@seams/wallet 0.13.1 → 0.15.0

package/dist/esm/plugins/next.js

@@ -1,196 +0,0 @@
-import "node:path";
-import "node:fs";
-import { createRequire } from "node:module";
-//#region ../shared-ts/src/utils/normalize.ts
-/** String coercion + trimming (useful at IO boundaries). */
-function normalizeTrimmedString(value) {
-	return String(value ?? "").trim();
-}
-/** Best-effort origin normalization (used by CSP/Permissions-Policy helpers). */
-function toOriginOrUndefined(input) {
-	try {
-		const v = normalizeTrimmedString(input);
-		if (!v) return void 0;
-		return new URL(v, "http://dummy").origin === "http://dummy" ? new URL(v).origin : v;
-	} catch {
-		return normalizeTrimmedString(input) || void 0;
-	}
-}
-//#endregion
-//#region src/plugins/headers.ts
-function buildPermissionsPolicy(walletOrigin) {
-	const o = toOriginOrUndefined(walletOrigin);
-	const part = (name) => `${name}=(self${o ? ` "${o}"` : ""})`;
-	return [
-		part("publickey-credentials-get"),
-		part("publickey-credentials-create"),
-		part("clipboard-read"),
-		part("clipboard-write")
-	].join(", ");
-}
-/**
-* Build a wallet-friendly Content Security Policy string.
-*
-* mode:
-*  - 'strict' (default): no inline styles, injects "style-src-attr 'none'", and forbids JS 'unsafe-eval'.
-*  - 'compatible': allows inline styles/scripts via 'unsafe-inline' for friendlier dev/local setups.
-*
-* allowUnsafeEval:
-*  - false by default. Set to true only for development servers that require eval (e.g., Next.js Fast Refresh).
-*  - Wallet pages always include 'wasm-unsafe-eval' because browser-side signer initialization uses
-*    WebAssembly compilation.
-*  - Seams SDK does not require JS 'unsafe-eval' in production.
-*
-* Typical usage: apply strict CSP only to the wallet HTML route
-* (/wallet-service); do not attach CSP to host app routes.
-*/
-function buildWalletCsp(opts = {}) {
-	const mode = opts.mode || "strict";
-	const frame = (opts.frameSrc || []).filter(Boolean);
-	const scriptAllow = (opts.scriptSrcAllowlist || []).map((s) => toOriginOrUndefined(s) || s).filter(Boolean);
-	const scriptWasmUnsafeEval = " 'wasm-unsafe-eval'";
-	const scriptUnsafeInline = mode === "compatible" ? " 'unsafe-inline'" : "";
-	const styleUnsafeInline = mode === "compatible" ? " 'unsafe-inline'" : "";
-	const base = [
-		"default-src 'self'",
-		`script-src 'self'${scriptWasmUnsafeEval}${scriptUnsafeInline}${opts.allowUnsafeEval ? " 'unsafe-eval'" : ""}${scriptAllow.length ? " " + scriptAllow.join(" ") : ""}`,
-		`style-src 'self'${styleUnsafeInline}`,
-		"img-src 'self' data:",
-		"font-src 'self'",
-		"connect-src 'self' https:",
-		"worker-src 'self' blob:",
-		`frame-src 'self'${frame.length ? " " + frame.join(" ") : ""}`,
-		"object-src 'none'",
-		"base-uri 'none'",
-		"form-action 'none'"
-	];
-	if (mode === "strict") base.splice(2, 0, "style-src-attr 'none'");
-	return base.join("; ");
-}
-//#endregion
-//#region src/plugins/plugin-utils.ts
-function sanitizeOrigins(values) {
-	const out = /* @__PURE__ */ new Set();
-	if (Array.isArray(values)) for (const v of values) {
-		if (typeof v !== "string") continue;
-		try {
-			const u = new URL(v.trim());
-			const scheme = u.protocol;
-			const host = u.hostname.toLowerCase();
-			const port = u.port ? `:${u.port}` : "";
-			if (!(scheme === "https:") && !(scheme === "http:" && host === "localhost")) continue;
-			if (u.pathname && u.pathname !== "/" || u.search || u.hash) continue;
-			out.add(`${scheme}//${host}${port}`);
-		} catch {}
-	}
-	return Array.from(out);
-}
-function parseConfiguredRorOrigins(value) {
-	return value.split(",").map((s) => s.trim()).filter(Boolean);
-}
-function resolveRorOrigins(input) {
-	return sanitizeOrigins([
-		...input.configuredOrigins,
-		input.docsOrigin.trim(),
-		input.walletOrigin.trim()
-	]);
-}
-createRequire(import.meta.url);
-//#endregion
-//#region src/plugins/next.ts
-function seamsNextHeaders(opts) {
-	const wallet = opts.walletOrigin;
-	const permissions = buildPermissionsPolicy(wallet);
-	const isDev = false;
-	const mode = opts.cspMode ?? "strict";
-	const allowUnsafeEval = isDev;
-	const csp = buildWalletCsp({
-		frameSrc: [wallet, ...opts.extraFrameSrc || []],
-		scriptSrcAllowlist: [...opts.extraScriptSrc || []],
-		mode,
-		allowUnsafeEval
-	});
-	return [{
-		source: "/:path*",
-		headers: [{
-			key: "Permissions-Policy",
-			value: permissions
-		}, {
-			key: "Content-Security-Policy",
-			value: csp
-		}]
-	}];
-}
-/**
-* Convenience wrapper for Next.js app origin.
-* Adds Permissions-Policy and a wallet-friendly CSP via Next's headers() API.
-* emitHeaders has no effect for Next.js; kept for parity with Vite wrappers.
-*/
-function seamsNextApp(opts) {
-	if (opts.emitHeaders) console.warn("[seams] seamsNextApp: emitHeaders has no effect in Next.js; headers are applied via next.config.js headers().");
-	return (config) => {
-		const existing = config?.headers;
-		return {
-			...config,
-			async headers() {
-				return [...(typeof existing === "function" ? await existing() : []) || [], ...seamsNextHeaders(opts)];
-			}
-		};
-	};
-}
-/**
-* Convenience wrapper for Next.js wallet origin.
-* Same behavior as seamsNextApp — Next.js does not serve the SDK/wallet HTML; this
-* helper only sets headers via headers() so the wallet host can be prepped if you
-* proxy wallet routes through Next in dev.
-*/
-function seamsNextWallet(opts) {
-	if (opts.emitHeaders) console.warn("[seams] seamsNextWallet: emitHeaders has no effect in Next.js; headers are applied via next.config.js headers().");
-	return (config) => {
-		const existing = config?.headers;
-		return {
-			...config,
-			async headers() {
-				return [...(typeof existing === "function" ? await existing() : []) || [], ...seamsNextHeaders(opts)];
-			}
-		};
-	};
-}
-function resolveRorParams(opts) {
-	return resolveRorOrigins({
-		configuredOrigins: [...opts.origins || [], ...parseConfiguredRorOrigins(String(process.env.VITE_ROR_ALLOWED_ORIGINS || ""))],
-		docsOrigin: opts.docsOrigin ?? String(process.env.VITE_DOCS_ORIGIN || ""),
-		walletOrigin: opts.walletOrigin ?? String(process.env.VITE_WALLET_ORIGIN || "")
-	});
-}
-/**
-* Pages Router compatible handler (Node runtime).
-* Usage (pages/api/.well-known/webauthn.ts):
-*   export default (req, res) => handleWellKnownRorNode(req, res)
-*/
-async function handleWellKnownRorNode(_req, res, opts = {}) {
-	const origins = resolveRorParams(opts);
-	res.statusCode = 200;
-	res.setHeader?.("Content-Type", "application/json; charset=utf-8");
-	res.setHeader?.("Cache-Control", "max-age=60, stale-while-revalidate=600");
-	res.end?.(JSON.stringify({ origins }));
-}
-/**
-* App Router compatible handler (Edge/Route Handler style).
-* Usage (app/.well-known/webauthn/route.ts):
-*   export async function GET(req: Request) { return handleWellKnownRorEdge(req) }
-*/
-async function handleWellKnownRorEdge(_request, opts = {}) {
-	const origins = resolveRorParams(opts);
-	return new Response(JSON.stringify({ origins }), {
-		status: 200,
-		headers: {
-			"Content-Type": "application/json; charset=utf-8",
-			"Cache-Control": "max-age=60, stale-while-revalidate=600"
-		}
-	});
-}
-//#endregion
-export { handleWellKnownRorEdge, handleWellKnownRorNode, seamsNextApp, seamsNextHeaders, seamsNextWallet };
-
-//# sourceMappingURL=next.js.map

package/dist/esm/plugins/shared-ts/src/utils/normalize.js

@@ -1,31 +0,0 @@
-//#region ../shared-ts/src/utils/normalize.ts
-/** String coercion + trimming (useful at IO boundaries). */
-function normalizeTrimmedString(value) {
-	return String(value ?? "").trim();
-}
-/** Ensure a non-empty string starts with `/` (path normalization). */
-function ensureLeadingSlash(value) {
-	const trimmed = normalizeTrimmedString(value);
-	if (!trimmed) return "";
-	return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
-}
-/** Normalize an app base path like `/sdk` (leading slash, no trailing slashes except `/`). */
-function toBasePath(value, fallback = "/sdk") {
-	const base = ensureLeadingSlash(typeof value === "string" ? value : fallback) || ensureLeadingSlash(fallback) || "/";
-	if (base === "/") return "/";
-	return base.replace(/\/+$/, "");
-}
-/** Best-effort origin normalization (used by CSP/Permissions-Policy helpers). */
-function toOriginOrUndefined(input) {
-	try {
-		const v = normalizeTrimmedString(input);
-		if (!v) return void 0;
-		return new URL(v, "http://dummy").origin === "http://dummy" ? new URL(v).origin : v;
-	} catch {
-		return normalizeTrimmedString(input) || void 0;
-	}
-}
-//#endregion
-export { toBasePath, toOriginOrUndefined };
-
-//# sourceMappingURL=normalize.js.map

package/dist/esm/plugins/vite.js

@@ -1,293 +0,0 @@
-import { toBasePath } from "./shared-ts/src/utils/normalize.js";
-import { buildPermissionsPolicy, buildWalletCsp } from "./headers.js";
-import { normalizeWalletHostVariant } from "./wallet/src/core/browser/walletIframe/hostVariant.js";
-import { addPreconnectLink, applyCoepCorpIfNeeded, buildWalletServiceHtml, echoCorsFromRequest, logRorConfig, parseConfiguredRorOrigins, resolveCoepMode, resolveRorOrigins, resolveSdkDistRoot, setContentType } from "./plugin-utils.js";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { fileURLToPath } from "node:url";
-//#region src/plugins/vite.ts
-const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
-function tryFile(...candidates) {
-	for (const file of candidates) try {
-		if (fs.statSync(file).isFile()) return file;
-	} catch {}
-}
-function walletStaticAssetCandidates(fileName) {
-	return [
-		path.resolve(MODULE_DIR, "../static/wallet-assets", fileName),
-		path.resolve(MODULE_DIR, "../sdk", fileName),
-		path.resolve(MODULE_DIR, "../../dist/esm/sdk", fileName),
-		path.resolve(MODULE_DIR, "../../public/sdk", fileName),
-		path.resolve(process.cwd(), "src/static/wallet-assets", fileName),
-		path.resolve(process.cwd(), "packages/wallet/src/static/wallet-assets", fileName)
-	];
-}
-function resolveWalletStaticAsset(fileName) {
-	const assetPath = tryFile(...walletStaticAssetCandidates(fileName));
-	if (assetPath) return assetPath;
-	throw new Error(`Missing wallet static asset source: ${fileName}`);
-}
-function copyWalletStaticAssetIfMissing(fileName, destination) {
-	if (fs.existsSync(destination)) return;
-	fs.copyFileSync(resolveWalletStaticAsset(fileName), destination);
-}
-/**
-* Seams SDK plugin: serve SDK assets under a stable base (default: /sdk) with optional COEP/CORP (strict mode) and permissive CORS.
-* Where it runs: both the app server and the wallet-iframe server.
-* - App server: lets host pages and wallet UI surfaces load SDK CSS/JS locally.
-* - Wallet server: used by /wallet-service to load the selected wallet host script and related CSS/JS.
-*/
-function seamsServeSdk(opts = {}) {
-	const configuredBase = toBasePath(opts.sdkBasePath, "/sdk");
-	const sdkDistRoot = resolveSdkDistRoot(opts.sdkDistRoot);
-	const enableDebugRoutes = opts.enableDebugRoutes === true;
-	const coepMode = resolveCoepMode(opts.coepMode);
-	const bases = Array.from(new Set([configuredBase, toBasePath("/sdk")])).sort((a, b) => b.length - a.length);
-	return {
-		name: "seams:serve-sdk",
-		apply: "serve",
-		enforce: "pre",
-		configureServer(server) {
-			if (enableDebugRoutes) server.middlewares.use("/__sdk-root", (_req, res) => {
-				res.setHeader("Content-Type", "text/plain; charset=utf-8");
-				res.setHeader("Cache-Control", "no-store, max-age=0");
-				res.end(sdkDistRoot);
-			});
-			server.middlewares.use((req, res, next) => {
-				if (!req.url) return next();
-				const url = req.url.split("?")[0];
-				const matchBase = bases.find((b) => url.startsWith(b + "/"));
-				if (!matchBase) return next();
-				const rel = url.slice((matchBase + "/").length);
-				const candidate = tryFile(path.join(sdkDistRoot, "esm", "sdk", rel), path.join(sdkDistRoot, rel), path.join(sdkDistRoot, "esm", rel));
-				if (!candidate) {
-					res.statusCode = 404;
-					res.setHeader("Content-Type", "application/json; charset=utf-8");
-					res.setHeader("Cache-Control", "no-store, max-age=0");
-					res.end(JSON.stringify({
-						error: "SDK asset not found",
-						path: rel
-					}));
-					return;
-				}
-				setContentType(res, candidate);
-				res.setHeader("Cache-Control", "no-store, max-age=0");
-				applyCoepCorpIfNeeded(res, coepMode);
-				echoCorsFromRequest(res, req, { handlePreflight: false });
-				const stream = fs.createReadStream(candidate);
-				stream.on("error", () => next());
-				stream.pipe(res);
-			});
-		}
-	};
-}
-/**
-* Dev plugin: expose the wallet service HTML route (default: /wallet-service) that links only external CSS/JS.
-* Where it runs: wallet-iframe dev server (wallet origin). Used by seamsWalletServer.
-*/
-function seamsWalletService(opts = {}) {
-	const walletServicePath = toBasePath(opts.walletServicePath, "/wallet-service");
-	const sdkBasePath = toBasePath(opts.sdkBasePath, "/sdk");
-	const walletHostVariant = normalizeWalletHostVariant(opts.walletHostVariant || process.env.VITE_WALLET_HOST_VARIANT);
-	const coepMode = resolveCoepMode(opts.coepMode);
-	return {
-		name: "seams:wallet-service",
-		apply: "serve",
-		enforce: "pre",
-		configureServer(server) {
-			server.middlewares.use((req, res, next) => {
-				if (!req.url) return next();
-				const url = req.url.split("?")[0];
-				if (url === walletServicePath || url === `${walletServicePath}/` || url === `${walletServicePath}//`) {
-					const html = buildWalletServiceHtml(sdkBasePath, String(Date.now()), walletHostVariant);
-					res.statusCode = 200;
-					res.setHeader("Content-Type", "text/html; charset=utf-8");
-					res.setHeader("Cache-Control", "no-store, max-age=0");
-					res.setHeader("Pragma", "no-cache");
-					applyCoepCorpIfNeeded(res, coepMode);
-					res.end(html);
-					return;
-				}
-				next();
-			});
-		}
-	};
-}
-/**
-* Dev plugin: serve the RP ID related-origin helper and optional strict-isolation headers.
-* Where it runs: Seams-owned local development only.
-*/
-function seamsHeaders(opts = {}) {
-	const walletOrigin = (opts.walletOrigin ?? process.env.VITE_WALLET_ORIGIN)?.trim();
-	const walletServicePath = toBasePath(opts.walletServicePath || process.env.VITE_WALLET_SERVICE_PATH, "/wallet-service");
-	const sdkBasePath = toBasePath(opts.sdkBasePath || process.env.VITE_SDK_BASE_PATH, "/sdk");
-	const coepMode = resolveCoepMode(opts.coepMode);
-	const rorOrigins = resolveRorOrigins({
-		configuredOrigins: parseConfiguredRorOrigins(String(process.env.VITE_ROR_ALLOWED_ORIGINS || "")),
-		docsOrigin: String(process.env.VITE_DOCS_ORIGIN || ""),
-		walletOrigin: walletOrigin || ""
-	});
-	logRorConfig(rorOrigins);
-	return {
-		name: "seams:dev-headers",
-		apply: "serve",
-		enforce: "pre",
-		configureServer(server) {
-			console.log("[seams] headers enabled", {
-				walletServicePath,
-				sdkBasePath,
-				coepMode,
-				rorOriginsCount: rorOrigins.length
-			});
-			server.middlewares.use((req, res, next) => {
-				const url = (req.url || "").split("?")[0] || "";
-				if (coepMode !== "off") {
-					res.setHeader("Cross-Origin-Embedder-Policy", "require-corp");
-					res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
-				}
-				addPreconnectLink(res, walletOrigin);
-				if (url === "/.well-known/webauthn" || url === "/.well-known/webauthn/") {
-					res.statusCode = 200;
-					res.setHeader("Content-Type", "application/json; charset=utf-8");
-					res.setHeader("Cache-Control", "max-age=60, stale-while-revalidate=600");
-					res.end(JSON.stringify({ origins: rorOrigins }));
-					return;
-				}
-				if (url.startsWith(`${sdkBasePath}/`)) {
-					applyCoepCorpIfNeeded(res, coepMode);
-					if (echoCorsFromRequest(res, req, {
-						honorExistingAcaOrigin: true,
-						handlePreflight: true
-					})) return;
-				}
-				next();
-			});
-		}
-	};
-}
-function createDevServerPlugin(options, includeWalletService) {
-	const sdkBasePath = toBasePath(options.sdkBasePath || process.env.VITE_SDK_BASE_PATH, "/sdk");
-	const walletServicePath = toBasePath(options.walletServicePath || process.env.VITE_WALLET_SERVICE_PATH, "/wallet-service");
-	const walletOrigin = (options.walletOrigin ?? process.env.VITE_WALLET_ORIGIN)?.trim();
-	const walletHostVariant = normalizeWalletHostVariant(options.walletHostVariant || process.env.VITE_WALLET_HOST_VARIANT);
-	const setDevHeaders = options.setDevHeaders === true;
-	const enableDebugRoutes = options.enableDebugRoutes === true;
-	const sdkDistRoot = resolveSdkDistRoot(options.sdkDistRoot);
-	const coepMode = resolveCoepMode(options.coepMode);
-	const sdkPlugin = seamsServeSdk({
-		sdkBasePath,
-		sdkDistRoot,
-		enableDebugRoutes,
-		coepMode
-	});
-	const walletPlugin = seamsWalletService({
-		walletServicePath,
-		sdkBasePath,
-		walletHostVariant,
-		coepMode
-	});
-	const headersPlugin = setDevHeaders ? seamsHeaders({
-		walletOrigin,
-		walletServicePath,
-		sdkBasePath,
-		coepMode
-	}) : void 0;
-	return {
-		name: "seams:dev",
-		apply: "serve",
-		enforce: "pre",
-		configureServer(server) {
-			sdkPlugin.configureServer?.(server);
-			if (headersPlugin) headersPlugin.configureServer?.(server);
-			if (includeWalletService) walletPlugin.configureServer?.(server);
-		}
-	};
-}
-/**
-* Build-time plugin: writes optional static-host `_headers` only for explicitly requested CORS or strict isolation.
-* Where it runs: Seams-owned static wallet host development.
-*/
-function seamsBuildHeaders(opts = {}) {
-	const walletServicePath = toBasePath(process.env.VITE_WALLET_SERVICE_PATH, "/wallet-service");
-	const sdkBasePath = toBasePath(process.env.VITE_SDK_BASE_PATH, "/sdk");
-	const walletHostVariant = normalizeWalletHostVariant(opts.walletHostVariant || process.env.VITE_WALLET_HOST_VARIANT);
-	const coepMode = resolveCoepMode(opts.coepMode);
-	let outDir = "dist";
-	return {
-		name: "seams:build-headers",
-		apply: "build",
-		enforce: "post",
-		configResolved(config) {
-			outDir = config?.build?.outDir || outDir;
-		},
-		generateBundle() {
-			try {
-				const hdrPath = path.join(outDir, "_headers");
-				if (fs.existsSync(hdrPath)) console.warn("[seams] _headers already exists in outDir; skipping auto-emission");
-				else {
-					const contentLines = [...coepMode === "off" ? [] : [
-						"/*",
-						"  Cross-Origin-Embedder-Policy: require-corp",
-						"  Cross-Origin-Resource-Policy: cross-origin",
-						""
-					]];
-					const configuredAcaOrigin = opts.cors && typeof opts.cors.accessControlAllowOrigin === "string" ? opts.cors.accessControlAllowOrigin.trim() : void 0;
-					if (configuredAcaOrigin) contentLines.push(`${sdkBasePath}/*`, `  Access-Control-Allow-Origin: ${configuredAcaOrigin}`);
-					if (contentLines.length > 0) {
-						const content = contentLines.join("\n") + "\n";
-						fs.mkdirSync(outDir, { recursive: true });
-						fs.writeFileSync(hdrPath, content, "utf-8");
-						console.log("[seams] emitted _headers" + (coepMode === "off" ? "" : " with strict isolation") + (configuredAcaOrigin ? " + CORS" : ""));
-					}
-				}
-				const sdkDir = path.join(outDir, sdkBasePath.replace(/^\//, ""));
-				try {
-					fs.mkdirSync(sdkDir, { recursive: true });
-				} catch {}
-				copyWalletStaticAssetIfMissing("wallet-shims.js", path.join(sdkDir, "wallet-shims.js"));
-				copyWalletStaticAssetIfMissing("wallet-service.css", path.join(sdkDir, "wallet-service.css"));
-				copyWalletStaticAssetIfMissing("wallet-ui.css", path.join(sdkDir, "wallet-ui.css"));
-				const walletRel = walletServicePath.replace(/^\//, "");
-				const wsDir = path.join(outDir, walletRel);
-				const wsHtml = path.join(wsDir, "index.html");
-				if (!fs.existsSync(wsHtml)) {
-					fs.mkdirSync(wsDir, { recursive: true });
-					fs.writeFileSync(wsHtml, buildWalletServiceHtml(sdkBasePath, void 0, walletHostVariant), "utf-8");
-					console.log(`[seams] emitted ${path.posix.join("/", walletRel, "index.html")} (minimal wallet service)`);
-				}
-			} catch (e) {
-				console.warn("[seams] failed to emit _headers:", e);
-			}
-		}
-	};
-}
-function computeDevPermissionsPolicy(walletOrigin) {
-	return buildPermissionsPolicy(walletOrigin);
-}
-function computeDevWalletCsp(mode = "strict") {
-	return buildWalletCsp({ mode });
-}
-function seamsWalletServer(options = {}) {
-	return createDevServerPlugin(options, true);
-}
-function seamsAppServer(options = {}) {
-	return createDevServerPlugin(options, false);
-}
-function seamsApp(options = {}) {
-	const { emitHeaders, ...devOpts } = options;
-	return [seamsAppServer(devOpts), emitHeaders ? seamsBuildHeaders({
-		coepMode: devOpts.coepMode,
-		walletHostVariant: devOpts.walletHostVariant
-	}) : void 0].filter(Boolean);
-}
-function seamsWallet(options = {}) {
-	const { emitHeaders, ...devOpts } = options;
-	return [seamsWalletServer(devOpts), emitHeaders ? seamsBuildHeaders({
-		coepMode: devOpts.coepMode,
-		walletHostVariant: devOpts.walletHostVariant
-	}) : void 0].filter(Boolean);
-}
-//#endregion
-export { computeDevPermissionsPolicy, computeDevWalletCsp, seamsApp, seamsAppServer, seamsBuildHeaders, seamsHeaders, seamsServeSdk, seamsWallet, seamsWalletServer, seamsWalletService };
-
-//# sourceMappingURL=vite.js.map

package/dist/esm/react/components/AccountMenuButton/icons/LayersIcon.js

@@ -1,8 +0,0 @@
-import { lucideIcon } from "./lucideIcon.js";
-import { Fragment, jsx, jsxs } from "react/jsx-runtime";
-//#region src/react/components/AccountMenuButton/icons/LayersIcon.tsx
-const LayersIcon = lucideIcon("layers-2", /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx("path", { d: "M13 13.74a2 2 0 0 1-2 0L2.5 8.87a1 1 0 0 1 0-1.74L11 2.26a2 2 0 0 1 2 0l8.5 4.87a1 1 0 0 1 0 1.74z" }), /* @__PURE__ */ jsx("path", { d: "m20 14.285 1.5.845a1 1 0 0 1 0 1.74L13 21.74a2 2 0 0 1-2 0l-8.5-4.87a1 1 0 0 1 0-1.74l1.5-.845" })] }));
-//#endregion
-export { LayersIcon };
-
-//# sourceMappingURL=LayersIcon.js.map

package/dist/esm/sdk/ecdsaDerivationExport-C1cE5m0t.js

@@ -1 +0,0 @@
-import{r as e}from"./domainIds-BzkGsRqO.js";import{c as t,u as n}from"./chains-C_X_fNuS.js";import{i as r,r as i}from"./base64-DW79QA0h.js";import{r as a}from"./secureRandomId-LwBFx84B.js";import{o}from"./sessionPolicy-CBTZQe1n.js";import{g as s}from"./capabilityKinds-N8xo_IEh.js";import{r as c}from"./canonicalPrimitives-Dsbsxgxc.js";import{c as l,o as u}from"./ecdsaChainTarget-DJBXHzbH.js";import{i as d,n as f}from"./signerDomain-DqLCvI-D.js";import{$ as p,C as m,J as h,Kt as g,N as _,Nt as v,Ot as y,T as b,Z as ee,en as x,h as te,tn as S,v as C}from"./emailOtpEcdsaDerivationIdentity-p0C1CQva.js";import{B as ne,C as re,E as w,I as ie,R as ae,S as oe,x as se,y as ce,z as le}from"./ecdsaCapabilityManifest-ChszYCC0.js";import{t as ue}from"./signerSlot-B4Eq8Oe2.js";import{r as T}from"./types-WGrFMQSw.js";import{o as de}from"./walletSessionAuthorizationStore-BiKGIBWQ.js";import{t as fe}from"./thresholdEcdsa-D-QMyevW.js";import{p as pe}from"./nearEd25519YaoSigningPreparation-Eiq_ikXk.js";import{a as me,i as he,r as ge}from"./walletSessionAuthorizationProjection-DuU6w0FP.js";import{a as _e,d as ve,i as ye,n as be,u as xe}from"./ecdsaDerivationClientWasm-CpH-b3jx.js";import{a as Se,r as Ce,t as we}from"./walletSessionFailure-YuhraC3P.js";import{a as E,o as D}from"./signingQueue-2pr7lAUS.js";import{t as O}from"./bytes-DZRW2UDg.js";const Te=`router-ab-ed25519-yao-seed-export-v1`;function Ee(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=e,n=typeof t.id==`string`&&t.id.trim()?t.id.trim():void 0;return t.success===!0&&`data`in t&&t.error===void 0?{id:n,success:!0,data:t.data}:t.success===!1&&typeof t.error==`string`&&t.data===void 0?{id:n,success:!1,error:t.error}:null}var k=class extends Error{constructor(e){super(`[OwnerLaneScope] ${e}`),this.name=`OwnerLaneScopeIntegrityError`}},De=class extends Error{constructor(e){super(`[OwnerLaneScope] relink_required: no active canonical wallet auth method (${e})`),this.code=`relink_required`,this.reason=`missing_canonical_owner_binding`,this.name=`OwnerRelinkRequiredError`}};function Oe(e){return e instanceof De&&e.name===`OwnerRelinkRequiredError`&&e.code===`relink_required`}function ke(e){return{walletId:e.walletId,factor:{kind:`passkey`,credentialIdB64u:e.credentialIdB64u},verifier:{kind:`webauthn`,rpId:e.rpId},bindingId:e.walletAuthMethodId}}function Ae(e){let t=String(e.providerSubjectId||``).trim();if(!t)throw new k(`active Email OTP method has no exact local factor`);let n=y({walletId:e.authMethod.walletId,factor:{kind:`email_otp`,provider:t.startsWith(`google:`)?`google`:`email`,providerUserId:t},verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:e.authMethod.emailHashHex},bindingId:e.authMethod.walletAuthMethodId});if(!n)throw new k(`active Email OTP method has no exact local factor`);return n}function je(e){let t=e.localMethods.filter(t=>t.kind===`email_otp`&&t.status===`active`&&t.walletId===e.authMethod.walletId&&t.emailHashHex===e.authMethod.emailHashHex),n=t[0],r=n?y(n.authority):null;if(t.length!==1||!r||r.walletId!==e.authMethod.walletId||r.bindingId!==e.authMethod.walletAuthMethodId||r.verifier.emailHashHex!==e.authMethod.emailHashHex)throw new k(`active Email OTP method has no exact local factor`);return r}async function A(e){let t=String(e.authMethod.walletId);try{return je({authMethod:e.authMethod,localMethods:await e.stores.listWalletAuthMethodsForWallet(t)})}catch(n){if(!e.stores.readEmailOtpProviderSubjectForWallet)throw n;let r=await e.stores.readEmailOtpProviderSubjectForWallet(t);if(!r)throw n;return Ae({authMethod:e.authMethod,providerSubjectId:r})}}function Me(e){if(e.authority.walletId!==e.authMethod.walletId||e.authority.bindingId!==e.authMethod.walletAuthMethodId)throw new k(`active wallet auth method does not have an exact factor authority binding`);return e.authority}async function Ne(e){return e.authMethod.kind===`passkey`?Me({authMethod:e.authMethod,authority:ke(e.authMethod)}):Me({authMethod:e.authMethod,authority:await A({authMethod:e.authMethod,stores:e.stores})})}function Pe(e){return{auth:{kind:`passkey`,rpId:b(e.authMethod.rpId),credentialIdB64u:e.authMethod.credentialIdB64u},signerSlot:e.signerSlot}}function Fe(e){return{auth:{kind:`passkey`,rpId:b(e.authMethod.rpId),credentialIdB64u:e.authMethod.credentialIdB64u},keyFamily:`ecdsa`}}function Ie(e){if(e.factorAuthority.walletId!==e.authMethod.walletId||e.factorAuthority.bindingId!==e.authMethod.walletAuthMethodId||e.factorAuthority.verifier.emailHashHex!==e.authMethod.emailHashHex||e.authorityRef.walletId!==e.authMethod.walletId||e.authorityRef.walletAuthMethodId!==e.authMethod.walletAuthMethodId)throw new k(`linked Email OTP authority does not match the selected V2 method`);return{auth:{kind:`email_otp`,providerSubjectId:String(e.factorAuthority.factor.providerUserId)},ownerAuthority:{walletAuthMethodId:e.authorityRef.walletAuthMethodId,authorityDigest:e.authorityRef.authorityDigest}}}async function Le(e){let t=await e.stores.getWalletPasskeyAuthenticator({walletId:String(e.authMethod.walletId),credentialId:e.authMethod.credentialIdB64u});if(!t||t.credentialId!==e.authMethod.credentialIdB64u)throw new k(`active Passkey auth method has no exact local authenticator`);let n=ue(t.signerSlot,{min:1});if(n===null)throw new k(`local authenticator signer slot is invalid`);return Pe({authMethod:e.authMethod,signerSlot:n})}async function Re(e){if(e.authMethod.kind===`passkey`)return await Le({authMethod:e.authMethod,stores:e.stores});let t=await A({authMethod:e.authMethod,stores:e.stores}),n=await v({authority:t});return{auth:{kind:`email_otp`,providerSubjectId:String(t.factor.providerUserId)},ownerAuthority:{walletAuthMethodId:n.walletAuthMethodId,authorityDigest:n.authorityDigest}}}function j(e){return e.kind===`credential_free_ecdsa_session_activation_authorization_v1`}function ze(e,t){return e.error||e.message||e.code||t}function M(e){return p({kind:`router_ab_ecdsa_post_registration_session_activation_v1`,public_capability:e.publicCapability,session_policy:{threshold_session_id:e.thresholdSessionId,wallet_session_mint_id:e.walletSessionMintId,ttl_ms:e.ttlMs,remaining_uses:e.remainingUses,runtime_policy_scope:e.runtimePolicyScope}})}function Be(e,t){let n=t.public_identity;return e.applicationBindingDigestB64u===t.context.application_binding_digest_b64u&&e.contextBinding32B64u===n.context_binding_b64u&&e.derivationClientSharePublicKey33B64u===n.derivation_client_share_public_key33_b64u&&e.relayerPublicKey33B64u===n.server_public_key33_b64u&&e.groupPublicKey33B64u===n.threshold_public_key33_b64u&&e.ethereumAddress.toLowerCase()===O(i(n.ethereum_address20_b64u))&&ce(e.publicCapability,t)}function Ve(e,t){let n=e.normal_signing.scope;return n.wallet_id===String(t.walletId)&&n.ecdsa_threshold_key_id===String(t.ecdsaThresholdKeyId)&&n.signing_root_id===String(t.signingRootId)&&n.signing_root_version===String(t.signingRootVersion)}function N(e){let t=e.persistedRoleLocalMaterial.publicFacts;if(!ce(e.sessionActivation.public_capability,e.publicCapability)||e.sessionActivation.session.threshold_session_id!==e.thresholdSessionId||!Ve(e.sessionActivation,t))throw Error(`Strict ECDSA session activation returned a different registered key identity`)}function He(t){let n=t.sessionActivation.activation,r=t.sessionActivation.authorization,i=r.record,a=x(n.public_capability.material_activation),o=0;for(let t of i.capabilitySubjects)t.kind===`sign`&&t.keyFamily===`ecdsa_secp256k1`&&e(t.materialActivation,a)&&(o+=1);if(N({publicCapability:t.publicCapability,persistedRoleLocalMaterial:t.persistedRoleLocalMaterial,thresholdSessionId:t.thresholdSessionId,sessionActivation:n}),String(i.walletId)!==t.walletId||String(i.walletId)!==String(n.public_capability.client_id)||i.authMethodId!==t.persistedRoleLocalMaterial.authority.walletAuthMethodId||i.authorizationId!==n.session.authorization_id||i.quotaId!==n.session.quota_id||i.expiresAtMs!==n.session.expires_at_ms||n.session.remaining_uses!==t.remainingUses||r.operationCredential.walletSessionId!==n.session.wallet_session_id||!e(a,t.persistedRoleLocalMaterial.materialActivation)||o!==1)throw Error(`Strict ECDSA credential-free activation authority does not match its session`)}function P(e){let t=e.persistedRoleLocalMaterial.publicFacts;if(!e.walletId||!e.thresholdSessionId)throw Error(`Strict ECDSA session activation requires exact wallet and session identity`);if(!Number.isSafeInteger(e.ttlMs)||e.ttlMs<1)throw Error(`Strict ECDSA session activation requires a positive ttlMs`);if(!Number.isSafeInteger(e.remainingUses)||e.remainingUses<1)throw Error(`Strict ECDSA session activation requires positive remainingUses`);if(String(t.walletId)!==e.walletId||!Be(t,e.publicCapability))throw Error(`Strict ECDSA session activation requires exact registered role-local material`)}function Ue(e){switch(e.kind){case`rehydrated`:return e;case`device_link_required`:throw Error(`device_link_required: registered ECDSA role-local material is unavailable on this device`);case`corrupt`:throw Error(`Registered ECDSA role-local material is corrupt (${e.reason}): ${e.message}`);default:{let t=e;throw Error(`Unsupported ECDSA role-local material resolution: ${String(t)}`)}}}async function F(e){let t=Ue(await D({purpose:`registration_activation`,source:E(e.persistedRoleLocalMaterial),workerCtx:e.workerCtx}));return{kind:`existing_ecdsa_role_local_material_activated_v1`,roleLocalMaterial:t.liveHandle,roleLocalMaterialRef:t.materialRef,publicFacts:e.persistedRoleLocalMaterial.publicFacts,publicCapability:e.publicCapability}}async function We(e){P(e);let t=await fe(e.relayerUrl,{auth:e.routeAuth,request:M(e)});if(!t.ok)throw Error(ze(t,`Strict ECDSA session activation failed`));return await I({workerCtx:e.workerCtx,publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.persistedRoleLocalMaterial,walletId:e.walletId,thresholdSessionId:e.thresholdSessionId,ttlMs:e.ttlMs,remainingUses:e.remainingUses,runtimePolicyScope:e.runtimePolicyScope,sessionActivation:t.value})}async function I(e){return P(e),N({publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.persistedRoleLocalMaterial,thresholdSessionId:e.thresholdSessionId,sessionActivation:e.sessionActivation}),{sessionActivation:e.sessionActivation,roleLocalActivation:await F(e)}}async function Ge(e){return P(e),He(e),{sessionActivation:e.sessionActivation.activation,authorization:e.sessionActivation.authorization,roleLocalActivation:await F(e)}}async function Ke(e,t){let n=o(e.lanePolicy.runtimePolicyScope);if(!n)throw Error(`Strict ECDSA session activation requires runtimePolicyScope`);let r={workerCtx:e.workerCtx,publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.existingRoleLocalMaterial,walletId:String(e.key.walletId),thresholdSessionId:e.lanePolicy.thresholdSessionId,ttlMs:e.lanePolicy.ttlMs,remainingUses:e.lanePolicy.remainingUses,runtimePolicyScope:n},s=e.sessionActivation?j(e.sessionActivation)?await Ge({...r,sessionActivation:e.sessionActivation}):await I({...r,sessionActivation:e.sessionActivation}):await We({...r,walletSessionMintId:qe(),relayerUrl:e.relayerUrl,routeAuth:e.bootstrapAuth}),c=s.sessionActivation.public_capability.public_identity,l=`authorization`in s?{thresholdSessionId:s.sessionActivation.session.threshold_session_id,authorizationSessionId:s.sessionActivation.session.authorization_session_id,authorizationId:s.sessionActivation.session.authorization_id,walletSessionId:s.sessionActivation.session.wallet_session_id,quotaId:s.sessionActivation.session.quota_id,expiresAtMs:s.sessionActivation.session.expires_at_ms,remainingUses:s.sessionActivation.session.remaining_uses,walletSession:s.authorization.record,operationCredential:s.authorization.operationCredential}:{thresholdSessionId:s.sessionActivation.session.threshold_session_id,authorizationSessionId:s.sessionActivation.session.authorization_session_id,authorizationId:s.sessionActivation.session.authorization_id,walletSessionId:s.sessionActivation.session.wallet_session_id,quotaId:s.sessionActivation.session.quota_id,expiresAtMs:s.sessionActivation.session.expires_at_ms,remainingUses:s.sessionActivation.session.remaining_uses,walletSession:s.sessionActivation.session.wallet_session,operationCredential:s.sessionActivation.session.operation_credential},u=await g({walletId:String(e.key.walletId),signingRootId:e.key.signingRootId,signingRootVersion:e.key.signingRootVersion});return{ok:!0,bootstrapKind:`strict_post_registration`,keygenSessionId:String(e.requestId||``).trim()||a(`tecdsa-keygen`,32,`threshold ECDSA session IDs`),rpId:t,keyHandle:String(e.keyHandle),clientVerifyingShareB64u:c.derivation_client_share_public_key33_b64u,thresholdEcdsaPublicKeyB64u:c.threshold_public_key33_b64u,ethereumAddress:O(i(c.ethereum_address20_b64u)),relayerKeyId:u,relayerVerifyingShareB64u:c.server_public_key33_b64u,participantIds:e.key.participantIds.map(Number),thresholdSessionId:l.thresholdSessionId,authorizationSessionId:l.authorizationSessionId,authorizationId:l.authorizationId,walletSessionId:l.walletSessionId,quotaId:l.quotaId,expiresAtMs:l.expiresAtMs,remainingUses:l.remainingUses,runtimePolicyScope:n,signingRootId:String(e.key.signingRootId),signingRootVersion:String(e.key.signingRootVersion),walletSession:l.walletSession,operationCredential:l.operationCredential,roleLocalActivation:s.roleLocalActivation,routerAbEcdsaDerivationNormalSigning:s.sessionActivation.normal_signing,secretSourceKind:`persisted_role_local`}}function qe(){let e=s(a(`wallet-session-mint`,32,`Wallet Session mint IDs`));if(!e.ok)throw Error(`Failed to create Wallet Session mint identity`);return e.value}async function Je(e){let t=e.touchIdPrompt.getRpId();if(!t)return{ok:!1,code:`invalid_args`,message:`Missing rpId for WebAuthn`};try{return await Ke(e,t)}catch(e){return{ok:!1,code:`strict_post_registration_failed`,message:e instanceof Error?e.message:String(e)}}}const L=`stale_ecdsa_key_identity`;function Ye(e){if(!e)throw Error(`Strict ECDSA session bootstrap requires Wallet Session authority`);switch(e.kind){case`opaque_wallet_session_operation_credential_v1`:return e;case`publishable_key`:throw Error(`Strict ECDSA session bootstrap requires Wallet Session authority`)}throw Error(`Strict ECDSA session bootstrap authority is invalid`)}function Xe(e){let t=String(e.code||``).trim(),n=String(e.message||``).trim().toLowerCase();return t===`stale_session_state`&&n.includes(`threshold-ecdsa bootstrap`)&&n.includes(`client verifying share`)&&n.includes(`integrated key record`)}function Ze(e){let t=String(e.message||e.code||`threshold-ecdsa bootstrap failed`).trim(),n=Xe(e)?L:String(e.code||`threshold_ecdsa_bootstrap_failed`).trim()||`threshold_ecdsa_bootstrap_failed`,r=Error(t||`threshold-ecdsa bootstrap failed`);return r.code=n,r}function Qe(e){let t=Error(e);return t.code=L,t}function $e(e){switch(e.authKind){case`email_otp`:return`email_otp`;case`passkey`:return`passkey`}return`unknown`}function et(e){switch(e.bootstrap.secretSourceKind){case`persisted_role_local`:return e.request.authKind===`email_otp`?se({authSubjectId:e.request.emailOtpWorkerSessionHandle.authSubjectId}):oe({credentialIdB64u:e.request.passkeyCredentialIdB64u,rpId:e.bootstrap.rpId})}}function R(e,t){let n=String(e||``).trim().toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(n))throw Error(`threshold-ecdsa exact activation returned invalid ${t}`);return n}function tt(e){let t=R(e.bootstrapOwnerAddress,`server owner address`);if(t!==R(e.key.thresholdOwnerAddress,`key owner address`))throw Qe(`threshold-ecdsa exact activation owner address mismatches server bootstrap result`);return t}async function nt(e,t){let n=l(String(t.key.walletId)),r=t.lanePolicy.chainTarget,i=String(t.lanePolicy.thresholdSessionId).trim();if(e.routerAbNormalSigning.mode!==`enabled`)throw Error(`Router A/B ECDSA derivation normal signing must be enabled for activation`);let a={walletId:n,chainTarget:r,targetKey:u(r),operationId:i||null,authMethod:$e(t),evmFamilyKeyFingerprint:te(t.key),keyHandle:t.keyHandle,chainTargetKey:u(r),ecdsaThresholdKeyId:String(t.key.ecdsaThresholdKeyId),thresholdSessionId:i||null,freshAuthRetrySideEffectState:`not_applicable`,hasRequestedEcdsaThresholdKeyId:!0,requestedSessionId:i||null,authKind:t.walletSessionRouteAuth?.kind||`none`,passkeyCredentialBound:t.authKind===`passkey`},o;try{o=await Je({touchIdPrompt:e.touchIdPrompt,relayerUrl:t.relayerUrl,requestId:t.requestId,workerCtx:e.workerCtx,...`preauthorizedSessionActivation`in t&&t.preauthorizedSessionActivation?{sessionActivation:t.preauthorizedSessionActivation}:{bootstrapAuth:Ye(t.walletSessionRouteAuth)},keyHandle:t.keyHandle,key:t.key,lanePolicy:t.lanePolicy,publicCapability:t.publicCapability,existingRoleLocalMaterial:t.existingRoleLocalMaterial})}catch(e){try{console.warn(`[threshold-ecdsa][bootstrap][exception]`,{...a,message:e instanceof Error?e.message:String(e)})}catch{}throw e}if(!o.ok){try{console.warn(`[threshold-ecdsa][bootstrap][failure]`,{...a,code:o.code||``,message:o.message||``})}catch{}throw Ze({code:o.code,message:o.message})}let s=String(t.key.ecdsaThresholdKeyId).trim();if(!s)throw Error(`threshold-ecdsa bootstrap returned empty ecdsaThresholdKeyId`);let c=ie(s),d=le(String(o.keyHandle||``).trim()),f=String(o.relayerKeyId||``).trim();if(!f)throw Error(`threshold-ecdsa bootstrap returned empty relayerKeyId`);let p=ne(f),m=String(o.clientVerifyingShareB64u||``).trim();if(!m)throw Error(`threshold-ecdsa bootstrap returned empty clientVerifyingShareB64u`);let h=ae(m),g=String(o.thresholdSessionId||``).trim();if(!g)throw Error(`threshold-ecdsa bootstrap returned empty thresholdSessionId`);let _=Number(o.expiresAtMs);if(!Number.isFinite(_))throw Error(`threshold-ecdsa bootstrap returned invalid expiresAtMs`);let v=Number(o.remainingUses);if(!Number.isFinite(v))throw Error(`threshold-ecdsa bootstrap returned invalid remainingUses`);let y=t.key.participantIds.map(e=>Number(e));if(!y)throw Error(`threshold-ecdsa bootstrap returned empty participantIds`);let b=tt({key:t.key,bootstrapOwnerAddress:o.ethereumAddress}),ee=re({walletId:n,chainTarget:r,keyHandle:d,ecdsaThresholdKeyId:c,signingRootId:o.signingRootId,signingRootVersion:o.signingRootVersion,applicationBindingDigestB64u:o.roleLocalActivation.publicCapability.context.application_binding_digest_b64u,clientParticipantId:1,relayerParticipantId:2,participantIds:y,contextBinding32B64u:o.roleLocalActivation.publicFacts.contextBinding32B64u,derivationClientSharePublicKey33B64u:o.roleLocalActivation.publicFacts.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:o.roleLocalActivation.publicFacts.relayerPublicKey33B64u,groupPublicKey33B64u:o.roleLocalActivation.publicFacts.groupPublicKey33B64u,ethereumAddress:o.roleLocalActivation.publicFacts.ethereumAddress,publicCapability:o.roleLocalActivation.publicCapability}),x=o.routerAbEcdsaDerivationNormalSigning,S=o.roleLocalActivation.roleLocalMaterial,C=et({request:t,bootstrap:o}),w={ok:!0,thresholdSessionId:g,authorizationSessionId:o.authorizationSessionId,authorizationId:o.authorizationId,walletSessionId:o.walletSessionId,quotaId:o.quotaId,expiresAtMs:_,remainingUses:v,runtimePolicyScope:o.runtimePolicyScope,walletSession:o.walletSession,operationCredential:o.operationCredential,clientVerifyingShareB64u:h};return{thresholdEcdsaKeyRef:{type:`threshold-ecdsa-secp256k1`,userId:n,chainTarget:r,relayerUrl:t.relayerUrl,keyHandle:d,ecdsaThresholdKeyId:c,backendBinding:{materialKind:`role_local_worker_handle`,relayerKeyId:p,clientVerifyingShareB64u:h,roleLocalMaterialHandle:S,roleLocalMaterialRef:o.roleLocalActivation.roleLocalMaterialRef,publicFacts:ee,authMethod:C},participantIds:y,thresholdEcdsaPublicKeyB64u:o.thresholdEcdsaPublicKeyB64u,ethereumAddress:b,relayerVerifyingShareB64u:o.relayerVerifyingShareB64u,routerAbEcdsaDerivationNormalSigning:x},session:w}}async function rt(e,t){return await nt(e,t)}function it(e){let t;try{t=c(e.evidenceSetDigest)}catch(e){throw Error(e instanceof Error?e.message:`ECDSA explicit export evidence digest is invalid`)}let n=Math.floor(Number(e.expiresAtMs)),r=ee(e.operation);if(r.operation_kind!==`evm.export_key`)throw Error(`ECDSA explicit export operation kind is invalid`);if(!Number.isSafeInteger(n)||n<=Date.now())throw Error(`ECDSA explicit export operation authorization expiry is invalid`);let i=at(e.unseal);return{kind:`verified_step_up`,evidenceSetDigest:t,operation:r,expiresAtMs:n,quotaUse:`none`,unseal:i}}function at(e){switch(e.kind){case`not_requested`:return{kind:`not_requested`};case`email_otp_grant`:{let t=String(e.grant||``).trim(),n=String(e.challenge_id||``).trim();if(!t||!n)throw Error(`ECDSA explicit export Email OTP unseal grant is invalid`);return{kind:`email_otp_grant`,grant:t,challenge_id:n}}default:{let t=e;throw Error(`Unsupported ECDSA explicit export unseal state: ${String(t)}`)}}}async function z(e){let t=String(e.relayerUrl||``).trim();if(!t)throw Error(`ECDSA explicit export relayer URL is required`);return{kind:`explicit_key_export_ecdsa_activation_result`,purpose:`explicit_key_export`,material:{kind:`auth_neutral_ecdsa_export_material_v1`,relayerUrl:t,persistedMaterial:e.existingRoleLocalMaterial},authorization:it(e.authorization)}}function B(e,t){let n=String(e||t||``).trim();if(!n)throw Error(`Missing relayer url (configs.network.relayer.url)`);return n}function V(e){return`key`in e&&!!e.key&&`keyHandle`in e&&!!String(e.keyHandle||``).trim()}function H(e){return V(e)?e.key.walletId:e.walletId}function U(e){return V(e)?e.lanePolicy.chainTarget:e.chainTarget}function ot(e){return e.kind===`email_otp_ecdsa_bootstrap`?{authMethod:f.emailOtp,signerSource:d.emailOtpRegistration}:{authMethod:f.passkey,signerSource:d.passkeyRegistration}}function st(e){switch(e.kind){case`passkey_preauthorized_ecdsa_bootstrap`:case`wallet_session_reconnect_ecdsa_bootstrap`:return e.authorizationAuthority;case`passkey_fresh_ecdsa_bootstrap`:case`email_otp_ecdsa_bootstrap`:return e.existingRoleLocalMaterial.authority}}function ct(e){if(!(`sessionActivation`in e.request)||!e.request.sessionActivation)return;let t=e.request.sessionActivation,n=j(t)?t.activation:t,r=j(t)?t.authorization:{record:t.session.wallet_session,operationCredential:t.session.operation_credential};me({walletId:e.walletId,authority:e.authority,walletSession:r.record,operationCredential:r.operationCredential,expectedAuthorizationId:n.session.authorization_id,expectedWalletSessionId:n.session.wallet_session_id,expectedQuotaId:n.session.quota_id,expectedExpiresAtMs:n.session.expires_at_ms}),e.request.kind===`passkey_preauthorized_ecdsa_bootstrap`&&he({expected:e.request.authorizationIdentity,walletSession:r.record})}function lt(e,t){let n=(e,n,r)=>({kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},...r,...n?{walletSessionRouteAuth:n}:{}}),r=e=>({kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u,preauthorizedSessionActivation:e.sessionActivation});switch(e.kind){case`passkey_fresh_ecdsa_bootstrap`:return n(e,e.routeAuth,{authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u});case`passkey_preauthorized_ecdsa_bootstrap`:return r(e);case`wallet_session_reconnect_ecdsa_bootstrap`:return n(e,e.routeAuth,{authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u});case`email_otp_ecdsa_bootstrap`:{let r={authKind:`email_otp`,emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle};return e.sessionActivation?{kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},...r,preauthorizedSessionActivation:e.sessionActivation}:n(e,e.routeAuth,r)}}throw Error(`[SigningEngine][ecdsa] unsupported ECDSA bootstrap request`)}function ut(e,t){return{purpose:`explicit_key_export`,relayerUrl:t,existingRoleLocalMaterial:e.existingRoleLocalMaterial,authorization:e.authorization}}function dt(e,t){return{purpose:`explicit_key_export`,relayerUrl:t,existingRoleLocalMaterial:e.existingRoleLocalMaterial,authorization:e.authorization}}async function ft(e,t){if(t.kind===`reuse_warm_ecdsa_bootstrap`)throw Error(`[SigningEngine][ecdsa] reuse_warm bootstrap must resolve an existing exact material request before activation`);let n=st(t),r=l(H(t)),i=U(t),a=B(t.relayerUrl,e.defaultRelayerUrl),o=e.getSignerWorkerContext(),s={touchIdPrompt:e.touchIdPrompt,workerCtx:o,routerAbNormalSigning:e.routerAbNormalSigning};ct({request:t,walletId:r,authority:n});let c=await rt(s,lt(t,a)),u=ot(t);return await e.persistThresholdEcdsaBootstrapForWalletTarget({walletId:r,chainTarget:i,bootstrap:c,signerAuth:u}),await t.beforeAuthorizationPersistence?.(),await ge(de,{walletId:r,authority:n,bootstrap:c}),c}async function pt(e,t){return await z(ut(t,B(t.relayerUrl,e.defaultRelayerUrl)))}async function mt(e,t){return await z(dt(t,B(t.relayerUrl,e.defaultRelayerUrl)))}async function W(e,t,n){let r=String(t),i=(e.get(r)||Promise.resolve()).catch(()=>void 0),a,o=new Promise(e=>{a=e}),s=i.then(()=>o);e.set(r,s),await i;try{return await n()}finally{a(),e.get(r)===s&&e.delete(r)}}function ht(e,t){return t.runtimeScopeBootstrap&&(e.runtimeScopeBootstrap=t.runtimeScopeBootstrap),t.operationIntent&&(e.operationIntent=t.operationIntent),typeof t.ttlMs==`number`&&(e.ttlMs=t.ttlMs),e}function G(e){return ht({kind:`email_otp_ecdsa_activation`,purpose:`transaction_signing`,walletKey:e.walletKey,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,source:e.source,relayerUrl:e.relayerUrl,sessionIdentity:e.sessionIdentity,sessionKind:e.sessionKind,sessionBudgetUses:e.sessionBudgetUses,runtimePolicy:e.runtimePolicy,emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle,emailOtpAuthContext:e.emailOtpAuthContext,...`preauthorizedSessionActivation`in e?{preauthorizedSessionActivation:e.preauthorizedSessionActivation}:{walletSessionRouteAuth:e.walletSessionRouteAuth}},e)}function K(e){if(pe(e.context)!==e.expected)throw Error(`Email OTP ${e.label} activation requires ${e.expected} retention`)}function gt(e){return K({context:e.emailOtpAuthContext,expected:`session`,label:`session bootstrap`}),G(e)}function _t(e){return K({context:e.emailOtpAuthContext,expected:`session`,label:`recovered session`}),G(e)}function vt(e){return K({context:e.emailOtpAuthContext,expected:`session`,label:`preauthorized session bootstrap`}),G(e)}function yt(e){return K({context:e.emailOtpAuthContext,expected:`single_use`,label:`per-operation reauth`}),G(e)}function bt(e){return{kind:`email_otp_ecdsa_export_activation`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}function xt(e){return{kind:`passkey_ecdsa_export_activation`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}function St(e){switch(e.kind){case`default_policy`:return;case`scoped_policy`:return e.scope}throw Error(`[SigningEngine][ecdsa] unsupported ECDSA activation policy`)}function q(e,t){t.runtimeScopeBootstrap&&(e.runtimeScopeBootstrap=t.runtimeScopeBootstrap),t.operationIntent&&(e.operationIntent=t.operationIntent);let n=St(t.runtimePolicy);return`walletId`in e&&(typeof t.ttlMs==`number`&&(e.ttlMs=t.ttlMs),n&&(e.runtimePolicyScope=n)),e}function Ct(e){switch(e.kind){case`passkey_ecdsa_activation`:return{kind:`passkey_existing_session_activation`,request:e};case`email_otp_ecdsa_activation`:return{kind:`email_otp_existing_session_activation`,request:e}}throw Error(`[SigningEngine][ecdsa] unsupported activation request`)}function wt(e){let t=String(e.webauthnAuthentication.rawId||e.webauthnAuthentication.id||``).trim();if(!t)throw Error(`[SigningEngine][ecdsa] passkey activation requires credential identity`);return t}function Tt(e){let t=Ct(e);switch(t.kind){case`passkey_existing_session_activation`:return q({kind:`passkey_fresh_ecdsa_bootstrap`,keyHandle:t.request.walletKey.keyHandle,key:C(t.request.walletKey),lanePolicy:t.request.lanePolicy,publicCapability:t.request.publicCapability,existingRoleLocalMaterial:t.request.existingRoleLocalMaterial,source:t.request.source,relayerUrl:t.request.relayerUrl,requestId:t.request.requestId,passkeyCredentialIdB64u:wt(t.request),routeAuth:t.request.walletSessionRouteAuth},t.request);case`email_otp_existing_session_activation`:{let e={kind:`email_otp_ecdsa_bootstrap`,keyHandle:t.request.walletKey.keyHandle,key:C(t.request.walletKey),lanePolicy:t.request.lanePolicy,publicCapability:t.request.publicCapability,existingRoleLocalMaterial:t.request.existingRoleLocalMaterial,source:`email_otp`,relayerUrl:t.request.relayerUrl,emailOtpWorkerSessionHandle:t.request.emailOtpWorkerSessionHandle,emailOtpAuthContext:t.request.emailOtpAuthContext};return t.request.preauthorizedSessionActivation?q({...e,sessionActivation:t.request.preauthorizedSessionActivation},t.request):q({...e,routeAuth:t.request.walletSessionRouteAuth},t.request)}}throw Error(`[SigningEngine][ecdsa] unsupported activation request`)}function Et(e){return{kind:`passkey_ecdsa_export_bootstrap`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}async function Dt(e){let t=e.bootstrap.thresholdEcdsaKeyRef.backendBinding;if(!t)throw Error(`[WarmSessionStore] threshold ECDSA bootstrap is missing its backend binding`);let n=Ot(t);if(!n)return;let r=await e.deps.persistEcdsaRoleLocalReadyRecord({record:n,storageKeyFacts:w(n)});if(!r.ok)throw Error(`[WarmSessionStore] threshold ECDSA role-local ready record persistence failed (${r.code}): ${r.message}`)}function Ot(e){switch(e.materialKind){case`role_local_ready_state_blob`:return e.ecdsaRoleLocalReadyRecord;case`role_local_worker_handle`:case`role_local_durable_public_anchor`:case`role_local_durable_sealed_ref`:case`metadata_only`:return null;default:{let t=e;throw Error(`[WarmSessionStore] unsupported threshold ECDSA backend binding: ${JSON.stringify(t)}`)}}}async function J(e,t){let n=l(H(t));return await W(e.queueByWallet,n,async()=>{let n=await ft(e.activationDeps,t);return await Dt({deps:e,bootstrap:n}),n})}async function kt(e,t){return await J(e,Tt(t))}async function At(e,t){return await pt(e.activationDeps,Et(t))}async function jt(e,t){let n={kind:`email_otp_ecdsa_export_bootstrap`,purpose:`explicit_key_export`,existingRoleLocalMaterial:t.existingRoleLocalMaterial,relayerUrl:t.relayerUrl,authorization:t.authorization};return await mt(e.activationDeps,n)}const Y=`ecdsa-derivation:role-local:product-export-confirmation:v5`,X=`ecdsa-derivation:role-local:product-export-authorization:v5`;function Mt(e){return{kind:`operation_step_up`}}function Z(e){return{authorizationKind:e.kind,authorizationId:e.evidenceSetDigest}}function Q(){let e=globalThis.crypto;if(!e||typeof e.getRandomValues!=`function`)throw Error(`crypto.getRandomValues is required for threshold ECDSA export`);return r(e.getRandomValues(new Uint8Array(32)))}async function Nt(e){let t=String(e.relayerUrl||``).trim().replace(/\/+$/g,``);if(!t)throw Error(`[SigningEngine][ecdsa-export] relayer URL is required`);if(e.authorization.kind===`wallet_session_bearer`&&!e.authorization.token.trim())throw Error(`[SigningEngine][ecdsa-export] Wallet Session operation credential is required`);let n={"Content-Type":`application/json`};e.authorization.kind===`wallet_session_bearer`&&(n.Authorization=`Bearer ${e.authorization.token}`);try{let r=await fetch(`${t}${_}`,{method:`POST`,credentials:e.authorization.kind===`legacy_cookie`?`include`:`omit`,headers:n,body:JSON.stringify({request:e.request,requestDigestB64u:e.requestDigestB64u})}),i=await r.json().catch(()=>null);if(!r.ok){let e=i&&typeof i==`object`&&!Array.isArray(i)?i:null;return{ok:!1,code:String(e?.code||`http_error`),message:String(e?.message||`HTTP ${r.status}`)}}return{ok:!0,value:h(i)}}catch(e){return{ok:!1,error:e instanceof Error?e.message:String(e)}}}async function Pt(e){return await Nt({...e,authorization:{kind:`legacy_cookie`}})}async function Ft(e){return await Nt({relayerUrl:e.relayerUrl,request:e.request,requestDigestB64u:e.requestDigestB64u,authorization:{kind:`wallet_session_bearer`,token:e.operationCredential.token}})}function It(e){let t=Math.min(e.issuedAtUnixMs+6e4,e.authorizationExpiresAtMsCeiling??1/0);if(Number.isFinite(t)&&t>e.issuedAtUnixMs)return t;throw new we({failure:Ce(Se.expired),message:`Wallet Session expired before ECDSA export authorization`})}function Lt(e){if(String(e.material.persistedMaterial.publicFacts.walletId)!==String(e.walletSessionUserId))throw Error(`[SigningEngine][ecdsa-export] explicit export wallet mismatch`)}async function $(e){return r(await n(t(e)))}function Rt(e){switch(e.kind){case`rehydrated`:return e;case`device_link_required`:throw Error(`[SigningEngine][ecdsa-export] device_link_required: local threshold ECDSA material is unavailable`);case`corrupt`:throw Error(`[SigningEngine][ecdsa-export] local threshold ECDSA material is corrupt (${e.reason}): ${e.message}`);default:{let t=e;throw Error(`Unsupported ECDSA export material resolution: ${String(t)}`)}}}async function zt(e){return Rt(await D({purpose:`explicit_key_export`,source:E(e.persistedMaterial),workerCtx:e.workerCtx}))}function Bt(e){let t=Z(e.material.operationAuthorization),n=e.material.persistedMaterial.publicFacts;return{version:X,operation:`explicit_key_export`,keyHandle:n.keyHandle,walletId:String(n.walletId),ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,relayerKeyId:n.publicCapability.signer_set.selected_server.server_id,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,contextBinding32B64u:e.contextBinding32B64u,publicIdentity:e.publicIdentity,exportRequestNonce32B64u:e.exportRequestNonce32B64u,confirmationDigest32B64u:e.confirmationDigest32B64u,issuedAtUnixMs:e.issuedAtUnixMs,expiresAtUnixMs:e.expiresAtUnixMs,authorizationKind:t.authorizationKind,authorizationId:t.authorizationId,materialActivation:S(e.material.persistedMaterial.materialActivation),participantIds:n.participantIds}}async function Vt(e,t){let n=t.persistedMaterial.publicFacts,r=S(t.persistedMaterial.materialActivation);switch(t.factorAuthorization.kind){case`passkey`:{let e=String(t.factorAuthorization.credential.rawId||t.factorAuthorization.credential.id||``).trim();if(!e)throw Error(`[SigningEngine][ecdsa-export] passkey authorization credential is missing`);if(e!==t.factorAuthorization.passkeyCredentialIdB64u)throw Error(`[SigningEngine][ecdsa-export] passkey export authorization credential mismatch`);break}case`email_otp_verified`:break;default:{let e=t.factorAuthorization;throw Error(`Unsupported ECDSA export authorization: ${String(e)}`)}}let i=Date.now(),a=It({issuedAtUnixMs:i,authorizationExpiresAtMsCeiling:t.operationAuthorization.expiresAtMs}),o={derivationClientSharePublicKey33B64u:n.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:n.relayerPublicKey33B64u,groupPublicKey33B64u:n.groupPublicKey33B64u,ethereumAddress:n.ethereumAddress},s=Q(),c=Z(t.operationAuthorization),l=await $({version:Y,walletId:String(n.walletId),ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,relayerKeyId:n.publicCapability.signer_set.selected_server.server_id,contextBinding32B64u:n.contextBinding32B64u,publicIdentity:o,authorizationKind:c.authorizationKind,authorizationId:c.authorizationId,materialActivation:r,exportRequestNonce32B64u:s,issuedAtUnixMs:i,expiresAtUnixMs:a}),u=await $(Bt({ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,contextBinding32B64u:n.contextBinding32B64u,publicIdentity:o,exportRequestNonce32B64u:s,confirmationDigest32B64u:l,issuedAtUnixMs:i,expiresAtUnixMs:a,material:t})),d=n.publicCapability,f=`ecdsa-export:${s}`,p=await _e({workerCtx:e.getSignerWorkerContext(),command:{kind:`create_router_ab_ecdsa_explicit_export_ceremony_v1`,ceremonyId:f,request:{context:d.context,lifecycle:{lifecycle_id:f,work_kind:`key_export`,primitive_request_kind:`export`,root_share_epoch:d.activation_epoch,account_id:String(n.walletId),session_id:T.thresholdEcdsaSession(f),signer_set_id:d.signer_set.signer_set_id,selected_server_id:d.signer_set.selected_server.server_id},public_identity:d.public_identity,signer_set:d.signer_set,router_id:d.router_id,client_id:d.client_id,authorization:Mt(t.operationAuthorization),authorization_id:t.operationAuthorization.evidenceSetDigest,operation:t.operationAuthorization.operation,material_activation:r,export_authorization_digest_b64u:u,export_nonce:s,expires_at_ms:a,deriver_recipient_keys:d.deriver_recipient_keys}}});if(p.kind!==`router_ab_ecdsa_explicit_export_ceremony_created_v1`)throw Error(`[SigningEngine][ecdsa-export] strict export ceremony kind mismatch`);try{let i=await Pt({relayerUrl:t.relayerUrl,request:p.request,requestDigestB64u:p.requestDigestB64u});if(!i.ok)throw Error(i.error||i.message||i.code||`Strict ECDSA explicit export request failed`);let a=await ve({workerCtx:e.getSignerWorkerContext(),command:{kind:`finalize_router_ab_ecdsa_explicit_export_v1`,ceremonyId:f,clientProofFinalization:{kind:`finalize_encrypted_client_proof_bundles_v2`,bundles:i.value.response.bundles},signingWorkerExport:i.value.signing_worker_export,authorizationKind:c.authorizationKind,authorizationId:c.authorizationId,materialActivation:r,roleLocalMaterial:t.liveMaterial.liveHandle,roleLocalMaterialRef:t.liveMaterial.materialRef,publicFacts:n}});return{publicKeyHex:a.publicKeyHex,privateKeyHex:a.privateKeyHex,ethereumAddress:a.ethereumAddress}}catch(t){throw await be({workerCtx:e.getSignerWorkerContext(),command:{kind:`close_router_ab_ecdsa_post_registration_ceremony_v1`,ceremonyId:f}}).catch(()=>void 0),t}}async function Ht(e,t){let n=t.exportProvision.material;Lt({material:n,walletSessionUserId:t.walletSessionUserId});let r=String(n.relayerUrl||``).trim();if(!r)throw Error(`[SigningEngine][ecdsa-export] relayer URL is required`);let i=n.persistedMaterial;return await Vt(e,{persistedMaterial:i,liveMaterial:await zt({persistedMaterial:i,workerCtx:e.getSignerWorkerContext()}),relayerUrl:r,operationAuthorization:t.exportProvision.authorization,factorAuthorization:t.factorAuthorization})}function Ut(t){let n=t.runtime.normalSigning.scope,r=t.operationAuthorization.operation,i=x(r.material_activation);if(r.operation_kind!==`evm.export_key`||r.wallet_id!==String(t.runtime.walletId)||r.key_handle!==t.runtime.publicFacts.keyHandle||r.relayer_key_id!==t.runtime.relayerKeyId||r.participant_ids[0]!==t.runtime.publicFacts.participantIds[0]||r.participant_ids[1]!==t.runtime.publicFacts.participantIds[1]||r.signing_worker_id!==n.signing_worker.server_id||r.normal_signing_scope.wallet_id!==n.wallet_id||r.normal_signing_scope.context.application_binding_digest_b64u!==n.context.application_binding_digest_b64u||r.normal_signing_scope.public_identity.context_binding_b64u!==n.public_identity.context_binding_b64u||r.normal_signing_scope.public_identity.threshold_public_key33_b64u!==n.public_identity.threshold_public_key33_b64u||r.normal_signing_scope.signing_worker.server_id!==n.signing_worker.server_id||!e(i,t.runtime.materialActivation)||!e(x(r.normal_signing_scope.material_activation),t.runtime.materialActivation))throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority operation identity changed`)}async function Wt(e,t){Ut(t);let n=t.runtime,r=n.normalSigning.scope;if(t.operationAuthorization.exportTopology.signer_set.selected_server.server_id!==r.signing_worker.server_id)throw Error(`[SigningEngine][ecdsa-export] active export topology changed`);let i=r.material_activation,a=Date.now(),o=It({issuedAtUnixMs:a,authorizationExpiresAtMsCeiling:t.operationAuthorization.expiresAtMs}),s={derivationClientSharePublicKey33B64u:r.public_identity.derivation_client_share_public_key33_b64u,relayerPublicKey33B64u:r.public_identity.server_public_key33_b64u,groupPublicKey33B64u:r.public_identity.threshold_public_key33_b64u,ethereumAddress:n.publicFacts.thresholdOwnerAddress},l=Q(),u=Z(t.operationAuthorization),d=await $({version:Y,walletId:String(n.walletId),ecdsaThresholdKeyId:r.ecdsa_threshold_key_id,relayerKeyId:n.relayerKeyId,contextBinding32B64u:r.public_identity.context_binding_b64u,publicIdentity:s,authorizationKind:u.authorizationKind,authorizationId:u.authorizationId,materialActivation:i,exportRequestNonce32B64u:l,issuedAtUnixMs:a,expiresAtUnixMs:o}),f=await $({version:X,operation:`explicit_key_export`,keyHandle:n.publicFacts.keyHandle,walletId:String(n.walletId),ecdsaThresholdKeyId:r.ecdsa_threshold_key_id,relayerKeyId:n.relayerKeyId,signingRootId:r.signing_root_id,signingRootVersion:r.signing_root_version,contextBinding32B64u:r.public_identity.context_binding_b64u,publicIdentity:s,exportRequestNonce32B64u:l,confirmationDigest32B64u:d,issuedAtUnixMs:a,expiresAtUnixMs:o,authorizationKind:u.authorizationKind,authorizationId:u.authorizationId,materialActivation:i,participantIds:n.publicFacts.participantIds}),p=`ecdsa-export:${l}`,m={context:r.context,lifecycle:{lifecycle_id:p,work_kind:`key_export`,primitive_request_kind:`export`,root_share_epoch:r.activation_epoch,account_id:r.wallet_id,session_id:T.thresholdEcdsaSession(p),signer_set_id:t.operationAuthorization.exportTopology.signer_set.signer_set_id,selected_server_id:t.operationAuthorization.exportTopology.signer_set.selected_server.server_id},public_identity:r.public_identity,signer_set:t.operationAuthorization.exportTopology.signer_set,router_id:t.operationAuthorization.exportTopology.router_id,client_id:String(n.walletId),authorization:Mt(t.operationAuthorization),operation:t.operationAuthorization.operation,authorization_id:c(t.operationAuthorization.evidenceSetDigest),material_activation:i,export_authorization_digest_b64u:f,export_nonce:l,expires_at_ms:o,deriver_recipient_keys:t.operationAuthorization.exportTopology.deriver_recipient_keys},h=await ye({holderHandleId:n.holderRuntime.holderHandleId,request:m,workerCtx:e.getSignerWorkerContext()});if(h.kind!==`ecdsa_holder_ordinary_export_request_created_v1`)throw Error(`[SigningEngine][ecdsa-export] active holder export request kind mismatch`);let g=await Ft({relayerUrl:t.relayerUrl,request:h.request,requestDigestB64u:h.requestDigestB64u,operationCredential:n.operationCredential});if(!g.ok)throw Error(g.error||g.message||g.code||`Active Wallet Authority ECDSA export request failed`);let _={wallet_id:r.wallet_id,key_handle:n.publicFacts.keyHandle,ecdsa_threshold_key_id:r.ecdsa_threshold_key_id,signing_root_id:r.signing_root_id,signing_root_version:r.signing_root_version,activation_epoch:r.activation_epoch,signing_worker_id:r.signing_worker.server_id,context_binding_b64u:r.public_identity.context_binding_b64u,threshold_public_key33_b64u:r.public_identity.threshold_public_key33_b64u,export_request_digest_b64u:h.requestDigestB64u,export_authorization_digest_b64u:f,export_nonce:l,authorization_kind:`verified_step_up`,authorization_id:t.operationAuthorization.evidenceSetDigest,material_activation:i,lifecycle_id:p,recipient_identity:h.request.client_id,recipient_public_key:h.request.client_ephemeral_public_key,expires_at_ms:h.request.expires_at_ms},v=await xe({holderHandleId:n.holderRuntime.holderHandleId,requestDigestB64u:h.requestDigestB64u,expectedBinding:_,forwardedResponse:g.value,workerCtx:e.getSignerWorkerContext()});return{publicKeyHex:v.publicKeyHex,privateKeyHex:v.privateKeyHex,ethereumAddress:v.ethereumAddress}}export{Ne as C,Re as S,Ee as T,j as _,yt as a,Pe as b,gt as c,kt as d,J as f,M as g,H as h,bt as i,jt as l,U as m,Ht as n,vt as o,W as p,xt as r,_t as s,Wt as t,At as u,Fe as v,Te as w,Oe as x,Ie as y};