.FunctionCall`);return{FunctionCall:{allowance:X(t.allowance,`NEAR access key allowance`),receiver_id:X(t.receiver_id,`NEAR access key receiver_id`),method_names:Yi(t.method_names,`NEAR access key method_names`)}}}function ea(e){return e===`FullAccess`?e:$i(e)}function ta(e,t){return{...t,nonce:Zi(e.nonce,`NEAR access key nonce`),permission:ea(e.permission)}}function na(e){let t=Y(e,`NEAR access key response`);return ta(t,Qi(t,`NEAR access key response`))}function ra(e){let t=Y(e,`NEAR access key list response`),n=Qi(t,`NEAR access key list response`);if(!Array.isArray(t.keys))throw Error(`Invalid NEAR access key list response.keys: expected an array`);let r=[];for(let e of t.keys){let t=Y(e,`NEAR access key list entry`),i=Y(t.access_key,`NEAR access key list entry.access_key`);r.push({public_key:X(t.public_key,`NEAR access key list entry.public_key`),access_key:ta(i,n)})}return{...n,keys:r}}function ia(e){let t=Y(e,`NEAR account response`);return{...Qi(t,`NEAR account response`),amount:Zi(t.amount,`NEAR account response.amount`),locked:Zi(t.locked,`NEAR account response.locked`),code_hash:X(t.code_hash,`NEAR account response.code_hash`),storage_usage:Xi(t.storage_usage,`NEAR account response.storage_usage`),storage_paid_at:Xi(t.storage_paid_at,`NEAR account response.storage_paid_at`)}}function aa(e){let t=X(Y(e,`NEAR view code response`).code_base64,`NEAR view code response.code_base64`);if(!t)throw Error(`Invalid NEAR view code response.code_base64: empty string`);return t}function oa(e){let t=Y(Y(e,`NEAR block response`).header,`NEAR block response.header`);return{header:{hash:X(t.hash,`NEAR block response.header.hash`),height:Xi(t.height,`NEAR block response.header.height`)}}}function sa(e){let t=Y(e,`NEAR contract call response`);if(!Array.isArray(t.result))throw Error(`Invalid NEAR contract call response.result: expected bytes`);let n=[];for(let e of t.result){if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`Invalid NEAR contract call response.result: expected bytes`);n.push(e)}return{...Qi(t,`NEAR contract call response`),logs:Yi(t.logs,`NEAR contract call response.logs`),result:n}}function ca(e){let t=new TextDecoder(`utf-8`,{fatal:!0}).decode(Uint8Array.from(e));if(!t.trim())return null;try{return JSON.parse(t)}catch{return t}}function la(e,t){let n=Y(e,t),r=typeof n.error_type==`string`?n.error_type:`InvalidTxError`in n?`InvalidTxError`:`ActionError`in n?`ActionError`:`TxExecutionError`;return{error_message:typeof n.error_message==`string`?n.error_message:`NEAR execution failed`,error_type:r,...`InvalidTxError`in n?{InvalidTxError:n.InvalidTxError}:{},...`ActionError`in n?{ActionError:n.ActionError}:{}}}function ua(e,t){let n=0;for(let r of t)Object.prototype.hasOwnProperty.call(e,r)&&n++;if(n!==1)throw Error(`Invalid NEAR status: expected exactly one variant`)}function da(e){if(e===`Unknown`)return qi.Unknown;if(e===`Pending`)return qi.Pending;if(e===`Failure`)return qi.Failure;let t=Y(e,`NEAR execution status`);if(ua(t,[`SuccessValue`,`SuccessReceiptId`,`Failure`]),typeof t.SuccessValue==`string`)return{SuccessValue:t.SuccessValue};if(typeof t.SuccessReceiptId==`string`)return{SuccessReceiptId:t.SuccessReceiptId};if(`Failure`in t)return{Failure:la(t.Failure,`NEAR execution failure`)};throw Error(`Invalid NEAR execution status`)}function fa(e){if(e===`NotStarted`)return Ji.NotStarted;if(e===`Started`)return Ji.Started;if(e===`Failure`)return Ji.Failure;let t=Y(e,`NEAR final execution status`);if(ua(t,[`SuccessValue`,`Failure`]),typeof t.SuccessValue==`string`)return{SuccessValue:t.SuccessValue};if(`Failure`in t)return{Failure:la(t.Failure,`NEAR final execution failure`)};throw Error(`Invalid NEAR final execution status`)}function pa(e){let t=Y(e,`NEAR execution outcome`);return{logs:Yi(t.logs,`NEAR execution outcome.logs`),receipt_ids:Yi(t.receipt_ids,`NEAR execution outcome.receipt_ids`),gas_burnt:Xi(t.gas_burnt,`NEAR execution outcome.gas_burnt`),tokens_burnt:X(t.tokens_burnt,`NEAR execution outcome.tokens_burnt`),executor_id:X(t.executor_id,`NEAR execution outcome.executor_id`),status:da(t.status)}}function ma(e){let t=Y(e,`NEAR execution outcome with id`);return{id:X(t.id,`NEAR execution outcome id`),outcome:pa(t.outcome)}}function ha(e){switch(e){case`NONE`:case`INCLUDED`:case`INCLUDED_FINAL`:case`EXECUTED`:case`FINAL`:case`EXECUTED_OPTIMISTIC`:return e;default:throw Error(`Invalid NEAR final_execution_status`)}}function ga(e){let t=Y(e,`NEAR final execution outcome`);if(!Array.isArray(t.receipts_outcome))throw Error(`Invalid NEAR final execution outcome.receipts_outcome: expected an array`);return{final_execution_status:ha(t.final_execution_status),status:fa(t.status),transaction:{hash:X(Y(t.transaction,`NEAR final execution outcome.transaction`).hash,`NEAR final execution outcome.transaction.hash`)},transaction_outcome:ma(t.transaction_outcome),receipts_outcome:t.receipts_outcome.map(ma)}}function _a(e){return String(e||``).trim()}function va(e){return String(e||``).trim()}async function ya(e){return g(await re(d(e)))}async function ba(e){return g(await re(d(e)))}function xa(t){let n=Oe(t);if(!n||!(`caller`in n))return null;let i=Ee(n.caller);if(i===`linked_device_ceremony`)return Object.prototype.hasOwnProperty.call(n,`source`)?null:{caller:`linked_device_ceremony`};if(i!==`same_device_addition`)return null;let a=Oe(`source`in n?n.source:void 0);if(!a)return null;let o=e(`walletAuthorityId`in a?a.walletAuthorityId:void 0),s=r(`walletAuthMethodId`in a?a.walletAuthMethodId:void 0),c=Ee(`walletSessionId`in a?a.walletSessionId:void 0),l=Ee(`authorityDigestB64u`in a?a.authorityDigestB64u:void 0),u=`revocationEpoch`in a?a.revocationEpoch:void 0;return!o.ok||!s.ok||!c||!l||typeof u!=`number`||!Number.isSafeInteger(u)||u<0?null:{caller:`same_device_addition`,source:{walletAuthorityId:o.value,walletAuthMethodId:s.value,walletSessionId:c,authorityDigestB64u:l,revocationEpoch:u}}}function Sa(e,t){return e.walletAuthorityId===t.walletAuthorityId&&e.walletAuthMethodId===t.walletAuthMethodId&&e.walletSessionId===t.walletSessionId&&e.authorityDigestB64u===t.authorityDigestB64u&&e.revocationEpoch===t.revocationEpoch}function Z(e,t,n,r=[]){let i=Oe(e);if(!i)throw Error(t+` must be an object`);let a=new Set([...n,...r]),o=Object.keys(i);if(o.length<n.length||o.length>a.size)throw Error(t+` has invalid fields`);for(let e of n)if(!Object.prototype.hasOwnProperty.call(i,e))throw Error(t+`.`+e+` is required`);for(let e of o)if(!a.has(e))throw Error(t+` has invalid fields`);return i}function Q(e,t,n){if(!Object.prototype.hasOwnProperty.call(e,t))throw Error(n+`.`+t+` is required`);return Reflect.get(e,t)}function Ca(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function $(e,t,n){let r=Q(e,t,n);if(typeof r!=`string`||r.length===0||r.trim()!==r)throw Error(n+`.`+t+` must be a non-empty canonical string`);return r}function wa(e,t,n,r){let i=Q(e,t,n);if(typeof i!=`number`||!Number.isSafeInteger(i)||i<r)throw Error(n+`.`+t+` must be a safe integer`);return i}function Ta(e,t){if(!Array.isArray(e))throw Error(t+` must be an array`);return e}function Ea(e,t,n){let r=Ta(Q(e,t,n),n+`.`+t);if(r.length===0)throw Error(n+`.`+t+` must not be empty`);let i=[];for(let e=0;e<r.length;e+=1){let a=r[e];if(typeof a!=`number`||!Number.isSafeInteger(a)||a<1)throw Error(n+`.`+t+`[`+e+`] must be a positive safe integer`);i.push(a)}return i}function Da(e,t,n){return Ca(e,t)?$(e,t,n):void 0}function Oa(e,t=`addSignerIntent.signerSelection.ecdsa.chainTarget`){try{let n=Z(e,t,[`kind`],[`namespace`,`chainId`,`networkSlug`]);switch($(n,`kind`,t)){case`evm`:{let e=Z(n,t,[`kind`,`namespace`,`chainId`],[`networkSlug`]);if($(e,`namespace`,t)!==`eip155`)return null;let r=wa(e,`chainId`,t,1),i=Da(e,`networkSlug`,t);return i===void 0?{kind:`evm`,namespace:`eip155`,chainId:r}:{kind:`evm`,namespace:`eip155`,chainId:r,networkSlug:i}}case`tempo`:{let e=Z(n,t,[`kind`,`chainId`],[`networkSlug`]),r=wa(e,`chainId`,t,1),i=Da(e,`networkSlug`,t);return i===void 0?{kind:`tempo`,chainId:r}:{kind:`tempo`,chainId:r,networkSlug:i}}default:return null}}catch{return null}}function ka(e){let t=`addSignerIntent.signerSelection`,n=Z(e,t,[`mode`],[`ed25519`,`ecdsa`]);switch($(n,`mode`,t)){case`ed25519`:{let e=Z(Q(Z(n,t,[`mode`,`ed25519`]),`ed25519`,t),t+`.ed25519`,[`mode`,`signerSlot`,`participantIds`,`keyPurpose`,`keyVersion`,`derivationVersion`]);if($(e,`mode`,t+`.ed25519`)!==`create_implicit_near_account`)throw Error(t+`.ed25519.mode is unsupported`);wa(e,`signerSlot`,t+`.ed25519`,1),Ea(e,`participantIds`,t+`.ed25519`),$(e,`keyPurpose`,t+`.ed25519`),$(e,`keyVersion`,t+`.ed25519`),wa(e,`derivationVersion`,t+`.ed25519`,1);break}case`ecdsa`:{let e=Z(Q(Z(n,t,[`mode`,`ecdsa`]),`ecdsa`,t),t+`.ecdsa`,[`chainTargets`,`participantIds`]),r=Ta(Q(e,`chainTargets`,t+`.ecdsa`),t+`.ecdsa.chainTargets`);if(r.length===0)throw Error(t+`.ecdsa.chainTargets must not be empty`);for(let e of r)if(!Oa(e))throw Error(t+`.ecdsa.chainTargets contains an invalid target`);Ea(e,`participantIds`,t+`.ecdsa`);break}default:throw Error(t+`.mode is unsupported`)}let r=ke(e,{normalizeEcdsaChainTarget:Oa});if(!r.ok)throw Error(r.message);return r.value}function Aa(e){let n=`addAuthMethodIntent.authMethod`,r=Z(e,n,[`kind`],[`rpId`,`email`]);switch($(r,`kind`,n)){case`passkey`:{let e=t($(Z(r,n,[`kind`,`rpId`]),`rpId`,n));if(!e.ok)throw Error(e.error.message);break}case`email_otp`:$(Z(r,n,[`kind`,`email`]),`email`,n);break;default:throw Error(n+`.kind is unsupported`)}let i=De(e);if(!i)throw Error(n+` is invalid`);return i}function ja(t){let n=`addAuthMethodIntent.source`,i=Z(t,n,[`walletAuthorityId`,`walletAuthMethodId`,`walletSessionId`,`authorityDigestB64u`,`revocationEpoch`]),a=e($(i,`walletAuthorityId`,n)),o=r($(i,`walletAuthMethodId`,n));if(!a.ok||!o.ok)throw Error(n+` has invalid identity`);$(i,`walletSessionId`,n),$(i,`authorityDigestB64u`,n),wa(i,`revocationEpoch`,n,0)}function Ma(e,t){if(!Ca(e,`runtimePolicyScope`))return;let n=t+`.runtimePolicyScope`,r=Z(Q(e,`runtimePolicyScope`,t),n,[`orgId`,`projectId`,`envId`],[`signingRootVersion`]),i=$(r,`orgId`,n),a=$(r,`projectId`,n),o=$(r,`envId`,n),s=Da(r,`signingRootVersion`,n);return s===void 0?{orgId:i,projectId:a,envId:o}:{orgId:i,projectId:a,envId:o,signingRootVersion:s}}function Na(e,t){let r=n($(e,`walletId`,t));if(!r.ok)throw Error(r.error.message);return r.value}function Pa(e,t,n){let i=r($(e,t,n));if(!i.ok)throw Error(i.error.message);return i.value}function Fa(e){let t=`addSignerIntent`,n=Z(e,t,[`version`,`walletId`,`signerSelection`,`nonceB64u`],[`runtimePolicyScope`]);if($(n,`version`,t)!==`add_signer_intent_v1`)throw Error(t+`.version is unsupported`);let r=Na(n,t),i=Ma(n,t),a=$(n,`nonceB64u`,t),o=ka(Q(n,`signerSelection`,t));return i===void 0?{version:`add_signer_intent_v1`,walletId:r,signerSelection:o,nonceB64u:a}:{version:`add_signer_intent_v1`,walletId:r,signerSelection:o,runtimePolicyScope:i,nonceB64u:a}}function Ia(e){let t=`addAuthMethodIntent`,n=Z(e,t,[`version`,`walletId`,`authMethod`,`targetWalletAuthMethodId`,`caller`,`nonceB64u`],[`runtimePolicyScope`,`source`]);if($(n,`version`,t)!==`add_auth_method_intent_v1`)throw Error(t+`.version is unsupported`);let r=Na(n,t),i=Pa(n,`targetWalletAuthMethodId`,t),a=Aa(Q(n,`authMethod`,t)),o=Ma(n,t),s=$(n,`nonceB64u`,t);switch($(n,`caller`,t)){case`same_device_addition`:ja(Q(n,`source`,t));break;case`linked_device_ceremony`:if(Ca(n,`source`))throw Error(t+`.source is not valid for linked_device_ceremony`);break;default:throw Error(t+`.caller is unsupported`)}let c=xa(n);if(!c)throw Error(t+`.caller is invalid`);let l=o===void 0?{version:`add_auth_method_intent_v1`,walletId:r,authMethod:a,targetWalletAuthMethodId:i,nonceB64u:s}:{version:`add_auth_method_intent_v1`,walletId:r,authMethod:a,targetWalletAuthMethodId:i,runtimePolicyScope:o,nonceB64u:s};switch(c.caller){case`same_device_addition`:return{...l,caller:c.caller,source:c.source};case`linked_device_ceremony`:return{...l,caller:c.caller};default:return La(c)}}function La(e){throw Error(`Unsupported add-auth-method intent caller: ${String(e)}`)}function Ra(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(!Number.isSafeInteger(e[n])||e[n]!==t[n])return!1;return!0}function za(e,t){switch(e.kind){case`evm`:return t.kind===`evm`&&e.namespace===t.namespace&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;case`tempo`:return t.kind===`tempo`&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;default:return Ba(e)}}function Ba(e){throw Error(`Unsupported add-signer chain target: ${String(e)}`)}function Va(e,t){if(e.mode!==t.mode)return!1;switch(e.mode){case`ed25519`:return t.mode===`ed25519`&&e.ed25519.mode===t.ed25519.mode&&e.ed25519.signerSlot===t.ed25519.signerSlot&&Ra(e.ed25519.participantIds,t.ed25519.participantIds)&&e.ed25519.keyPurpose===t.ed25519.keyPurpose&&e.ed25519.keyVersion===t.ed25519.keyVersion&&e.ed25519.derivationVersion===t.ed25519.derivationVersion;case`ecdsa`:if(t.mode!==`ecdsa`||e.ecdsa.chainTargets.length!==t.ecdsa.chainTargets.length)return!1;for(let n=0;n<e.ecdsa.chainTargets.length;n+=1)if(!za(e.ecdsa.chainTargets[n],t.ecdsa.chainTargets[n]))return!1;return Ra(e.ecdsa.participantIds,t.ecdsa.participantIds);default:return Ha(e)}}function Ha(e){throw Error(`Unsupported add-signer selection: ${String(e)}`)}function Ua(e,t){return e===void 0||t===void 0?e===t:e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function Wa(e,t){return e.version===t.version&&e.walletId===t.walletId&&Va(e.signerSelection,t.signerSelection)&&Ua(e.runtimePolicyScope,t.runtimePolicyScope)&&e.nonceB64u===t.nonceB64u}function Ga(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId;case`email_otp`:return t.kind===`email_otp`&&e.email===t.email;default:return Ka(e)}}function Ka(e){throw Error(`Unsupported add-auth-method input: ${String(e)}`)}function qa(e,t){if(e.version!==t.version||e.walletId!==t.walletId||!Ga(e.authMethod,t.authMethod)||e.targetWalletAuthMethodId!==t.targetWalletAuthMethodId||!Ua(e.runtimePolicyScope,t.runtimePolicyScope)||e.nonceB64u!==t.nonceB64u)return!1;switch(e.caller){case`same_device_addition`:return t.caller===`same_device_addition`&&Sa(e.source,t.source);case`linked_device_ceremony`:return t.caller===`linked_device_ceremony`;default:return Ja(e)}}function Ja(e){throw Error(`Unsupported add-auth-method intent: ${String(e)}`)}export{Mr as $,ti as A,Pr as B,Ai as C,mi as D,wi as E,Lr as F,yn as G,hn as H,Br as I,jr as J,Wn as K,zr as L,oi as M,li as N,di as O,Gr as P,xr as Q,Fr as R,Mi as S,Ei as T,_n as U,Kt as V,jn as W,kr as X,Tr as Y,Cr as Z,Wi as _,it as _t,Ia as a,Ln as at,Gi as b,Wa as c,Ct as ct,ia as d,ft as dt,un as et,oa as f,ht as ft,ca as g,ot as gt,ga as h,pt as ht,ya as i,zn as it,ii as j,hi as k,ra as l,St as lt,sa as m,mt,va as n,Sn as nt,Fa as o,sn as ot,aa as p,dt as pt,Dr as q,ba as r,sr as rt,qa as s,cn as st,_a as t,wn as tt,na as u,st as ut,Hi as v,at as vt,Di as w,Vi as x,Ui as y,nt as yt,Rr as z};

package/dist/{esm/sdk/registrationSignerPlan-dY9Rp0m_.js → public/sdk/registrationSignerPlan-CPzHavPM.js}

@@ -1 +1 @@
-import{c as e}from"./chains-C_X_fNuS.js";import{c as t}from"./accountIds-BzZs7YoX.js";import{i as n,t as r}from"./registrationAuthMethodInput-BBCeWDmw.js";function i(){return{kind:`implicit_account`,accountIdSource:`ed25519_public_key`}}function a(e){return{kind:`sponsored_named_account`,requestedAccountId:e,sponsor:`relayer`}}function o(e,t){let n=typeof e==`number`?e:Number(e);return Number.isFinite(n)&&n>=1?Math.floor(n):t}function s(e){if(!Array.isArray(e))return[];let t=[];for(let n of e){let e=Number(n);Number.isInteger(e)&&e>0&&t.push(e)}return t}function c(e){return Array.isArray(e)?e:[]}function l(e){let i=r(e);if(!i||!(`kind`in i))return null;switch(n(i.kind)){case`implicit_account`:return Object.prototype.hasOwnProperty.call(i,`requestedAccountId`)||Object.prototype.hasOwnProperty.call(i,`sponsor`)?null:{kind:`implicit_account`,accountIdSource:`ed25519_public_key`};case`sponsored_named_account`:{if(Object.prototype.hasOwnProperty.call(i,`accountIdSource`)||!(`requestedAccountId`in i))return null;let e=t(i.requestedAccountId);return e.ok?{kind:`sponsored_named_account`,requestedAccountId:e.value,sponsor:`relayer`}:null}default:return null}}function u(e){if(!e||!(`participantIds`in e)||!(`chainTargets`in e))return null;let t=s(e.participantIds),n=c(e.chainTargets);return t.length===0||n.length===0?null:{participantIds:t,chainTargets:n}}const d=`router-ab-ed25519-yao-v1`;function f(e){let t=n(e);if(!t)throw Error(`registration signer branch key is required`);return t}function p(e){return f(`near_ed25519:slot:${e}`)}function m(t){return f(`evm_family_ecdsa:${t.map(e).join(`|`)}`)}function h(e){return g(e.map(_))}function g(e){if(e.length===0)return{ok:!1,code:`invalid_body`,message:`signer set must include at least one signer`};let t=new Set,n=new Set,r=new Set;for(let i of e){let e=v({branch:i,nearSlots:t,ecdsaTargetKeys:n,branchKeys:r});if(e)return e}return{ok:!0,value:{kind:`signer_set`,branches:e}}}function _(e){switch(e.kind){case`near_ed25519`:return{kind:`near_ed25519`,branchKey:p(e.signerSlot),accountProvisioning:e.accountProvisioning,signerSlot:e.signerSlot,participantIds:e.participantIds,keyPurpose:`near_tx`,keyVersion:d,derivationVersion:e.derivationVersion};case`evm_family_ecdsa`:return{kind:`evm_family_ecdsa`,branchKey:m(e.chainTargets),participantIds:e.participantIds,chainTargets:e.chainTargets};default:return P(e)}}function v(e){switch(e.branch.kind){case`near_ed25519`:if(e.nearSlots.has(e.branch.signerSlot))return{ok:!1,code:`invalid_body`,message:`duplicate near_ed25519 signer slot is invalid`};e.nearSlots.add(e.branch.signerSlot);break;case`evm_family_ecdsa`:{let t=b(e.branch,e.ecdsaTargetKeys);if(t)return t}break;default:return F(e.branch)}return y(e.branch,e.branchKeys)}function y(e,t){let n=String(e.branchKey);return t.has(n)?{ok:!1,code:`invalid_body`,message:`duplicate signer branch is invalid`}:(t.add(n),null)}function b(t,n){for(let r of t.chainTargets){let t=e(r);if(n.has(t))return{ok:!1,code:`invalid_body`,message:`duplicate evm_family_ecdsa chain target is invalid`};n.add(t)}return null}function x(e){let t=r(e);if(!t)return{ok:!1,code:`invalid_body`,message:`signer set entry must be an object`};if(!(`kind`in t))return{ok:!1,code:`invalid_body`,message:`unsupported registration signer kind`};switch(n(t.kind)){case`near_ed25519`:return S(t);case`evm_family_ecdsa`:return C(t);default:return{ok:!1,code:`invalid_body`,message:`unsupported registration signer kind`}}}function S(e){if(Object.prototype.hasOwnProperty.call(e,`keyPurpose`)||Object.prototype.hasOwnProperty.call(e,`keyVersion`))return{ok:!1,code:`invalid_body`,message:`near_ed25519 signer spec cannot include protocol key fields`};if(Object.prototype.hasOwnProperty.call(e,`nearAccountId`)||Object.prototype.hasOwnProperty.call(e,`createNearAccount`))return{ok:!1,code:`invalid_body`,message:`near_ed25519 signer spec is invalid`};let t=l(`accountProvisioning`in e?e.accountProvisioning:void 0),n=o(`signerSlot`in e?e.signerSlot:void 0,0),r=Number(`derivationVersion`in e?e.derivationVersion:void 0),i=s(`participantIds`in e?e.participantIds:void 0);return!t||n<1||i.length===0||r!==1?{ok:!1,code:`invalid_body`,message:`near_ed25519 signer spec is invalid`}:{ok:!0,value:{kind:`near_ed25519`,accountProvisioning:t,signerSlot:n,participantIds:i,derivationVersion:r}}}function C(e){let t=u(e);return t?{ok:!0,value:{kind:`evm_family_ecdsa`,participantIds:t.participantIds,chainTargets:t.chainTargets}}:{ok:!1,code:`invalid_body`,message:`evm_family_ecdsa signer spec is invalid`}}function w(e){if(!(`signers`in e)||!Array.isArray(e.signers))return{ok:!1,code:`invalid_body`,message:`signerSelection.signers must be an array`};let t=[];for(let n of e.signers){let e=x(n);if(!e.ok)return e;t.push(e.value)}return h(t)}function T(e){let t=r(e);return t?`kind`in t&&n(t.kind)===`signer_set`?w(t):{ok:!1,code:`invalid_body`,message:`signerSelection.kind must be signer_set`}:{ok:!1,code:`invalid_body`,message:`signerSelection must be an object`}}function E(e){return h(e.signers)}function D(e){for(let t of e.branches)if(t.kind===`near_ed25519`)return t;return null}function O(e){for(let t of e.branches)if(t.kind===`evm_family_ecdsa`)return t;return null}function k(e,t={}){let n=[];for(let r of e.branches){let e=A(r,t);if(!e.ok)return e;n.push(e.value)}return{ok:!0,value:{kind:`signer_set`,signers:n}}}function A(e,t){switch(e.kind){case`near_ed25519`:return{ok:!0,value:j(e)};case`evm_family_ecdsa`:return M(e,t);default:return F(e)}}function j(e){return{kind:`near_ed25519`,accountProvisioning:e.accountProvisioning,signerSlot:e.signerSlot,participantIds:[...e.participantIds],derivationVersion:e.derivationVersion}}function M(e,t){let n=N(e,t);return n?{ok:!0,value:{kind:`evm_family_ecdsa`,participantIds:[...e.participantIds],chainTargets:n}}:{ok:!1,code:`invalid_body`,message:`registration ECDSA chainTargets are invalid`}}function N(e,t){if(!t.normalizeEcdsaChainTarget)return[...e.chainTargets];let n=[];for(let r of e.chainTargets){let e=t.normalizeEcdsaChainTarget(r);if(!e)return null;n.push(e)}return n}function P(e){throw Error(`Unsupported registration signer request: ${String(e)}`)}function F(e){throw Error(`Unsupported registration signer plan branch: ${String(e)}`)}function I(e,t){let i=r(e);if(!i)return{ok:!1,code:`invalid_body`,message:`signerSelection must be an object`};if(!(`mode`in i))return{ok:!1,code:`invalid_body`,message:`unsupported add-signer mode`};let a=n(i.mode);return a===`ecdsa`?L(`ecdsa`in i?i.ecdsa:void 0,t):a===`ed25519`?z(`ed25519`in i?i.ed25519:void 0):{ok:!1,code:`invalid_body`,message:`unsupported add-signer mode`}}function L(e,t){let n=r(e),i=s(n&&`participantIds`in n?n.participantIds:void 0),a=R(n&&`chainTargets`in n?n.chainTargets:void 0,t);return i.length===0||a.length===0?{ok:!1,code:`invalid_body`,message:`ecdsa add-signer spec is invalid`}:{ok:!0,value:{mode:`ecdsa`,ecdsa:{chainTargets:a,participantIds:i}}}}function R(e,t){if(!Array.isArray(e))return[];let n=[];for(let r of e){let e=t.normalizeEcdsaChainTarget(r);if(!e)return[];n.push(e)}return n}function z(e){let t=r(e),i=n(t&&`mode`in t?t.mode:void 0),a=o(t&&`signerSlot`in t?t.signerSlot:void 0,1),c=n(t&&`keyPurpose`in t?t.keyPurpose:void 0),l=n(t&&`keyVersion`in t?t.keyVersion:void 0),u=o(t&&`derivationVersion`in t?t.derivationVersion:void 0,0),d=s(t&&`participantIds`in t?t.participantIds:void 0);return!c||!l||!u||d.length===0?{ok:!1,code:`invalid_body`,message:`ed25519 add-signer spec is invalid`}:i===`create_implicit_near_account`?{ok:!0,value:{mode:`ed25519`,ed25519:{mode:i,signerSlot:a,participantIds:d,keyPurpose:c,keyVersion:l,derivationVersion:u}}}:{ok:!1,code:`invalid_body`,message:`unsupported add-signer mode`}}export{I as a,p as c,a as d,i,E as l,O as n,T as o,D as r,m as s,d as t,k as u};
+import{c as e}from"./chains-C_X_fNuS.js";import{c as t}from"./accountIds-Cpvlkvbe.js";import{i as n,t as r}from"./registrationAuthMethodInput-RbSR7R1G.js";function i(){return{kind:`implicit_account`,accountIdSource:`ed25519_public_key`}}function a(e){return{kind:`sponsored_named_account`,requestedAccountId:e,sponsor:`relayer`}}function o(e,t){let n=typeof e==`number`?e:Number(e);return Number.isFinite(n)&&n>=1?Math.floor(n):t}function s(e){if(!Array.isArray(e))return[];let t=[];for(let n of e){let e=Number(n);Number.isInteger(e)&&e>0&&t.push(e)}return t}function c(e){return Array.isArray(e)?e:[]}function l(e){let i=r(e);if(!i||!(`kind`in i))return null;switch(n(i.kind)){case`implicit_account`:return Object.prototype.hasOwnProperty.call(i,`requestedAccountId`)||Object.prototype.hasOwnProperty.call(i,`sponsor`)?null:{kind:`implicit_account`,accountIdSource:`ed25519_public_key`};case`sponsored_named_account`:{if(Object.prototype.hasOwnProperty.call(i,`accountIdSource`)||!(`requestedAccountId`in i))return null;let e=t(i.requestedAccountId);return e.ok?{kind:`sponsored_named_account`,requestedAccountId:e.value,sponsor:`relayer`}:null}default:return null}}function u(e){if(!e||!(`participantIds`in e)||!(`chainTargets`in e))return null;let t=s(e.participantIds),n=c(e.chainTargets);return t.length===0||n.length===0?null:{participantIds:t,chainTargets:n}}const d=`router-ab-ed25519-yao-v1`;function f(e){let t=n(e);if(!t)throw Error(`registration signer branch key is required`);return t}function p(e){return f(`near_ed25519:slot:${e}`)}function m(t){return f(`evm_family_ecdsa:${t.map(e).join(`|`)}`)}function h(e){return g(e.map(_))}function g(e){if(e.length===0)return{ok:!1,code:`invalid_body`,message:`signer set must include at least one signer`};let t=new Set,n=new Set,r=new Set;for(let i of e){let e=v({branch:i,nearSlots:t,ecdsaTargetKeys:n,branchKeys:r});if(e)return e}return{ok:!0,value:{kind:`signer_set`,branches:e}}}function _(e){switch(e.kind){case`near_ed25519`:return{kind:`near_ed25519`,branchKey:p(e.signerSlot),accountProvisioning:e.accountProvisioning,signerSlot:e.signerSlot,participantIds:e.participantIds,keyPurpose:`near_tx`,keyVersion:d,derivationVersion:e.derivationVersion};case`evm_family_ecdsa`:return{kind:`evm_family_ecdsa`,branchKey:m(e.chainTargets),participantIds:e.participantIds,chainTargets:e.chainTargets};default:return P(e)}}function v(e){switch(e.branch.kind){case`near_ed25519`:if(e.nearSlots.has(e.branch.signerSlot))return{ok:!1,code:`invalid_body`,message:`duplicate near_ed25519 signer slot is invalid`};e.nearSlots.add(e.branch.signerSlot);break;case`evm_family_ecdsa`:{let t=b(e.branch,e.ecdsaTargetKeys);if(t)return t}break;default:return F(e.branch)}return y(e.branch,e.branchKeys)}function y(e,t){let n=String(e.branchKey);return t.has(n)?{ok:!1,code:`invalid_body`,message:`duplicate signer branch is invalid`}:(t.add(n),null)}function b(t,n){for(let r of t.chainTargets){let t=e(r);if(n.has(t))return{ok:!1,code:`invalid_body`,message:`duplicate evm_family_ecdsa chain target is invalid`};n.add(t)}return null}function x(e){let t=r(e);if(!t)return{ok:!1,code:`invalid_body`,message:`signer set entry must be an object`};if(!(`kind`in t))return{ok:!1,code:`invalid_body`,message:`unsupported registration signer kind`};switch(n(t.kind)){case`near_ed25519`:return S(t);case`evm_family_ecdsa`:return C(t);default:return{ok:!1,code:`invalid_body`,message:`unsupported registration signer kind`}}}function S(e){if(Object.prototype.hasOwnProperty.call(e,`keyPurpose`)||Object.prototype.hasOwnProperty.call(e,`keyVersion`))return{ok:!1,code:`invalid_body`,message:`near_ed25519 signer spec cannot include protocol key fields`};if(Object.prototype.hasOwnProperty.call(e,`nearAccountId`)||Object.prototype.hasOwnProperty.call(e,`createNearAccount`))return{ok:!1,code:`invalid_body`,message:`near_ed25519 signer spec is invalid`};let t=l(`accountProvisioning`in e?e.accountProvisioning:void 0),n=o(`signerSlot`in e?e.signerSlot:void 0,0),r=Number(`derivationVersion`in e?e.derivationVersion:void 0),i=s(`participantIds`in e?e.participantIds:void 0);return!t||n<1||i.length===0||r!==1?{ok:!1,code:`invalid_body`,message:`near_ed25519 signer spec is invalid`}:{ok:!0,value:{kind:`near_ed25519`,accountProvisioning:t,signerSlot:n,participantIds:i,derivationVersion:r}}}function C(e){let t=u(e);return t?{ok:!0,value:{kind:`evm_family_ecdsa`,participantIds:t.participantIds,chainTargets:t.chainTargets}}:{ok:!1,code:`invalid_body`,message:`evm_family_ecdsa signer spec is invalid`}}function w(e){if(!(`signers`in e)||!Array.isArray(e.signers))return{ok:!1,code:`invalid_body`,message:`signerSelection.signers must be an array`};let t=[];for(let n of e.signers){let e=x(n);if(!e.ok)return e;t.push(e.value)}return h(t)}function T(e){let t=r(e);return t?`kind`in t&&n(t.kind)===`signer_set`?w(t):{ok:!1,code:`invalid_body`,message:`signerSelection.kind must be signer_set`}:{ok:!1,code:`invalid_body`,message:`signerSelection must be an object`}}function E(e){return h(e.signers)}function D(e){for(let t of e.branches)if(t.kind===`near_ed25519`)return t;return null}function O(e){for(let t of e.branches)if(t.kind===`evm_family_ecdsa`)return t;return null}function k(e,t={}){let n=[];for(let r of e.branches){let e=A(r,t);if(!e.ok)return e;n.push(e.value)}return{ok:!0,value:{kind:`signer_set`,signers:n}}}function A(e,t){switch(e.kind){case`near_ed25519`:return{ok:!0,value:j(e)};case`evm_family_ecdsa`:return M(e,t);default:return F(e)}}function j(e){return{kind:`near_ed25519`,accountProvisioning:e.accountProvisioning,signerSlot:e.signerSlot,participantIds:[...e.participantIds],derivationVersion:e.derivationVersion}}function M(e,t){let n=N(e,t);return n?{ok:!0,value:{kind:`evm_family_ecdsa`,participantIds:[...e.participantIds],chainTargets:n}}:{ok:!1,code:`invalid_body`,message:`registration ECDSA chainTargets are invalid`}}function N(e,t){if(!t.normalizeEcdsaChainTarget)return[...e.chainTargets];let n=[];for(let r of e.chainTargets){let e=t.normalizeEcdsaChainTarget(r);if(!e)return null;n.push(e)}return n}function P(e){throw Error(`Unsupported registration signer request: ${String(e)}`)}function F(e){throw Error(`Unsupported registration signer plan branch: ${String(e)}`)}function I(e,t){let i=r(e);if(!i)return{ok:!1,code:`invalid_body`,message:`signerSelection must be an object`};if(!(`mode`in i))return{ok:!1,code:`invalid_body`,message:`unsupported add-signer mode`};let a=n(i.mode);return a===`ecdsa`?L(`ecdsa`in i?i.ecdsa:void 0,t):a===`ed25519`?z(`ed25519`in i?i.ed25519:void 0):{ok:!1,code:`invalid_body`,message:`unsupported add-signer mode`}}function L(e,t){let n=r(e),i=s(n&&`participantIds`in n?n.participantIds:void 0),a=R(n&&`chainTargets`in n?n.chainTargets:void 0,t);return i.length===0||a.length===0?{ok:!1,code:`invalid_body`,message:`ecdsa add-signer spec is invalid`}:{ok:!0,value:{mode:`ecdsa`,ecdsa:{chainTargets:a,participantIds:i}}}}function R(e,t){if(!Array.isArray(e))return[];let n=[];for(let r of e){let e=t.normalizeEcdsaChainTarget(r);if(!e)return[];n.push(e)}return n}function z(e){let t=r(e),i=n(t&&`mode`in t?t.mode:void 0),a=o(t&&`signerSlot`in t?t.signerSlot:void 0,1),c=n(t&&`keyPurpose`in t?t.keyPurpose:void 0),l=n(t&&`keyVersion`in t?t.keyVersion:void 0),u=o(t&&`derivationVersion`in t?t.derivationVersion:void 0,0),d=s(t&&`participantIds`in t?t.participantIds:void 0);return!c||!l||!u||d.length===0?{ok:!1,code:`invalid_body`,message:`ed25519 add-signer spec is invalid`}:i===`create_implicit_near_account`?{ok:!0,value:{mode:`ed25519`,ed25519:{mode:i,signerSlot:a,participantIds:d,keyPurpose:c,keyVersion:l,derivationVersion:u}}}:{ok:!1,code:`invalid_body`,message:`unsupported add-signer mode`}}export{I as a,p as c,a as d,i,E as l,O as n,T as o,D as r,m as s,d as t,k as u};

package/dist/public/sdk/{requireStepUpAuth-FqZSU021.js → requireStepUpAuth-BCY5ZStI.js}

@@ -1 +1 @@
-import{c as e,u as t}from"./chains-C_X_fNuS.js";import{i as n}from"./base64-DW79QA0h.js";import{r}from"./secureRandomId-LwBFx84B.js";import{i}from"./errors-DIWY1KR9.js";import{o as a}from"./sdkSentEvents-Dl8fOL50.js";import{a as o,c as s,i as c,o as ee,r as te,t as ne}from"./types-WGrFMQSw.js";import{t as l}from"./types-DhtByIcQ.js";import{t as u}from"./promptText-B8RprJhO.js";async function d(r){let i=await t(e({kind:String(r.kind||``).trim()||`unknown`,payload:f(r.payload)}));return te.signingOperationFingerprint(`sha256:${n(i)}`)}function f(e){if(typeof e==`bigint`)return e.toString(10);if(e instanceof Uint8Array)return{__bytesB64u:n(e)};if(ArrayBuffer.isView(e))return{__bytesB64u:n(new Uint8Array(e.buffer,e.byteOffset,e.byteLength))};if(e instanceof ArrayBuffer)return{__bytesB64u:n(new Uint8Array(e))};if(Array.isArray(e))return e.map(f);if(!e||typeof e!=`object`)return e;let t={};for(let n of Object.keys(e).sort()){let r=f(e[n]);r!==void 0&&(t[n]=r)}return t}const p={Created:`created`,Planned:`planned`,ConfirmationApproved:`confirmation_approved`,AuthenticationInProgress:`authentication_in_progress`,AuthReady:`auth_ready`,ThresholdConnected:`threshold_connected`,PayloadPrepared:`payload_prepared`,Signed:`signed`,CleanedUp:`cleaned_up`,Completed:`completed`,Failed:`failed`,Cancelled:`cancelled`},m={ShowConfirmation:`showConfirmation`,RequestOtp:`requestOtp`,RequestPasskey:`requestPasskey`,ConnectThreshold:`connectThreshold`,PreparePayload:`preparePayload`,Sign:`sign`,Cleanup:`cleanup`},h={Review:`review`,Authentication:`authentication`,Execution:`execution`},g={Pending:`pending`,Approved:`approved`},_={ReviewApproved:`review_approved`,AuthenticationStarted:`authentication_started`,AuthenticationCompleted:`authentication_completed`};function v(e){return{operationId:e.operationId,current:{kind:p.Created}}}function y(e,t){switch(e.current.kind){case p.Created:case p.Planned:{let n={kind:p.Planned,plan:t};return e.current=n,n}case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:{let n={kind:p.ConfirmationApproved,plan:t};return e.current=n,n}case p.AuthenticationInProgress:{let n={kind:e.current.reviewApproval===g.Approved?p.ConfirmationApproved:p.Planned,plan:t};return e.current=n,n}case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot be replanned`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be replanned`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot be replanned`);default:return I(e.current)}}function b(e){switch(e.current.kind){case p.Planned:e.current={kind:p.ConfirmationApproved,plan:e.current.plan};return;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.AuthenticationInProgress:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Approved};return;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before confirmation`);case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot be confirmed`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be confirmed`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot be confirmed`);default:return I(e.current)}}function x(e){switch(e.current.kind){case p.Planned:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Pending};return;case p.ConfirmationApproved:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Approved};return;case p.AuthenticationInProgress:return;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before authentication`);case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot authenticate`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot authenticate`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot authenticate`);default:return I(e.current)}}function S(e){switch(e.current.kind){case p.AuthenticationInProgress:if(e.current.reviewApproval!==g.Approved)throw Error(`[SigningOperationMachine] authentication cannot complete before transaction approval`);e.current={kind:p.AuthReady,plan:e.current.plan};return;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.Created:case p.Planned:throw Error(`[SigningOperationMachine] authentication cannot complete before transaction approval`);case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot authenticate`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot authenticate`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot authenticate`);default:return I(e.current)}}function C(e,t){switch(t.kind){case _.ReviewApproved:b(e);return;case _.AuthenticationStarted:x(e);return;case _.AuthenticationCompleted:S(e);return;default:return L(t)}}function w(e){let t;switch(e.current.kind){case p.Planned:t=h.Review;break;case p.AuthenticationInProgress:t=h.Authentication;break;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:t=h.Execution;break;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before cancellation`);case p.Signed:case p.CleanedUp:case p.Completed:throw Error(`[SigningOperationMachine] completed signing cannot be cancelled`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be cancelled`);case p.Cancelled:return e.current;default:return I(e.current)}let n={kind:p.Cancelled,plan:e.current.plan,phase:t};return e.current=n,n}function re(e){switch(e){case p.Planned:return!1;case p.ConfirmationApproved:return!0;default:return R(e)}}function ie(e){switch(e.kind){case p.Created:case p.Planned:case p.Failed:case p.Cancelled:return!1;case p.AuthenticationInProgress:return e.reviewApproval===g.Approved;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:case p.Completed:return!0;default:return I(e)}}function T(e){return{kind:`signing_operation_plan`,sessionPlan:e.sessionPlan,operation:e.operation,commands:e.commands}}async function E(e){let t=[];for(let n of e.steps){if(n.command)try{await e.executor.execute(n.command)}catch(r){let i=j({from:n.from,to:{kind:p.Failed,plan:n.command.plan,reason:F(r)},command:n.command,reason:F(r)});return await e.onTransition?.(i.traceEvent),t.push(i),{ok:!1,finalState:i.to,error:r}}if(await e.onTransition?.(n.traceEvent),t.push(n),n.to.kind===p.Failed)return{ok:!0,finalState:n.to}}let n=t.at(-1)?.to||e.steps.at(-1)?.from;if(!n)throw Error(`[SigningOperationMachine] command sequence produced no steps`);return{ok:!0,finalState:n}}async function ae(e){for(let t of e.commands)await e.execute(t)}function D(e){let t=k(e),n=-1;return t.forEach((e,t)=>{e.command&&(n=t)}),n>=0?t.slice(0,n+1):[]}async function O(e){let t,n=await E({steps:D(T({sessionPlan:e.signingSessionPlan,operation:e.signingOperation,commands:[e.commandKind]})),executor:{execute:async n=>{n.kind===e.commandKind&&(t=await e.execute())}}});if(!n.ok)throw n.error;if(n.finalState.kind===p.Failed)throw Error(n.finalState.reason);return t}function k(e,t={kind:p.Planned,plan:e.sessionPlan}){let n=e.sessionPlan;if(n.kind===c.NotReady)return[j({from:t,to:{kind:p.Failed,plan:n,reason:n.reason},reason:n.reason})];let r=[],i=t;return i=A(r,i,{to:{kind:p.ConfirmationApproved,plan:n},command:N(e,{kind:m.ShowConfirmation,plan:n,lane:n.lane})}),n.kind===c.EmailOtpReauth?(i=A(r,i,{to:{kind:p.AuthReady,plan:n},command:N(e,{kind:m.RequestOtp,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.ThresholdConnected,plan:n},command:N(e,{kind:m.ConnectThreshold,plan:n,lane:n.lane})})):n.kind===c.PasskeyReauth?(i=A(r,i,{to:{kind:p.AuthReady,plan:n},command:N(e,{kind:m.RequestPasskey,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.ThresholdConnected,plan:n},command:N(e,{kind:m.ConnectThreshold,plan:n,lane:n.lane})})):i=A(r,i,{to:{kind:p.AuthReady,plan:n}}),i=A(r,i,{to:{kind:p.PayloadPrepared,plan:n},command:N(e,{kind:m.PreparePayload,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.Signed,plan:n},command:N(e,{kind:m.Sign,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.CleanedUp,plan:n},command:N(e,{kind:m.Cleanup,plan:n,lane:n.lane})}),A(r,i,{to:{kind:p.Completed,plan:n}}),r}function A(e,t,n){let r=j({from:t,to:n.to,command:n.command,reason:n.reason});return e.push(r),r.to}function j(e){let t=M(e.from,e.to);return{from:e.from,to:e.to,command:e.command,traceEvent:{event:`signing_operation_transition`,from:e.from.kind,to:e.to.kind,...e.command?{command:e.command.kind}:{},...e.command?.operation?{operationId:e.command.operation.operationId}:{},plan:ee(t),lane:o(t.lane),...e.reason?{reason:e.reason}:{}}}}function M(e,t){if(`plan`in t)return t.plan;if(`plan`in e)return e.plan;throw Error(`[SigningOperationMachine] transition has no signing plan`)}function N(e,t){if(e.commands.includes(t.kind))return P(t,e.operation)}function P(e,t){return t?{...e,operation:t}:e}function F(e){return e instanceof Error&&e.message.trim()?e.message:`execution_command_failed`}function I(e){throw Error(`Unsupported signing operation state: ${String(e)}`)}function L(e){throw Error(`[SigningOperationMachine] unsupported interaction event: ${String(e)}`)}function R(e){throw Error(`Unsupported signing operation state kind: ${String(e)}`)}function z(e){switch(e.signingAuthPlan.kind){case l.WarmSession:return{signingAuthPlan:e.signingAuthPlan};case l.ActiveWalletAuthority:return{signingAuthPlan:e.signingAuthPlan};case l.PasskeyReauth:return{signingAuthPlan:e.signingAuthPlan,...e.webauthnChallenge?{webauthnChallenge:e.webauthnChallenge}:{}};case l.EmailOtpReauth:{let t=e.emailOtpPrompt??e.signingAuthPlan.emailOtpPrompt;if(!t)throw Error(`[SigningConfirmation] missing_email_otp_prompt`);return{signingAuthPlan:e.signingAuthPlan,emailOtpPrompt:t}}default:return B(e.signingAuthPlan)}}function B(e){throw Error(`Unsupported signing auth plan: ${String(e.kind)}`)}async function V(e){H(e.request);let t=e.runtime.orchestrateSigningConfirmation;return await t(e.request)}function H(e){let t=e;switch(e.signingAuthPlan.kind){case l.WarmSession:if(t.emailOtpPrompt!==void 0||t.webauthnChallenge!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.ActiveWalletAuthority:if(t.emailOtpPrompt!==void 0||t.webauthnChallenge!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.PasskeyReauth:if(t.emailOtpPrompt!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.EmailOtpReauth:if(t.webauthnChallenge!==void 0||!t.emailOtpPrompt)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;default:return B(e.signingAuthPlan)}}function U(e){switch(e){case`missing_capability`:case`missing_material`:case`authority_ambiguous`:case`binding_mismatch`:case`exact_record_conflict`:case`corrupt`:return{kind:`invalid_material`,reason:e};case`revoked`:case`replaced`:return{kind:`full_login_required`,reason:e};case`persistence_unavailable`:return{kind:`temporarily_unavailable`,reason:e};default:throw Error(`[SigningEngine] unsupported signing material block reason`)}}var W=class extends Error{constructor(e){super(`Wallet signing material is invalid. Log in again or recover the wallet.`),this.reason=e,this.name=`InvalidWalletSigningMaterialError`,this.code=`wallet_signing_material_invalid`}},G=class extends Error{constructor(e){super(`A full wallet login is required before signing.`),this.reason=e,this.name=`WalletFullLoginRequiredError`,this.code=`wallet_full_login_required`}},K=class extends Error{constructor(){super(`Request cancelled.`),this.name=`WalletOperationStepUpCancelled`,this.code=`wallet_operation_step_up_cancelled`}},q=class extends Error{constructor(){super(`Wallet signing material storage is temporarily unavailable. Retry the operation.`),this.name=`WalletSigningMaterialTemporarilyUnavailableError`,this.code=`wallet_signing_material_temporarily_unavailable`,this.reason=`persistence_unavailable`}};function J(e){return new W(e)}function Y(e){return new G(e)}function oe(e){let t=U(e);switch(t.kind){case`invalid_material`:return J(t.reason);case`full_login_required`:return Y(t.reason);case`temporarily_unavailable`:return new q;default:throw Error(`[SigningEngine] unsupported signing material disposition`)}}function se(){return new K}function ce(e){return e instanceof W||e instanceof G||e instanceof K}function le(e){return r(e,32,`signing confirmation request IDs`)}function ue(e){return e.override}function de(e){return e.kind===`digest`?e.digest32:e.challenge32}function X(e){let t=V;return async()=>await t({runtime:e.runtime,request:e.request})}async function fe(e){let t=y(e.signingOperationState,e.signingSessionPlan),n={...e.request,signingOperationStateKind:t.kind,onSigningOperationInteractionEvent:C.bind(void 0,e.signingOperationState)},r=X({runtime:e.runtime,request:n});try{return await O({signingSessionPlan:e.signingSessionPlan,signingOperation:e.signingOperation,commandKind:m.ShowConfirmation,execute:r})}catch(t){throw i(t)&&w(e.signingOperationState).phase===h.Authentication?se():t}}async function pe(e){let t=X({runtime:e.runtime,request:e.request});return await O({signingSessionPlan:e.signingSessionPlan,signingOperation:e.signingOperation,commandKind:m.ShowConfirmation,execute:t})}function me(e){let t=e.plan;if(t.kind===c.WarmSession){if(t.keyRef.kind!==ne.Cached)throw Error(`[SigningEngine] warm signing-session plan requires a cached key ref`);let n=Math.floor(Number(e.expiresAtMs)||0),r=Math.floor(Number(e.remainingUses)||0);if(n<=0||r<=0)throw Error(`[SigningEngine] warm signing-session auth plan requires positive expiresAtMs and remainingUses`);if(e.curve===`ed25519`){if(t.keyRef.curve!==`ed25519`)throw Error(`[SigningEngine] Ed25519 warm plan requires an Ed25519 key ref`);return{kind:l.WarmSession,method:s(t.lane.auth),accountId:e.accountId,intent:e.intent,curve:`ed25519`,thresholdSessionId:String(t.keyRef.thresholdSessionId),retention:t.lane.retention,expiresAtMs:n,remainingUses:r}}if(t.keyRef.curve!==`ecdsa`)throw Error(`[SigningEngine] ECDSA warm plan requires an ECDSA key ref`);return{kind:l.WarmSession,method:s(t.lane.auth),accountId:e.accountId,intent:e.intent,curve:`ecdsa`,materialActivation:t.keyRef.materialActivation,authorization:t.keyRef.authorization,retention:t.lane.retention,expiresAtMs:n,remainingUses:r}}return t.kind===c.EmailOtpReauth?{kind:l.EmailOtpReauth,method:`email_otp`,...e.emailOtpPrompt?{emailOtpPrompt:e.emailOtpPrompt}:{}}:{kind:l.PasskeyReauth,method:`passkey`}}function he(e){switch(e.kind){case l.EmailOtpReauth:return`email_otp`;case l.WarmSession:return`warm_session`;case l.ActiveWalletAuthority:return`warm_session`;case l.PasskeyReauth:return`passkey`;default:{let t=e.kind;throw Error(`Unsupported signing confirmation auth method: ${String(t)}`)}}}function Z(e,t){let n=String(e.phase||``),r=e.status===`failed`;if(n===`intent-confirmation-required`)return{phase:a.STEP_05_CONFIRMATION_DISPLAYED,status:`waiting_for_user`,interaction:{kind:`transaction_confirmation`,overlay:`show`},data:Q(e.data)};if(n===`confirmation.complete`)return r?{phase:a.STEP_05_CONFIRMATION_CANCELLED,status:`cancelled`,interaction:{kind:`transaction_confirmation`,overlay:`hide`},error:{message:e.message||`Transaction rejected`},data:Q(e.data)}:{phase:t===`email_otp`?a.STEP_06_AUTH_EMAIL_OTP_VERIFY_SUCCEEDED:a.STEP_05_CONFIRMATION_APPROVED,status:`succeeded`,interaction:{kind:t===`email_otp`?`otp_input`:`transaction_confirmation`,overlay:`hide`},data:Q(e.data)};if(n===`auth.passkey.prompt.started`)return{phase:a.STEP_06_AUTH_PASSKEY_PROMPT_STARTED,status:`waiting_for_user`,interaction:{kind:`passkey_assert`,overlay:`show`},data:Q(e.data)};if(n===`auth.passkey.prompt.succeeded`){let t=`passkey_assert`;return r?{phase:a.FAILED,status:`failed`,interaction:{kind:t,overlay:`hide`},error:{message:e.message||`Transaction signing failed`},data:Q(e.data)}:{phase:a.STEP_06_AUTH_PASSKEY_PROMPT_SUCCEEDED,status:`succeeded`,interaction:{kind:t,overlay:`hide`},data:Q(e.data)}}return null}function Q(e){if(e!=null)return typeof e==`object`&&!Array.isArray(e)?e:{value:e}}function ge(e){return{challengeId:e.challenge.challengeId,...e.challenge.emailHint?{emailHint:e.challenge.emailHint}:{},title:`Enter email code to sign`,helperText:u(e.challenge.emailHint),...e.resend?{onResend:e.resend}:{}}}var $=class extends Error{constructor(e,t,n){super(n),this.name=`StepUpMethodSelectionError`,this.code=e,this.method=t}};function _e(e,t){return t.kind===`reuse_warm_session`?`warm_session`:t.kind===`force_method`?t.method:e.authMethod}function ve(e){if(e.policy.kind===`reuse_warm_session`)return{method:`warm_session`,authorization:e.policy.authorization};let t=_e(e.selectedLane,e.policy);if(t===`passkey`){if(!e.methods.passkey)throw new $(`missing_step_up_runner`,t,`Passkey step-up runner is required for this operation`);return{method:`passkey`,runner:e.methods.passkey}}if(t===`email_otp`){if(!e.methods.emailOtp)throw new $(`missing_step_up_runner`,t,`Email OTP step-up runner is required for this operation`);return{method:`email_otp`,runner:e.methods.emailOtp}}let n=t;throw new $(`unsupported_step_up_method`,n,`Unsupported step-up method: ${n}`)}async function ye(e){let t=ve({selectedLane:e.selectedLane,policy:e.policy,methods:e.methods});if(t.method===`warm_session`)return{method:`warm_session`,authorization:t.authorization};if(t.method===`passkey`){let n=await t.runner.prepare();return{method:`passkey`,prompt:n,complete:async r=>await t.runner.complete({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,prompt:n,confirmation:r})}}let n=await t.runner.prepareChallenge({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy}),r={},i=ge({challenge:n,resend:t.runner.resendChallenge?async()=>await t.runner.resendChallenge({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,currentPrompt:r.prompt||i}):void 0});return r.prompt=i,{method:`email_otp`,prompt:i,complete:async n=>await t.runner.complete({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,prompt:i,confirmation:n})}}export{O as C,d as E,re as S,ae as T,_,le as a,v as b,pe as c,Y as d,J as f,m as g,z as h,de as i,fe as l,oe as m,ue as n,Z as o,ce as p,X as r,he as s,ye as t,me as u,D as v,E as w,ie as x,T as y};
+import{c as e,u as t}from"./chains-C_X_fNuS.js";import{i as n}from"./base64-DW79QA0h.js";import{r}from"./secureRandomId-LwBFx84B.js";import{i}from"./errors-DIWY1KR9.js";import{o as a}from"./sdkSentEvents-D4KtK7_I.js";import{a as o,c as s,i as c,o as ee,r as te,t as ne}from"./types-hKLqDUhR.js";import{t as l}from"./types-Buoe6179.js";import{t as u}from"./promptText-CnyrLxgj.js";async function d(r){let i=await t(e({kind:String(r.kind||``).trim()||`unknown`,payload:f(r.payload)}));return te.signingOperationFingerprint(`sha256:${n(i)}`)}function f(e){if(typeof e==`bigint`)return e.toString(10);if(e instanceof Uint8Array)return{__bytesB64u:n(e)};if(ArrayBuffer.isView(e))return{__bytesB64u:n(new Uint8Array(e.buffer,e.byteOffset,e.byteLength))};if(e instanceof ArrayBuffer)return{__bytesB64u:n(new Uint8Array(e))};if(Array.isArray(e))return e.map(f);if(!e||typeof e!=`object`)return e;let t={};for(let n of Object.keys(e).sort()){let r=f(e[n]);r!==void 0&&(t[n]=r)}return t}const p={Created:`created`,Planned:`planned`,ConfirmationApproved:`confirmation_approved`,AuthenticationInProgress:`authentication_in_progress`,AuthReady:`auth_ready`,ThresholdConnected:`threshold_connected`,PayloadPrepared:`payload_prepared`,Signed:`signed`,CleanedUp:`cleaned_up`,Completed:`completed`,Failed:`failed`,Cancelled:`cancelled`},m={ShowConfirmation:`showConfirmation`,RequestOtp:`requestOtp`,RequestPasskey:`requestPasskey`,ConnectThreshold:`connectThreshold`,PreparePayload:`preparePayload`,Sign:`sign`,Cleanup:`cleanup`},h={Review:`review`,Authentication:`authentication`,Execution:`execution`},g={Pending:`pending`,Approved:`approved`},_={ReviewApproved:`review_approved`,AuthenticationStarted:`authentication_started`,AuthenticationCompleted:`authentication_completed`};function v(e){return{operationId:e.operationId,current:{kind:p.Created}}}function y(e,t){switch(e.current.kind){case p.Created:case p.Planned:{let n={kind:p.Planned,plan:t};return e.current=n,n}case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:{let n={kind:p.ConfirmationApproved,plan:t};return e.current=n,n}case p.AuthenticationInProgress:{let n={kind:e.current.reviewApproval===g.Approved?p.ConfirmationApproved:p.Planned,plan:t};return e.current=n,n}case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot be replanned`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be replanned`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot be replanned`);default:return I(e.current)}}function b(e){switch(e.current.kind){case p.Planned:e.current={kind:p.ConfirmationApproved,plan:e.current.plan};return;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.AuthenticationInProgress:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Approved};return;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before confirmation`);case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot be confirmed`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be confirmed`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot be confirmed`);default:return I(e.current)}}function x(e){switch(e.current.kind){case p.Planned:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Pending};return;case p.ConfirmationApproved:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Approved};return;case p.AuthenticationInProgress:return;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before authentication`);case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot authenticate`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot authenticate`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot authenticate`);default:return I(e.current)}}function S(e){switch(e.current.kind){case p.AuthenticationInProgress:if(e.current.reviewApproval!==g.Approved)throw Error(`[SigningOperationMachine] authentication cannot complete before transaction approval`);e.current={kind:p.AuthReady,plan:e.current.plan};return;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.Created:case p.Planned:throw Error(`[SigningOperationMachine] authentication cannot complete before transaction approval`);case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot authenticate`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot authenticate`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot authenticate`);default:return I(e.current)}}function C(e,t){switch(t.kind){case _.ReviewApproved:b(e);return;case _.AuthenticationStarted:x(e);return;case _.AuthenticationCompleted:S(e);return;default:return L(t)}}function w(e){let t;switch(e.current.kind){case p.Planned:t=h.Review;break;case p.AuthenticationInProgress:t=h.Authentication;break;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:t=h.Execution;break;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before cancellation`);case p.Signed:case p.CleanedUp:case p.Completed:throw Error(`[SigningOperationMachine] completed signing cannot be cancelled`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be cancelled`);case p.Cancelled:return e.current;default:return I(e.current)}let n={kind:p.Cancelled,plan:e.current.plan,phase:t};return e.current=n,n}function re(e){switch(e){case p.Planned:return!1;case p.ConfirmationApproved:return!0;default:return R(e)}}function ie(e){switch(e.kind){case p.Created:case p.Planned:case p.Failed:case p.Cancelled:return!1;case p.AuthenticationInProgress:return e.reviewApproval===g.Approved;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:case p.Completed:return!0;default:return I(e)}}function T(e){return{kind:`signing_operation_plan`,sessionPlan:e.sessionPlan,operation:e.operation,commands:e.commands}}async function E(e){let t=[];for(let n of e.steps){if(n.command)try{await e.executor.execute(n.command)}catch(r){let i=j({from:n.from,to:{kind:p.Failed,plan:n.command.plan,reason:F(r)},command:n.command,reason:F(r)});return await e.onTransition?.(i.traceEvent),t.push(i),{ok:!1,finalState:i.to,error:r}}if(await e.onTransition?.(n.traceEvent),t.push(n),n.to.kind===p.Failed)return{ok:!0,finalState:n.to}}let n=t.at(-1)?.to||e.steps.at(-1)?.from;if(!n)throw Error(`[SigningOperationMachine] command sequence produced no steps`);return{ok:!0,finalState:n}}async function ae(e){for(let t of e.commands)await e.execute(t)}function D(e){let t=k(e),n=-1;return t.forEach((e,t)=>{e.command&&(n=t)}),n>=0?t.slice(0,n+1):[]}async function O(e){let t,n=await E({steps:D(T({sessionPlan:e.signingSessionPlan,operation:e.signingOperation,commands:[e.commandKind]})),executor:{execute:async n=>{n.kind===e.commandKind&&(t=await e.execute())}}});if(!n.ok)throw n.error;if(n.finalState.kind===p.Failed)throw Error(n.finalState.reason);return t}function k(e,t={kind:p.Planned,plan:e.sessionPlan}){let n=e.sessionPlan;if(n.kind===c.NotReady)return[j({from:t,to:{kind:p.Failed,plan:n,reason:n.reason},reason:n.reason})];let r=[],i=t;return i=A(r,i,{to:{kind:p.ConfirmationApproved,plan:n},command:N(e,{kind:m.ShowConfirmation,plan:n,lane:n.lane})}),n.kind===c.EmailOtpReauth?(i=A(r,i,{to:{kind:p.AuthReady,plan:n},command:N(e,{kind:m.RequestOtp,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.ThresholdConnected,plan:n},command:N(e,{kind:m.ConnectThreshold,plan:n,lane:n.lane})})):n.kind===c.PasskeyReauth?(i=A(r,i,{to:{kind:p.AuthReady,plan:n},command:N(e,{kind:m.RequestPasskey,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.ThresholdConnected,plan:n},command:N(e,{kind:m.ConnectThreshold,plan:n,lane:n.lane})})):i=A(r,i,{to:{kind:p.AuthReady,plan:n}}),i=A(r,i,{to:{kind:p.PayloadPrepared,plan:n},command:N(e,{kind:m.PreparePayload,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.Signed,plan:n},command:N(e,{kind:m.Sign,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.CleanedUp,plan:n},command:N(e,{kind:m.Cleanup,plan:n,lane:n.lane})}),A(r,i,{to:{kind:p.Completed,plan:n}}),r}function A(e,t,n){let r=j({from:t,to:n.to,command:n.command,reason:n.reason});return e.push(r),r.to}function j(e){let t=M(e.from,e.to);return{from:e.from,to:e.to,command:e.command,traceEvent:{event:`signing_operation_transition`,from:e.from.kind,to:e.to.kind,...e.command?{command:e.command.kind}:{},...e.command?.operation?{operationId:e.command.operation.operationId}:{},plan:ee(t),lane:o(t.lane),...e.reason?{reason:e.reason}:{}}}}function M(e,t){if(`plan`in t)return t.plan;if(`plan`in e)return e.plan;throw Error(`[SigningOperationMachine] transition has no signing plan`)}function N(e,t){if(e.commands.includes(t.kind))return P(t,e.operation)}function P(e,t){return t?{...e,operation:t}:e}function F(e){return e instanceof Error&&e.message.trim()?e.message:`execution_command_failed`}function I(e){throw Error(`Unsupported signing operation state: ${String(e)}`)}function L(e){throw Error(`[SigningOperationMachine] unsupported interaction event: ${String(e)}`)}function R(e){throw Error(`Unsupported signing operation state kind: ${String(e)}`)}function z(e){switch(e.signingAuthPlan.kind){case l.WarmSession:return{signingAuthPlan:e.signingAuthPlan};case l.ActiveWalletAuthority:return{signingAuthPlan:e.signingAuthPlan};case l.PasskeyReauth:return{signingAuthPlan:e.signingAuthPlan,...e.webauthnChallenge?{webauthnChallenge:e.webauthnChallenge}:{}};case l.EmailOtpReauth:{let t=e.emailOtpPrompt??e.signingAuthPlan.emailOtpPrompt;if(!t)throw Error(`[SigningConfirmation] missing_email_otp_prompt`);return{signingAuthPlan:e.signingAuthPlan,emailOtpPrompt:t}}default:return B(e.signingAuthPlan)}}function B(e){throw Error(`Unsupported signing auth plan: ${String(e.kind)}`)}async function V(e){H(e.request);let t=e.runtime.orchestrateSigningConfirmation;return await t(e.request)}function H(e){let t=e;switch(e.signingAuthPlan.kind){case l.WarmSession:if(t.emailOtpPrompt!==void 0||t.webauthnChallenge!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.ActiveWalletAuthority:if(t.emailOtpPrompt!==void 0||t.webauthnChallenge!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.PasskeyReauth:if(t.emailOtpPrompt!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.EmailOtpReauth:if(t.webauthnChallenge!==void 0||!t.emailOtpPrompt)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;default:return B(e.signingAuthPlan)}}function U(e){switch(e){case`missing_capability`:case`missing_material`:case`authority_ambiguous`:case`binding_mismatch`:case`exact_record_conflict`:case`corrupt`:return{kind:`invalid_material`,reason:e};case`revoked`:case`replaced`:return{kind:`full_login_required`,reason:e};case`persistence_unavailable`:return{kind:`temporarily_unavailable`,reason:e};default:throw Error(`[SigningEngine] unsupported signing material block reason`)}}var W=class extends Error{constructor(e){super(`Wallet signing material is invalid. Log in again or recover the wallet.`),this.reason=e,this.name=`InvalidWalletSigningMaterialError`,this.code=`wallet_signing_material_invalid`}},G=class extends Error{constructor(e){super(`A full wallet login is required before signing.`),this.reason=e,this.name=`WalletFullLoginRequiredError`,this.code=`wallet_full_login_required`}},K=class extends Error{constructor(){super(`Request cancelled.`),this.name=`WalletOperationStepUpCancelled`,this.code=`wallet_operation_step_up_cancelled`}},q=class extends Error{constructor(){super(`Wallet signing material storage is temporarily unavailable. Retry the operation.`),this.name=`WalletSigningMaterialTemporarilyUnavailableError`,this.code=`wallet_signing_material_temporarily_unavailable`,this.reason=`persistence_unavailable`}};function J(e){return new W(e)}function Y(e){return new G(e)}function oe(e){let t=U(e);switch(t.kind){case`invalid_material`:return J(t.reason);case`full_login_required`:return Y(t.reason);case`temporarily_unavailable`:return new q;default:throw Error(`[SigningEngine] unsupported signing material disposition`)}}function se(){return new K}function ce(e){return e instanceof W||e instanceof G||e instanceof K}function le(e){return r(e,32,`signing confirmation request IDs`)}function ue(e){return e.override}function de(e){return e.kind===`digest`?e.digest32:e.challenge32}function X(e){let t=V;return async()=>await t({runtime:e.runtime,request:e.request})}async function fe(e){let t=y(e.signingOperationState,e.signingSessionPlan),n={...e.request,signingOperationStateKind:t.kind,onSigningOperationInteractionEvent:C.bind(void 0,e.signingOperationState)},r=X({runtime:e.runtime,request:n});try{return await O({signingSessionPlan:e.signingSessionPlan,signingOperation:e.signingOperation,commandKind:m.ShowConfirmation,execute:r})}catch(t){throw i(t)&&w(e.signingOperationState).phase===h.Authentication?se():t}}async function pe(e){let t=X({runtime:e.runtime,request:e.request});return await O({signingSessionPlan:e.signingSessionPlan,signingOperation:e.signingOperation,commandKind:m.ShowConfirmation,execute:t})}function me(e){let t=e.plan;if(t.kind===c.WarmSession){if(t.keyRef.kind!==ne.Cached)throw Error(`[SigningEngine] warm signing-session plan requires a cached key ref`);let n=Math.floor(Number(e.expiresAtMs)||0),r=Math.floor(Number(e.remainingUses)||0);if(n<=0||r<=0)throw Error(`[SigningEngine] warm signing-session auth plan requires positive expiresAtMs and remainingUses`);if(e.curve===`ed25519`){if(t.keyRef.curve!==`ed25519`)throw Error(`[SigningEngine] Ed25519 warm plan requires an Ed25519 key ref`);return{kind:l.WarmSession,method:s(t.lane.auth),accountId:e.accountId,intent:e.intent,curve:`ed25519`,thresholdSessionId:String(t.keyRef.thresholdSessionId),retention:t.lane.retention,expiresAtMs:n,remainingUses:r}}if(t.keyRef.curve!==`ecdsa`)throw Error(`[SigningEngine] ECDSA warm plan requires an ECDSA key ref`);return{kind:l.WarmSession,method:s(t.lane.auth),accountId:e.accountId,intent:e.intent,curve:`ecdsa`,materialActivation:t.keyRef.materialActivation,authorization:t.keyRef.authorization,retention:t.lane.retention,expiresAtMs:n,remainingUses:r}}return t.kind===c.EmailOtpReauth?{kind:l.EmailOtpReauth,method:`email_otp`,...e.emailOtpPrompt?{emailOtpPrompt:e.emailOtpPrompt}:{}}:{kind:l.PasskeyReauth,method:`passkey`}}function he(e){switch(e.kind){case l.EmailOtpReauth:return`email_otp`;case l.WarmSession:return`warm_session`;case l.ActiveWalletAuthority:return`warm_session`;case l.PasskeyReauth:return`passkey`;default:{let t=e.kind;throw Error(`Unsupported signing confirmation auth method: ${String(t)}`)}}}function Z(e,t){let n=String(e.phase||``),r=e.status===`failed`;if(n===`intent-confirmation-required`)return{phase:a.STEP_05_CONFIRMATION_DISPLAYED,status:`waiting_for_user`,interaction:{kind:`transaction_confirmation`,overlay:`show`},data:Q(e.data)};if(n===`confirmation.complete`)return r?{phase:a.STEP_05_CONFIRMATION_CANCELLED,status:`cancelled`,interaction:{kind:`transaction_confirmation`,overlay:`hide`},error:{message:e.message||`Transaction rejected`},data:Q(e.data)}:{phase:t===`email_otp`?a.STEP_06_AUTH_EMAIL_OTP_VERIFY_SUCCEEDED:a.STEP_05_CONFIRMATION_APPROVED,status:`succeeded`,interaction:{kind:t===`email_otp`?`otp_input`:`transaction_confirmation`,overlay:`hide`},data:Q(e.data)};if(n===`auth.passkey.prompt.started`)return{phase:a.STEP_06_AUTH_PASSKEY_PROMPT_STARTED,status:`waiting_for_user`,interaction:{kind:`passkey_assert`,overlay:`show`},data:Q(e.data)};if(n===`auth.passkey.prompt.succeeded`){let t=`passkey_assert`;return r?{phase:a.FAILED,status:`failed`,interaction:{kind:t,overlay:`hide`},error:{message:e.message||`Transaction signing failed`},data:Q(e.data)}:{phase:a.STEP_06_AUTH_PASSKEY_PROMPT_SUCCEEDED,status:`succeeded`,interaction:{kind:t,overlay:`hide`},data:Q(e.data)}}return null}function Q(e){if(e!=null)return typeof e==`object`&&!Array.isArray(e)?e:{value:e}}function ge(e){return{challengeId:e.challenge.challengeId,...e.challenge.emailHint?{emailHint:e.challenge.emailHint}:{},title:`Enter email code to sign`,helperText:u(e.challenge.emailHint),...e.resend?{onResend:e.resend}:{}}}var $=class extends Error{constructor(e,t,n){super(n),this.name=`StepUpMethodSelectionError`,this.code=e,this.method=t}};function _e(e,t){return t.kind===`reuse_warm_session`?`warm_session`:t.kind===`force_method`?t.method:e.authMethod}function ve(e){if(e.policy.kind===`reuse_warm_session`)return{method:`warm_session`,authorization:e.policy.authorization};let t=_e(e.selectedLane,e.policy);if(t===`passkey`){if(!e.methods.passkey)throw new $(`missing_step_up_runner`,t,`Passkey step-up runner is required for this operation`);return{method:`passkey`,runner:e.methods.passkey}}if(t===`email_otp`){if(!e.methods.emailOtp)throw new $(`missing_step_up_runner`,t,`Email OTP step-up runner is required for this operation`);return{method:`email_otp`,runner:e.methods.emailOtp}}let n=t;throw new $(`unsupported_step_up_method`,n,`Unsupported step-up method: ${n}`)}async function ye(e){let t=ve({selectedLane:e.selectedLane,policy:e.policy,methods:e.methods});if(t.method===`warm_session`)return{method:`warm_session`,authorization:t.authorization};if(t.method===`passkey`){let n=await t.runner.prepare();return{method:`passkey`,prompt:n,complete:async r=>await t.runner.complete({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,prompt:n,confirmation:r})}}let n=await t.runner.prepareChallenge({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy}),r={},i=ge({challenge:n,resend:t.runner.resendChallenge?async()=>await t.runner.resendChallenge({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,currentPrompt:r.prompt||i}):void 0});return r.prompt=i,{method:`email_otp`,prompt:i,complete:async n=>await t.runner.complete({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,prompt:i,confirmation:n})}}export{O as C,d as E,re as S,ae as T,_,le as a,v as b,pe as c,Y as d,J as f,m as g,z as h,de as i,fe as l,oe as m,ue as n,Z as o,ce as p,X as r,he as s,ye as t,me as u,D as v,E as w,ie as x,T as y};

package/dist/public/sdk/routerAbNormalSigning-C4P2tDU-.js

@@ -0,0 +1 @@
+import{c as e,h as t,k as n}from"./chains-C_X_fNuS.js";import{A as r,D as i,j as a,k as o}from"./primitives-CqrjmIAH.js";import{i as s,r as c,t as l}from"./base64-DW79QA0h.js";import{r as u}from"./walletDbName-DtRewci9.js";import{d,h as f}from"./capabilityKinds-N8xo_IEh.js";import{$t as p,Qt as m,U as h,W as g,Z as _,ct as v,lt as y}from"./emailOtpEcdsaDerivationIdentity-Bik0N8v9.js";import{t as b}from"./authenticatorOptions-2_XK8aXv.js";import{r as x,t as ee}from"./walletSessionAuthorizationStatus-BL7j2TeM.js";import{t as S}from"./authorizationAdmission-CGinGhXH.js";import{n as te}from"./walletSessionFailure-YuhraC3P.js";const C={enabled:!0,targetDepth:5,lowWatermark:4,maxRefillInFlight:1,refillAttemptTimeoutMs:3e4},ne={network:{chains:[{network:`near-testnet`,rpcUrl:`https://rpc.testnet.fastnear.com`,explorerUrl:`https://testnet.nearblocks.io`},{network:`tempo-testnet`,rpcUrl:`https://rpc.moderato.tempo.xyz`,explorerUrl:`https://explore.tempo.xyz`,chainId:42431},{network:`arc-testnet`,rpcUrl:`https://rpc.testnet.arc.io`,explorerUrl:`https://testnet.arcscan.app`,chainId:5042002},{network:`ethereum-sepolia`,rpcUrl:`https://ethereum-sepolia-rpc.publicnode.com`,explorerUrl:`https://sepolia.etherscan.io`,chainId:11155111}],relayer:{accountId:``,url:``,routes:{delegateAction:`/signed-delegate`}}},registration:{mode:`managed`,projectEnvironmentId:``,publishableKey:``,paymentMode:`disabled`,nearAccountProvisioning:{kind:`implicit_account`}},signing:{sessionDefaults:{ttlMs:u,remainingUses:3},emailOtp:{authPolicy:`session`},sessionPersistenceMode:`none`,sessionSeal:{mode:`none`},routerAb:{normalSigning:{mode:`disabled`}},routerAbEcdsaDerivation:{presignaturePool:C},thresholdEcdsa:{provisioningDefaults:{tempo:{enabled:!0,signingSession:{kind:`jwt`,ttlMs:u,remainingUses:3}},evm:{enabled:!0,signingSession:{kind:`jwt`,ttlMs:u,remainingUses:3}}}}},wallet:{mode:`iframe`,iframe:{origin:`https://wallet.example.localhost`,servicePath:`/wallet-service`,sdkBasePath:`/sdk`,walletHostVariant:`runtime`,rpIdOverride:`example.localhost`}},webauthn:{authenticatorOptions:{userVerification:b.Preferred,originPolicy:{single:void 0,all_subdomains:!0,multiple:void 0}}},ui:{appearance:{theme:{id:`default`,mode:`dark`,colors:{}},palette:`default`}}};async function re(e,t){let r=n(t,`ECDSA prepare response`);if(r.kind!==e.authorization.kind)throw Error(`ECDSA prepare authorization kind does not match the request`);let i=await h(e,r.signing);if(e.authorization.kind===`operation_step_up`){if(Object.keys(r).some(w))throw Error(`Invalid step-up prepare response`);return{kind:`operation_step_up`,signing:i}}if(Object.keys(r).some(ie))throw Error(`Invalid Wallet Session prepare response`);let a=n(r.session_status,`ECDSA prepare session status`),o=d(a.quotaId),s=f(e.authorization.wallet_session_id);if(!o.ok||!s.ok)throw Error(`Invalid prepare session identity`);let c=x(a,{walletSessionId:s.value,quotaId:o.value});if(!c||c.status!==`active`||c.authorization.walletId!==e.scope.wallet_id)throw Error(`ECDSA prepare did not return the admitted Wallet Session`);return{kind:`reusable_wallet_session`,signing:i,sessionStatus:c}}function w(e){return e!==`kind`&&e!==`signing`}function ie(e){return w(e)&&e!==`session_status`}var T=class extends Error{constructor(e){super(`Router A/B signing ${e.path} returned HTTP ${e.status}: ${e.message||e.code}`),this.name=`RouterAbSigningRequestError`,this.code=e.code,this.path=e.path,this.status=e.status}};function ae(e){let t=String(e.code||``).trim(),n=`Router A/B signing ${e.path} returned HTTP ${e.status}: ${e.message||t||`unknown admission failure`}`;if(e.authorizationDecision?.kind===`step_up_required`)return new S({kind:`exhausted`,source:`server_prepare`,detail:n},e.authorizationDecision);switch(t){case`wallet_budget_exhausted`:return new S({kind:`exhausted`,source:`server_prepare`,detail:n},e.authorizationDecision);case`wallet_budget_in_flight`:case`wallet_budget_reserved`:return new S({kind:`in_flight`,source:`server_prepare`,detail:n,retryAfterMs:150});default:return null}}function E(e,t){let n=Math.floor(Number(e));if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} must be a positive integer`);return n}function D(e,t,n){if(!Array.isArray(e))throw Error(`${t} must be a byte array`);let r=e.map(e=>Number(e));if(!r.every(e=>Number.isInteger(e)&&e>=0&&e<=255))throw Error(`${t} must contain bytes`);if(n!==void 0&&r.length!==n)throw Error(`${t} must contain ${n} bytes`);return r}function O(e,n){let r=t(e,n);if(c(r).length!==32)throw Error(`${n} must decode to 32 bytes`);return r}function k(e,n){let r=t(e,n);if(c(r).length===0)throw Error(`${n} must decode to non-empty bytes`);return r}function A(e,n){let r=t(e,n),i;try{i=l(r)}catch{i=c(r)}if(i.length!==32)throw Error(`${n} must decode to 32 bytes`);return s(i)}function j(e){return{bytes:[...D([...e],`digest bytes`,32)]}}function M(e,t){return s(Uint8Array.from(D(e.bytes,t)))}async function oe(t){return s(await Q(new TextEncoder().encode(e(t))))}function se(e){let n=t(e.message,`nep413.message`),r=t(e.recipient,`nep413.recipient`),i=c(A(e.nonce,`nep413.nonce`)),a=e.callbackUrl==null?void 0:t(e.callbackUrl,`callbackUrl`),o=[];return Z(o,2147484061),q(o,n),Y(o,i),q(o,r),a?(o.push(1),q(o,a)):o.push(0),s(Uint8Array.from(o))}async function ce(e){let n={scope:I(e.scope,`scope`),expires_at_ms:E(e.expiresAtMs,`expiresAtMs`),display_digest:j(c(O(e.displayDigestB64u,`displayDigestB64u`))),intent:{kind:`near_transaction_v1`,operation_id:t(e.operationId,`operationId`),operation_fingerprint:t(e.operationFingerprint,`operationFingerprint`),near_account_id:t(e.nearAccountId,`nearAccountId`),near_network_id:e.nearNetworkId,transactions:e.transactions.map((e,n)=>({receiver_id:t(e.receiverId,`transactions[${n}].receiverId`),action_fingerprint:t(e.actionFingerprint,`transactions[${n}].actionFingerprint`)})),unsigned_transaction_borsh_b64u:k(e.unsignedTransactionBorshB64u,`unsignedTransactionBorshB64u`)},signing_payload:{kind:`near_unsigned_transaction_borsh_v1`,unsigned_transaction_borsh_b64u:k(e.unsignedTransactionBorshB64u,`unsignedTransactionBorshB64u`),expected_signing_digest_b64u:O(e.expectedSigningDigestB64u,`expectedSigningDigestB64u`)}};return{request:n,admissionMaterial:await P(n)}}async function le(e){let n=A(e.nonce,`nonce`),r=e.callbackUrl==null?void 0:t(e.callbackUrl,`callbackUrl`),i=se({message:e.message,recipient:e.recipient,nonce:n,...r?{callbackUrl:r}:{}}),a={scope:I(e.scope,`scope`),expires_at_ms:E(e.expiresAtMs,`expiresAtMs`),display_digest:j(c(O(e.displayDigestB64u,`displayDigestB64u`))),intent:{kind:`nep413_v1`,operation_id:t(e.operationId,`operationId`),operation_fingerprint:t(e.operationFingerprint,`operationFingerprint`),near_account_id:t(e.nearAccountId,`nearAccountId`),near_network_id:e.nearNetworkId,recipient:t(e.recipient,`recipient`),message:t(e.message,`message`),nonce_b64u:n,...r?{callback_url:r}:{}},signing_payload:{kind:`nep413_message_v1`,canonical_message_b64u:i,expected_signing_digest_b64u:O(e.expectedSigningDigestB64u,`expectedSigningDigestB64u`)}};return{request:a,admissionMaterial:await P(a)}}async function ue(e){let n=k(e.delegate.canonicalDelegateBorshB64u,`canonicalDelegateBorshB64u`),r={scope:I(e.scope,`scope`),expires_at_ms:E(e.expiresAtMs,`expiresAtMs`),display_digest:j(c(O(e.displayDigestB64u,`displayDigestB64u`))),intent:{kind:`near_delegate_action_v1`,operation_id:t(e.operationId,`operationId`),operation_fingerprint:t(e.operationFingerprint,`operationFingerprint`),near_account_id:t(e.nearAccountId,`nearAccountId`),near_network_id:e.nearNetworkId,delegate:{sender_id:t(e.delegate.senderId,`delegate.senderId`),receiver_id:t(e.delegate.receiverId,`delegate.receiverId`),public_key:t(e.delegate.publicKey,`delegate.publicKey`),nonce:t(e.delegate.nonce,`delegate.nonce`),max_block_height:t(e.delegate.maxBlockHeight,`delegate.maxBlockHeight`),action_fingerprint:t(e.delegate.actionFingerprint,`delegate.actionFingerprint`),canonical_delegate_borsh_b64u:n}},signing_payload:{kind:`near_delegate_action_v1`,canonical_delegate_borsh_b64u:n,expected_signing_digest_b64u:O(e.expectedSigningDigestB64u,`expectedSigningDigestB64u`)}};return{request:r,admissionMaterial:await P(r)}}function N(e){let n=I(e.scope,`scope`),r={scope:n,expires_at_ms:E(e.expiresAtMs,`expiresAtMs`),prepare_binding:{server_round1_handle:t(e.prepareResponse.server_round1_handle,`server_round1_handle`),round1_binding_digest:L(e.prepareResponse.round1_binding_digest,`round1_binding_digest`),intent_digest:L(e.admissionMaterial.intentDigest,`intent_digest`),signing_payload_digest:L(e.admissionMaterial.signingPayloadDigest,`signing_payload_digest`)},protocol:{kind:`ed25519_two_party_frost_finalize_v1`,client_commitments:z(e.clientCommitments,`clientCommitments`),server_commitments:z(e.prepareResponse.server_commitments,`serverCommitments`),client_verifying_share_b64u:t(e.clientVerifyingShareB64u,`clientVerifyingShareB64u`),server_verifying_share_b64u:t(e.prepareResponse.server_verifying_share_b64u,`serverVerifyingShareB64u`),client_signature_share_b64u:t(e.clientSignatureShareB64u,`clientSignatureShareB64u`)}};if(n.authorization.kind===`reusable_wallet_session`&&e.prepareResponse.scope.authorization.kind===`reusable_wallet_session`)return{...r,scope:{...n,authorization:n.authorization},authorized_operation:V(e.prepareResponse.authorized_operation,`authorized_operation`)};if(n.authorization.kind===`operation_step_up`&&e.prepareResponse.scope.authorization.kind===`operation_step_up`)return{...r,scope:{...n,authorization:n.authorization},authorized_operation:H(e.prepareResponse.authorized_operation,`authorized_operation`)};throw Error(`Router A/B normal-signing authorization changed after prepare`)}async function P(e){let t=j(await Q(Se(e.intent))),n=j(await Q(Ce(e.signing_payload))),r=j(await Q(we(e.signing_payload))),i=c(Te(e.signing_payload));if(!De(r.bytes,i))throw Error(`Router A/B normal-signing expected signing digest drift`);return{intentDigest:t,signingPayloadDigest:n,admittedSigningDigest:r}}function F(e,t,n){let r=Object.keys(e).sort(),i=[...t].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${n} has invalid fields`)}function I(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);F(r,[`request_id`,`account_id`,`authorization`,`material_activation`,`signing_worker_id`],n);let i={request_id:t(r.request_id,`${n}.request_id`),account_id:t(r.account_id,`${n}.account_id`),authorization:p(r.authorization),material_activation:m(r.material_activation),signing_worker_id:t(r.signing_worker_id,`${n}.signing_worker_id`)};if(i.material_activation.signing_worker!==i.signing_worker_id)throw Error(`${n} material activation SigningWorker mismatch`);return i}function L(e,t){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`${t} must be an object`);return{bytes:D(n.bytes,`${t}.bytes`,32)}}function R(e,t){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`${t} must be an object`);let r=D(n.bytes,`${t}.bytes`);if(r.length===0)throw Error(`${t}.bytes must be non-empty`);return{bytes:r}}function z(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);return{hiding:t(r.hiding,`${n}.hiding`),binding:t(r.binding,`${n}.binding`)}}function B(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);return{server_id:t(r.server_id,`${n}.server_id`),key_epoch:t(r.key_epoch,`${n}.key_epoch`),recipient_encryption_key:t(r.recipient_encryption_key,`${n}.recipient_encryption_key`)}}function V(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);F(r,[`kind`,`authorized_operation_id`,`operation_id`,`capability_kind`,`operation_kind`,`lane_digest_b64u`,`intent_digest_b64u`,`display_digest_b64u`,`operation_fingerprint_digest`],n);let i=t(r.kind,`${n}.kind`);if(i!==`reusable_wallet_session_authorized_operation_v1`)throw Error(`${n}.kind is invalid`);let a=t(r.capability_kind,`${n}.capability_kind`);if(a!==`near_ed25519_mpc_signing`)throw Error(`${n}.capability_kind is invalid`);let o=t(r.operation_kind,`${n}.operation_kind`);if(o!==`near.sign_transaction`&&o!==`near.sign_delegate_action`&&o!==`near.sign_nep413_message`)throw Error(`${n}.operation_kind is invalid`);return{kind:i,authorized_operation_id:t(r.authorized_operation_id,`${n}.authorized_operation_id`),operation_id:t(r.operation_id,`${n}.operation_id`),capability_kind:a,operation_kind:o,lane_digest_b64u:O(r.lane_digest_b64u,`${n}.lane_digest_b64u`),intent_digest_b64u:O(r.intent_digest_b64u,`${n}.intent_digest_b64u`),display_digest_b64u:O(r.display_digest_b64u,`${n}.display_digest_b64u`),operation_fingerprint_digest:O(r.operation_fingerprint_digest,`${n}.operation_fingerprint_digest`)}}function H(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);if(F(r,[`kind`,`authorization_session_id`,`evidence_set_digest`,`authorized_operation_id`,`operation_id`,`capability_kind`,`operation_kind`,`lane_digest_b64u`,`intent_digest_b64u`,`display_digest_b64u`,`operation_fingerprint_digest`],n),t(r.kind,`${n}.kind`)!==`verified_step_up_authorized_operation_v1`)throw Error(`${n}.kind is invalid`);if(t(r.capability_kind,`${n}.capability_kind`)!==`near_ed25519_mpc_signing`)throw Error(`${n}.capability_kind is invalid`);let i=t(r.operation_kind,`${n}.operation_kind`);if(i!==`near.sign_transaction`&&i!==`near.sign_delegate_action`&&i!==`near.sign_nep413_message`)throw Error(`${n}.operation_kind is invalid`);return{kind:`verified_step_up_authorized_operation_v1`,authorization_session_id:t(r.authorization_session_id,`${n}.authorization_session_id`),evidence_set_digest:O(r.evidence_set_digest,`${n}.evidence_set_digest`),authorized_operation_id:t(r.authorized_operation_id,`${n}.authorized_operation_id`),operation_id:t(r.operation_id,`${n}.operation_id`),capability_kind:`near_ed25519_mpc_signing`,operation_kind:i,lane_digest_b64u:O(r.lane_digest_b64u,`${n}.lane_digest_b64u`),intent_digest_b64u:O(r.intent_digest_b64u,`${n}.intent_digest_b64u`),display_digest_b64u:O(r.display_digest_b64u,`${n}.display_digest_b64u`),operation_fingerprint_digest:O(r.operation_fingerprint_digest,`${n}.operation_fingerprint_digest`)}}function U(e){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`Router A/B normal-signing prepare response must be an object`);let r=t(n.signature_scheme,`signature_scheme`);if(r!==`ed25519_v1`)throw Error(`Unsupported Router A/B normal-signing signature scheme: ${r}`);let i=I(n.scope,`scope`),a={scope:i,signing_payload_digest:L(n.signing_payload_digest,`signing_payload_digest`),round1_binding_digest:L(n.round1_binding_digest,`round1_binding_digest`),signing_worker:B(n.signing_worker,`signing_worker`),server_round1_handle:t(n.server_round1_handle,`server_round1_handle`),server_commitments:z(n.server_commitments,`server_commitments`),server_verifying_share_b64u:t(n.server_verifying_share_b64u,`server_verifying_share_b64u`),signature_scheme:`ed25519_v1`,prepared_at_ms:E(n.prepared_at_ms,`prepared_at_ms`),expires_at_ms:E(n.expires_at_ms,`expires_at_ms`)};switch(i.authorization.kind){case`reusable_wallet_session`:return F(n,[`scope`,`signing_payload_digest`,`round1_binding_digest`,`signing_worker`,`server_round1_handle`,`server_commitments`,`server_verifying_share_b64u`,`signature_scheme`,`prepared_at_ms`,`expires_at_ms`,`authorized_operation`],`Router A/B reusable Wallet Session prepare response`),{...a,scope:{...i,authorization:i.authorization},authorized_operation:V(n.authorized_operation,`authorized_operation`)};case`operation_step_up`:return F(n,[`scope`,`signing_payload_digest`,`round1_binding_digest`,`signing_worker`,`server_round1_handle`,`server_commitments`,`server_verifying_share_b64u`,`signature_scheme`,`prepared_at_ms`,`expires_at_ms`,`authorized_operation`],`Router A/B operation step-up prepare response`),{...a,scope:{...i,authorization:i.authorization},authorized_operation:H(n.authorized_operation,`authorized_operation`)}}}function de(e){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`Router A/B normal-signing response must be an object`);F(n,[`scope`,`signing_payload_digest`,`signing_worker`,`signature_scheme`,`signature`,`signed_at_ms`],`Router A/B normal-signing response`);let r=t(n.signature_scheme,`signature_scheme`);if(r!==`ed25519_v1`)throw Error(`Unsupported Router A/B normal-signing signature scheme: ${r}`);return{scope:I(n.scope,`scope`),signing_payload_digest:L(n.signing_payload_digest,`signing_payload_digest`),signing_worker:B(n.signing_worker,`signing_worker`),signature_scheme:`ed25519_v1`,signature:R(n.signature,`signature`),signed_at_ms:E(n.signed_at_ms,`signed_at_ms`)}}function fe(e){let t=e.credential.kind===`wallet_session_opaque`?{token:e.credential.walletSessionToken,home:e.credential.home}:null;return i({...t?{headers:o(t)}:{},body:e.body})}function pe(e){if(!e.trim())return null;try{let t=JSON.parse(e),n=t&&typeof t==`object`?t:null;if(!n)return null;let r=String(n.code||``).trim(),i=String(n.message||``).trim();if(!r)return null;let a=n.authorization_decision===void 0?void 0:me(n.authorization_decision);return{code:r,message:i,...a?{authorizationDecision:a}:{}}}catch{return null}}function me(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`Router A/B owner-operation authorization decision is invalid`);let t=e,n=t.kind;if(n===`step_up_required`){W(t,[`kind`,`reason`,`step_up`],`owner-operation step-up decision`);let e=t.reason;if(e!==`wallet_session_missing`&&e!==`wallet_session_expired`&&e!==`wallet_session_exhausted`&&e!==`wallet_session_ended`&&e!==`wallet_session_superseded`)throw Error(`owner-operation step-up decision reason is invalid`);let r=t.step_up;return r&&typeof r==`object`&&!Array.isArray(r)&&`operation_digests`in r?{kind:n,reason:e,step_up:_(r)}:{kind:n,reason:e,step_up:he(r)}}if(n===`denied`){if(W(t,[`kind`,`denial`],`owner-operation denial decision`),!t.denial||typeof t.denial!=`object`||Array.isArray(t.denial))throw Error(`owner-operation denial is invalid`);let e=t.denial;W(e,[`code`,`message`],`owner-operation denial`);let r=e.code;if(r!==`invalid_identity`&&r!==`invalid_authority`&&r!==`invalid_operation`&&r!==`inactive_material`&&r!==`replayed_step_up`&&r!==`authorization_unavailable`)throw Error(`owner-operation denial code is invalid`);if(typeof e.message!=`string`||e.message.trim()!==e.message)throw Error(`owner-operation denial message is invalid`);return{kind:n,denial:{code:r,message:e.message}}}if(n===`authorized`){if(W(t,[`kind`,`operation`,`source`],`owner-operation decision`),!t.operation||typeof t.operation!=`object`||Array.isArray(t.operation))throw Error(`owner-operation authorized operation is invalid`);let e=t.operation;if(W(e,[`kind`,`operation_id`,`authorized_operation_id`,`operation_fingerprint_digest`],`owner-operation authorized operation`),e.kind!==`authorized_operation`||typeof e.operation_id!=`string`||typeof e.authorized_operation_id!=`string`||typeof e.operation_fingerprint_digest!=`string`)throw Error(`owner-operation authorized operation is invalid`);if(!t.source||typeof t.source!=`object`||Array.isArray(t.source))throw Error(`owner-operation authorized source is invalid`);let r=t.source;if(W(r,[`kind`,`wallet_session_id`,`quota_id`],`owner-operation authorized source`),r.kind!==`reusable_wallet_session`||typeof r.wallet_session_id!=`string`||typeof r.quota_id!=`string`)throw Error(`owner-operation authorized source is invalid`);return{kind:n,operation:{kind:`authorized_operation`,operation_id:e.operation_id,authorized_operation_id:e.authorized_operation_id,operation_fingerprint_digest:e.operation_fingerprint_digest},source:{kind:`reusable_wallet_session`,wallet_session_id:r.wallet_session_id,quota_id:r.quota_id}}}throw Error(`owner-operation authorization decision kind is invalid`)}function he(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`Ed25519 operation step-up preparation is invalid`);let t=e;W(t,[`wallet_id`,`operation_kind`,`operation_id`,`request_id`,`account_id`,`material_activation`,`signing_worker_id`,`near_account_id`,`signer_slot`,`participant_ids`,`expires_at_ms`],`Ed25519 owner-operation step-up preparation`);let n=t.operation_kind;if(n!==`near.sign_transaction`&&n!==`near.sign_delegate_action`&&n!==`near.sign_nep413_message`)throw Error(`Ed25519 operation step-up kind is invalid`);if(typeof t.wallet_id!=`string`||typeof t.operation_id!=`string`||typeof t.request_id!=`string`||typeof t.account_id!=`string`||typeof t.signing_worker_id!=`string`||typeof t.near_account_id!=`string`||!Number.isSafeInteger(t.signer_slot)||!Number.isSafeInteger(t.expires_at_ms)||!Array.isArray(t.participant_ids)||t.participant_ids.length!==2||!t.participant_ids.every(e=>Number.isSafeInteger(e)&&Number(e)>0))throw Error(`Ed25519 operation step-up preparation fields are invalid`);let[r,i]=t.participant_ids,a=t.signer_slot,o=t.expires_at_ms;if(typeof r!=`number`||typeof i!=`number`||typeof a!=`number`||typeof o!=`number`)throw Error(`Ed25519 operation step-up participants are invalid`);return{wallet_id:t.wallet_id,operation_kind:n,operation_id:t.operation_id,request_id:t.request_id,account_id:t.account_id,material_activation:m(t.material_activation),signing_worker_id:t.signing_worker_id,near_account_id:t.near_account_id,signer_slot:a,participant_ids:[r,i],expires_at_ms:o}}function W(e,t,n){let r=new Set(t);for(let t of Object.keys(e))if(!r.has(t))throw Error(`${n} contains unsupported field ${t}`);for(let r of t)if(!Object.hasOwn(e,r))throw Error(`${n} is missing ${r}`)}function ge(e){let t=pe(e.bodyText);return t?ae({code:t.code,message:t.message,path:e.path,status:e.status,authorizationDecision:t.authorizationDecision})||te({code:t.code,message:`Router A/B signing ${e.path} returned HTTP ${e.status}: ${t.message}`})||new T({code:t.code,message:t.message,path:e.path,status:e.status}):Error(`Router A/B signing ${e.path} returned HTTP ${e.status}${e.bodyText?`: ${e.bodyText}`:``}`)}async function G(e){if(typeof fetch!=`function`)throw Error(`fetch is not available for Router A/B normal-signing request`);let n=a(t(e.relayServerUrl,`relayServerUrl`)),i=await r(new Request(`${n}${e.path}`,{...fe({credential:e.credential,body:e.body}),signal:e.signal}));try{e.onServerTiming?.(i.headers.get(`Server-Timing`))}catch{}if(!i.ok){let t=await i.text().catch(()=>``),n=ge({path:e.path,status:i.status,bodyText:t});throw e.credential.kind===`wallet_session_opaque`&&n instanceof S&&n.failure.kind===`exhausted`&&ee.forgetCredential(e.credential.walletSessionToken),n}return e.parse(await i.json())}function _e(e,t){let r=n(t,`Ed25519 prepare response`);if(r.kind!==e.scope.authorization.kind)throw Error(`Ed25519 prepare authorization kind does not match the request`);let i=U(r.signing);if(e.scope.authorization.kind===`operation_step_up`)return W(r,[`kind`,`signing`],`Ed25519 step-up prepare response`),{kind:`operation_step_up`,signing:i};W(r,[`kind`,`signing`,`session_status`],`Ed25519 session prepare response`);let a=n(r.session_status,`Ed25519 prepare session status`),o=f(e.scope.authorization.wallet_session_id),s=d(a.quotaId);if(!o.ok||!s.ok)throw Error(`Invalid Ed25519 prepare session identity`);let c=x(a,{walletSessionId:o.value,quotaId:s.value});if(!c||c.status!==`active`)throw Error(`Ed25519 prepare did not return an active Wallet Session`);return{kind:`reusable_wallet_session`,signing:i,sessionStatus:c}}async function ve(e){return G({relayServerUrl:e.relayServerUrl,path:`/router-ab/ed25519/sign/prepare`,credential:e.credential,body:e.request,parse:_e.bind(null,e.request)})}async function ye(e){return await y(e.request),G({relayServerUrl:e.relayServerUrl,path:`/router-ab/ecdsa-derivation/sign/prepare`,onServerTiming:e.onServerTiming,credential:e.credential,body:e.request,parse:re.bind(null,e.request)})}async function be(e){return G({relayServerUrl:e.relayServerUrl,path:`/router-ab/ed25519/sign`,credential:e.credential,body:e.request,parse:de})}async function xe(e){return await v(e.request),G({relayServerUrl:e.relayServerUrl,path:`/router-ab/ecdsa-derivation/sign`,onServerTiming:e.onServerTiming,credential:e.credential,body:e.request,parse:t=>g(e.request,t)})}function Se(e){let t=[];switch(J(t,$(`router-ab-protocol/ed25519-normal-signing/intent/v2`)),e.kind){case`near_transaction_v1`:J(t,$(`near_transaction_v1`)),K(t,e),X(t,e.transactions.length);for(let n of e.transactions)J(t,$(n.receiver_id)),J(t,$(n.action_fingerprint));return J(t,$(e.unsigned_transaction_borsh_b64u)),Uint8Array.from(t);case`nep413_v1`:return J(t,$(`nep413_v1`)),K(t,e),J(t,$(e.recipient)),J(t,$(e.message)),J(t,$(e.nonce_b64u)),Ee(t,e.callback_url),Uint8Array.from(t);case`near_delegate_action_v1`:return J(t,$(`near_delegate_action_v1`)),K(t,e),J(t,$(e.delegate.sender_id)),J(t,$(e.delegate.receiver_id)),J(t,$(e.delegate.public_key)),J(t,$(e.delegate.nonce)),J(t,$(e.delegate.max_block_height)),J(t,$(e.delegate.action_fingerprint)),J(t,$(e.delegate.canonical_delegate_borsh_b64u)),Uint8Array.from(t)}}function Ce(e){let t=[];switch(J(t,$(`router-ab-protocol/ed25519-normal-signing/payload/v2`)),e.kind){case`near_unsigned_transaction_borsh_v1`:return J(t,$(`near_unsigned_transaction_borsh_v1`)),J(t,$(e.unsigned_transaction_borsh_b64u)),J(t,$(e.expected_signing_digest_b64u)),Uint8Array.from(t);case`nep413_message_v1`:return J(t,$(`nep413_message_v1`)),J(t,$(e.canonical_message_b64u)),J(t,$(e.expected_signing_digest_b64u)),Uint8Array.from(t);case`near_delegate_action_v1`:return J(t,$(`near_delegate_action_v1`)),J(t,$(e.canonical_delegate_borsh_b64u)),J(t,$(e.expected_signing_digest_b64u)),Uint8Array.from(t)}}function we(e){switch(e.kind){case`near_unsigned_transaction_borsh_v1`:return c(e.unsigned_transaction_borsh_b64u);case`nep413_message_v1`:return c(e.canonical_message_b64u);case`near_delegate_action_v1`:return c(e.canonical_delegate_borsh_b64u)}}function Te(e){switch(e.kind){case`near_unsigned_transaction_borsh_v1`:case`nep413_message_v1`:case`near_delegate_action_v1`:return e.expected_signing_digest_b64u}}function K(e,t){J(e,$(t.operation_id)),J(e,$(t.operation_fingerprint)),J(e,$(t.near_account_id)),J(e,$(t.near_network_id))}function Ee(e,t){t?(e.push(1),J(e,$(t))):e.push(0)}function q(e,t){let n=$(t);Z(e,n.length),Y(e,n)}function J(e,t){X(e,t.length),Y(e,t)}function Y(e,t){for(let n of t)e.push(n)}function X(e,t){e.push(t>>>24&255,t>>>16&255,t>>>8&255,t&255)}function Z(e,t){e.push(t&255,t>>>8&255,t>>>16&255,t>>>24&255)}async function Q(e){let t=globalThis.crypto?.subtle;if(!t)throw Error(`Web Crypto SHA-256 is unavailable for Router A/B normal signing`);let n=new Uint8Array(e.length);return n.set(e),new Uint8Array(await t.digest(`SHA-256`,n.buffer))}function $(e){return new TextEncoder().encode(e)}function De(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}export{N as a,ye as c,oe as d,C as f,le as i,ve as l,ue as n,xe as o,ne as p,ce as r,be as s,T as t,M as u};