npm - @seams/wallet - Versions diffs - 0.15.2 → 0.15.6 - Mend

@seams/wallet 0.15.2 → 0.15.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (58) hide show

package/dist/public/sdk/registration-yoF0o52H.js ADDED Viewed

@@ -0,0 +1 @@

+ import{n as e}from"./chunk-dVx5-UGu.js";import{D as t,I as n,M as r,N as i,O as a,R as o,S as s,T as c,h as l,i as u,j as d,o as f,r as p,s as m,w as h,x as g}from"./domainIds-BzkGsRqO.js";import{C as _,M as v,O as y,S as b,c as x,d as S,f as C,g as w,j as T,k as E,l as D,t as O,u as k}from"./chains-C_X_fNuS.js";import{O as ee,S as te,_ as A,b as j,c as M,k as N,v as ne,w as P,x as re,y as F}from"./primitives-CqrjmIAH.js";import{i as I,r as L}from"./base64-DW79QA0h.js";import{r as R}from"./secureRandomId-LwBFx84B.js";import{s as ie}from"./walletDbName-DtRewci9.js";import{c as ae,d as oe,f as se,l as ce,s as le,u as ue}from"./signingSessionSeal-DX41aXUL.js";import{a as de,i as fe,n as pe}from"./activeWalletSession-WdZkhtBB.js";import{d as me,g as he,h as ge,m as _e}from"./capabilityKinds-N8xo_IEh.js";import{i as ve,n as ye,r as be}from"./canonicalPrimitives-Dsbsxgxc.js";import{n as xe,o as Se,t as Ce}from"./errors-DIWY1KR9.js";import{c as we,d as Te,r as Ee,t as z}from"./accountIds-Cpvlkvbe.js";import{c as De,d as Oe,i as ke,l as Ae,n as je,r as Me,s as Ne}from"./registrationSignerPlan-CPzHavPM.js";import{a as Pe,c as Fe,i as Ie,o as Le,r as Re,s as ze}from"./ecdsaChainTarget-Bfatk3oP.js";import{c as Be,d as Ve,h as He,m as Ue,n as We,s as Ge}from"./signerDomain-Dp7BhfmZ.js";import{i as Ke,n as qe,r as Je,t as Ye}from"./singletons-BXhnsqeY.js";import{L as Xe,M as Ze,d as Qe,f as $e,p as et,u as tt}from"./accountLifecycle-CBOkr0vU.js";import{d as nt}from"./walletAuthority-CAiGuWW2.js";import{Et as rt,H as it,Jt as at,K as ot,Nt as st,Ot as ct,Pt as lt,Q as ut,St as dt,T as ft,Yt as pt,at as mt,en as ht,et as gt,gt as _t,ht as vt,jt as yt,kt as bt,nn as xt,q as St,tn as Ct,tt as wt,vt as Tt,w as Et,xt as Dt,yt as Ot}from"./emailOtpEcdsaDerivationIdentity-Bik0N8v9.js";import{D as kt,F as At,I as jt,J as Mt,K as Nt,P as Pt,S as Ft,T as It,U as Lt,X as Rt,b as zt,k as Bt,n as Vt,q as Ht,x as Ut}from"./challengeDelivery-CATQ4u6P.js";import{l as Wt}from"./digestEncoding-BX3VW9eF.js";import{r as Gt}from"./walletAuthMethodRecord-LniOQQmj.js";import{a as Kt,i as qt,r as Jt,t as Yt}from"./registrationIds-BaK3jUS6.js";import{a as Xt,c as Zt,d as Qt,f as $t,h as en,l as tn,n as nn,r as rn,u as an}from"./passkey-custody-DpTM-eNJ.js";import{A as on,B as sn,I as cn,N as ln,P as un,i as dn,j as fn}from"./ecdsaCapabilityManifest-DX6TflEz.js";import{g as pn,i as B,p as mn,s as hn}from"./sdkSentEvents-D4KtK7_I.js";import{C as gn,S as _n,b as vn,c as yn,g as bn,r as xn,u as V,v as Sn,w as Cn,x as wn,y as Tn}from"./walletCustodyEcdsaContinuity-B4fTDL10.js";import{t as En}from"./signerSlot-FJAGOhmg.js";import{c as Dn,o as On,s as kn}from"./wallet-recovery-Bfhfk52N.js";import{n as An}from"./authenticatorOptions-2_XK8aXv.js";import{X as jn,j as Mn}from"./walletOwnershipGeneration-B6HyR2rE.js";import{c as Nn,r as Pn}from"./types-hKLqDUhR.js";import{o as Fn}from"./walletSessionAuthorizationStore-DmYe-cDR.js";import{l as In,o as Ln,u as Rn}from"./helpers-B9fpZNAP.js";import{i as zn}from"./profileAccountProjection-BNVJLOt2.js";import{A as Bn,C as Vn,E as Hn,O as Un,S as Wn,T as Gn,c as Kn,d as qn,f as Jn,h as Yn,n as Xn,p as Zn,r as Qn,s as $n,t as er,x as tr,y as nr}from"./nearEd25519YaoMaterialActivation-Bo3IOTS-.js";import{A as rr,a as ir,d as ar,f as or,j as sr,o as cr,u as lr}from"./nearEd25519YaoSigningPreparation-RIfkYN0d.js";import{n as ur}from"./lanes-5kcTFbPx.js";import{t as dr}from"./walletSessionAuthorizationStatus-BL7j2TeM.js";import{n as fr}from"./prfCache-DJ93rtDv.js";import{u as pr}from"./trace-BBux0jtr.js";import{t as mr}from"./webauthnPromptCoordinator-CwJeKiYq.js";import{t as hr}from"./intentDigest-P_-CM7lS.js";import{n as gr,t as _r}from"./pendingWalletRecoveryCodeBackup-C60sZMj5.js";import{n as vr}from"./walletSessionAuthorizationProjection-DuU6w0FP.js";function yr(){return Reflect.get(globalThis,`__SEAMS_REGISTRATION_BENCHMARK_DIAGNOSTICS`)===!0}function br(){}function xr(e){if(e.keySet!==`near_ed25519_v1`)throw Error(`The custody worker began an EVM run for a NEAR request`);return e}function Sr(e){if(e.keySet!==`evm_family_ecdsa_v1`)throw Error(`The custody worker began a NEAR run for an EVM request`);return e}function Cr(e){if(e.keySet!==`evm_family_ecdsa_v1`)throw Error(`The custody worker completed a NEAR run for an EVM request`);return e}function wr(e){switch(e.origin){case`establish`:case`establish_factor_after_round`:return{origin:`establish`,walletId:e.walletId};case`join`:return{origin:`join`,custodyJson:e.custodyJson,factorSecret:e.factorSecret};case`recover`:return{origin:`recover`,custodyJson:e.custodyJson,recoveryCode:e.recoveryCode};case`recover_and_reseal`:return{origin:`recover_and_reseal`,custodyJson:e.custodyJson,recoveryCode:e.recoveryCode,replacementFactorJson:e.replacementFactorJson,replacementFactorSecret:e.replacementFactorSecret};default:return Er(e)}}async function Tr(e){switch(e.origin){case`establish`:return{kind:`establish`,factorJson:e.factorJson,factorSecret:e.factorSecret,recoveryCodesJson:e.recoveryCodesJson};case`establish_factor_after_round`:{let t=await e.factor();return{kind:`establish`,factorJson:t.factorJson,factorSecret:t.factorSecret,recoveryCodesJson:e.recoveryCodesJson}}case`join`:case`recover`:return{kind:`existing`};case`recover_and_reseal`:return{kind:`recover_reseal`,replacementFactorJson:e.replacementFactorJson,replacementFactorSecret:e.replacementFactorSecret};default:return Er(e)}}function Er(e){throw Error(`Unsupported wallet custody origin: ${String(e)}`)}function Dr(e,t){if(e.walletId!==t.activation.walletId)throw Error(`EVM custody activation changed the wallet identity`);if(e.keyManifestDigestB64u!==t.activation.keyManifestDigestB64u)throw Error(`EVM custody activation changed the key manifest digest`);if(e.clientRootPublicKey33B64u!==t.activation.clientRootPublicKey33B64u)throw Error(`EVM custody activation changed the client root public key`)}function Or(e,t,n){if(yr())try{console.info(`[WalletCustody] timing `+JSON.stringify({event:`wallet_custody_timing`,ceremonyId:e,stage:`custody.${t}`,durationMs:Math.round((performance.now()-n)*10)/10,outcome:`success`}))}catch{}}async function kr(e){let t=e.ceremonyId||R(`wallet-custody-ceremony`,32,`wallet custody ceremony IDs`),{custody:n,keySetRun:r}=e,i=!1;try{if(r.keySet===`near_ed25519_v1`){let a=performance.now(),o;if(r.checkpointJson!==void 0){if(n.origin!==`join`)throw Error(`Checkpoint restoration requires existing custody`);o=(await e.runStep(`restoreNearRegistration`,{ceremonyId:t,custodyJson:n.custodyJson,factorSecret:n.factorSecret,checkpointJson:r.checkpointJson})).yaoExecuteRequestJson}else o=xr(await e.runStep(`beginWalletCustodyKeySetRun`,{ceremonyId:t,keySet:`near_ed25519_v1`,custody:wr(n),protocolInputsJson:r.protocolInputsJson})).yaoExecuteRequestJson;if(Or(t,`begin`,a),i=!0,r.beforeRouterRound){a=performance.now();let n=await e.runStep(`checkpointNearRegistration`,{ceremonyId:t});Or(t,`checkpoint`,a),await r.beforeRouterRound(n.checkpointJson)}a=performance.now();let s=await r.runRouterRound(o);Or(t,`router_round`,a),a=performance.now(),await e.runStep(`completeWalletCustodyKeySetRun`,{ceremonyId:t,keySet:`near_ed25519_v1`,protocolResultJson:s,nearEd25519SigningKeyId:r.nearEd25519SigningKeyId,recordedKeyManifestDigestB64u:e.recordedKeyManifestDigestB64u}),Or(t,`complete`,a),await r.afterRouterRoundCompleted?.(s),a=performance.now();let c=await e.runStep(`finishWalletCustodyKeySetRun`,{ceremonyId:t,finish:await Tr(n)});return Or(t,`finish`,a),c}if(n.origin===`establish_factor_after_round`)throw Error(`An EVM custody run seals under its factor before the relayer round`);let a=await e.runStep(`beginWalletCustodyKeySetRun`,{ceremonyId:t,keySet:`evm_family_ecdsa_v1`,custody:n,protocolInputsJson:r.protocolInputsJson,evmFamilySigningKeySlotId:r.evmFamilySigningKeySlotId,recordedKeyManifestDigestB64u:e.recordedKeyManifestDigestB64u});i=!0;let o=Sr(a);await r.beforeRelayerRound();let s=await r.runRelayerRound({contextBinding32B64u:o.ecdsaContextBinding32B64u,clientSharePublicKey33B64u:o.ecdsaClientSharePublicKey33B64u,clientShareRetryCounter:o.ecdsaClientShareRetryCounter,preActivationCommitPayload:o.preActivationCommitPayload}),c=Cr(await e.runStep(`completeWalletCustodyKeySetRun`,{ceremonyId:t,keySet:`evm_family_ecdsa_v1`,protocolResultJson:s}));return Dr(o.preActivationCommitPayload,c),{...o.preActivationCommitPayload,clientRootPublicKey33B64u:c.activation.clientRootPublicKey33B64u,ecdsaReadyStateBlobB64u:c.activation.ecdsaReadyStateBlobB64u,ecdsaPublicFacts:c.activation.ecdsaPublicFacts}}catch(n){throw i&&await e.runStep(`discardWalletCustodyCeremony`,{ceremonyId:t}).catch(br),n}}const Ar=[1,2];function jr(e){let t=[],n=new Set;for(let r of e){let e=O(r.network);if(e!==`evm`&&e!==`tempo`)continue;let i=Ie(r),a=Le(i);n.has(a)||(n.add(a),t.push({chainTarget:i}))}return t}function Mr(e){let t=[],n=new Set;for(let r of e.chains){let i=O(r.network);if(i!==`evm`&&i!==`tempo`||!(i===`tempo`?e.signerOptions.tempo:e.signerOptions.evm).enabled)continue;let a=Ie(r),o=Le(a);n.has(o)||(n.add(o),t.push({chainTarget:a}))}return t}function Nr(e){for(let t of e.signers)if(t.kind===`near_ed25519`)return!0;return!1}function Pr(e){let t={kind:`near_ed25519`,accountProvisioning:e.accountProvisioning??ke(),signerSlot:1,participantIds:[...te],derivationVersion:1},n=e.ecdsaChainTargets??Mr({signerOptions:e.options.signerOptions??e.configs.signing.thresholdEcdsa.provisioningDefaults,chains:e.configs.network.chains}).map(e=>e.chainTarget);return n.length?{kind:`signer_set`,signers:[t,{kind:`evm_family_ecdsa`,chainTargets:[...n],participantIds:[...Ar]}]}:{kind:`signer_set`,signers:[t]}}function Fr(e){let t=we(e);if(!t.ok)throw Error(t.message);return Oe(t.value)}function Ir(e){let t=String(e.walletId||``).trim(),n=String(e.relayerAccountId||``).trim();if(!t)throw Error(`Relayer named NEAR registration requires walletId`);if(!n)throw Error(`Relayer named NEAR registration requires relayer accountId`);return Fr(`${t}.${n}`)}function Lr(e){let t=e.preference??e.configs.registration.nearAccountProvisioning;switch(t.kind){case`implicit_account`:return ke();case`relayer_named_subaccount`:if(e.wallet.kind!==`provided`)throw Error(`Relayer named NEAR registration requires a provided walletId`);return Ir({walletId:e.wallet.walletId,relayerAccountId:e.configs.network.relayer.accountId});default:return t}}function Rr(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<1)throw Error(`${t} must be a positive integer`);return e}function zr(e,t){let n=s(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function Br(e,t){if(!Array.isArray(e)||e.length!==32)throw Error(`${t} must contain exactly 32 bytes`);let n=[];for(let r of e){if(typeof r!=`number`||!Number.isInteger(r)||r<0||r>255)throw Error(`${t} must contain exactly 32 bytes`);n.push(r)}return Object.freeze(n)}function Vr(e,t){if(!Array.isArray(e)||e.length===0)throw Error(`${t} must contain bytes`);return e.map(e=>{if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`${t} must contain bytes`);return e})}function Hr(e){if(!Array.isArray(e)||e.length!==2||!Number.isSafeInteger(e[0])||!Number.isSafeInteger(e[1])||e[0]<1||e[1]<1||e[0]===e[1])throw Error(`participantIds must contain two distinct positive integers`);return[Number(e[0]),Number(e[1])]}function Ur(e){let t=E(e,`capability.registrationContinuity`);if(t.kind===`recovery`)return{kind:`recovery`,activationTranscript:Vr(t.activationTranscript,`capability.registrationContinuity.activationTranscript`)};if(t.kind!==`registration`)throw Error(`capability.registrationContinuity kind is invalid`);let n=Nt(t.admissionRequest),r=Lt(t.admissionReceipt);if(!n.ok)throw Error(`capability registration continuity transcript is invalid: ${n.message}`);if(!r.ok)throw Error(`capability registration continuity transcript is invalid: ${r.message}`);return{kind:`registration`,admissionRequest:n.value,admissionReceipt:r.value,activationTranscript:Vr(t.activationTranscript,`capability.registrationContinuity.activationTranscript`)}}function Wr(e){let t=E(e,`capability`);if(t.kind!==`router_ab_ed25519_yao_active_capability_v1`)throw Error(`Yao recovery capability kind is invalid`);let n=E(t.applicationBinding,`capability.applicationBinding`),r=E(t.lifecycle,`capability.lifecycle`),i;try{i=ht(t.materialActivation)}catch(e){throw Error(`capability.materialActivation is invalid: ${e instanceof Error?e.message:String(e)}`)}return{materialActivation:i,activeCapabilityBinding:Br(t.activeCapabilityBinding,`capability.activeCapabilityBinding`),registeredPublicKey:Br(t.registeredPublicKey,`capability.registeredPublicKey`),nearAccountId:z(T(t.nearAccountId,`capability.nearAccountId`)),applicationBinding:{wallet_id:T(n.wallet_id,`applicationBinding.wallet_id`),near_ed25519_signing_key_id:T(n.near_ed25519_signing_key_id,`applicationBinding.near_ed25519_signing_key_id`),signing_root_id:T(n.signing_root_id,`applicationBinding.signing_root_id`),key_creation_signer_slot:Rr(n.key_creation_signer_slot,`applicationBinding.key_creation_signer_slot`)},participantIds:Hr(t.participantIds),runtimePolicyScope:F(E(t.runtimePolicyScope,`capability.runtimePolicyScope`)),lifecycle:{lifecycleId:T(r.lifecycleId,`lifecycle.lifecycleId`),rootShareEpoch:T(r.rootShareEpoch,`lifecycle.rootShareEpoch`),accountId:T(r.accountId,`lifecycle.accountId`),thresholdSessionId:zr(T(r.thresholdSessionId,`lifecycle.thresholdSessionId`),`lifecycle.thresholdSessionId`),signerSetId:T(r.signerSetId,`lifecycle.signerSetId`),signingWorkerId:T(r.signingWorkerId,`lifecycle.signingWorkerId`)},stateEpoch:Rr(t.stateEpoch,`capability.stateEpoch`),registrationContinuity:Ur(t.registrationContinuity)}}var Gr=class e{static __wrap(t){let n=Object.create(e.prototype);return n.__wbg_ptr=t,ni.register(n,n.__wbg_ptr,n),n}__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,ni.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmactivatedclientv1_free(e,0)}create_signing_share(e,t,n,r,i){let a=H(n,K.__wbindgen_malloc),o=G,s=U(r,K.__wbindgen_malloc,K.__wbindgen_realloc),c=G,l=H(i,K.__wbindgen_malloc),u=G,d=K.wasmactivatedclientv1_create_signing_share(this.__wbg_ptr,e,t,a,o,s,c,l,u);if(d[2])throw W(d[1]);return Kr.__wrap(d[0])}static import_linked_material(t,n,r,i){let a=H(t,K.__wbindgen_malloc),o=G,s=U(i,K.__wbindgen_malloc,K.__wbindgen_realloc),c=G,l=K.wasmactivatedclientv1_import_linked_material(a,o,n,r,s,c);if(l[2])throw W(l[1]);return e.__wrap(l[0])}static import_local_material(t,n,r,i,a,o,s,c,l){let u=H(t,K.__wbindgen_malloc),d=G,f=H(n,K.__wbindgen_malloc),p=G,m=H(r,K.__wbindgen_malloc),h=G,g=H(i,K.__wbindgen_malloc),_=G,v=H(a,K.__wbindgen_malloc),y=G,b=H(l,K.__wbindgen_malloc),x=G,S=K.wasmactivatedclientv1_import_local_material(u,d,f,p,m,h,g,_,v,y,o,s,c,b,x);if(S[2])throw W(S[1]);return e.__wrap(S[0])}registered_public_key(){let e=K.wasmactivatedclientv1_registered_public_key(this.__wbg_ptr);var t=mi(e[0],e[1]).slice();return K.__wbindgen_free(e[0],e[1]*1,1),t}seal_local_material(e,t,n){let r=H(e,K.__wbindgen_malloc),i=G,a=H(t,K.__wbindgen_malloc),o=G,s=H(n,K.__wbindgen_malloc),c=G,l=K.wasmactivatedclientv1_seal_local_material(this.__wbg_ptr,r,i,a,o,s,c);if(l[3])throw W(l[2]);var u=mi(l[0],l[1]).slice();return K.__wbindgen_free(l[0],l[1]*1,1),u}state_epoch(){let e=K.wasmactivatedclientv1_state_epoch(this.__wbg_ptr);return BigInt.asUintN(64,e)}};Symbol.dispose&&(Gr.prototype[Symbol.dispose]=Gr.prototype.free);var Kr=class e{static __wrap(t){let n=Object.create(e.prototype);return n.__wbg_ptr=t,ri.register(n,n.__wbg_ptr,n),n}__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,ri.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmclientsigningsharev1_free(e,0)}client_commitments_json(){let e,t;try{let n=K.wasmclientsigningsharev1_client_commitments_json(this.__wbg_ptr);return e=n[0],t=n[1],_i(n[0],n[1])}finally{K.__wbindgen_free(e,t,1)}}client_signature_share_b64u(){let e,t;try{let n=K.wasmclientsigningsharev1_client_signature_share_b64u(this.__wbg_ptr);return e=n[0],t=n[1],_i(n[0],n[1])}finally{K.__wbindgen_free(e,t,1)}}client_verifying_share(){let e=K.wasmclientsigningsharev1_client_verifying_share(this.__wbg_ptr);var t=mi(e[0],e[1]).slice();return K.__wbindgen_free(e[0],e[1]*1,1),t}};Symbol.dispose&&(Kr.prototype[Symbol.dispose]=Kr.prototype.free);var qr=class{__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,ii.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmed25519yaoclientrootexportsessionv1_free(e,0)}complete(e){let t=U(e,K.__wbindgen_malloc,K.__wbindgen_realloc),n=G,r=K.wasmed25519yaoclientrootexportsessionv1_complete(this.__wbg_ptr,t,n);if(r[2])throw W(r[1]);return Zr.__wrap(r[0])}execute_request_json(){let e,t;try{let n=K.wasmed25519yaoclientrootexportsessionv1_execute_request_json(this.__wbg_ptr);return e=n[0],t=n[1],_i(n[0],n[1])}finally{K.__wbindgen_free(e,t,1)}}constructor(e,t,n,r,i,a,o,s,c,l,u,d,f){let p=U(e,K.__wbindgen_malloc,K.__wbindgen_realloc),m=G,h=U(t,K.__wbindgen_malloc,K.__wbindgen_realloc),g=G,_=H(i,K.__wbindgen_malloc),v=G,y=U(a,K.__wbindgen_malloc,K.__wbindgen_realloc),b=G,x=H(o,K.__wbindgen_malloc),S=G,C=H(s,K.__wbindgen_malloc),w=G,T=H(c,K.__wbindgen_malloc),E=G,D=H(l,K.__wbindgen_malloc),O=G,k=H(u,K.__wbindgen_malloc),ee=G,te=H(d,K.__wbindgen_malloc),A=G,j=H(f,K.__wbindgen_malloc),M=G,N=K.wasmed25519yaoclientrootexportsessionv1_new(p,m,h,g,n,r,_,v,y,b,x,S,C,w,T,E,D,O,k,ee,te,A,j,M);if(N[2])throw W(N[1]);return this.__wbg_ptr=N[0],ii.register(this,this.__wbg_ptr,this),this}};Symbol.dispose&&(qr.prototype[Symbol.dispose]=qr.prototype.free);var Jr=class{__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,ai.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmed25519yaolaneclientv1_free(e,0)}complete(e){let t=K.wasmed25519yaolaneclientv1_complete(this.__wbg_ptr,e);if(t[2])throw W(t[1]);return W(t[0])}execute_request_json(){let e,t;try{let i=K.wasmed25519yaolaneclientv1_execute_request_json(this.__wbg_ptr);var n=i[0],r=i[1];if(i[3])throw n=0,r=0,W(i[2]);return e=n,t=r,_i(n,r)}finally{K.__wbindgen_free(e,t,1)}}constructor(){return this.__wbg_ptr=K.wasmed25519yaolaneclientv1_new(),ai.register(this,this.__wbg_ptr,this),this}prepare(e,t,n,r,i,a,o,s,c,l){fi(a,Yr);let u=H(o,K.__wbindgen_malloc),d=G,f=H(s,K.__wbindgen_malloc),p=G,m=H(c,K.__wbindgen_malloc),h=G,g=H(l,K.__wbindgen_malloc),_=G,v=K.wasmed25519yaolaneclientv1_prepare(this.__wbg_ptr,e,t,n,r,i,a.__wbg_ptr,u,d,f,p,m,h,g,_);if(v[2])throw W(v[1]);return W(v[0])}};Symbol.dispose&&(Jr.prototype[Symbol.dispose]=Jr.prototype.free);var Yr=class e{static __wrap(t){let n=Object.create(e.prototype);return n.__wbg_ptr=t,oi.register(n,n.__wbg_ptr,n),n}__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,oi.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmed25519yaolanesourcev1_free(e,0)}constructor(e,t,n,r,i,a){let o=H(e,K.__wbindgen_malloc),s=G,c=U(t,K.__wbindgen_malloc,K.__wbindgen_realloc),l=G,u=H(n,K.__wbindgen_malloc),d=G,f=H(r,K.__wbindgen_malloc),p=G,m=H(i,K.__wbindgen_malloc),h=G,g=H(a,K.__wbindgen_malloc),_=G,v=K.wasmed25519yaolanesourcev1_new(o,s,c,l,u,d,f,p,m,h,g,_);if(v[2])throw W(v[1]);return this.__wbg_ptr=v[0],oi.register(this,this.__wbg_ptr,this),this}};Symbol.dispose&&(Yr.prototype[Symbol.dispose]=Yr.prototype.free);var Xr=class{__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,si.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmed25519yaosourcepreservingregistrationsessionv1_free(e,0)}constructor(e,t,n,r,i,a,o,s,c){fi(i,Yr);let l=H(a,K.__wbindgen_malloc),u=G,d=H(o,K.__wbindgen_malloc),f=G,p=H(s,K.__wbindgen_malloc),m=G,h=H(c,K.__wbindgen_malloc),g=G,_=K.wasmed25519yaosourcepreservingregistrationsessionv1_new(e,t,n,r,i.__wbg_ptr,l,u,d,f,p,m,h,g);if(_[2])throw W(_[1]);return this.__wbg_ptr=_[0],si.register(this,this.__wbg_ptr,this),this}take_execute_request_json(){let e,t;try{let i=K.wasmed25519yaosourcepreservingregistrationsessionv1_take_execute_request_json(this.__wbg_ptr);var n=i[0],r=i[1];if(i[3])throw n=0,r=0,W(i[2]);return e=n,t=r,_i(n,r)}finally{K.__wbindgen_free(e,t,1)}}};Symbol.dispose&&(Xr.prototype[Symbol.dispose]=Xr.prototype.free);var Zr=class e{static __wrap(t){let n=Object.create(e.prototype);return n.__wbg_ptr=t,ci.register(n,n.__wbg_ptr,n),n}__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,ci.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmexporteded25519seedv1_free(e,0)}take_export_artifact_json(){let e,t;try{let i=K.wasmexporteded25519seedv1_take_export_artifact_json(this.__wbg_ptr);var n=i[0],r=i[1];if(i[3])throw n=0,r=0,W(i[2]);return e=n,t=r,_i(n,r)}finally{K.__wbindgen_free(e,t,1)}}};Symbol.dispose&&(Zr.prototype[Symbol.dispose]=Zr.prototype.free);var Qr=class{__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,li.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmordinaryed25519activationclientmaterialv1_free(e,0)}destroy(){K.wasmordinaryed25519activationclientmaterialv1_destroy(this.__wbg_ptr)}constructor(e,t,n,r,i,a){let o=U(e,K.__wbindgen_malloc,K.__wbindgen_realloc),s=G,c=U(t,K.__wbindgen_malloc,K.__wbindgen_realloc),l=G,u=U(n,K.__wbindgen_malloc,K.__wbindgen_realloc),d=G,f=H(r,K.__wbindgen_malloc),p=G,m=U(i,K.__wbindgen_malloc,K.__wbindgen_realloc),h=G,g=U(a,K.__wbindgen_malloc,K.__wbindgen_realloc),_=G,v=K.wasmordinaryed25519activationclientmaterialv1_new(o,s,c,l,u,d,f,p,m,h,g,_);if(v[2])throw W(v[1]);return this.__wbg_ptr=v[0],li.register(this,this.__wbg_ptr,this),this}take_client_material(){let e=K.wasmordinaryed25519activationclientmaterialv1_take_client_material(this.__wbg_ptr);if(e[3])throw W(e[2]);var t=mi(e[0],e[1]).slice();return K.__wbindgen_free(e[0],e[1]*1,1),t}};Symbol.dispose&&(Qr.prototype[Symbol.dispose]=Qr.prototype.free);var $r=class{__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,ui.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmwalletcustodyseedexportsessionv1_free(e,0)}complete(e){let t=U(e,K.__wbindgen_malloc,K.__wbindgen_realloc),n=G,r=K.wasmwalletcustodyseedexportsessionv1_complete(this.__wbg_ptr,t,n);if(r[2])throw W(r[1]);return Zr.__wrap(r[0])}execute_request_json(){let e,t;try{let n=K.wasmwalletcustodyseedexportsessionv1_execute_request_json(this.__wbg_ptr);return e=n[0],t=n[1],_i(n[0],n[1])}finally{K.__wbindgen_free(e,t,1)}}constructor(e,t,n,r,i,a,o,s,c,l,u,d,f){let p=U(e,K.__wbindgen_malloc,K.__wbindgen_realloc),m=G,h=U(t,K.__wbindgen_malloc,K.__wbindgen_realloc),g=G,_=H(i,K.__wbindgen_malloc),v=G,y=U(a,K.__wbindgen_malloc,K.__wbindgen_realloc),b=G,x=H(o,K.__wbindgen_malloc),S=G,C=H(s,K.__wbindgen_malloc),w=G,T=H(c,K.__wbindgen_malloc),E=G,D=H(l,K.__wbindgen_malloc),O=G,k=H(u,K.__wbindgen_malloc),ee=G,te=H(d,K.__wbindgen_malloc),A=G,j=H(f,K.__wbindgen_malloc),M=G,N=K.wasmwalletcustodyseedexportsessionv1_new(p,m,h,g,n,r,_,v,y,b,x,S,C,w,T,E,D,O,k,ee,te,A,j,M);if(N[2])throw W(N[1]);return this.__wbg_ptr=N[0],ui.register(this,this.__wbg_ptr,this),this}};Symbol.dispose&&($r.prototype[Symbol.dispose]=$r.prototype.free);function ei(e,t,n,r,i,a,o,s,c,l,u,d,f,p){let m=H(e,K.__wbindgen_malloc),h=G,g=U(t,K.__wbindgen_malloc,K.__wbindgen_realloc),_=G,v=H(n,K.__wbindgen_malloc),y=G,b=H(r,K.__wbindgen_malloc),x=G,S=H(i,K.__wbindgen_malloc),C=G,w=H(a,K.__wbindgen_malloc),T=G,E=H(o,K.__wbindgen_malloc),D=G,O=H(s,K.__wbindgen_malloc),k=G,ee=H(d,K.__wbindgen_malloc),te=G,A=H(f,K.__wbindgen_malloc),j=G,M=H(p,K.__wbindgen_malloc),N=G,ne=K.openWalletCustodyEd25519MaterialV1(m,h,g,_,v,y,b,x,S,C,w,T,E,D,O,k,c,l,u,ee,te,A,j,M,N);if(ne[2])throw W(ne[1]);return Gr.__wrap(ne[0])}function ti(){let e={__proto__:null,__wbg_Error_92b29b0548f8b746:function(e,t){return Error(_i(e,t))},__wbg_Number_9a4e0ecb0fa16705:function(e){return Number(e)},__wbg_String_8564e559799eccda:function(e,t){let n=U(String(t),K.__wbindgen_malloc,K.__wbindgen_realloc),r=G;gi().setInt32(e+4,r,!0),gi().setInt32(e+0,n,!0)},__wbg___wbindgen_bigint_get_as_i64_d968e41184ae354f:function(e,t){let n=t,r=typeof n==`bigint`?n:void 0;gi().setBigInt64(e+8,xi(r)?BigInt(0):r,!0),gi().setInt32(e+0,!xi(r),!0)},__wbg___wbindgen_boolean_get_fa956cfa2d1bd751:function(e){let t=e,n=typeof t==`boolean`?t:void 0;return xi(n)?16777215:n?1:0},__wbg___wbindgen_debug_string_c25d447a39f5578f:function(e,t){let n=U(pi(t),K.__wbindgen_malloc,K.__wbindgen_realloc),r=G;gi().setInt32(e+4,r,!0),gi().setInt32(e+0,n,!0)},__wbg___wbindgen_in_aca499c5de7ff5e5:function(e,t){return e in t},__wbg___wbindgen_is_bigint_2f76dc55065b4273:function(e){return typeof e==`bigint`},__wbg___wbindgen_is_function_1ff95bcc5517c252:function(e){return typeof e==`function`},__wbg___wbindgen_is_object_a27215656b807791:function(e){let t=e;return typeof t==`object`&&!!t},__wbg___wbindgen_is_string_ea5e6cc2e4141dfe:function(e){return typeof e==`string`},__wbg___wbindgen_is_undefined_c05833b95a3cf397:function(e){return e===void 0},__wbg___wbindgen_jsval_eq_e659fcf7b0e32763:function(e,t){return e===t},__wbg___wbindgen_jsval_loose_eq_db4c3b15f63fc170:function(e,t){return e==t},__wbg___wbindgen_number_get_394265ed1e1b84ee:function(e,t){let n=t,r=typeof n==`number`?n:void 0;gi().setFloat64(e+8,xi(r)?0:r,!0),gi().setInt32(e+0,!xi(r),!0)},__wbg___wbindgen_string_get_b0ca35b86a603356:function(e,t){let n=t,r=typeof n==`string`?n:void 0;var i=xi(r)?0:U(r,K.__wbindgen_malloc,K.__wbindgen_realloc),a=G;gi().setInt32(e+4,a,!0),gi().setInt32(e+0,i,!0)},__wbg___wbindgen_throw_344f42d3211c4765:function(e,t){throw Error(_i(e,t))},__wbg_call_8a2dd23819f8a60a:function(){return bi(function(e,t){return e.call(t)},arguments)},__wbg_call_a6e5c5dce5018821:function(){return bi(function(e,t,n){return e.call(t,n)},arguments)},__wbg_crypto_38df2bab126b63dc:function(e){return e.crypto},__wbg_done_89b2b13e91a60321:function(e){return e.done},__wbg_entries_015dc610cd81ede0:function(e){return Object.entries(e)},__wbg_getRandomValues_c44a50d8cfdaebeb:function(){return bi(function(e,t){e.getRandomValues(t)},arguments)},__wbg_get_507a50627bffa49b:function(e,t){return e[t>>>0]},__wbg_get_78f252d074a84d0b:function(){return bi(function(e,t){return Reflect.get(e,t)},arguments)},__wbg_get_c7eb1f358a7654df:function(){return bi(function(e,t){return Reflect.get(e,t)},arguments)},__wbg_get_unchecked_6e0ad6d2a41b06f6:function(e,t){return e[t>>>0]},__wbg_get_with_ref_key_6412cf3094599694:function(e,t){return e[t]},__wbg_instanceof_ArrayBuffer_4480b9e0068a8adb:function(e){let t;try{t=e instanceof ArrayBuffer}catch{t=!1}return t},__wbg_instanceof_Map_e5b5e3db98422fcc:function(e){let t;try{t=e instanceof Map}catch{t=!1}return t},__wbg_instanceof_Uint8Array_309b927aaf7a3fc7:function(e){let t;try{t=e instanceof Uint8Array}catch{t=!1}return t},__wbg_isArray_0677c962b281d01a:function(e){return Array.isArray(e)},__wbg_isSafeInteger_04f36e4056f1b851:function(e){return Number.isSafeInteger(e)},__wbg_iterator_6f722e4a93058b71:function(){return Symbol.iterator},__wbg_length_1f0964f4a5e2c6d8:function(e){return e.length},__wbg_length_370319915dc99107:function(e){return e.length},__wbg_msCrypto_bd5a034af96bcba6:function(e){return e.msCrypto},__wbg_new_cd45aabdf6073e84:function(e){return new Uint8Array(e)},__wbg_new_da52cf8fe3429cb2:function(){return{}},__wbg_new_with_length_e6785c33c8e4cce8:function(e){return new Uint8Array(e>>>0)},__wbg_next_6dbf2c0ac8cde20f:function(e){return e.next},__wbg_next_71f2aa1cb3d1e37e:function(){return bi(function(e){return e.next()},arguments)},__wbg_node_84ea875411254db1:function(e){return e.node},__wbg_process_44c7a14e11e9f69e:function(e){return e.process},__wbg_prototypesetcall_4770620bbe4688a0:function(e,t,n){Uint8Array.prototype.set.call(mi(e,t),n)},__wbg_randomFillSync_6c25eac9869eb53c:function(){return bi(function(e,t){e.randomFillSync(t)},arguments)},__wbg_require_b4edbdcf3e2a1ef0:function(){return bi(function(){return module.require},arguments)},__wbg_set_6be42768c690e380:function(e,t,n){e[t]=n},__wbg_set_8535240470bf2500:function(){return bi(function(e,t,n){return Reflect.set(e,t,n)},arguments)},__wbg_static_accessor_GLOBAL_4ef717fb391d88b7:function(){let e=typeof global>`u`?null:global;return xi(e)?0:di(e)},__wbg_static_accessor_GLOBAL_THIS_8d1badc68b5a74f4:function(){let e=typeof globalThis>`u`?null:globalThis;return xi(e)?0:di(e)},__wbg_static_accessor_SELF_146583524fe1469b:function(){let e=typeof self>`u`?null:self;return xi(e)?0:di(e)},__wbg_static_accessor_WINDOW_f2829a2234d7819e:function(){let e=typeof window>`u`?null:window;return xi(e)?0:di(e)},__wbg_subarray_3ed232c8a6baee09:function(e,t,n){return e.subarray(t>>>0,n>>>0)},__wbg_value_a5d5488a9589444a:function(e){return e.value},__wbg_versions_276b2795b1c6a219:function(e){return e.versions},__wbindgen_cast_0000000000000001:function(e){return e},__wbindgen_cast_0000000000000002:function(e){return e},__wbindgen_cast_0000000000000003:function(e,t){return mi(e,t)},__wbindgen_cast_0000000000000004:function(e,t){return _i(e,t)},__wbindgen_cast_0000000000000005:function(e){return BigInt.asUintN(64,e)},__wbindgen_init_externref_table:function(){let e=K.__wbindgen_externrefs,t=e.grow(4);e.set(0,void 0),e.set(t+0,void 0),e.set(t+1,null),e.set(t+2,!0),e.set(t+3,!1)}};return{__proto__:null,"./router_ab_ed25519_yao_client_bg.js":e}}const ni=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmactivatedclientv1_free(e,1)),ri=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmclientsigningsharev1_free(e,1)),ii=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmed25519yaoclientrootexportsessionv1_free(e,1)),ai=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmed25519yaolaneclientv1_free(e,1)),oi=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmed25519yaolanesourcev1_free(e,1)),si=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmed25519yaosourcepreservingregistrationsessionv1_free(e,1)),ci=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmexporteded25519seedv1_free(e,1)),li=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmordinaryed25519activationclientmaterialv1_free(e,1)),ui=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmwalletcustodyseedexportsessionv1_free(e,1));function di(e){let t=K.__externref_table_alloc();return K.__wbindgen_externrefs.set(t,e),t}function fi(e,t){if(!(e instanceof t))throw Error(`expected instance of ${t.name}`)}function pi(e){let t=typeof e;if(t==`number`||t==`boolean`||e==null)return`${e}`;if(t==`string`)return`"${e}"`;if(t==`symbol`){let t=e.description;return t==null?`Symbol`:`Symbol(${t})`}if(t==`function`){let t=e.name;return typeof t==`string`&&t.length>0?`Function(${t})`:`Function`}if(Array.isArray(e)){let t=e.length,n=`[`;t>0&&(n+=pi(e[0]));for(let r=1;r<t;r++)n+=`, `+pi(e[r]);return n+=`]`,n}let n=/\[object ([^\]]+)\]/.exec(toString.call(e)),r;if(n&&n.length>1)r=n[1];else return toString.call(e);if(r==`Object`)try{return`Object(`+JSON.stringify(e)+`)`}catch{return`Object`}return e instanceof Error?`${e.name}: ${e.message}\n${e.stack}`:r}function mi(e,t){return e>>>=0,yi().subarray(e/1,e/1+t)}let hi=null;function gi(){return(hi===null||hi.buffer.detached===!0||hi.buffer.detached===void 0&&hi.buffer!==K.memory.buffer)&&(hi=new DataView(K.memory.buffer)),hi}function _i(e,t){return wi(e>>>0,t)}let vi=null;function yi(){return(vi===null||vi.byteLength===0)&&(vi=new Uint8Array(K.memory.buffer)),vi}function bi(e,t){try{return e.apply(this,t)}catch(e){let t=di(e);K.__wbindgen_exn_store(t)}}function xi(e){return e==null}function H(e,t){let n=t(e.length*1,1)>>>0;return yi().set(e,n/1),G=e.length,n}function U(e,t,n){if(n===void 0){let n=Ti.encode(e),r=t(n.length,1)>>>0;return yi().subarray(r,r+n.length).set(n),G=n.length,r}let r=e.length,i=t(r,1)>>>0,a=yi(),o=0;for(;o<r;o++){let t=e.charCodeAt(o);if(t>127)break;a[i+o]=t}if(o!==r){o!==0&&(e=e.slice(o)),i=n(i,r,r=o+e.length*3,1)>>>0;let t=yi().subarray(i+o,i+r),a=Ti.encodeInto(e,t);o+=a.written,i=n(i,r,o,1)>>>0}return G=o,i}function W(e){let t=K.__wbindgen_externrefs.get(e);return K.__externref_table_dealloc(e),t}let Si=new TextDecoder(`utf-8`,{ignoreBOM:!0,fatal:!0});Si.decode();let Ci=0;function wi(e,t){return Ci+=t,Ci>=2146435072&&(Si=new TextDecoder(`utf-8`,{ignoreBOM:!0,fatal:!0}),Si.decode(),Ci=t),Si.decode(yi().subarray(e,e+t))}const Ti=new TextEncoder;`encodeInto`in Ti||(Ti.encodeInto=function(e,t){let n=Ti.encode(e);return t.set(n),{read:e.length,written:n.length}});let G=0,K;function Ei(e,t){return K=e.exports,hi=null,vi=null,K.__wbindgen_start(),K}async function Di(e,t){if(typeof Response==`function`&&e instanceof Response){if(typeof WebAssembly.instantiateStreaming==`function`)try{return await WebAssembly.instantiateStreaming(e,t)}catch(t){if(e.ok&&n(e.type)&&e.headers.get(`Content-Type`)!==`application/wasm`)console.warn("`WebAssembly.instantiateStreaming` failed because your server does not serve Wasm with `application/wasm` MIME type. Falling back to `WebAssembly.instantiate` which is slower. Original error:\n",t);else throw t}let r=await e.arrayBuffer();return await WebAssembly.instantiate(r,t)}else{let n=await WebAssembly.instantiate(e,t);return n instanceof WebAssembly.Instance?{instance:n,module:e}:n}function n(e){switch(e){case`basic`:case`cors`:case`default`:return!0}return!1}}async function Oi(e){if(K!==void 0)return K;e!==void 0&&(Object.getPrototypeOf(e)===Object.prototype?{module_or_path:e}=e:console.warn(`using deprecated parameters for the initialization function; pass a single object instead`)),e===void 0&&(e=new URL(`router_ab_ed25519_yao_client_bg.wasm`,import.meta.url));let t=ti();(typeof e==`string`||typeof Request==`function`&&e instanceof Request||typeof URL==`function`&&e instanceof URL)&&(e=fetch(e));let{instance:n,module:r}=await Di(await e,t);return Ei(n,r)}const ki=`router_ab_ed25519_yao_active_client_v1`;function Ai(e){switch(e.authorization.kind){case`passkey`:return{protocol:e.protocol,authorization:{kind:`passkey`,webauthnAuthentication:Rn(e.authorization.webauthnAuthentication)}};case`email_otp_factor`:return{protocol:e.protocol,authorization:{kind:`email_otp_factor`,providerSubjectId:e.authorization.providerSubjectId,walletAuthMethodId:e.authorization.walletAuthMethodId,challengeId:e.authorization.challengeId,otpCode:e.authorization.otpCode}}}}const ji=Symbol(`router-ab-ed25519-yao-active-client-construction`);function Mi(e,t){if(!(e instanceof Uint8Array)||e.length!==32)throw Error(`${t} must contain 32 bytes`);return e}function Ni(e){return e.authorization.kind===`passkey`}function Pi(e){switch(e.kind){case`wallet_custody_seed_v1`:return $r;case`ed25519_yao_client_root_v1`:return qr;default:return Vi(e.kind)}}function Fi(e){let t=[JSON.stringify(e.admission),JSON.stringify(e.applicationBinding),e.participantIds[0],e.participantIds[1],e.custodyEnvelope.factorSecret,e.custodyEnvelope.bindingJson,e.custodyEnvelope.nonce,e.custodyEnvelope.ciphertext,e.custodyEnvelope.aadHash,e.custodyEnvelope.ciphertextDigest,e.entropy.recipientKeyMaterial,e.entropy.deriverASealSeed,e.entropy.deriverBSealSeed];return new(Pi(e.custodyEnvelope))(...t)}function Ii(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=Object.keys(e);if(t.length!==4||![`kind`,`challengeId`,`loginGrant`,`expiresAtMs`].every(e=>t.includes(e))||Reflect.get(e,`kind`)!==`email_otp_login_grant`)return null;let n=Reflect.get(e,`challengeId`),r=Reflect.get(e,`loginGrant`),i=Reflect.get(e,`expiresAtMs`);return typeof n!=`string`||n.trim().length===0||typeof r!=`string`||r.trim().length===0||typeof i!=`number`||!Number.isSafeInteger(i)||i<=0?null:{kind:`email_otp_login_grant`,challengeId:n,loginGrant:r}}function Li(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`Router export admission response must be an object`);let t=Object.keys(e),n=t.length===1&&t[0]===`protocol`,r=t.length===2&&t.includes(`protocol`)&&t.includes(`factorRelease`);if(!n&&!r)throw Error(`Router export admission response contains unexpected fields`);let i=Pt(Reflect.get(e,`protocol`));if(!i.ok)throw Error(i.message);return n?{kind:`protocol_only`,protocol:i.value}:{kind:`protocol_with_factor_release`,protocol:i.value,factorRelease:Ii(Reflect.get(e,`factorRelease`))}}function Ri(){return{recipientKeyMaterial:Ui(),deriverASealSeed:Ui(),deriverBSealSeed:Ui()}}function zi(e){e.recipientKeyMaterial.fill(0),e.deriverASealSeed.fill(0),e.deriverBSealSeed.fill(0)}function Bi(e,t){if(e.length!==t.length)return!1;let n=0;for(let r=0;r<e.length;r+=1)n|=e[r]^t[r];return n===0}function Vi(e){throw Error(`Unhandled Ed25519 Yao Client lifecycle: ${String(e)}`)}function Hi(e){switch(e.kind){case`active`:return e.activated;case`disposed`:throw Error(`Ed25519 Yao Client state is disposed`);default:return Vi(e)}}function Ui(){let e=new Uint8Array(32);do globalThis.crypto.getRandomValues(e);while(e.every(Wi));return e}function Wi(e){return e===0}function Gi(e){let t=JSON.parse(e);if(typeof t!=`object`||!t||Array.isArray(t))throw Error(`Client commitments must be an object`);let n=Object.keys(t);if(n.length!==2||!n.includes(`hiding`)||!n.includes(`binding`))throw Error(`Client commitments contain unexpected fields`);let r=Reflect.get(t,`hiding`),i=Reflect.get(t,`binding`);if(typeof r!=`string`||typeof i!=`string`)throw Error(`Client commitments must contain hiding and binding strings`);return{hiding:r,binding:i}}function Ki(e,t){let n=t.binding.ceremony.lifecycle;return n.lifecycle_id===e.scope.lifecycle_id&&n.root_share_epoch===e.scope.root_share_epoch&&n.account_id===e.scope.account_id&&n.session_id===e.scope.threshold_session_id&&n.signer_set_id===e.scope.signer_set_id&&n.selected_server_id===e.scope.signing_worker_id&&xt(t.binding.ceremony.material_activation,e.scope.material_activation)&&t.binding.state_epoch===e.state_epoch&&Bi(t.binding.registered_public_key,e.registered_public_key)&&Bi(t.binding.runtime_policy_binding,e.runtime_policy_binding)&&Bi(t.binding.authorization_digest,e.authorization.authorization_digest)}function qi(e){let t=JSON.parse(e);if(typeof t!=`object`||!t||Array.isArray(t))throw Error(`Ed25519 Yao export artifact must be an object`);let n=Object.keys(t).sort(),r=[`artifactKind`,`privateKey`,`publicKey`];if(n.length!==r.length||n.some((e,t)=>e!==r[t]))throw Error(`Ed25519 Yao export artifact contains unexpected fields`);if(Reflect.get(t,`artifactKind`)!==`near-ed25519-seed-v1`||typeof Reflect.get(t,`publicKey`)!=`string`||typeof Reflect.get(t,`privateKey`)!=`string`||!String(Reflect.get(t,`publicKey`)).startsWith(`ed25519:`)||!String(Reflect.get(t,`privateKey`)).startsWith(`ed25519:`))throw Error(`Ed25519 Yao export artifact is invalid`);let i=Reflect.get(t,`publicKey`),a=Reflect.get(t,`privateKey`);if(typeof i!=`string`||typeof a!=`string`)throw Error(`Ed25519 Yao export artifact is invalid`);return{artifactKind:`near-ed25519-seed-v1`,publicKey:i,privateKey:a}}function Ji(e){let t=new URL(e.routerOrigin);if(t.protocol!==`http:`&&t.protocol!==`https:`||t.pathname!==`/`)throw Error(`Router origin must be an HTTP origin without a path`);if(t.search||t.hash)throw Error(`Router origin must not contain query or hash`);if(typeof e.fetch!=`function`)throw Error(`Router fetch is required`);switch(e.authorization.kind){case`bearer`:if(!e.authorization.value.trim())throw Error(`Router bearer authorization is required`);break;case`recovery_challenge`:if(!e.authorization.challengeId.trim())throw Error(`Router recovery challenge ID is required`);break;case`cookies`:break}return{routerOrigin:t.origin,routing:e.routing,authorization:e.authorization,fetch:e.fetch,traceContext:Yi(e.traceContext)}}function Yi(e){if(!e)return gn();if(e.kind!==`router_ab_trace_context_v1`)throw Error(`Router trace context kind is invalid`);let t=Cn(e.value);if(!t.ok)throw Error(t.message);return t.value}async function Xi(e){let t=e.headers.get(`Server-Timing`),n;try{n=await e.json()}catch(e){return{ok:!1,message:e instanceof Error?e.message:String(e)}}if(e.ok){let r=t||Zi(e.url);return{ok:!0,value:n,...r?{serverTiming:r}:{}}}let r=C(n)?.code;return{ok:!1,message:JSON.stringify(n),...typeof r==`string`?{code:r}:{}}}function Zi(e){if(!e||typeof performance>`u`||typeof performance.getEntriesByName!=`function`)return null;let t=performance.getEntriesByName(e,`resource`);for(let e=t.length-1;e>=0;--e){let n=t[e];if(!n||n.entryType!==`resource`)continue;let r=Qi(Reflect.get(n,`serverTiming`));if(r)return r}return null}function Qi(e){if(!Array.isArray(e))return null;let t=[];for(let n of e){if(typeof n!=`object`||!n)continue;let e=String(Reflect.get(n,`name`)||``).trim(),r=Number(Reflect.get(n,`duration`));/^[a-z0-9_]+$/.test(e)&&(!Number.isFinite(r)||r<0||t.push(`${e};dur=${r}`))}return t.length>0?t.join(`, `):null}var $i=class{constructor(e){this.config=Ji(e)}async send(e){let t;try{let n=!(e.kind===`export_admit`||e.kind===`export_execute`)&&this.config.authorization.kind===`bearer`?this.config.authorization.value:null,r=e.kind===`recovery_admit`&&this.config.authorization.kind===`recovery_challenge`?this.config.authorization.challengeId:null,i=this.config.authorization.kind===`cookies`;t=await this.config.fetch.call(globalThis,new URL(e.path,this.config.routerOrigin),{method:`POST`,headers:{...sa(this.config.routing),...n?{authorization:n}:{},...r?{[It]:r}:{},"content-type":`application/json`,[_n]:this.config.traceContext.value},credentials:i?`include`:`omit`,body:JSON.stringify(e.body)})}catch(e){return{ok:!1,message:e instanceof Error?e.message:String(e)}}return Xi(t)}},ea=class{constructor(e){if(e[ji]!==!0)throw Error(`Ed25519 Yao Client state requires verified WASM completion`);this.activeMetadata={kind:e.metadata.kind,scope:{lifecycle_id:e.metadata.scope.lifecycle_id,root_share_epoch:e.metadata.scope.root_share_epoch,account_id:e.metadata.scope.account_id,threshold_session_id:e.metadata.scope.threshold_session_id,signer_set_id:e.metadata.scope.signer_set_id,signing_worker_id:e.metadata.scope.signing_worker_id,material_activation:e.metadata.scope.material_activation},applicationBinding:{wallet_id:e.metadata.applicationBinding.wallet_id,near_ed25519_signing_key_id:e.metadata.applicationBinding.near_ed25519_signing_key_id,signing_root_id:e.metadata.applicationBinding.signing_root_id,key_creation_signer_slot:e.metadata.applicationBinding.key_creation_signer_slot},participantIds:[e.metadata.participantIds[0],e.metadata.participantIds[1]],registeredPublicKey:e.metadata.registeredPublicKey.slice(),signingWorkerVerifyingShare:e.metadata.signingWorkerVerifyingShare.slice(),stateEpoch:e.metadata.stateEpoch,transcript:e.metadata.transcript.slice(),activeCapabilityBinding:[...e.metadata.activeCapabilityBinding],materialActivation:e.metadata.materialActivation},this.lifecycle={kind:`active`,activated:e.activated}}sealLocalMaterial(e){let t=Hi(this.lifecycle);try{return{kind:`router_ab_ed25519_yao_sealed_local_material_v1`,nonce:e.nonce.slice(),ciphertext:t.seal_local_material(Mi(e.ownedPasskeyPrfFirst,`passkey PRF.first`),e.binding,e.nonce)}}finally{e.ownedPasskeyPrfFirst.fill(0)}}async createSigningShare(e){let t=Hi(this.lifecycle),n=Mi(e.admittedDigest,`admitted digest`),r=Mi(e.signingWorkerVerifyingShare,`SigningWorker verifying share`);if(!Bi(r,this.activeMetadata.signingWorkerVerifyingShare))throw Error(`SigningWorker verifying share does not match activated Client state`);let i=t.create_signing_share(this.activeMetadata.participantIds[0],this.activeMetadata.participantIds[1],n,JSON.stringify(e.signingWorkerCommitments),r);try{return{clientCommitments:Gi(i.client_commitments_json()),clientVerifyingShare:i.client_verifying_share(),clientSignatureShareB64u:i.client_signature_share_b64u()}}finally{i.free()}}metadata(){return{kind:this.activeMetadata.kind,scope:{lifecycle_id:this.activeMetadata.scope.lifecycle_id,root_share_epoch:this.activeMetadata.scope.root_share_epoch,account_id:this.activeMetadata.scope.account_id,threshold_session_id:this.activeMetadata.scope.threshold_session_id,signer_set_id:this.activeMetadata.scope.signer_set_id,signing_worker_id:this.activeMetadata.scope.signing_worker_id,material_activation:this.activeMetadata.scope.material_activation},applicationBinding:{wallet_id:this.activeMetadata.applicationBinding.wallet_id,near_ed25519_signing_key_id:this.activeMetadata.applicationBinding.near_ed25519_signing_key_id,signing_root_id:this.activeMetadata.applicationBinding.signing_root_id,key_creation_signer_slot:this.activeMetadata.applicationBinding.key_creation_signer_slot},participantIds:[this.activeMetadata.participantIds[0],this.activeMetadata.participantIds[1]],registeredPublicKey:this.activeMetadata.registeredPublicKey.slice(),signingWorkerVerifyingShare:this.activeMetadata.signingWorkerVerifyingShare.slice(),stateEpoch:this.activeMetadata.stateEpoch,transcript:this.activeMetadata.transcript.slice(),activeCapabilityBinding:[...this.activeMetadata.activeCapabilityBinding],materialActivation:this.activeMetadata.materialActivation}}status(){switch(this.lifecycle.kind){case`active`:return{kind:`active`};case`disposed`:return{kind:`disposed`};default:return Vi(this.lifecycle)}}dispose(){switch(this.lifecycle.kind){case`active`:{let e=this.lifecycle.activated;this.lifecycle={kind:`disposed`},e.free();return}case`disposed`:return;default:return Vi(this.lifecycle)}}};function ta(e){let t=null;try{return t=Gr.import_local_material(Mi(e.ownedPasskeyPrfFirst,`passkey PRF.first`),e.binding,e.sealed.nonce,e.sealed.ciphertext,e.metadata.registeredPublicKey,e.metadata.stateEpoch,e.metadata.participantIds[0],e.metadata.participantIds[1],e.metadata.signingWorkerVerifyingShare),new ea({[ji]:!0,metadata:e.metadata,activated:t})}catch(e){throw t?.free(),e}finally{e.ownedPasskeyPrfFirst.fill(0)}}function na(e){let t=null;try{if(t=Gr.import_linked_material(Mi(e.ownedClientScalarShare,`linked-device Ed25519 Client share`),e.metadata.participantIds[0],e.metadata.participantIds[1],JSON.stringify(e.publicReceipt)),t.state_epoch()!==e.metadata.stateEpoch||!Bi(t.registered_public_key(),e.metadata.registeredPublicKey)||!Bi(e.publicReceipt.signing_worker_verifying_share,e.metadata.signingWorkerVerifyingShare))throw Error(`linked-device Ed25519 material metadata does not match its receipt`);return new ea({[ji]:!0,metadata:e.metadata,activated:t})}catch(e){throw t?.free(),e}finally{e.ownedClientScalarShare.fill(0)}}function ra(e){let t=null;try{return t=ei(e.ownedFactorSecret,e.envelope.bindingJson,e.envelope.nonce,e.envelope.ciphertext,e.envelope.aadHash,e.envelope.ciphertextDigest,e.applicationBindingDigest,e.metadata.registeredPublicKey,e.metadata.stateEpoch,e.metadata.participantIds[0],e.metadata.participantIds[1],e.metadata.signingWorkerVerifyingShare,e.sealed.nonce,e.sealed.ciphertext),new ea({[ji]:!0,metadata:e.metadata,activated:t})}catch(e){throw t?.free(),e}finally{e.ownedFactorSecret.fill(0)}}let ia=null;function aa(e){throw ia=null,e}var oa=class e{constructor(){}static async initializeBundled(){return ia??=Oi().catch(aa),await ia,new e}importLocalMaterial(e){return ta(e)}importLinkedMaterial(e){return na(e)}openCustodyCache(e){return ra(e)}async exportSeed(e){let t=await e.transport.send({kind:`export_admit`,path:Ut,body:Ai({protocol:e.request,authorization:e.authorization})});if(!t.ok)return t;let n;try{n=Li(t.value)}catch(e){return{ok:!1,message:e instanceof Error?e.message:String(e)}}if(!Ki(e.request,n.protocol))return{ok:!1,message:`Router export admission does not match the requested exact capability`};let r;if(Ni(e)){if(n.kind!==`protocol_only`)return{ok:!1,message:`Passkey export admission returned an Email OTP factor release`};r=e.custodyEnvelope}else{if(n.kind!==`protocol_with_factor_release`)return{ok:!1,message:`Email OTP export admission did not return the matching factor release`};let t=n.factorRelease;if(!t||t.challengeId!==e.authorization.challengeId)return{ok:!1,message:`Email OTP export admission did not return the matching factor release`};try{r=await e.resolveCustodyEnvelope(t)}catch(e){return{ok:!1,message:e instanceof Error?e.message:String(e)}}}let i=Ri(),a;try{a=Fi({admission:n.protocol,applicationBinding:e.request.application_binding,participantIds:e.request.participant_ids,custodyEnvelope:r,entropy:i})}catch(e){return{ok:!1,message:e instanceof Error?e.message:String(e)}}finally{r.factorSecret.fill(0),zi(i)}try{let t=At(JSON.parse(a.execute_request_json()));if(!t.ok)return{ok:!1,message:t.message};let n=await e.transport.send({kind:`export_execute`,path:Ft,body:{protocol:t.value}});if(!n.ok)return n;let r=jt(n.value);if(!r.ok)return{ok:!1,message:r.message};let i=a.complete(JSON.stringify(r.value));try{return{ok:!0,artifact:qi(i.take_export_artifact_json())}}finally{i.free()}}catch(e){return{ok:!1,message:e instanceof Error?e.message:String(e)}}finally{a.free()}}};function sa(e){switch(e.kind){case`discovery`:return{};case`direct`:case`regional`:return ee(e);default:return Vi(e)}}function ca(e){return{materialActivation:e.materialActivation,lifecycleId:e.scope.lifecycle_id,signingRootVersion:e.scope.root_share_epoch,signingRootId:e.applicationBinding.signing_root_id,signerSetId:e.scope.signer_set_id,thresholdSessionId:e.scope.threshold_session_id,activationTranscriptB64u:I(e.transcript),activationCapabilityBindingB64u:I(Uint8Array.from(e.activeCapabilityBinding))}}function la(e){if(!en(e.binding))throw Error(`wallet custody cache accepts wallet custody seed envelopes only`);return{bindingJson:tn(e),nonceB64u:e.nonceB64u,ciphertextB64u:e.sealedCustodySecretB64u,aadHashB64u:e.aadHashB64u,ciphertextDigestB64u:e.ciphertextDigestB64u}}function ua(e){let{binding:t}=e.material,{activation:n}=e;return{kind:ki,scope:{lifecycle_id:n.lifecycleId,root_share_epoch:n.signingRootVersion,account_id:t.walletId,threshold_session_id:n.thresholdSessionId,signer_set_id:n.signerSetId,signing_worker_id:t.signingWorkerId,material_activation:Ct(n.materialActivation)},applicationBinding:{wallet_id:t.walletId,near_ed25519_signing_key_id:t.nearEd25519SigningKeyId,signing_root_id:n.signingRootId,key_creation_signer_slot:t.signerSlot},participantIds:t.participantIds,registeredPublicKey:L(t.registeredPublicKeyB64u),signingWorkerVerifyingShare:L(t.signingWorkerVerifyingShareB64u),stateEpoch:BigInt(t.stateEpoch),transcript:L(n.activationTranscriptB64u),activeCapabilityBinding:Array.from(L(n.activationCapabilityBindingB64u)),materialActivation:n.materialActivation}}async function da(e){let t=ua({material:e.material,activation:e.activation});return(await oa.initializeBundled()).openCustodyCache({ownedFactorSecret:e.ownedFactorSecret,envelope:{bindingJson:e.envelope.bindingJson,nonce:L(e.envelope.nonceB64u),ciphertext:L(e.envelope.ciphertextB64u),aadHash:L(e.envelope.aadHashB64u),ciphertextDigest:L(e.envelope.ciphertextDigestB64u)},applicationBindingDigest:L(e.material.binding.applicationBindingDigestB64u),sealed:{kind:`router_ab_ed25519_yao_sealed_local_material_v1`,nonce:L(e.material.sealed.nonceB64u),ciphertext:L(e.material.sealed.ciphertextB64u)},metadata:t})}async function fa(e){let t=await e.loadCachedMaterial();return t.kind===`found`?{kind:`opened`,activeClient:await da({material:t.material,activation:e.activation,envelope:e.envelope,ownedFactorSecret:e.ownedFactorSecret})}:(e.ownedFactorSecret.fill(0),{kind:`rejoin_required`})}function pa(e){let t=String(e.rpId).trim(),n=String(e.nearAccountId).trim(),r=String(e.nearEd25519SigningKeyId).trim(),i=String(e.relayerKeyId).trim(),a=String(e.credentialIdB64u).trim(),o=P(e.participantIds),s=Math.floor(Number(e.signerSlot));if(!t||!n||!r||!i||!a||!o||!Number.isSafeInteger(s)||s<1)throw Error(`Passkey Ed25519 sealed restore metadata is incomplete`);return{rpId:t,nearAccountId:n,nearEd25519SigningKeyId:r,relayerKeyId:i,participantIds:[...o],runtimePolicyScope:e.runtimePolicyScope,signerSlot:s,routerAbNormalSigning:e.routerAbNormalSigning,credentialIdB64u:a,materialActivation:e.materialActivation}}async function ma(e){let t=String(e.session.thresholdSessionId||``).trim(),n=String(e.session.walletSessionAuth.walletSessionToken||``).trim(),r=String(e.session.signingLane.identity.signer.account.wallet.walletId||``).trim(),i=String(e.prfFirstB64u||``).trim(),a=Math.floor(Number(e.session.signingWalletSession.expiresAtMs)||0),o=Math.floor(Number(e.session.remainingUses)),s=e.session.signingLane.identity.auth;if(s.kind!==`passkey`)throw Error(`Ed25519 Yao sealed refresh persistence requires a passkey lane`);if(!t||!n||!r||!i||a<=0||!Number.isSafeInteger(o)||o<0)throw Error(`Ed25519 Yao sealed refresh persistence received an invalid session`);let c=e.session.signingLane.identity.signer;if(r!==String(c.account.wallet.walletId)||e.ed25519Restore.nearAccountId!==String(c.account.nearAccountId)||e.ed25519Restore.nearEd25519SigningKeyId!==String(c.nearEd25519SigningKeyId)||e.ed25519Restore.signerSlot!==c.signerSlot||e.ed25519Restore.rpId!==String(s.rpId)||e.ed25519Restore.credentialIdB64u!==s.credentialIdB64u||!p(e.ed25519Restore.materialActivation,e.materialActivation)||e.ed25519Restore.routerAbNormalSigning?.signingWorkerId!==e.session.routerAbNormalSigning.signingWorkerId)throw Error(`Ed25519 Yao sealed refresh metadata does not match the exact session`);let l={curve:`ed25519`,authMethod:`passkey`,walletId:r,relayerUrl:e.session.relayerUrl,walletSessionToken:n,ed25519Restore:e.ed25519Restore};await e.persistence.hydrateSigningSession({thresholdSessionId:t,prfFirstB64u:i,expiresAtMs:a,remainingUses:o,transport:l})}const ha=`[Registration] wallet timing summary`,ga=new Map(Object.entries({yao_credential_digest:`yaoServerCredentialDigestMs`,yao_d1_admission_read:`yaoServerD1AdmissionReadMs`,yao_router_execution:`yaoServerRouterExecutionMs`,yao_result_reconstruction:`yaoServerResultReconstructionMs`,yao_router_prepare_pair:`yaoServerRouterPreparePairMs`,yao_router_role_execution:`yaoServerRouterRoleExecutionMs`,yao_router_signing_worker_delivery:`yaoServerRouterSigningWorkerDeliveryMs`,ecdsa_respond_d1_claim:`ecdsaRespondD1ClaimMs`,ecdsa_respond_reconcile:`ecdsaRespondReconcileMs`,ecdsa_respond_router:`ecdsaRespondRouterMs`,ecdsa_respond_d1_commit:`ecdsaRespondD1CommitMs`,ecdsa_respond_total:`ecdsaRespondTotalMs`,ecdsa_activate_d1_claim:`ecdsaActivateD1ClaimMs`,ecdsa_activate_reconcile:`ecdsaActivateReconcileMs`,ecdsa_activate_router:`ecdsaActivateRouterMs`,ecdsa_activate_bootstrap:`ecdsaActivateBootstrapMs`,ecdsa_activate_session_provision:`ecdsaActivateSessionProvisionMs`,ecdsa_activate_d1_commit:`ecdsaActivateD1CommitMs`,ecdsa_activate_policy_lookup:`ecdsaActivatePolicyLookupMs`,ecdsa_activate_jwt_mint:`ecdsaActivateJwtMintMs`,ecdsa_activate_total:`ecdsaActivateTotalMs`,ecdsa_rt_authorize:`ecdsaRtAuthorizeMs`,ecdsa_rt_admission:`ecdsaRtAdmissionMs`,ecdsa_rt_derivers:`ecdsaRtDeriversMs`,ecdsa_rt_deriver_a:`ecdsaRtDeriverAMs`,ecdsa_rt_deriver_b:`ecdsaRtDeriverBMs`,ecdsa_rt_completion:`ecdsaRtCompletionMs`,ecdsa_rt_total:`ecdsaRtTotalMs`,ecdsa_rt_act_session:`ecdsaRtActSessionMs`,ecdsa_rt_act_worker:`ecdsaRtActWorkerMs`,ecdsa_rt_act_total:`ecdsaRtActTotalMs`,ecdsa_a_parse:`ecdsaDeriverAParseMs`,ecdsa_a_preload:`ecdsaDeriverAPreloadMs`,ecdsa_a_execute:`ecdsaDeriverAExecuteMs`,ecdsa_a_total:`ecdsaDeriverATotalMs`,ecdsa_b_parse:`ecdsaDeriverBParseMs`,ecdsa_b_preload:`ecdsaDeriverBPreloadMs`,ecdsa_b_execute:`ecdsaDeriverBExecuteMs`,ecdsa_b_total:`ecdsaDeriverBTotalMs`,ecdsa_sw_parse:`ecdsaSigningWorkerParseMs`,ecdsa_sw_activate:`ecdsaSigningWorkerActivateMs`,ecdsa_sw_total:`ecdsaSigningWorkerTotalMs`,near_finalize_authority:`nearFinalizeAuthorityMs`,near_finalize_fingerprint:`nearFinalizeFingerprintMs`,near_finalize_side_effect:`nearFinalizeSideEffectMs`,near_finalize_cleanup:`nearFinalizeCleanupMs`,near_finalize_session_projection:`nearFinalizeSessionProjectionMs`,near_finalize_session_seal:`nearFinalizeSessionSealMs`,near_finalize_total:`nearFinalizeTotalMs`}));function _a(e,t,n){yr()&&console.info(`[Registration] ECDSA Server-Timing header presence`,{leg:t,present:!!n?.trim()}),va(e,n)}function va(e,t){if(e)for(let[n,r]of ya(t))e.record(n,r)}function ya(e){if(!e)return[];let t=[];for(let n of e.split(`,`)){let e=n.split(`;`),r=String(e[0]||``).trim(),i=ga.get(r);if(i)for(let n of e.slice(1)){let[e,r]=n.split(`=`);if(String(e||``).trim()!==`dur`)continue;let a=Number(String(r||``).trim());if(!Number.isFinite(a)||a<0)break;t.push([i,a]);break}}return t}function ba(e){Sa({ceremonyId:e.ceremonyId,stage:e.stage,durationMs:Math.max(0,performance.now()-e.startedAt),outcome:e.outcome})}function xa(e,t,n){Sa({ceremonyId:e,stage:`session_hydration.${t}`,durationMs:n,outcome:`success`})}function Sa(e){if(yr())try{console.info(`[Registration] NEAR timing`,JSON.stringify({event:`near_registration_timing`,ceremonyId:e.ceremonyId,stage:e.stage,durationMs:e.durationMs,outcome:e.outcome}))}catch{}}const Ca=[`passkeyAuthConfirmationMs`,`passkeyAuthPrfExtractionMs`,`passkeyAuthCredentialRedactionMs`,`passkeyAuthWorkerReadyMs`,`passkeyAuthWorkerRequestRoundTripMs`,`passkeyAuthWorkerResponseValidationMs`,`passkeyAuthRequestSetupMs`,`passkeyAuthPromptUserMs`,`passkeyAuthPromptElementDefineMs`,`passkeyAuthPromptMountMs`,`passkeyAuthPromptHostFirstUpdateMs`,`passkeyAuthPromptHostInteractiveMs`,`passkeyAuthPromptConfirmEventMs`,`passkeyAuthPromptDecisionWaitMs`,`passkeyAuthCredentialCreateStartMs`,`passkeyAuthCredentialCreateMs`,`passkeyAuthCredentialSerializeMs`,`passkeyAuthDuplicateRetryCount`,`passkeyAuthMainThreadTotalMs`],wa=[`emailOtpYaoEnrollmentMaterialWaitMs`,`emailOtpYaoWorkerRegistrationMs`,`emailOtpYaoTotalMs`],Ta=[`ecdsaClientBootstrapMs`,`ecdsaRegistrationTotalMs`,`ecdsaRegistrationClientCreateMs`,`ecdsaRegistrationGatewayRespondMs`,`ecdsaRegistrationClientProofVerifyMs`,`ecdsaRegistrationGatewayActivateMs`,`ecdsaRegistrationClientActivationFinalizeMs`],Ea=[`ecdsaRegistrationPersistenceMs`,`ecdsaRegistrationSessionFinalizeMs`,`ecdsaRegistrationLocalRecordPersistenceMs`,`ecdsaRegistrationTargetCount`,`ecdsaRegistrationClientFinalizeMs`,`ecdsaRegistrationClientMaterialStoreMs`,`ecdsaRegistrationServerBootstrapMs`,`ecdsaRegistrationPasskeyBootstrapStoreMs`,`ecdsaRegistrationRoleLocalRecordPersistenceMs`,`ecdsaRegistrationWarmSessionHydrationMs`,`ecdsaRegistrationWarmSessionWorkerReadyMs`,`ecdsaRegistrationWarmSessionWorkerPutMs`,`ecdsaRegistrationWarmSessionSealedRecordPersistMs`,`ecdsaRegistrationWarmSessionSealResolveTransportMs`,`ecdsaRegistrationWarmSessionSealExistingRecordReadMs`,`ecdsaRegistrationWarmSessionSealPolicyReadMs`,`ecdsaRegistrationWarmSessionSealApplyServerSealMs`,`ecdsaRegistrationWarmSessionSealApplyRuntimeSetupMs`,`ecdsaRegistrationWarmSessionSealApplyClientSealMs`,`ecdsaRegistrationWarmSessionSealApplyServerRouteMs`,`ecdsaRegistrationWarmSessionSealApplyClientUnsealMs`,`ecdsaRegistrationWarmSessionSealApplyPolicyUpdateMs`,`ecdsaRegistrationWarmSessionSealRegisterMs`,`ecdsaRegistrationWarmSessionSealVerifyReadMs`,`ecdsaRegistrationEmailOtpSessionCommitMs`],Da=[...Ta,...Ea],Oa=[`registrationWarmupMs`,`registrationWarmupWaitMs`,`registrationWarmupAuthenticatedWalletStateMs`,`registrationWarmupNoncePrefetchMs`,`registrationWarmupKeyMaterialReadMs`,`registrationWarmupUiConfirmPrewarmMs`,`registrationWarmupEmailOtpWorkerPrewarmMs`,`registrationWarmupEmailOtpYaoWasmInitMs`,`managedRegistrationGrantMs`,`registrationIntentMs`,`registrationIntentDigestMs`,`authProofMs`,...Ca,`emailOtpEnrollmentMaterialMs`,...wa,`yaoBranchTotalMs`,`yaoAdmissionMs`,`yaoClientSessionCreateMs`,`yaoClientCompletionMs`,`yaoServerCredentialDigestMs`,`yaoServerD1AdmissionReadMs`,`yaoServerRouterExecutionMs`,`yaoServerResultReconstructionMs`,`yaoServerRouterPreparePairMs`,`yaoServerRouterRoleExecutionMs`,`yaoServerRouterSigningWorkerDeliveryMs`,`ecdsaRespondD1ClaimMs`,`ecdsaRespondReconcileMs`,`ecdsaRespondRouterMs`,`ecdsaRespondD1CommitMs`,`ecdsaRespondTotalMs`,`ecdsaActivateD1ClaimMs`,`ecdsaActivateReconcileMs`,`ecdsaActivateRouterMs`,`ecdsaActivateBootstrapMs`,`ecdsaActivateSessionProvisionMs`,`ecdsaActivateD1CommitMs`,`ecdsaActivatePolicyLookupMs`,`ecdsaActivateJwtMintMs`,`ecdsaActivateTotalMs`,`ecdsaRtAuthorizeMs`,`ecdsaRtAdmissionMs`,`ecdsaRtDeriversMs`,`ecdsaRtDeriverAMs`,`ecdsaRtDeriverBMs`,`ecdsaRtCompletionMs`,`ecdsaRtTotalMs`,`ecdsaRtActSessionMs`,`ecdsaRtActWorkerMs`,`ecdsaRtActTotalMs`,`ecdsaDeriverAParseMs`,`ecdsaDeriverAPreloadMs`,`ecdsaDeriverAExecuteMs`,`ecdsaDeriverATotalMs`,`ecdsaDeriverBParseMs`,`ecdsaDeriverBPreloadMs`,`ecdsaDeriverBExecuteMs`,`ecdsaDeriverBTotalMs`,`ecdsaSigningWorkerParseMs`,`ecdsaSigningWorkerActivateMs`,`ecdsaSigningWorkerTotalMs`,`nearFinalizeAuthorityMs`,`nearFinalizeFingerprintMs`,`nearFinalizeSideEffectMs`,`nearFinalizeCleanupMs`,`nearFinalizeSessionProjectionMs`,`nearFinalizeSessionSealMs`,`nearFinalizeTotalMs`,`walletRegisterStartMs`,...Ta,`emailOtpRecoveryCodeBackupMs`,`walletRegisterFinalizeMs`,...Ea];function q(e){throw Error(`Unexpected registration timing branch: ${String(e)}`)}function ka(e){switch(e.kind){case`near_ed25519`:return`near_ed25519`;case`evm_family_ecdsa`:return`evm_family_ecdsa`;default:return q(e)}}function Aa(e){return{kind:`signer_set`,branches:e.branches.map(ka)}}function ja(e,t){return e.branches.includes(t)}function Ma(e){return Math.max(0,Math.round(performance.now()-e))}function Na(e){switch(e){case`registrationIntentLoadMs`:case`registrationIntentDigestMs`:case`registrationIntentConsumeMs`:case`registrationPreparationPersistMs`:case`registrationPreparationLoadMs`:case`registrationPreparationConsumeMs`:case`registrationPreparationScopeCheckMs`:case`registrationAuthorityVerifyMs`:case`registrationEcdsaPrepareMs`:case`registrationCeremonyPersistMs`:case`registerPrepareTotalMs`:case`registerStartTotalMs`:case`registrationEcdsaRespondMs`:case`registrationFinalizeReplayLoadMs`:case`registrationCeremonyLoadMs`:case`registrationEcdsaBootstrapVerifyMs`:case`sponsoredNearAccountCreateMs`:case`registrationKeygenMs`:case`registrationEmailOtpEnrollmentPlanMs`:case`relaySessionMintMs`:case`relayGoogleEmailOtpActivationPlanMs`:case`relayPersistenceMs`:case`registrationFinalizeReplayCacheMs`:case`registerFinalizeTotalMs`:return e;default:return null}}function Pa(e){if(!b(e)||e.kind!==`wallet_registration_route_diagnostics_v1`||e.route!==`wallets_register_start`&&e.route!==`wallets_register_ecdsa_derivation_respond`&&e.route!==`wallets_register_finalize`||!Array.isArray(e.entries))return null;let t=[];for(let n of e.entries){if(!b(n))continue;let e=Na(n.name),r=Number(n.durationMs);!e||!Number.isFinite(r)||r<0||t.push({name:e,durationMs:r})}return{kind:`wallet_registration_route_diagnostics_v1`,route:e.route,entries:t}}function Fa(e){return{kind:e.kind,route:e.route,entries:e.entries.map(Ia)}}function Ia(e){return{name:e.name,durationMs:e.durationMs}}function La(e,t){let n={};for(let r of e)n[r]=t[r];return n}function Ra(e){let t={};for(let n of e)t[n]=0;return t}function za(e){switch(e.authMethod){case`passkey`:return{kind:`passkey`,authProofMs:e.buckets.authProofMs,...La(Ca,e.buckets),emailOtpEnrollmentMaterialMs:0,emailOtpRecoveryCodeBackupMs:0};case`email_otp`:return{kind:`email_otp`,authProofMs:e.buckets.authProofMs,...Ra(Ca),emailOtpEnrollmentMaterialMs:e.buckets.emailOtpEnrollmentMaterialMs,emailOtpRecoveryCodeBackupMs:e.buckets.emailOtpRecoveryCodeBackupMs};default:return q(e.authMethod)}}function Ba(e){return ja(e.signerSet,`near_ed25519`)?{kind:`ed25519_yao_enabled`,...La(wa,e.buckets)}:{kind:`ed25519_disabled`,...Ra(wa)}}function Va(e){return ja(e.signerSet,`evm_family_ecdsa`)?{kind:`ecdsa_enabled`,...La(Da,e.buckets)}:{kind:`ecdsa_disabled`,...Ra(Da)}}const Ha=[`registrationWarmupWaitMs`,`managedRegistrationGrantMs`,`registrationIntentMs`,`registrationIntentDigestMs`,`authProofMs`,`emailOtpEnrollmentMaterialMs`,`emailOtpYaoEnrollmentMaterialWaitMs`,`emailOtpYaoWorkerRegistrationMs`,`emailOtpYaoTotalMs`,`walletRegisterStartMs`,`ecdsaClientBootstrapMs`,`ecdsaRegistrationTotalMs`,`emailOtpRecoveryCodeBackupMs`,`walletRegisterFinalizeMs`,`ecdsaRegistrationPersistenceMs`];function Ua(e){return e.startsWith(`registrationWarmup`)?`warmup`:e.startsWith(`passkeyAuth`)||e===`authProofMs`?`auth`:e.includes(`Yao`)||e.includes(`yao`)?`ed25519_yao`:e.includes(`ecdsa`)?`ecdsa`:`registration`}function Wa(e){return{name:e.name,kind:e.kind,startOffsetMs:e.startOffsetMs,endOffsetMs:e.endOffsetMs}}function Ga(e,t){let n=t.map(t=>({start:Math.max(0,Math.min(e,t.startOffsetMs)),end:Math.max(0,Math.min(e,t.endOffsetMs))})).filter(e=>e.end>e.start).sort((e,t)=>e.start-t.start||e.end-t.end),r=0,i=0,a=0;for(let e of n){if(a<=i){i=e.start,a=e.end;continue}if(e.start>a){r+=a-i,i=e.start,a=e.end;continue}a=Math.max(a,e.end)}return a>i?r+a-i:r}function Ka(e){let t=Ha.map(t=>({name:t,durationMs:e.buckets[t]})),n=t.reduce((e,t)=>e+Math.max(0,t.durationMs),0),r=t.filter(e=>e.durationMs>0).sort((e,t)=>t.durationMs===e.durationMs?e.name.localeCompare(t.name):t.durationMs-e.durationMs).slice(0,5),i=Ga(e.totalElapsedMs,e.spans);return{kind:`registration_critical_path_summary_v2`,totalElapsedMs:e.totalElapsedMs,measuredWorkMs:n,spanUnionMs:i,spanCoverageRatio:e.totalElapsedMs>0?Math.min(1,i/e.totalElapsedMs):1,unattributedElapsedMs:Math.max(0,e.totalElapsedMs-i),overlappedOrBackgroundMs:Math.max(0,n-e.totalElapsedMs),topBuckets:r,spans:e.spans.map(Wa)}}function qa(e){let t=La(Oa,e.buckets);return{...t,auth:za({authMethod:e.authMethod,buckets:t}),ed25519:Ba({signerSet:e.signerSet,buckets:t}),ecdsa:Va({signerSet:e.signerSet,buckets:t}),emailOtpYaoPrewarm:{...e.emailOtpYaoPrewarm}}}var Ja=class{constructor(e){this.startedAt=e,this.nearStageStartedAt=e,this.buckets=Ra(Oa),this.relayDiagnostics=[],this.spans=[],this.emailOtpYaoPrewarm=Ya()}markNearStage(e,t){let n=performance.now();Sa({ceremonyId:e,stage:t,durationMs:n-this.nearStageStartedAt,outcome:`success`}),this.nearStageStartedAt=n}async measure(e,t){let n=performance.now();try{return await t()}finally{this.buckets[e]=Ma(n),this.recordSpan(e,n,performance.now())}}record(e,t){let n=Math.max(0,Math.round(t));this.buckets[e]+=n}snapshot(){return La(Oa,this.buckets)}spansSnapshot(){return this.spans.map(Wa)}recordSpan(e,t,n){this.spans.push({name:e,kind:Ua(e),startOffsetMs:Math.max(0,Math.round(t-this.startedAt)),endOffsetMs:Math.max(0,Math.round(n-this.startedAt))})}captureRouteDiagnostics(e){let t=Pa(e);t&&this.relayDiagnostics.push(t)}captureWarmupDiagnostics(e){this.buckets.registrationWarmupAuthenticatedWalletStateMs=e.authenticatedWalletStateMs,this.buckets.registrationWarmupNoncePrefetchMs=e.noncePrefetchMs,this.buckets.registrationWarmupKeyMaterialReadMs=e.keyMaterialReadMs,this.buckets.registrationWarmupUiConfirmPrewarmMs=e.uiConfirmPrewarmMs,this.buckets.registrationWarmupEmailOtpWorkerPrewarmMs=e.emailOtpWorkerPrewarmMs,this.buckets.registrationWarmupEmailOtpYaoWasmInitMs=e.emailOtpYaoWasmInitMs,this.emailOtpYaoPrewarm={...e.emailOtpYaoPrewarm}}emailOtpYaoPrewarmSnapshot(){return{...this.emailOtpYaoPrewarm}}capturePasskeyAuthDiagnostics(e){this.buckets.passkeyAuthConfirmationMs=e.requestConfirmationMs,this.buckets.passkeyAuthPrfExtractionMs=e.prfExtractionMs,this.buckets.passkeyAuthCredentialRedactionMs=e.credentialRedactionMs,this.buckets.passkeyAuthWorkerReadyMs=e.confirmationWorkerReadyMs,this.buckets.passkeyAuthWorkerRequestRoundTripMs=e.confirmationWorkerRequestRoundTripMs,this.buckets.passkeyAuthWorkerResponseValidationMs=e.confirmationWorkerResponseValidationMs,this.buckets.passkeyAuthRequestSetupMs=e.confirmationRequestSetupMs,this.buckets.passkeyAuthPromptUserMs=e.confirmationPromptUserMs,this.buckets.passkeyAuthPromptElementDefineMs=e.confirmationPromptElementDefineMs,this.buckets.passkeyAuthPromptMountMs=e.confirmationPromptMountMs,this.buckets.passkeyAuthPromptHostFirstUpdateMs=e.confirmationPromptHostFirstUpdateMs,this.buckets.passkeyAuthPromptHostInteractiveMs=e.confirmationPromptHostInteractiveMs,this.buckets.passkeyAuthPromptConfirmEventMs=e.confirmationPromptConfirmEventMs,this.buckets.passkeyAuthPromptDecisionWaitMs=e.confirmationPromptDecisionWaitMs,this.buckets.passkeyAuthCredentialCreateStartMs=e.confirmationCredentialCreateStartMs,this.buckets.passkeyAuthCredentialCreateMs=e.confirmationCredentialCreateMs,this.buckets.passkeyAuthCredentialSerializeMs=e.confirmationCredentialSerializeMs,this.buckets.passkeyAuthDuplicateRetryCount=e.confirmationDuplicateRetryCount,this.buckets.passkeyAuthMainThreadTotalMs=e.confirmationMainThreadTotalMs}routeDiagnosticsSnapshot(){return this.relayDiagnostics.map(Fa)}totalMs(){return Ma(this.startedAt)}};function Ya(){return{kind:`not_requested`,elapsedMs:0,workerPrewarmMs:0,yaoWasmInitMs:0}}function Xa(e){let t=e.recorder.totalMs(),n=e.recorder.snapshot();return{kind:`registration_timing_summary_v2`,status:`succeeded`,authMethod:e.authMethod,signerSet:e.signerSet,totalMs:t,criticalPath:Ka({totalElapsedMs:t,buckets:n,spans:e.recorder.spansSnapshot()}),relayDiagnostics:e.recorder.routeDiagnosticsSnapshot(),timings:qa({authMethod:e.authMethod,signerSet:e.signerSet,buckets:n,emailOtpYaoPrewarm:e.recorder.emailOtpYaoPrewarmSnapshot()})}}function Za(e){let t=e.recorder.totalMs(),n=e.recorder.snapshot();return{kind:`registration_timing_summary_v2`,status:`failed`,authMethod:e.authMethod,signerSet:e.signerSet,totalMs:t,criticalPath:Ka({totalElapsedMs:t,buckets:n,spans:e.recorder.spansSnapshot()}),errorCode:e.errorCode,relayDiagnostics:e.recorder.routeDiagnosticsSnapshot(),timings:qa({authMethod:e.authMethod,signerSet:e.signerSet,buckets:n,emailOtpYaoPrewarm:e.recorder.emailOtpYaoPrewarmSnapshot()})}}function Qa(e){yr()&&(console.info(ha,e),console.info(`${ha} ${JSON.stringify(e)}`))}function $a(e){let t={event:`seams_registration_timing_span_v1`,span:e.span,operation:`registration`,outcome:e.outcome,duration_ms:Math.max(0,Math.round(e.durationMs)),trace_id:e.traceContext.value};try{e.callback?.(t)}catch{}}function J(e){return{kind:`unavailable`,reason:e}}function eo(e){let t=e.selected;if(t.kind!==`resolved`)switch(t.kind){case`missing_selection`:return J(`selected_authority_missing`);case`missing_auth_method`:case`missing_authority`:case`integrity_error`:return J(`selected_authority_invalid`);default:return t}return t.selection.walletId!==e.walletId||t.authMethod.walletId!==e.walletId||t.authority.walletId!==e.walletId||t.selection.walletAuthMethodId!==t.authMethod.walletAuthMethodId||t.authMethod.walletAuthorityId!==t.authority.authorityId?J(`authority_identity_mismatch`):t.selection.lockState===`unlocked`?t.authMethod.status===`active`?t.authority.state===`active`?t.authMethod.kind===e.authMethod?{authority:t.authority,authMethod:t.authMethod}:J(`auth_method_mismatch`):J(`authority_inactive`):J(`auth_method_inactive`):J(`wallet_locked`)}function to(e){let t=e.authority.signerActivations;return e.keyFamily===`ed25519`?t.ed25519?.materialActivation??null:t.ecdsa?.materialActivation??null}function no(e){return e.session.capabilitySubjects.filter(t=>t.kind===`sign`&&t.keyFamily===e.keyFamily&&p(t.materialActivation,e.materialActivation)).length===1}function ro(e){return rr(e)?{keyFamily:`ecdsa_secp256k1`,materialActivation:e.signer.materialActivation}:{keyFamily:`ed25519`}}async function io(e){let{input:t,ports:n}=e,r;try{r=await n.resolveSelectedWalletAuthority(String(t.walletId))}catch{return J(`persistence_unavailable`)}let i=eo({selected:r,walletId:t.walletId,authMethod:t.authMethod});if(`kind`in i)return i;let a=to({authority:i.authority,keyFamily:t.requiredSigningSubject.keyFamily});if(!a)return J(`signer_material_missing`);if(t.requiredSigningSubject.keyFamily===`ecdsa_secp256k1`&&!p(t.requiredSigningSubject.materialActivation,a))return J(`signer_material_mismatch`);let o;try{o=await n.readExactWithOperationCredential({walletId:t.walletId,authorityId:i.authority.authorityId,authMethodId:i.authMethod.walletAuthMethodId})}catch{return J(`persistence_unavailable`)}switch(o.kind){case`found`:break;case`missing`:return J(`wallet_session_missing`);case`upgrade_required`:return J(`wallet_session_upgrade_required`)}let s=o.record,c=o.operationCredential;return s.walletId!==t.walletId||s.authorityId!==i.authority.authorityId||s.authMethodId!==i.authMethod.walletAuthMethodId||s.authorityDigestB64u!==i.authority.authorityDigestB64u||s.authorityRevocationEpoch!==i.authority.revocationEpoch||s.quotaId!==t.quotaId||c.walletSessionId!==t.walletSessionId||c.token.trim().length===0?J(`wallet_session_identity_mismatch`):t.expiry.kind===`unexpired`&&s.expiresAtMs<=t.expiry.nowMs?J(`wallet_session_expired`):t.expiry.kind===`expired`&&s.expiresAtMs>t.expiry.nowMs?J(`wallet_session_not_expired`):no({session:s,keyFamily:t.requiredSigningSubject.keyFamily,materialActivation:a})?{kind:`resolved`,resolved:{authMethod:i.authMethod,session:s,operationCredential:c,walletSessionId:c.walletSessionId,materialActivation:a}}:J(`wallet_session_capability_mismatch`)}function ao(e){return String(e||``).trim()}function oo(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>0?e:0}function so(e){let t=Math.floor(Number(e));return Number.isSafeInteger(t)&&t>=0?t:null}function co(e){return e.expiresAtMs<=e.nowMs?{kind:`expired`}:e.remainingUses<=0?{kind:`exhausted`}:null}function lo(e,t){let n=ao(e);return n?{kind:`wallet_session_opaque`,walletSessionToken:n,credential:{kind:`wallet_session_opaque`,walletSessionToken:n,home:t}}:null}function uo(e){let t=lo(ao(e.walletSessionToken),e.home);if(!t)return{ok:!1,reason:`missing_wallet_session_token`};let n=ao(e.walletId),r=ao(e.nearAccountId),i=ao(e.nearEd25519SigningKeyId);if(!n||!r||!i)return{ok:!1,reason:`wallet_binding_mismatch`};let a=ge(e.walletSessionId),o=_e(e.authorizationId),c=me(e.quotaId),l=s(e.thresholdSessionId);if(!a.ok||!o.ok)return{ok:!1,reason:`missing_session_identity`};if(!c.ok)return{ok:!1,reason:`missing_quota_id`};if(!l.ok)return{ok:!1,reason:`missing_threshold_session_id`};let u=so(e.nowMs),d=oo(e.remainingUses),f=oo(e.expiresAtMs);if(u==null||!Number.isSafeInteger(e.remainingUses)||!Number.isSafeInteger(e.expiresAtMs)||e.remainingUses<0||e.expiresAtMs<=0)return{ok:!1,reason:`invalid_budget`};let p=co({remainingUses:Math.max(0,Math.floor(e.remainingUses)),expiresAtMs:Math.max(0,Math.floor(e.expiresAtMs)),nowMs:u});if(p?.kind===`expired`)return{ok:!1,reason:`expired`};if(p?.kind===`exhausted`)return{ok:!1,reason:`exhausted`};let m;try{m=re(e.runtimePolicyScope)}catch{return{ok:!1,reason:`missing_signing_root`}}return m.signingRootId!==ao(e.signingRootId)||m.signingRootVersion!==ao(e.signingRootVersion)?{ok:!1,reason:`signing_root_mismatch`}:{ok:!0,value:{curve:`ed25519`,auth:t,walletSessionId:a.value,authorizationId:o.value,quotaId:c.value,thresholdSessionId:l.value,remainingUses:d,expiresAtMs:f,runtimePolicyScope:e.runtimePolicyScope,signingRootId:m.signingRootId,signingRootVersion:ao(m.signingRootVersion),routerAbNormalSigning:e.routerAbNormalSigning}}}const fo=Ke.signingSessionSeals,po=Ke.signingSessionRestoreLeases,mo=[Je.ed25519ThresholdSessionId,Je.ecdsaThresholdSessionId];function ho(e){return new Promise((t,n)=>{e.onsuccess=()=>t(e.result),e.onerror=()=>n(e.error||Error(`IndexedDB request failed`))})}function go(e){return new Promise((t,n)=>{e.oncomplete=()=>t(),e.onabort=()=>n(e.error||Error(`IndexedDB transaction aborted`)),e.onerror=()=>n(e.error||Error(`IndexedDB transaction failed`))})}async function _o(){if(Ye.isDisabled())return null;try{return qe(await Ye.getDB())}catch{return null}}function vo(e,t){return new Promise((n,r)=>{let i=[],a=e.openCursor(t);a.onsuccess=()=>{let e=a.result;if(!e){n(i);return}i.push({primaryKey:e.primaryKey,value:e.value}),e.continue()},a.onerror=()=>r(a.error||Error(`IndexedDB cursor failed`))})}function yo(e){return new Promise((t,n)=>{let r=[],i=e.openCursor();i.onsuccess=()=>{let e=i.result;if(!e){t(r);return}r.push({primaryKey:e.primaryKey,value:e.value}),e.continue()},i.onerror=()=>n(i.error||Error(`IndexedDB cursor failed`))})}async function bo(e,t){let n=new Map;for(let r of mo)try{let i=await vo(e.index(r),t);for(let e of i)n.set(String(e.primaryKey),e)}catch{}return n.size?[...n.values()]:await yo(e).catch(()=>[])}const Y=new class{async collectAllRawSealedRecordEntries(){let e=await _o();if(!e)return[];let t=e.transaction(fo,`readonly`),n=await yo(t.objectStore(fo));return await go(t).catch(()=>void 0),n}async collectRawSealedRecordEntriesByThresholdSessionId(e){let t=await _o();if(!t)return[];let n=t.transaction(fo,`readonly`),r=await bo(n.objectStore(fo),e);return await go(n).catch(()=>void 0),r}async replaceSealedRecord(e){let t=await _o();if(!t)return;let n=t.transaction(fo,`readwrite`),r=n.objectStore(fo);for(let t of e.staleStoreKeys)r.delete(t);r.put(e.row),await go(n)}async replaceSealedRecordAndDeleteRestoreLease(e){let t=await _o();if(!t)return!1;let n=t.transaction([fo,po],`readwrite`),r=n.objectStore(fo);for(let t of e.staleStoreKeys)r.delete(t);return r.put(e.row),n.objectStore(po).delete(e.restoreLeaseKey),await go(n),!0}async deleteSealedRecords(e){if(!e.length)return;let t=await _o();if(!t)return;let n=t.transaction(fo,`readwrite`),r=n.objectStore(fo);for(let t of e)r.delete(t);await go(n).catch(()=>void 0)}async deleteRestoreLease(e){let t=await _o();if(!t)return;let n=t.transaction(po,`readwrite`);n.objectStore(po).delete(e),await go(n).catch(()=>void 0)}async deleteRestoreLeaseIf(e){let t=await _o();if(!t)return;let n=t.transaction(po,`readwrite`),r=n.objectStore(po),i=await ho(r.get(e.leaseKey));e.shouldDelete(i)&&r.delete(e.leaseKey),await go(n).catch(()=>void 0)}async withRestoreLeaseTransaction(e,t){let n=await _o();if(!n)return null;try{let r=n.transaction([fo,po],`readwrite`),i=r.objectStore(fo),a=r.objectStore(po),o=await bo(i,e),s=!1,c=await t({entries:o,getRawRestoreLease:async e=>await ho(a.get(e)),putRestoreLease:e=>a.put(e),abort:()=>{s=!0}});return s?(r.abort(),c):(await go(r),c)}catch{return null}}};function xo(e){throw Error(`Unhandled durable sealed-session identity: ${String(e)}`)}function So(e){return{kind:`delete_durable_sealed_session`,durableRecord:e.durableRecord,deleteReason:e.deleteReason,preserveResolvedIdentity:e.preserveResolvedIdentity}}function Co(e){switch(e.curve){case`ed25519`:return{authMethod:e.authMethod,curve:`ed25519`};case`ecdsa`:return{authMethod:e.authMethod,curve:`ecdsa`,chainTarget:e.chainTarget};default:return xo(e)}}function wo(e){return[`ecdsa-material-v2`,e.walletId,e.authMethod,Le(e.chainTarget),e.materialActivation.activationId,e.materialActivation.capability,e.materialActivation.materialOwner,e.materialActivation.keyBinding,e.materialActivation.lifecycleBinding,e.materialActivation.signingWorker].map(e=>encodeURIComponent(String(e))).join(`:`)}const To=`ecdsa_inactive_sealed_material_v1`,Eo=`sealed_record`;function Do(e){let t=C(e)??{},n=o(t.ed25519),r=o(t.ecdsa);return{...n?{ed25519:n}:{},...r?{ecdsa:r}:{}}}function Oo(e){return Do((C(e)??{}).thresholdSessionIds)}function ko(e){let t=C(e);if(!t)return!1;let n=[`signing`,`Grant`,`Id`].join(``),r=[`signing`,`grant`,`id`].join(`_`);return Object.prototype.hasOwnProperty.call(t,n)||Object.prototype.hasOwnProperty.call(t,r)}function Ao(e){let t=String(e||``).trim();return t===`ed25519`||t===`ecdsa`?t:void 0}function jo(e){let t=C(e);return t&&Eo in t?t[Eo]:e}function Mo(e){let t=e.ecdsaRestore?.chainTarget,n=o(e.thresholdSessionIds.ecdsa),r=o(e.thresholdSessionIds.ed25519);return{store_key:e.storeKey,wallet_id:e.walletId,auth_method:e.authMethod,curve:e.curve,signing_root_id:o(`signingRootId`in e?e.signingRootId:void 0),signing_root_version:o(`signingRootVersion`in e?e.signingRootVersion:void 0),ed25519_threshold_session_id:r,ecdsa_threshold_session_id:n,threshold_session_id:n||r,key_handle:o(e.ecdsaRestore?.keyHandle),chain_target_key:t?Le(t):void 0,expires_at_ms:e.expiresAtMs,updated_at:e.updatedAtMs,[Eo]:e}}function No(e){return{store_key:e.storeKey,wallet_id:e.walletId,auth_method:e.authMethod,curve:e.curve,key_handle:e.ecdsaRestore.keyHandle,chain_target_key:Le(e.ecdsaRestore.chainTarget),updated_at:e.updatedAtMs,[Eo]:e}}function Po(e){return Mo(e)}function Fo(e){let t=String(e||``).trim().toLowerCase();return/^0x[0-9a-f]{40}$/.test(t)?t:void 0}function Io(e){return e.curve?e.curve:e.thresholdSessionIds.ecdsa?`ecdsa`:e.thresholdSessionIds.ed25519?`ed25519`:null}function Lo(e){try{return ot(e)}catch{return null}}function Ro(e){switch(e){case`login`:case`registration`:case`manual-bootstrap`:case`email_otp`:return e;default:return null}}function zo(e){try{let t=re(F(e)),n=o(t.signingRootId),r=o(t.signingRootVersion);return n&&r?{signingRootId:n,signingRootVersion:r}:null}catch{return null}}function Bo(e){let t=C(e);if(!t)return;let n=null;try{n=Pe(C(t.chainTarget)??{})}catch{n=null}let r=Ro(t.source),i=yt(t.authority),a=o(t.rpId),s=t.runtimePolicyScope&&typeof t.runtimePolicyScope==`object`?t.runtimePolicyScope:void 0,c=zo(s),l=o(t.signingRootId),u=o(t.signingRootVersion);if(l&&c?.signingRootId&&l!==c.signingRootId||u&&c?.signingRootVersion&&u!==c.signingRootVersion)return;let d=l||c?.signingRootId||``,f=u||c?.signingRootVersion||``,p=o(t.credentialIdB64u),m=null;try{m=un(t.roleLocalMaterialRef)}catch{m=null}let h=ct(t.emailOtpAuthority),g=t.provider===`google`||t.provider===`email`?t.provider:null,_=o(t.providerSubjectId),v=o(t.emailHashHex),y=o(t.keyHandle),b=o(t.ecdsaThresholdKeyId),x=Fo(t.ethereumAddress),S=o(t.relayerKeyId),w=o(t.thresholdEcdsaPublicKeyB64u),T=Lo(t.routerAbEcdsaDerivationNormalSigning),E=null;try{E=St(t.publicCapability)}catch{E=null}let D=Jo(t.participantIds);if(!n||!r||!d||!f||!y||!x||!S||!T||!E||!D.length)return;let O=p&&a&&m&&i&&r!==`email_otp`?{source:r,authority:i,roleLocalMaterialRef:m,rpId:a,credentialIdB64u:p}:_&&g&&v&&m&&i&&h&&r===`email_otp`?{source:r,provider:g,providerSubjectId:_,emailHashHex:v,authority:i,emailOtpAuthority:h,roleLocalMaterialRef:m}:null;if(!O)return;let k=o(t.clientVerifyingShareB64u);return{chainTarget:n,signingRootId:d,signingRootVersion:f,...O,keyHandle:y,...b?{ecdsaThresholdKeyId:b}:{},ethereumAddress:x,relayerKeyId:S,...k?{clientVerifyingShareB64u:k}:{},...w?{thresholdEcdsaPublicKeyB64u:w}:{},participantIds:D,routerAbEcdsaDerivationNormalSigning:T,publicCapability:E,...s?{runtimePolicyScope:s}:{}}}function Vo(e){let t=C(e);if(!t)return;let r=o(t.nearAccountId),i=o(t.nearEd25519SigningKeyId),a=o(t.rpId),s=o(t.credentialIdB64u),c=o(t.providerSubjectId),u=t.provider===`google`||t.provider===`email`?t.provider:null,d=o(t.emailHashHex),f=o(t.authSubjectId),p=o(t.relayerKeyId),m=Jo(t.participantIds),h=n(t.signerSlot),g=oe(t.routerAbNormalSigning),_=l(t.materialActivation),v=s&&!c&&_.ok?{credentialIdB64u:s,materialActivation:_.value}:u&&c&&d&&!s&&_.ok?{provider:u,providerSubjectId:c,emailHashHex:d,materialActivation:_.value}:null;if(!(!r||!i||!a||!p||!m.length||h==null||h<=0||!g||!v||f))return{nearAccountId:r,nearEd25519SigningKeyId:i,rpId:a,...v,relayerKeyId:p,participantIds:m,...t.runtimePolicyScope&&typeof t.runtimePolicyScope==`object`?{runtimePolicyScope:t.runtimePolicyScope}:{},signerSlot:h,routerAbNormalSigning:g}}function Ho(e){let t=e.restore.materialActivation;return[`ed25519-material-v2`,e.walletId,e.authMethod,`ed25519`,t.activationId,t.capability,t.materialOwner,t.keyBinding,t.lifecycleBinding,t.signingWorker].map(Wo).join(`:`)}function Uo(e){let t=e.restore.roleLocalMaterialRef;return[`inactive-material`,e.walletId,e.authMethod,`ecdsa`,Le(e.restore.chainTarget),t.materialActivation.activationId].map(Wo).join(`:`)}function Wo(e){return encodeURIComponent(String(e||``).trim())}function Go(e){let t=String(e||``).trim();return t===`passkey`||t===`email_otp`?t:void 0}function Ko(e){let t=C(e);return!!(o(t?.subjectId)||o(t?.userId))}function qo(e){let t=C(e);return!!(o(t?.signingRootId)||o(t?.signingRootVersion))}function Jo(e){return Array.isArray(e)?e.map(e=>Math.floor(Number(e))).filter(e=>Number.isFinite(e)&&e>0):[]}function Yo(e){return{authMethod:o(e?.authMethod)||null,curve:o(e?.curve)||null,storeKey:o(e?.storeKey)||null,walletId:o(e?.walletId)||null,thresholdSessionIds:Oo(e),hasEcdsaRestore:!!C(e?.ecdsaRestore),hasEd25519Restore:!!C(e?.ed25519Restore),issuedAtMs:n(e?.issuedAtMs),expiresAtMs:n(e?.expiresAtMs),remainingUses:n(e?.remainingUses),updatedAtMs:n(e?.updatedAtMs)}}function X(e,t,n){return{kind:e,storeKey:o(t?.storeKey)||null,walletId:o(t?.walletId)||null,reason:n,safeSummary:Yo(t)}}function Xo(e){return{v:2,alg:le,storageScope:ce,authMethod:e,secretKind:ue}}function Zo(e){e=jo(e);let t=C(e);if(!t)return X(`malformed`,null,`invalid_payload`);if(ko(t))return X(`delete_required`,t,`invalid_identity`);if(t.recordKind===`ecdsa_reauth_anchor_v1`)return X(`delete_required`,t,`invalid_header`);if(t.recordKind===To){let e=es(t);return e?{kind:`ecdsa_inactive_material`,record:e}:X(`malformed`,t,`invalid_identity`)}if(Number(t.v)===1)return X(`delete_required`,t,`invalid_header`);if(Number(t.v)!==2||String(t.alg||``).trim()!==`shamir3pass-v2`||String(t.storageScope||``).trim()!==`iframe_origin_indexeddb`||String(t.secretKind||``).trim()!==`signing_session_secret32`)return X(`malformed`,t,`invalid_header`);let r=String(t.authMethod||``).trim(),i=Oo(t),a=o(t.sealedSecretB64u),s=Ao(t.curve),c=o(t.subjectId),l=o(t.userId),u=o(t.walletId),d=o(t.signingRootId),f=o(t.signingRootVersion),p=f||(d?`default`:null),m=o(t.relayerUrl),h=o(t.keyVersion),g=o(t.groupId),_=n(t.issuedAtMs),v=n(t.expiresAtMs),y=n(t.remainingUses),b=n(t.updatedAtMs);if(!a||!h||g!==`rfc2409-group2`||r!==`passkey`&&r!==`email_otp`||!i.ed25519&&!i.ecdsa||!u)return X(`malformed`,t,`invalid_identity`);let x=Io({curve:s,thresholdSessionIds:i});if(!x||_==null||_<=0||v==null||v<=0||y==null||y<0||b==null||b<=0)return X(`malformed`,t,`invalid_identity`);let S=C(t.ecdsaRestore),w=C(t.ed25519Restore),T=Bo(t.ecdsaRestore),E=Vo(t.ed25519Restore);if(x===`ecdsa`){if(!i.ecdsa)return X(`malformed`,t,`invalid_identity`);if(c||l||d||f)return X(`delete_required`,t,`invalid_identity`);if(!S||!m)return X(`rebuild_required`,t,`missing_restore_metadata`);if(!Jo(S.participantIds).length)return X(`delete_required`,t,`missing_participant_ids`);if(!T)return X(`rebuild_required`,t,`missing_restore_metadata`);let e=wo({walletId:u,authMethod:r,chainTarget:T.chainTarget,materialActivation:T.roleLocalMaterialRef.materialActivation}),n=o(t.storeKey);return n&&n!==e?X(`malformed`,t,`invalid_identity`):{kind:`current`,record:{...Xo(r),storeKey:e,thresholdSessionIds:{...i.ed25519?{ed25519:i.ed25519}:{},ecdsa:i.ecdsa},sealedSecretB64u:a,curve:`ecdsa`,walletId:u,relayerUrl:m,keyVersion:h,groupId:ae,ecdsaRestore:T,...E?{ed25519Restore:E}:{},issuedAtMs:_,expiresAtMs:v,remainingUses:y,updatedAtMs:b}}}if(!i.ed25519)return X(`malformed`,t,`invalid_identity`);if(c||l)return X(`delete_required`,t,`invalid_identity`);if(!w||!m)return X(`rebuild_required`,t,`missing_restore_metadata`);if(!Jo(w.participantIds).length)return X(`delete_required`,t,`missing_participant_ids`);if(!E)return X(`rebuild_required`,t,`missing_restore_metadata`);let D=Ho({walletId:u,authMethod:r,restore:E}),O=o(t.storeKey);return O&&O!==D?X(`malformed`,t,`invalid_identity`):{kind:`current`,record:{...Xo(r),storeKey:D,thresholdSessionIds:{ed25519:i.ed25519,...i.ecdsa?{ecdsa:i.ecdsa}:{}},sealedSecretB64u:a,curve:`ed25519`,walletId:u,...d?{signingRootId:d}:{},...p?{signingRootVersion:p}:{},relayerUrl:m,keyVersion:h,groupId:ae,...T?{ecdsaRestore:T}:{},ed25519Restore:E,issuedAtMs:_,expiresAtMs:v,remainingUses:y,updatedAtMs:b}}}function Qo(e){let t=Zo(jo(e));return t.kind===`current`?t.record:null}function $o(e){let t=C(e);if(!t||t.clientVerifyingShareB64u!=null)return null;let n,r,i,a;try{n=Pe(t.chainTarget&&typeof t.chainTarget==`object`?t.chainTarget:{}),r=F(t.runtimePolicyScope);let e=ot(t.routerAbEcdsaDerivationNormalSigning);if(!e)return null;i=e,a=St(t.publicCapability)}catch{return null}let s=o(t.signingRootId),c=o(t.signingRootVersion),l=null;try{l=un(t.roleLocalMaterialRef)}catch{l=null}let u=yt(t.authority),d=ct(t.emailOtpAuthority),f=o(t.keyHandle),p=o(t.ecdsaThresholdKeyId),m=o(t.ethereumAddress),h=o(t.relayerKeyId),g=o(t.thresholdEcdsaPublicKeyB64u),_=Jo(t.participantIds);if(!s||!c||!f||!p||!m||!h||!g||!_.length)return null;let v={chainTarget:n,signingRootId:s,signingRootVersion:c,keyHandle:f,ecdsaThresholdKeyId:p,ethereumAddress:m,relayerKeyId:h,thresholdEcdsaPublicKeyB64u:g,participantIds:_,runtimePolicyScope:r,routerAbEcdsaDerivationNormalSigning:i,publicCapability:a};switch(t.source){case`email_otp`:{let e=t.provider===`google`||t.provider===`email`?t.provider:null,n=o(t.providerSubjectId),r=o(t.emailHashHex);return!e||!n||!r||!l||!u||!d||t.rpId!=null||t.credentialIdB64u!=null?null:{...v,source:`email_otp`,provider:e,providerSubjectId:n,emailHashHex:r,authority:u,emailOtpAuthority:d,roleLocalMaterialRef:l}}case`login`:case`registration`:case`manual-bootstrap`:{let e=o(t.rpId),n=o(t.credentialIdB64u);return!e||!n||!l||!u||t.providerSubjectId!=null||t.emailHashHex!=null?null:{...v,source:t.source,authority:u,roleLocalMaterialRef:l,rpId:e,credentialIdB64u:n}}default:return null}}function es(e){let t=C(jo(e));if(!t||t.recordKind!==To||ko(t)||t.thresholdSessionIds!=null||t.ed25519Restore!=null||t.curve!==`ecdsa`)return null;let r=Go(t.authMethod),i=o(t.walletId),a=o(t.relayerUrl),s=$o(t.ecdsaRestore),c=o(t.sealedSecretB64u),l=o(t.keyVersion),u=o(t.groupId),d=n(t.updatedAtMs),f=t.authorizationRetirementReason;if(!r||!i||!a||!s||t.alg!==`shamir3pass-v2`||t.storageScope!==`iframe_origin_indexeddb`||t.secretKind!==`signing_session_secret32`||!c||!l||u!==`rfc2409-group2`||t.issuedAtMs!=null||t.expiresAtMs!=null||t.remainingUses!=null||d==null||d<=0||f!==`expired`&&f!==`exhausted`)return null;let p=Uo({walletId:i,authMethod:r,restore:s});return o(t.storeKey)===p?ts({storeKey:p,walletId:i,relayerUrl:a,sealedSecretB64u:c,keyVersion:l,updatedAtMs:d,authorizationRetirementReason:f,authMethod:r,ecdsaRestore:s}):null}function ts(e){let{authMethod:t,ecdsaRestore:n}=e,r={recordKind:To,storeKey:e.storeKey,curve:`ecdsa`,walletId:e.walletId,relayerUrl:e.relayerUrl,alg:le,storageScope:ce,secretKind:ue,sealedSecretB64u:e.sealedSecretB64u,keyVersion:e.keyVersion,groupId:ae,updatedAtMs:e.updatedAtMs,authorizationRetirementReason:e.authorizationRetirementReason};return t===`email_otp`&&n.source===`email_otp`||t===`passkey`&&n.source!==`email_otp`?{...r,authMethod:t,ecdsaRestore:n}:null}function ns(e){if(e.classification.kind===`ecdsa_inactive_material`||e.classification.kind===`rebuild_required`)return;let t=e.classification.kind===`malformed`?`malformed`:`rejected`,n={operation:e.operation,outcome:t,classificationKind:e.classification.kind,...e.classification};console.warn(`[SigningSessionSealedStore] rejected sealed record`,n)}function rs(e){let t=String(e.thresholdSessionId||``).trim(),r=Ao(e.curve),i=e.authMethod===`passkey`||e.authMethod===`email_otp`?e.authMethod:void 0;if(!r||!i)return null;let a=is({thresholdSessionId:t,curve:r,thresholdSessionIds:e.thresholdSessionIds}),s=o(e.walletId),c=o(e.sealedSecretB64u),l=n(e.expiresAtMs),u=n(e.remainingUses),d=n(e.issuedAtMs),f=n(e.updatedAtMs),p=o(e.keyVersion);if(!t||!c||!p||e.groupId!==`rfc2409-group2`||!a.ed25519&&!a.ecdsa||d==null||d<=0||l==null||l<=0||u==null||u<0||f==null||f<=0)return null;let m=Bo(e.ecdsaRestore),h=Vo(e.ed25519Restore);if(Ko(e)||r===`ecdsa`&&(!m?.chainTarget||!s||qo(e)))return null;let g,_;e.curve===`ed25519`&&(g=o(e.signingRootId),_=o(e.signingRootVersion));let v=Zo({...Xo(i),thresholdSessionIds:a,sealedSecretB64u:c,curve:r,...s?{walletId:s}:{},...g?{signingRootId:g}:{},..._?{signingRootVersion:_}:{},...o(e.relayerUrl)?{relayerUrl:o(e.relayerUrl)}:{},keyVersion:p,groupId:ae,...m?{ecdsaRestore:m}:{},...h?{ed25519Restore:h}:{},issuedAtMs:d,expiresAtMs:l,remainingUses:u,updatedAtMs:f});return v.kind===`current`?v.record:(ns({operation:`build current sealed session record`,classification:v}),null)}function is(e){let t=Do(e.thresholdSessionIds),n=String(e.thresholdSessionId||``).trim();return n&&(e.curve===`ed25519`&&t.ed25519===n||e.curve===`ecdsa`&&t.ecdsa===n)?t:{}}function as(e,t){let n=o(t),r=o(e.ecdsaThresholdKeyId),i=o(e.thresholdEcdsaPublicKeyB64u);if(!n||!r||!i)return null;let a;try{a=F(e.runtimePolicyScope)}catch{return null}let s={chainTarget:e.chainTarget,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,keyHandle:e.keyHandle,ecdsaThresholdKeyId:r,ethereumAddress:e.ethereumAddress,relayerKeyId:e.relayerKeyId,thresholdEcdsaPublicKeyB64u:i,participantIds:[...e.participantIds],runtimePolicyScope:a,routerAbEcdsaDerivationNormalSigning:e.routerAbEcdsaDerivationNormalSigning,publicCapability:e.publicCapability};switch(e.source){case`email_otp`:return{...s,source:`email_otp`,provider:e.provider,providerSubjectId:e.providerSubjectId,emailHashHex:e.emailHashHex,authority:e.authority,emailOtpAuthority:e.emailOtpAuthority,roleLocalMaterialRef:un(e.roleLocalMaterialRef)};case`login`:case`registration`:case`manual-bootstrap`:return{...s,source:e.source,authority:e.authority,roleLocalMaterialRef:un(e.roleLocalMaterialRef),rpId:e.rpId,credentialIdB64u:e.credentialIdB64u}}}function os(e){let t=e.record,n=as(t.ecdsaRestore,t.relayerUrl);return n?ts({storeKey:Uo({walletId:t.walletId,authMethod:t.authMethod,restore:n}),walletId:t.walletId,relayerUrl:t.relayerUrl,sealedSecretB64u:t.sealedSecretB64u,keyVersion:t.keyVersion,updatedAtMs:e.updatedAtMs,authorizationRetirementReason:e.retirement,authMethod:t.authMethod,ecdsaRestore:n}):null}function ss(e){let t=os(e);if(!t)throw Error(`[SigningSessionSealedStore] inactive ECDSA material requires exact public restore facts`);return t}const cs=15e3;function ls(e){return R(e,32,`sealed signing session restore IDs`)}function us(e){return{lease_key:e.leaseKey,owner_id:e.ownerId,attempt_id:e.attemptId,started_at_ms:e.startedAtMs,expires_at_ms:e.expiresAtMs,lease:e}}function ds(e){let t=new Set,n=o(e.walletId);return n&&t.add(n),t}function fs(e,t){let n=ds(e);if(!n.size)return!1;for(let e of ds(t))if(n.has(e))return!0;return!1}function ps(e,t){if(!fs(e,t)||e.authMethod!==t.authMethod||e.curve!==t.curve)return!1;if(e.curve===`ed25519`&&t.curve===`ed25519`)return p(e.ed25519Restore.materialActivation,t.ed25519Restore.materialActivation);if(e.curve===`ecdsa`){let n=o(e.ecdsaRestore?.keyHandle),r=o(t.ecdsaRestore?.keyHandle);if(!n||!r||n!==r)return!1;let i=e.ecdsaRestore?.chainTarget,a=t.ecdsaRestore?.chainTarget;if(!i||!a||!ze(i,a))return!1}return!0}function ms(e){return x({storeKey:e.storeKey,walletId:e.walletId,authMethod:e.authMethod,signingRootId:e.signingRootId??null,signingRootVersion:e.signingRootVersion??null,restore:e.ed25519Restore})}function hs(e,t){if(typeof e.primaryKey!=`string`||!e.primaryKey.trim())throw Error(`[SigningSessionSealedStore] exact Ed25519 record key is invalid`);return{primaryKey:e.primaryKey,record:t}}function gs(e,t){return e.record.updatedAtMs===t.record.updatedAtMs?e.primaryKey===e.record.storeKey?e:t.primaryKey===t.record.storeKey?t:e.primaryKey.localeCompare(t.primaryKey)<=0?e:t:e.record.updatedAtMs>t.record.updatedAtMs?e:t}async function _s(e,t={writeCanonical:!1}){let n=e[0];if(!n)return null;let r=ms(n.record);for(let t of e.slice(1))if(ms(t.record)!==r)throw Error(`[SigningSessionSealedStore] exact Ed25519 material has conflicting public identity facts`);let i=e.reduce(gs),a=i.record.storeKey,o=[...new Set(e.map(e=>e.primaryKey))].filter(e=>e!==a);return(t.writeCanonical||o.length>0||i.primaryKey!==a)&&await Y.replaceSealedRecord({row:Po(i.record),staleStoreKeys:o}),i.record}async function vs(e){let t=jo(e.value),n=Zo(t);if(n.kind!==`current`)return n;let r=C(t);return ko(C(e.value))||ko(r)?X(`delete_required`,r,`invalid_identity`):n}function ys(e){return Oo(jo(e))}function bs(e,t,n,r){ns({operation:e,classification:t}),(t.kind===`delete_required`||t.kind===`malformed`)&&r.push(n)}function xs(e){let t=C(e);if(!t)return null;if(C(t.lease))return xs(t.lease);if(Number(t.v)!==1||ko(t))return null;let r=o(t.leaseKey),i=o(t.ownerId),a=o(t.attemptId),s=n(t.startedAtMs),c=n(t.expiresAtMs);return!r||!i||!a||s==null||s<=0||c==null||c<=s?null:{v:1,leaseKey:r,ownerId:i,attemptId:a,startedAtMs:s,expiresAtMs:c}}function Ss(e){return{v:1,leaseKey:e.leaseKey,ownerId:e.ownerId,attemptId:ls(`restore-attempt`),startedAtMs:e.nowMs,expiresAtMs:e.nowMs+e.ttlMs}}function Cs(e,t,n){return!(e.authMethod!==n.authMethod||e.thresholdSessionIds[n.curve]!==t||n.curve===`ecdsa`&&(!e.ecdsaRestore?.chainTarget||!ze(e.ecdsaRestore.chainTarget,n.chainTarget)))}function ws(e,t){if(e?.authMethod&&e.curve===`ed25519`||e?.authMethod&&e.curve===`ecdsa`&&e.chainTarget)return e;throw console.warn(`[SigningSessionSealedStore] rejected ambiguous sealed record access`,{operation:t}),Error(`[SigningSessionSealedStore] ${t} requires an explicit authMethod, curve, and ECDSA chain target`)}async function Ts(e){let t=await Y.collectRawSealedRecordEntriesByThresholdSessionId(e);return t.length?t:(await Y.collectAllRawSealedRecordEntries()).filter(t=>{let n=ys(t.value);return n.ed25519===e||n.ecdsa===e})}async function Es(e,t,n){let r=await Ts(e),i=null,a=[],o=[];for(let s of r){let r=await vs(s);if(r.kind===`current`){Cs(r.record,e,t)&&(i=r.record,r.record.curve===`ed25519`&&a.push(hs(s,r.record)));continue}bs(n,r,s.primaryKey,o)}return await Y.deleteSealedRecords(o),a.length>0?await _s(a):i}async function Ds(e,t){try{let n=await Ts(e),r=[];for(let i of n){let n=await vs(i),a=n.kind===`current`?n.record:null;a?.storeKey&&Cs(a,e,t)&&r.push(i.primaryKey)}await Y.deleteSealedRecords(r)}catch{}}async function Os(e){if(!ds(e).size||!e.authMethod)return[];try{let t=await Y.collectAllRawSealedRecordEntries(),n=[];for(let r of t){let t=await vs(r),i=t.kind===`current`?t.record:null;i&&i.storeKey!==e.storeKey&&ps(i,e)&&n.push(i)}return n}catch{return[]}}function ks(e){if(e.curve!==`ecdsa`)return null;let t=as(e.ecdsaRestore,e.relayerUrl);return t?Uo({walletId:e.walletId,authMethod:e.authMethod,restore:t}):null}async function As(e,t){let n=ws(t,`read`),r=String(e||``).trim();return r?await Es(r,n,`read`):null}function js(e,t){return e.curve===`ed25519`&&e.authMethod===t.authMethod&&p(e.ed25519Restore.materialActivation,t.materialActivation)}async function Ms(e){let t=await Y.collectAllRawSealedRecordEntries(),n=[],r=[];for(let i of t){let t=await vs(i);if(t.kind===`current`){let n=t.record;js(n,e)&&r.push(hs(i,n));continue}bs(`read exact Ed25519 material`,t,i.primaryKey,n)}return await Y.deleteSealedRecords(n),await _s(r)}async function Ns(e){let t=o(e.walletId);if(!t)return[];let n=ws(e.filter,`list exact account records`),r=e.filter.curve===`ecdsa`?e.filter.chainTarget:void 0,i=await Y.collectAllRawSealedRecordEntries(),a=[];try{let e=[],o=new Set,s=new Map;for(let c of i){let i=await vs(c);if(i.kind!==`current`){bs(`list exact account records`,i,c.primaryKey,a);continue}let l=i.record;if(l.walletId===t&&l.authMethod===n.authMethod&&l.thresholdSessionIds[n.curve]&&!(r&&(!l.ecdsaRestore?.chainTarget||!ze(l.ecdsaRestore.chainTarget,r)))){if(l.curve===`ed25519`){let e=s.get(l.storeKey)??[];e.push(hs(c,l)),s.set(l.storeKey,e);continue}o.has(l.storeKey)||(o.add(l.storeKey),e.push(l))}}for(let t of s.values()){let n=await _s(t);n&&e.push(n)}return await Y.deleteSealedRecords(a),e}finally{await Y.deleteSealedRecords(a)}}async function Ps(e){let t=o(e.walletId);if(!t)return[];if(e.filter.curve!==`ecdsa`)return console.warn(`[SigningSessionSealedStore] rejected non-ECDSA wallet-scoped list`,{operation:`list wallet ecdsa records`}),[];let n=await Y.collectAllRawSealedRecordEntries(),r=[];try{let i=[],a=new Set;for(let o of n){let n=await vs(o);if(n.kind===`ecdsa_inactive_material`){let r=n.record;if(r.walletId!==t||e.filter.authMethod&&r.authMethod!==e.filter.authMethod||a.has(r.storeKey))continue;a.add(r.storeKey),i.push(r);continue}if(n.kind!==`current`){bs(`list wallet ecdsa records`,n,o.primaryKey,r);continue}let s=n.record;s.walletId===t&&(e.filter.authMethod&&s.authMethod!==e.filter.authMethod||s.thresholdSessionIds.ecdsa&&s.ecdsaRestore?.chainTarget&&(a.has(s.storeKey)||(a.add(s.storeKey),i.push(s))))}return await Y.deleteSealedRecords(r),i}finally{await Y.deleteSealedRecords(r)}}async function Fs(e){let t=Zo(e);if(t.kind!==`current`){ns({operation:`write exact sealed session`,classification:t});return}let n=t.record;if(n.curve===`ed25519`){let e=[{primaryKey:n.storeKey,record:n}],t=await Y.collectAllRawSealedRecordEntries();for(let r of t){let t=await vs(r);t.kind===`current`&&t.record.curve===`ed25519`&&t.record.storeKey===n.storeKey&&e.push(hs(r,t.record))}await _s(e,{writeCanonical:!0});return}let r=await Os(n),i=ks(n);await Y.replaceSealedRecord({row:Po(n),staleStoreKeys:[...r.map(e=>e.storeKey),...i?[i]:[]]})}function Is(e,t,n){return Ls({current:e,inactive:ss({record:e,retirement:t,updatedAtMs:n})})}async function Ls(e){await Y.replaceSealedRecordAndDeleteRestoreLease({row:No(e.inactive),staleStoreKeys:[e.current.storeKey],restoreLeaseKey:e.current.storeKey})}async function Rs(e){let t=ws(e.filter,`update policy`),n=String(e.thresholdSessionId||``).trim();if(!n)return;let r=await As(n,t);r&&await Bs(r,e)}async function zs(e){let t=await Ms(e.locator);t&&await Bs(t,e)}async function Bs(e,t){let r=n(t.expiresAtMs??e.expiresAtMs),i=n(t.remainingUses??e.remainingUses),a=n(t.updatedAtMs);if(r==null||r<=0||i==null||i<0||a==null||a<=0)return;let o={...e,expiresAtMs:r,remainingUses:i,updatedAtMs:a};if(o.curve===`ecdsa`){let e=r<=Date.now()?`expired`:i===0?`exhausted`:null;if(e){await Is(o,e,a);return}}await Fs(o)}async function Vs(e,t,n){let r=ws(t,`delete`),i=String(e||``).trim();if(!i)return;let a=await Es(i,r,`delete`);await Ds(i,r),a&&n.deleteResolvedIdentity&&await Y.deleteRestoreLease(a.storeKey)}async function Hs(e,t){let n=await Y.collectAllRawSealedRecordEntries(),r=[],i=[];for(let a of n){let n=await vs(a);if(n.kind!==`current`){ns({operation:`delete exact Ed25519 material`,classification:n});continue}let o=n.record;js(o,e)&&(r.push(a.primaryKey),t.deleteResolvedIdentity&&i.push(o.storeKey))}if(await Y.deleteSealedRecords(r),t.deleteResolvedIdentity)for(let e of i)await Y.deleteRestoreLease(e)}async function Us(e){let t=e.preserveResolvedIdentity?{deleteResolvedIdentity:!1}:{deleteResolvedIdentity:!0,resolvedIdentityDeleteReason:`durable_record_deleted`};if(e.durableRecord.curve===`ed25519`){await Hs({kind:`ed25519_durable_material`,authMethod:e.durableRecord.authMethod,materialActivation:e.durableRecord.materialActivation},t);return}let n=Co(e.durableRecord),r=await Ws(e.durableRecord.thresholdSessionId,n);if(e.preserveResolvedIdentity&&e.durableRecord.curve===`ecdsa`&&r?.curve===`ecdsa`&&(e.deleteReason===`expired`||e.deleteReason===`exhausted`)){await Is(r,e.deleteReason,Date.now());return}await Vs(e.durableRecord.thresholdSessionId,n,t)}async function Ws(e,t){try{return await As(e,t)}catch{return null}}async function Gs(e){let t=ws(e,`acquire restore lease`),r=String(e.thresholdSessionId||``).trim();if(!r)return null;let i=n(e.nowMs??Date.now())??Date.now(),a=Math.max(1,n(e.ttlMs??cs)??cs),s=o(e.ownerId)||ls(`restore-owner`);return await Es(r,t,`acquire restore lease`)?await Y.withRestoreLeaseTransaction(r,async e=>{let n=[];for(let t of e.entries){let e=Qo(t.value);e?.storeKey&&!n.some(t=>t.storeKey===e.storeKey)&&n.push(e)}let o=n.find(e=>Cs(e,r,t))||null;if(!o)return e.abort(),null;let c=xs(await e.getRawRestoreLease(o.storeKey));if(c&&c.expiresAtMs>i&&c.ownerId!==s)return e.abort(),null;let l=Ss({leaseKey:o.storeKey,ownerId:s,nowMs:i,ttlMs:a});return e.putRestoreLease(us(l)),{...l,thresholdSessionId:r}}):null}async function Ks(e){!e?.leaseKey||!e.ownerId||!e.attemptId||await Y.deleteRestoreLeaseIf({leaseKey:e.leaseKey,shouldDelete:t=>{let n=xs(t);return n?.ownerId===e.ownerId&&n.attemptId===e.attemptId}})}function qs(e){return String(e??``).trim()||null}function Js(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>0?e:null}function Ys(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0?e:null}function Xs(e){let t=P(e);return t?.length===2?[t[0],t[1]]:null}function Zs(e){let t=e.ed25519Restore;switch(e.authMethod){case We.passkey:{let e=qs(t.credentialIdB64u);return e?{kind:`passkey`,rpId:ft(t.rpId),credentialIdB64u:e}:null}case We.emailOtp:{if(!(`provider`in t))return null;let e=qs(t.providerSubjectId),n=qs(t.emailHashHex);return!e||!n?null:{kind:`email_otp`,provider:t.provider,providerSubjectId:e,emailHashHex:n}}}}function Qs(e){switch(e.kind){case`passkey`:return{kind:We.passkey,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u};case`email_otp`:return{kind:We.emailOtp,providerSubjectId:e.providerSubjectId}}}function $s(e){let t=e.ed25519Restore,n=qs(e.thresholdSessionIds.ed25519),r=qs(e.relayerUrl),i=qs(t.relayerKeyId),a=Js(e.expiresAtMs),o=Ys(e.remainingUses),s=En(t.signerSlot),c=Xs(t.participantIds),l=ie(t.runtimePolicyScope),u=l?re(l):null,d=qs(u?.signingRootVersion),f=oe(t.routerAbNormalSigning),p=Zs(e);if(!n||!r||!i||!a||o===null||!s||!c||!l||!u||!d||!f||f.signingWorkerId!==i||!p||e.signingRootId!==u.signingRootId||e.signingRootVersion!==d)return null;try{return{kind:`exact_ed25519_sealed_session_runtime`,sealedRecord:e,walletId:Fe(e.walletId),nearAccountId:z(t.nearAccountId),nearEd25519SigningKeyId:Jt(t.nearEd25519SigningKeyId),signerSlot:s,factor:p,auth:Qs(p),thresholdSessionId:Pn.thresholdEd25519Session(n),remainingUses:o,expiresAtMs:a,relayerUrl:r,relayerKeyId:i,participantIds:c,runtimePolicyScope:l,signingRootId:u.signingRootId,signingRootVersion:d,routerAbNormalSigning:f}}catch{return null}}async function ec(e){let t;switch(e.runtime.factor.kind){case`passkey`:t=bt({walletId:e.runtime.walletId,factor:{kind:`passkey`,credentialIdB64u:e.runtime.factor.credentialIdB64u},verifier:{kind:`webauthn`,rpId:e.runtime.factor.rpId},bindingId:e.walletAuthMethodId});break;case`email_otp`:t=ct({walletId:e.runtime.walletId,factor:{kind:`email_otp`,provider:e.runtime.factor.provider,providerUserId:e.runtime.factor.providerSubjectId},verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:e.runtime.factor.emailHashHex},bindingId:e.walletAuthMethodId});break;default:return tc(e.runtime.factor)}if(!t)throw Error(`[SigningEngine][near] sealed Ed25519 authority is invalid`);return await st({authority:t})}function tc(e){throw Error(`Unsupported Ed25519 factor: ${String(e)}`)}async function nc(e){let{authorization:t,runtime:n}=e;if(t.session.walletId!==n.walletId||t.session.authMethodId!==t.selectedAuthMethod.walletAuthMethodId||t.session.quotaId!==t.status.quotaId||t.operationCredential.walletSessionId!==t.status.walletSessionId||t.operationCredential.token.trim().length===0||t.status.remainingUses<=0||!ir({session:t.session,materialActivation:n.sealedRecord.ed25519Restore.materialActivation}))return!1;if(n.factor.kind===`passkey`){if(t.selectedAuthMethod.kind!==`passkey`||String(t.selectedAuthMethod.rpId)!==String(n.factor.rpId)||t.selectedAuthMethod.credentialIdB64u!==n.factor.credentialIdB64u||t.selectedFactorAuthority.factor.kind!==`passkey`||t.selectedFactorAuthority.factor.credentialIdB64u!==n.factor.credentialIdB64u||t.selectedFactorAuthority.verifier.kind!==`webauthn`||String(t.selectedFactorAuthority.verifier.rpId)!==String(n.factor.rpId))return!1}else if(t.selectedAuthMethod.kind!==`email_otp`||t.selectedAuthMethod.emailHashHex!==n.factor.emailHashHex||t.selectedFactorAuthority.factor.kind!==`email_otp`||t.selectedFactorAuthority.factor.provider!==n.factor.provider||t.selectedFactorAuthority.factor.providerUserId!==n.factor.providerSubjectId||t.selectedFactorAuthority.verifier.kind!==`email_otp_wallet_auth_method`||t.selectedFactorAuthority.verifier.emailHashHex!==n.factor.emailHashHex)return!1;try{let e=await ec({runtime:n,walletAuthMethodId:t.selectedAuthMethod.walletAuthMethodId}),r=await st({authority:t.selectedFactorAuthority});return e.walletId===t.selectedAuthority.walletId&&e.walletAuthMethodId===t.selectedAuthMethod.walletAuthMethodId&&e.walletId===r.walletId&&e.walletAuthMethodId===r.walletAuthMethodId&&e.authorityDigest===r.authorityDigest}catch{return!1}}function rc(e,t){switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId&&e.credentialIdB64u===t.credentialIdB64u;case`email_otp`:return t.kind===`email_otp`&&e.providerSubjectId===t.providerSubjectId}}function ic(e){let t=e.laneIdentity.signer,n=e.record.ed25519Restore;return e.record.walletId===t.account.wallet.walletId&&n.nearAccountId===t.account.nearAccountId&&n.nearEd25519SigningKeyId===t.nearEd25519SigningKeyId&&n.signerSlot===t.signerSlot&&e.record.thresholdSessionIds.ed25519===e.laneIdentity.thresholdSessionId}function ac(e,t){return rc(e.auth,t.auth)}async function oc(e,t){let n=(await t.listExactSealedSessionsForWallet({walletId:e.walletId,filter:{authMethod:e.laneIdentity.auth.kind,curve:`ed25519`}})).filter(t=>t.curve===`ed25519`&&ic({record:t,laneIdentity:e.laneIdentity}));if(n.length===0)return{kind:`missing`};if(n.length>1)return{kind:`conflict`};let r=$s(n[0]);return!r||!ac(r,e.laneIdentity)?{kind:`corrupt`}:{kind:`resolved`,runtime:r}}async function sc(e){return await oc(e,{listExactSealedSessionsForWallet:Ns})}async function cc(e,t){return uc(await lc(e,t))}async function lc(e,t){let n=await Promise.all([t.listExactSealedSessionsForWallet({walletId:e,filter:{authMethod:We.passkey,curve:`ed25519`}}),t.listExactSealedSessionsForWallet({walletId:e,filter:{authMethod:We.emailOtp,curve:`ed25519`}})]),r=[];for(let e of n)for(let t of e)t.curve===`ed25519`&&r.push(t);return r}function uc(e){if(e.length===0)return{kind:`missing`};if(e.length>1)return{kind:`conflict`};let t=$s(e[0]);return t?{kind:`resolved`,runtime:t}:{kind:`corrupt`}}async function dc(e){return await cc(e,{listExactSealedSessionsForWallet:Ns})}async function fc(e,t){let n=await lc(e.walletId,t),r=[];for(let t of n)t.ed25519Restore.nearAccountId===e.nearAccountId&&t.ed25519Restore.nearEd25519SigningKeyId===e.nearEd25519SigningKeyId&&r.push(t);return uc(r)}async function pc(e){return await fc(e,{listExactSealedSessionsForWallet:Ns})}function mc(e,t){let n=String(e).trim();if(!n)throw Error(`${t} is required for Ed25519 Wallet Session state`);return n}function hc(e,t){if(!Number.isSafeInteger(e)||e<1)throw Error(`${t} must be positive for Ed25519 Wallet Session state`);return e}function gc(e){let t=Pn.thresholdEd25519Session(mc(e.signingWalletSession.thresholdSessionId,`thresholdSessionId`)),n=mc(e.signingWalletSession.auth.walletSessionToken,`walletSessionToken`),r=mc(e.relayerUrl,`relayerUrl`),i=mc(e.providerSubjectId,`providerSubjectId`),a=hc(e.signerSlot,`signerSlot`),o=hc(e.signingWalletSession.remainingUses,`remainingUses`);return{walletSessionAuth:{kind:`wallet_session_opaque`,home:e.signingWalletSession.auth.credential.home,walletSessionToken:n},walletSessionId:e.signingWalletSession.walletSessionId,quotaId:e.signingWalletSession.quotaId,thresholdSessionId:t,signingLane:ur({walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:a,auth:{kind:`email_otp`,providerSubjectId:i},walletSessionId:e.signingWalletSession.walletSessionId,quotaId:e.signingWalletSession.quotaId,thresholdSessionId:t,retention:`session`,sessionOrigin:`login`}),remainingUses:o,signingRootId:e.signingWalletSession.signingRootId,signingRootVersion:e.signingWalletSession.signingRootVersion,routerAbNormalSigning:e.signingWalletSession.routerAbNormalSigning,runtimePolicyScope:e.signingWalletSession.runtimePolicyScope,relayerUrl:r,signingWalletSession:e.signingWalletSession,authority:e.authority}}function _c(e){let t=Pn.thresholdEd25519Session(mc(e.signingWalletSession.thresholdSessionId,`thresholdSessionId`)),n=mc(e.signingWalletSession.auth.walletSessionToken,`walletSessionToken`),r=mc(e.relayerUrl,`relayerUrl`),i=mc(e.credentialIdB64u,`credentialIdB64u`),a=hc(e.signerSlot,`signerSlot`);return{walletSessionAuth:{kind:`wallet_session_opaque`,home:e.signingWalletSession.auth.credential.home,walletSessionToken:n},walletSessionId:e.signingWalletSession.walletSessionId,quotaId:e.signingWalletSession.quotaId,thresholdSessionId:t,signingLane:ur({walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:a,auth:{kind:`passkey`,rpId:e.rpId,credentialIdB64u:i},walletSessionId:e.signingWalletSession.walletSessionId,quotaId:e.signingWalletSession.quotaId,thresholdSessionId:t,storageSource:`login`}),remainingUses:e.signingWalletSession.remainingUses,signingRootId:e.signingWalletSession.signingRootId,signingRootVersion:e.signingWalletSession.signingRootVersion,routerAbNormalSigning:e.signingWalletSession.routerAbNormalSigning,runtimePolicyScope:e.signingWalletSession.runtimePolicyScope,relayerUrl:r,signingWalletSession:e.signingWalletSession,authority:e.authority}}async function vc(e){let t=e.authorization.operationCredential.token,n=e.authorization.session.authorizationId,r=await ec({runtime:e.runtime,walletAuthMethodId:e.authorization.selectedAuthMethod.walletAuthMethodId}),i=await st({authority:e.authorization.selectedFactorAuthority}),a=Math.min(e.runtime.expiresAtMs,e.authorization.status.expiresAtMs);if(!t||!n||e.authorization.session.walletId!==e.runtime.walletId||e.authorization.selectedAuthMethod.kind!==e.runtime.auth.kind||r.walletId!==e.runtime.walletId||r.walletAuthMethodId!==e.authorization.selectedAuthMethod.walletAuthMethodId||r.walletId!==i.walletId||r.walletAuthMethodId!==i.walletAuthMethodId||String(r.authorityDigest)!==String(i.authorityDigest)||e.authorization.operationCredential.walletSessionId!==e.authorization.status.walletSessionId||a<=e.nowMs)throw Error(`Ed25519 Wallet Session authorization does not match sealed material`);let o=uo({walletId:e.runtime.walletId,nearAccountId:e.runtime.nearAccountId,nearEd25519SigningKeyId:e.runtime.nearEd25519SigningKeyId,walletSessionId:e.authorization.operationCredential.walletSessionId,authorizationId:n,quotaId:e.authorization.session.quotaId,thresholdSessionId:e.runtime.thresholdSessionId,remainingUses:Math.min(e.runtime.remainingUses,e.authorization.status.remainingUses),expiresAtMs:a,runtimePolicyScope:e.runtime.runtimePolicyScope,signingRootId:e.runtime.signingRootId,signingRootVersion:e.runtime.signingRootVersion,routerAbNormalSigning:e.runtime.routerAbNormalSigning,walletSessionToken:t,home:e.authorization.operationCredential.home,nowMs:e.nowMs});if(!o.ok)throw Error(`Ed25519 Wallet Session runtime is invalid: ${o.reason}`);if(e.runtime.factor.kind===`passkey`&&e.runtime.auth.kind===`passkey`)return _c({walletId:e.runtime.walletId,nearAccountId:e.runtime.nearAccountId,nearEd25519SigningKeyId:e.runtime.nearEd25519SigningKeyId,signerSlot:e.runtime.signerSlot,rpId:e.runtime.factor.rpId,credentialIdB64u:e.runtime.factor.credentialIdB64u,relayerUrl:e.runtime.relayerUrl,authority:r,signingWalletSession:o.value});if(e.runtime.factor.kind===`email_otp`&&e.runtime.auth.kind===`email_otp`)return gc({walletId:e.runtime.walletId,nearAccountId:e.runtime.nearAccountId,nearEd25519SigningKeyId:e.runtime.nearEd25519SigningKeyId,providerSubjectId:e.runtime.auth.providerSubjectId,signerSlot:e.runtime.signerSlot,relayerUrl:e.runtime.relayerUrl,authority:r,signingWalletSession:o.value});throw Error(`Ed25519 sealed runtime factor and auth binding disagree`)}function yc(e){return{thresholdSessionId:e.thresholdSessionId,signer:e.signingLane.identity.signer,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,routerAbNormalSigning:e.routerAbNormalSigning,runtimePolicyScope:e.runtimePolicyScope,relayerUrl:e.relayerUrl}}function bc(e){return e.authorization.capabilitySubjects.some(t=>t.kind===`sign`&&t.keyFamily===`ed25519`&&p(t.materialActivation,e.materialActivation))}function xc(e){let t=e.state,n=e.authorization,r=t.signingLane.identity.signer.account.wallet.walletId,i=e.operationCredential.token,a=t.signingLane.identity.signer,o=Math.min(t.signingWalletSession.expiresAtMs,n.expiresAtMs);if(!i||!bc({authorization:n,materialActivation:e.materialActivation})||n.walletId!==r||n.authMethodId!==t.authority.walletAuthMethodId||e.operationCredential.walletSessionId!==t.walletSessionId||n.authorizationId!==t.signingWalletSession.authorizationId||o<=e.nowMs||!Number.isSafeInteger(o))return null;let s=uo({walletId:String(a.account.wallet.walletId),nearAccountId:String(a.account.nearAccountId),nearEd25519SigningKeyId:String(a.nearEd25519SigningKeyId),walletSessionId:String(t.walletSessionId),authorizationId:String(t.signingWalletSession.authorizationId),quotaId:String(t.quotaId),thresholdSessionId:String(t.thresholdSessionId),remainingUses:t.remainingUses,expiresAtMs:o,runtimePolicyScope:t.runtimePolicyScope,signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,routerAbNormalSigning:t.routerAbNormalSigning,walletSessionToken:i,home:e.operationCredential.home,nowMs:e.nowMs});if(!s.ok)return null;switch(t.signingLane.auth.kind){case`passkey`:return{..._c({walletId:a.account.wallet.walletId,nearAccountId:a.account.nearAccountId,nearEd25519SigningKeyId:a.nearEd25519SigningKeyId,signerSlot:a.signerSlot,rpId:t.signingLane.auth.rpId,credentialIdB64u:t.signingLane.auth.credentialIdB64u,relayerUrl:t.relayerUrl,authority:t.authority,signingWalletSession:s.value}),walletSessionAuthorization:n,walletSessionOperationCredential:e.operationCredential};case`email_otp`:return{...gc({walletId:a.account.wallet.walletId,nearAccountId:a.account.nearAccountId,nearEd25519SigningKeyId:a.nearEd25519SigningKeyId,providerSubjectId:t.signingLane.auth.providerSubjectId,signerSlot:a.signerSlot,relayerUrl:t.relayerUrl,authority:t.authority,signingWalletSession:s.value}),walletSessionAuthorization:n,walletSessionOperationCredential:e.operationCredential};default:return Sc(t.signingLane.auth)}}function Sc(e){throw Error(`Unknown Ed25519 signing lane auth: ${String(e)}`)}async function Cc(e){let t=e.state.signingLane.identity.signer.account.wallet.walletId,n=await io({ports:e.ports,input:{walletId:t,authMethod:Nn(e.state.signingLane.auth),walletSessionId:e.state.walletSessionId,quotaId:e.state.quotaId,requiredSigningSubject:ro(e.state.signingLane.identity),expiry:{kind:`unexpired`,nowMs:e.nowMs}}});return n.kind!==`resolved`||n.resolved.authMethod.walletAuthMethodId!==e.state.authority.walletAuthMethodId?null:xc({state:e.state,authorization:n.resolved.session,operationCredential:n.resolved.operationCredential,materialActivation:n.resolved.materialActivation,nowMs:e.nowMs})}function wc(e){return lt(x({operation:`wallet_add_signer_activate_v2`,addSignerCeremonyId:e.addSignerCeremonyId,activationCorrelationId:e.activationCorrelationId,publicFacts:e.publicFacts}))}async function Tc(e){return I(await k(String(wc(e))))}function Ec(e){let t;try{t=Qt(e,`custody envelope`)}catch(e){return{ok:!1,reason:e instanceof Error?e.message:`custody envelope is invalid`}}let n=t.lifecycle.state;return n===`active`?t.binding.kind===`wallet_custody_seed_v1`?{ok:!0,custodyJson:JSON.stringify({envelopeBinding:{walletId:t.walletId,envelopeId:t.envelopeId,factor:t.factor,envelopeRevision:t.envelopeRevision,binding:t.binding,ownership:an(t.ownership)},nonceB64u:t.nonceB64u,sealedCustodySecretB64u:t.sealedCustodySecretB64u,aadHashB64u:t.aadHashB64u,ciphertextDigestB64u:t.ciphertextDigestB64u})}:{ok:!1,reason:`generic custody wire rejects non-seed envelopes`}:{ok:!1,reason:`custody envelope is ${n}`}}function Dc(e){let t={};return yr()&&(t[`X-Seams-Benchmark-Diagnostics`]=`registration-flow`),e&&(t[_n]=e.value),Object.keys(t).length>0?t:void 0}function Oc(e){let t=L(e);if(t.length!==20)throw Error(`ECDSA activation returned an invalid address`);let n=``;for(let e of t)n+=e.toString(16).padStart(2,`0`);return`0x${n}`}var kc=class extends Error{constructor(e){super(`Registration response was already committed; exact-method unlock is required`),this.code=`wallet_unlock_required`,this.next=`unlock_exact_method`,this.name=`RegistrationExactMethodUnlockRequiredError`,this.projection=e}};function Ac(e){switch(e.kind){case`issued`:return e.session;case`already_committed`:throw new kc(e.session);default:return q(e)}}function jc(e){let t=e[0];if(t)for(let n of e.slice(1)){let e=Nc(t,n);if(e)throw Error(`ECDSA registration returned partitioned EVM-family wallet key material: ${e}`)}}function Mc(e){for(let t of e.walletKeys)if(!_t(t.publicCapability,e.session.publicCapability))throw Error(`ECDSA registration wallet key public capability does not match client-verified activation`)}function Nc(e,t){return e.keyScope!==`evm-family`||t.keyScope!==`evm-family`?`keyScope`:e.walletId===t.walletId?e.evmFamilySigningKeySlotId===t.evmFamilySigningKeySlotId?e.keyHandle===t.keyHandle?e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId?e.signingRootId===t.signingRootId?e.signingRootVersion===t.signingRootVersion?e.thresholdEcdsaPublicKeyB64u===t.thresholdEcdsaPublicKeyB64u?e.thresholdOwnerAddress.trim().toLowerCase()===t.thresholdOwnerAddress.trim().toLowerCase()?e.relayerKeyId===t.relayerKeyId?e.relayerVerifyingShareB64u===t.relayerVerifyingShareB64u?e.participantIds.join(`,`)===t.participantIds.join(`,`)?null:`participantIds`:`relayerVerifyingShareB64u`:`relayerKeyId`:`thresholdOwnerAddress`:`thresholdEcdsaPublicKeyB64u`:`signingRootVersion`:`signingRootId`:`ecdsaThresholdKeyId`:`keyHandle`:`evmFamilySigningKeySlotId`:`walletId`}function Pc(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1){let r=e[n],i=t[n];if(!r||!i||Le(r)!==Le(i))return!1}return!0}async function Fc(e){try{await e.context.signingEngine.closeRouterAbEcdsaRegistrationCeremony({kind:`close_router_ab_ecdsa_registration_ceremony_v1`,ceremonyId:e.ceremonyId})}catch{return}}function Ic(e){let t=e.prepare;return{formatVersion:t.formatVersion,walletId:t.walletId,evmFamilySigningKeySlotId:t.evmFamilySigningKeySlotId,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,keyScope:t.keyScope,relayerKeyId:t.relayerKeyId,registrationPreparationId:t.registrationPreparationId,requestId:t.requestId,thresholdSessionId:t.thresholdSessionId,ttlMs:t.ttlMs,remainingUses:t.remainingUses,participantIds:[...t.participantIds],runtimePolicyScope:t.runtimePolicyScope,derivationClientSharePublicKey33B64u:e.verified.derivationClientSharePublicKey33B64u,clientShareRetryCounter:e.verified.clientShareRetryCounter,contextBinding32B64u:e.verified.contextBinding32B64u}}async function Lc(e){return{canonicalRequest:wc(e),requestDigest:be(await Tc(e))}}async function Rc(e){try{return await qn(e)}catch{return await qn(e)}}async function zc(e){return e.registrationTiming?await e.registrationTiming.measure(e.bucket,e.operation):await e.operation()}async function Bc(e){let[t,...n]=e.started.chainTargets;if(!t)throw Error(`Strict ECDSA ceremony requires at least one EVM-family target`);let r=e.addSignerCeremonyId,i=ye(r);try{let a=await zc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationClientCreateMs`,operation:e.context.signingEngine.createRouterAbEcdsaRegistrationCeremony.bind(e.context.signingEngine,{kind:`create_router_ab_ecdsa_registration_ceremony_v1`,ceremonyId:r,registration:e.started.strictRegistration})}),o=await zc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationGatewayRespondMs`,operation:Gn.bind(void 0,{relayerUrl:e.relayerUrl,walletId:e.walletId,addSignerCeremonyId:r,ecdsa:{kind:`router_ab_ecdsa_registration_v1`,strictRegistration:a.registrationRequest,requestDigestB64u:a.registrationRequestDigestB64u}})}),s=await zc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationClientProofVerifyMs`,operation:e.context.signingEngine.verifyRouterAbEcdsaRegistrationClientProofs.bind(e.context.signingEngine,{kind:`verify_router_ab_ecdsa_registration_client_proofs_v1`,bootstrapOwner:`wallet_custody`,ceremonyId:r,clientProofFinalization:{kind:`finalize_encrypted_client_proof_bundles_v2`,bundles:o.ecdsa.strictResult.response.bundles}})}),c=Ec(e.custodyEnvelope);if(!c.ok)throw Error(c.reason);let l={response:null,journalId:null},u=await e.context.signingEngine.joinWalletCustodyEvmFamilyKeySet({walletId:e.walletId,custodyJson:c.custodyJson,factorSecret:e.factorSecret,evmFamilySigningKeySlotId:e.started.prepare.evmFamilySigningKeySlotId,applicationBindingDigestB64u:s.applicationBindingDigestB64u,runRelayerRound:async a=>{let o=mt({registrationRequestDigestB64u:s.registrationRequestDigestB64u,proofTranscriptDigestB64u:s.proofTranscriptDigestB64u,contextBinding32B64u:a.contextBinding32B64u,derivationClientSharePublicKey33B64u:a.clientSharePublicKey33B64u,clientShareRetryCounter:a.clientShareRetryCounter,participantId:1}),c=await Lc({addSignerCeremonyId:r,activationCorrelationId:i,publicFacts:o}),u={bytes:Array.from(L(String(c.requestDigest)))},d=await e.context.signingEngine.persistInitialCanonicalEcdsaActivation({kind:`persist_initial_canonical_ecdsa_activation_v1`,bootstrapOwner:`wallet_custody`,ceremonyId:r,clientActivation:o,planInput:{authority:e.authority,targetMemberships:[t,...n],evmFamilySigningKeySlotId:Wt(e.started.prepare.evmFamilySigningKeySlotId,`registration ECDSA signing key slot`),ecdsaThresholdKeyId:cn(e.started.prepare.ecdsaThresholdKeyId),signingRootId:at(e.started.prepare.signingRootId),signingRootVersion:pt(e.started.prepare.signingRootVersion),runtimePolicyScope:e.started.prepare.runtimePolicyScope,clientVerifyingPublicKey33B64u:on(a.clientSharePublicKey33B64u),participantIds:[Et(e.started.prepare.participantIds[0]),Et(e.started.prepare.participantIds[1])],relayerKeyId:sn(e.started.prepare.relayerKeyId),bindingDigest:fn(a.contextBinding32B64u),journalId:i,requestDigest:c.requestDigest,canonicalRequest:c.canonicalRequest,createdAt:ve(new Date().toISOString())}});if(!d.ok)throw Error(`Canonical ECDSA activation persistence failed (${d.code}): ${d.message}`);l.journalId=d.journalId,l.response=await zc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationGatewayActivateMs`,operation:Rc.bind(void 0,{relayerUrl:e.relayerUrl,walletId:e.walletId,addSignerCeremonyId:r,activationCorrelationId:i,publicFacts:o,expectedActivationRequestDigest:u})});let f=l.response.ecdsa.activation.ecdsa_activation.public_identity;return JSON.stringify({relayerKeyId:e.started.prepare.relayerKeyId,relayerPublicKey33B64u:f.server_public_key33_b64u,groupPublicKey33B64u:f.threshold_public_key33_b64u,ethereumAddress:Oc(f.ethereum_address20_b64u),relayerShareRetryCounter:f.server_share_retry_counter})}});if(!l.response||!l.journalId)throw Error(`Add-signer ECDSA custody join did not activate`);let d=l.response,f=l.journalId,p=u.commitPayload.clientRootPublicKey33B64u;if(!p)throw Error(`Add-signer ECDSA custody join returned no client root public key`);let m=Ic({prepare:e.started.prepare,verified:u.clientBootstrap}),h=Wn({clientBootstrap:m,serverBootstrap:d.ecdsa.bootstrap,activationEpoch:d.ecdsa.activation.ecdsa_activation.activation_epoch});return{chainTargets:[t,...n],clientBootstrap:m,bootstrap:h,activatedThresholdSessionId:d.ecdsa.bootstrap.thresholdSessionId,journalId:f,activationReceipt:d.ecdsa.activation,custodyKeySet:{kind:`evm_family_ecdsa_v1`,keyManifestDigestB64u:u.commitPayload.keyManifestDigestB64u,clientRootPublicKey33B64u:p},custodyLocalMaterial:u.localMaterial}}catch(t){throw await Fc({context:e.context,ceremonyId:r}),t}}async function Vc(e){let t=await e.context.signingEngine.finalizeRouterAbEcdsaRegistrationActivation({kind:`finalize_router_ab_ecdsa_registration_activation_v1`,bootstrapOwner:`wallet_custody`,journalId:e.pending.journalId,activationReceipt:e.pending.activationReceipt,routerAbEcdsaDerivationNormalSigning:e.pending.bootstrap.routerAbEcdsaDerivationNormalSigning,readyStateBlobB64u:e.pending.custodyLocalMaterial.readyStateBlobB64u,walletCustodyPublicFacts:e.pending.custodyLocalMaterial.publicFacts});return{chainTargets:e.pending.chainTargets,authority:t.authority,clientBootstrap:e.pending.clientBootstrap,bootstrap:e.pending.bootstrap,activatedThresholdSessionId:e.pending.activatedThresholdSessionId,roleLocalMaterial:t.roleLocalMaterial,materialActivation:t.materialActivation,clientPublicFacts:t.publicFacts,publicCapability:t.publicCapability}}function Hc(e){switch(e.tokens.kind){case`evm_family_ecdsa`:case`near_ed25519_and_evm_family_ecdsa`:return e.tokens.ecdsa;case`near_ed25519`:throw Error(`Registration-established session is missing ECDSA authorization`);default:return q(e.tokens)}}function Uc(e){let[t]=e.walletKeys;if(!t)throw Error(`ECDSA registration did not return wallet key material`);let n=Hc(e.session.registrationEstablishedSession);if(String(e.session.registrationEstablishedSession.walletId)!==t.walletId||n.thresholdSessionId!==e.session.activatedThresholdSessionId||n.keyHandle!==t.keyHandle||!Wc(n.runtimePolicyScope,e.session.clientBootstrap.runtimePolicyScope)||!vt(n.routerAbEcdsaDerivationNormalSigning,e.session.bootstrap.routerAbEcdsaDerivationNormalSigning))throw Error(`Registration-established ECDSA session changed the signer identity`);for(let r of e.walletKeys)if(r.walletId!==t.walletId||r.keyHandle!==n.keyHandle||r.ecdsaThresholdKeyId!==t.ecdsaThresholdKeyId)throw Error(`ECDSA registration material changed the established session identity`)}function Wc(e,t){return e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function Gc(e){return dt({walletId:e.walletId,rpId:e.rpId,credentialIdB64u:String(e.credential.rawId||e.credential.id||``).trim()})}async function Kc(e){if(!e.material)throw Error(`Email OTP registration ${e.operation} is missing enrollment material`);return await e.material}function qc(e){let t=e.admissionRequest,n=s(t.scope.threshold_session_id);if(!n.ok)throw Error(`Ed25519 registration threshold-session identity is invalid`);let r=t.participant_ids,i=F(e.finalized.runtimePolicyScope);if(t.application_binding.wallet_id!==e.walletId||t.application_binding.near_ed25519_signing_key_id!==e.finalized.nearEd25519SigningKeyId||t.application_binding.key_creation_signer_slot!==e.finalized.signerSlot||r[0]!==e.finalized.participantIds[0]||r[1]!==e.finalized.participantIds[1]||!Wc(i,e.expectedRuntimePolicyScope)||t.application_binding.signing_root_id!==`${i.projectId}:${i.envId}`||t.scope.root_share_epoch!==i.signingRootVersion||t.scope.signing_worker_id!==e.finalized.routerAbNormalSigning.signingWorkerId||e.finalized.relayerKeyId!==e.finalized.routerAbNormalSigning.signingWorkerId)throw Error(`Ed25519 registration material changed the admitted signer identity`);return{identity:{walletId:String(e.walletId),nearAccountId:e.finalized.nearAccountId,nearEd25519SigningKeyId:e.finalized.nearEd25519SigningKeyId,thresholdSessionId:n.value,signerSlot:e.finalized.signerSlot,signingRootId:t.application_binding.signing_root_id,signingRootVersion:t.scope.root_share_epoch,signingWorkerId:t.scope.signing_worker_id},stableServerScope:{relayerKeyId:e.finalized.relayerKeyId,participantIds:e.finalized.participantIds,runtimePolicyScope:i,routerAbNormalSigning:e.finalized.routerAbNormalSigning}}}function Jc(e){switch(e.tokens.kind){case`near_ed25519`:case`near_ed25519_and_evm_family_ecdsa`:return e.tokens.ed25519;case`evm_family_ecdsa`:throw Error(`Registration-established session is missing Ed25519 authorization`);default:return q(e.tokens)}}async function Yc(e){let t=Jc(e.registrationEstablishedSession);if(t.nearAccountId!==String(e.nearAccountId)||t.nearEd25519SigningKeyId!==String(e.nearEd25519SigningKeyId)||t.thresholdSessionId!==String(e.thresholdSessionId)||!Wc(t.runtimePolicyScope,e.runtimePolicyScope))throw Error(`Registration-established Email OTP Ed25519 session changed signer identity`);let n=re(t.runtimePolicyScope),r=n.signingRootVersion;if(!r)throw Error(`Registration-established Ed25519 session is missing a signing-root version`);let i=uo({walletId:String(e.walletId),nearAccountId:String(e.nearAccountId),nearEd25519SigningKeyId:String(e.nearEd25519SigningKeyId),walletSessionId:String(e.registrationEstablishedSession.walletSessionId),authorizationId:String(e.registrationEstablishedSession.authorizationId),quotaId:String(e.registrationEstablishedSession.quotaId),thresholdSessionId:t.thresholdSessionId,remainingUses:e.registrationEstablishedSession.remainingUses,expiresAtMs:e.registrationEstablishedSession.expiresAtMs,runtimePolicyScope:t.runtimePolicyScope,signingRootId:n.signingRootId,signingRootVersion:r,routerAbNormalSigning:t.routerAbNormalSigning,walletSessionToken:e.registrationEstablishedSession.operationCredential.token,home:e.registrationEstablishedSession.operationCredential.home,nowMs:Date.now()});if(!i.ok)throw Error(`Registration-established Email OTP Ed25519 session is unusable (${i.reason})`);let a=await st({authority:e.emailOtpAuthContext.authority});return gc({walletId:e.walletId,nearAccountId:z(e.nearAccountId),nearEd25519SigningKeyId:qt(e.nearEd25519SigningKeyId),providerSubjectId:or(e.emailOtpAuthContext),signerSlot:e.signerSlot,relayerUrl:e.relayerUrl,authority:a,signingWalletSession:i.value})}function Xc(e){if(e.authMethod.kind!==`passkey`)throw Error(`Ed25519 Yao registration requires a passkey registration intent`);return{version:e.version,walletId:e.walletId,authMethod:e.authMethod,signerSelection:e.signerSelection,foundingWalletAuthMethodId:e.foundingWalletAuthMethodId,...e.runtimePolicyScope?{runtimePolicyScope:e.runtimePolicyScope}:{},nonceB64u:e.nonceB64u}}function Zc(e){if(e.finalized.authMethod.kind!==`passkey`||e.finalized.rpId!==e.expectedRpId)throw Error(`Ed25519 Yao finalize returned a different passkey authority`);if(e.finalized.walletId!==e.expectedWalletId)throw Error(`Ed25519 Yao finalize returned a different wallet`);if(e.finalized.ed25519.publicKey!==e.clientPublicKey||e.finalized.ed25519.nearEd25519SigningKeyId!==e.finalized.resolvedAccount.nearEd25519SigningKeyId||e.finalized.ed25519.nearAccountId!==e.finalized.resolvedAccount.nearAccountId)throw Error(`Ed25519 Yao finalize returned mismatched signer identity`);return{rpId:e.finalized.rpId,credentialIdB64u:e.finalized.authMethod.credentialIdB64u}}function Qc(e){if(e.finalized.authMethod.kind!==`email_otp`||e.finalized.authMethod.registrationAuthorityId!==e.expectedRegistrationAuthorityId)throw Error(`Ed25519 Yao finalize returned a different Email OTP authority`);if(e.finalized.walletId!==e.expectedWalletId)throw Error(`Ed25519 Yao finalize returned a different wallet`);if(e.finalized.ed25519.publicKey!==e.clientPublicKey||e.finalized.ed25519.nearEd25519SigningKeyId!==e.finalized.resolvedAccount.nearEd25519SigningKeyId||e.finalized.ed25519.nearAccountId!==e.finalized.resolvedAccount.nearAccountId)throw Error(`Ed25519 Yao finalize returned mismatched signer identity`)}async function $c(e,t){let n=await new $i(t).send({kind:`admit`,path:kt,body:e.admissionRequest});if(!n.ok)throw Error(n.message);let r=Lt(n.value);if(!r.ok)throw Error(r.message);return r.value}function el(e){let t=Jc(e.session);return{thresholdSessionId:String(t.thresholdSessionId),prfFirstB64u:e.prfFirstB64u,expiresAtMs:e.session.expiresAtMs,remainingUses:e.session.remainingUses,diagnostics:{recordDuration:xa.bind(void 0,e.ceremonyId)},...e.preparedServerSeal?{preparedServerSeal:e.preparedServerSeal}:{},transport:{curve:`ed25519`,authMethod:`passkey`,walletId:e.walletId,relayerUrl:e.relayerUrl,walletSessionToken:e.session.operationCredential.token,ed25519Restore:pa({rpId:e.restore.rpId,nearAccountId:e.restore.nearAccountId,nearEd25519SigningKeyId:e.restore.nearEd25519SigningKeyId,relayerKeyId:e.restore.relayerKeyId,participantIds:e.restore.participantIds,runtimePolicyScope:t.runtimePolicyScope,signerSlot:e.restore.signerSlot,routerAbNormalSigning:t.routerAbNormalSigning,credentialIdB64u:e.restore.credentialIdB64u,materialActivation:e.restore.materialActivation})}}}function tl(e){if(e.operation!==`registration_activate`||e.signerPlanKind!==`evm_family_ecdsa`)return!1;let t=e.localMaterial.keyFamilies;return t.length===1&&t[0]===`ecdsa_secp256k1`}function nl(e){if(e.operation!==`registration_activate`||e.signerPlanKind!==`near_ed25519_and_evm_family_ecdsa`)return!1;let t=e.localMaterial.keyFamilies;return t.length===1&&t[0]===`ecdsa_secp256k1`}function rl(e){let t=e.registrationEstablishedSession.session.tokens;if(t.kind===`evm_family_ecdsa`||t.kind===`near_ed25519_and_evm_family_ecdsa`)return t;throw Error(`pending ECDSA activation returned no ECDSA projection`)}function il(e,t,n){let r=t.registrationEstablishedSession.session,i=rl(t);return t.walletId===e.walletId&&t.custodyKeyManifestDigestB64u===e.localMaterial.custodyCommit.keyManifestDigestB64u&&t.walletCustody?.status===`committed`&&r.walletId===e.walletId&&r.walletSession.walletId===e.walletId&&r.walletSession.authMethodId===e.walletAuthMethodId&&r.tokens.kind===`evm_family_ecdsa`&&i.ecdsa.keyHandle===n.keyHandle&&i.ecdsa.thresholdSessionId===t.ecdsa.bootstrap.thresholdSessionId&&r.expiresAtMs===t.ecdsa.bootstrap.expiresAtMs&&r.remainingUses===t.ecdsa.bootstrap.remainingUses}function al(e,t,n){let r=e.ecdsa_activation.public_identity;return Ot({registrationRequestDigestB64u:t.publicCapability.registration_request_digest_b64u,proofTranscriptDigestB64u:I(Uint8Array.from(e.transcript_digest.bytes)),contextBinding32B64u:r.context_binding_b64u,derivationClientSharePublicKey33B64u:r.derivation_client_share_public_key33_b64u,clientShareRetryCounter:r.client_share_retry_counter,participantId:1},n)}function ol(e,t){return e.derivationClientSharePublicKey33B64u===t.derivationClientSharePublicKey33B64u&&e.relayerPublicKey33B64u===t.relayerVerifyingShareB64u&&e.groupPublicKey33B64u===t.thresholdEcdsaPublicKeyB64u&&e.ethereumAddress===t.thresholdOwnerAddress.toLowerCase()}function sl(e,t){return e.server_public_key33_b64u===t.relayerVerifyingShareB64u&&e.threshold_public_key33_b64u===t.thresholdEcdsaPublicKeyB64u&&dl(e.ethereum_address20_b64u)===t.thresholdOwnerAddress&&e.server_share_retry_counter===t.relayerShareRetryCounter}function cl(e,t){return e.walletId===t.walletId&&e.keyHandle===t.keyHandle&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.evmFamilySigningKeySlotId===t.evmFamilySigningKeySlotId&&e.signingRootId===t.signingRootId&&e.signingRootVersion===t.signingRootVersion&&e.thresholdEcdsaPublicKeyB64u===t.thresholdEcdsaPublicKeyB64u&&e.ethereumAddress.toLowerCase()===t.thresholdOwnerAddress.toLowerCase()&&e.relayerKeyId===t.relayerKeyId&&e.relayerVerifyingShareB64u===t.relayerVerifyingShareB64u&&e.clientShareRetryCounter===t.clientShareRetryCounter&&e.relayerShareRetryCounter===t.relayerShareRetryCounter}function ll(e,t){let n={relayerUrl:e,registrationCeremonyId:t.registrationCeremonyId,signedSetup:t.signedSetup,idempotencyKey:t.idempotencyKey,walletCustodyCommit:t.localMaterial.custodyCommit,...t.auth.kind===`email_otp`?{emailOtpEnrollment:t.auth.enrollment}:{}},r={activationCorrelationId:t.localMaterial.ecdsa.activationJournalId,activationRequestDigestB64u:t.localMaterial.ecdsa.activationRequestDigestB64u,clientActivation:t.localMaterial.ecdsa.clientActivation};return{...n,signerPlanKind:t.signerPlanKind,ecdsa:r}}function ul(e){let t=e.ecdsa.walletKeys[0];if(!t)throw Error(`pending ECDSA activation returned no wallet keys`);return jc(e.ecdsa.walletKeys),[t,...e.ecdsa.walletKeys.slice(1)]}function dl(e){let t=L(e);if(t.length!==20)throw Error(`pending ECDSA activation returned an invalid address`);let n=`0x`;for(let e of t)n+=e.toString(16).padStart(2,`0`);return n}function fl(e,t,n){if(!il(e,t,n))throw Error(`pending ECDSA activation projection mismatch`);Sn(e,{operation:e.operation,walletId:t.walletId,walletAuthMethodId:t.foundingAuthMethod.walletAuthMethodId,authority:t.authority})}function pl(e){return e.ok===!0&&e.kind===`evm_family_ecdsa`&&e.registrationEstablishedSession.kind===`already_committed`}async function ml(e,t){if(e.auth.kind===`passkey`){if(t.authMethod.kind!==`passkey`||t.rpId!==e.auth.rpId||t.authMethod.credentialIdB64u!==e.auth.credentialIdB64u)throw Error(`pending ECDSA activation returned a different Passkey method`);return}if(t.authMethod.kind!==`email_otp`||t.authMethod.registrationAuthorityId!==e.auth.registrationAuthorityId)throw Error(`pending ECDSA activation returned a different Email OTP method`);let n=ct(t.authority),r=await S(e.auth.email);if(!n||n.factor.providerUserId!==e.auth.providerSubject||n.verifier.emailHashHex.toLowerCase()!==r.toLowerCase())throw Error(`pending ECDSA activation returned a different Email OTP identity`)}function hl(e,t,n){let r=t.ecdsa.activation,i=r.ecdsa_activation,a=i.public_identity,o=e.localMaterial.ecdsa.clientActivation;if(r.activation_correlation_id!==e.localMaterial.ecdsa.activationJournalId||I(Uint8Array.from(r.activation_request_digest.bytes))!==e.localMaterial.ecdsa.activationRequestDigestB64u||!al(r,n,o)||!ol(t.ecdsa.bootstrap.publicIdentity,n)||i.context.application_binding_digest_b64u!==t.ecdsa.bootstrap.applicationBindingDigestB64u||!sl(a,n))throw Error(`pending ECDSA activation facts mismatch`);if(!cl(t.ecdsa.bootstrap,n))throw Error(`pending ECDSA bootstrap changed committed key identity`)}function gl(e){let t=rl(e).ecdsa,n=e.ecdsa.activation.ecdsa_activation;if(!p(t.materialActivation,ht(n.material_activation))||!vt(t.routerAbEcdsaDerivationNormalSigning,e.ecdsa.bootstrap.routerAbEcdsaDerivationNormalSigning))throw Error(`pending ECDSA activation facts do not match the committed projection`)}async function _l(e){let t=e.response;if(!pl(t))throw Error(t.ok?`pending ECDSA activation replay did not return a committed projection`:`pending ECDSA activation replay failed`);let n=ul(t)[0];if(fl(e.pending,t,n),await ml(e.pending,t),hl(e.pending,t,n),gl(t),e.pending.signerPlanKind===`evm_family_ecdsa`){if(t.nearProvisioning!==void 0)throw Error(`ECDSA-only registration unexpectedly has deferred NEAR provisioning`)}else if(t.nearProvisioning?.status!==`near_pending`)throw Error(`mixed registration did not retain deferred NEAR provisioning`);return t}function vl(e){return String(In(e)||``).trim()}function yl(e,t){let n=vl(e);if(!n)throw Error(`${t} requires PRF.first output from the passkey credential`);return n}function bl(e){return String(e?.rawId||e?.id||``).trim()}async function xl(e){let t=new bn,n=ht(e.activationReceipt.ecdsa_activation.material_activation),r=await t.lookupByMaterialActivation({walletId:e.authority.walletId,authority:e.authority,materialActivation:n});if(r.kind===`missing`){let t=await xn(e);return{roleLocalMaterialRef:t.roleLocalMaterialRef,publication:[t]}}if(r.kind!==`active`)throw Error(`Pending ECDSA registration continuity is ${r.kind}`);let i=r.manifest,a=i.durableMaterial;if(!Tt(i.activation.serverActivation.serverActivationReceipt.protocolReceipt,e.activationReceipt)||!_t(a.roleLocalPublicFacts.publicCapability,e.publicCapability)||!Mn(i.signer.scope,dn({targetMemberships:e.chainTargets}))||a.roleLocalBinding.keyHandle!==e.keyHandle||a.roleLocalBinding.ecdsaThresholdKeyId!==e.ecdsaThresholdKeyId||a.roleLocalBinding.relayerKeyId!==e.relayerKeyId||a.bindingDigest!==e.publicFacts.contextBinding32B64u||i.signer.signingRootId!==e.signingRootId||i.signer.signingRootVersion!==e.signingRootVersion||!jn(a.runtimePolicyScope,e.runtimePolicyScope))throw Error(`Pending ECDSA registration conflicts with its restored activation`);return{roleLocalMaterialRef:{kind:`ecdsa_role_local_persisted_material_ref_v1`,durableMaterialRef:a.durableMaterialRef,bindingDigest:a.bindingDigest,materialActivation:n},publication:[]}}function Sl(e){let t=e[0];if(!t)throw Error(`ECDSA registration finalization returned no wallet keys`);return[t,...e.slice(1)]}function Cl(e){let t=e[0];if(!t)throw Error(`ECDSA registration activation returned no chain targets`);return[t.chainTarget,...e.slice(1).map(e=>e.chainTarget)]}async function wl(e){let t=Sl(e.walletKeys);if(e.pending.auth.kind===`passkey`){if(e.response.authMethod.kind!==`passkey`||!e.response.authMethod.credentialPublicKeyB64u)throw Error(`ECDSA registration publication has no exact Passkey credential`);return await tt({kind:`passkey`,walletId:e.pending.walletId,rpId:e.pending.auth.rpId,credentialIdB64u:e.pending.auth.credentialIdB64u,credentialPublicKeyB64u:e.response.authMethod.credentialPublicKeyB64u,transports:e.pending.auth.transports,walletKeys:t})}if(e.response.authMethod.kind!==`email_otp`)throw Error(`ECDSA Email OTP registration publication has a different auth method`);let n=ct(e.response.authority);if(!n)throw Error(`ECDSA Email OTP registration authority is invalid`);return await tt({kind:`email_otp`,walletId:e.pending.walletId,email:e.pending.auth.email,registrationAuthorityId:e.pending.auth.registrationAuthorityId,authority:n,walletKeys:t})}function Tl(e){return{pending:e.pending,authority:e.response.authority,foundingAuthority:{authority:e.response.foundingAuthority,authMethod:e.response.foundingAuthMethod},request:{operation:e.pending.operation,registrationCeremonyId:e.pending.registrationCeremonyId,idempotencyKey:e.pending.idempotencyKey,walletId:e.pending.walletId,walletAuthMethodId:e.pending.walletAuthMethodId},walletSessionPublication:{kind:`issued`,walletSession:e.session.session.wallet_session,operationCredential:e.session.session.operation_credential},ecdsaContinuity:e.ecdsaContinuity,registration:e.registration}}async function El(e){let t=await e.ports.activateWalletRegistration(ll(e.relayerUrl,e.pending)),n=await _l({pending:e.pending,response:t}),r=ul(n),i={sessionPolicy:e.sessionPolicy,onEvent:e.onEvent,relayerUrl:e.relayerUrl,pending:e.pending,response:n,walletKeys:r,exactMethod:e.exactMethod,signingSurface:e.signingSurface},a=await e.ports.unlockPendingEcdsaRegistration(i),o=r[0];if(!o)throw Error(`ECDSA registration activation returned no primary key`);let s=await st({authority:n.authority}),c=await xl({authority:s,chainTargets:Cl(r),walletId:String(e.pending.walletId),keyHandle:o.keyHandle,ecdsaThresholdKeyId:o.ecdsaThresholdKeyId,signingRootId:o.signingRootId,signingRootVersion:o.signingRootVersion,relayerKeyId:o.relayerKeyId,participantIds:o.participantIds,publicCapability:o.publicCapability,activationReceipt:n.ecdsa.activation,runtimePolicyScope:rl(n).ecdsa.runtimePolicyScope,readyStateBlobB64u:a.readyStateBlobB64u,publicFacts:a.publicFacts}),l={kind:`ecdsa_role_local_worker_handle_v1`,materialHandle:ln(c.roleLocalMaterialRef.durableMaterialRef),bindingDigest:c.roleLocalMaterialRef.bindingDigest,durableMaterialRef:c.roleLocalMaterialRef.durableMaterialRef},u=await e.signingSurface.finalizeWalletRegistrationEcdsaSessions({walletId:String(e.pending.walletId),session:{chainTargets:Cl(r),authority:s,bootstrap:{applicationBindingDigestB64u:n.ecdsa.bootstrap.applicationBindingDigestB64u},roleLocalMaterial:l,materialActivation:c.roleLocalMaterialRef.materialActivation,clientPublicFacts:{contextBinding32B64u:a.publicFacts.contextBinding32B64u,derivationClientSharePublicKey33B64u:a.publicFacts.derivationClientSharePublicKey33B64u,clientVerifyingShareB64u:a.publicFacts.clientVerifyingShare33B64u,relayerPublicKey33B64u:a.publicFacts.relayerPublicKey33B64u,groupPublicKey33B64u:a.publicFacts.groupPublicKey33B64u,ethereumAddress:a.publicFacts.ethereumAddress},publicCapability:o.publicCapability},walletKeys:r}),d=await wl({pending:e.pending,response:n,walletKeys:u});if(await e.ports.publishPendingWalletRegistrationCommit(Tl({pending:e.pending,response:n,registration:d,session:a.session,ecdsaContinuity:c.publication})),e.pending.signerPlanKind===`near_ed25519_and_evm_family_ecdsa`&&e.pending.auth.kind===`passkey`&&a.kind===`passkey`){let t=yl(a.credential,`Pending NEAR registration continuation`),n=gh({context:e.nearContext,sessionAuthority:{record:a.session.session.wallet_session,operationCredential:a.session.session.operation_credential},factor:{kind:`passkey`,rpId:e.pending.auth.rpId,credentialIdB64u:bl(a.credential),prfFirstB64u:t},ownedFactorSecret:L(t).slice().buffer,custodyEnvelope:a.custody.envelope});e.nearCompletion===`await`&&await n}return{kind:`published`,registrationCeremonyId:e.pending.registrationCeremonyId,walletId:n.walletId,signingSession:{sessionId:String(a.session.session.threshold_session_id),status:`active`,authMethod:a.kind,remainingUses:a.session.session.remaining_uses,expiresAtMs:a.session.session.expires_at_ms}}}function Dl(e,t,n){e?.(pn({flowId:`unlock:${t}`,accountId:t,...n}))}async function Ol(e){let{context:t,authMethod:n,unlockSubjectId:r,loginResult:i,onEvent:a,afterCall:o}=e;return i.success&&t.signingEngine.setWalletAuthenticated({kind:`authenticated`,walletId:i.walletId,authMethod:n}),Dl(a,r,{phase:hn.STEP_07_COMPLETED,status:`succeeded`,data:{...i.success&&i.kind===`near_wallet_unlocked`?{operationalPublicKey:i.operationalPublicKey??``}:{walletId:i.success?String(i.walletId):``}}}),await o?.(!0,i),i}async function kl(e){let{message:t,unlockSubjectId:n,error:r,onEvent:i,onError:a,afterCall:o,callOnError:s=!0,callAfterCall:c=!0,cancelled:l=!1}=e;return s&&a?.(Se(r)),Dl(i,n,{phase:l?hn.CANCELLED:hn.FAILED,status:l?`cancelled`:`failed`,...l?{}:{message:t},interaction:{kind:`passkey_assert`,overlay:`hide`},error:{message:t}}),c&&await o?.(!1),{success:!1,error:t}}async function Al(e){let t=kn(),n=null;try{let r=JSON.stringify(t.codeBytes.map(e=>({codeBytesB64u:I(e)}))),i=await kr({runStep:e.runStep,custody:e.factorAfterRouterRound?{origin:`establish_factor_after_round`,walletId:e.walletId,recoveryCodesJson:r,factor:e.factorAfterRouterRound}:{origin:`establish`,walletId:e.walletId,factorJson:e.factorJson,factorSecret:e.factorSecret,recoveryCodesJson:r},keySetRun:{keySet:`near_ed25519_v1`,protocolInputsJson:JSON.stringify({yaoAdmission:e.yaoAdmission,yaoApplication:e.yaoApplication,clientParticipantId:e.participantIds[0],signingWorkerParticipantId:e.participantIds[1],...e.continuityRegisteredPublicKeyB64u===void 0?{}:{continuityRegisteredPublicKeyB64u:e.continuityRegisteredPublicKeyB64u}}),nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,runRouterRound:async t=>{let r=await e.runRouterRound(t);return n=Wl(r),r}}});if(!n)throw Error(`the NEAR custody ceremony produced no activation session id`);let a=await Ul(i,t);return{recoveryCodes:t.codes,activationReference:{kind:`router_ab_ed25519_yao_activation_reference_v1`,lifecycle_id:e.registrationCeremonyId,session_id:n},commitPayload:Hl(a),localMaterial:i.ed25519LocalMaterialB64u&&i.ed25519LocalMaterialNonceB64u&&i.ed25519ApplicationBindingDigestB64u?{b64u:i.ed25519LocalMaterialB64u,nonceB64u:i.ed25519LocalMaterialNonceB64u,applicationBindingDigestB64u:i.ed25519ApplicationBindingDigestB64u}:null}}finally{t&&Dn(t),t=null}}function jl(e){let t=e.establishedCustody;if(!t)throw Error(`wallet custody join requires an established envelope`);let n;try{n=JSON.parse(t.envelopeBindingJson)}catch{throw Error(`wallet custody envelope binding is not JSON`)}if(typeof n!=`object`||!n||Array.isArray(n))throw Error(`wallet custody envelope binding must be an object`);return JSON.stringify({envelopeBinding:n,nonceB64u:t.envelopeNonceB64u,sealedCustodySecretB64u:t.sealedCustodySecretB64u,aadHashB64u:t.envelopeAadHashB64u,ciphertextDigestB64u:t.envelopeCiphertextDigestB64u})}async function Ml(e){let t=kn(),n=null,r=null;try{let i=t;if(!i)throw Error(`recovery codes were not issued`);let a=await kr({runStep:e.runStep,custody:{origin:`establish`,walletId:e.walletId,factorJson:e.factorJson,factorSecret:e.factorSecret,recoveryCodesJson:JSON.stringify(t.codeBytes.map(e=>({codeBytesB64u:I(e)})))},keySetRun:{keySet:`evm_family_ecdsa_v1`,protocolInputsJson:JSON.stringify({applicationBindingDigestB64u:e.applicationBindingDigestB64u}),evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,beforeRelayerRound:e.confirmRecoveryCodesBackedUp.bind(void 0,t.codes),runRelayerRound:async t=>{let a=nn(await Ul(t.preActivationCommitPayload,i));return n=a,r={contextBinding32B64u:t.contextBinding32B64u,derivationClientSharePublicKey33B64u:t.clientSharePublicKey33B64u,clientShareRetryCounter:t.clientShareRetryCounter,participantId:1},await e.runRelayerRound({...t,preActivationCommitPayload:a})}}});if(!n||!r)throw Error(`the EVM custody ceremony reached no activation round`);if(!a.ecdsaReadyStateBlobB64u||!a.ecdsaPublicFacts)throw Error(`the EVM custody ceremony produced no local signing material`);return{recoveryCodes:t.codes,commitPayload:n,clientBootstrap:r,localMaterial:{readyStateBlobB64u:a.ecdsaReadyStateBlobB64u,publicFacts:a.ecdsaPublicFacts}}}finally{t&&Dn(t),t=null}}async function Nl(e){let t=null,n=null,r=await kr({runStep:e.runStep,custody:{origin:`join`,custodyJson:e.custodyJson,factorSecret:e.factorSecret},keySetRun:{keySet:`evm_family_ecdsa_v1`,protocolInputsJson:JSON.stringify({applicationBindingDigestB64u:e.applicationBindingDigestB64u}),evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,beforeRelayerRound:async()=>void 0,runRelayerRound:async r=>(t=r.preActivationCommitPayload,n={contextBinding32B64u:r.contextBinding32B64u,derivationClientSharePublicKey33B64u:r.clientSharePublicKey33B64u,clientShareRetryCounter:r.clientShareRetryCounter,participantId:1},await e.runRelayerRound(r))}});if(!t||!n)throw Error(`the EVM custody join reached no activation round`);if(r.establishedCustody)throw Error(`an EVM custody join must not establish a second wallet seed`);if(!r.ecdsaReadyStateBlobB64u||!r.ecdsaPublicFacts)throw Error(`the EVM custody join produced no local signing material`);return{commitPayload:t,clientBootstrap:n,localMaterial:{readyStateBlobB64u:r.ecdsaReadyStateBlobB64u,publicFacts:r.ecdsaPublicFacts}}}function Pl(e){switch(e.factorReplacement.kind){case`preserve_existing`:return{origin:`recover`,custodyJson:e.custodyJson,recoveryCode:e.recoveryCode};case`reseal_replacement_factor`:return{origin:`recover_and_reseal`,custodyJson:e.custodyJson,recoveryCode:e.recoveryCode,replacementFactorJson:e.factorReplacement.factorJson,replacementFactorSecret:e.factorReplacement.factorSecret};default:return Fl(e.factorReplacement)}}function Fl(e){throw Error(`unsupported recovery factor replacement: ${String(e)}`)}async function Il(e){if(await Bl({walletId:e.walletId,evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,clientRootPublicKey33B64u:e.registeredClientRootPublicKey33B64u})!==e.recordedKeyManifestDigestB64u)throw Error(`EVM recovery manifest digest does not match the registered identity`);let t=await kr({runStep:e.runStep,custody:Pl(e),keySetRun:{keySet:`evm_family_ecdsa_v1`,protocolInputsJson:JSON.stringify({applicationBindingDigestB64u:e.applicationBindingDigestB64u}),evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,beforeRelayerRound:async()=>void 0,runRelayerRound:e.resolveRelayerPublicIdentity},recordedKeyManifestDigestB64u:e.recordedKeyManifestDigestB64u});if(!t.ecdsaReadyStateBlobB64u||!t.ecdsaPublicFacts)throw Error(`the EVM recovery produced no local signing material`);if(t.clientRootPublicKey33B64u!==e.registeredClientRootPublicKey33B64u)throw Error(`the EVM recovery changed the registered client root public key`);return{readyStateBlobB64u:t.ecdsaReadyStateBlobB64u,publicFacts:t.ecdsaPublicFacts,recoveryReplacementEnvelope:t.recoveryReplacementEnvelope??null}}async function Ll(e){let t=await Bl({walletId:e.walletId,evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,clientRootPublicKey33B64u:e.registeredClientRootPublicKey33B64u}),n=await kr({runStep:e.runStep,custody:{origin:`join`,custodyJson:e.custodyJson,factorSecret:e.factorSecret},keySetRun:{keySet:`evm_family_ecdsa_v1`,protocolInputsJson:JSON.stringify({applicationBindingDigestB64u:e.applicationBindingDigestB64u}),evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,beforeRelayerRound:async()=>void 0,runRelayerRound:async()=>e.relayerPublicIdentityJson},recordedKeyManifestDigestB64u:t});if(n.establishedCustody)throw Error(`an EVM cold unlock must not establish custody`);if(!n.ecdsaReadyStateBlobB64u||!n.ecdsaPublicFacts)throw Error(`the EVM cold unlock produced no local signing material`);return{readyStateBlobB64u:n.ecdsaReadyStateBlobB64u,publicFacts:n.ecdsaPublicFacts}}function Rl(e,t){e.push(t>>>24&255,t>>>16&255,t>>>8&255,t&255)}function zl(e,t,n){let r=new TextEncoder().encode(t);Rl(e,r.length),e.push(...r),Rl(e,n.length),e.push(...n)}async function Bl(e){let t=String(e.walletId||``).trim(),n=String(e.evmFamilySigningKeySlotId||``).trim(),r=L(e.clientRootPublicKey33B64u);if(!t||!n||r.length!==33)throw Error(`EVM custody continuity identity is invalid`);let i=[];return zl(i,`context`,new TextEncoder().encode(`seams/wallet-custody/key-set-manifest/evm-family-ecdsa/v1`)),zl(i,`walletId`,new TextEncoder().encode(t)),zl(i,`evmFamilySigningKeySlotId`,new TextEncoder().encode(n)),zl(i,`clientRootPublicKey33`,r),I(await D(Uint8Array.from(i)))}async function Vl(e){let t=String(e.walletId||``).trim(),n=String(e.nearEd25519SigningKeyId||``).trim(),r=L(e.registeredPublicKeyB64u);if(!t||!n||r.length!==32)throw Error(`NEAR custody continuity identity is invalid`);let i=[];return zl(i,`context`,new TextEncoder().encode(`seams/wallet-custody/key-set-manifest/near-ed25519/v1`)),zl(i,`walletId`,new TextEncoder().encode(t)),zl(i,`nearEd25519SigningKeyId`,new TextEncoder().encode(n)),zl(i,`registeredPublicKey`,r),I(await D(Uint8Array.from(i)))}function Hl(e){let{ed25519LocalMaterialB64u:t,ed25519LocalMaterialNonceB64u:n,ed25519ApplicationBindingDigestB64u:r,ecdsaReadyStateBlobB64u:i,recoveryReplacementEnvelope:a,...o}=e;return o}async function Ul(e,t){let n=e.establishedCustody;if(!n)return e;if(n.recoveryManifestKekWraps.length!==t.codeBytes.length)throw Error(`recovery code and wrap counts do not match`);let r=await Promise.all(t.codeBytes.map(async(e,t)=>{let r=n.recoveryManifestKekWraps[t];if(!r)throw Error(`recovery code and wrap counts do not match`);return{locatorB64u:await On(e),recoveryKeyId:r.recoveryKeyId}}));if(new Set(r.map(e=>e.locatorB64u)).size!==r.length)throw Error(`recovery code locators must be unique`);return{...e,establishedCustody:{...n,recoveryCodeLocators:r}}}function Wl(e){let t;try{t=JSON.parse(e)}catch{throw Error(`the Router activation result is not JSON`)}let n=t?.binding?.session_id;if(!Array.isArray(n)||n.length===0)throw Error(`the Router activation result carries no session id`);return n.map(e=>{if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`the Router activation session id is not a byte array`);return e})}async function Gl(e){if(await Vl({walletId:e.walletId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,registeredPublicKeyB64u:e.registeredPublicKeyB64u})!==e.recordedKeyManifestDigestB64u)throw Error(`NEAR recovery manifest digest does not match the registered identity`);let t=null,n=null,r=await kr({runStep:e.runStep,custody:Pl(e),keySetRun:{keySet:`near_ed25519_v1`,protocolInputsJson:JSON.stringify({yaoAdmission:e.yaoAdmission,yaoApplication:e.yaoApplication,clientParticipantId:e.participantIds[0],signingWorkerParticipantId:e.participantIds[1],continuityRegisteredPublicKeyB64u:e.registeredPublicKeyB64u}),nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,runRouterRound:async n=>(t=await e.runRouterRound(n),t),afterRouterRoundCompleted:async t=>{n=await e.activateRouterRecovery(t)}},recordedKeyManifestDigestB64u:e.recordedKeyManifestDigestB64u});if(!r.ed25519LocalMaterialB64u||!r.ed25519LocalMaterialNonceB64u)throw Error(`the NEAR recovery sealed no local signing material`);if(!r.ed25519ApplicationBindingDigestB64u)throw Error(`the NEAR recovery omitted its application binding digest`);if(!t||!n)throw Error(`the NEAR recovery produced no Router activation`);return{localMaterial:{b64u:r.ed25519LocalMaterialB64u,nonceB64u:r.ed25519LocalMaterialNonceB64u,applicationBindingDigestB64u:r.ed25519ApplicationBindingDigestB64u},activationResultJson:t,activationReceipt:n,recoveryReplacementEnvelope:r.recoveryReplacementEnvelope??null}}async function Kl(e){return await Jl(e,e.registrationCeremonyId,void 0,`registration join`)}async function ql(e){let t=String(e.registeredPublicKeyB64u||``).trim();if(!t)throw Error(`a cold unlock must name the key set it reproduces`);let n=null,r=null,i=await Jl({...e,preparation:{kind:`fresh`}},e.recoveryLifecycleId,t,`cold unlock`,async t=>{n=t,r=await e.activateRouterRecovery(t)});if(!n||!r)throw Error(`the NEAR cold unlock produced no Router recovery activation`);return{...i,activationResultJson:n,activationReceipt:r}}async function Jl(e,t,n,r,i){let a=null,o=await kr({runStep:e.runStep,custody:{origin:`join`,custodyJson:e.custodyJson,factorSecret:e.factorSecret},keySetRun:{keySet:`near_ed25519_v1`,...e.preparation.kind===`checkpoint`?{checkpointJson:e.preparation.checkpointJson}:{protocolInputsJson:JSON.stringify({yaoAdmission:e.yaoAdmission,yaoApplication:e.yaoApplication,clientParticipantId:e.participantIds[0],signingWorkerParticipantId:e.participantIds[1],...n?{continuityRegisteredPublicKeyB64u:n}:{}}),beforeRouterRound:e.beforeRouterRound},nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,runRouterRound:async t=>{let n=await e.runRouterRound(t);return a=Wl(n),n},...i?{afterRouterRoundCompleted:i}:{}}});if(!a)throw Error(`the NEAR ${r} produced no activation session id`);if(o.establishedCustody)throw Error(`a NEAR ${r} must not establish custody`);if(!o.ed25519LocalMaterialB64u||!o.ed25519LocalMaterialNonceB64u)throw Error(`the NEAR ${r} sealed no local material`);return{commitPayload:Hl(o),activationReference:{kind:`router_ab_ed25519_yao_activation_reference_v1`,lifecycle_id:t,session_id:a},localMaterial:{b64u:o.ed25519LocalMaterialB64u,nonceB64u:o.ed25519LocalMaterialNonceB64u,applicationBindingDigestB64u:String(o.ed25519ApplicationBindingDigestB64u||``)}}}function Yl(e){switch(e.routeFamily){case`operation_step_up`:return{routeFamily:e.routeFamily,operation:e.operation,operationCredential:e.operationCredential};case`registration`:if(e.operation!==`registration`)throw Error(`Email OTP registration routes require registration operation`);return{routeFamily:`registration`,operation:e.operation};case`login`:if(!He(e.operation))throw Error(`Email OTP login routes require a login operation`);return{routeFamily:`login`,operation:e.operation};case`signing_session`:if(e.operation!==`transaction_sign`&&e.operation!==`export_key`)throw Error(`Email OTP signing-session routes require signing or export operation`);return{routeFamily:`signing_session`,authLane:e.authLane,operation:e.operation}}throw Error(`Unsupported Email OTP route family`)}var Xl=class e extends Error{constructor(t){super(Zl(t)),this.kind=`email_otp_signing_session_auth_state_error`,this.name=`EmailOtpSigningSessionAuthStateError`,this.failure=t,Object.setPrototypeOf(this,e.prototype)}};function Zl(e){return`Email OTP ${e.expectedCurve} signing-session auth lane is unavailable at ${e.source}; unlock wallet again`}function Ql(e){throw new Xl(e)}function $l(e){return e.freshRouteFamily===`registration`?Yl({routeFamily:`registration`,operation:Ve}):Yl({routeFamily:`login`,operation:e.operation??`wallet_unlock`})}function eu(e){return e?.kind!==`signing_session`&&Ql({kind:`auth_lane_missing`,source:`route_plan`,expectedCurve:`unknown`}),e}function tu(e){return Yl({routeFamily:`signing_session`,authLane:e.authLane,operation:e.operation})}function nu(e){if(e.kind===`signing_session`&&e.curve===`ecdsa`)return{kind:`threshold_ecdsa_session`,operationCredential:e.operationCredential,curve:`ecdsa`,thresholdSessionId:e.thresholdSessionId,chainTarget:e.chainTarget}}function ru(e){if(e.routeFamily===`signing_session`)return nu(e.authLane)}async function iu(e){return await e.workerCtx.requestWorkerOperation({kind:`emailOtp`,request:{type:`unlockEmailOtpAuthorityWallet`,timeoutMs:6e4,payload:{relayUrl:e.relayUrl,walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,challengeId:e.challengeId,otpCode:e.otpCode,ed25519:e.ed25519}}})}async function au(e){return await e.base.workerCtx.requestWorkerOperation({kind:`emailOtp`,request:{type:`loginWithEmailOtpWallet`,timeoutMs:6e4,payload:{relayUrl:e.base.relayUrl,walletId:String(e.base.walletSession.walletId),authoritySelector:e.base.authoritySelector,userId:String(e.base.walletSession.walletSessionUserId),verification:e.base.verification,groupId:e.base.groupId,routePlan:e.base.routePlan,otpChannel:Ge,material:e.material},onEvent:e.base.onProgress}})}async function ou(e){let t=await au({base:e,material:e.ecdsaSessionPolicy?{kind:`ecdsa`,ecdsaSessionHandleBinding:e.ecdsaSessionHandleBinding,runtimePolicyScope:e.runtimePolicyScope,ecdsaSessionPolicy:e.ecdsaSessionPolicy}:{kind:`ecdsa`,ecdsaSessionHandleBinding:e.ecdsaSessionHandleBinding,runtimePolicyScope:e.runtimePolicyScope}});if(t.kind!==`ecdsa`)throw Error(`Email OTP wallet unlock returned the wrong material branch`);if(e.ecdsaSessionPolicy){if(t.operation!==`wallet_unlock`)throw Error(`Email OTP wallet unlock returned a non-unlock ECDSA result`);return{kind:`ecdsa`,operation:`wallet_unlock`,recovery:t.recovery,emailOtpSessionHandle:t.emailOtpSessionHandle,ecdsaSession:t.ecdsaSession,ecdsaCustody:t.ecdsaCustody}}if(t.operation!==e.ecdsaSessionHandleBinding.operation)throw Error(`Email OTP ECDSA result operation does not match its request`);return{kind:`ecdsa`,operation:t.operation,recovery:t.recovery,emailOtpSessionHandle:t.emailOtpSessionHandle}}async function su(e){let t=await au({base:e,material:{kind:`ed25519_yao_recovery`,providerSubject:e.providerSubject,nearAccountId:e.nearAccountId,expectedOperationalPublicKey:e.expectedOperationalPublicKey,expectedThresholdSessionId:e.expectedThresholdSessionId,walletCustodyEd25519Material:e.walletCustodyEd25519Material,ed25519YaoRecovery:{kind:zt,signerSlot:e.signerSlot,remainingUses:e.remainingUses,orgId:e.orgId}}});if(t.kind===`ed25519_yao_capability`)return{kind:t.kind,recovery:t.recovery,activeClientHandle:t.activeClientHandle,metadata:t.metadata,ed25519YaoCapability:t.ed25519YaoCapability,walletSessionAuthorization:t.walletSessionAuthorization,...t.walletCustodyEd25519Material?{walletCustodyEd25519Material:t.walletCustodyEd25519Material}:{},ed25519ExportRootCustody:t.ed25519ExportRootCustody};if(t.kind!==`wallet_custody_cache_absent`)throw Error(`Email OTP Ed25519 Yao unlock returned the wrong material branch`);return{kind:`wallet_custody_cache_absent`,recovery:t.recovery,ed25519YaoRecovery:t.ed25519YaoRecovery}}async function cu(e){let t=await au({base:e,material:{kind:`wallet_unlock_capabilities`,ecdsa:{sessionHandleBinding:e.ecdsaSessionHandleBinding,runtimePolicyScope:e.runtimePolicyScope,sessionPolicy:e.ecdsaSessionPolicy},ed25519Yao:{providerSubject:e.providerSubject,nearAccountId:e.nearAccountId,expectedOperationalPublicKey:e.expectedOperationalPublicKey,expectedThresholdSessionId:e.expectedThresholdSessionId,walletCustodyEd25519Material:e.walletCustodyEd25519Material,recovery:{kind:zt,signerSlot:e.signerSlot,remainingUses:e.remainingUses,orgId:e.runtimePolicyScope.orgId}}}});if(t.kind!==`wallet_unlock_capabilities`)throw Error(`Email OTP capability unlock returned the wrong material branch`);return{kind:`wallet_unlock_capabilities`,recovery:t.recovery,walletSessionAuthorization:t.walletSessionAuthorization,ed25519ExportRootCustody:t.ed25519ExportRootCustody,ecdsa:{kind:`ecdsa`,operation:`wallet_unlock`,recovery:t.recovery,emailOtpSessionHandle:t.ecdsa.emailOtpSessionHandle,ecdsaSession:t.ecdsa.session,ecdsaCustody:t.ecdsa.custody},ed25519Yao:t.ed25519Yao.kind===`wallet_custody_cache_absent`?{kind:`wallet_custody_cache_absent`,recovery:t.recovery,ed25519YaoRecovery:t.ed25519Yao.bootstrap}:{kind:`ed25519_yao_capability`,recovery:t.recovery,activeClientHandle:t.ed25519Yao.activeClientHandle,metadata:t.ed25519Yao.metadata,ed25519YaoCapability:t.ed25519Yao.bootstrap,walletSessionAuthorization:t.walletSessionAuthorization,ed25519ExportRootCustody:t.ed25519ExportRootCustody}}}function lu(e){let t=e.walletSessionState.signingLane;if(t.auth.kind!==`passkey`)throw Error(`[SigningEngine][near] Passkey recovery returned another auth lane`);let n=t.identity.signer;return{walletId:n.account.wallet.walletId,nearAccountId:n.account.nearAccountId,thresholdSessionId:e.walletSessionState.thresholdSessionId,runtimePolicyScope:e.walletSessionState.runtimePolicyScope,materialActivation:e.materialActivation,auth:{kind:`passkey`,rpId:t.auth.rpId,credentialIdB64u:t.auth.credentialIdB64u},nearEd25519SigningKeyId:n.nearEd25519SigningKeyId,signerSlot:n.signerSlot}}function uu(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<1)throw Error(`${t} must be a positive integer`);return e}function du(e){if(!Array.isArray(e)||e.length!==2||!Number.isSafeInteger(e[0])||!Number.isSafeInteger(e[1])||e[0]<1||e[1]<1||e[0]===e[1])throw Error(`participantIds must contain two distinct positive integers`);return[Number(e[0]),Number(e[1])]}function fu(e){return e.kind===`sign`&&e.keyFamily===`ed25519`}function pu(e,t,n,r,i,a){if(`sessionKind`in e||`walletSessionToken`in e)throw Error(`sync-account signer bootstrap must not carry a Wallet Session bearer`);if(T(e.walletId,`session.walletId`)!==n.walletId||T(e.nearAccountId,`session.nearAccountId`)!==n.nearAccountId||T(e.nearEd25519SigningKeyId,`session.nearEd25519SigningKeyId`)!==n.nearEd25519SigningKeyId)throw Error(`Yao recovery session identity does not match the verified passkey`);let o=F(E(e.runtimePolicyScope,`session.runtimePolicyScope`)),s=oe(e.routerAbNormalSigning);if(!s)throw Error(`Yao recovery session signing state is invalid`);let c=ge(e.walletSessionId),l=me(e.quotaId);if(!c.ok||!l.ok)throw Error(`Yao recovery Wallet Session identity is invalid`);let u=uu(e.expiresAtMs,`session.expiresAtMs`),d=uu(e.remainingUses,`session.remainingUses`),f=r.capabilitySubjects.find(fu);if(r.walletId!==n.walletId||r.authorityId!==a.walletAuthorityId||r.authMethodId!==a.walletAuthMethodId||r.authorityDigestB64u!==a.authorityDigestB64u||r.authorityRevocationEpoch!==a.authorityRevocationEpoch||r.expiresAtMs!==u||i.walletSessionId!==c.value||!f||!p(f.materialActivation,a.materialActivation))throw Error(`Yao recovery session does not match the exact Wallet Session`);return{thresholdSessionId:T(e.thresholdSessionId,`session.thresholdSessionId`),authorizationId:r.authorizationId,walletSessionId:i.walletSessionId,quotaId:l.value,expiresAtMs:u,remainingUses:d,runtimePolicyScope:o,participantIds:t,routerAbNormalSigning:s,walletSession:r,operationCredential:i}}function mu(e){let t=e.capability,n=e.session,r=re(n.runtimePolicyScope);if(!r||t.applicationBinding.wallet_id!==String(e.walletId)||t.applicationBinding.near_ed25519_signing_key_id!==e.nearEd25519SigningKeyId||t.applicationBinding.key_creation_signer_slot!==e.signerSlot||t.nearAccountId!==e.nearAccountId||t.lifecycle.accountId!==String(e.walletId)||t.lifecycle.signingWorkerId!==e.relayerKeyId||n.routerAbNormalSigning?.signingWorkerId!==e.relayerKeyId||n.participantIds[0]!==t.participantIds[0]||n.participantIds[1]!==t.participantIds[1]||!j(n.runtimePolicyScope,t.runtimePolicyScope)||n.runtimePolicyScope.signingRootVersion!==t.lifecycle.rootShareEpoch||t.applicationBinding.signing_root_id!==r.signingRootId||e.operationalPublicKey!==`ed25519:${Te(Uint8Array.from(t.registeredPublicKey))}`)throw Error(`Yao recovery response does not preserve the registered wallet identity`)}function hu(e){if(mu(e),e.capability.lifecycle.thresholdSessionId!==e.session.thresholdSessionId)throw Error(`Yao recovery response does not preserve the threshold material lifecycle`)}function gu(e,t){if(mu(e),!p(e.capability.materialActivation,t))throw Error(`Yao warm recovery response does not preserve exact material activation`)}function _u(e){return`operationCredential`in e?e.operationCredential.token:e.walletSessionToken}function vu(e){let n=E(e,`sync-account response`);if(n.ok!==!0||n.verified!==!0)throw Error(`sync-account response is not verified`);let r=Kt(T(n.walletId,`walletId`)),i=z(T(n.nearAccountId,`nearAccountId`)),a=T(n.nearEd25519SigningKeyId,`nearEd25519SigningKeyId`),o=E(n.thresholdEd25519,`thresholdEd25519`),s=du(o.participantIds),l=E(n.ed25519YaoRecovery,`ed25519YaoRecovery`);if(l.kind!==`router_ab_ed25519_yao_sync_recovery_v1`)throw Error(`sync-account recovery kind is invalid`);let u=yt(l.authorityRef);if(!u||String(u.walletId)!==String(r))throw Error(`sync-account recovery authority is invalid`);let d=c(n.walletAuthMethodId),f=t(n.walletAuthorityId),p=nt(n.foundingAuthority),m=Gt(n.foundingAuthMethod);if(!d.ok||!f.ok||d.value!==u.walletAuthMethodId||!p.ok||p.value.state!==`active`||p.value.provenance.kind!==`wallet_registration`||p.value.walletId!==r||p.value.authorityId!==f.value||!m||m.kind!==`passkey`||m.status!==`active`||m.walletId!==r||m.walletAuthorityId!==f.value||m.walletAuthMethodId!==d.value)throw Error(`sync-account exact auth-method identity is invalid`);let h=E(n.walletCustody,`walletCustody`);if(h.kind!==`wallet_custody_sync_bootstrap_v1`)throw Error(`walletCustody kind is invalid`);let g=Wr(l.capability),_=pe(n.walletSession),v=fe(n.operationCredential),y={authority:u,walletAuthMethodId:d.value,walletAuthorityId:f.value,foundingAuthority:p.value,foundingAuthMethod:m,walletId:r,nearAccountId:i,nearEd25519SigningKeyId:a,signerSlot:uu(n.signerSlot,`signerSlot`),operationalPublicKey:T(n.publicKey,`publicKey`),relayerKeyId:T(o.relayerKeyId,`thresholdEd25519.relayerKeyId`),keyVersion:T(o.keyVersion,`thresholdEd25519.keyVersion`),credentialIdB64u:T(n.credentialIdB64u,`credentialIdB64u`),credentialPublicKeyB64u:T(n.credentialPublicKeyB64u,`credentialPublicKeyB64u`),session:pu(E(o.session,`thresholdEd25519.session`),s,{walletId:String(r),nearAccountId:String(i),nearEd25519SigningKeyId:a},_,v,{walletAuthorityId:f.value,walletAuthMethodId:d.value,authorityDigestB64u:p.value.authorityDigestB64u,authorityRevocationEpoch:p.value.revocationEpoch,materialActivation:g.materialActivation}),capability:g,walletSession:_,operationCredential:v,walletCustody:{envelope:Qt(h.envelope),storeVersion:T(h.storeVersion,`walletCustody.storeVersion`)}};return hu(y),y}function yu(e){let t=e.parsed,n=t.session,r=re(n.runtimePolicyScope),i=uo({walletId:String(t.walletId),nearAccountId:String(t.nearAccountId),nearEd25519SigningKeyId:t.nearEd25519SigningKeyId,walletSessionId:n.walletSessionId,authorizationId:n.authorizationId,quotaId:n.quotaId,thresholdSessionId:e.thresholdSessionId,remainingUses:n.remainingUses,expiresAtMs:n.expiresAtMs,runtimePolicyScope:n.runtimePolicyScope,signingRootId:r.signingRootId,signingRootVersion:String(r.signingRootVersion||``),routerAbNormalSigning:n.routerAbNormalSigning,walletSessionToken:_u(n),home:`operationCredential`in n?n.operationCredential.home:n.home,nowMs:Math.min(Date.now(),n.expiresAtMs-1)});if(!i.ok)throw Error(`recovered Yao Wallet Session is unusable: ${i.reason}`);return _c({walletId:Fe(t.walletId),nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:Jt(t.nearEd25519SigningKeyId),signerSlot:t.signerSlot,rpId:ft(e.rpId),credentialIdB64u:t.credentialIdB64u,relayerUrl:e.relayerUrl,authority:t.authority,signingWalletSession:i.value})}function bu(e){if(!b(e)||e.kind!==`wallet_custody_passkey_login_v1`)throw Error(`Passkey wallet unlock returned invalid custody data`);if(!b(e.ed25519))throw Error(`Passkey wallet unlock omitted Ed25519 custody continuity`);if(e.ed25519.kind===`absent`)return{kind:`wallet_custody_passkey_login_v1`,envelope:Qt(e.envelope),storeVersion:T(e.storeVersion,`walletCustody.storeVersion`),ed25519:{kind:`absent`}};if(e.ed25519.kind!==`active`)throw Error(`Passkey wallet unlock returned invalid Ed25519 custody state`);let t=Number(e.ed25519.signerSlot),n=e.ed25519.participantIds;if(!Number.isSafeInteger(t)||t<1||!Array.isArray(n)||n.length!==2||!n.every(e=>Number.isSafeInteger(e)&&Number(e)>0)||n[0]===n[1])throw Error(`Passkey wallet unlock returned invalid Ed25519 signer identity`);return{kind:`wallet_custody_passkey_login_v1`,envelope:Qt(e.envelope),storeVersion:T(e.storeVersion,`walletCustody.storeVersion`),ed25519:{kind:`active`,nearAccountId:T(e.ed25519.nearAccountId,`walletCustody.ed25519.nearAccountId`),nearEd25519SigningKeyId:T(e.ed25519.nearEd25519SigningKeyId,`walletCustody.ed25519.nearEd25519SigningKeyId`),signerSlot:t,publicKey:T(e.ed25519.publicKey,`walletCustody.ed25519.publicKey`),relayerKeyId:T(e.ed25519.relayerKeyId,`walletCustody.ed25519.relayerKeyId`),participantIds:[Number(n[0]),Number(n[1])],capability:Wr(e.ed25519.capability)}}}function xu(e){if(!b(e))throw Error(`ECDSA custody chain target is invalid`);let t=T(e.kind,`ecdsaCustody.chainTarget.kind`),n=Number(e.chainId),r=T(e.networkSlug,`ecdsaCustody.chainTarget.networkSlug`);if(!Number.isSafeInteger(n)||n<0||!r)throw Error(`ECDSA custody chain target is invalid`);if(t===`evm`){if(e.namespace!==`eip155`)throw Error(`ECDSA custody EVM namespace is invalid`);return{kind:`evm`,namespace:`eip155`,chainId:n,networkSlug:r}}if(t===`tempo`)return{kind:`tempo`,chainId:n,networkSlug:r};throw Error(`ECDSA custody chain target kind is invalid`)}function Su(e){if(!b(e)||e.kind!==`wallet_custody_ecdsa_sync_continuity_v1`)throw Error(`Passkey wallet unlock returned invalid ECDSA custody continuity`);if(!Array.isArray(e.signers))throw Error(`Passkey wallet unlock returned invalid ECDSA custody signers`);let t=[];for(let n of e.signers){if(!b(n)||!b(n.walletKey))throw Error(`Passkey wallet unlock returned invalid ECDSA custody signer`);let e=n.walletKey,r=e.participantIds;if(!Array.isArray(r)||r.length!==2||r[0]!==1||r[1]!==2)throw Error(`Passkey wallet unlock returned invalid ECDSA custody participants`);t.push({chainTarget:xu(n.chainTarget),walletKey:{walletId:T(e.walletId,`ecdsaCustody.walletKey.walletId`),keyHandle:T(e.keyHandle,`ecdsaCustody.walletKey.keyHandle`),ecdsaThresholdKeyId:T(e.ecdsaThresholdKeyId,`ecdsaCustody.walletKey.ecdsaThresholdKeyId`),signingRootId:T(e.signingRootId,`ecdsaCustody.walletKey.signingRootId`),signingRootVersion:T(e.signingRootVersion,`ecdsaCustody.walletKey.signingRootVersion`),relayerKeyId:T(e.relayerKeyId,`ecdsaCustody.walletKey.relayerKeyId`),contextBinding32B64u:T(e.contextBinding32B64u,`ecdsaCustody.walletKey.contextBinding32B64u`),derivationClientSharePublicKey33B64u:T(e.derivationClientSharePublicKey33B64u,`ecdsaCustody.walletKey.derivationClientSharePublicKey33B64u`),participantIds:[1,2],publicCapability:St(e.publicCapability)},activationReceipt:wt(n.activationReceipt),runtimePolicyScope:F(n.runtimePolicyScope)})}if(t.length===0)throw Error(`Passkey wallet unlock omitted ECDSA custody signers`);return{kind:`wallet_custody_ecdsa_sync_continuity_v1`,signers:t}}function Cu(e){let t=e.raw.sessionKind;if(t===`issued_exact_wallet_session`){let n=fe(e.raw.operationCredential);if(n.walletSessionId!==e.walletSessionId)throw Error(`Wallet unlock Ed25519 credential does not identify its session`);return{sessionKind:t,operationCredential:n}}if(t!==`already_committed_exact_wallet_session`)throw Error(`Wallet unlock returned an unsupported Ed25519 session kind`);if(e.raw.operationCredential!==void 0)throw Error(`Reused Ed25519 Wallet Session must not carry its own credential`);if(fe(e.unlockCredential).walletSessionId!==e.walletSessionId)throw Error(`Wallet unlock Ed25519 session reuses another Wallet Session`);return{sessionKind:t}}function wu(e,t){if(e===null)return null;if(!b(e))throw Error(`Wallet unlock returned invalid Ed25519 session data`);let n=s(e.thresholdSessionId),r=_e(e.authorizationId),i=ge(e.walletSessionId),a=me(e.quotaId),o=Number(e.expiresAtMs),c=Number(e.remainingUses),l=F(e.runtimePolicyScope),u=se(e.routerAbNormalSigning),d=e.participantIds;if(!n.ok||!r.ok||!i.ok||!a.ok||!Number.isSafeInteger(o)||o<=Date.now()||!Number.isSafeInteger(c)||c<1||!Array.isArray(d)||d.length!==2||!d.every(e=>Number.isSafeInteger(e)&&e>0)||d[0]===d[1])throw Error(`Wallet unlock returned invalid Ed25519 session lifecycle`);let f=Cu({raw:e,walletSessionId:i.value,unlockCredential:t});return{walletId:T(e.walletId,`ed25519Session.walletId`),nearAccountId:T(e.nearAccountId,`ed25519Session.nearAccountId`),nearEd25519SigningKeyId:T(e.nearEd25519SigningKeyId,`ed25519Session.nearEd25519SigningKeyId`),relayerKeyId:T(e.relayerKeyId,`ed25519Session.relayerKeyId`),participantIds:[Number(d[0]),Number(d[1])],thresholdSessionId:n.value,authorizationId:r.value,walletSessionId:i.value,quotaId:a.value,expiresAtMs:o,remainingUses:c,runtimePolicyScope:l,routerAbNormalSigning:u,...f}}function Tu(e){let t=e.authorization.record,n=ht(e.ecdsaSession.public_capability.material_activation),r=0;for(let e of t.capabilitySubjects)e.kind===`sign`&&e.keyFamily===`ecdsa_secp256k1`&&p(e.materialActivation,n)&&(r+=1);if(t.walletId!==e.ed25519Session.walletId||t.walletId!==e.ecdsaSession.public_capability.client_id||t.authorizationId!==e.ed25519Session.authorizationId||t.authorizationId!==e.ecdsaSession.session.authorization_id||t.quotaId!==e.ed25519Session.quotaId||t.quotaId!==e.ecdsaSession.session.quota_id||t.expiresAtMs!==e.ed25519Session.expiresAtMs||t.expiresAtMs!==e.ecdsaSession.session.expires_at_ms||e.ed25519Session.walletSessionId!==e.ecdsaSession.session.wallet_session_id||e.authorization.operationCredential.walletSessionId!==e.ed25519Session.walletSessionId||e.ed25519Session.remainingUses!==e.ecdsaSession.session.remaining_uses||r!==1)throw Error(`Passkey ECDSA activation authority does not match its Wallet Session`)}function Eu(e){let t=e.authorization.record;if(t.walletId!==e.ed25519Session.walletId||t.authorizationId!==e.ed25519Session.authorizationId||t.quotaId!==e.ed25519Session.quotaId||t.expiresAtMs!==e.ed25519Session.expiresAtMs||e.authorization.operationCredential.walletSessionId!==e.ed25519Session.walletSessionId)throw Error(`Passkey Ed25519 Wallet Session authorization is inconsistent`)}async function Du(e,t){let n=e.data.walletSession!==void 0;if(n!==(e.data.operationCredential!==void 0))throw Error(`Passkey wallet unlock returned a partial Wallet Session authorization`);if(n){if(e.ed25519Session.sessionKind!==`already_committed_exact_wallet_session`)throw Error(`Passkey wallet unlock returned competing Wallet Session credentials`);let t={record:pe(e.data.walletSession),operationCredential:fe(e.data.operationCredential)};return Eu({ed25519Session:e.ed25519Session,authorization:t}),t}if(e.ed25519Session.sessionKind!==`issued_exact_wallet_session`)throw Error(`Passkey wallet unlock omitted the exact Wallet Session credential`);let r=await t.read({relayerUrl:e.relayServerUrl,operationCredential:e.ed25519Session.operationCredential},{walletSessionId:e.ed25519Session.walletSessionId,quotaId:e.ed25519Session.quotaId});if(r.status!==`active`||r.walletSessionId!==e.ed25519Session.walletSessionId||r.quotaId!==e.ed25519Session.quotaId||r.expiresAtMs!==e.ed25519Session.expiresAtMs||r.remainingUses!==e.ed25519Session.remainingUses)throw Error(`Passkey wallet unlock returned an inconsistent issued Wallet Session`);let i={record:r.authorization,operationCredential:e.ed25519Session.operationCredential};return Eu({ed25519Session:e.ed25519Session,authorization:i}),i}async function Ou(e,t){let n=await Du(e,t);return Tu({ed25519Session:e.ed25519Session,ecdsaSession:e.ecdsaSession,authorization:n}),n}function ku(e){let t=Kn(e)??$n(e);return t?{success:!1,kind:`already_committed`,code:t.code,message:t.message,next:t.next,committed:t.committed}:null}async function Au(e,t,n){try{if(t.type!==`passkey_assertion`)throw Error(`Passkey wallet unlock requires a passkey assertion`);let r=T(t.challengeId,`challengeId`),a=t.webauthn_authentication,o=String(t.expected_origin||``).trim(),s={unlockBackend:`passkey`,challengeId:r,...`walletId`in t&&t.walletId?{walletId:t.walletId}:{},webauthn_authentication:Rn(a),ed25519SessionRequest:t.ed25519SessionRequest,...o?{expected_origin:o}:{},...t.ecdsaSessionPolicy?{ecdsaSessionPolicy:ut(t.ecdsaSessionPolicy)}:{}},c=i(e,`/wallet/unlock/verify`),l=await fetch(c,{method:`POST`,headers:{"Content-Type":`application/json`},credentials:`omit`,body:JSON.stringify(s)}),u=await l.json().catch(()=>({})),d=b(u)?u:{};if(!l.ok)return ku(d)||{success:!1,error:typeof d.message==`string`?d.message:`HTTP ${l.status}`};if(d.ok!==!0)return ku(d)||{success:!1,error:typeof d.message==`string`?d.message:`Wallet unlock verification failed`};let f=t.type===`passkey_assertion`&&t.ecdsaSessionPolicy!==void 0,p=wu(d.ed25519Session,d.operationCredential);if(t.ed25519SessionRequest.kind===`requested`&&!p)throw Error(`Wallet unlock omitted the requested Ed25519 Wallet Session`);if(t.ed25519SessionRequest.kind===`not_requested`&&p)throw Error(`Wallet unlock returned an unrequested Ed25519 Wallet Session`);let m=bu(d.walletCustody),h,g,_,v;if(f){if(d.ecdsaSession===void 0)throw Error(`Wallet unlock omitted the requested ECDSA Wallet Session activation`);if(h=b(d.ecdsaSession)&&d.ecdsaSession.kind===`router_ab_ecdsa_credential_free_session_activated_v1`?it(d.ecdsaSession):gt(d.ecdsaSession),d.ecdsaActivationReceipt===void 0||d.ecdsaCustody===void 0)throw Error(`Wallet unlock omitted ECDSA custody continuity`);if(_=wt(d.ecdsaActivationReceipt),v=Su(d.ecdsaCustody),!m)throw Error(`Wallet unlock omitted wallet custody for ECDSA activation`);if(h.kind===`router_ab_ecdsa_credential_free_session_activated_v1`){if(!p)throw Error(`Credential-free ECDSA activation requires an Ed25519 Wallet Session`);g=await Ou({relayServerUrl:e,data:d,ed25519Session:p,ecdsaSession:h},n)}}else if(d.ecdsaSession!==void 0)throw Error(`Wallet unlock returned an unrequested ECDSA Wallet Session activation`);else p&&(g=await Du({relayServerUrl:e,data:d,ed25519Session:p},n));if(h&&_&&v&&m){if(h.kind===`router_ab_ecdsa_credential_free_session_activated_v1`){if(!g)throw Error(`Credential-free ECDSA activation omitted exact Wallet Session authority`);return{success:!0,ecdsaSession:h,ecdsaActivationReceipt:_,ecdsaCustody:v,ed25519Session:p,walletCustody:m,walletSessionAuthorization:g}}return{success:!0,ecdsaSession:h,ecdsaActivationReceipt:_,ecdsaCustody:v,ed25519Session:p,walletCustody:m}}if(m&&p&&g)return{success:!0,ed25519Session:p,walletCustody:m,walletSessionAuthorization:g};if(m&&!p)return{success:!0,ed25519Session:null,walletCustody:m};throw Error(`Passkey wallet unlock returned incomplete exact session state`)}catch(e){return{success:!1,error:Ce(e)||`Failed to verify wallet unlock`}}}async function ju(e,t){try{let n=T(t.challengeId,`challengeId`),r=String(t.expected_origin||``).trim(),a={unlockBackend:`passkey`,challengeId:n,webauthn_authentication:Rn(t.webauthn_authentication),ed25519SessionRequest:t.ed25519SessionRequest,...r?{expected_origin:r}:{}},o=await fetch(i(e,`/wallet/unlock/verify`),{method:`POST`,headers:{"Content-Type":`application/json`},credentials:`omit`,body:JSON.stringify(a)}),s=await o.json().catch(()=>({})),c=b(s)?s:{};if(!o.ok||c.ok!==!0)return ku(c)||{success:!1,error:typeof c.message==`string`?c.message:`Wallet Session unlock failed (HTTP ${o.status})`};if(c.walletCustody!==void 0&&c.walletCustody!==null)throw Error(`Linked passkey unlock returned custody data`);if(c.ecdsaSession!==void 0&&c.ecdsaSession!==null)throw Error(`Linked passkey unlock returned an ECDSA activation`);let l=wu(c.ed25519Session,c.operationCredential);if(t.ed25519SessionRequest.kind===`requested`&&!l)throw Error(`Linked passkey unlock omitted the requested Ed25519 Wallet Session`);if(t.ed25519SessionRequest.kind===`not_requested`&&l)throw Error(`Linked passkey unlock returned an unrequested Ed25519 Wallet Session`);return{success:!0,walletSession:pe(c.walletSession),operationCredential:fe(c.operationCredential),ed25519Session:l}}catch(e){return{success:!1,error:Ce(e)||`Failed to verify linked passkey Wallet Session`}}}function Mu(e){let t=g(e);if(!t.ok)throw Error(`ECDSA registration recovery could not create a session id`);return t.value}function Nu(e){let t=he(e);if(!t.ok)throw Error(`ECDSA registration recovery could not create a Wallet Session mint id`);return t.value}function Pu(e){return ut({kind:`router_ab_ecdsa_post_registration_session_activation_policy_v1`,key_handle:e.keyHandle,session_policy:{threshold_session_id:Mu(fr(`threshold-ecdsa-registration-recovery`)),wallet_session_mint_id:Nu(fr(`wallet-session-mint`)),ttl_ms:e.sessionPolicy.ttlMs,remaining_uses:e.sessionPolicy.unlockRemainingUses,runtime_policy_scope:e.runtimePolicyScope}})}async function Fu(e){let t=await fetch(i(e.relayerUrl,`/wallet/unlock/challenge`),{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({unlockBackend:`passkey`,userId:e.walletId,rpId:e.rpId})}),n=E(await t.json().catch(()=>({})),`Passkey unlock challenge response`);if(!t.ok||n.ok!==!0)throw Error(typeof n.message==`string`&&n.message?n.message:`wallet/unlock/challenge failed (HTTP ${t.status})`);return{challengeId:y(n.challengeId,`Passkey unlock challenge ID`),challengeB64u:y(n.challengeB64u,`Passkey unlock challenge`)}}function Iu(e){return e===`ble`||e===`hybrid`||e===`internal`||e===`nfc`||e===`usb`}function Lu(e,t){return{id:e,type:`public-key`,transports:t.filter(Iu)}}function Ru(e){let t=e.session.session.wallet_session;if(t.walletId!==e.pending.walletId||t.authMethodId!==e.pending.walletAuthMethodId||t.authorityId!==e.response.foundingAuthority.authorityId||t.expiresAtMs!==e.session.session.expires_at_ms||t.authorizationId!==e.session.session.authorization_id||t.quotaId!==e.session.session.quota_id||e.session.session.remaining_uses<=0||e.session.session.expires_at_ms<=Date.now()||e.session.session.wallet_session_id!==e.session.session.operation_credential.walletSessionId||!_t(e.session.public_capability,e.walletKey.publicCapability))throw Error(`ECDSA registration unlock did not issue the exact Wallet Session`)}function zu(e){if(e.signers.length!==e.walletKeys.length)throw Error(`ECDSA registration unlock returned incomplete custody continuity`);let t=new Map;for(let n of e.walletKeys){let e=Le(n.chainTarget);if(t.has(e))throw Error(`ECDSA registration has duplicate custody targets`);t.set(e,n)}for(let n of e.signers){let r=Le(n.chainTarget),i=t.get(r);if(!i)throw Error(`ECDSA registration unlock returned an unknown target`);if(t.delete(r),n.walletKey.walletId!==e.pending.walletId||n.walletKey.keyHandle!==i.keyHandle||n.walletKey.ecdsaThresholdKeyId!==i.ecdsaThresholdKeyId||n.walletKey.signingRootId!==i.signingRootId||n.walletKey.signingRootVersion!==i.signingRootVersion||n.walletKey.relayerKeyId!==i.relayerKeyId||n.walletKey.contextBinding32B64u!==i.contextBinding32B64u||n.walletKey.derivationClientSharePublicKey33B64u!==i.derivationClientSharePublicKey33B64u||!_t(n.walletKey.publicCapability,i.publicCapability)||!Tt(n.activationReceipt,e.response.ecdsa.activation))throw Error(`ECDSA registration unlock returned different custody continuity`)}}function Bu(e){new Uint8Array(e).fill(0)}async function Vu(e){if(e.pending.auth.kind!==`passkey`)throw Error(`ECDSA registration passkey unlock has a different pending factor`);let t=e.walletKeys[0];if(!t)throw Error(`ECDSA registration unlock has no primary wallet key`);let n=typeof window<`u`?window.location.origin:``;if(!n)throw Error(`ECDSA registration passkey unlock requires an origin`);Dl(e.onEvent,String(e.pending.walletId),{phase:hn.STEP_03_PASSKEY_CHALLENGE_STARTED,status:`running`,authMethod:`passkey`});let r=await Fu({relayerUrl:e.relayerUrl,walletId:String(e.pending.walletId),rpId:e.pending.auth.rpId});Dl(e.onEvent,String(e.pending.walletId),{phase:hn.STEP_03_PASSKEY_PROMPT_STARTED,status:`waiting_for_user`,authMethod:`passkey`,interaction:{kind:`passkey_assert`,overlay:`show`}});let i=await e.signingSurface.getAuthenticationCredentialsSerialized({subjectId:String(e.pending.walletId),challengeB64u:r.challengeB64u,allowCredentials:[Lu(e.pending.auth.credentialIdB64u,e.pending.auth.transports)],includeSecondPrfOutput:!0});if(bl(i)!==e.pending.auth.credentialIdB64u)throw Error(`ECDSA registration unlock returned a different Passkey credential`);Dl(e.onEvent,String(e.pending.walletId),{phase:hn.STEP_03_PASSKEY_PROMPT_SUCCEEDED,status:`succeeded`,authMethod:`passkey`,interaction:{kind:`passkey_assert`,overlay:`hide`}});let a=yl(i,`ECDSA registration recovery`),o=await Au(e.relayerUrl,{type:`passkey_assertion`,challengeId:r.challengeId,walletId:String(e.pending.walletId),webauthn_authentication:i,ed25519SessionRequest:{kind:`not_requested`},expected_origin:n,ecdsaSessionPolicy:Pu({keyHandle:t.keyHandle,sessionPolicy:e.sessionPolicy,runtimePolicyScope:rl(e.response).ecdsa.runtimePolicyScope})},new dr);if(!o.success)throw Error(o.error||`Passkey ECDSA registration unlock failed`);if(o.ecdsaSession.kind!==`router_ab_ecdsa_post_registration_session_activated_v1`||!o.ecdsaCustody||!o.walletCustody)throw Error(`Passkey ECDSA registration unlock did not issue exact session custody`);Ru({pending:e.pending,response:e.response,session:o.ecdsaSession,walletKey:t}),zu({pending:e.pending,response:e.response,walletKeys:e.walletKeys,signers:o.ecdsaCustody.signers});let s=Uint8Array.from(L(a)).buffer;try{let n=await e.signingSurface.rejoinWalletCustodyEvmFamilyKeySet({walletId:String(e.pending.walletId),custodyJson:jl(e.pending.localMaterial.custodyCommit),factorSecret:s,evmFamilySigningKeySlotId:t.evmFamilySigningKeySlotId,applicationBindingDigestB64u:e.response.ecdsa.bootstrap.applicationBindingDigestB64u,registeredClientRootPublicKey33B64u:t.derivationClientSharePublicKey33B64u,relayerPublicIdentityJson:JSON.stringify({relayerKeyId:t.relayerKeyId,relayerPublicKey33B64u:t.relayerVerifyingShareB64u,groupPublicKey33B64u:t.thresholdEcdsaPublicKeyB64u,ethereumAddress:t.thresholdOwnerAddress,relayerShareRetryCounter:t.relayerShareRetryCounter})});return{kind:`passkey`,credential:i,custody:o.walletCustody,session:o.ecdsaSession,readyStateBlobB64u:n.readyStateBlobB64u,publicFacts:n.publicFacts}}finally{Bu(s)}}async function Hu(e){if(e.pending.auth.kind!==`email_otp`)throw Error(`ECDSA registration Email OTP unlock has a different pending factor`);let t=e.walletKeys[0];if(!t)throw Error(`ECDSA registration unlock has no primary wallet key`);let n=rl(e.response).ecdsa.runtimePolicyScope,r=await ou({walletSession:{walletId:Fe(e.pending.walletId),walletSessionUserId:String(e.pending.walletId)},authoritySelector:{kind:`wallet_auth_method`,walletAuthMethodId:e.pending.walletAuthMethodId},relayUrl:e.relayerUrl,groupId:ae,routePlan:$l({freshRouteFamily:`login`,operation:Ue}),workerCtx:e.signingSurface.getSignerWorkerContext(),verification:{kind:`otp`,challengeId:e.exactMethod.challengeId,otpCode:e.exactMethod.otpCode},runtimePolicyScope:n,ecdsaSessionHandleBinding:{keyHandle:t.keyHandle,authSubjectId:e.pending.auth.providerSubject,operation:`wallet_unlock`,chainTarget:t.chainTarget},ecdsaSessionPolicy:Pu({keyHandle:t.keyHandle,sessionPolicy:e.sessionPolicy,runtimePolicyScope:n})});if(r.operation!==`wallet_unlock`)throw Error(`Email OTP ECDSA registration unlock returned the wrong operation`);return Ru({pending:e.pending,response:e.response,session:r.ecdsaSession,walletKey:t}),zu({pending:e.pending,response:e.response,walletKeys:e.walletKeys,signers:r.ecdsaCustody.continuity.signers}),{kind:`email_otp`,session:r.ecdsaSession,readyStateBlobB64u:r.ecdsaCustody.readyStateBlobB64u,publicFacts:r.ecdsaCustody.publicFacts}}async function Uu(e){switch(e.exactMethod.kind){case`passkey`:return await Vu({relayerUrl:e.relayerUrl,sessionPolicy:e.sessionPolicy,onEvent:e.onEvent,pending:e.pending,response:e.response,walletKeys:e.walletKeys,exactMethod:e.exactMethod,signingSurface:e.signingSurface});case`email_otp`:return await Hu({relayerUrl:e.relayerUrl,sessionPolicy:e.sessionPolicy,onEvent:e.onEvent,pending:e.pending,response:e.response,walletKeys:e.walletKeys,exactMethod:e.exactMethod,signingSurface:e.signingSurface});default:throw e.exactMethod,Error(`Unsupported pending registration unlock method: ${String(e.exactMethod)}`)}}const Wu={listPendingWalletRegistrationCommits:Gu,completeWalletRegistrationNearProvisioning:Zn,publishPendingWalletRegistrationCommit:Ku};async function Gu(){return await V.initialize(),await V.listPendingWalletRegistrationCommits()}async function Ku(e){return await V.publishPendingWalletRegistrationCommit(e)}function qu(e){return e instanceof Error?e:Error(String(e||`pending registration replay failed`))}function Ju(e){return e.operation===`near_provisioning`&&e.phase===`joined`}function Yu(e,t){let n=e.localMaterial.ed25519.metadata,r=e.localMaterial.ed25519.localMaterial;return{binding:{kind:Ze,applicationBindingDigestB64u:r.applicationBindingDigestB64u,registeredPublicKeyB64u:n.registeredPublicKeyB64u,participantIds:n.participantIds,stateEpoch:n.stateEpoch,walletId:String(t.walletId),nearAccountId:t.ed25519.nearAccountId,nearEd25519SigningKeyId:t.ed25519.nearEd25519SigningKeyId,signerSlot:t.ed25519.signerSlot,signingWorkerId:n.signingWorkerId,signingWorkerVerifyingShareB64u:n.signingWorkerVerifyingShareB64u},sealed:{ciphertextB64u:r.b64u,nonceB64u:r.nonceB64u}}}function Xu(e){let t=L(e.localMaterial.ed25519.metadata.registeredPublicKeyB64u);if(t.length!==32)throw Error(`pending registration has an invalid Ed25519 registered public key`);return`ed25519:${Te(t)}`}function Zu(e,t,n){let r=e.localMaterial.ed25519.metadata,i=e.localMaterial.custodyCommit;if(e.auth.kind===`passkey`){if(Zc({clientPublicKey:n,finalized:t,expectedRpId:e.auth.rpId,expectedWalletId:e.walletId}).credentialIdB64u!==e.auth.credentialIdB64u)throw Error(`pending registration returned a different Passkey credential`)}else Qc({clientPublicKey:n,finalized:t,expectedRegistrationAuthorityId:e.auth.registrationAuthorityId,expectedWalletId:e.walletId});if(t.foundingAuthMethod.walletAuthMethodId!==e.walletAuthMethodId||t.foundingAuthMethod.walletId!==e.walletId||t.foundingAuthority.walletId!==e.walletId||t.ed25519.signerSlot!==r.signerSlot||t.ed25519.nearEd25519SigningKeyId!==r.nearEd25519SigningKeyId||t.ed25519.participantIds[0]!==r.participantIds[0]||t.ed25519.participantIds[1]!==r.participantIds[1]||t.ed25519.routerAbNormalSigning.signingWorkerId!==r.signingWorkerId||t.ed25519.relayerKeyId!==t.ed25519.routerAbNormalSigning.signingWorkerId||t.custodyKeyManifestDigestB64u!==i.keyManifestDigestB64u||i.registeredPublicKeyB64u!==void 0&&i.registeredPublicKeyB64u!==r.registeredPublicKeyB64u)throw Error(`pending registration does not match the committed NEAR projection`);Sn(e,{operation:e.operation,walletId:t.walletId,walletAuthMethodId:t.foundingAuthMethod.walletAuthMethodId,authority:t.authority})}function Qu(e,t){let n=t.registrationEstablishedSession.session,r=n.tokens.kind===`near_ed25519`||n.tokens.kind===`near_ed25519_and_evm_family_ecdsa`?n.tokens.ed25519:null,i=e.localMaterial.ed25519.metadata;if(n.walletId!==e.walletId||!r||r.nearAccountId!==t.ed25519.nearAccountId||r.nearEd25519SigningKeyId!==t.ed25519.nearEd25519SigningKeyId||r.routerAbNormalSigning.signingWorkerId!==i.signingWorkerId||!p(r.materialActivation,i.materialActivation))throw Error(`pending registration does not match the committed Wallet Session projection`)}function $u(e,t){Qu(e,t);let n=t.registrationEstablishedSession;if(n.kind===`issued`){if(n.session.walletSession.walletId!==e.walletId||n.session.walletSession.authMethodId!==e.walletAuthMethodId)throw Error(`pending registration issued a Wallet Session for another auth method`);return}if(n.next!==`unlock_exact_method`)throw Error(`pending registration replay has an invalid continuation`)}function ed(e,t,n){if(!t.ok||t.kind!==`near_ed25519`)throw Error(t.ok?`pending registration replay returned a different signer branch`:`pending registration replay failed: ${t.code}`);if(t.walletCustody?.status!==n)throw Error(`pending registration replay did not commit the expected wallet custody`);return Zu(e,t,Xu(e)),t}function td(e,t){let n=ed(e,t,e.signerPlanKind===`near_ed25519`?`committed`:`joined`);if(e.signerPlanKind===`near_ed25519_and_evm_family_ecdsa`&&(n.registrationEstablishedSession.kind!==`already_committed`||n.registrationEstablishedSession.session.tokens.kind!==`near_ed25519_and_evm_family_ecdsa`))throw Error(`NEAR completion must extend the committed ECDSA session`);return $u(e,n),n}async function nd(e,t){let n=Xu(e),r={walletId:e.walletId,nearAccountId:z(t.ed25519.nearAccountId),nearEd25519SigningKeyId:t.ed25519.nearEd25519SigningKeyId,signerSlot:t.ed25519.signerSlot,operationalPublicKey:n,relayerKeyId:t.ed25519.relayerKeyId,keyVersion:t.ed25519.keyVersion,participantIds:t.ed25519.participantIds,custodyMaterial:Yu(e,t)};if(e.auth.kind===`passkey`){if(t.authMethod.kind!==`passkey`)throw Error(`pending Passkey registration replay returned a non-Passkey auth method`);return Qe({...r,rpId:e.auth.rpId,credentialIdB64u:e.auth.credentialIdB64u,credentialPublicKeyB64u:t.authMethod.credentialPublicKeyB64u,transports:e.auth.transports})}if(t.authMethod.kind!==`email_otp`)throw Error(`pending Email OTP registration replay returned a non-Email OTP auth method`);let i=ct(t.authority);if(!i)throw Error(`pending Email OTP registration replay returned an invalid authority`);return await et({...r,email:e.auth.email,registrationAuthorityId:e.auth.registrationAuthorityId,authority:i})}function rd(e,t,n){return{pending:e,authority:t.authority,foundingAuthority:{authority:t.foundingAuthority,authMethod:t.foundingAuthMethod},request:{operation:e.operation,registrationCeremonyId:e.registrationCeremonyId,idempotencyKey:e.idempotencyKey,walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId},ecdsaContinuity:[],walletSessionPublication:t.registrationEstablishedSession.kind===`issued`?{kind:`issued`,walletSession:t.registrationEstablishedSession.session.walletSession,operationCredential:t.registrationEstablishedSession.session.operationCredential}:{kind:`credential_free_projection`,walletSession:t.registrationEstablishedSession.session.walletSession},registration:n}}function id(e){switch(e.auth.kind){case`passkey`:return{kind:`passkey`};case`email_otp`:return{kind:`email_otp`,enrollment:e.auth.enrollment};default:throw e.auth,Error(`pending registration has an unsupported auth method`)}}function ad(e,t){return{relayerUrl:e,registrationCeremonyId:t.registrationCeremonyId,signedSetup:t.signedSetup,idempotencyKey:t.idempotencyKey,ed25519:{activationReference:t.localMaterial.ed25519.activationReference},auth:id(t),walletCustodyCommit:t.localMaterial.custodyCommit}}async function od(e){let t=ad(e.relayerUrl,e.pending),n=await e.ports.completeWalletRegistrationNearProvisioning(t);return td(e.pending,n)}async function sd(e){let t=await Zn({...ad(e.relayerUrl,e.pending),headers:N(e.operationCredential)}),n=td(e.pending,t),r=n.registrationEstablishedSession.session;if(r.tokens.kind!==`near_ed25519_and_evm_family_ecdsa`)throw Error(`Persisted mixed registration has no NEAR session`);let i=r.tokens.ed25519,a=Ht({kind:`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`,walletId:e.pending.walletId,nearAccountId:n.ed25519.nearAccountId,nearEd25519SigningKeyId:n.ed25519.nearEd25519SigningKeyId,signerSlot:n.ed25519.signerSlot,thresholdSessionId:i.thresholdSessionId,signingWorkerId:n.ed25519.routerAbNormalSigning.signingWorkerId,participantIds:n.ed25519.participantIds});if(!a.ok)throw Error(a.message);let o=await fetch(`${e.relayerUrl.replace(/\/$/,``)}${Bt}`,{method:`POST`,headers:{...N(e.operationCredential),"Content-Type":`application/json`},body:JSON.stringify(a.value)}),s=await o.json();if(!o.ok||!s||typeof s!=`object`)throw Error(`Persisted NEAR registration activation is unavailable`);let c=Wr(Reflect.get(s,`capability`)),l=e.pending.localMaterial.ed25519.metadata;if(c.registrationContinuity.kind!==`registration`||c.applicationBinding.wallet_id!==e.pending.walletId||c.applicationBinding.near_ed25519_signing_key_id!==l.nearEd25519SigningKeyId||c.lifecycle.lifecycleId!==e.pending.localMaterial.ed25519.activationReference.lifecycle_id||c.lifecycle.thresholdSessionId!==i.thresholdSessionId||c.lifecycle.signingWorkerId!==l.signingWorkerId||c.applicationBinding.key_creation_signer_slot!==l.signerSlot||I(Uint8Array.from(c.registeredPublicKey))!==l.registeredPublicKeyB64u||!p(c.materialActivation,l.materialActivation))throw Error(`Persisted NEAR registration activation changed identity`);let u=c.registrationContinuity;return{joined:{commitPayload:e.pending.localMaterial.custodyCommit,activationReference:e.pending.localMaterial.ed25519.activationReference,localMaterial:e.pending.localMaterial.ed25519.localMaterial,metadata:ua({material:Yu(e.pending,n),activation:{materialActivation:c.materialActivation,lifecycleId:c.lifecycle.lifecycleId,signingRootVersion:c.lifecycle.rootShareEpoch,signingRootId:c.applicationBinding.signing_root_id,signerSetId:c.lifecycle.signerSetId,thresholdSessionId:c.lifecycle.thresholdSessionId,activationTranscriptB64u:I(Uint8Array.from(u.activationTranscript)),activationCapabilityBindingB64u:I(Uint8Array.from(c.activeCapabilityBinding))}})},admissionRequest:u.admissionRequest,admissionReceipt:u.admissionReceipt}}async function cd(e){let t=await od(e),n=await nd(e.pending,t);return await e.ports.publishPendingWalletRegistrationCommit(rd(e.pending,t,n)),{kind:`published`,registrationCeremonyId:e.pending.registrationCeremonyId}}async function ld(e){let t=e.ports||Wu,n=await t.listPendingWalletRegistrationCommits(),r=[];for(let i of n){if(tl(i)||nl(i)){r.push({kind:`unlock_required`,registrationCeremonyId:i.registrationCeremonyId,keyFamilies:i.localMaterial.keyFamilies,next:`unlock_exact_method`,reason:`ecdsa_local_finalization`});continue}if(i.operation===`near_provisioning`&&i.signerPlanKind===`near_ed25519_and_evm_family_ecdsa`){r.push({kind:`unlock_required`,reason:`near_provisioning`,registrationCeremonyId:i.registrationCeremonyId,next:`unlock_exact_method`});continue}if(Ju(i))try{r.push(await cd({relayerUrl:e.relayerUrl,pending:i,ports:t}))}catch(e){r.push({kind:`failed`,registrationCeremonyId:i.registrationCeremonyId,error:qu(e)})}}return r}const ud={activateWalletRegistration:Jn,publishPendingWalletRegistrationCommit:Ku,unlockPendingEcdsaRegistration:Uu};async function dd(e){await V.initialize();let t=null;for(let n of await V.listPendingWalletRegistrationCommits())if(!(n.operation!==`registration_activate`||n.walletId!==e)){if(t)throw Error(`wallet has multiple pending registration activations`);t=n}if(!t)return null;if(!tl(t)&&!nl(t))throw Error(`pending registration commit is not ECDSA-enabled`);return t}async function fd(e){if(e.pending.auth.kind!==e.exactMethod.kind)throw Error(`pending registration requires its exact authentication method`);return await El({relayerUrl:e.relayerUrl,sessionPolicy:e.sessionPolicy,pending:e.pending,exactMethod:e.exactMethod,signingSurface:e.signingSurface,ports:ud,nearContext:e.nearContext,nearCompletion:e.nearCompletion,onEvent:e.onEvent})}async function pd(e){let t=performance.now();pr(`evm-family`,{event:`ecdsa_session_prefill`,trigger:e.trigger,chainTarget:e.chainTarget,status:`started`,startedAtMs:t});try{let n=await e.signingEngine.scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill({walletId:e.walletId,chainTarget:e.chainTarget},e.statusReads);pr(`evm-family`,{event:`ecdsa_session_prefill`,trigger:e.trigger,chainTarget:e.chainTarget,status:n.status,reason:n.reason,scheduleReason:`schedule`in n?n.schedule.reason:null,walletSessionId:n.walletSessionId,durationMs:performance.now()-t})}catch{pr(`evm-family`,{event:`ecdsa_session_prefill`,trigger:e.trigger,chainTarget:e.chainTarget,status:`failed`,reason:`unexpected_error`,durationMs:performance.now()-t})}}const md=new Map,hd=new Set;function gd(e,t){for(let n of hd)try{n(e,t)}catch{}}function _d(e,t){let n=String(e),r=md.get(n);if(r)return r;let i={state:{status:`near_pending`,updatedAtMs:t},inFlight:null};return md.set(n,i),i}function vd(e){return md.get(String(e))?.state??null}async function yd(e){let t=md.get(String(e));return t?t.inFlight?await t.inFlight:t.state:null}function bd(e,t){let n=_d(e,t.updatedAtMs);n.state.status===`near_ready`&&t.status!==`near_ready`||(n.state=t,gd(e,t))}function xd(e){return hd.add(e),()=>{hd.delete(e)}}function Sd(e){let t=_d(e.walletId,e.nowMs());if(t.inFlight)return t.inFlight;if(t.state.status===`near_ready`)return Promise.resolve(t.state);bd(e.walletId,{status:`near_provisioning`,updatedAtMs:e.nowMs()});let n=(async()=>{try{return await e.attempt()}catch(t){return{status:`near_failed_retryable`,updatedAtMs:e.nowMs(),error:t instanceof Error?t.message:String(t),errorCode:`near_provisioning_failed`}}})().then(n=>(t.inFlight=null,bd(e.walletId,n),n));return t.inFlight=n,n}function Cd(e){let t=e.registration;if(t.mode!==`managed`)return;let n=String(t.projectEnvironmentId||``).trim(),r=String(t.publishableKey||``).trim();if(!(!n||!r))return{projectEnvironmentId:n,publishableKey:r}}async function wd(e){let t=(await V.listWalletAuthMethodsV2ForWallet(String(e.walletId))).filter(t=>t.kind===`passkey`&&t.status===`active`&&t.walletId===e.walletId&&String(t.rpId)===e.rpId&&String(t.credentialIdB64u)===e.credentialIdB64u),[n]=t;if(t.length!==1||!n)throw Error(`passkey authority requires one exact active V2 auth method`);return n}async function Td(e){let t=await wd(e);return await st({authority:{walletId:t.walletId,factor:{kind:`passkey`,credentialIdB64u:t.credentialIdB64u},verifier:{kind:`webauthn`,rpId:t.rpId},bindingId:t.walletAuthMethodId}})}const Ed=[`walletId`,`envelopeId`,`factor`,`envelopeRevision`,`binding`,`ownership`];function Dd(e){let t=Od(e.replacement.envelopeBindingJson);if(t.walletId!==e.expectedWalletId)throw Error(`recovery replacement envelope changed the wallet identity`);if(t.envelopeId!==e.replacement.envelopeId)throw Error(`recovery replacement envelope changed the envelope identity`);let n=Qt({kind:rn,envelopeId:t.envelopeId,walletId:t.walletId,binding:t.binding,factor:t.factor,ownership:$t(t.ownership,`recoveryReplacementEnvelope.binding.ownership`),envelopeVersion:rn,envelopeRevision:t.envelopeRevision,nonceB64u:e.replacement.envelopeNonceB64u,sealedCustodySecretB64u:e.replacement.sealedCustodySecretB64u,ciphertextDigestB64u:e.replacement.envelopeCiphertextDigestB64u,aadHashB64u:e.replacement.envelopeAadHashB64u,lifecycle:{state:`active`,activatedAtMs:e.activatedAtMs},createdAtMs:e.activatedAtMs,updatedAtMs:e.activatedAtMs},`recoveryReplacementEnvelope`);if(n.binding.kind!==`wallet_custody_seed_v1`)throw Error(`custody envelope must seal the wallet custody seed`);return n}function Od(e){let t;try{t=JSON.parse(e)}catch{throw Error(`recovery replacement envelope binding is not JSON`)}let n=E(t,`recoveryReplacementEnvelope.binding`);return A(n,Ed,`recoveryReplacementEnvelope.binding`),n}const kd=`passkeyCustodyEnvelopeCacheV1`,Ad=`passkey_custody_envelope_cache_v1`;let jd={kind:`unconfigured`};const Md=new Map;function Nd(e){throw Error(`unknown passkey custody session cache persistence state: ${String(e)}`)}function Pd(){switch(jd.kind){case`configured`:return jd.persistence;case`unconfigured`:throw Error(`passkey custody session cache persistence is not configured`);default:return Nd(jd)}}function Fd(e){jd={kind:`configured`,persistence:e}}function Id(e,t){let n=String(e||``).trim(),r=String(t||``).trim();if(!n||!r)throw Error(`passkey custody session identity is required`);return`${n}:${r}`}function Ld(){return{kind:Ad,envelopes:[]}}function Rd(e){if(e==null)return Ld();if(typeof e!=`object`||Array.isArray(e))throw Error(`passkey custody envelope cache is invalid`);let t=e;if(t.kind!==Ad||!Array.isArray(t.envelopes))throw Error(`passkey custody envelope cache has an invalid shape`);return{kind:Ad,envelopes:t.envelopes.map(e=>{let t=Qt(e);if(!en(t.binding))throw Error(`generic passkey custody cache cannot contain an Ed25519 export root`);return t})}}async function zd(){return Rd(await Pd().readCacheEntry(kd))}async function Bd(e){await Pd().writeCacheEntry(kd,e)}async function Vd(e){if(e.envelope.lifecycle.state!==`active`)throw Error(`passkey custody session envelope is not active`);if(!en(e.envelope.binding))throw Error(`generic passkey custody cache accepts wallet custody seeds only`);if(String(e.envelope.walletId)!==String(e.walletId)||e.envelope.factor.kind!==`passkey`||String(e.envelope.factor.credentialIdB64u)!==String(e.credentialIdB64u))throw Error(`passkey custody session envelope identity changed`);let t=Id(String(e.walletId),String(e.credentialIdB64u));Md.set(t,e.envelope);let n=(await zd()).envelopes.filter(e=>e.factor.kind!==`passkey`||Id(String(e.walletId),String(e.factor.credentialIdB64u))!==t);n.push(e.envelope),await Bd({kind:Ad,envelopes:n.slice(-32)})}async function Hd(e){let t=Id(String(e.walletId),String(e.credentialIdB64u)),n=Md.get(t);if(n)return n;let r=(await zd()).envelopes.find(e=>e.lifecycle.state===`active`&&e.factor.kind===`passkey`&&Id(String(e.walletId),String(e.factor.credentialIdB64u))===t);return r?(Md.set(t,r),r):null}function Ud(e){return Math.max(0,Math.round(performance.now()-e))}function Wd(){return{kind:`registration_confirmation_diagnostics_v1`,workerReadyMs:0,workerRequestRoundTripMs:0,workerResponseValidationMs:0,requestSetupMs:0,promptUserMs:0,promptElementDefineMs:0,promptMountMs:0,promptHostFirstUpdateMs:0,promptHostInteractiveMs:0,promptConfirmEventMs:0,promptDecisionWaitMs:0,credentialCreateStartMs:0,credentialCreateMs:0,credentialSerializeMs:0,duplicateRetryCount:0,mainThreadTotalMs:0}}function Gd(e){let t=performance.now(),n=yl(e.credential,`Passkey registration authority`),r=Ud(t),i=performance.now(),a=Ln(e.credential),o=Ud(i);return{kind:`passkey`,credential:e.credential,webauthnRegistration:a,prfFirstB64u:n,diagnostics:{kind:`passkey_registration_authority_diagnostics_v1`,requestConfirmationMs:e.requestConfirmationMs,prfExtractionMs:r,credentialRedactionMs:o,confirmationWorkerReadyMs:e.diagnostics.workerReadyMs,confirmationWorkerRequestRoundTripMs:e.diagnostics.workerRequestRoundTripMs,confirmationWorkerResponseValidationMs:e.diagnostics.workerResponseValidationMs,confirmationRequestSetupMs:e.diagnostics.requestSetupMs,confirmationPromptUserMs:e.diagnostics.promptUserMs,confirmationPromptElementDefineMs:e.diagnostics.promptElementDefineMs,confirmationPromptMountMs:e.diagnostics.promptMountMs,confirmationPromptHostFirstUpdateMs:e.diagnostics.promptHostFirstUpdateMs,confirmationPromptHostInteractiveMs:e.diagnostics.promptHostInteractiveMs,confirmationPromptConfirmEventMs:e.diagnostics.promptConfirmEventMs,confirmationPromptDecisionWaitMs:e.diagnostics.promptDecisionWaitMs,confirmationCredentialCreateStartMs:e.diagnostics.credentialCreateStartMs,confirmationCredentialCreateMs:e.diagnostics.credentialCreateMs,confirmationCredentialSerializeMs:e.diagnostics.credentialSerializeMs,confirmationDuplicateRetryCount:e.diagnostics.duplicateRetryCount,confirmationMainThreadTotalMs:e.diagnostics.mainThreadTotalMs}}}async function Kd(e){let t=performance.now();return Gd({credential:await e,diagnostics:Wd(),requestConfirmationMs:Ud(t)})}async function qd(e){let t=performance.now(),n=await e.context.signingEngine.requestRegistrationCredentialConfirmation({walletId:e.walletId,signerSlot:e.signerSlot,confirmerText:e.options.confirmerText,confirmationConfigOverride:e.confirmationConfigOverride,challengeB64u:e.registrationIntentDigestB64u}),r=Ud(t),i=n.registrationDiagnostics??Wd();return Gd({credential:n.credential,diagnostics:i,requestConfirmationMs:r})}function Jd(e){let t=e.trim();if(!t)throw Error(`Registration finalize idempotency key is required`);return t}function Yd(e){let t=l(e.materialActivation);if(!t.ok)throw Error(`Email OTP Ed25519 material activation is invalid`);let n=String(e.nearAccountId||``).trim(),r=String(e.operationalPublicKey||``).trim(),i=String(e.thresholdSessionId||``).trim(),a=Number(e.signerSlot);if(!n||!r||!i)throw Error(`Email OTP Ed25519 signer identity is incomplete`);if(!Number.isSafeInteger(a)||a<1)throw Error(`Email OTP Ed25519 signer slot is invalid`);let o=ie(e.runtimePolicyScope);if(!o)throw Error(`Email OTP Ed25519 runtime policy scope is invalid`);return{materialActivation:t.value,nearAccountId:n,signerSlot:a,operationalPublicKey:r,thresholdSessionId:i,runtimePolicyScope:o}}function Xd(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`Email OTP Ed25519 signer selection must be an object`);let t=e;if(t.kind===`absent`)return{kind:`absent`};if(t.kind!==`present`)throw Error(`Email OTP Ed25519 signer selection kind is invalid`);return{kind:`present`,...Yd(t)}}function Zd(e){let t=ef(e,`wallet/email-otp/challenge signerSelection`);if(t.kind===`ed25519_only`)return{kind:`ed25519_only`,...Yd(t)};if(t.kind!==`ecdsa`)throw Error(`wallet/email-otp/challenge signerSelection kind is invalid`);return{kind:`ecdsa`,keyHandle:Z(t.keyHandle,`wallet/email-otp/challenge keyHandle`),runtimePolicyScope:F(t.runtimePolicyScope),ed25519:Xd(t.ed25519)}}var Qd=class extends Error{constructor(e){super(e.message),this.name=`EmailOtpRouteError`;let t=tf(e.code);t&&(this.code=t),this.status=e.status;let n=Number(e.retryAfterMs);Number.isFinite(n)&&n>=0&&(this.retryAfterMs=Math.floor(n));let r=Number(e.resetAtMs);Number.isFinite(r)&&r>=0&&(this.resetAtMs=Math.floor(r))}};function $d(e){let t=e||globalThis.fetch;if(typeof t!=`function`)throw Error(`fetch is unavailable in this runtime`);return t}function ef(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} returned invalid JSON`);return e}function Z(e,t){return T(e,t)}function tf(e){return v(e)}function nf(e){let t={"Content-Type":`application/json`},n=String(e.publishableKey||``).trim();return n&&(t.Authorization=`Bearer ${n}`),t}function rf(e){return e.routeFamily===`registration`?Yl({routeFamily:`registration`,operation:Ve}):Yl({routeFamily:`login`,operation:e.operation??`wallet_unlock`})}function af(e){let t=tf(e.challenge.action);if(t&&t!==e.expectedAction)throw Error(`${e.context} returned ${t}; expected ${e.expectedAction}`)}async function of(e){let t=await $d(e.fetchImpl)(e.url,{method:`POST`,headers:nf({publishableKey:e.publishableKey}),credentials:`include`,body:JSON.stringify(e.body)}),n=await t.text(),r=null;try{r=n?JSON.parse(n):null}catch{throw Error(`${e.url} returned non-JSON response (HTTP ${t.status})`)}let i=ef(r,e.url);if(!t.ok||i.ok===!1)throw new Qd({message:typeof i.message==`string`&&i.message.trim()||`${e.url} failed (HTTP ${t.status})`,status:t.status,code:i.code,retryAfterMs:i.retryAfterMs,resetAtMs:i.resetAtMs});return i}async function sf(e){if(e.restartRegistrationOffer===!0&&e.accountMode!==`register`)throw Error(`restartRegistrationOffer is only valid with register account mode`);let t=await of({url:i(e.relayUrl,`/auth/google/verify`),fetchImpl:e.fetchImpl,publishableKey:Z(e.publishableKey,`publishableKey`),body:{id_token:Z(e.idToken,`idToken`),account_mode:e.accountMode,project_environment_id:Z(e.projectEnvironmentId,`projectEnvironmentId`),...e.loginWalletId?{wallet_id:Z(e.loginWalletId,`loginWalletId`)}:{},...e.restartRegistrationOffer===!0?{restart_registration_offer:!0}:{}}}),n=Z(t.mode,`auth/google/verify mode`),r=Z(t.walletId,`auth/google/verify walletId`),a=Z(t.providerSubject,`auth/google/verify providerSubject`),o=tf(t.email);if(n===`existing_wallet`){if(t.hasEmailOtpEnrollment!==!0)throw Error(`auth/google/verify existing wallet is missing Email OTP enrollment`);if(!o)throw Error(`auth/google/verify existing wallet is missing email`);return{mode:n,walletId:r,providerSubject:a,email:o,hasEmailOtpEnrollment:!0}}if(n!==`register_started`)throw Error(`auth/google/verify returned unsupported mode: ${n}`);if(!o)throw Error(`auth/google/verify registration is missing email`);let s=ef(t.offer,`auth/google/verify offer`),c=(Array.isArray(s.candidates)?s.candidates:[]).map(cf),l=c[0];if(!l)throw Error(`auth/google/verify offer has no wallet candidates`);return{mode:n,walletId:r,providerSubject:a,email:o,registrationAttemptId:Z(t.registrationAttemptId,`auth/google/verify registrationAttemptId`),expiresAtMs:lf(t.expiresAtMs,`auth/google/verify expiresAtMs`),offer:{offerId:Z(s.offerId,`auth/google/verify offer.offerId`),selectedCandidateId:Z(s.selectedCandidateId,`auth/google/verify offer.selectedCandidateId`),candidates:[l,...c.slice(1)]}}}function cf(e){let t=ef(e,`auth/google/verify offer candidate`);return{candidateId:Z(t.candidateId,`offer candidate candidateId`),walletId:Z(t.walletId,`offer candidate walletId`)}}function lf(e,t){let n=Number(e);if(!Number.isSafeInteger(n)||n<=Date.now())throw Error(`${t} must be a future timestamp`);return n}async function uf(e){let t=e.operation??`wallet_unlock`;if(!e.fetchImpl&&e.workerCtx)return await e.workerCtx.requestWorkerOperation({kind:`emailOtp`,request:{type:`requestEmailOtpChallenge`,payload:{relayUrl:Z(e.relayUrl,`relayUrl`),walletId:Z(e.walletId,`walletId`),...e.walletAuthMethodId?{walletAuthMethodId:Z(e.walletAuthMethodId,`walletAuthMethodId`)}:{},routePlan:rf({routeFamily:`login`,operation:t}),otpChannel:Ge,...e.operationFingerprintDigest?{operationFingerprintDigest:e.operationFingerprintDigest}:{}}}});let n=await of({url:i(e.relayUrl,`/wallet/email-otp/challenge`),fetchImpl:e.fetchImpl,body:{walletId:Z(e.walletId,`walletId`),...e.walletAuthMethodId?{walletAuthMethodId:Z(e.walletAuthMethodId,`walletAuthMethodId`)}:{},otpChannel:e.otpChannel||`email_otp`,operation:t,...e.operationFingerprintDigest?{operationFingerprintDigest:e.operationFingerprintDigest}:{}}}),r=ef(n.challenge,`wallet/email-otp/challenge`);af({challenge:r,expectedAction:Be.login,context:`wallet/email-otp/challenge`});let a=Vt(n.delivery,`wallet/email-otp/challenge delivery`),o=Number(r.expiresAtMs),s={challengeId:Z(r.challengeId,`wallet/email-otp/challenge challengeId`),otpChannel:Ge,delivery:a,emailHint:a.emailHint,ownerProofBindingDigest:Z(r.ownerProofBindingDigest,`wallet/email-otp/challenge ownerProofBindingDigest`),walletAuthMethodId:Z(n.walletAuthMethodId,`wallet/email-otp/challenge walletAuthMethodId`),signerSelection:Zd(n.signerSelection)};return Number.isFinite(o)&&(s.expiresAtMs=o),s}async function df(e){if(!e.fetchImpl&&e.workerCtx)return await e.workerCtx.requestWorkerOperation({kind:`emailOtp`,request:{type:`requestEmailOtpEnrollmentChallenge`,payload:{relayUrl:Z(e.relayUrl,`relayUrl`),walletId:Z(e.walletId,`walletId`),routePlan:rf({routeFamily:`registration`}),otpChannel:Ge}}});let t=await of({url:i(e.relayUrl,`/wallet/email-otp/registration/challenge`),fetchImpl:e.fetchImpl,body:{walletId:Z(e.walletId,`walletId`),otpChannel:e.otpChannel||`email_otp`}}),n=ef(t.challenge,`wallet/email-otp/registration/challenge`);af({challenge:n,expectedAction:Be.registration,context:`wallet/email-otp/registration/challenge`});let r=Vt(t.delivery,`wallet/email-otp/registration/challenge delivery`),a=Number(n.expiresAtMs),o={challengeId:Z(n.challengeId,`wallet/email-otp/registration/challenge challengeId`),otpChannel:Ge,delivery:r,emailHint:r.emailHint};return Number.isFinite(a)&&(o.expiresAtMs=a),o}function ff(e,t){let n=typeof e==`string`?e.trim():``;if(!n)throw Error(`${t} is required for Email OTP registration authority`);return n}async function pf(e){let t=ff(e.authMethod.email,`email`).toLowerCase(),n=ff(e.authMethod.providerSubject,`providerSubject`),r=ff(e.relayUrl,`relayUrl`),i=ff(e.walletId,`walletId`),a=ff(e.registrationIntentDigestB64u,`registrationIntentDigestB64u`);if(e.authMethod.proofKind===`google_sso_registration`){let r=ff(e.authMethod.googleEmailOtpRegistrationAttemptId,`googleEmailOtpRegistrationAttemptId`);return{kind:`email_otp`,proof:{version:`email_otp_registration_proof_v1`,proofKind:`google_sso_registration`,providerSubject:n,email:t,googleEmailOtpRegistrationAttemptId:r,googleEmailOtpRegistrationOfferId:ff(e.authMethod.googleEmailOtpRegistrationOfferId,`googleEmailOtpRegistrationOfferId`),googleEmailOtpRegistrationCandidateId:ff(e.authMethod.googleEmailOtpRegistrationCandidateId,`googleEmailOtpRegistrationCandidateId`),registrationIntentDigestB64u:a},registrationAuthorityId:r,providerSubject:n,email:t}}let o=ff(e.authMethod.otpCode,`otpCode`),s=typeof e.authMethod.challengeId==`string`?e.authMethod.challengeId.trim():``,c=s?null:await df({relayUrl:r,walletId:i,fetchImpl:e.fetchImpl}),l=s||ff(c?.challengeId,`challengeId`);return{kind:`email_otp`,proof:{version:`email_otp_registration_proof_v1`,proofKind:`otp_challenge`,providerSubject:n,email:t,challengeId:l,otpCode:o,otpChannel:Ge,registrationIntentDigestB64u:a},registrationAuthorityId:l,providerSubject:n,email:t}}function mf(e,t,n){if(e!==t)throw Error(`${n} does not match the verified add-signer intent`)}function hf(e,t){if(e.length!==2||e[0]!==t[0]||e[1]!==t[1])throw Error(`Yao participant IDs do not match the verified add-signer intent`)}function gf(e){let t=w(e.verifiedIntent.addSignerIntentGrant,`add-signer intent grant`);return{routerOrigin:w(e.httpTransport.routerOrigin,`Yao Router origin`),routing:{kind:`discovery`},authorization:{kind:`bearer`,value:`Bearer ${t}`},fetch:e.httpTransport.fetch}}async function _f(e){let t=e.verifiedIntent.intent,n=t.signerSelection.ed25519;mf(String(t.walletId),String(e.verifiedAuthority.walletId),`Passkey authority wallet ID`),mf(e.verifiedIntent.addSignerIntentDigestB64u,e.verifiedAuthority.addSignerIntentDigestB64u,`Passkey authority intent digest`),w(e.verifiedAuthority.credentialIdB64u,`passkey credential ID`);let r=F(t.runtimePolicyScope),i=ne(r),a=Nt(e.admissionRequest);if(!a.ok)throw Error(a.message);let o=a.value,s=w(e.verifiedIntent.addSignerCeremonyId,`add-signer ceremony ID`);if(mf(o.scope.lifecycle_id,s,`Yao lifecycle ID`),mf(o.scope.threshold_session_id,s,`Yao Threshold Session ID`),mf(o.scope.account_id,String(t.walletId),`Yao account ID`),mf(o.scope.signer_set_id,String(De(n.signerSlot)),`Yao signer-set ID`),mf(o.scope.root_share_epoch,r.signingRootVersion,`Yao root-share epoch`),mf(o.application_binding.wallet_id,String(t.walletId),`Yao application wallet ID`),mf(o.application_binding.signing_root_id,i,`Yao signing-root ID`),o.application_binding.key_creation_signer_slot!==n.signerSlot)throw Error(`Yao signer slot does not match the verified add-signer intent`);hf(n.participantIds,o.participant_ids);let c=await Yt({kind:`wallet_add_signer_implicit_near_ed25519_key_v1`,walletId:t.walletId,signingRootId:i,signingRootVersion:r.signingRootVersion,signerSlot:n.signerSlot,participantIds:n.participantIds,keyPurpose:n.keyPurpose,keyVersion:n.keyVersion,derivationVersion:n.derivationVersion});return mf(o.application_binding.near_ed25519_signing_key_id,String(c),`Yao NEAR signing-key ID`),{kind:`prepared_passkey_ed25519_yao_add_signer_v1`,request:o,transportConfig:gf(e)}}async function vf(e){let t=await _f(e),n=await new $i(t.transportConfig).send({kind:`admit`,path:kt,body:t.request});if(!n.ok)throw Error(n.message);let r=Lt(n.value);if(!r.ok)throw Error(r.message);return{request:t.request,receipt:r.value}}var yf=class e{constructor(e){this.kind=`restorable_mpc_material_ref`,this.protocolProof=!0,this.durableMaterialRef=e,this.protocolProof}static build(t){let n=String(t||``).trim();if(!n)throw Error(`Restorable MPC material reference is required`);return new e(n)}};function bf(e){return yf.build(e)}const xf=`router_ab_ed25519_yao_active_client_v1`,Sf=`chacha20poly1305-hkdf-sha256-prf-first-v1`,Cf=(1n<<64n)-1n;function Q(e,t){let n=String(e??``).trim();if(!n)throw Error(`${t} is required for local Ed25519 material`);return n}function wf(e,t){let n=Number(e);if(!Number.isSafeInteger(n)||n<1)throw Error(`${t} must be a positive safe integer`);return n}function Tf(e,t){let n=s(e);if(!n.ok)throw Error(`${t}: ${n.error.message}`);return n.value}function Ef(e,t){let n=Q(e,t);if(L(n).length!==32)throw Error(`${t} must encode 32 bytes`);return n}function Df(e){if(!Array.isArray(e)||e.length!==2)throw Error(`participantIds must contain exactly two entries`);let t=[wf(e[0],`participantIds[0]`),wf(e[1],`participantIds[1]`)];if(t[0]>65535||t[1]>65535||t[0]===t[1])throw Error(`participantIds must contain two distinct u16 identifiers`);return t}function Of(e,t){let n=Q(e,t);if(!/^(0|[1-9][0-9]*)$/.test(n)||BigInt(n)>Cf)throw Error(`${t} must be a canonical u64`);return n}function kf(e,t,n){let r=e.signingLane.identity.signer;return{walletId:Q(r.account.wallet.walletId,`walletId`),nearAccountId:Q(r.account.nearAccountId,`nearAccountId`),nearEd25519SigningKeyId:Q(r.nearEd25519SigningKeyId,`nearEd25519SigningKeyId`),thresholdSessionId:Tf(e.signingLane.identity.thresholdSessionId,`thresholdSessionId`),signerSlot:wf(r.signerSlot,`signerSlot`),rpId:Q(t,`rpId`),credentialIdB64u:Q(n,`credentialIdB64u`),signingRootId:Q(e.signingRootId,`signingRootId`),signingRootVersion:Q(e.signingRootVersion,`signingRootVersion`),signingWorkerId:Q(e.routerAbNormalSigning.signingWorkerId,`signingWorkerId`)}}function Af(e){let t=e.metadata;if(t.scope.account_id!==e.identity.walletId||t.applicationBinding.wallet_id!==e.identity.walletId||t.applicationBinding.near_ed25519_signing_key_id!==e.identity.nearEd25519SigningKeyId||t.scope.threshold_session_id!==e.identity.thresholdSessionId||t.applicationBinding.key_creation_signer_slot!==e.identity.signerSlot||t.applicationBinding.signing_root_id!==e.identity.signingRootId||t.scope.root_share_epoch!==e.identity.signingRootVersion||t.scope.signing_worker_id!==e.identity.signingWorkerId)throw Error(`Active Ed25519 Client metadata does not match the wallet signing lane`);return{kind:xf,walletId:e.identity.walletId,nearAccountId:e.identity.nearAccountId,nearEd25519SigningKeyId:e.identity.nearEd25519SigningKeyId,signerSlot:e.identity.signerSlot,rpId:e.identity.rpId,credentialIdB64u:e.identity.credentialIdB64u,lifecycleId:Q(t.scope.lifecycle_id,`lifecycleId`),thresholdSessionId:Tf(t.scope.threshold_session_id,`thresholdSessionId`),materialActivation:er(t),signingRootId:e.identity.signingRootId,signingRootVersion:e.identity.signingRootVersion,signerSetId:Q(t.scope.signer_set_id,`signerSetId`),signingWorkerId:e.identity.signingWorkerId,participantIds:[t.participantIds[0],t.participantIds[1]],registeredPublicKeyB64u:I(t.registeredPublicKey),signingWorkerVerifyingShareB64u:I(t.signingWorkerVerifyingShare),stateEpoch:t.stateEpoch.toString(10),activationTranscriptB64u:I(t.transcript),activationCapabilityBindingB64u:I(Uint8Array.from(t.activeCapabilityBinding))}}function jf(e){return new TextEncoder().encode(JSON.stringify([e.kind,e.walletId,e.nearAccountId,e.nearEd25519SigningKeyId,e.signerSlot,e.rpId,e.credentialIdB64u,e.lifecycleId,e.thresholdSessionId,e.materialActivation.kind,e.materialActivation.activationId,e.materialActivation.capability,e.materialActivation.materialOwner,e.materialActivation.keyBinding,e.materialActivation.lifecycleBinding,e.materialActivation.signingWorker,e.signingRootId,e.signingRootVersion,e.signerSetId,e.signingWorkerId,e.participantIds[0],e.participantIds[1],e.registeredPublicKeyB64u,e.signingWorkerVerifyingShareB64u,e.stateEpoch,e.activationTranscriptB64u,e.activationCapabilityBindingB64u]))}function Mf(e,t){if(e.walletId!==t.walletId||e.nearAccountId!==t.nearAccountId||e.nearEd25519SigningKeyId!==t.nearEd25519SigningKeyId||e.signerSlot!==t.signerSlot||e.rpId!==t.rpId||e.credentialIdB64u!==t.credentialIdB64u||e.signingRootId!==t.signingRootId||e.signingRootVersion!==t.signingRootVersion||e.signingWorkerId!==t.signingWorkerId)throw Error(`Stored Ed25519 Client material does not match the wallet signing lane`)}function Nf(e){let t=C(e);if(!t||t.kind!==xf)throw Error(`Stored Ed25519 Client material binding is invalid`);let n=l(t.materialActivation);if(!n.ok)throw Error(n.error.message);let r={kind:xf,walletId:Q(t.walletId,`binding.walletId`),nearAccountId:Q(t.nearAccountId,`binding.nearAccountId`),nearEd25519SigningKeyId:Q(t.nearEd25519SigningKeyId,`binding.nearEd25519SigningKeyId`),signerSlot:wf(t.signerSlot,`binding.signerSlot`),rpId:Q(t.rpId,`binding.rpId`),credentialIdB64u:Q(t.credentialIdB64u,`binding.credentialIdB64u`),lifecycleId:Q(t.lifecycleId,`binding.lifecycleId`),thresholdSessionId:Tf(t.thresholdSessionId,`binding.thresholdSessionId`),materialActivation:n.value,signingRootId:Q(t.signingRootId,`binding.signingRootId`),signingRootVersion:Q(t.signingRootVersion,`binding.signingRootVersion`),signerSetId:Q(t.signerSetId,`binding.signerSetId`),signingWorkerId:Q(t.signingWorkerId,`binding.signingWorkerId`),participantIds:Df(t.participantIds),registeredPublicKeyB64u:Ef(t.registeredPublicKeyB64u,`binding.registeredPublicKeyB64u`),signingWorkerVerifyingShareB64u:Ef(t.signingWorkerVerifyingShareB64u,`binding.signingWorkerVerifyingShareB64u`),stateEpoch:Of(t.stateEpoch,`binding.stateEpoch`),activationTranscriptB64u:Ef(t.activationTranscriptB64u,`binding.activationTranscriptB64u`),activationCapabilityBindingB64u:Ef(t.activationCapabilityBindingB64u,`binding.activationCapabilityBindingB64u`)};if(r.materialActivation.materialOwner!==r.walletId||r.materialActivation.signingWorker!==r.signingWorkerId)throw Error(`Stored Ed25519 Client material activation does not match its binding`);return r}function Pf(e,t){let n=Nf(e);return Mf(n,t),n}function Ff(e){let t=C(e);if(!t)throw Error(`Stored Ed25519 Client stable server scope is invalid`);let n=ie(t.runtimePolicyScope);if(!n)throw Error(`Stored Ed25519 Client server runtime policy scope is invalid`);return{relayerKeyId:Q(t.relayerKeyId,`stableServerScope.relayerKeyId`),participantIds:Df(t.participantIds),runtimePolicyScope:n,routerAbNormalSigning:se(t.routerAbNormalSigning)}}async function If(e){let t=e.stored.payload,n=C(t);if(!n)throw Error(`Stored Ed25519 Client local material locator is invalid`);let r=Nf(n.binding),i=`ed25519:${Te(L(r.registeredPublicKeyB64u))}`,a=e.stored.payloadEnvelope;if(e.stored.profileId!==e.target.profileId||e.stored.chainIdKey!==e.target.chainIdKey||e.stored.accountAddress!==e.target.accountAddress||e.stored.keyKind!==xf||e.stored.schemaVersion!==3||e.stored.publicKey!==i||e.stored.signerId!==r.nearEd25519SigningKeyId||a?.encVersion!==1||a.alg!==Sf)throw Error(`Stored Ed25519 Client local material record is invalid`);let o=bt({walletId:r.walletId,factor:{kind:`passkey`,credentialIdB64u:r.credentialIdB64u},verifier:{kind:`webauthn`,rpId:r.rpId},bindingId:e.authority.walletAuthMethodId});if(!o)throw Error(`Stored Ed25519 Client local material authority is invalid`);let s=await st({authority:o});if(s.authorityDigest!==e.authority.authorityDigest)throw Error(`Stored Ed25519 Client local material authority changed`);return{kind:`passkey_ed25519_yao_local_material_locator_v1`,authority:s,materialActivation:r.materialActivation,sealedMaterial:bf(JSON.stringify([e.stored.profileId,e.stored.signerSlot,e.stored.chainIdKey,e.stored.keyKind,r.materialActivation.activationId])),stableServerScope:Ff(n.stableServerScope)}}function Lf(e){let t=C(e.stored.payload?.binding);if(e.stored.profileId!==e.target.profileId||e.stored.chainIdKey!==e.target.chainIdKey||e.stored.accountAddress!==e.target.accountAddress||e.stored.signerSlot!==e.input.signerSlot||e.stored.signerId!==e.input.nearEd25519SigningKeyId||e.stored.keyKind!==xf||t?.kind!==xf||t.walletId!==e.input.walletId||t.nearAccountId!==e.input.nearAccountId||t.nearEd25519SigningKeyId!==e.input.nearEd25519SigningKeyId||t.signerSlot!==e.input.signerSlot||t.rpId!==e.input.rpId||t.credentialIdB64u!==e.input.credentialIdB64u)throw Error(`Stored Ed25519 Client material locator does not match local custody`)}function Rf(e,t){let n=Q(t,`thresholdSessionId`);return{kind:ki,scope:{lifecycle_id:e.lifecycleId,root_share_epoch:e.signingRootVersion,account_id:e.walletId,threshold_session_id:n,signer_set_id:e.signerSetId,signing_worker_id:e.signingWorkerId,material_activation:Ct(e.materialActivation)},applicationBinding:{wallet_id:e.walletId,near_ed25519_signing_key_id:e.nearEd25519SigningKeyId,signing_root_id:e.signingRootId,key_creation_signer_slot:e.signerSlot},participantIds:e.participantIds,registeredPublicKey:L(e.registeredPublicKeyB64u),signingWorkerVerifyingShare:L(e.signingWorkerVerifyingShareB64u),stateEpoch:BigInt(e.stateEpoch),transcript:L(e.activationTranscriptB64u),activeCapabilityBinding:Array.from(L(e.activationCapabilityBindingB64u)),materialActivation:e.materialActivation}}function zf(){let e=new Uint8Array(12);return globalThis.crypto.getRandomValues(e),e}function Bf(e){let t=e.identity,n=e.activeClient.metadata(),r=Af({identity:t,metadata:n}),i=zf(),a=e.activeClient.sealLocalMaterial({ownedPasskeyPrfFirst:e.ownedPasskeyPrfFirst,binding:jf(r),nonce:i}),o={binding:r,stableServerScope:e.stableServerScope};switch(e.lifecycle.kind){case`registration_or_rehydration`:break;case`recovery_promotion`:o.lifecycleReceipt=e.lifecycle.promotionReceipt;break;default:e.lifecycle}return{profileId:e.target.profileId,signerSlot:t.signerSlot,chainIdKey:e.target.chainIdKey,accountAddress:e.target.accountAddress,keyKind:xf,algorithm:`ed25519`,publicKey:`ed25519:${Te(n.registeredPublicKey)}`,signerId:t.nearEd25519SigningKeyId,payload:o,payloadEnvelope:{encVersion:1,alg:Sf,nonce:I(a.nonce),ciphertext:I(a.ciphertext),aad:Xe({profileId:e.target.profileId,signerSlot:t.signerSlot,chainIdKey:e.target.chainIdKey,accountAddress:e.target.accountAddress,keyKind:xf,schemaVersion:3,signerId:t.nearEd25519SigningKeyId})},timestamp:Date.now(),schemaVersion:3}}async function Vf(e){let t=await yn(e.store,{accountRefs:zn(e.identity.nearAccountId)});if(!t)throw Error(`Local Ed25519 material requires a persisted wallet profile`);let n=Bf({target:t,activeClient:e.activeClient,identity:e.identity,stableServerScope:e.stableServerScope,ownedPasskeyPrfFirst:L(e.passkeyPrfFirstB64u),lifecycle:{kind:`registration_or_rehydration`}});await e.store.storeKeyMaterial(n)}async function Hf(e){let t=Q(e.nearAccountId,`nearAccountId`),n=await yn(e.store,{accountRefs:zn(t)});if(!n)return{kind:`unavailable`};let r=await e.store.getKeyMaterial(n.profileId,wf(e.signerSlot,`signerSlot`),n.chainIdKey,xf);return r?(Lf({stored:r,target:n,input:e}),{kind:`available`,locator:await If({stored:r,target:n,authority:e.authority})}):{kind:`unavailable`}}function Uf(e){return e.publicLocator.walletId===e.identity.walletId&&e.publicLocator.nearAccountId===e.identity.nearAccountId&&e.publicLocator.signerSlot===e.identity.signerSlot}async function Wf(e){let t=bt({walletId:e.identity.walletId,factor:{kind:`passkey`,credentialIdB64u:e.identity.credentialIdB64u},verifier:{kind:`webauthn`,rpId:e.identity.rpId},bindingId:e.authority.walletAuthMethodId});if(!t)throw Error(`Passkey Ed25519 authority is invalid`);let n=await st({authority:t});if(n.authorityDigest!==e.authority.authorityDigest)throw Error(`Passkey Ed25519 authority does not match the Wallet Session`);return n}function Gf(e){if(!e||e.activeClient.status().kind!==`active`)return{kind:`absent`};let t=er(e.activeClient.metadata());return{kind:`live`,runtime:Xn(t),materialActivation:t}}function Kf(e){return{kind:`blocked`,plan:e}}async function qf(e){let t=await Wf(e),n=e.publicLocator.kind===`available`&&!Uf({publicLocator:e.publicLocator,identity:e.identity})?{kind:`conflict`}:e.publicLocator.kind===`available`?{...e.publicLocator,authority:t}:e.publicLocator,r;try{r=await Hf({store:e.store,walletId:String(e.identity.walletId),nearAccountId:String(e.identity.nearAccountId),nearEd25519SigningKeyId:String(e.identity.nearEd25519SigningKeyId),signerSlot:e.identity.signerSlot,rpId:e.identity.rpId,credentialIdB64u:e.identity.credentialIdB64u,authority:t})}catch{return{expectedAuthority:t,publicLocator:n,sealed:{kind:`corrupt`}}}return{expectedAuthority:t,publicLocator:n,sealed:r.kind===`available`?{kind:`available`,authority:r.locator.authority,materialActivation:r.locator.materialActivation,sealedMaterial:r.locator.sealedMaterial}:{kind:`missing`}}}function Jf(e,t){let n=Qn({publicLocator:e,sealed:{kind:`corrupt`},runtime:t,unlockSource:{kind:`unavailable`}});if(n.kind!==`blocked`)throw Error(`Corrupt Near Ed25519 material resolved to an executable hydration plan`);return n}async function Yf(e){let{expectedAuthority:t,publicLocator:n,sealed:r}=await qf(e);if(r.kind===`corrupt`)return{kind:`blocked`,plan:Jf(n,{kind:`absent`})};let i=Qn({publicLocator:n,sealed:r,runtime:{kind:`absent`},unlockSource:{kind:`available`,authority:t}});switch(i.kind){case`rehydrate_material_activation`:return{kind:`prepared`,plan:i};case`blocked`:return{kind:`blocked`,plan:i};case`use_live_runtime`:case`reauthorize_public_anchor`:throw Error(`Sealed Near Ed25519 preparation resolved an invalid hydration plan`);default:throw Error(`Unsupported sealed Near Ed25519 preparation plan`)}}async function Xf(e){let{expectedAuthority:t,publicLocator:n,sealed:r}=await qf(e);if(r.kind===`corrupt`)return Kf(Jf(n,Gf(e.liveMaterial)));let i=e.unlockSource.kind===`available`?{kind:`available`,authority:t}:{kind:`unavailable`},a=Qn({publicLocator:n,sealed:r,runtime:Gf(e.liveMaterial),unlockSource:i});switch(a.kind){case`use_live_runtime`:{let t=e.liveMaterial;if(!t||t.activeClient.status().kind!==`active`||!p(a.materialActivation,er(t.activeClient.metadata())))throw Error(`Near Ed25519 live hydration plan lost its exact runtime`);return{kind:`live`,plan:a}}case`rehydrate_material_activation`:{if(e.unlockSource.kind!==`available`)throw Error(`Near Ed25519 rehydration plan lost its unlock source`);let t=await Zf({store:e.store,identity:e.identity,passkeyPrfFirstB64u:e.unlockSource.passkeyPrfFirstB64u});if(t.kind!==`rehydrated`)throw Error(`Near Ed25519 rehydration plan lost its sealed material`);let n=er(t.activeClient.metadata());if(!p(a.materialActivation,n))throw t.activeClient.dispose(),Error(`Near Ed25519 rehydration changed the material activation`);return{kind:`rehydrated`,plan:a,activeClient:t.activeClient}}case`blocked`:return Kf(a);case`reauthorize_public_anchor`:throw Error(`Near Ed25519 material retirement requires explicit reauthorization`);default:throw Error(`Unsupported Near Ed25519 hydration plan`)}}async function Zf(e){let t=e.identity,n=await yn(e.store,{accountRefs:zn(t.nearAccountId)});if(!n)return{kind:`unavailable`};let r=await e.store.getKeyMaterial(n.profileId,t.signerSlot,n.chainIdKey,xf);return r?Qf({stored:r,target:n,identity:t,ownedPasskeyPrfFirst:L(e.passkeyPrfFirstB64u)}):{kind:`unavailable`}}async function Qf(e){let t=e.identity,n=e.stored,r=e.target,i=n.payloadEnvelope;if(n.profileId!==r.profileId||n.accountAddress!==r.accountAddress||n.signerId!==t.nearEd25519SigningKeyId||n.keyKind!==xf||n.schemaVersion!==3||i?.encVersion!==1||i.alg!==Sf)throw Error(`Stored Ed25519 Client material record is invalid`);let a=Pf(n.payload?.binding,t),o=Rf(a,t.thresholdSessionId),s=`ed25519:${Te(o.registeredPublicKey)}`;if(n.publicKey!==s)throw Error(`Stored Ed25519 Client public key does not match its sealed binding`);return{kind:`rehydrated`,activeClient:(await oa.initializeBundled()).importLocalMaterial({ownedPasskeyPrfFirst:e.ownedPasskeyPrfFirst,binding:jf(a),sealed:{kind:`router_ab_ed25519_yao_sealed_local_material_v1`,nonce:L(i.nonce),ciphertext:L(i.ciphertext)},metadata:o})}}function $f(e,t){return e.requestWorkerOperation(t)}function ep(e,t,n){return e.requestOperation({kind:`walletCustodyCeremony`,request:{type:t,payload:n}})}function tp(e){return ep.bind(void 0,e)}let np=null,rp=null,ip=null,ap=null;function op(e){ap=e}function sp(e){let t=ap;if(!t||e.kind!==`unlocked_wallet_ed25519_export_root_capability_v1`)return;let n=e.upgradedEnvelope;if(n!==void 0)try{t({walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,walletSessionId:e.walletSessionId,envelope:n})}catch(e){console.warn(`[walletCustody] the upgraded custody envelope was not forwarded:`,e instanceof Error?e.message:String(e||`unknown error`))}}function cp(e){return{requestOperation:$f.bind(void 0,e)}}function lp(){ip!==null&&(clearTimeout(ip),ip=null)}function up(){lp(),np=null,rp=null}function dp(e,t){lp();let n=Math.max(0,e.expiresAtMs-Date.now());ip=setTimeout(()=>{if(ip=null,!(np!==e||rp!==t)){if(e.expiresAtMs>Date.now()){dp(e,t);return}vp(t,{kind:`capability`,capabilityHandleId:e.capabilityHandleId})}},Math.min(n,2147483647))}function fp(e){if(!_(e))return null;if(e.kind===`unlocked_linked_device_ed25519_client_root_capability_v1`)return pp(e);let t=Object.keys(e),n=t.includes(`upgradedEnvelope`),r=n?[`kind`,`capabilityHandleId`,`walletId`,`walletAuthMethodId`,`walletSessionId`,`expiresAtMs`,`upgradedEnvelope`]:[`kind`,`capabilityHandleId`,`walletId`,`walletAuthMethodId`,`walletSessionId`,`expiresAtMs`];if(t.length!==r.length||t.some(e=>!r.includes(e))||e.kind!==`unlocked_wallet_ed25519_export_root_capability_v1`)return null;let i=u(e.capabilityHandleId),o=a(e.walletId),s=c(e.walletAuthMethodId),l=ge(e.walletSessionId);if(!i.ok||!o.ok||!s.ok||!l.ok)return null;let d;try{d=M(e.expiresAtMs,`unlocked Ed25519 export-root capability expiry`)}catch{return null}let f;if(n)try{f=Qt(e.upgradedEnvelope)}catch{}return{kind:`unlocked_wallet_ed25519_export_root_capability_v1`,capabilityHandleId:i.value,walletId:o.value,walletAuthMethodId:s.value,walletSessionId:l.value,expiresAtMs:d,...f?{upgradedEnvelope:f}:{}}}function pp(e){let t=[`kind`,`capabilityHandleId`,`walletId`,`walletAuthMethodId`,`walletSessionId`,`expiresAtMs`],n=Object.keys(e);if(n.length!==t.length||n.some(e=>!t.includes(e)))return null;let r=u(e.capabilityHandleId),i=a(e.walletId),o=c(e.walletAuthMethodId),s=ge(e.walletSessionId);if(!r.ok||!i.ok||!o.ok||!s.ok)return null;let l;try{l=M(e.expiresAtMs,`unlocked Ed25519 Client-root capability expiry`)}catch{return null}return{kind:`unlocked_linked_device_ed25519_client_root_capability_v1`,capabilityHandleId:r.value,walletId:i.value,walletAuthMethodId:o.value,walletSessionId:s.value,expiresAtMs:l}}async function mp(e,t){let n=t.existingEnvelope.binding;if(!en(n)&&n.kind!==`ed25519_yao_client_root_v1`)return;let r=t.existingFactorSecret.slice(),i;try{i=await e.requestOperation({kind:`walletCustodyCeremony`,request:{type:`establishUnlockedWalletEd25519ExportRootCapability`,payload:{existingEnvelope:t.existingEnvelope,existingFactorSecret:r.buffer,walletId:t.walletId,walletAuthMethodId:t.walletAuthMethodId,walletSessionId:t.walletSessionId,expiresAtMs:t.expiresAtMs},transfer:[r.buffer]}})}finally{r.byteLength>0&&r.fill(0)}let a=fp(i);if(a===null)throw Error(`unlocked Ed25519 export-root capability worker returned no reference`);return lp(),np=a,rp=e,dp(a,e),sp(a),a}function hp(e){let t=gp(e);return t?.kind===`unlocked_wallet_ed25519_export_root_capability_v1`?t:void 0}function gp(e){let t=np;if(t&&t.walletId===e){if(t.expiresAtMs<=Date.now()){let e=rp;e?vp(e,{kind:`capability`,capabilityHandleId:t.capabilityHandleId}):up();return}return t}}function _p(){up()}async function vp(e,t){let n=np;n!==null&&(t.kind===`all`||t.kind===`capability`&&t.capabilityHandleId===n.capabilityHandleId||t.kind===`wallet`&&t.walletId===n.walletId||t.kind===`wallet_session`&&t.walletSessionId===n.walletSessionId)&&up();try{await e.requestOperation({kind:`walletCustodyCeremony`,request:{type:`destroyUnlockedWalletEd25519ExportRootCapabilities`,payload:{scope:t}}})}catch{}}function yp(e){let t=r(e);if(!t.ok)throw Error(t.error.message);return t.value}function bp(e){let t=e.finalized.authMethod;if(!t||t.kind!==`passkey`)throw Error(`Passkey registration finalize returned non-passkey auth material`);let n=String(e.credential.rawId||e.credential.id||``).trim(),r=String(t.credentialIdB64u||``).trim();if(!n||r!==n)throw Error(`Passkey registration finalize returned credential id mismatch`);let i=String(t.credentialPublicKeyB64u||``).trim();if(!i)throw Error(`Passkey registration finalize returned missing credentialPublicKeyB64u`);return i}async function xp(e){let t=e.configs.signing.emailOtp.authPolicy;return cr({policy:t,retention:`session`,reason:`login`,authority:e.authority})}async function Sp(e){switch(e.authMethod.kind){case`passkey`:if(!e.passkeyAuthority)throw Error(`Passkey registration authority was not collected`);return{kind:`passkey`,rpId:e.authMethod.rpId,credential:e.passkeyAuthority.credential,credentialPublicKeyB64u:bp({finalized:e.finalized,credential:e.passkeyAuthority.credential})};case`email_otp`:{let t=String(e.email||``).trim(),n=String(e.providerSubject||``).trim(),r=String(e.registrationAuthorityId||``).trim();if(!t||!n||!r)throw Error(`Email OTP registration persistence requires provider identity`);if(!rt(e.finalized.authority))throw Error(`Email OTP registration finalize returned a different authority`);if(e.finalized.foundingAuthMethod.kind!==`email_otp`)throw Error(`Email OTP registration finalize returned a different founding method`);let i=ct({...e.finalized.authority,bindingId:e.finalized.foundingAuthMethod.walletAuthMethodId});if(!i)throw Error(`Email OTP registration finalize returned an invalid exact authority`);return{kind:`email_otp`,email:t,registrationAuthorityId:r,emailOtpAuthContext:await xp({configs:e.configs,authority:i}),authority:i}}default:return q(e.authMethod)}}function Cp(e){let[t,...n]=e.walletKeys,[r,...i]=e.expectedChainTargets;if(!t||!r)throw Error(`ECDSA registration persistence requires session, key, and target material`);if(e.walletKeys.length!==e.expectedChainTargets.length)throw Error(`ECDSA registration persistence requires one family session projected to every target`);if(e.session.chainTargets.length!==e.expectedChainTargets.length||!Pc(e.session.chainTargets,e.expectedChainTargets))throw Error(`ECDSA registration family session target projection is incomplete`);return jc(e.walletKeys),Mc({session:e.session,walletKeys:e.walletKeys}),Uc({session:e.session,walletKeys:e.walletKeys}),{kind:`evm_family_ecdsa`,session:e.session,walletKeys:[t,...n],expectedChainTargets:[r,...i]}}function wp(e){let{walletId:t,authority:n,foundingAuthority:r,foundingAuthMethod:i,registrationDiagnostics:a,rpId:o,authMethod:s,custodyKeyManifestDigestB64u:c,ecdsa:l}=e,{activation:u,bootstrap:d,...f}=l,p={ok:!0,walletId:t,authority:n,foundingAuthority:r,foundingAuthMethod:i,...a?{registrationDiagnostics:a}:{},...c===void 0?{}:{custodyKeyManifestDigestB64u:c},kind:`evm_family_ecdsa`,ecdsa:f};if(s.kind===`passkey`){if(!o)throw Error(`Passkey activation is missing its relying-party id`);return{...p,rpId:o,authMethod:s}}if(o!==void 0)throw Error(`Email OTP activation returned a relying-party id`);return{...p,authMethod:s}}function Tp(e){return{kind:`registration_persistence_plan_v1`,walletId:e.walletId,auth:e.auth,ecdsa:e.ecdsa,foundingAuthority:e.foundingAuthority,foundingAuthMethod:e.foundingAuthMethod}}function Ep(e){let t=Tn(e);if(!t)throw Error(`pending wallet registration commit is invalid`);return t}function Dp(e){let t=Fe(e.walletId),n=c(e.walletAuthMethodId);if(!n.ok)throw Error(n.error.message);let r=Op(e.auth),i={kind:`pending_wallet_registration_commit_v1`,registrationCeremonyId:kp(e.registrationCeremonyId,`registrationCeremonyId`),idempotencyKey:kp(e.idempotencyKey,`idempotencyKey`),walletId:t,walletAuthMethodId:n.value,signedSetup:kp(e.signedSetup,`signedSetup`),auth:r,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs};if(e.operation===`registration_activate`)return Ep({...i,operation:e.operation,signerPlanKind:e.signerPlanKind,localMaterial:e.localMaterial});if(e.signerPlanKind!==`near_ed25519`&&e.signerPlanKind!==`near_ed25519_and_evm_family_ecdsa`)throw Error(`near provisioning requires a NEAR signer plan`);return Ep({...i,operation:e.operation,phase:`joined`,completion:e.completion,signerPlanKind:e.signerPlanKind,localMaterial:e.localMaterial})}function Op(e){if(e.kind===`passkey`){let t=yp(e.rpId),n=d(e.credentialIdB64u);if(!n.ok)throw Error(n.error.message);return{kind:`passkey`,rpId:t,credentialIdB64u:n.value,transports:[...e.transports]}}let t=h(e.email);if(!t.ok)throw Error(t.error.message);let n=f(e.registrationAuthorityId);if(!n.ok)throw Error(n.error.message);let r=m(e.providerSubject);if(!r.ok)throw Error(r.error.message);return{kind:`email_otp`,email:t.value,registrationAuthorityId:n.value,providerSubject:r.value,enrollment:{enrollmentSealKeyVersion:kp(e.enrollment.enrollmentSealKeyVersion,`enrollment.enrollmentSealKeyVersion`),serverSealedFactorCiphertextB64u:kp(e.enrollment.serverSealedFactorCiphertextB64u,`enrollment.serverSealedFactorCiphertextB64u`),clientUnlockPublicKeyB64u:kp(e.enrollment.clientUnlockPublicKeyB64u,`enrollment.clientUnlockPublicKeyB64u`),unlockKeyVersion:kp(e.enrollment.unlockKeyVersion,`enrollment.unlockKeyVersion`)}}}function kp(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} must be a non-empty canonical string`);return e}async function Ap(e){e.registrationTiming.record(`ecdsaRegistrationTargetCount`,e.plan.ecdsa.walletKeys.length);let t=performance.now();try{return await e.context.signingEngine.finalizeWalletRegistrationEcdsaSessions({walletId:Fe(e.plan.walletId),session:e.plan.ecdsa.session,walletKeys:[...e.plan.ecdsa.walletKeys]})}finally{e.registrationTiming.record(`ecdsaRegistrationSessionFinalizeMs`,Ma(t))}}async function jp(e){if(e.plan.auth.kind===`passkey`){await e.context.signingEngine.finalizeWalletEcdsaRegistration({walletId:e.plan.walletId,rpId:yp(e.plan.auth.rpId),credential:e.plan.auth.credential,credentialPublicKeyB64u:e.plan.auth.credentialPublicKeyB64u,walletKeys:e.walletKeys});return}await e.context.signingEngine.storeWalletEmailOtpEcdsaRegistrationData({walletId:e.plan.walletId,email:e.plan.auth.email,registrationAuthorityId:e.plan.auth.registrationAuthorityId,authority:e.plan.auth.authority,walletKeys:e.walletKeys})}async function Mp(e){let t=await Ap(e),n=performance.now();try{if(await jp({context:e.context,plan:e.plan,walletKeys:t}),await V.persistFoundingWalletAuthority({authority:e.plan.foundingAuthority,authMethod:e.plan.foundingAuthMethod}),e.plan.auth.kind===`email_otp`){let t=h(e.plan.auth.email);if(!t.ok)throw Error(t.error.message);let n=await V.retainVerifiedEmailOtpLocalPresentation({walletId:e.plan.walletId,walletAuthMethodId:e.plan.foundingAuthMethod.walletAuthMethodId,emailAddress:t.value});if(n.kind!==`retained`)throw Error(`Verified Email OTP presentation was not retained: ${n.reason}`)}}finally{e.registrationTiming.record(`ecdsaRegistrationLocalRecordPersistenceMs`,Ma(n))}await vr(Fn,e.plan.ecdsa.session.registrationEstablishedSession)}function Np(e){return Mp.bind(void 0,e)}async function Pp(e){await e.registrationTiming.measure(`ecdsaRegistrationPersistenceMs`,Np(e))}var Fp=e({REGISTRATION_TIMING_LABEL:()=>ha,addSigner:()=>Qh,cancelHostedPasskeyRegistration:()=>xm,prepareHostedPasskeyRegistration:()=>bm,registerPreparedHostedPasskeyRegistration:()=>Cm,registerWallet:()=>zh,resumeNearRegistrationAfterUnlock:()=>gh,startHostedPasskeyRegistrationCredential:()=>Sm});async function Ip(e,t,n,r){if(r.length!==10||new Set(r).size!==10)throw Error(`Wallet custody must issue exactly ten distinct recovery codes`);switch((await Lp({backup:n,context:e,request:{kind:`wallet_recovery_code_backup_request_v1`,walletId:t,recoveryCodes:r,continuation:`registration_may_defer`}}))?.kind){case`wallet_recovery_codes_backed_up_v1`:return;case`wallet_recovery_code_backup_deferred_v1`:await _r.write({walletId:t,recoveryCodes:r});return;default:throw Error(`Wallet recovery-code backup result is invalid`)}}async function Lp(e){if(!e.backup)return{kind:`wallet_recovery_code_backup_deferred_v1`};switch(e.backup.kind){case`defer_to_account_menu`:return{kind:`wallet_recovery_code_backup_deferred_v1`};case`show_builtin_dialog`:return await gr(e.request,e.context.signingEngine.getWalletIframeSurfaceMeasurementBinding());case`custom_handler`:return await e.backup.handler(e.request);default:return q(e.backup)}}function Rp(e){e.byteLength>0&&new Uint8Array(e).fill(0)}function zp(e){let t=e.established.metadata;return{binding:{kind:Ze,applicationBindingDigestB64u:e.established.localMaterial.applicationBindingDigestB64u,registeredPublicKeyB64u:I(t.registeredPublicKey),participantIds:t.participantIds,stateEpoch:String(t.stateEpoch),walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:e.signerSlot,signingWorkerId:t.scope.signing_worker_id,signingWorkerVerifyingShareB64u:I(t.signingWorkerVerifyingShare)},sealed:{ciphertextB64u:e.established.localMaterial.b64u,nonceB64u:e.established.localMaterial.nonceB64u}}}function Bp(e){let t=e.metadata;return{materialActivation:er(t),registeredPublicKeyB64u:I(t.registeredPublicKey),signingWorkerVerifyingShareB64u:I(t.signingWorkerVerifyingShare),stateEpoch:String(t.stateEpoch),signingWorkerId:t.scope.signing_worker_id,participantIds:t.participantIds,nearEd25519SigningKeyId:t.applicationBinding.near_ed25519_signing_key_id,signerSlot:t.applicationBinding.key_creation_signer_slot}}function Vp(e){let t=e.establishedCustody;if(!t)throw Error(`Mixed registration custody commit is missing its established envelope`);return{bindingJson:t.envelopeBindingJson,nonceB64u:t.envelopeNonceB64u,ciphertextB64u:t.sealedCustodySecretB64u,aadHashB64u:t.envelopeAadHashB64u,ciphertextDigestB64u:t.envelopeCiphertextDigestB64u}}function Hp(e){let t=e.commit.establishedCustody;if(!t)throw Error(`Passkey registration custody commit is missing its established envelope`);return Dd({expectedWalletId:e.walletId,replacement:t,activatedAtMs:e.activatedAtMs})}async function Up(e){await e.signingEngine.establishUnlockedWalletEd25519ExportRootCapabilityV1({existingEnvelope:Hp({commit:e.commit,walletId:e.walletId,activatedAtMs:Date.now()}),passkeyPrfFirstB64u:e.passkeyPrfFirstB64u,walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,walletSessionId:e.walletSessionId,expiresAtMs:e.expiresAtMs})}async function Wp(e){try{await mp(cp(e.context.signingEngine.getSignerWorkerContext()),{existingEnvelope:Hp({commit:e.commit,walletId:e.walletId,activatedAtMs:Date.now()}),existingFactorSecret:e.factorSecret32,walletId:e.walletId,walletAuthMethodId:String(e.emailOtpAuthContext.authority.bindingId),walletSessionId:e.walletSessionId,expiresAtMs:e.expiresAtMs})}catch(e){console.warn(`[registration][email-otp] unlocked Ed25519 export-root capability was not established:`,e instanceof Error?e.message:String(e||`unknown error`))}}async function Gp(e){let t=Hp(e);if(t.factor.kind!==`passkey`)throw Error(`Passkey registration custody commit has a non-passkey factor`);await Vd({walletId:e.walletId,credentialIdB64u:t.factor.credentialIdB64u,envelope:t})}function Kp(e){let t=e.joined.metadata,n=s(t.scope.threshold_session_id);if(!n.ok)throw Error(`Registration Ed25519 capability has an invalid threshold session`);return{kind:zt,session:{walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,authorityScope:{kind:`email_otp`,provider:ar(e.authContext),providerUserId:or(e.authContext)},thresholdSessionId:n.value,authorizationId:e.sessionState.signingWalletSession.authorizationId,walletSessionId:e.sessionState.walletSessionId,quotaId:e.sessionState.quotaId,expiresAtMs:e.sessionState.signingWalletSession.expiresAtMs,participantIds:t.participantIds,remainingUses:e.sessionState.signingWalletSession.remainingUses,signingRootId:e.sessionState.signingRootId,signingRootVersion:e.sessionState.signingRootVersion,runtimePolicyScope:e.sessionState.runtimePolicyScope,routerAbNormalSigning:e.sessionState.routerAbNormalSigning},capability:{kind:`router_ab_ed25519_yao_active_capability_v1`,materialActivation:t.materialActivation,activeCapabilityBinding:t.activeCapabilityBinding,registeredPublicKey:[...t.registeredPublicKey],nearAccountId:e.nearAccountId,applicationBinding:t.applicationBinding,runtimePolicyScope:e.sessionState.runtimePolicyScope,participantIds:t.participantIds,lifecycle:{lifecycleId:t.scope.lifecycle_id,rootShareEpoch:t.scope.root_share_epoch,accountId:t.scope.account_id,thresholdSessionId:n.value,signerSetId:t.scope.signer_set_id,signingWorkerId:t.scope.signing_worker_id},stateEpoch:Number(t.stateEpoch),registrationContinuity:{kind:`registration`,admissionRequest:e.deferredNear.admissionRequest,admissionReceipt:e.admissionReceipt,activationTranscript:[...t.transcript]}}}}const qp=Symbol(`hostedPasskeyRegistrationPrepared`),Jp=new WeakMap;function Yp(e){let t=Ae(e);if(!t.ok)throw Error(t.message);return t.value}function Xp(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function Zp(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`implicit_account`:return t.kind===`implicit_account`&&e.accountIdSource===t.accountIdSource;case`sponsored_named_account`:return t.kind===`sponsored_named_account`&&e.requestedAccountId===t.requestedAccountId&&e.sponsor===t.sponsor;default:return q(e)}}function Qp(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`near_ed25519`:return t.kind===`near_ed25519`&&Zp(e.accountProvisioning,t.accountProvisioning)&&e.signerSlot===t.signerSlot&&Xp(e.participantIds,t.participantIds)&&e.derivationVersion===t.derivationVersion;case`evm_family_ecdsa`:return t.kind===`evm_family_ecdsa`&&Xp(e.participantIds,t.participantIds)&&Ne(e.chainTargets)===Ne(t.chainTargets);default:return q(e)}}function $p(e,t){if(e.kind!==t.kind||e.signers.length!==t.signers.length)return!1;for(let n=0;n<e.signers.length;n+=1){let r=e.signers[n],i=t.signers[n];if(!r||!i||!Qp(r,i))return!1}return!0}function em(e){return e.signingEngine.warmCriticalResources.bind(e.signingEngine,{kind:`none`})}function tm(){return Promise.resolve(Ya())}function nm(e){return e.signers.some(e=>e.kind===`evm_family_ecdsa`)}function rm(e){return e.authMethod.kind!==`email_otp`||!Nr(e.signerSelection)?tm:am.bind(void 0,{prewarm:e.context.signingEngine.prewarmEmailOtpYao.bind(e.context.signingEngine)})}function im(e,t){let n=Ma(t);return{kind:`failed`,elapsedMs:n,workerPrewarmMs:n,yaoWasmInitMs:0,failureStage:`worker_ready`}}function am(e){let t=performance.now();return e.prewarm().catch(e=>im(e,t))}function om(e){let[t,n]=e;return{kind:`completed`,diagnostics:{...t,emailOtpWorkerPrewarmMs:n.workerPrewarmMs,emailOtpYaoWasmInitMs:n.yaoWasmInitMs,emailOtpYaoPrewarm:n}}}function sm(e){return{kind:`failed`,error:e}}function cm(e){Vn({relayerUrl:e.relayerUrl,nearEd25519:e.signerSelection.signers.some(e=>e.kind===`near_ed25519`),evmFamilyEcdsa:nm(e.signerSelection)}),Nr(e.signerSelection)&&Sh(e.authMethod);let t=e.recorder.measure(`registrationWarmupMs`,em(e.context)),n=e.recorder.measure(`registrationWarmupEmailOtpYaoWasmInitMs`,rm({context:e.context,authMethod:e.authMethod,signerSelection:e.signerSelection}));return nm(e.signerSelection)&&e.context.signingEngine.prewarmEcdsaRegistrationCrypto?.().catch(()=>{}),Promise.all([t,n]).then(om,sm)}function lm(e){e.warmup.then(t=>{t.kind===`completed`&&e.recorder.captureWarmupDiagnostics(t.diagnostics)})}function um(e){return Me(Yp(e))?.signerSlot??1}async function dm(e){return e.passkeyExecution?.kind===`use_hosted_preparation`?await e.passkeyExecution.authority:await qd({context:e.context,walletId:e.walletId,signerSlot:e.signerSlot,registrationIntentDigestB64u:e.registrationIntentDigestB64u,options:e.options,confirmationConfigOverride:e.confirmationConfigOverride})}function fm(e){if(e[qp]!==!0)throw Error(`Invalid hosted passkey registration preparation`);let t=Jp.get(e);if(!t)throw Error(`Hosted passkey registration preparation is unknown`);return t}function pm(e){if(e.lifecycle!==`ready`)throw Error(`Hosted passkey registration preparation is no longer usable`);if(Date.now()>=e.prepared.expiresAtMs)throw xm(e.prepared),Error(`Hosted passkey registration preparation expired`);if(e.controller.signal.aborted)throw Error(`Hosted passkey registration preparation was cancelled`);if(!mr.isLiveReservation({reservation:e.prepared.reservation,owner:e.prepared.owner}))throw xm(e.prepared),Error(`Hosted passkey registration prompt reservation is no longer active`)}function mm(e){return x({wallet:e.wallet,signerSelection:e.signerSelection,authMethod:e.authMethod,walletId:e.walletId,signerSlot:e.signerSlot,rpId:e.rpId,challengeB64u:e.challengeB64u})}function hm(){return Error(`Hosted passkey registration preparation was cancelled`)}function gm(e){if(e.aborted)throw hm()}function _m(e){let t=e.cancellation.signal;return gm(t),new Promise((n,r)=>{let i=!1,a=()=>{c(hm())},o=()=>{t.removeEventListener(`abort`,a)},s=e=>{i||(i=!0,o(),n(e))},c=e=>{i||(i=!0,o(),r(e))};t.addEventListener(`abort`,a,{once:!0}),e.operation.then(s,c)})}function vm(e){switch(e.setup.kind){case`near_ed25519`:return{kind:`not_required`};case`evm_family_ecdsa`:case`near_ed25519_and_evm_family_ecdsa`:{let t=e.setup.registrationCeremonyId,n=Zm(e.setup.ecdsa),r=e.context.signingEngine.createRouterAbEcdsaRegistrationCeremony({kind:`create_router_ab_ecdsa_registration_ceremony_v1`,ceremonyId:t,registration:n.strictRegistration});return r.catch(()=>void 0),{kind:`started`,ceremonyId:t,operation:r}}default:return q(e.setup)}}function ym(e){e.ceremony.kind!==`not_required`&&Fc({context:e.context,ceremonyId:e.ceremony.ceremonyId})}async function bm(e){let t=e.authMethod,n=yp(String(t.rpId));if(yp(String(e.context.signingEngine.getRpId()||``))!==n)throw Error(`Hosted passkey registration rpId does not match the wallet runtime`);let r=um(e.signerSelection),i=e.expiresInMs??300*1e3;if(!Number.isSafeInteger(i)||i<=0)throw Error(`Hosted passkey registration expiry must be a positive safe integer`);let a=Date.now()+i,o={kind:`hosted_auth_menu_registration`,authMenuSessionId:e.authMenuSessionId,requestId:e.requestId},s=new AbortController,c=null,l=null,u={kind:`not_required`},d=()=>{s.abort(),c&&xm(c)},f=()=>{e.cancellation.signal.removeEventListener(`abort`,d)};gm(e.cancellation.signal),e.cancellation.signal.addEventListener(`abort`,d,{once:!0});let p=new Ja(performance.now());try{let i=await _m({operation:Wm({context:e.context,authMethod:t,wallet:e.wallet,signerSelection:e.signerSelection,recorder:p}),cancellation:e.cancellation}),d=Xc(i.setup.intent);if(String(d.authMethod.rpId)!==String(n)||!$p(d.signerSelection,e.signerSelection))throw Error(`Hosted passkey registration setup changed its authority binding`);let m=Kt(String(d.walletId)),h=String(i.setup.registrationIntentDigestB64u||``).trim();if(!h)throw Error(`Hosted passkey registration setup returned no challenge`);if(r!==um(e.signerSelection))throw Error(`Hosted passkey registration signer slot changed during preparation`);if(u=vm({context:e.context,setup:i.setup}),lm({recorder:p,warmup:i.registrationWarmup}),Date.now()>=a)throw Error(`Hosted passkey registration preparation expired before reservation`);let g=await mr.reserveRegistrationPrompt({owner:o,expiresAtMs:a,cancellation:e.cancellation});l=g;let _=mm({wallet:e.wallet,signerSelection:e.signerSelection,authMethod:t,walletId:m,signerSlot:r,rpId:n,challengeB64u:h}),v=Object.freeze({kind:`hosted_passkey_registration_prepared_v1`,walletId:m,signerSlot:r,rpId:n,challengeB64u:h,registrationIntentDigestB64u:h,expiresAtMs:a,owner:o,reservation:g,cancellation:{kind:`abort_signal`,signal:s.signal},[qp]:!0});return Jp.set(v,{prepared:v,context:e.context,wallet:e.wallet,signerSelection:e.signerSelection,authMethod:t,options:e.options??{},...e.confirmationConfigOverride?{confirmationConfigOverride:e.confirmationConfigOverride}:{},setup:i,controller:s,removeExternalCancellationListener:f,binding:_,lifecycle:`ready`,authority:null,registrationStarted:!1,ecdsaClientCeremony:u}),c=v,v}catch(t){throw s.abort(),f(),ym({context:e.context,ceremony:u}),c?xm(c):l&&mr.releaseReservation(l),t}}function xm(e){let t=fm(e);t.lifecycle===`finished`||t.lifecycle===`cancelled`||(t.lifecycle=`cancelled`,t.controller.abort(),t.removeExternalCancellationListener?.(),t.removeExternalCancellationListener=null,ym({context:t.context,ceremony:t.ecdsaClientCeremony}),mr.releaseReservation(e.reservation))}function Sm(e){let t=fm(e);pm(t),t.lifecycle=`consuming`;let n=Kd(t.context.signingEngine.startPreparedPasskeyRegistrationCredential({walletId:String(e.walletId),signerSlot:e.signerSlot,challengeB64u:e.challengeB64u,expectedRpId:String(e.rpId),reservation:e.reservation,owner:e.owner,cancellation:e.cancellation}));return t.authority=n,n.then(()=>{t.lifecycle===`consuming`&&(t.lifecycle=`consumed`)},()=>{xm(e)}),n}async function Cm(e){let t=fm(e.prepared);if(t.lifecycle!==`consuming`&&t.lifecycle!==`consumed`||!t.authority)throw Error(`Hosted passkey registration credential must be started by its CTA`);if(t.registrationStarted)throw Error(`Hosted passkey registration continuation was already consumed`);t.registrationStarted=!0;try{return await Lh({context:t.context,authMethod:t.authMethod,wallet:t.wallet,signerSelection:t.signerSelection,options:t.options,authenticatorOptions:An(t.context.configs.webauthn.authenticatorOptions),...t.confirmationConfigOverride?{confirmationConfigOverride:t.confirmationConfigOverride}:{},passkeyExecution:{kind:`use_hosted_preparation`,prepared:e.prepared,authority:t.authority}})}finally{t.lifecycle=`finished`,ym({context:t.context,ceremony:t.ecdsaClientCeremony}),t.controller.abort(),t.removeExternalCancellationListener?.(),t.removeExternalCancellationListener=null,mr.releaseReservation(e.prepared.reservation)}}async function wm(e){return Jd(`wallet-registration-near-provisioning:${await S([`wallet-registration-near-provisioning`,e.registrationCeremonyId,e.activationReference.lifecycle_id,e.activationReference.session_id.map(e=>e.toString(16).padStart(2,`0`)).join(``)].join(`:`))}`)}function Tm(e){let t=globalThis.crypto;if(t&&typeof t.randomUUID==`function`)return Jd(`${e}:${t.randomUUID()}`);let n=new Uint8Array(16);if(!t||typeof t.getRandomValues!=`function`)throw Error(`Secure randomness is required for registration finalization`);return t.getRandomValues(n),Jd(`${e}:${[...n].map(e=>e.toString(16).padStart(2,`0`)).join(``)}`)}function Em(e){return e.recorder.measure(`emailOtpEnrollmentMaterialMs`,()=>Om({context:e.context,authMethod:e.authMethod,relayerUrl:e.relayerUrl,walletId:e.walletId,providerSubject:e.providerSubject,clientSecret32:e.clientSecret32}))}function Dm(e){if(e.emailOtpSessionHandle.kind!==`not_requested`)throw Error(`Strict ECDSA registration received obsolete Email OTP root-share material`)}async function Om(e){if(e.authMethod.kind!==`email_otp`)throw Error(`Email OTP enrollment material requires Email OTP auth`);try{let t=await e.context.signingEngine.prepareEmailOtpRegistrationEnrollmentMaterialInternal({relayUrl:e.relayerUrl,walletId:Fe(e.walletId),userId:e.providerSubject,clientSecret32:e.clientSecret32});return Dm(t),t}finally{e.clientSecret32.fill(0)}}function km(e){let t=e.event.authMethod,n=Am(e.accountId);return mn({...e.event,flowId:`registration:${t}:${n}`,accountId:n,authMethod:t})}function Am(e){let t=String(e||``).trim();if(!t)throw Error(`Registration event account id is required`);return t}function jm(e){return b(e)&&`code`in e?String(e.code||``).trim():``}function Mm(e,t){return Object.assign(Error(e),t?{code:t}:{})}function Nm(e){return Array.isArray(e)?e.filter(e=>{switch(e){case`ble`:case`hybrid`:case`internal`:case`nfc`:case`smart-card`:case`usb`:return!0;default:return!1}}):[]}function $(e,t,n){e?.(km({accountId:t,event:n}))}function Pm(e,t,n){let r=!1;return async i=>{if(!e||r)return await i;let a=setTimeout(()=>{r||(r=!0,$(e,t,{authMethod:`passkey`,phase:n,status:`running`}))},5e3);try{return await i}finally{clearTimeout(a)}}}async function Fm(e){let t=String(e||``).trim().toLowerCase();if(!t)throw Error(`Email OTP registration auth context requires email`);return S(t)}function Im(e){switch(e.proofKind){case`otp_challenge`:return`email`;case`google_sso_registration`:return`google`;default:return q(e)}}function Lm(e){switch(e.kind){case`passkey`:return{kind:`passkey`,webauthnRegistration:e.webauthnRegistration};case`email_otp`:return{kind:`email_otp`,emailOtpRegistrationProof:e.emailOtpRegistrationProof};default:return q(e)}}async function Rm(e){let t=performance.now();try{let n=await $c(e.deferredNear,{routerOrigin:new URL(e.relayerUrl).origin,routing:e.home,authorization:{kind:`bearer`,value:`Bearer ${e.signedSetup}`},fetch:globalThis.fetch,...e.traceContext?{traceContext:e.traceContext}:{}});return ba({ceremonyId:e.registrationCeremonyId,stage:`early_admission`,startedAt:t,outcome:`success`}),{deferredNear:e.deferredNear,admissionReceipt:n}}catch(n){throw ba({ceremonyId:e.registrationCeremonyId,stage:`early_admission`,startedAt:t,outcome:`failure`}),n}}function zm(e){if(!e)throw Error(`Mixed registration did not start NEAR admission`);return e}function Bm(e,t,n){switch(e.kind){case`passkey`:return{auth:{kind:`passkey`,rpId:ft(e.rpId),credentialIdB64u:t}};case`email_otp`:return{auth:{kind:`email_otp`,providerSubjectId:or(e.emailOtpAuthContext)},remainingUses:n.remainingUses,expiresAtMs:n.expiresAtMs};default:return q(e)}}async function Vm(e){let t=lt(x({operation:`wallet_registration_activate_v2`,registrationCeremonyId:e.registrationCeremonyId,activationCorrelationId:e.activationCorrelationId,idempotencyKey:e.idempotencyKey,publicFacts:e.publicFacts}));return{canonicalRequest:t,requestDigest:be(I(await k(String(t))))}}async function Hm(e){let t={authority:e.materialAuthority,targetMemberships:e.chainTargets,evmFamilySigningKeySlotId:Wt(e.ecdsaPrepare.prepare.evmFamilySigningKeySlotId,`registration ECDSA signing key slot`),ecdsaThresholdKeyId:cn(e.ecdsaPrepare.prepare.ecdsaThresholdKeyId),signingRootId:at(e.ecdsaPrepare.prepare.signingRootId),signingRootVersion:pt(e.ecdsaPrepare.prepare.signingRootVersion),runtimePolicyScope:e.ecdsaPrepare.prepare.runtimePolicyScope,clientVerifyingPublicKey33B64u:on(e.clientActivation.derivationClientSharePublicKey33B64u),participantIds:[Et(e.ecdsaPrepare.prepare.participantIds[0]),Et(e.ecdsaPrepare.prepare.participantIds[1])],relayerKeyId:sn(e.ecdsaPrepare.prepare.relayerKeyId),bindingDigest:fn(e.clientActivation.contextBinding32B64u),journalId:e.activationCorrelationId,requestDigest:e.activationCommand.requestDigest,canonicalRequest:e.activationCommand.canonicalRequest,createdAt:ve(new Date().toISOString())},n=await e.context.signingEngine.persistInitialCanonicalEcdsaActivation({kind:`persist_initial_canonical_ecdsa_activation_v1`,bootstrapOwner:`wallet_custody`,clientActivation:e.clientActivation,ceremonyId:e.ceremonyId,planInput:t});if(!n.ok)throw Error(`Canonical ECDSA activation persistence failed (${n.code}): ${n.message}`);return n}function Um(e){let t=L(e);if(t.length!==20)throw Error(`ECDSA activation address must contain 20 bytes`);return`0x${Array.from(t,e=>e.toString(16).padStart(2,`0`)).join(``)}`}async function Wm(e){let t=String(e.context.configs.network.relayer.url||``).trim();if(!t)throw Error(`registerWallet requires relayer.url`);let n=e.context.configs.registration,r=String(n?.publishableKey||``).trim(),i=String(n?.projectEnvironmentId||``).trim();if(!r||!i)throw Error(`registerWallet requires registration.publishableKey and registration.projectEnvironmentId`);let a=cm({recorder:e.recorder,context:e.context,relayerUrl:t,authMethod:e.authMethod,signerSelection:e.signerSelection}),o=await e.recorder.measure(`registrationIntentMs`,()=>Un({relayerUrl:t,request:{...e.wallet.kind===`provided`?{wallet:e.wallet}:{},signerSelection:e.signerSelection,authMethod:e.authMethod},auth:{publishableKey:r,environmentId:i}}));if(!o.ok)throw Mm(o.message,o.code);return{relayerUrl:t,setup:o,registrationWarmup:a}}async function Gm(e){if(e.passkeyExecution.kind===`collect_during_registration`)return await Wm({context:e.context,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,recorder:e.recorder});if(e.authMethod.kind!==`passkey`)throw Error(`Hosted passkey preparation requires passkey registration`);let t=fm(e.passkeyExecution.prepared);if(t.context!==e.context||t.lifecycle===`cancelled`)throw Error(`Hosted passkey registration preparation belongs to a different operation`);let n=t.setup,r=Xc(n.setup.intent),i=String(n.setup.registrationIntentDigestB64u||``).trim(),a=um(e.signerSelection);if(mm({wallet:e.wallet,signerSelection:e.signerSelection,authMethod:e.authMethod,walletId:Kt(String(r.walletId)),signerSlot:a,rpId:yp(String(e.authMethod.rpId)),challengeB64u:i})!==t.binding||String(r.walletId)!==String(e.passkeyExecution.prepared.walletId)||i!==e.passkeyExecution.prepared.challengeB64u)throw Error(`Hosted passkey registration preparation binding changed`);return n}function Km(e){if(e.passkeyExecution.kind===`collect_during_registration`)return{kind:`create_after_authority`};let t=fm(e.passkeyExecution.prepared);if(t.ecdsaClientCeremony.kind!==`started`||t.ecdsaClientCeremony.ceremonyId!==e.ceremonyId)throw Error(`Hosted passkey registration has no matching ECDSA client ceremony`);return{kind:`use_hosted_preparation`,ceremonyId:t.ecdsaClientCeremony.ceremonyId,operation:t.ecdsaClientCeremony.operation}}async function qm(e){return await e}function Jm(e){switch(e.clientCeremony.kind){case`create_after_authority`:return e.context.signingEngine.createRouterAbEcdsaRegistrationCeremony.bind(e.context.signingEngine,{kind:`create_router_ab_ecdsa_registration_ceremony_v1`,ceremonyId:e.ceremonyId,registration:e.registration});case`use_hosted_preparation`:if(e.clientCeremony.ceremonyId!==e.ceremonyId)throw Error(`Prepared ECDSA client ceremony identity changed`);return qm.bind(void 0,e.clientCeremony.operation);default:return q(e.clientCeremony)}}async function Ym(e){let[t,...n]=e.ecdsaPrepare.chainTargets;if(!t)throw Error(`Strict ECDSA ceremony requires at least one EVM-family target`);let r=e.registrationCeremonyId,i=ye(r),a=null;try{let o=await zc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationClientCreateMs`,operation:Jm({context:e.context,ceremonyId:r,registration:e.ecdsaPrepare.strictRegistration,clientCeremony:e.clientCeremony})}),s=await zc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationGatewayRespondMs`,operation:Hn.bind(void 0,{relayerUrl:e.relayerUrl,headers:Dc(e.traceContext),registrationCeremonyId:r,signerPlanKind:e.signerPlanKind,signedSetup:e.signedSetup,ecdsa:{kind:`router_ab_ecdsa_registration_v1`,strictRegistration:o.registrationRequest,requestDigestB64u:o.registrationRequestDigestB64u},...Lm(e.authority),onServerTiming:t=>_a(e.registrationTiming,`respond`,t)})});if(s.kind===`near_ed25519`)throw Error(`ECDSA registration ceremony received an Ed25519-only respond result`);let c=s.kind===`near_ed25519_and_evm_family_ecdsa`?s.ed25519:null,l=c?Rm({home:e.home,relayerUrl:e.relayerUrl,registrationCeremonyId:r,signedSetup:e.signedSetup,deferredNear:c,traceContext:e.traceContext}):null;l?.catch(lh);let u=await zc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationClientProofVerifyMs`,operation:e.context.signingEngine.verifyRouterAbEcdsaRegistrationClientProofs.bind(e.context.signingEngine,{kind:`verify_router_ab_ecdsa_registration_client_proofs_v1`,bootstrapOwner:`wallet_custody`,ceremonyId:r,clientProofFinalization:{kind:`finalize_encrypted_client_proof_bundles_v2`,bundles:s.ecdsa.strictResult.response.bundles}})}),d=await e.resolveActivateEmailOtp(),f=[t,...n],p=e.authority.kind===`passkey`?e.authority.walletCustodyFactorJson:d.walletCustodyFactorJson;if(!p)throw Error(`ECDSA registration has no wallet custody factor binding`);let m=e.authority.walletCustodyFactorSecret,h={},g=await e.context.signingEngine.establishWalletCustodyEvmFamilyKeySet({walletId:e.ecdsaPrepare.prepare.walletId,factorJson:p,factorSecret:m,evmFamilySigningKeySlotId:e.ecdsaPrepare.prepare.evmFamilySigningKeySlotId,applicationBindingDigestB64u:u.applicationBindingDigestB64u,confirmRecoveryCodesBackedUp:e.confirmRecoveryCodesBackedUp,runRelayerRound:async t=>{let n=mt({registrationRequestDigestB64u:u.registrationRequestDigestB64u,proofTranscriptDigestB64u:u.proofTranscriptDigestB64u,contextBinding32B64u:t.contextBinding32B64u,derivationClientSharePublicKey33B64u:t.clientSharePublicKey33B64u,clientShareRetryCounter:t.clientShareRetryCounter,participantId:1}),o=await Vm({registrationCeremonyId:r,activationCorrelationId:i,idempotencyKey:e.idempotencyKey,publicFacts:n}),s=Hl(t.preActivationCommitPayload),p={activationJournalId:i,clientActivation:n,activationRequestDigestB64u:o.requestDigest};if(e.signerPlanKind===`near_ed25519_and_evm_family_ecdsa`){if(!c)throw Error(`Mixed registration has no NEAR continuation`);await e.persistPendingCommit({signerPlanKind:e.signerPlanKind,localMaterial:{keyFamilies:[`ecdsa_secp256k1`],custodyCommit:s,ecdsa:p},emailOtpEnrollment:d.enrollment,deferredNear:c}),a=e.startDeferredNearCustody({admission:zm(l),establishedEvmCustodyCommit:t.preActivationCommitPayload}),a.catch(lh)}else await e.persistPendingCommit({signerPlanKind:e.signerPlanKind,localMaterial:{keyFamilies:[`ecdsa_secp256k1`],custodyCommit:s,ecdsa:p},emailOtpEnrollment:d.enrollment});let m=await Hm({context:e.context,ceremonyId:r,materialAuthority:e.materialAuthority,ecdsaPrepare:e.ecdsaPrepare,chainTargets:f,activationCorrelationId:i,activationCommand:o,clientActivation:n});if(String(m.journalId)!==String(i))throw Error(`ECDSA activation journal identity changed before activate`);let g=await zc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationGatewayActivateMs`,operation:Jn.bind(void 0,{relayerUrl:e.relayerUrl,headers:Dc(e.traceContext),registrationCeremonyId:r,signerPlanKind:e.signerPlanKind,signedSetup:e.signedSetup,idempotencyKey:e.idempotencyKey,ecdsa:{clientActivation:n,activationCorrelationId:i,activationRequestDigestB64u:o.requestDigest},walletCustodyCommit:t.preActivationCommitPayload,...d.enrollment?{emailOtpEnrollment:d.enrollment}:{},onServerTiming:t=>_a(e.registrationTiming,`activate`,t)})});if(g.kind!==`evm_family_ecdsa`||!g.ecdsa)throw Error(`ECDSA registration ceremony received a non-ECDSA activate result`);h.value=g,h.journalId=m.journalId;let _=g.ecdsa.activation.ecdsa_activation.public_identity;return JSON.stringify({relayerKeyId:e.ecdsaPrepare.prepare.relayerKeyId,relayerPublicKey33B64u:_.server_public_key33_b64u,groupPublicKey33B64u:_.threshold_public_key33_b64u,ethereumAddress:Um(_.ethereum_address20_b64u),relayerShareRetryCounter:_.server_share_retry_counter})}});if(!h.value||!h.journalId)throw Error(`Wallet custody ECDSA activation did not return its committed receipt`);let _=h.value;if(_.walletCustody?.status!==`committed`){let e=_.walletCustody?.status??`not_reported`;throw Error(`Wallet custody did not commit during ECDSA activation (${e})`)}let v=Ic({prepare:e.ecdsaPrepare.prepare,verified:g.clientBootstrap}),y=Wn({clientBootstrap:v,serverBootstrap:_.ecdsa.bootstrap,activationEpoch:_.ecdsa.activation.ecdsa_activation.activation_epoch}),b=await e.context.signingEngine.finalizeRouterAbEcdsaRegistrationActivation({kind:`finalize_router_ab_ecdsa_registration_activation_v1`,bootstrapOwner:`wallet_custody`,journalId:h.journalId,activationReceipt:_.ecdsa.activation,routerAbEcdsaDerivationNormalSigning:y.routerAbEcdsaDerivationNormalSigning,readyStateBlobB64u:g.localMaterial.readyStateBlobB64u,walletCustodyPublicFacts:g.localMaterial.publicFacts});return{session:{chainTargets:[t,...n],clientBootstrap:v,bootstrap:y,activatedThresholdSessionId:_.ecdsa.bootstrap.thresholdSessionId,roleLocalMaterial:b.roleLocalMaterial,authority:await st({authority:_.authority}),materialActivation:b.materialActivation,clientPublicFacts:b.publicFacts,publicCapability:b.publicCapability,registrationEstablishedSession:Ac(_.registrationEstablishedSession)},activated:_,deferredNear:c,activateEmailOtp:{enrollment:d.enrollment},walletCustody:g,deferredNearCustodyWork:a}}catch(t){throw oh(a),await Fc({context:e.context,ceremonyId:r}),t}}function Xm(e){switch(e.kind){case`evm`:return Re({chain:`evm`,chainId:e.chainId,networkSlug:e.networkSlug});case`tempo`:return Re({chain:`tempo`,chainId:e.chainId,networkSlug:e.networkSlug});default:return q(e)}}function Zm(e){let[t,...n]=e.chainTargets;if(!t)throw Error(`Registration setup ECDSA chain targets are required`);return{kind:e.kind,chainTargets:[Xm(t),...n.map(Xm)],prepare:e.prepare,strictRegistration:e.strictRegistration}}function Qm(e,t){switch(e.kind){case`near_ed25519`:throw Error(`Registration setup returned an Ed25519-only signer branch`);case`evm_family_ecdsa`:case`near_ed25519_and_evm_family_ecdsa`:if(e.kind!==t)throw Error(`Registration setup returned a different signer branch`);return e;default:return q(e)}}function $m(e){switch(e.kind){case`evm_family_ecdsa`:return 1;case`near_ed25519_and_evm_family_ecdsa`:return e.ed25519Selection.signerSlot;default:return q(e)}}function eh(e){if(e.authMethod.kind===`passkey`){if(!e.passkeyAuthority)throw Error(`Passkey registration authority was not collected`);return{kind:`passkey`,rpId:e.authMethod.rpId,credentialIdB64u:String(e.passkeyAuthority.credential.rawId||e.passkeyAuthority.credential.id||``).trim(),transports:[...e.passkeyAuthority.webauthnRegistration.response.transports]}}return{kind:`email_otp`,email:e.email,registrationAuthorityId:e.registrationAuthorityId,providerSubject:e.providerSubject,enrollment:th(e.emailOtpEnrollment)}}function th(e){if(!e)throw Error(`Email OTP registration has no enrollment material for pending recovery`);return e}async function nh(e){let t=Date.now(),n=Dp({...e,createdAtMs:t,updatedAtMs:t});return await V.putPendingWalletRegistrationCommit(n),n}function rh(e){if(!e||e.operation!==`registration_activate`||e.signerPlanKind!==`near_ed25519_and_evm_family_ecdsa`)throw Error(`Mixed registration activation commit was not persisted`);return e}async function ih(e){let t=e.walletKeys;if(e.auth.kind===`passkey`){let n=String(e.auth.credential.rawId||e.auth.credential.id||``).trim();if(!n)throw Error(`Passkey registration publication has no credential id`);return await tt({kind:`passkey`,walletId:e.walletId,rpId:yp(e.auth.rpId),credentialIdB64u:n,credentialPublicKeyB64u:e.auth.credentialPublicKeyB64u,transports:e.auth.credential.response?.transports??[],walletKeys:t})}return await tt({kind:`email_otp`,walletId:e.walletId,email:e.auth.email,registrationAuthorityId:e.auth.registrationAuthorityId,authority:e.auth.authority,walletKeys:t})}async function ah(e){let t=await Ap({context:e.context,relayerUrl:e.relayerUrl,registrationTiming:e.registrationTiming,plan:e.plan}),n=await ih({auth:e.plan.auth,walletId:e.plan.walletId,walletKeys:t}),r=e.plan.ecdsa.session.registrationEstablishedSession;await V.publishPendingWalletRegistrationCommit({pending:e.pending,authority:e.activated.authority,foundingAuthority:{authority:e.activated.foundingAuthority,authMethod:e.activated.foundingAuthMethod},request:{operation:e.pending.operation,registrationCeremonyId:e.pending.registrationCeremonyId,idempotencyKey:e.pending.idempotencyKey,walletId:e.pending.walletId,walletAuthMethodId:e.pending.walletAuthMethodId},walletSessionPublication:{kind:`issued`,walletSession:r.walletSession,operationCredential:r.operationCredential},ecdsaContinuity:[],registration:n})}async function oh(e){if(e)try{Rp((await e).factorSecret32)}catch{}}function sh(e){switch(e.auth.kind){case`passkey`:{if(!e.passkeyAuthority)throw Error(`Deferred passkey registration requires authority material`);let t=String(e.passkeyAuthority.credential.rawId||e.passkeyAuthority.credential.id||``).trim(),n=String(e.passkeyAuthority.prfFirstB64u||``).trim();if(!t||!n)throw Error(`Deferred passkey registration requires credential PRF material`);return{kind:`passkey`,rpId:e.auth.rpId,credentialIdB64u:t,prfFirstB64u:n}}case`email_otp`:if(!e.emailOtpEnrollment)throw Error(`Deferred Email OTP registration requires enrollment material`);return{kind:`email_otp`,enrollment:e.emailOtpEnrollment,emailOtpAuthContext:e.auth.emailOtpAuthContext};default:return q(e.auth)}}async function ch(e,t,n){let r=performance.now();await V.advancePendingNearRegistration({expected:e,next:wn(e,t,n)}),Or(e.registrationCeremonyId,`journal_prepared`,r)}function lh(){}async function uh(e,t){let n=e.factorSecretOwner.value;if(!n)throw Error(`Mixed registration has no NEAR custody factor secret`);e.factorSecretOwner.value=null;let r=performance.now(),i=`failure`;try{let r=await V.getPendingWalletRegistrationCommit({registrationCeremonyId:e.registrationCeremonyId,operation:`near_provisioning`});if(!r||r.operation!==`near_provisioning`||r.phase!==`planned`)throw Error(`NEAR registration has no planned continuation`);let a;try{let e=await t.admission;if(!Rt(e.deferredNear.admissionRequest,r.admissionRequest))throw Error(`NEAR admission changed the authorized request`);a=e.admissionReceipt}catch(e){if(e instanceof Error&&e.message===`NEAR admission changed the authorized request`)throw e;a=void 0}let{joined:o,admissionReceipt:s}=await fh({home:e.home,pending:r,signingEngine:e.context.signingEngine,relayerUrl:e.relayerUrl,credential:e.signedSetup,traceContext:e.traceContext,factorSecret:n,...a?{admitted:a}:{}});return i=`success`,{admissionReceipt:s,joined:o,admissionRequest:r.admissionRequest,envelope:Hp({commit:t.establishedEvmCustodyCommit,walletId:r.walletId,activatedAtMs:Date.now()}),factorSecret32:n}}catch(e){throw Rp(n),e}finally{ba({ceremonyId:e.registrationCeremonyId,stage:`custody_join`,startedAt:r,outcome:i})}}async function dh(e){return e.pending.phase===`execution_prepared`?e.pending.admissionReceipt:e.admitted?e.admitted:await $c({status:`deferred`,admissionRequest:e.pending.admissionRequest},{routerOrigin:new URL(e.relayerUrl).origin,routing:e.home,authorization:{kind:`bearer`,value:`Bearer ${e.credential}`},fetch:globalThis.fetch,traceContext:e.traceContext})}async function fh(e){let t=e.pending;if(t.phase===`joined`&&t.completion.kind!==`encrypted_checkpoint`)throw Error(`Joined material has no encrypted execution checkpoint`);let n=t.phase===`joined`&&t.completion.kind===`encrypted_checkpoint`?t.completion.prepared:t;if(n.phase===`joined`)throw Error(`Invalid NEAR continuation phase`);let r=n.admissionRequest,i=performance.now(),a=await dh({home:e.home,pending:n,relayerUrl:e.relayerUrl,credential:e.credential,traceContext:e.traceContext,...e.admitted?{admitted:e.admitted}:{}});Or(n.registrationCeremonyId,`admission`,i);let o=await e.signingEngine.joinWalletCustodyNearEd25519KeySet({routing:e.home,...n.phase===`planned`?{preparation:{kind:`fresh`},beforeRouterRound:ch.bind(void 0,n,a)}:{preparation:{kind:`checkpoint`,checkpointJson:n.checkpointJson}},custodyJson:jl(n.baseCustodyCommit),factorSecret:e.factorSecret,nearEd25519SigningKeyId:r.application_binding.near_ed25519_signing_key_id,registrationCeremonyId:n.registrationCeremonyId,admissionRequest:r,admissionReceipt:a,participantIds:r.participant_ids,routerOrigin:new URL(e.relayerUrl).origin,authorization:`Bearer ${e.credential}`,traceContext:e.traceContext});if(t.phase===`joined`){if(I(o.metadata.registeredPublicKey)!==t.localMaterial.ed25519.metadata.registeredPublicKeyB64u||JSON.stringify(o.activationReference)!==JSON.stringify(t.localMaterial.ed25519.activationReference))throw Error(`Restored NEAR checkpoint changed the joined key`);return{joined:o,admissionReceipt:a}}let s=performance.now(),c=await V.getPendingWalletRegistrationCommit({registrationCeremonyId:n.registrationCeremonyId,operation:`near_provisioning`});if(!c||c.operation!==`near_provisioning`||c.phase!==`execution_prepared`)throw Error(`NEAR execution checkpoint was not persisted`);let l=Dp({operation:`near_provisioning`,signerPlanKind:`near_ed25519_and_evm_family_ecdsa`,completion:{kind:`encrypted_checkpoint`,prepared:c},registrationCeremonyId:c.registrationCeremonyId,idempotencyKey:await wm({registrationCeremonyId:c.registrationCeremonyId,activationReference:o.activationReference}),walletId:c.walletId,walletAuthMethodId:c.walletAuthMethodId,signedSetup:c.signedSetup,auth:c.auth,createdAtMs:c.createdAtMs,updatedAtMs:Date.now(),localMaterial:{keyFamilies:[`ed25519`],custodyCommit:o.commitPayload,ed25519:{activationReference:o.activationReference,localMaterial:o.localMaterial,metadata:Bp(o)}}});if(l.operation!==`near_provisioning`||l.phase!==`joined`)throw Error(`Invalid joined NEAR continuation`);return await V.advancePendingNearRegistration({expected:c,next:l}),Or(n.registrationCeremonyId,`journal_joined`,s),{joined:o,admissionReceipt:a}}function ph(e){return e.chainTarget}function mh(e,t){if(e.auth.kind===`passkey`&&t.kind===`passkey`&&e.auth.rpId===t.rpId&&e.auth.credentialIdB64u===t.credentialIdB64u)return{kind:`passkey`,rpId:t.rpId,credentialIdB64u:t.credentialIdB64u,prfFirstB64u:t.prfFirstB64u};if(e.auth.kind===`email_otp`&&t.kind===`email_otp`&&e.auth.providerSubject===t.providerSubject){let n=ct({walletId:e.walletId,bindingId:e.walletAuthMethodId,factor:{kind:`email_otp`,provider:t.provider,providerUserId:t.providerSubject},verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:t.emailHashHex}});if(!n)throw Error(`NEAR continuation requires its founding Email OTP method`);return{kind:`email_otp`,enrollment:e.auth.enrollment,emailOtpAuthContext:cr({policy:`session`,retention:`session`,reason:`login`,authority:n})}}throw Error(`NEAR continuation requires its founding authentication method`)}async function hh(e){if(await yh(e.sessionAuthority),e.pending.phase===`joined`&&e.pending.completion.kind===`sealed_material`){let t=await sd({pending:e.pending,relayerUrl:e.relayerUrl,operationCredential:e.sessionAuthority.operationCredential});return{joined:t.joined,admissionRequest:t.admissionRequest,admissionReceipt:t.admissionReceipt,envelope:e.envelope,factorSecret32:e.factorSecret}}let t=e.pending.phase===`joined`?e.pending.completion.prepared:e.pending;if(!t)throw Error(`NEAR continuation has no encrypted checkpoint`);let n=await fh({home:e.sessionAuthority.operationCredential.home,pending:e.pending,signingEngine:e.context.signingEngine,relayerUrl:e.relayerUrl,credential:e.sessionAuthority.operationCredential.token,traceContext:gn(),factorSecret:e.factorSecret});return{joined:n.joined,admissionReceipt:n.admissionReceipt,admissionRequest:t.admissionRequest,envelope:e.envelope,factorSecret32:e.factorSecret}}async function gh(e){let t=performance.now();try{let n=await V.listPendingWalletRegistrationCommits();for(let r of n){if(r.operation!==`near_provisioning`||r.walletId!==e.sessionAuthority.record.walletId||r.walletAuthMethodId!==e.sessionAuthority.record.authMethodId||r.signerPlanKind!==`near_ed25519_and_evm_family_ecdsa`||await V.getPendingWalletRegistrationCommit({registrationCeremonyId:r.registrationCeremonyId,operation:`registration_activate`}))continue;let n=e.context.configs.network.relayer.url,i=mh(r,e.factor),a=hh.bind(void 0,{context:e.context,pending:r,envelope:e.custodyEnvelope,relayerUrl:n,sessionAuthority:e.sessionAuthority,factorSecret:e.ownedFactorSecret});await kh({context:e.context,walletId:r.walletId,commit:{context:e.context,registrationTiming:null,registrationStartedAt:t,relayerUrl:n,registrationCeremonyId:r.registrationCeremonyId,signedSetup:r.signedSetup,headers:Dc(),nearCustodyWork:a,sessionAuthority:e.sessionAuthority,expectedChainTargets:jr(e.context.configs.network.chains).map(ph),walletId:r.walletId,authMaterial:i}})}}catch(e){console.warn(`[registration] NEAR continuation remains pending`,e instanceof Error?e.message:`continuation failed`)}finally{Rp(e.ownedFactorSecret)}}function _h(e){if(!e)throw Error(`Mixed registration did not start its NEAR custody join`);return e}function vh(e,t,n,r){if(t.kind!==`already_committed`||t.session.tokens.kind!==`near_ed25519_and_evm_family_ecdsa`)throw Error(`NEAR completion must extend the current Wallet Session`);let i=t.session,a=e.record,o=i.walletSession;if(i.walletId!==a.walletId||i.authorizationId!==a.authorizationId||i.quotaId!==a.quotaId||i.walletSessionId!==e.operationCredential.walletSessionId||o.authorityId!==a.authorityId||o.authMethodId!==a.authMethodId||o.issuedAtMs!==a.issuedAtMs||o.expiresAtMs!==a.expiresAtMs||o.authorityRevocationEpoch!==a.authorityRevocationEpoch||o.expiresAtMs<=Date.now()||!de(a,o)||n.authorityId!==o.authorityId||n.walletId!==o.walletId||n.authorityDigestB64u!==o.authorityDigestB64u||n.revocationEpoch!==o.authorityRevocationEpoch||r.walletAuthMethodId!==o.authMethodId||r.walletId!==o.walletId||r.walletAuthorityId!==o.authorityId)throw Error(`NEAR completion changed the current Wallet Session authority`);return{kind:`registration_established_wallet_session_v2`,walletId:i.walletId,authorizationId:i.authorizationId,walletSessionId:i.walletSessionId,quotaId:i.quotaId,expiresAtMs:i.expiresAtMs,remainingUses:i.remainingUses,walletSession:o,operationCredential:e.operationCredential,tokens:i.tokens}}async function yh(e){let t=await Fn.readExactWithOperationCredential({walletId:e.record.walletId,authorityId:e.record.authorityId,authMethodId:e.record.authMethodId});if(t.kind!==`found`||t.record.expiresAtMs<=Date.now()||t.record.authorizationId!==e.record.authorizationId||t.record.authorityRevocationEpoch!==e.record.authorityRevocationEpoch||t.operationCredential.token!==e.operationCredential.token)throw Error(`NEAR continuation requires the current unlocked Wallet Session`)}async function bh(e){let t=await V.getPendingWalletRegistrationCommit({registrationCeremonyId:e.registrationCeremonyId,operation:`near_provisioning`});if(!t||t.operation!==`near_provisioning`||t.phase!==`joined`||t.walletId!==e.walletId||t.walletAuthMethodId!==e.walletAuthMethodId)throw Error(`NEAR joined checkpoint was not persisted`);return t}async function xh(e){let{metadata:t,materialFacts:n}=e,r={materialActivation:er(t),lifecycleId:t.scope.lifecycle_id,signingRootVersion:t.scope.root_share_epoch,signingRootId:t.applicationBinding.signing_root_id,signerSetId:t.scope.signer_set_id,thresholdSessionId:n.identity.thresholdSessionId,activationTranscriptB64u:I(t.transcript),activationCapabilityBindingB64u:I(Uint8Array.from(t.activeCapabilityBinding))},i=null;try{i=await da({material:e.material,activation:r,envelope:e.envelope,ownedFactorSecret:e.ownedFactorSecret}),await Vf({store:V,activeClient:i,identity:{walletId:n.identity.walletId,nearAccountId:n.identity.nearAccountId,nearEd25519SigningKeyId:n.identity.nearEd25519SigningKeyId,thresholdSessionId:n.identity.thresholdSessionId,signerSlot:n.identity.signerSlot,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,signingRootId:n.identity.signingRootId,signingRootVersion:n.identity.signingRootVersion,signingWorkerId:n.stableServerScope.routerAbNormalSigning.signingWorkerId},stableServerScope:n.stableServerScope,passkeyPrfFirstB64u:e.passkeyPrfFirstB64u}),await yh(e.sessionAuthority),await e.signingEngine.activateVerifiedNearEd25519YaoMaterial({activeClient:i,facts:{thresholdSessionId:n.identity.thresholdSessionId,signer:sr({walletId:Fe(n.identity.walletId),nearAccountId:z(n.identity.nearAccountId),nearEd25519SigningKeyId:qt(n.identity.nearEd25519SigningKeyId),signerSlot:n.identity.signerSlot}),signingRootId:n.identity.signingRootId,signingRootVersion:n.identity.signingRootVersion,routerAbNormalSigning:n.stableServerScope.routerAbNormalSigning,runtimePolicyScope:n.stableServerScope.runtimePolicyScope,relayerUrl:e.relayerUrl}}),await yh(e.sessionAuthority),i=null}catch(e){throw i?.dispose(),e}finally{e.ownedFactorSecret.fill(0)}}async function Sh(e){if(e.kind===`passkey`)try{await oa.initializeBundled()}catch{}}async function Ch(e){let t=performance.now(),n=`failure`;try{return await e.signingEngine.hydrateSigningSession(e.input),n=`success`,{kind:`completed`}}catch(e){return{kind:`failed`,error:e}}finally{ba({ceremonyId:e.ceremonyId,stage:`session_hydration`,startedAt:t,outcome:n})}}async function wh(e){let t=performance.now(),n=`failure`;try{return await e.signingEngine.prepareSigningSessionHydration(e.input),n=`success`,{kind:`completed`}}catch(e){return{kind:`failed`,error:e}}finally{ba({ceremonyId:e.ceremonyId,stage:`session_seal_preparation`,startedAt:t,outcome:n})}}function Th(e){let t=s(e.thresholdSessionId);if(!t.ok)throw Error(`Invalid admitted NEAR session identity`);let n=Tm(`near-session-client-seal`);return{kind:`preparing`,thresholdSessionId:String(t.value),preparationId:n,result:wh({signingEngine:e.signingEngine,ceremonyId:e.ceremonyId,input:{preparationId:n,thresholdSessionId:String(t.value),prfFirstB64u:e.prfFirstB64u}})}}async function Eh(e){try{await yh(e.sessionAuthority);let t=await V.getPendingWalletRegistrationCommit({registrationCeremonyId:e.ceremonyId,operation:`near_provisioning`});return!t||t.operation!==`near_provisioning`||t.phase===`joined`||t.walletId!==e.sessionAuthority.record.walletId||t.walletAuthMethodId!==e.sessionAuthority.record.authMethodId?{kind:`none`}:Th({signingEngine:e.signingEngine,ceremonyId:e.ceremonyId,thresholdSessionId:t.admissionRequest.scope.threshold_session_id,prfFirstB64u:e.prfFirstB64u})}catch{return{kind:`none`}}}function Dh(){return null}async function Oh(e){let t=e.authMaterial,n=performance.now(),r=`failure`,i=null,a=Promise.resolve({kind:`completed`}),o={kind:`none`};try{t.kind===`passkey`&&(o=await Eh({signingEngine:e.context.signingEngine,ceremonyId:e.registrationCeremonyId,sessionAuthority:e.sessionAuthority,prfFirstB64u:t.prfFirstB64u}));let n=await e.nearCustodyWork();i=n.factorSecret32;let s=n.joined,c=`ed25519:${Te(s.metadata.registeredPublicKey)}`,l=s.activationReference,u=await wm({registrationCeremonyId:e.registrationCeremonyId,activationReference:l}),d=await bh({registrationCeremonyId:e.registrationCeremonyId,walletId:e.walletId,walletAuthMethodId:String(e.sessionAuthority.record.authMethodId)});await yh(e.sessionAuthority),t.kind===`passkey`&&o.kind===`none`&&(o=Th({signingEngine:e.context.signingEngine,ceremonyId:e.registrationCeremonyId,thresholdSessionId:s.metadata.scope.threshold_session_id,prfFirstB64u:t.prfFirstB64u}));let f;if(o.kind===`preparing`){let t=performance.now(),n=await o.result;if(ba({ceremonyId:e.registrationCeremonyId,stage:`session_seal_preparation_wait`,startedAt:t,outcome:n.kind===`completed`?`success`:`failure`}),n.kind===`failed`)throw n.error;await yh(e.sessionAuthority);let r=await e.context.signingEngine.readPreparedSigningSessionHydration({thresholdSessionId:o.thresholdSessionId,preparationId:o.preparationId});f={preparationId:o.preparationId,thresholdSessionId:o.thresholdSessionId,ciphertext:r.ciphertext}}let p=performance.now(),m={relayerUrl:e.relayerUrl,registrationCeremonyId:e.registrationCeremonyId,signedSetup:e.signedSetup,headers:{...e.headers,...N(e.sessionAuthority.operationCredential)},idempotencyKey:u,ed25519:{activationReference:l},walletCustodyCommit:s.commitPayload,onServerTiming:va.bind(void 0,e.registrationTiming)},h;if(f){if(e.authMaterial.kind!==`passkey`)throw Error(`Prepared session sealing requires a passkey authority`);h=await Zn({...m,auth:{kind:`passkey`},sessionSeal:{thresholdSessionId:f.thresholdSessionId,ciphertext:f.ciphertext}})}else h=await Zn({...m,auth:e.authMaterial});if(!h.ok)throw Error(`Deferred NEAR provisioning did not complete`);let g=h;if(g.kind!==`near_ed25519`)throw Error(`Deferred Ed25519 finalize returned a different signer branch`);if(g.walletCustody?.status!==`joined`){let e=g.walletCustody?.status??`not_reported`;throw Error(`Deferred NEAR custody join did not commit (${e})`)}if(f&&!g.sessionSeal)throw Error(`Deferred NEAR finalization did not return the prepared session seal`);ba({ceremonyId:e.registrationCeremonyId,stage:`server_finalize`,startedAt:p,outcome:`success`});let _=vh(e.sessionAuthority,g.registrationEstablishedSession,g.foundingAuthority,g.foundingAuthMethod),v=z(g.ed25519.nearAccountId),y=e.authMaterial.kind===`passkey`?e.authMaterial.credentialIdB64u:``;t.kind===`passkey`?Zc({clientPublicKey:c,finalized:g,expectedRpId:t.rpId,expectedWalletId:e.walletId}):Qc({clientPublicKey:c,finalized:g,expectedRegistrationAuthorityId:d.auth.kind===`email_otp`?d.auth.registrationAuthorityId:``,expectedWalletId:e.walletId});let b=qc({admissionRequest:n.admissionRequest,finalized:g.ed25519,walletId:e.walletId,expectedRuntimePolicyScope:F(g.ed25519.runtimePolicyScope)}),x=s.metadata,S=er(x),C=zp({established:s,walletId:String(e.walletId),nearAccountId:String(v),nearEd25519SigningKeyId:g.ed25519.nearEd25519SigningKeyId,signerSlot:g.ed25519.signerSlot}),w=performance.now(),T=await nd(d,g);await yh(e.sessionAuthority);let E=(await V.publishPendingWalletRegistrationCommitAndRetain({pending:d,ecdsaContinuity:[],authority:g.authority,foundingAuthority:{authority:g.foundingAuthority,authMethod:g.foundingAuthMethod},request:{operation:d.operation,registrationCeremonyId:e.registrationCeremonyId,idempotencyKey:d.idempotencyKey,walletId:e.walletId,walletAuthMethodId:g.foundingAuthMethod.walletAuthMethodId},walletSessionPublication:{kind:`credential_free_projection`,walletSession:_.walletSession},registration:T})).signerActivations[0];if(!E||E.signerSlot!==g.ed25519.signerSlot)throw Error(`Deferred Ed25519 registration persisted a different signer slot`);let D=new dr;for(let t of e.expectedChainTargets)pd({signingEngine:e.context.signingEngine,walletId:e.walletId,chainTarget:t,trigger:`registration`,statusReads:D});ba({ceremonyId:e.registrationCeremonyId,stage:`local_publication`,startedAt:w,outcome:`success`}),await yh(e.sessionAuthority),e.authMaterial.kind===`passkey`&&_.remainingUses>0&&(a=Ch({signingEngine:e.context.signingEngine,ceremonyId:e.registrationCeremonyId,input:el({session:_,ceremonyId:e.registrationCeremonyId,walletId:String(e.walletId),relayerUrl:e.relayerUrl,prfFirstB64u:e.authMaterial.prfFirstB64u,preparedServerSeal:f&&g.sessionSeal?{preparationId:f.preparationId,...g.sessionSeal}:null,restore:{rpId:e.authMaterial.rpId,nearAccountId:String(v),nearEd25519SigningKeyId:g.ed25519.nearEd25519SigningKeyId,relayerKeyId:g.ed25519.relayerKeyId,participantIds:g.ed25519.participantIds,signerSlot:g.ed25519.signerSlot,credentialIdB64u:e.authMaterial.credentialIdB64u,materialActivation:S}})}));let O=performance.now();await e.context.signingEngine.activateAuthenticatedWalletState({walletId:e.walletId,nearAccountId:v,signerSlot:g.ed25519.signerSlot,nearClient:e.context.nearClient}),await e.context.signingEngine.upsertEd25519YaoPublicCapabilityLaneReference({walletId:e.walletId,nearAccountId:v,thresholdSessionId:b.identity.thresholdSessionId,runtimePolicyScope:b.stableServerScope.runtimePolicyScope,materialActivation:S,...Bm(t,y,_),nearEd25519SigningKeyId:qt(g.ed25519.nearEd25519SigningKeyId),signerSlot:g.ed25519.signerSlot}),ba({ceremonyId:e.registrationCeremonyId,stage:`session_install`,startedAt:O,outcome:`success`});let k=performance.now();if(t.kind===`email_otp`&&_.remainingUses>0){let r=await Yc({registrationEstablishedSession:_,walletId:e.walletId,nearAccountId:String(v),nearEd25519SigningKeyId:g.ed25519.nearEd25519SigningKeyId,thresholdSessionId:b.identity.thresholdSessionId,runtimePolicyScope:b.stableServerScope.runtimePolicyScope,signerSlot:g.ed25519.signerSlot,relayerUrl:e.relayerUrl,emailOtpAuthContext:t.emailOtpAuthContext}),a=Kp({walletId:e.walletId,nearAccountId:String(v),nearEd25519SigningKeyId:g.ed25519.nearEd25519SigningKeyId,sessionState:r,joined:s,deferredNear:{status:`deferred`,admissionRequest:n.admissionRequest},admissionReceipt:n.admissionReceipt,authContext:t.emailOtpAuthContext});await e.context.signingEngine.activateEmailOtpEd25519RegistrationMaterialInternal({walletSession:{walletId:e.walletId,walletSessionUserId:String(e.walletId)},providerSubject:or(t.emailOtpAuthContext),emailHashHex:lr(t.emailOtpAuthContext),signerSlot:g.ed25519.signerSlot,expectedOperationalPublicKey:c,expectedThresholdSessionId:b.identity.thresholdSessionId,bootstrap:a,material:C,envelope:la(n.envelope),factorSecret32:i}),i=null}else if(t.kind===`passkey`){if(e.authMaterial.kind!==`passkey`)throw Error(`Deferred passkey registration has no Passkey authorization material`);if(!i)throw Error(`Deferred passkey registration has no custody factor secret`);await xh({signingEngine:e.context.signingEngine,sessionAuthority:e.sessionAuthority,metadata:x,material:C,materialFacts:b,envelope:la(n.envelope),ownedFactorSecret:new Uint8Array(i),rpId:e.authMaterial.rpId,credentialIdB64u:e.authMaterial.credentialIdB64u,passkeyPrfFirstB64u:e.authMaterial.prfFirstB64u,relayerUrl:e.relayerUrl}),i=null}e.authMaterial.kind===`passkey`&&await Vd({walletId:String(e.walletId),credentialIdB64u:e.authMaterial.credentialIdB64u,envelope:n.envelope}),ba({ceremonyId:e.registrationCeremonyId,stage:`signer_activation`,startedAt:k,outcome:`success`}),await yh(e.sessionAuthority);let ee=performance.now(),te=await a;if(ba({ceremonyId:e.registrationCeremonyId,stage:`session_hydration_wait`,startedAt:ee,outcome:te.kind===`completed`?`success`:`failure`}),te.kind===`failed`)throw te.error;await yh(e.sessionAuthority);let A=performance.now();return await V.completePendingNearRegistration({pending:d,walletSession:_.walletSession,operationCredential:_.operationCredential,nearAccountId:String(v)}),ba({ceremonyId:e.registrationCeremonyId,stage:`durable_ready`,startedAt:A,outcome:`success`}),r=`success`,{status:`near_ready`,updatedAtMs:Date.now(),nearAccountId:String(v)}}catch(t){let n=await V.getProfile(String(e.walletId)).catch(Dh);if(n?.nearProvisioning?.status===`near_ready`)return n.nearProvisioning;let r=Ah(t);try{await e.context.signingEngine.setWalletNearProvisioningState({walletId:String(e.walletId),status:`near_failed_retryable`,errorCode:r})}catch{}return{status:`near_failed_retryable`,updatedAtMs:Date.now(),error:xe(t,`registration`,String(e.walletId)),errorCode:r}}finally{await a,o.kind===`preparing`&&(await o.result,await e.context.signingEngine.discardSigningSessionHydration({thresholdSessionId:o.thresholdSessionId,preparationId:o.preparationId}).catch(lh)),i&&Rp(i),ba({ceremonyId:e.registrationCeremonyId,stage:`provisioning_total`,startedAt:n,outcome:r}),ba({ceremonyId:e.registrationCeremonyId,stage:`registration_total`,startedAt:e.registrationStartedAt,outcome:r})}}async function kh(e){try{await e.context.signingEngine.setWalletNearProvisioningState({walletId:String(e.walletId),status:`near_provisioning`})}catch(t){let n=Ah(t),r={status:`near_failed_retryable`,updatedAtMs:Date.now(),error:xe(t,`registration`,String(e.walletId)),errorCode:n};try{await e.context.signingEngine.setWalletNearProvisioningState({walletId:String(e.walletId),status:`near_failed_retryable`,errorCode:n})}catch{}bd(e.walletId,r);return}await Sd({walletId:e.walletId,nowMs:Date.now,attempt:Oh.bind(void 0,e.commit)})}function Ah(e){let t=e instanceof Error?e.message:String(e);return t.includes(`finalize`)?`near_finalize_failed`:t.includes(`seal`)||t.includes(`Yao`)?`near_seal_failed`:t.includes(`wallet session`)?`near_capability_persist_failed`:`near_provisioning_failed`}async function jh(e){let t=Ah(e.error),n=xe(e.error,`registration`,String(e.walletId));try{await e.context.signingEngine.setWalletNearProvisioningState({walletId:String(e.walletId),status:`near_failed_retryable`,errorCode:t})}catch{}return bd(e.walletId,{status:`near_failed_retryable`,updatedAtMs:Date.now(),error:n,errorCode:t}),{status:`retryable`,error:n,errorCode:t}}async function Mh(e){try{return await e.context.signingEngine.setWalletNearProvisioningState({walletId:String(e.walletId),status:`near_pending`}),bd(e.walletId,{status:`near_pending`,updatedAtMs:Date.now()}),{status:`pending`}}catch(t){return await jh({context:e.context,walletId:e.walletId,error:t})}}async function Nh(e){let{context:t,wallet:n,signerSelection:r}=e,i=e.options||{},{onEvent:a,onError:o,afterCall:s}=i,l=performance.now(),u=new Ja(l),f=gn(),p=null,m=null,h=Am(n.kind===`provided`?String(n.walletId):`wallet-registration`);$(a,h,{authMethod:e.authMethod.kind,phase:B.STEP_01_STARTED,status:`started`});try{let o=Tm(`wallet-registration-finalize`),h=await Gm({context:t,authMethod:e.authMethod,wallet:n,signerSelection:r,recorder:u,passkeyExecution:e.passkeyExecution});e.authMethod.kind===`email_otp`&&lm({recorder:u,warmup:h.registrationWarmup});let{relayerUrl:g,setup:_}=h,v=Zm(Qm(_,e.kind).ecdsa),y=Km({passkeyExecution:e.passkeyExecution,ceremonyId:_.registrationCeremonyId}),b={intent:_.intent,registrationIntentDigestB64u:_.registrationIntentDigestB64u},x=b.intent.walletId,S=Am(String(x)),C=null,w=``,T=``,E=``,D=null,O=null,k=null,ee;if(e.authMethod.kind===`passkey`){$(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_04_PASSKEY_CREATE_STARTED,status:`waiting_for_user`,interaction:{kind:`passkey_create`,overlay:`show`}});let n={uiMode:`modal`,behavior:`requireClick`,...e.confirmationConfigOverride??i?.confirmationConfig??{}};k=await u.measure(`authProofMs`,()=>dm({context:t,walletId:x,signerSlot:$m(e),registrationIntentDigestB64u:b.registrationIntentDigestB64u,options:i,confirmationConfigOverride:n,passkeyExecution:e.passkeyExecution})),u.capturePasskeyAuthDiagnostics(k.diagnostics),p=performance.now();let r=d(String(k.credential.rawId||k.credential.id||``).trim());if(!r.ok)throw Error(`passkey credential id ${r.error.message}`);ee={kind:`passkey`,webauthnRegistration:k.webauthnRegistration,walletCustodyFactorJson:JSON.stringify({envelopeId:`wallet-custody-envelope:${crypto.randomUUID()}`,factor:Zt({rpId:yp(e.authMethod.rpId),credentialIdB64u:r.value}),walletAuthMethodId:b.intent.foundingWalletAuthMethodId}),walletCustodyFactorSecret:L(k.prfFirstB64u).buffer},$(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_04_PASSKEY_CREATE_SUCCEEDED,status:`succeeded`,interaction:{kind:`passkey_create`,overlay:`hide`}})}else{let n=e.authMethod,r=crypto.getRandomValues(new Uint8Array(32));m=r.slice(),O=r.slice().buffer;let i=await u.measure(`authProofMs`,()=>pf({authMethod:n,relayUrl:g,walletId:String(x),registrationIntentDigestB64u:b.registrationIntentDigestB64u}));C=Em({recorder:u,context:t,authMethod:n,relayerUrl:g,walletId:String(x),providerSubject:i.providerSubject,clientSecret32:r}),w=i.registrationAuthorityId,T=i.email,E=i.providerSubject,D=Im(i.proof),ee={kind:`email_otp`,emailOtpRegistrationProof:i.proof,walletCustodyFactorSecret:O}}let te=c(_.walletAuthMethodId);if(!te.ok)throw Error(`Registration setup auth-method identity is invalid: ${te.error.message}`);let A;if(e.authMethod.kind===`passkey`){if(!k)throw Error(`ECDSA registration is missing its verified passkey authority`);A=await st({authority:{...Gc({walletId:x,rpId:e.authMethod.rpId,credential:k.credential}),bindingId:te.value}})}else{if(!D)throw Error(`Email OTP registration is missing its verified provider`);A=await st({authority:{...Dt({walletId:x,provider:D,providerUserId:E,emailHashHex:await Fm(T)}),bindingId:te.value}})}$(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_05_ED25519_SIGNER_PREPARE_STARTED,status:`running`});let j={value:e.kind===`near_ed25519_and_evm_family_ecdsa`?ee.walletCustodyFactorSecret.slice(0):null},M=null,N;try{N=await u.measure(`ecdsaRegistrationTotalMs`,()=>Ym({home:_.home,context:t,relayerUrl:g,registrationCeremonyId:_.registrationCeremonyId,signerPlanKind:e.kind,signedSetup:_.signedSetup,ecdsaPrepare:v,clientCeremony:y,authority:ee,materialAuthority:A,idempotencyKey:o,resolveActivateEmailOtp:async()=>{let t=null,n=null;if(e.authMethod.kind===`email_otp`){let e=await Kc({material:C,operation:`activate`});t=e.emailOtpEnrollment??null,n=JSON.stringify({envelopeId:`wallet-custody-envelope:${crypto.randomUUID()}`,factor:Xt({enrollmentId:e.enrollmentId,enrollmentSealKeyVersion:e.enrollmentSealKeyVersion}),walletAuthMethodId:b.intent.foundingWalletAuthMethodId})}return{enrollment:t,walletCustodyFactorJson:n}},traceContext:f,registrationTiming:u,confirmRecoveryCodesBackedUp:Ip.bind(void 0,t,String(x),i.recoveryCodeBackup),persistPendingCommit:async t=>{let n={operation:`registration_activate`,registrationCeremonyId:_.registrationCeremonyId,idempotencyKey:o,walletId:String(x),walletAuthMethodId:String(b.intent.foundingWalletAuthMethodId),signedSetup:String(_.signedSetup),auth:eh({authMethod:e.authMethod,passkeyAuthority:k,email:T,registrationAuthorityId:w,providerSubject:E,emailOtpEnrollment:t.emailOtpEnrollment})};if(t.signerPlanKind===`near_ed25519_and_evm_family_ecdsa`){let e=Date.now(),r=rh(Dp({...n,signerPlanKind:t.signerPlanKind,localMaterial:t.localMaterial,createdAtMs:e,updatedAtMs:e})),i=vn(r,t.deferredNear.admissionRequest);await V.putPendingWalletRegistrationCommits([r,i]),M=r;return}M=await nh({...n,signerPlanKind:t.signerPlanKind,localMaterial:t.localMaterial})},startDeferredNearCustody:uh.bind(void 0,{home:_.home,context:t,factorSecretOwner:j,registrationCeremonyId:_.registrationCeremonyId,relayerUrl:g,signedSetup:String(_.signedSetup),traceContext:f})}))}finally{Rp(ee.walletCustodyFactorSecret),j.value&&=(Rp(j.value),null)}let ne=N.session;if(N.activated.kind!==`evm_family_ecdsa`)throw Error(`Wallet registration activate returned a different signer branch`);let P=wp(N.activated),re=N.activateEmailOtp.enrollment;if(P.kind!==`evm_family_ecdsa`)throw Error(`Wallet registration finalize returned a different signer branch`);if(e.authMethod.kind===`email_otp`&&!tr(P))throw Error(`Email OTP registration finalize returned a different auth method`);u.captureRouteDiagnostics(P.registrationDiagnostics);let F=P.ecdsa.walletKeys;if(F.length===0)throw Error(`Wallet registration finalize did not return ECDSA wallet keys`);let I=await Sp({authMethod:e.authMethod,configs:t.configs,walletId:Fe(P.walletId),finalized:P,passkeyAuthority:k,email:T,providerSubject:E,registrationAuthorityId:w}),R=Tp({walletId:Fe(P.walletId),auth:I,foundingAuthority:P.foundingAuthority,foundingAuthMethod:P.foundingAuthMethod,ecdsa:Cp({session:ne,walletKeys:F,expectedChainTargets:ne.chainTargets})});$(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_05_ED25519_SIGNER_PREPARE_SUCCEEDED,status:`succeeded`}),$(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_08_STORAGE_PERSIST_STARTED,status:`running`});let ie=Fe(P.walletId),ae={status:`pending`};e.kind===`near_ed25519_and_evm_family_ecdsa`?(await ah({context:t,relayerUrl:g,registrationTiming:u,pending:rh(M),plan:R,activated:N.activated}),ae=await Mh({context:t,walletId:ie})):await Pp({context:t,relayerUrl:g,registrationTiming:u,plan:R});let oe=dr.fromRegistration(g,R.ecdsa.session.registrationEstablishedSession);for(let e of ne.chainTargets)pd({signingEngine:t.signingEngine,walletId:ie,chainTarget:e,trigger:`registration`,statusReads:oe});let se=R.ecdsa.walletKeys[0];if(e.authMethod.kind===`passkey`){if(!k)throw Error(`Passkey registration authority was not collected`);let n=R.ecdsa.session.registrationEstablishedSession;try{await Up({signingEngine:t.signingEngine,commit:N.walletCustody.commitPayload,passkeyPrfFirstB64u:k.prfFirstB64u,walletId:String(x),walletAuthMethodId:String(R.foundingAuthMethod.walletAuthMethodId),walletSessionId:String(n.walletSessionId),expiresAtMs:n.expiresAtMs})}catch(n){if(e.kind!==`near_ed25519_and_evm_family_ecdsa`)throw n;ae=await jh({context:t,walletId:ie,error:n})}}else{if(I.kind!==`email_otp`||!m)throw Error(`Email OTP registration has no custody capability material`);let e=R.ecdsa.session.registrationEstablishedSession;await Wp({context:t,commit:N.walletCustody.commitPayload,factorSecret32:m,emailOtpAuthContext:I.emailOtpAuthContext,walletId:String(x),walletSessionId:String(e.walletSessionId),expiresAtMs:e.expiresAtMs})}if(e.kind===`near_ed25519_and_evm_family_ecdsa`){let e=sh({auth:R.auth,emailOtpEnrollment:re,passkeyAuthority:k});try{kh({context:t,walletId:ie,commit:{context:t,registrationTiming:u,registrationStartedAt:l,relayerUrl:g,registrationCeremonyId:_.registrationCeremonyId,signedSetup:_.signedSetup,headers:Dc(f),nearCustodyWork:_h.bind(void 0,N.deferredNearCustodyWork),sessionAuthority:{record:R.ecdsa.session.registrationEstablishedSession.walletSession,operationCredential:R.ecdsa.session.registrationEstablishedSession.operationCredential},expectedChainTargets:R.ecdsa.expectedChainTargets,walletId:ie,authMaterial:e}})}catch(e){let t=Ah(e);ae={status:`retryable`,error:xe(e,`registration`,String(ie)),errorCode:t},bd(ie,{status:`near_failed_retryable`,updatedAtMs:Date.now(),error:ae.error,errorCode:t})}}e.kind===`evm_family_ecdsa`&&await V.deletePendingWalletRegistrationCommit({registrationCeremonyId:_.registrationCeremonyId,operation:`registration_activate`});let ce=e.kind===`near_ed25519_and_evm_family_ecdsa`?{success:!0,kind:`ecdsa_wallet_registered_near_pending`,walletId:P.walletId,capabilities:[{kind:`evm_family_ecdsa`,thresholdEcdsaEthereumAddress:se.thresholdOwnerAddress,thresholdEcdsaPublicKeyB64u:se.thresholdEcdsaPublicKeyB64u}],nearProvisioning:ae}:{success:!0,kind:`wallet_registered`,walletId:P.walletId,capabilities:[{kind:`evm_family_ecdsa`,thresholdEcdsaEthereumAddress:se.thresholdOwnerAddress,thresholdEcdsaPublicKeyB64u:se.thresholdEcdsaPublicKeyB64u}]};if($(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_08_STORAGE_PERSIST_SUCCEEDED,status:`succeeded`}),$(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_11_COMPLETED,status:`succeeded`}),p!==null){let e=performance.now();$a({callback:i.onTimingSpan,span:`registration.post_touch_id`,outcome:`success`,durationMs:e-p,traceContext:f}),$a({callback:i.onTimingSpan,span:`frontend.wallet_ready`,outcome:`success`,durationMs:0,traceContext:f})}return Qa(Xa({recorder:u,authMethod:e.authMethod.kind,signerSet:Aa(e.signerPlan)})),Rh(e.context,ce,e.authMethod.kind),s?.(!0,ce),ce}catch(t){let n=jm(t),r=xe(t,`registration`,h);p!==null&&$a({callback:i.onTimingSpan,span:`registration.post_touch_id`,outcome:`failure`,durationMs:performance.now()-p,traceContext:f});let c=Mm(r,n);o?.(c),$(a,h,{authMethod:e.authMethod.kind,phase:B.FAILED,status:`failed`,message:r,interaction:{kind:`passkey_create`,overlay:`hide`},error:{...n?{code:n}:{},message:r}});let l={success:!1,error:r,...n?{errorCode:n}:{}};return Qa(Za({recorder:u,authMethod:e.authMethod.kind,signerSet:Aa(e.signerPlan),errorCode:n||null})),s?.(!1),l}finally{m?.fill(0)}}async function Ph(e){let{context:t,options:n}=e,r=Am(e.wallet.kind===`provided`?String(e.wallet.walletId):`wallet-registration`),i=new Ja(performance.now()),a=null;$(n.onEvent,r,{authMethod:`email_otp`,phase:B.STEP_01_STARTED,status:`started`});try{let r=await Wm({context:t,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,recorder:i});lm({recorder:i,warmup:r.registrationWarmup});let{relayerUrl:o,setup:s}=r,c=s.intent.walletId,l=Am(String(c)),u=await i.measure(`authProofMs`,pf.bind(void 0,{authMethod:e.authMethod,relayUrl:o,walletId:String(c),registrationIntentDigestB64u:s.registrationIntentDigestB64u})),d=crypto.getRandomValues(new Uint8Array(32));a=d.slice();let f=d.slice().buffer,p=Em({recorder:i,context:t,authMethod:e.authMethod,relayerUrl:o,walletId:String(c),providerSubject:u.providerSubject,clientSecret32:d});$(n.onEvent,l,{authMethod:`email_otp`,phase:B.STEP_05_ED25519_SIGNER_PREPARE_STARTED,status:`running`});let m=await i.measure(`walletRegisterStartMs`,Hn.bind(void 0,{relayerUrl:o,registrationCeremonyId:s.registrationCeremonyId,signerPlanKind:`near_ed25519`,signedSetup:s.signedSetup,headers:{...Dc(),...ee(s.home)},kind:`email_otp`,emailOtpRegistrationProof:u.proof}));if(m.kind!==`near_ed25519`)throw Error(`Ed25519-only registration respond returned a different signer branch`);let h=await Kc({material:p,operation:`finalize`}),g;try{g=await t.signingEngine.establishWalletCustodyNearEd25519KeySet({home:s.home,walletId:String(c),factor:{factorJson:JSON.stringify({envelopeId:`wallet-custody-envelope:${crypto.randomUUID()}`,factor:Xt({enrollmentId:h.enrollmentId,enrollmentSealKeyVersion:h.enrollmentSealKeyVersion}),walletAuthMethodId:s.intent.foundingWalletAuthMethodId}),factorSecret:f},nearEd25519SigningKeyId:m.ed25519.admissionRequest.application_binding.near_ed25519_signing_key_id,registrationCeremonyId:s.registrationCeremonyId,admissionRequest:m.ed25519.admissionRequest,admissionReceipt:m.ed25519.admissionReceipt,participantIds:m.ed25519.admissionRequest.participant_ids,routerOrigin:new URL(o).origin,authorization:`Bearer ${String(s.signedSetup)}`})}finally{Rp(f)}await Ip(t,String(c),n.recoveryCodeBackup,g.recoveryCodes);let _=nn(g.commitPayload);if(!g.localMaterial)throw Error(`Email OTP registration produced no sealed local custody material`);let v=await wm({registrationCeremonyId:s.registrationCeremonyId,activationReference:g.activationReference}),y=await nh({operation:`near_provisioning`,completion:{kind:`sealed_material`},signerPlanKind:`near_ed25519`,registrationCeremonyId:s.registrationCeremonyId,idempotencyKey:v,walletId:String(c),walletAuthMethodId:String(s.intent.foundingWalletAuthMethodId),signedSetup:String(s.signedSetup),auth:{kind:`email_otp`,email:u.email,registrationAuthorityId:u.registrationAuthorityId,providerSubject:u.providerSubject,enrollment:h.emailOtpEnrollment},localMaterial:{keyFamilies:[`ed25519`],custodyCommit:_,ed25519:{activationReference:g.activationReference,localMaterial:g.localMaterial,metadata:Bp(g)}}}),b=`ed25519:${Te(g.metadata.registeredPublicKey)}`,x=await i.measure(`walletRegisterFinalizeMs`,Zn.bind(void 0,{relayerUrl:o,registrationCeremonyId:s.registrationCeremonyId,signedSetup:s.signedSetup,headers:{...Dc(),...ee(s.home)},idempotencyKey:v,ed25519:{activationReference:g.activationReference},auth:{kind:`email_otp`,enrollment:h.emailOtpEnrollment},walletCustodyCommit:_}));if(!x.ok)throw Error(`Deferred NEAR provisioning did not complete`);if(i.captureRouteDiagnostics(x.registrationDiagnostics),x.kind!==`near_ed25519`)throw Error(`Wallet registration finalize returned a different signer branch`);if(!tr(x))throw Error(`Email OTP registration finalize returned a different auth method`);if(x.walletCustody?.status!==`committed`){let e=x.walletCustody?.status??`not_reported`;throw Error(`Wallet custody did not commit (${e})`)}if(x.ed25519.signerSlot!==e.ed25519Selection.signerSlot)throw Error(`Ed25519 Yao finalize returned a different signer slot`);let S=Ac(x.registrationEstablishedSession);Qc({clientPublicKey:b,finalized:x,expectedRegistrationAuthorityId:u.registrationAuthorityId,expectedWalletId:c});let C=await Sp({authMethod:e.authMethod,configs:t.configs,walletId:Fe(x.walletId),finalized:x,passkeyAuthority:null,email:u.email,providerSubject:u.providerSubject,registrationAuthorityId:u.registrationAuthorityId});if(C.kind!==`email_otp`)throw Error(`Email OTP Ed25519 registration produced a different persistence authority`);$(n.onEvent,l,{authMethod:`email_otp`,phase:B.STEP_05_ED25519_SIGNER_PREPARE_SUCCEEDED,status:`succeeded`}),$(n.onEvent,l,{authMethod:`email_otp`,phase:B.STEP_08_STORAGE_PERSIST_STARTED,status:`running`});let w=qc({admissionRequest:m.ed25519.admissionRequest,finalized:x.ed25519,walletId:c,expectedRuntimePolicyScope:F(s.intent.runtimePolicyScope)}),T=g.metadata,E=z(x.ed25519.nearAccountId),D=zp({established:g,walletId:String(x.walletId),nearAccountId:String(E),nearEd25519SigningKeyId:x.ed25519.nearEd25519SigningKeyId,signerSlot:x.ed25519.signerSlot}),O=await et({walletId:x.walletId,nearAccountId:E,nearEd25519SigningKeyId:x.ed25519.nearEd25519SigningKeyId,email:C.email,registrationAuthorityId:C.registrationAuthorityId,authority:C.authority,signerSlot:x.ed25519.signerSlot,operationalPublicKey:b,relayerKeyId:x.ed25519.relayerKeyId,keyVersion:x.ed25519.keyVersion,participantIds:[...x.ed25519.participantIds],custodyMaterial:D}),k=await V.publishPendingWalletRegistrationCommit({pending:y,ecdsaContinuity:[],authority:x.authority,foundingAuthority:{authority:x.foundingAuthority,authMethod:x.foundingAuthMethod},request:{operation:`near_provisioning`,registrationCeremonyId:s.registrationCeremonyId,idempotencyKey:v,walletId:x.walletId,walletAuthMethodId:x.foundingAuthMethod.walletAuthMethodId},walletSessionPublication:{kind:`issued`,walletSession:S.walletSession,operationCredential:S.operationCredential},registration:O});dr.acceptRegistrationSession(o,S);let te=k.signerActivations[1];if(!te||te.signerSlot!==x.ed25519.signerSlot)throw Error(`Ed25519 Yao registration persisted a different signer slot`);if(await t.signingEngine.activateAuthenticatedWalletState({walletId:x.walletId,nearAccountId:E,signerSlot:x.ed25519.signerSlot,nearClient:t.nearClient}),await t.signingEngine.upsertEd25519YaoPublicCapabilityLaneReference({walletId:x.walletId,nearAccountId:E,thresholdSessionId:w.identity.thresholdSessionId,runtimePolicyScope:w.stableServerScope.runtimePolicyScope,materialActivation:er(T),auth:{kind:`email_otp`,providerSubjectId:u.providerSubject},nearEd25519SigningKeyId:qt(x.ed25519.nearEd25519SigningKeyId),signerSlot:x.ed25519.signerSlot,remainingUses:S.remainingUses,expiresAtMs:S.expiresAtMs}),!a)throw Error(`Email OTP registration has no custody capability material`);await Wp({context:t,commit:_,factorSecret32:a,emailOtpAuthContext:C.emailOtpAuthContext,walletId:String(x.walletId),walletSessionId:String(S.walletSessionId),expiresAtMs:S.expiresAtMs}),$(n.onEvent,l,{authMethod:`email_otp`,phase:B.STEP_08_STORAGE_PERSIST_SUCCEEDED,status:`succeeded`}),$(n.onEvent,l,{authMethod:`email_otp`,phase:B.STEP_11_COMPLETED,status:`succeeded`});let A={success:!0,kind:`wallet_registered`,walletId:x.walletId,capabilities:[{kind:`near_ed25519`,accountProvisioning:x.accountProvisioning,resolvedAccount:x.resolvedAccount,nearEd25519SigningKeyId:qt(x.ed25519.nearEd25519SigningKeyId),operationalPublicKey:b,nearAccountId:z(x.ed25519.nearAccountId),transactionId:x.resolvedAccount.kind===`sponsored_named_account`?x.resolvedAccount.transactionHash:null}]};return Qa(Xa({recorder:i,authMethod:`email_otp`,signerSet:Aa(e.signerPlan)})),Rh(t,A,`email_otp`),n.afterCall?.(!0,A),A}catch(t){let a=jm(t),o=xe(t,`registration`,r);n.onError?.(Mm(o,a)),$(n.onEvent,r,{authMethod:`email_otp`,phase:B.FAILED,status:`failed`,message:o,error:{...a?{code:a}:{},message:o}});let s={success:!1,error:o,...a?{errorCode:a}:{}};return Qa(Za({recorder:i,authMethod:`email_otp`,signerSet:Aa(e.signerPlan),errorCode:a||null})),n.afterCall?.(!1),s}finally{a?.fill(0)}}function Fh(){}async function Ih(e){let{context:t,options:n}=e,r=Am(e.wallet.kind===`provided`?String(e.wallet.walletId):`wallet-registration`),i=gn(),a=null,o={kind:`none`};$(n.onEvent,r,{authMethod:`passkey`,phase:B.STEP_01_STARTED,status:`started`});try{let r=new Ja(performance.now()),{relayerUrl:s,setup:c}=await Gm({context:t,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,recorder:r,passkeyExecution:e.passkeyExecution});r.markNearStage(c.registrationCeremonyId,`near_only.setup`);let l=Xc(c.intent),u=Am(String(l.walletId));$(n.onEvent,u,{authMethod:`passkey`,phase:B.STEP_04_PASSKEY_CREATE_STARTED,status:`waiting_for_user`,interaction:{kind:`passkey_create`,overlay:`show`}});let f=c.kind===`near_ed25519`&&c.ed25519.status===`described`?c.ed25519:null,p=dm({context:t,walletId:l.walletId,signerSlot:e.ed25519Selection.signerSlot,registrationIntentDigestB64u:c.registrationIntentDigestB64u,options:n,confirmationConfigOverride:{uiMode:`modal`,behavior:`requireClick`,...e.confirmationConfigOverride??n.confirmationConfig??{}},passkeyExecution:e.passkeyExecution}).then(e=>(a=performance.now(),r.capturePasskeyAuthDiagnostics(e.diagnostics),r.markNearStage(c.registrationCeremonyId,`near_only.authentication`),$(n.onEvent,u,{authMethod:`passkey`,phase:B.STEP_04_PASSKEY_CREATE_SUCCEEDED,status:`succeeded`,interaction:{kind:`passkey_create`,overlay:`hide`}}),e)),m=Pm(n.onEvent,u,B.STEP_05_ED25519_SIGNER_PROVISION_DELAYED),h=async(e,t)=>{let n=await m(Hn({relayerUrl:s,registrationCeremonyId:c.registrationCeremonyId,signerPlanKind:`near_ed25519`,signedSetup:c.signedSetup,headers:{...Dc(i),...ee(c.home)},kind:`passkey`,webauthnRegistration:e.webauthnRegistration,...t?{ed25519Execution:t}:{},onServerTiming:va.bind(void 0,r)}));if(r.markNearStage(c.registrationCeremonyId,`near_only.respond`),n.kind!==`near_ed25519`)throw Error(`Ed25519-only registration respond returned a different signer branch`);return n.ed25519},g=e=>{let t=d(String(e.credential.rawId||e.credential.id||``).trim());if(!t.ok)throw Error(`passkey credential id ${t.error.message}`);return t.value},_=null,v=t=>(_=L(t.prfFirstB64u).buffer,{factorJson:JSON.stringify({envelopeId:`wallet-custody-envelope:${crypto.randomUUID()}`,factor:Zt({rpId:yp(e.authMethod.rpId),credentialIdB64u:g(t)}),walletAuthMethodId:c.intent.foundingWalletAuthMethodId}),factorSecret:_}),y=(e,n)=>Th({signingEngine:t.signingEngine,ceremonyId:c.registrationCeremonyId,thresholdSessionId:n,prfFirstB64u:e.prfFirstB64u}),b=e=>({home:c.home,walletId:String(l.walletId),nearEd25519SigningKeyId:e.admissionRequest.application_binding.near_ed25519_signing_key_id,registrationCeremonyId:c.registrationCeremonyId,admissionRequest:e.admissionRequest,admissionReceipt:e.admissionReceipt,participantIds:e.admissionRequest.participant_ids,routerOrigin:new URL(s).origin,authorization:`Bearer ${String(c.signedSetup)}`,traceContext:i}),x,S,C;try{if(f){S=f;let e=t.signingEngine.establishWalletCustodyNearEd25519KeySet({...b(f),factor:{factorAfterRouterRound:async()=>v(await p)},executeWithProof:async e=>{let t=await h(await p,JSON.parse(e));if(!Mt(t.admissionReceipt.binding,f.admissionReceipt.binding))throw Error(`Registration respond issued another admission than setup described`);return t.status===`executed`?JSON.stringify(t.activationResult):null}});e.catch(Fh),x=await p,o=y(x,f.admissionRequest.scope.threshold_session_id),C=await m(e)}else x=await p,S=await h(x),o=y(x,S.admissionRequest.scope.threshold_session_id),C=await m(t.signingEngine.establishWalletCustodyNearEd25519KeySet({...b(S),factor:v(x)}))}finally{_&&Rp(_)}let w={value:g(x)};r.markNearStage(c.registrationCeremonyId,`near_only.custody`),await Ip(t,String(l.walletId),n.recoveryCodeBackup,C.recoveryCodes);let T=nn(C.commitPayload);if(!C.localMaterial)throw Error(`Passkey registration produced no sealed local custody material`);let E=await wm({registrationCeremonyId:c.registrationCeremonyId,activationReference:C.activationReference}),D=await nh({operation:`near_provisioning`,completion:{kind:`sealed_material`},signerPlanKind:`near_ed25519`,registrationCeremonyId:c.registrationCeremonyId,idempotencyKey:E,walletId:String(l.walletId),walletAuthMethodId:String(c.intent.foundingWalletAuthMethodId),signedSetup:String(c.signedSetup),auth:{kind:`passkey`,rpId:e.authMethod.rpId,credentialIdB64u:w.value,transports:[...x.webauthnRegistration.response.transports]},localMaterial:{keyFamilies:[`ed25519`],custodyCommit:T,ed25519:{activationReference:C.activationReference,localMaterial:C.localMaterial,metadata:Bp(C)}}}),O=`ed25519:${Te(C.metadata.registeredPublicKey)}`;if(r.markNearStage(c.registrationCeremonyId,`near_only.provision_checkpoint`),o.kind!==`preparing`)throw Error(`NEAR registration session seal preparation is missing`);let k=await o.result;if(k.kind===`failed`)throw k.error;let te=await t.signingEngine.readPreparedSigningSessionHydration({thresholdSessionId:o.thresholdSessionId,preparationId:o.preparationId}),A=await Pm(n.onEvent,u,B.STEP_06_RELAY_BOOTSTRAP_DELAYED)(Zn({relayerUrl:s,registrationCeremonyId:c.registrationCeremonyId,signedSetup:c.signedSetup,headers:{...Dc(i),...ee(c.home)},idempotencyKey:E,ed25519:{activationReference:C.activationReference},auth:{kind:`passkey`},sessionSeal:{thresholdSessionId:o.thresholdSessionId,ciphertext:te.ciphertext},walletCustodyCommit:T}));if(r.markNearStage(c.registrationCeremonyId,`near_only.finalize`),!A.ok||A.kind!==`near_ed25519`)throw Error(`Deferred NEAR provisioning returned a different signer branch`);if(!A.sessionSeal)throw Error(`NEAR finalization did not return the prepared session seal`);if(C.commitPayload&&A.walletCustody?.status!==`committed`){let e=A.walletCustody?.status??`not_reported`,t=A.walletCustody?.status===`rejected`?`: ${A.walletCustody.reason}`:``;throw Error(`Wallet custody did not commit (${e})${t}. The recovery codes shown are not usable.`)}let j=Ac(A.registrationEstablishedSession),M=Zc({clientPublicKey:O,finalized:A,expectedRpId:e.authMethod.rpId,expectedWalletId:l.walletId}),N=z(A.ed25519.nearAccountId),ne=bp({finalized:A,credential:x.credential}),P=qc({admissionRequest:S.admissionRequest,finalized:A.ed25519,walletId:l.walletId,expectedRuntimePolicyScope:F(l.runtimePolicyScope)}),re=C.metadata,I=zp({established:C,walletId:String(A.walletId),nearAccountId:String(N),nearEd25519SigningKeyId:A.ed25519.nearEd25519SigningKeyId,signerSlot:A.ed25519.signerSlot});await Gp({commit:C.commitPayload,walletId:String(A.walletId),activatedAtMs:Date.now()}),await t.signingEngine.upsertEd25519YaoPublicCapabilityLaneReference({walletId:A.walletId,nearAccountId:z(A.ed25519.nearAccountId),thresholdSessionId:P.identity.thresholdSessionId,runtimePolicyScope:P.stableServerScope.runtimePolicyScope,materialActivation:er(re),auth:{kind:`passkey`,rpId:ft(M.rpId),credentialIdB64u:M.credentialIdB64u},nearEd25519SigningKeyId:qt(A.ed25519.nearEd25519SigningKeyId),signerSlot:A.ed25519.signerSlot});let R=$e({walletId:A.walletId,nearAccountId:N,nearEd25519SigningKeyId:A.ed25519.nearEd25519SigningKeyId,rpId:yp(M.rpId),credential:x.credential,credentialPublicKeyB64u:ne,signerSlot:A.ed25519.signerSlot,operationalPublicKey:O,relayerKeyId:A.ed25519.relayerKeyId,keyVersion:A.ed25519.keyVersion,participantIds:[...A.ed25519.participantIds],custodyMaterial:I}),ie=await V.publishPendingWalletRegistrationCommit({pending:D,ecdsaContinuity:[],authority:A.authority,foundingAuthority:{authority:A.foundingAuthority,authMethod:A.foundingAuthMethod},request:{operation:`near_provisioning`,registrationCeremonyId:c.registrationCeremonyId,idempotencyKey:E,walletId:A.walletId,walletAuthMethodId:A.foundingAuthMethod.walletAuthMethodId},walletSessionPublication:{kind:`issued`,walletSession:j.walletSession,operationCredential:j.operationCredential},registration:R});dr.acceptRegistrationSession(s,j);let ae=ie.signerActivations[1];if(!ae||ae.signerSlot!==A.ed25519.signerSlot)throw Error(`Ed25519 Yao registration persisted a different signer slot`);r.markNearStage(c.registrationCeremonyId,`near_only.publication`);let oe=await Ch({signingEngine:t.signingEngine,ceremonyId:c.registrationCeremonyId,input:el({session:j,ceremonyId:c.registrationCeremonyId,walletId:String(A.walletId),relayerUrl:s,prfFirstB64u:x.prfFirstB64u,preparedServerSeal:{preparationId:o.preparationId,...A.sessionSeal},restore:{rpId:M.rpId,nearAccountId:String(N),nearEd25519SigningKeyId:A.ed25519.nearEd25519SigningKeyId,relayerKeyId:A.ed25519.relayerKeyId,participantIds:A.ed25519.participantIds,signerSlot:A.ed25519.signerSlot,credentialIdB64u:M.credentialIdB64u,materialActivation:er(re)}})});if(oe.kind===`failed`)throw oe.error;if(o={kind:`consumed`},r.markNearStage(c.registrationCeremonyId,`near_only.session_hydration`),await xh({signingEngine:t.signingEngine,sessionAuthority:{record:j.walletSession,operationCredential:j.operationCredential},metadata:re,material:I,materialFacts:P,envelope:Vp(C.commitPayload),ownedFactorSecret:L(x.prfFirstB64u),rpId:M.rpId,credentialIdB64u:M.credentialIdB64u,passkeyPrfFirstB64u:x.prfFirstB64u,relayerUrl:s}),r.markNearStage(c.registrationCeremonyId,`near_only.material_activation`),await Up({signingEngine:t.signingEngine,commit:C.commitPayload,passkeyPrfFirstB64u:x.prfFirstB64u,walletId:String(A.walletId),walletAuthMethodId:String(A.foundingAuthMethod.walletAuthMethodId),walletSessionId:String(j.walletSessionId),expiresAtMs:j.expiresAtMs}),r.markNearStage(c.registrationCeremonyId,`near_only.export_capability`),await t.signingEngine.activateAuthenticatedWalletState({walletId:A.walletId,nearAccountId:N,signerSlot:A.ed25519.signerSlot,nearClient:t.nearClient}),$(n.onEvent,u,{authMethod:`passkey`,phase:B.STEP_11_COMPLETED,status:`succeeded`}),a!==null){let e=performance.now();$a({callback:n.onTimingSpan,span:`registration.post_touch_id`,outcome:`success`,durationMs:e-a,traceContext:i}),$a({callback:n.onTimingSpan,span:`frontend.wallet_ready`,outcome:`success`,durationMs:0,traceContext:i})}r.markNearStage(c.registrationCeremonyId,`near_only.wallet_ready`),Qa(Xa({recorder:r,authMethod:`passkey`,signerSet:Aa(e.signerPlan)}));let se={success:!0,kind:`wallet_registered`,walletId:A.walletId,capabilities:[{kind:`near_ed25519`,accountProvisioning:A.accountProvisioning,resolvedAccount:A.resolvedAccount,nearEd25519SigningKeyId:qt(A.ed25519.nearEd25519SigningKeyId),operationalPublicKey:O,nearAccountId:z(A.ed25519.nearAccountId),transactionId:A.resolvedAccount.kind===`sponsored_named_account`?A.resolvedAccount.transactionHash:null}]};return Rh(t,se,`passkey`),n.afterCall?.(!0,se),se}catch(e){let t=jm(e),o=xe(e,`registration`,r);a!==null&&$a({callback:n.onTimingSpan,span:`registration.post_touch_id`,outcome:`failure`,durationMs:performance.now()-a,traceContext:i}),n.onError?.(Mm(o,t)),$(n.onEvent,r,{authMethod:`passkey`,phase:B.FAILED,status:`failed`,message:o,interaction:{kind:`passkey_create`,overlay:`hide`},error:{...t?{code:t}:{},message:o}});let s={success:!1,error:o,...t?{errorCode:t}:{}};return n.afterCall?.(!1),s}finally{o.kind===`preparing`&&(await o.result,await t.signingEngine.discardSigningSessionHydration({thresholdSessionId:o.thresholdSessionId,preparationId:o.preparationId}).catch(lh))}}async function Lh(e){let t=Yp(e.signerSelection),n=Me(t);if(n){let r=je(t);if(r)return await Nh({kind:`near_ed25519_and_evm_family_ecdsa`,context:e.context,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,signerPlan:t,ed25519Selection:n,ecdsaSelection:r,options:e.options,passkeyExecution:e.passkeyExecution,...e.confirmationConfigOverride?{confirmationConfigOverride:e.confirmationConfigOverride}:{}});if(e.authMethod.kind===`email_otp`){if(e.passkeyExecution.kind!==`collect_during_registration`)throw Error(`Prepared registration authority requires passkey authentication`);return await Ph({context:e.context,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,signerPlan:t,ed25519Selection:n,options:e.options,passkeyExecution:e.passkeyExecution})}return await Ih({context:e.context,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,signerPlan:t,ed25519Selection:n,options:e.options,passkeyExecution:e.passkeyExecution,...e.confirmationConfigOverride?{confirmationConfigOverride:e.confirmationConfigOverride}:{}})}let r=je(t);if(!r)throw Error(`Wallet registration requires an ECDSA signer branch`);return await Nh({kind:`evm_family_ecdsa`,context:e.context,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,signerPlan:t,ecdsaSelection:r,options:e.options,passkeyExecution:e.passkeyExecution,...e.confirmationConfigOverride?{confirmationConfigOverride:e.confirmationConfigOverride}:{}})}function Rh(e,t,n){e.signingEngine.setWalletAuthenticated({kind:`authenticated`,walletId:t.walletId,authMethod:n})}async function zh(e){try{return await Lh({context:e.context,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,options:e.options,authenticatorOptions:e.authenticatorOptions,...e.confirmationConfigOverride?{confirmationConfigOverride:e.confirmationConfigOverride}:{},passkeyExecution:{kind:`collect_during_registration`}})}finally{e.context.signingEngine.closeRegistrationPreparationModal()}}function Bh(e,t,n){try{$(e,t,n)}catch{}}function Vh(e,t){try{e?.(t)}catch{}}function Hh(e,t,n){try{t&&n?e?.(!0,n):e?.(!1)}catch{}}function Uh(e){let t=[];for(let n of e){let e=String(n.credentialId||``).trim();e&&t.push({id:e,type:`public-key`,transports:Nm(n.transports)})}if(t.length===0)throw Error(`Wallet add-signer requires an existing passkey credential`);return t}function Wh(e,t){let n=String(e.id||``).trim(),r=String(e.rawId||``).trim();if(!n||!r||n!==r)throw Error(`Wallet add-signer selected an invalid passkey credential identity`);for(let e of t)if(e.id===r)return r;throw Error(`Wallet add-signer selected a passkey outside the authorized wallet`)}async function Gh(e){if(e.started.intent.walletId!==e.walletId)throw Error(`Wallet add-signer start returned a different wallet`);if(await hr(e.started.intent)!==e.expectedDigestB64u)throw Error(`Wallet add-signer start returned a different intent`);if(!String(e.started.addSignerCeremonyId||``).trim())throw Error(`Wallet add-signer start returned an invalid ceremony ID`)}function Kh(e,t){return e.length===2&&t.length===2&&e[0]===t[0]&&e[1]===t[1]}function qh(e){let t=e.started.intent.signerSelection;if(t.mode!==`ed25519`)throw Error(`Wallet add-signer start intent changed signer branch`);let n=t.ed25519,r=e.started.ed25519.admissionRequest,i=e.finalized,a=i.ed25519,o=Ee(e.clientPublicKey);if(i.walletId!==e.walletId||i.rpId!==e.rpId||i.credentialIdB64u!==e.credentialIdB64u||a.publicKey!==e.clientPublicKey||a.nearAccountId!==o||a.signerSlot!==n.signerSlot||a.keyVersion!==n.keyVersion||a.recoveryExportCapable!==!0||!Kh(a.participantIds,n.participantIds)||a.nearEd25519SigningKeyId!==r.application_binding.near_ed25519_signing_key_id||a.relayerKeyId!==r.scope.signing_worker_id||r.application_binding.wallet_id!==e.walletId||r.application_binding.key_creation_signer_slot!==n.signerSlot)throw Error(`Wallet add-signer finalize returned mismatched Ed25519 Yao identity`);return i}function Jh(e){let t=e.intent.signerSelection;if(t.mode!==`ed25519`)throw Error(`Wallet add-signer start intent changed signer branch`);return{version:e.intent.version,walletId:e.intent.walletId,signerSelection:t,...e.intent.runtimePolicyScope?{runtimePolicyScope:e.intent.runtimePolicyScope}:{},nonceB64u:e.intent.nonceB64u}}async function Yh(e){if(e.started.intent.signerSelection.mode!==`ed25519`)throw Error(`Wallet add-signer start returned a different signer branch`);let t=null,n=null,r=null;try{if(e.started.authorizationKind!==`webauthn_assertion`)throw Error(`Wallet custody Ed25519 add-signer requires WebAuthn authorization`);let i=await vf({kind:`verified_passkey_ed25519_yao_add_signer_input_v1`,verifiedIntent:{kind:`verified_passkey_ed25519_add_signer_intent_v1`,intent:Jh(e.started),addSignerIntentDigestB64u:e.intentResponse.addSignerIntentDigestB64u,addSignerIntentGrant:e.intentResponse.addSignerIntentGrant,addSignerCeremonyId:e.started.addSignerCeremonyId},verifiedAuthority:{kind:`verified_passkey_ed25519_add_signer_authority_v1`,walletId:e.walletId,addSignerIntentDigestB64u:e.intentResponse.addSignerIntentDigestB64u,credentialIdB64u:e.credentialIdB64u},admissionRequest:e.started.ed25519.admissionRequest,httpTransport:{kind:`passkey_ed25519_yao_http_transport_v1`,routerOrigin:new URL(e.relayerUrl).origin,fetch:globalThis.fetch}}),a=Ec(e.started.ed25519.custodyEnvelope);if(!a.ok)throw Error(a.reason);r=Uint8Array.from(L(e.passkeyPrfFirstB64u)).buffer;let o=await e.context.signingEngine.joinWalletCustodyNearEd25519KeySet({routing:{kind:`discovery`},preparation:{kind:`fresh`},custodyJson:a.custodyJson,factorSecret:r,nearEd25519SigningKeyId:i.request.application_binding.near_ed25519_signing_key_id,registrationCeremonyId:e.started.addSignerCeremonyId,admissionRequest:i.request,admissionReceipt:i.receipt,participantIds:i.request.participant_ids,routerOrigin:new URL(e.relayerUrl).origin,authorization:`Bearer ${String(e.intentResponse.addSignerIntentGrant)}`}),c=`ed25519:${Te(o.metadata.registeredPublicKey)}`,l=await nr({relayerUrl:e.relayerUrl,walletId:e.walletId,addSignerCeremonyId:e.started.addSignerCeremonyId,idempotencyKey:Tm(`wallet-ed25519-add-signer-finalize`),kind:`near_ed25519`,ed25519:{activationReference:o.activationReference},custodyKeySet:{kind:`near_ed25519_v1`,keyManifestDigestB64u:o.commitPayload.keyManifestDigestB64u,registeredPublicKeyB64u:I(o.metadata.registeredPublicKey)}});if(l.kind!==`near_ed25519`)throw Error(`Wallet add-signer finalize returned a different signer branch`);let u=qh({finalized:l,started:e.started,walletId:e.walletId,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,clientPublicKey:c});Bh(e.onEvent,e.eventAccountId,{authMethod:`passkey`,phase:B.STEP_08_STORAGE_PERSIST_STARTED,status:`running`});let d=await e.context.signingEngine.finalizeWalletEd25519SignerRegistration({walletId:e.walletId,nearAccountId:z(u.ed25519.nearAccountId),nearEd25519SigningKeyId:u.ed25519.nearEd25519SigningKeyId,auth:{kind:`passkey`,credential:e.credential},signerSlot:u.ed25519.signerSlot,operationalPublicKey:c,relayerKeyId:u.ed25519.relayerKeyId,keyVersion:u.ed25519.keyVersion,participantIds:[...u.ed25519.participantIds]});if(d.signerSlot!==u.ed25519.signerSlot)throw Error(`Wallet add-signer persisted a different Ed25519 signer slot`);t=d.rollbackReceipt;let f=e.started.ed25519.admissionRequest,p=s(f.scope.threshold_session_id);if(!p.ok)throw Error(`Wallet add-signer threshold-session identity is invalid`);let m=o.metadata;return await e.context.signingEngine.persistWalletCustodyEd25519Material({binding:{kind:Ze,applicationBindingDigestB64u:o.localMaterial.applicationBindingDigestB64u,registeredPublicKeyB64u:I(m.registeredPublicKey),participantIds:m.participantIds,stateEpoch:String(m.stateEpoch),walletId:String(u.walletId),nearAccountId:String(u.ed25519.nearAccountId),nearEd25519SigningKeyId:u.ed25519.nearEd25519SigningKeyId,signerSlot:u.ed25519.signerSlot,signingWorkerId:m.scope.signing_worker_id,signingWorkerVerifyingShareB64u:I(m.signingWorkerVerifyingShare)},sealed:{ciphertextB64u:o.localMaterial.b64u,nonceB64u:o.localMaterial.nonceB64u}}),n={nearAccountId:u.ed25519.nearAccountId,signerSlot:u.ed25519.signerSlot},await e.context.signingEngine.upsertEd25519YaoPublicCapabilityLaneReference({walletId:u.walletId,nearAccountId:z(u.ed25519.nearAccountId),thresholdSessionId:p.value,runtimePolicyScope:F(e.started.intent.runtimePolicyScope),materialActivation:er(m),auth:{kind:`passkey`,rpId:ft(e.rpId),credentialIdB64u:e.credentialIdB64u},nearEd25519SigningKeyId:qt(u.ed25519.nearEd25519SigningKeyId),signerSlot:u.ed25519.signerSlot}),t=null,Bh(e.onEvent,e.eventAccountId,{authMethod:`passkey`,phase:B.STEP_08_STORAGE_PERSIST_SUCCEEDED,status:`succeeded`}),{success:!0,kind:`wallet_signer_added`,walletId:u.walletId,capabilities:[{kind:`near_ed25519`,nearEd25519SigningKeyId:qt(u.ed25519.nearEd25519SigningKeyId),operationalPublicKey:c,nearAccountId:z(u.ed25519.nearAccountId)}]}}catch(r){let i=[];if(n)try{await e.context.signingEngine.deleteWalletCustodyEd25519Material({nearAccountId:n.nearAccountId,signerSlot:n.signerSlot})}catch(e){i.push(e instanceof Error?e.message:String(e))}if(t)try{await e.context.signingEngine.rollbackWalletEd25519SignerRegistration(t)}catch(e){i.push(e instanceof Error?e.message:String(e))}if(i.length>0){let e=r instanceof Error?r.message:String(r);throw Error(`${e}; add-signer cleanup failed: ${i.join(`; `)}`)}throw r}finally{r&&Rp(r)}}async function Xh(e){if(e.started.authorizationKind!==`webauthn_assertion`)throw Error(`Wallet custody ECDSA add-signer requires WebAuthn authorization`);let t=await Td({walletId:e.walletId,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u}),n=Uint8Array.from(L(e.passkeyPrfFirstB64u)).buffer,r;try{r=await Bc({context:e.context,relayerUrl:e.relayerUrl,walletId:e.walletId,addSignerCeremonyId:e.started.addSignerCeremonyId,started:e.started.ecdsa,custodyEnvelope:e.started.ecdsa.custodyEnvelope,factorSecret:n,authority:t,registrationTiming:null})}finally{Rp(n)}let i={relayerUrl:e.relayerUrl,walletId:e.walletId,addSignerCeremonyId:e.started.addSignerCeremonyId,idempotencyKey:Tm(`wallet-add-signer-finalize`),kind:`evm_family_ecdsa`,ecdsa:{expectedKeyHandles:[r.bootstrap.keyHandle]},custodyKeySet:r.custodyKeySet},a;try{a=await nr(i)}catch(e){if(!(e instanceof TypeError))throw e;a=await nr(i)}if(a.kind!==`evm_family_ecdsa`||a.walletId!==e.walletId||a.rpId!==e.rpId)throw Error(`Wallet add-signer finalize returned a different ECDSA identity`);let o=a.ecdsa.walletKeys,s=o[0];if(!s)throw Error(`Wallet add-signer finalize did not return ECDSA wallet keys`);let c=await Vc({context:e.context,pending:r});Bh(e.onEvent,e.eventAccountId,{authMethod:`passkey`,phase:B.STEP_08_STORAGE_PERSIST_STARTED,status:`running`});let l=await e.context.signingEngine.finalizeWalletRegistrationEcdsaSessions({walletId:Fe(e.walletId),session:c,walletKeys:[s,...o.slice(1)]});return await e.context.signingEngine.storeWalletEcdsaSignerRecords({walletId:e.walletId,walletKeys:l}),await V.adoptAddedEcdsaSignerAuthority({authority:a.authority,materialActivation:c.materialActivation}),Bh(e.onEvent,e.eventAccountId,{authMethod:`passkey`,phase:B.STEP_08_STORAGE_PERSIST_SUCCEEDED,status:`succeeded`}),{success:!0,kind:`wallet_signer_added`,walletId:e.walletId,capabilities:[{kind:`evm_family_ecdsa`,thresholdEcdsaEthereumAddress:s.thresholdOwnerAddress,thresholdEcdsaPublicKeyB64u:s.thresholdEcdsaPublicKeyB64u}]}}async function Zh(e){switch(e.signerSelection.mode){case`ed25519`:if(e.started.kind!==`near_ed25519`)throw Error(`Wallet add-signer start returned a different signer branch`);return await Yh({context:e.input.context,walletId:e.input.walletId,rpId:e.input.rpId,relayerUrl:e.input.relayerUrl,intentResponse:e.input.intentResponse,credential:e.input.credential,credentialIdB64u:e.input.credentialIdB64u,passkeyPrfFirstB64u:e.input.passkeyPrfFirstB64u,eventAccountId:e.input.eventAccountId,onEvent:e.input.onEvent,started:e.started});case`ecdsa`:if(e.started.kind!==`evm_family_ecdsa`)throw Error(`Wallet add-signer start returned a different signer branch`);return await Xh({context:e.input.context,walletId:e.input.walletId,rpId:e.input.rpId,relayerUrl:e.input.relayerUrl,intentResponse:e.input.intentResponse,credential:e.input.credential,credentialIdB64u:e.input.credentialIdB64u,passkeyPrfFirstB64u:e.input.passkeyPrfFirstB64u,eventAccountId:e.input.eventAccountId,onEvent:e.input.onEvent,started:e.started});default:return q(e.signerSelection)}}async function Qh(e){let{context:t,signerSelection:n}=e,r=e.options||{},i=Kt(String(e.walletId||``).trim()),a=Am(String(i)),o=yp(String(e.rpId||``).trim());Bh(r.onEvent,a,{authMethod:`passkey`,phase:B.STEP_01_STARTED,status:`started`});try{let e=String(t.configs.network.relayer.url||``).trim();if(!e)throw Error(`addSigner requires relayer.url`);let s=Cd(t.configs);if(!s)throw Error(`addSigner requires registration.publishableKey and registration.projectEnvironmentId`);let c=await Yn({relayerUrl:e,walletId:i,request:{walletId:i,rpId:o,signerSelection:n},auth:{publishableKey:s.publishableKey,environmentId:s.projectEnvironmentId}});if(await hr(c.intent)!==c.addSignerIntentDigestB64u)throw Error(`Add-signer intent digest mismatch`);Bh(r.onEvent,a,{authMethod:`passkey`,phase:B.STEP_04_PASSKEY_CREATE_STARTED,status:`waiting_for_user`,interaction:{kind:`passkey_assert`,overlay:`show`}});let l=Uh(await V.listProfileAuthenticators(String(i))),u=await t.signingEngine.getAuthenticationCredentialsSerialized({subjectId:String(i),challengeB64u:c.addSignerIntentDigestB64u,allowCredentials:l,includeSecondPrfOutput:!1}),d=Wh(u,l),f=yl(u,`Wallet add-signer authorization`);Bh(r.onEvent,a,{authMethod:`passkey`,phase:B.STEP_04_PASSKEY_CREATE_SUCCEEDED,status:`succeeded`,interaction:{kind:`passkey_assert`,overlay:`hide`}});let p=await Bn({relayerUrl:e,walletId:i,addSignerIntentGrant:c.addSignerIntentGrant,addSignerIntentDigestB64u:c.addSignerIntentDigestB64u,intent:c.intent,auth:{kind:`webauthn_assertion`,rpId:o,credential:Rn(u),expectedChallengeDigestB64u:c.addSignerIntentDigestB64u}});await Gh({started:p,walletId:i,expectedDigestB64u:c.addSignerIntentDigestB64u});let m=await Zh({input:{context:t,walletId:i,rpId:o,relayerUrl:e,intentResponse:c,credential:u,credentialIdB64u:d,passkeyPrfFirstB64u:f,eventAccountId:a,onEvent:r.onEvent},signerSelection:n,started:p});return Bh(r.onEvent,a,{authMethod:`passkey`,phase:B.STEP_11_COMPLETED,status:`succeeded`}),Hh(r.afterCall,!0,m),m}catch(e){let t=jm(e),n=xe(e,`registration`,a);Vh(r.onError,Mm(n,t)),Bh(r.onEvent,a,{authMethod:`passkey`,phase:B.FAILED,status:`failed`,message:n,interaction:{kind:`passkey_assert`,overlay:`hide`},error:{...t?{code:t}:{},message:n}});let i={success:!1,error:n,...t?{errorCode:t}:{}};return Hh(r.afterCall,!1),i}}export{ru as $,Wr as $t,Td as A,Us as At,ju as B,So as Bt,pf as C,nc as Ct,Hd as D,dc as Dt,Fd as E,sc as Et,xd as F,Ks as Ft,lu as G,ma as Gt,gu as H,ro as Ht,pd as I,zs as It,ou as J,ca as Jt,iu as K,fa as Kt,dd as L,Rs as Lt,Cd as M,Ns as Mt,yd as N,Ms as Nt,Vd as O,pc as Ot,vd as P,As as Pt,$l as Q,$i as Qt,fd as R,Fs as Rt,bf as S,Cc as St,sf as T,$s as Tt,yu as U,io as Ut,Au as V,uo as Vt,vu as W,pa as Wt,eu as X,ki as Xt,cu as Y,la as Yt,tu as Z,oa as Zt,kf as _,Ec as _t,zh as a,Kl as at,Yf as b,yc as bt,vp as c,Ll as ct,gp as d,kl as dt,Pr as en,Ql as et,hp as f,Ol as ft,tp as g,Wc as gt,$f as h,yl as ht,Cm as i,Mr as in,Nl as it,wd as j,Ps as jt,Dd as k,Gs as kt,_p as l,ql as lt,cp as m,vl as mt,xm as n,Lr as nn,Ml as nt,Fp as o,Il as ot,op as p,bl as pt,su as q,da as qt,bm as r,jr as rn,Al as rt,Sm as s,Gl as st,Qh as t,Nr as tn,Yl as tt,mp as u,Dl as ut,Xf as v,gc as vt,uf as w,ec as wt,Hf as x,vc as xt,Vf as y,_c as yt,ld as z,rs as zt};