npm - @seams/wallet - Versions diffs - 0.15.4 → 0.17.0 - Mend

@seams/wallet 0.15.4 → 0.17.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (510) hide show

package/dist/{public/sdk/ecdsaDerivationExport-DOGzq0qC.js → esm/sdk/ecdsaDerivationExport-DyugdheE.js} RENAMED Viewed

	@@ -1 +1 @@
1	- import{r as e}from"./domainIds-BzkGsRqO.js";import{c as t,u as n}from"./chains-C_X_fNuS.js";import{i as r,r as i}from"./base64-DW79QA0h.js";import{r as a}from"./secureRandomId-LwBFx84B.js";import{s as o}from"./walletDbName-DtRewci9.js";import{g as s}from"./capabilityKinds-N8xo_IEh.js";import{r as c}from"./canonicalPrimitives-Dsbsxgxc.js";import{c as l,o as u}from"./ecdsaChainTarget-Bfatk3oP.js";import{i as d,n as f}from"./signerDomain-Dp7BhfmZ.js";import{$ as p,C as m,J as h,Kt as g,N as _,Z as v,en as y,h as ee,tn as b,v as x}from"./emailOtpEcdsaDerivationIdentity-Bik0N8v9.js";import{B as te,C as ne,E as S,I as re,R as ie,S as C,x as ae,y as w,z as oe}from"./ecdsaCapabilityManifest-DX6TflEz.js";import{r as T}from"./types-hKLqDUhR.js";import{o as se}from"./walletSessionAuthorizationStore-DmYe-cDR.js";import{t as ce}from"./thresholdEcdsa-CneSKcRt.js";import{p as le}from"./nearEd25519YaoSigningPreparation-RIfkYN0d.js";import{a as ue,i as de,r as fe}from"./walletSessionAuthorizationProjection-DuU6w0FP.js";import{a as pe,d as me,i as he,n as ge,u as _e}from"./ecdsaDerivationClientWasm-CpjnN4aK.js";import{a as ve,r as ye,t as be}from"./walletSessionFailure-YuhraC3P.js";import{a as E,o as D}from"./signingQueue-D_Ebmzcn.js";import{t as O}from"./bytes-DZRW2UDg.js";const xe=`router-ab-ed25519-yao-seed-export-v1`;function Se(e){if(typeof e!=`object`\|\|!e\|\|Array.isArray(e))return null;let t=e,n=typeof t.id==`string`&&t.id.trim()?t.id.trim():void 0;return t.success===!0&&`data`in t&&t.error===void 0?{id:n,success:!0,data:t.data}:t.success===!1&&typeof t.error==`string`&&t.data===void 0?{id:n,success:!1,error:t.error}:null}function k(e){return e.kind===`credential_free_ecdsa_session_activation_authorization_v1`}function Ce(e,t){return e.error\|\|e.message\|\|e.code\|\|t}function A(e){return p({kind:`router_ab_ecdsa_post_registration_session_activation_v1`,public_capability:e.publicCapability,session_policy:{threshold_session_id:e.thresholdSessionId,wallet_session_mint_id:e.walletSessionMintId,ttl_ms:e.ttlMs,remaining_uses:e.remainingUses,runtime_policy_scope:e.runtimePolicyScope}})}function we(e,t){let n=t.public_identity;return e.applicationBindingDigestB64u===t.context.application_binding_digest_b64u&&e.contextBinding32B64u===n.context_binding_b64u&&e.derivationClientSharePublicKey33B64u===n.derivation_client_share_public_key33_b64u&&e.relayerPublicKey33B64u===n.server_public_key33_b64u&&e.groupPublicKey33B64u===n.threshold_public_key33_b64u&&e.ethereumAddress.toLowerCase()===O(i(n.ethereum_address20_b64u))&&w(e.publicCapability,t)}function Te(e,t){let n=e.normal_signing.scope;return n.wallet_id===String(t.walletId)&&n.ecdsa_threshold_key_id===String(t.ecdsaThresholdKeyId)&&n.signing_root_id===String(t.signingRootId)&&n.signing_root_version===String(t.signingRootVersion)}function Ee(e){let t=e.persistedRoleLocalMaterial.publicFacts;if(!w(e.sessionActivation.public_capability,e.publicCapability)\|\|e.sessionActivation.session.threshold_session_id!==e.thresholdSessionId\|\|!Te(e.sessionActivation,t))throw Error(`Strict ECDSA session activation returned a different registered key identity`)}function De(t){let n=t.sessionActivation.activation,r=t.sessionActivation.authorization,i=r.record,a=y(n.public_capability.material_activation),o=0;for(let t of i.capabilitySubjects)t.kind===`sign`&&t.keyFamily===`ecdsa_secp256k1`&&e(t.materialActivation,a)&&(o+=1);if(Ee({publicCapability:t.publicCapability,persistedRoleLocalMaterial:t.persistedRoleLocalMaterial,thresholdSessionId:t.thresholdSessionId,sessionActivation:n}),String(i.walletId)!==t.walletId\|\|String(i.walletId)!==String(n.public_capability.client_id)\|\|i.authMethodId!==t.persistedRoleLocalMaterial.authority.walletAuthMethodId\|\|i.authorizationId!==n.session.authorization_id\|\|i.quotaId!==n.session.quota_id\|\|i.expiresAtMs!==n.session.expires_at_ms\|\|n.session.remaining_uses!==t.remainingUses\|\|r.operationCredential.walletSessionId!==n.session.wallet_session_id\|\|!e(a,t.persistedRoleLocalMaterial.materialActivation)\|\|o!==1)throw Error(`Strict ECDSA credential-free activation authority does not match its session`)}function j(e){let t=e.persistedRoleLocalMaterial.publicFacts;if(!e.walletId\|\|!e.thresholdSessionId)throw Error(`Strict ECDSA session activation requires exact wallet and session identity`);if(!Number.isSafeInteger(e.ttlMs)\|\|e.ttlMs<1)throw Error(`Strict ECDSA session activation requires a positive ttlMs`);if(!Number.isSafeInteger(e.remainingUses)\|\|e.remainingUses<1)throw Error(`Strict ECDSA session activation requires positive remainingUses`);if(String(t.walletId)!==e.walletId\|\|!we(t,e.publicCapability))throw Error(`Strict ECDSA session activation requires exact registered role-local material`)}function Oe(e){switch(e.kind){case`rehydrated`:return e;case`device_link_required`:throw Error(`device_link_required: registered ECDSA role-local material is unavailable on this device`);case`corrupt`:throw Error(`Registered ECDSA role-local material is corrupt (${e.reason}): ${e.message}`);default:{let t=e;throw Error(`Unsupported ECDSA role-local material resolution: ${String(t)}`)}}}async function M(e){let t=Oe(await D({purpose:`registration_activation`,source:E(e.persistedRoleLocalMaterial),workerCtx:e.workerCtx}));return{kind:`existing_ecdsa_role_local_material_activated_v1`,roleLocalMaterial:t.liveHandle,roleLocalMaterialRef:t.materialRef,publicFacts:e.persistedRoleLocalMaterial.publicFacts,publicCapability:e.publicCapability}}async function ke(e){j(e);let t=await ce(e.relayerUrl,{auth:e.routeAuth,request:A(e)});if(!t.ok)throw Error(Ce(t,`Strict ECDSA session activation failed`));return await N({workerCtx:e.workerCtx,publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.persistedRoleLocalMaterial,walletId:e.walletId,thresholdSessionId:e.thresholdSessionId,ttlMs:e.ttlMs,remainingUses:e.remainingUses,runtimePolicyScope:e.runtimePolicyScope,sessionActivation:t.value})}async function N(e){return j(e),Ee({publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.persistedRoleLocalMaterial,thresholdSessionId:e.thresholdSessionId,sessionActivation:e.sessionActivation}),{sessionActivation:e.sessionActivation,roleLocalActivation:await M(e)}}async function Ae(e){return j(e),De(e),{sessionActivation:e.sessionActivation.activation,authorization:e.sessionActivation.authorization,roleLocalActivation:await M(e)}}async function je(e,t){let n=o(e.lanePolicy.runtimePolicyScope);if(!n)throw Error(`Strict ECDSA session activation requires runtimePolicyScope`);let r={workerCtx:e.workerCtx,publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.existingRoleLocalMaterial,walletId:String(e.key.walletId),thresholdSessionId:e.lanePolicy.thresholdSessionId,ttlMs:e.lanePolicy.ttlMs,remainingUses:e.lanePolicy.remainingUses,runtimePolicyScope:n},s=e.sessionActivation?k(e.sessionActivation)?await Ae({...r,sessionActivation:e.sessionActivation}):await N({...r,sessionActivation:e.sessionActivation}):await ke({...r,walletSessionMintId:Me(),relayerUrl:e.relayerUrl,routeAuth:e.bootstrapAuth}),c=s.sessionActivation.public_capability.public_identity,l=`authorization`in s?{thresholdSessionId:s.sessionActivation.session.threshold_session_id,authorizationSessionId:s.sessionActivation.session.authorization_session_id,authorizationId:s.sessionActivation.session.authorization_id,walletSessionId:s.sessionActivation.session.wallet_session_id,quotaId:s.sessionActivation.session.quota_id,expiresAtMs:s.sessionActivation.session.expires_at_ms,remainingUses:s.sessionActivation.session.remaining_uses,walletSession:s.authorization.record,operationCredential:s.authorization.operationCredential}:{thresholdSessionId:s.sessionActivation.session.threshold_session_id,authorizationSessionId:s.sessionActivation.session.authorization_session_id,authorizationId:s.sessionActivation.session.authorization_id,walletSessionId:s.sessionActivation.session.wallet_session_id,quotaId:s.sessionActivation.session.quota_id,expiresAtMs:s.sessionActivation.session.expires_at_ms,remainingUses:s.sessionActivation.session.remaining_uses,walletSession:s.sessionActivation.session.wallet_session,operationCredential:s.sessionActivation.session.operation_credential},u=await g({walletId:String(e.key.walletId),signingRootId:e.key.signingRootId,signingRootVersion:e.key.signingRootVersion});return{ok:!0,bootstrapKind:`strict_post_registration`,keygenSessionId:String(e.requestId\|\|``).trim()\|\|a(`tecdsa-keygen`,32,`threshold ECDSA session IDs`),rpId:t,keyHandle:String(e.keyHandle),clientVerifyingShareB64u:c.derivation_client_share_public_key33_b64u,thresholdEcdsaPublicKeyB64u:c.threshold_public_key33_b64u,ethereumAddress:O(i(c.ethereum_address20_b64u)),relayerKeyId:u,relayerVerifyingShareB64u:c.server_public_key33_b64u,participantIds:e.key.participantIds.map(Number),thresholdSessionId:l.thresholdSessionId,authorizationSessionId:l.authorizationSessionId,authorizationId:l.authorizationId,walletSessionId:l.walletSessionId,quotaId:l.quotaId,expiresAtMs:l.expiresAtMs,remainingUses:l.remainingUses,runtimePolicyScope:n,signingRootId:String(e.key.signingRootId),signingRootVersion:String(e.key.signingRootVersion),walletSession:l.walletSession,operationCredential:l.operationCredential,roleLocalActivation:s.roleLocalActivation,routerAbEcdsaDerivationNormalSigning:s.sessionActivation.normal_signing,secretSourceKind:`persisted_role_local`}}function Me(){let e=s(a(`wallet-session-mint`,32,`Wallet Session mint IDs`));if(!e.ok)throw Error(`Failed to create Wallet Session mint identity`);return e.value}async function Ne(e){let t=e.touchIdPrompt.getRpId();if(!t)return{ok:!1,code:`invalid_args`,message:`Missing rpId for WebAuthn`};try{return await je(e,t)}catch(e){return{ok:!1,code:`strict_post_registration_failed`,message:e instanceof Error?e.message:String(e)}}}const P=`stale_ecdsa_key_identity`;function Pe(e){if(!e)throw Error(`Strict ECDSA session bootstrap requires Wallet Session authority`);switch(e.kind){case`opaque_wallet_session_operation_credential_v1`:return e;case`publishable_key`:throw Error(`Strict ECDSA session bootstrap requires Wallet Session authority`)}throw Error(`Strict ECDSA session bootstrap authority is invalid`)}function Fe(e){let t=String(e.code\|\|``).trim(),n=String(e.message\|\|``).trim().toLowerCase();return t===`stale_session_state`&&n.includes(`threshold-ecdsa bootstrap`)&&n.includes(`client verifying share`)&&n.includes(`integrated key record`)}function Ie(e){let t=String(e.message\|\|e.code\|\|`threshold-ecdsa bootstrap failed`).trim(),n=Fe(e)?P:String(e.code\|\|`threshold_ecdsa_bootstrap_failed`).trim()\|\|`threshold_ecdsa_bootstrap_failed`,r=Error(t\|\|`threshold-ecdsa bootstrap failed`);return r.code=n,r}function Le(e){let t=Error(e);return t.code=P,t}function Re(e){switch(e.authKind){case`email_otp`:return`email_otp`;case`passkey`:return`passkey`}return`unknown`}function ze(e){switch(e.bootstrap.secretSourceKind){case`persisted_role_local`:return e.request.authKind===`email_otp`?ae({authSubjectId:e.request.emailOtpWorkerSessionHandle.authSubjectId}):C({credentialIdB64u:e.request.passkeyCredentialIdB64u,rpId:e.bootstrap.rpId})}}function F(e,t){let n=String(e\|\|``).trim().toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(n))throw Error(`threshold-ecdsa exact activation returned invalid ${t}`);return n}function Be(e){let t=F(e.bootstrapOwnerAddress,`server owner address`);if(t!==F(e.key.thresholdOwnerAddress,`key owner address`))throw Le(`threshold-ecdsa exact activation owner address mismatches server bootstrap result`);return t}async function Ve(e,t){let n=l(String(t.key.walletId)),r=t.lanePolicy.chainTarget,i=String(t.lanePolicy.thresholdSessionId).trim();if(e.routerAbNormalSigning.mode!==`enabled`)throw Error(`Router A/B ECDSA derivation normal signing must be enabled for activation`);let a={walletId:n,chainTarget:r,targetKey:u(r),operationId:i\|\|null,authMethod:Re(t),evmFamilyKeyFingerprint:ee(t.key),keyHandle:t.keyHandle,chainTargetKey:u(r),ecdsaThresholdKeyId:String(t.key.ecdsaThresholdKeyId),thresholdSessionId:i\|\|null,freshAuthRetrySideEffectState:`not_applicable`,hasRequestedEcdsaThresholdKeyId:!0,requestedSessionId:i\|\|null,authKind:t.walletSessionRouteAuth?.kind\|\|`none`,passkeyCredentialBound:t.authKind===`passkey`},o;try{o=await Ne({touchIdPrompt:e.touchIdPrompt,relayerUrl:t.relayerUrl,requestId:t.requestId,workerCtx:e.workerCtx,...`preauthorizedSessionActivation`in t&&t.preauthorizedSessionActivation?{sessionActivation:t.preauthorizedSessionActivation}:{bootstrapAuth:Pe(t.walletSessionRouteAuth)},keyHandle:t.keyHandle,key:t.key,lanePolicy:t.lanePolicy,publicCapability:t.publicCapability,existingRoleLocalMaterial:t.existingRoleLocalMaterial})}catch(e){try{console.warn(`[threshold-ecdsa][bootstrap][exception]`,{...a,message:e instanceof Error?e.message:String(e)})}catch{}throw e}if(!o.ok){try{console.warn(`[threshold-ecdsa][bootstrap][failure]`,{...a,code:o.code\|\|``,message:o.message\|\|``})}catch{}throw Ie({code:o.code,message:o.message})}let s=String(t.key.ecdsaThresholdKeyId).trim();if(!s)throw Error(`threshold-ecdsa bootstrap returned empty ecdsaThresholdKeyId`);let c=re(s),d=oe(String(o.keyHandle\|\|``).trim()),f=String(o.relayerKeyId\|\|``).trim();if(!f)throw Error(`threshold-ecdsa bootstrap returned empty relayerKeyId`);let p=te(f),m=String(o.clientVerifyingShareB64u\|\|``).trim();if(!m)throw Error(`threshold-ecdsa bootstrap returned empty clientVerifyingShareB64u`);let h=ie(m),g=String(o.thresholdSessionId\|\|``).trim();if(!g)throw Error(`threshold-ecdsa bootstrap returned empty thresholdSessionId`);let _=Number(o.expiresAtMs);if(!Number.isFinite(_))throw Error(`threshold-ecdsa bootstrap returned invalid expiresAtMs`);let v=Number(o.remainingUses);if(!Number.isFinite(v))throw Error(`threshold-ecdsa bootstrap returned invalid remainingUses`);let y=t.key.participantIds.map(e=>Number(e));if(!y)throw Error(`threshold-ecdsa bootstrap returned empty participantIds`);let b=Be({key:t.key,bootstrapOwnerAddress:o.ethereumAddress}),x=ne({walletId:n,chainTarget:r,keyHandle:d,ecdsaThresholdKeyId:c,signingRootId:o.signingRootId,signingRootVersion:o.signingRootVersion,applicationBindingDigestB64u:o.roleLocalActivation.publicCapability.context.application_binding_digest_b64u,clientParticipantId:1,relayerParticipantId:2,participantIds:y,contextBinding32B64u:o.roleLocalActivation.publicFacts.contextBinding32B64u,derivationClientSharePublicKey33B64u:o.roleLocalActivation.publicFacts.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:o.roleLocalActivation.publicFacts.relayerPublicKey33B64u,groupPublicKey33B64u:o.roleLocalActivation.publicFacts.groupPublicKey33B64u,ethereumAddress:o.roleLocalActivation.publicFacts.ethereumAddress,publicCapability:o.roleLocalActivation.publicCapability}),S=o.routerAbEcdsaDerivationNormalSigning,C=o.roleLocalActivation.roleLocalMaterial,ae=ze({request:t,bootstrap:o}),w={ok:!0,thresholdSessionId:g,authorizationSessionId:o.authorizationSessionId,authorizationId:o.authorizationId,walletSessionId:o.walletSessionId,quotaId:o.quotaId,expiresAtMs:_,remainingUses:v,runtimePolicyScope:o.runtimePolicyScope,walletSession:o.walletSession,operationCredential:o.operationCredential,clientVerifyingShareB64u:h};return{thresholdEcdsaKeyRef:{type:`threshold-ecdsa-secp256k1`,userId:n,chainTarget:r,relayerUrl:t.relayerUrl,keyHandle:d,ecdsaThresholdKeyId:c,backendBinding:{materialKind:`role_local_worker_handle`,relayerKeyId:p,clientVerifyingShareB64u:h,roleLocalMaterialHandle:C,roleLocalMaterialRef:o.roleLocalActivation.roleLocalMaterialRef,publicFacts:x,authMethod:ae},participantIds:y,thresholdEcdsaPublicKeyB64u:o.thresholdEcdsaPublicKeyB64u,ethereumAddress:b,relayerVerifyingShareB64u:o.relayerVerifyingShareB64u,routerAbEcdsaDerivationNormalSigning:S},session:w}}async function He(e,t){return await Ve(e,t)}function Ue(e){let t;try{t=c(e.evidenceSetDigest)}catch(e){throw Error(e instanceof Error?e.message:`ECDSA explicit export evidence digest is invalid`)}let n=Math.floor(Number(e.expiresAtMs)),r=v(e.operation);if(r.operation_kind!==`evm.export_key`)throw Error(`ECDSA explicit export operation kind is invalid`);if(!Number.isSafeInteger(n)\|\|n<=Date.now())throw Error(`ECDSA explicit export operation authorization expiry is invalid`);let i=We(e.unseal);return{kind:`verified_step_up`,evidenceSetDigest:t,operation:r,expiresAtMs:n,quotaUse:`none`,unseal:i}}function We(e){switch(e.kind){case`not_requested`:return{kind:`not_requested`};case`email_otp_grant`:{let t=String(e.grant\|\|``).trim(),n=String(e.challenge_id\|\|``).trim();if(!t\|\|!n)throw Error(`ECDSA explicit export Email OTP unseal grant is invalid`);return{kind:`email_otp_grant`,grant:t,challenge_id:n}}default:{let t=e;throw Error(`Unsupported ECDSA explicit export unseal state: ${String(t)}`)}}}async function I(e){let t=String(e.relayerUrl\|\|``).trim();if(!t)throw Error(`ECDSA explicit export relayer URL is required`);return{kind:`explicit_key_export_ecdsa_activation_result`,purpose:`explicit_key_export`,material:{kind:`auth_neutral_ecdsa_export_material_v1`,relayerUrl:t,persistedMaterial:e.existingRoleLocalMaterial},authorization:Ue(e.authorization)}}function L(e,t){let n=String(e\|\|t\|\|``).trim();if(!n)throw Error(`Missing relayer url (configs.network.relayer.url)`);return n}function R(e){return`key`in e&&!!e.key&&`keyHandle`in e&&!!String(e.keyHandle\|\|``).trim()}function z(e){return R(e)?e.key.walletId:e.walletId}function B(e){return R(e)?e.lanePolicy.chainTarget:e.chainTarget}function Ge(e){return e.kind===`email_otp_ecdsa_bootstrap`?{authMethod:f.emailOtp,signerSource:d.emailOtpRegistration}:{authMethod:f.passkey,signerSource:d.passkeyRegistration}}function Ke(e){switch(e.kind){case`passkey_preauthorized_ecdsa_bootstrap`:case`wallet_session_reconnect_ecdsa_bootstrap`:return e.authorizationAuthority;case`passkey_fresh_ecdsa_bootstrap`:case`email_otp_ecdsa_bootstrap`:return e.existingRoleLocalMaterial.authority}}function qe(e){if(!(`sessionActivation`in e.request)\|\|!e.request.sessionActivation)return;let t=e.request.sessionActivation,n=k(t)?t.activation:t,r=k(t)?t.authorization:{record:t.session.wallet_session,operationCredential:t.session.operation_credential};ue({walletId:e.walletId,authority:e.authority,walletSession:r.record,operationCredential:r.operationCredential,expectedAuthorizationId:n.session.authorization_id,expectedWalletSessionId:n.session.wallet_session_id,expectedQuotaId:n.session.quota_id,expectedExpiresAtMs:n.session.expires_at_ms}),e.request.kind===`passkey_preauthorized_ecdsa_bootstrap`&&de({expected:e.request.authorizationIdentity,walletSession:r.record})}function Je(e,t){let n=(e,n,r)=>({kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},...r,...n?{walletSessionRouteAuth:n}:{}}),r=e=>({kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u,preauthorizedSessionActivation:e.sessionActivation});switch(e.kind){case`passkey_fresh_ecdsa_bootstrap`:return n(e,e.routeAuth,{authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u});case`passkey_preauthorized_ecdsa_bootstrap`:return r(e);case`wallet_session_reconnect_ecdsa_bootstrap`:return n(e,e.routeAuth,{authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u});case`email_otp_ecdsa_bootstrap`:{let r={authKind:`email_otp`,emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle};return e.sessionActivation?{kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},...r,preauthorizedSessionActivation:e.sessionActivation}:n(e,e.routeAuth,r)}}throw Error(`[SigningEngine][ecdsa] unsupported ECDSA bootstrap request`)}function Ye(e,t){return{purpose:`explicit_key_export`,relayerUrl:t,existingRoleLocalMaterial:e.existingRoleLocalMaterial,authorization:e.authorization}}function Xe(e,t){return{purpose:`explicit_key_export`,relayerUrl:t,existingRoleLocalMaterial:e.existingRoleLocalMaterial,authorization:e.authorization}}async function Ze(e,t){if(t.kind===`reuse_warm_ecdsa_bootstrap`)throw Error(`[SigningEngine][ecdsa] reuse_warm bootstrap must resolve an existing exact material request before activation`);let n=Ke(t),r=l(z(t)),i=B(t),a=L(t.relayerUrl,e.defaultRelayerUrl),o=e.getSignerWorkerContext(),s={touchIdPrompt:e.touchIdPrompt,workerCtx:o,routerAbNormalSigning:e.routerAbNormalSigning};qe({request:t,walletId:r,authority:n});let c=await He(s,Je(t,a)),u=Ge(t);return await e.persistThresholdEcdsaBootstrapForWalletTarget({walletId:r,chainTarget:i,bootstrap:c,signerAuth:u}),await t.beforeAuthorizationPersistence?.(),await fe(se,{walletId:r,authority:n,bootstrap:c}),c}async function Qe(e,t){return await I(Ye(t,L(t.relayerUrl,e.defaultRelayerUrl)))}async function $e(e,t){return await I(Xe(t,L(t.relayerUrl,e.defaultRelayerUrl)))}async function V(e,t,n){let r=String(t),i=(e.get(r)\|\|Promise.resolve()).catch(()=>void 0),a,o=new Promise(e=>{a=e}),s=i.then(()=>o);e.set(r,s),await i;try{return await n()}finally{a(),e.get(r)===s&&e.delete(r)}}function et(e,t){return t.runtimeScopeBootstrap&&(e.runtimeScopeBootstrap=t.runtimeScopeBootstrap),t.operationIntent&&(e.operationIntent=t.operationIntent),typeof t.ttlMs==`number`&&(e.ttlMs=t.ttlMs),e}function H(e){return et({kind:`email_otp_ecdsa_activation`,purpose:`transaction_signing`,walletKey:e.walletKey,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,source:e.source,relayerUrl:e.relayerUrl,sessionIdentity:e.sessionIdentity,sessionKind:e.sessionKind,sessionBudgetUses:e.sessionBudgetUses,runtimePolicy:e.runtimePolicy,emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle,emailOtpAuthContext:e.emailOtpAuthContext,...`preauthorizedSessionActivation`in e?{preauthorizedSessionActivation:e.preauthorizedSessionActivation}:{walletSessionRouteAuth:e.walletSessionRouteAuth}},e)}function U(e){if(le(e.context)!==e.expected)throw Error(`Email OTP ${e.label} activation requires ${e.expected} retention`)}function tt(e){return U({context:e.emailOtpAuthContext,expected:`session`,label:`session bootstrap`}),H(e)}function nt(e){return U({context:e.emailOtpAuthContext,expected:`session`,label:`recovered session`}),H(e)}function rt(e){return U({context:e.emailOtpAuthContext,expected:`session`,label:`preauthorized session bootstrap`}),H(e)}function it(e){return U({context:e.emailOtpAuthContext,expected:`single_use`,label:`per-operation reauth`}),H(e)}function at(e){return{kind:`email_otp_ecdsa_export_activation`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}function ot(e){return{kind:`passkey_ecdsa_export_activation`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}function st(e){switch(e.kind){case`default_policy`:return;case`scoped_policy`:return e.scope}throw Error(`[SigningEngine][ecdsa] unsupported ECDSA activation policy`)}function W(e,t){t.runtimeScopeBootstrap&&(e.runtimeScopeBootstrap=t.runtimeScopeBootstrap),t.operationIntent&&(e.operationIntent=t.operationIntent);let n=st(t.runtimePolicy);return`walletId`in e&&(typeof t.ttlMs==`number`&&(e.ttlMs=t.ttlMs),n&&(e.runtimePolicyScope=n)),e}function ct(e){switch(e.kind){case`passkey_ecdsa_activation`:return{kind:`passkey_existing_session_activation`,request:e};case`email_otp_ecdsa_activation`:return{kind:`email_otp_existing_session_activation`,request:e}}throw Error(`[SigningEngine][ecdsa] unsupported activation request`)}function lt(e){let t=String(e.webauthnAuthentication.rawId\|\|e.webauthnAuthentication.id\|\|``).trim();if(!t)throw Error(`[SigningEngine][ecdsa] passkey activation requires credential identity`);return t}function ut(e){let t=ct(e);switch(t.kind){case`passkey_existing_session_activation`:return W({kind:`passkey_fresh_ecdsa_bootstrap`,keyHandle:t.request.walletKey.keyHandle,key:x(t.request.walletKey),lanePolicy:t.request.lanePolicy,publicCapability:t.request.publicCapability,existingRoleLocalMaterial:t.request.existingRoleLocalMaterial,source:t.request.source,relayerUrl:t.request.relayerUrl,requestId:t.request.requestId,passkeyCredentialIdB64u:lt(t.request),routeAuth:t.request.walletSessionRouteAuth},t.request);case`email_otp_existing_session_activation`:{let e={kind:`email_otp_ecdsa_bootstrap`,keyHandle:t.request.walletKey.keyHandle,key:x(t.request.walletKey),lanePolicy:t.request.lanePolicy,publicCapability:t.request.publicCapability,existingRoleLocalMaterial:t.request.existingRoleLocalMaterial,source:`email_otp`,relayerUrl:t.request.relayerUrl,emailOtpWorkerSessionHandle:t.request.emailOtpWorkerSessionHandle,emailOtpAuthContext:t.request.emailOtpAuthContext};return t.request.preauthorizedSessionActivation?W({...e,sessionActivation:t.request.preauthorizedSessionActivation},t.request):W({...e,routeAuth:t.request.walletSessionRouteAuth},t.request)}}throw Error(`[SigningEngine][ecdsa] unsupported activation request`)}function dt(e){return{kind:`passkey_ecdsa_export_bootstrap`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}async function ft(e){let t=e.bootstrap.thresholdEcdsaKeyRef.backendBinding;if(!t)throw Error(`[WarmSessionStore] threshold ECDSA bootstrap is missing its backend binding`);let n=pt(t);if(!n)return;let r=await e.deps.persistEcdsaRoleLocalReadyRecord({record:n,storageKeyFacts:S(n)});if(!r.ok)throw Error(`[WarmSessionStore] threshold ECDSA role-local ready record persistence failed (${r.code}): ${r.message}`)}function pt(e){switch(e.materialKind){case`role_local_ready_state_blob`:return e.ecdsaRoleLocalReadyRecord;case`role_local_worker_handle`:case`role_local_durable_public_anchor`:case`role_local_durable_sealed_ref`:case`metadata_only`:return null;default:{let t=e;throw Error(`[WarmSessionStore] unsupported threshold ECDSA backend binding: ${JSON.stringify(t)}`)}}}async function G(e,t){let n=l(z(t));return await V(e.queueByWallet,n,async()=>{let n=await Ze(e.activationDeps,t);return await ft({deps:e,bootstrap:n}),n})}async function mt(e,t){return await G(e,ut(t))}async function ht(e,t){return await Qe(e.activationDeps,dt(t))}async function gt(e,t){let n={kind:`email_otp_ecdsa_export_bootstrap`,purpose:`explicit_key_export`,existingRoleLocalMaterial:t.existingRoleLocalMaterial,relayerUrl:t.relayerUrl,authorization:t.authorization};return await $e(e.activationDeps,n)}const K=`ecdsa-derivation:role-local:product-export-confirmation:v5`,q=`ecdsa-derivation:role-local:product-export-authorization:v5`;function J(e){return{kind:`operation_step_up`}}function Y(e){return{authorizationKind:e.kind,authorizationId:e.evidenceSetDigest}}function X(){let e=globalThis.crypto;if(!e\|\|typeof e.getRandomValues!=`function`)throw Error(`crypto.getRandomValues is required for threshold ECDSA export`);return r(e.getRandomValues(new Uint8Array(32)))}async function Z(e){let t=String(e.relayerUrl\|\|``).trim().replace(/\/+$/g,``);if(!t)throw Error(`[SigningEngine][ecdsa-export] relayer URL is required`);if(e.authorization.kind===`wallet_session_bearer`&&!e.authorization.token.trim())throw Error(`[SigningEngine][ecdsa-export] Wallet Session operation credential is required`);let n={"Content-Type":`application/json`};e.authorization.kind===`wallet_session_bearer`&&(n.Authorization=`Bearer ${e.authorization.token}`);try{let r=await fetch(`${t}${_}`,{method:`POST`,credentials:e.authorization.kind===`legacy_cookie`?`include`:`omit`,headers:n,body:JSON.stringify({request:e.request,requestDigestB64u:e.requestDigestB64u})}),i=await r.json().catch(()=>null);if(!r.ok){let e=i&&typeof i==`object`&&!Array.isArray(i)?i:null;return{ok:!1,code:String(e?.code\|\|`http_error`),message:String(e?.message\|\|`HTTP ${r.status}`)}}return{ok:!0,value:h(i)}}catch(e){return{ok:!1,error:e instanceof Error?e.message:String(e)}}}async function _t(e){return await Z({...e,authorization:{kind:`legacy_cookie`}})}async function vt(e){return await Z({relayerUrl:e.relayerUrl,request:e.request,requestDigestB64u:e.requestDigestB64u,authorization:{kind:`wallet_session_bearer`,token:e.operationCredential.token}})}function Q(e){let t=Math.min(e.issuedAtUnixMs+6e4,e.authorizationExpiresAtMsCeiling??1/0);if(Number.isFinite(t)&&t>e.issuedAtUnixMs)return t;throw new be({failure:ye(ve.expired),message:`Wallet Session expired before ECDSA export authorization`})}function yt(e){if(String(e.material.persistedMaterial.publicFacts.walletId)!==String(e.walletSessionUserId))throw Error(`[SigningEngine][ecdsa-export] explicit export wallet mismatch`)}async function $(e){return r(await n(t(e)))}function bt(e){switch(e.kind){case`rehydrated`:return e;case`device_link_required`:throw Error(`[SigningEngine][ecdsa-export] device_link_required: local threshold ECDSA material is unavailable`);case`corrupt`:throw Error(`[SigningEngine][ecdsa-export] local threshold ECDSA material is corrupt (${e.reason}): ${e.message}`);default:{let t=e;throw Error(`Unsupported ECDSA export material resolution: ${String(t)}`)}}}async function xt(e){return bt(await D({purpose:`explicit_key_export`,source:E(e.persistedMaterial),workerCtx:e.workerCtx}))}function St(e){let t=Y(e.material.operationAuthorization),n=e.material.persistedMaterial.publicFacts;return{version:q,operation:`explicit_key_export`,keyHandle:n.keyHandle,walletId:String(n.walletId),ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,relayerKeyId:n.publicCapability.signer_set.selected_server.server_id,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,contextBinding32B64u:e.contextBinding32B64u,publicIdentity:e.publicIdentity,exportRequestNonce32B64u:e.exportRequestNonce32B64u,confirmationDigest32B64u:e.confirmationDigest32B64u,issuedAtUnixMs:e.issuedAtUnixMs,expiresAtUnixMs:e.expiresAtUnixMs,authorizationKind:t.authorizationKind,authorizationId:t.authorizationId,materialActivation:b(e.material.persistedMaterial.materialActivation),participantIds:n.participantIds}}async function Ct(e,t){let n=t.persistedMaterial.publicFacts,r=b(t.persistedMaterial.materialActivation);switch(t.factorAuthorization.kind){case`passkey`:{let e=String(t.factorAuthorization.credential.rawId\|\|t.factorAuthorization.credential.id\|\|``).trim();if(!e)throw Error(`[SigningEngine][ecdsa-export] passkey authorization credential is missing`);if(e!==t.factorAuthorization.passkeyCredentialIdB64u)throw Error(`[SigningEngine][ecdsa-export] passkey export authorization credential mismatch`);break}case`email_otp_verified`:break;default:{let e=t.factorAuthorization;throw Error(`Unsupported ECDSA export authorization: ${String(e)}`)}}let i=Date.now(),a=Q({issuedAtUnixMs:i,authorizationExpiresAtMsCeiling:t.operationAuthorization.expiresAtMs}),o={derivationClientSharePublicKey33B64u:n.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:n.relayerPublicKey33B64u,groupPublicKey33B64u:n.groupPublicKey33B64u,ethereumAddress:n.ethereumAddress},s=X(),c=Y(t.operationAuthorization),l=await $({version:K,walletId:String(n.walletId),ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,relayerKeyId:n.publicCapability.signer_set.selected_server.server_id,contextBinding32B64u:n.contextBinding32B64u,publicIdentity:o,authorizationKind:c.authorizationKind,authorizationId:c.authorizationId,materialActivation:r,exportRequestNonce32B64u:s,issuedAtUnixMs:i,expiresAtUnixMs:a}),u=await $(St({ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,contextBinding32B64u:n.contextBinding32B64u,publicIdentity:o,exportRequestNonce32B64u:s,confirmationDigest32B64u:l,issuedAtUnixMs:i,expiresAtUnixMs:a,material:t})),d=n.publicCapability,f=`ecdsa-export:${s}`,p=await pe({workerCtx:e.getSignerWorkerContext(),command:{kind:`create_router_ab_ecdsa_explicit_export_ceremony_v1`,ceremonyId:f,request:{context:d.context,lifecycle:{lifecycle_id:f,work_kind:`key_export`,primitive_request_kind:`export`,root_share_epoch:d.activation_epoch,account_id:String(n.walletId),session_id:T.thresholdEcdsaSession(f),signer_set_id:d.signer_set.signer_set_id,selected_server_id:d.signer_set.selected_server.server_id},public_identity:d.public_identity,signer_set:d.signer_set,router_id:d.router_id,client_id:d.client_id,authorization:J(t.operationAuthorization),authorization_id:t.operationAuthorization.evidenceSetDigest,operation:t.operationAuthorization.operation,material_activation:r,export_authorization_digest_b64u:u,export_nonce:s,expires_at_ms:a,deriver_recipient_keys:d.deriver_recipient_keys}}});if(p.kind!==`router_ab_ecdsa_explicit_export_ceremony_created_v1`)throw Error(`[SigningEngine][ecdsa-export] strict export ceremony kind mismatch`);try{let i=await _t({relayerUrl:t.relayerUrl,request:p.request,requestDigestB64u:p.requestDigestB64u});if(!i.ok)throw Error(i.error\|\|i.message\|\|i.code\|\|`Strict ECDSA explicit export request failed`);let a=await me({workerCtx:e.getSignerWorkerContext(),command:{kind:`finalize_router_ab_ecdsa_explicit_export_v1`,ceremonyId:f,clientProofFinalization:{kind:`finalize_encrypted_client_proof_bundles_v2`,bundles:i.value.response.bundles},signingWorkerExport:i.value.signing_worker_export,authorizationKind:c.authorizationKind,authorizationId:c.authorizationId,materialActivation:r,roleLocalMaterial:t.liveMaterial.liveHandle,roleLocalMaterialRef:t.liveMaterial.materialRef,publicFacts:n}});return{publicKeyHex:a.publicKeyHex,privateKeyHex:a.privateKeyHex,ethereumAddress:a.ethereumAddress}}catch(t){throw await ge({workerCtx:e.getSignerWorkerContext(),command:{kind:`close_router_ab_ecdsa_post_registration_ceremony_v1`,ceremonyId:f}}).catch(()=>void 0),t}}async function wt(e,t){let n=t.exportProvision.material;yt({material:n,walletSessionUserId:t.walletSessionUserId});let r=String(n.relayerUrl\|\|``).trim();if(!r)throw Error(`[SigningEngine][ecdsa-export] relayer URL is required`);let i=n.persistedMaterial;return await Ct(e,{persistedMaterial:i,liveMaterial:await xt({persistedMaterial:i,workerCtx:e.getSignerWorkerContext()}),relayerUrl:r,operationAuthorization:t.exportProvision.authorization,factorAuthorization:t.factorAuthorization})}function Tt(t){let n=t.runtime.normalSigning.scope,r=t.operationAuthorization.operation,i=y(r.material_activation);if(r.operation_kind!==`evm.export_key`\|\|r.wallet_id!==String(t.runtime.walletId)\|\|r.key_handle!==t.runtime.publicFacts.keyHandle\|\|r.relayer_key_id!==t.runtime.relayerKeyId\|\|r.participant_ids[0]!==t.runtime.publicFacts.participantIds[0]\|\|r.participant_ids[1]!==t.runtime.publicFacts.participantIds[1]\|\|r.signing_worker_id!==n.signing_worker.server_id\|\|r.normal_signing_scope.wallet_id!==n.wallet_id\|\|r.normal_signing_scope.context.application_binding_digest_b64u!==n.context.application_binding_digest_b64u\|\|r.normal_signing_scope.public_identity.context_binding_b64u!==n.public_identity.context_binding_b64u\|\|r.normal_signing_scope.public_identity.threshold_public_key33_b64u!==n.public_identity.threshold_public_key33_b64u\|\|r.normal_signing_scope.signing_worker.server_id!==n.signing_worker.server_id\|\|!e(i,t.runtime.materialActivation)\|\|!e(y(r.normal_signing_scope.material_activation),t.runtime.materialActivation))throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority operation identity changed`)}async function Et(e,t){Tt(t);let n=t.runtime,r=n.normalSigning.scope;if(t.operationAuthorization.exportTopology.signer_set.selected_server.server_id!==r.signing_worker.server_id)throw Error(`[SigningEngine][ecdsa-export] active export topology changed`);let i=r.material_activation,a=Date.now(),o=Q({issuedAtUnixMs:a,authorizationExpiresAtMsCeiling:t.operationAuthorization.expiresAtMs}),s={derivationClientSharePublicKey33B64u:r.public_identity.derivation_client_share_public_key33_b64u,relayerPublicKey33B64u:r.public_identity.server_public_key33_b64u,groupPublicKey33B64u:r.public_identity.threshold_public_key33_b64u,ethereumAddress:n.publicFacts.thresholdOwnerAddress},l=X(),u=Y(t.operationAuthorization),d=await $({version:K,walletId:String(n.walletId),ecdsaThresholdKeyId:r.ecdsa_threshold_key_id,relayerKeyId:n.relayerKeyId,contextBinding32B64u:r.public_identity.context_binding_b64u,publicIdentity:s,authorizationKind:u.authorizationKind,authorizationId:u.authorizationId,materialActivation:i,exportRequestNonce32B64u:l,issuedAtUnixMs:a,expiresAtUnixMs:o}),f=await $({version:q,operation:`explicit_key_export`,keyHandle:n.publicFacts.keyHandle,walletId:String(n.walletId),ecdsaThresholdKeyId:r.ecdsa_threshold_key_id,relayerKeyId:n.relayerKeyId,signingRootId:r.signing_root_id,signingRootVersion:r.signing_root_version,contextBinding32B64u:r.public_identity.context_binding_b64u,publicIdentity:s,exportRequestNonce32B64u:l,confirmationDigest32B64u:d,issuedAtUnixMs:a,expiresAtUnixMs:o,authorizationKind:u.authorizationKind,authorizationId:u.authorizationId,materialActivation:i,participantIds:n.publicFacts.participantIds}),p=`ecdsa-export:${l}`,m={context:r.context,lifecycle:{lifecycle_id:p,work_kind:`key_export`,primitive_request_kind:`export`,root_share_epoch:r.activation_epoch,account_id:r.wallet_id,session_id:T.thresholdEcdsaSession(p),signer_set_id:t.operationAuthorization.exportTopology.signer_set.signer_set_id,selected_server_id:t.operationAuthorization.exportTopology.signer_set.selected_server.server_id},public_identity:r.public_identity,signer_set:t.operationAuthorization.exportTopology.signer_set,router_id:t.operationAuthorization.exportTopology.router_id,client_id:String(n.walletId),authorization:J(t.operationAuthorization),operation:t.operationAuthorization.operation,authorization_id:c(t.operationAuthorization.evidenceSetDigest),material_activation:i,export_authorization_digest_b64u:f,export_nonce:l,expires_at_ms:o,deriver_recipient_keys:t.operationAuthorization.exportTopology.deriver_recipient_keys},h=await he({holderHandleId:n.holderRuntime.holderHandleId,request:m,workerCtx:e.getSignerWorkerContext()});if(h.kind!==`ecdsa_holder_ordinary_export_request_created_v1`)throw Error(`[SigningEngine][ecdsa-export] active holder export request kind mismatch`);let g=await vt({relayerUrl:t.relayerUrl,request:h.request,requestDigestB64u:h.requestDigestB64u,operationCredential:n.operationCredential});if(!g.ok)throw Error(g.error\|\|g.message\|\|g.code\|\|`Active Wallet Authority ECDSA export request failed`);let _={wallet_id:r.wallet_id,key_handle:n.publicFacts.keyHandle,ecdsa_threshold_key_id:r.ecdsa_threshold_key_id,signing_root_id:r.signing_root_id,signing_root_version:r.signing_root_version,activation_epoch:r.activation_epoch,signing_worker_id:r.signing_worker.server_id,context_binding_b64u:r.public_identity.context_binding_b64u,threshold_public_key33_b64u:r.public_identity.threshold_public_key33_b64u,export_request_digest_b64u:h.requestDigestB64u,export_authorization_digest_b64u:f,export_nonce:l,authorization_kind:`verified_step_up`,authorization_id:t.operationAuthorization.evidenceSetDigest,material_activation:i,lifecycle_id:p,recipient_identity:h.request.client_id,recipient_public_key:h.request.client_ephemeral_public_key,expires_at_ms:h.request.expires_at_ms},v=await _e({holderHandleId:n.holderRuntime.holderHandleId,requestDigestB64u:h.requestDigestB64u,expectedBinding:_,forwardedResponse:g.value,workerCtx:e.getSignerWorkerContext()});return{publicKeyHex:v.publicKeyHex,privateKeyHex:v.privateKeyHex,ethereumAddress:v.ethereumAddress}}export{k as _,it as a,tt as c,mt as d,G as f,A as g,z as h,at as i,gt as l,B as m,wt as n,rt as o,V as p,ot as r,nt as s,Et as t,ht as u,xe as v,Se as y};
1	+ import{r as e}from"./domainIds-C3fUa33Q.js";import{c as t,u as n}from"./chains-CPmd4s9f.js";import{i as r,r as i}from"./base64-DW79QA0h.js";import{r as a}from"./secureRandomId-LwBFx84B.js";import{s as o}from"./walletDbName-DRzPv5Ir.js";import{g as s}from"./capabilityKinds-D0Yrp9uf.js";import{r as c}from"./canonicalPrimitives-BOzRXzfv.js";import{c as l,o as u}from"./ecdsaChainTarget-DkOrgv4y.js";import{i as d,n as f}from"./signerDomain-BFqRQ0Jl.js";import{$ as p,C as m,J as h,Kt as g,N as _,Z as v,en as y,h as ee,tn as b,v as x}from"./emailOtpEcdsaDerivationIdentity-BDVjvnmO.js";import{B as te,C as ne,E as S,I as re,R as ie,S as C,x as ae,y as w,z as oe}from"./ecdsaCapabilityManifest-DzA996y9.js";import{r as T}from"./types-CQTWmtqu.js";import{o as se}from"./walletSessionAuthorizationStore-D-MhJ0PC.js";import{t as ce}from"./thresholdEcdsa-murTq-xz.js";import{p as le}from"./nearEd25519YaoSigningPreparation-CqBNMG87.js";import{a as ue,i as de,r as fe}from"./walletSessionAuthorizationProjection-DuU6w0FP.js";import{a as pe,d as me,i as he,n as ge,u as _e}from"./ecdsaDerivationClientWasm-DQlajPpE.js";import{a as ve,r as ye,t as be}from"./walletSessionFailure-C6TAQTZn.js";import{a as E,o as D}from"./signingQueue-C1Pb07gm.js";import{t as O}from"./bytes-DZRW2UDg.js";const xe=`router-ab-ed25519-yao-seed-export-v1`;function Se(e){if(typeof e!=`object`\|\|!e\|\|Array.isArray(e))return null;let t=e,n=typeof t.id==`string`&&t.id.trim()?t.id.trim():void 0;return t.success===!0&&`data`in t&&t.error===void 0?{id:n,success:!0,data:t.data}:t.success===!1&&typeof t.error==`string`&&t.data===void 0?{id:n,success:!1,error:t.error}:null}function k(e){return e.kind===`credential_free_ecdsa_session_activation_authorization_v1`}function Ce(e,t){return e.error\|\|e.message\|\|e.code\|\|t}function A(e){return p({kind:`router_ab_ecdsa_post_registration_session_activation_v1`,public_capability:e.publicCapability,session_policy:{threshold_session_id:e.thresholdSessionId,wallet_session_mint_id:e.walletSessionMintId,ttl_ms:e.ttlMs,remaining_uses:e.remainingUses,runtime_policy_scope:e.runtimePolicyScope}})}function we(e,t){let n=t.public_identity;return e.applicationBindingDigestB64u===t.context.application_binding_digest_b64u&&e.contextBinding32B64u===n.context_binding_b64u&&e.derivationClientSharePublicKey33B64u===n.derivation_client_share_public_key33_b64u&&e.relayerPublicKey33B64u===n.server_public_key33_b64u&&e.groupPublicKey33B64u===n.threshold_public_key33_b64u&&e.ethereumAddress.toLowerCase()===O(i(n.ethereum_address20_b64u))&&w(e.publicCapability,t)}function Te(e,t){let n=e.normal_signing.scope;return n.wallet_id===String(t.walletId)&&n.ecdsa_threshold_key_id===String(t.ecdsaThresholdKeyId)&&n.signing_root_id===String(t.signingRootId)&&n.signing_root_version===String(t.signingRootVersion)}function Ee(e){let t=e.persistedRoleLocalMaterial.publicFacts;if(!w(e.sessionActivation.public_capability,e.publicCapability)\|\|e.sessionActivation.session.threshold_session_id!==e.thresholdSessionId\|\|!Te(e.sessionActivation,t))throw Error(`Strict ECDSA session activation returned a different registered key identity`)}function De(t){let n=t.sessionActivation.activation,r=t.sessionActivation.authorization,i=r.record,a=y(n.public_capability.material_activation),o=0;for(let t of i.capabilitySubjects)t.kind===`sign`&&t.keyFamily===`ecdsa_secp256k1`&&e(t.materialActivation,a)&&(o+=1);if(Ee({publicCapability:t.publicCapability,persistedRoleLocalMaterial:t.persistedRoleLocalMaterial,thresholdSessionId:t.thresholdSessionId,sessionActivation:n}),String(i.walletId)!==t.walletId\|\|String(i.walletId)!==String(n.public_capability.client_id)\|\|i.authMethodId!==t.persistedRoleLocalMaterial.authority.walletAuthMethodId\|\|i.authorizationId!==n.session.authorization_id\|\|i.quotaId!==n.session.quota_id\|\|i.expiresAtMs!==n.session.expires_at_ms\|\|n.session.remaining_uses!==t.remainingUses\|\|r.operationCredential.walletSessionId!==n.session.wallet_session_id\|\|!e(a,t.persistedRoleLocalMaterial.materialActivation)\|\|o!==1)throw Error(`Strict ECDSA credential-free activation authority does not match its session`)}function j(e){let t=e.persistedRoleLocalMaterial.publicFacts;if(!e.walletId\|\|!e.thresholdSessionId)throw Error(`Strict ECDSA session activation requires exact wallet and session identity`);if(!Number.isSafeInteger(e.ttlMs)\|\|e.ttlMs<1)throw Error(`Strict ECDSA session activation requires a positive ttlMs`);if(!Number.isSafeInteger(e.remainingUses)\|\|e.remainingUses<1)throw Error(`Strict ECDSA session activation requires positive remainingUses`);if(String(t.walletId)!==e.walletId\|\|!we(t,e.publicCapability))throw Error(`Strict ECDSA session activation requires exact registered role-local material`)}function Oe(e){switch(e.kind){case`rehydrated`:return e;case`device_link_required`:throw Error(`device_link_required: registered ECDSA role-local material is unavailable on this device`);case`corrupt`:throw Error(`Registered ECDSA role-local material is corrupt (${e.reason}): ${e.message}`);default:{let t=e;throw Error(`Unsupported ECDSA role-local material resolution: ${String(t)}`)}}}async function M(e){let t=Oe(await D({purpose:`registration_activation`,source:E(e.persistedRoleLocalMaterial),workerCtx:e.workerCtx}));return{kind:`existing_ecdsa_role_local_material_activated_v1`,roleLocalMaterial:t.liveHandle,roleLocalMaterialRef:t.materialRef,publicFacts:e.persistedRoleLocalMaterial.publicFacts,publicCapability:e.publicCapability}}async function ke(e){j(e);let t=await ce(e.relayerUrl,{auth:e.routeAuth,request:A(e)});if(!t.ok)throw Error(Ce(t,`Strict ECDSA session activation failed`));return await N({workerCtx:e.workerCtx,publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.persistedRoleLocalMaterial,walletId:e.walletId,thresholdSessionId:e.thresholdSessionId,ttlMs:e.ttlMs,remainingUses:e.remainingUses,runtimePolicyScope:e.runtimePolicyScope,sessionActivation:t.value})}async function N(e){return j(e),Ee({publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.persistedRoleLocalMaterial,thresholdSessionId:e.thresholdSessionId,sessionActivation:e.sessionActivation}),{sessionActivation:e.sessionActivation,roleLocalActivation:await M(e)}}async function Ae(e){return j(e),De(e),{sessionActivation:e.sessionActivation.activation,authorization:e.sessionActivation.authorization,roleLocalActivation:await M(e)}}async function je(e,t){let n=o(e.lanePolicy.runtimePolicyScope);if(!n)throw Error(`Strict ECDSA session activation requires runtimePolicyScope`);let r={workerCtx:e.workerCtx,publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.existingRoleLocalMaterial,walletId:String(e.key.walletId),thresholdSessionId:e.lanePolicy.thresholdSessionId,ttlMs:e.lanePolicy.ttlMs,remainingUses:e.lanePolicy.remainingUses,runtimePolicyScope:n},s=e.sessionActivation?k(e.sessionActivation)?await Ae({...r,sessionActivation:e.sessionActivation}):await N({...r,sessionActivation:e.sessionActivation}):await ke({...r,walletSessionMintId:Me(),relayerUrl:e.relayerUrl,routeAuth:e.bootstrapAuth}),c=s.sessionActivation.public_capability.public_identity,l=`authorization`in s?{thresholdSessionId:s.sessionActivation.session.threshold_session_id,authorizationSessionId:s.sessionActivation.session.authorization_session_id,authorizationId:s.sessionActivation.session.authorization_id,walletSessionId:s.sessionActivation.session.wallet_session_id,quotaId:s.sessionActivation.session.quota_id,expiresAtMs:s.sessionActivation.session.expires_at_ms,remainingUses:s.sessionActivation.session.remaining_uses,walletSession:s.authorization.record,operationCredential:s.authorization.operationCredential}:{thresholdSessionId:s.sessionActivation.session.threshold_session_id,authorizationSessionId:s.sessionActivation.session.authorization_session_id,authorizationId:s.sessionActivation.session.authorization_id,walletSessionId:s.sessionActivation.session.wallet_session_id,quotaId:s.sessionActivation.session.quota_id,expiresAtMs:s.sessionActivation.session.expires_at_ms,remainingUses:s.sessionActivation.session.remaining_uses,walletSession:s.sessionActivation.session.wallet_session,operationCredential:s.sessionActivation.session.operation_credential},u=await g({walletId:String(e.key.walletId),signingRootId:e.key.signingRootId,signingRootVersion:e.key.signingRootVersion});return{ok:!0,bootstrapKind:`strict_post_registration`,keygenSessionId:String(e.requestId\|\|``).trim()\|\|a(`tecdsa-keygen`,32,`threshold ECDSA session IDs`),rpId:t,keyHandle:String(e.keyHandle),clientVerifyingShareB64u:c.derivation_client_share_public_key33_b64u,thresholdEcdsaPublicKeyB64u:c.threshold_public_key33_b64u,ethereumAddress:O(i(c.ethereum_address20_b64u)),relayerKeyId:u,relayerVerifyingShareB64u:c.server_public_key33_b64u,participantIds:e.key.participantIds.map(Number),thresholdSessionId:l.thresholdSessionId,authorizationSessionId:l.authorizationSessionId,authorizationId:l.authorizationId,walletSessionId:l.walletSessionId,quotaId:l.quotaId,expiresAtMs:l.expiresAtMs,remainingUses:l.remainingUses,runtimePolicyScope:n,signingRootId:String(e.key.signingRootId),signingRootVersion:String(e.key.signingRootVersion),walletSession:l.walletSession,operationCredential:l.operationCredential,roleLocalActivation:s.roleLocalActivation,routerAbEcdsaDerivationNormalSigning:s.sessionActivation.normal_signing,secretSourceKind:`persisted_role_local`}}function Me(){let e=s(a(`wallet-session-mint`,32,`Wallet Session mint IDs`));if(!e.ok)throw Error(`Failed to create Wallet Session mint identity`);return e.value}async function Ne(e){let t=e.touchIdPrompt.getRpId();if(!t)return{ok:!1,code:`invalid_args`,message:`Missing rpId for WebAuthn`};try{return await je(e,t)}catch(e){return{ok:!1,code:`strict_post_registration_failed`,message:e instanceof Error?e.message:String(e)}}}const P=`stale_ecdsa_key_identity`;function Pe(e){if(!e)throw Error(`Strict ECDSA session bootstrap requires Wallet Session authority`);switch(e.kind){case`opaque_wallet_session_operation_credential_v1`:return e;case`publishable_key`:throw Error(`Strict ECDSA session bootstrap requires Wallet Session authority`)}throw Error(`Strict ECDSA session bootstrap authority is invalid`)}function Fe(e){let t=String(e.code\|\|``).trim(),n=String(e.message\|\|``).trim().toLowerCase();return t===`stale_session_state`&&n.includes(`threshold-ecdsa bootstrap`)&&n.includes(`client verifying share`)&&n.includes(`integrated key record`)}function Ie(e){let t=String(e.message\|\|e.code\|\|`threshold-ecdsa bootstrap failed`).trim(),n=Fe(e)?P:String(e.code\|\|`threshold_ecdsa_bootstrap_failed`).trim()\|\|`threshold_ecdsa_bootstrap_failed`,r=Error(t\|\|`threshold-ecdsa bootstrap failed`);return r.code=n,r}function Le(e){let t=Error(e);return t.code=P,t}function Re(e){switch(e.authKind){case`email_otp`:return`email_otp`;case`passkey`:return`passkey`}return`unknown`}function ze(e){switch(e.bootstrap.secretSourceKind){case`persisted_role_local`:return e.request.authKind===`email_otp`?ae({authSubjectId:e.request.emailOtpWorkerSessionHandle.authSubjectId}):C({credentialIdB64u:e.request.passkeyCredentialIdB64u,rpId:e.bootstrap.rpId})}}function F(e,t){let n=String(e\|\|``).trim().toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(n))throw Error(`threshold-ecdsa exact activation returned invalid ${t}`);return n}function Be(e){let t=F(e.bootstrapOwnerAddress,`server owner address`);if(t!==F(e.key.thresholdOwnerAddress,`key owner address`))throw Le(`threshold-ecdsa exact activation owner address mismatches server bootstrap result`);return t}async function Ve(e,t){let n=l(String(t.key.walletId)),r=t.lanePolicy.chainTarget,i=String(t.lanePolicy.thresholdSessionId).trim();if(e.routerAbNormalSigning.mode!==`enabled`)throw Error(`Router A/B ECDSA derivation normal signing must be enabled for activation`);let a={walletId:n,chainTarget:r,targetKey:u(r),operationId:i\|\|null,authMethod:Re(t),evmFamilyKeyFingerprint:ee(t.key),keyHandle:t.keyHandle,chainTargetKey:u(r),ecdsaThresholdKeyId:String(t.key.ecdsaThresholdKeyId),thresholdSessionId:i\|\|null,freshAuthRetrySideEffectState:`not_applicable`,hasRequestedEcdsaThresholdKeyId:!0,requestedSessionId:i\|\|null,authKind:t.walletSessionRouteAuth?.kind\|\|`none`,passkeyCredentialBound:t.authKind===`passkey`},o;try{o=await Ne({touchIdPrompt:e.touchIdPrompt,relayerUrl:t.relayerUrl,requestId:t.requestId,workerCtx:e.workerCtx,...`preauthorizedSessionActivation`in t&&t.preauthorizedSessionActivation?{sessionActivation:t.preauthorizedSessionActivation}:{bootstrapAuth:Pe(t.walletSessionRouteAuth)},keyHandle:t.keyHandle,key:t.key,lanePolicy:t.lanePolicy,publicCapability:t.publicCapability,existingRoleLocalMaterial:t.existingRoleLocalMaterial})}catch(e){try{console.warn(`[threshold-ecdsa][bootstrap][exception]`,{...a,message:e instanceof Error?e.message:String(e)})}catch{}throw e}if(!o.ok){try{console.warn(`[threshold-ecdsa][bootstrap][failure]`,{...a,code:o.code\|\|``,message:o.message\|\|``})}catch{}throw Ie({code:o.code,message:o.message})}let s=String(t.key.ecdsaThresholdKeyId).trim();if(!s)throw Error(`threshold-ecdsa bootstrap returned empty ecdsaThresholdKeyId`);let c=re(s),d=oe(String(o.keyHandle\|\|``).trim()),f=String(o.relayerKeyId\|\|``).trim();if(!f)throw Error(`threshold-ecdsa bootstrap returned empty relayerKeyId`);let p=te(f),m=String(o.clientVerifyingShareB64u\|\|``).trim();if(!m)throw Error(`threshold-ecdsa bootstrap returned empty clientVerifyingShareB64u`);let h=ie(m),g=String(o.thresholdSessionId\|\|``).trim();if(!g)throw Error(`threshold-ecdsa bootstrap returned empty thresholdSessionId`);let _=Number(o.expiresAtMs);if(!Number.isFinite(_))throw Error(`threshold-ecdsa bootstrap returned invalid expiresAtMs`);let v=Number(o.remainingUses);if(!Number.isFinite(v))throw Error(`threshold-ecdsa bootstrap returned invalid remainingUses`);let y=t.key.participantIds.map(e=>Number(e));if(!y)throw Error(`threshold-ecdsa bootstrap returned empty participantIds`);let b=Be({key:t.key,bootstrapOwnerAddress:o.ethereumAddress}),x=ne({walletId:n,chainTarget:r,keyHandle:d,ecdsaThresholdKeyId:c,signingRootId:o.signingRootId,signingRootVersion:o.signingRootVersion,applicationBindingDigestB64u:o.roleLocalActivation.publicCapability.context.application_binding_digest_b64u,clientParticipantId:1,relayerParticipantId:2,participantIds:y,contextBinding32B64u:o.roleLocalActivation.publicFacts.contextBinding32B64u,derivationClientSharePublicKey33B64u:o.roleLocalActivation.publicFacts.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:o.roleLocalActivation.publicFacts.relayerPublicKey33B64u,groupPublicKey33B64u:o.roleLocalActivation.publicFacts.groupPublicKey33B64u,ethereumAddress:o.roleLocalActivation.publicFacts.ethereumAddress,publicCapability:o.roleLocalActivation.publicCapability}),S=o.routerAbEcdsaDerivationNormalSigning,C=o.roleLocalActivation.roleLocalMaterial,ae=ze({request:t,bootstrap:o}),w={ok:!0,thresholdSessionId:g,authorizationSessionId:o.authorizationSessionId,authorizationId:o.authorizationId,walletSessionId:o.walletSessionId,quotaId:o.quotaId,expiresAtMs:_,remainingUses:v,runtimePolicyScope:o.runtimePolicyScope,walletSession:o.walletSession,operationCredential:o.operationCredential,clientVerifyingShareB64u:h};return{thresholdEcdsaKeyRef:{type:`threshold-ecdsa-secp256k1`,userId:n,chainTarget:r,relayerUrl:t.relayerUrl,keyHandle:d,ecdsaThresholdKeyId:c,backendBinding:{materialKind:`role_local_worker_handle`,relayerKeyId:p,clientVerifyingShareB64u:h,roleLocalMaterialHandle:C,roleLocalMaterialRef:o.roleLocalActivation.roleLocalMaterialRef,publicFacts:x,authMethod:ae},participantIds:y,thresholdEcdsaPublicKeyB64u:o.thresholdEcdsaPublicKeyB64u,ethereumAddress:b,relayerVerifyingShareB64u:o.relayerVerifyingShareB64u,routerAbEcdsaDerivationNormalSigning:S},session:w}}async function He(e,t){return await Ve(e,t)}function Ue(e){let t;try{t=c(e.evidenceSetDigest)}catch(e){throw Error(e instanceof Error?e.message:`ECDSA explicit export evidence digest is invalid`)}let n=Math.floor(Number(e.expiresAtMs)),r=v(e.operation);if(r.operation_kind!==`evm.export_key`)throw Error(`ECDSA explicit export operation kind is invalid`);if(!Number.isSafeInteger(n)\|\|n<=Date.now())throw Error(`ECDSA explicit export operation authorization expiry is invalid`);let i=We(e.unseal);return{kind:`verified_step_up`,evidenceSetDigest:t,operation:r,expiresAtMs:n,quotaUse:`none`,unseal:i}}function We(e){switch(e.kind){case`not_requested`:return{kind:`not_requested`};case`email_otp_grant`:{let t=String(e.grant\|\|``).trim(),n=String(e.challenge_id\|\|``).trim();if(!t\|\|!n)throw Error(`ECDSA explicit export Email OTP unseal grant is invalid`);return{kind:`email_otp_grant`,grant:t,challenge_id:n}}default:{let t=e;throw Error(`Unsupported ECDSA explicit export unseal state: ${String(t)}`)}}}async function I(e){let t=String(e.relayerUrl\|\|``).trim();if(!t)throw Error(`ECDSA explicit export relayer URL is required`);return{kind:`explicit_key_export_ecdsa_activation_result`,purpose:`explicit_key_export`,material:{kind:`auth_neutral_ecdsa_export_material_v1`,relayerUrl:t,persistedMaterial:e.existingRoleLocalMaterial},authorization:Ue(e.authorization)}}function L(e,t){let n=String(e\|\|t\|\|``).trim();if(!n)throw Error(`Missing relayer url (configs.network.relayer.url)`);return n}function R(e){return`key`in e&&!!e.key&&`keyHandle`in e&&!!String(e.keyHandle\|\|``).trim()}function z(e){return R(e)?e.key.walletId:e.walletId}function B(e){return R(e)?e.lanePolicy.chainTarget:e.chainTarget}function Ge(e){return e.kind===`email_otp_ecdsa_bootstrap`?{authMethod:f.emailOtp,signerSource:d.emailOtpRegistration}:{authMethod:f.passkey,signerSource:d.passkeyRegistration}}function Ke(e){switch(e.kind){case`passkey_preauthorized_ecdsa_bootstrap`:case`wallet_session_reconnect_ecdsa_bootstrap`:return e.authorizationAuthority;case`passkey_fresh_ecdsa_bootstrap`:case`email_otp_ecdsa_bootstrap`:return e.existingRoleLocalMaterial.authority}}function qe(e){if(!(`sessionActivation`in e.request)\|\|!e.request.sessionActivation)return;let t=e.request.sessionActivation,n=k(t)?t.activation:t,r=k(t)?t.authorization:{record:t.session.wallet_session,operationCredential:t.session.operation_credential};ue({walletId:e.walletId,authority:e.authority,walletSession:r.record,operationCredential:r.operationCredential,expectedAuthorizationId:n.session.authorization_id,expectedWalletSessionId:n.session.wallet_session_id,expectedQuotaId:n.session.quota_id,expectedExpiresAtMs:n.session.expires_at_ms}),e.request.kind===`passkey_preauthorized_ecdsa_bootstrap`&&de({expected:e.request.authorizationIdentity,walletSession:r.record})}function Je(e,t){let n=(e,n,r)=>({kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},...r,...n?{walletSessionRouteAuth:n}:{}}),r=e=>({kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u,preauthorizedSessionActivation:e.sessionActivation});switch(e.kind){case`passkey_fresh_ecdsa_bootstrap`:return n(e,e.routeAuth,{authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u});case`passkey_preauthorized_ecdsa_bootstrap`:return r(e);case`wallet_session_reconnect_ecdsa_bootstrap`:return n(e,e.routeAuth,{authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u});case`email_otp_ecdsa_bootstrap`:{let r={authKind:`email_otp`,emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle};return e.sessionActivation?{kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},...r,preauthorizedSessionActivation:e.sessionActivation}:n(e,e.routeAuth,r)}}throw Error(`[SigningEngine][ecdsa] unsupported ECDSA bootstrap request`)}function Ye(e,t){return{purpose:`explicit_key_export`,relayerUrl:t,existingRoleLocalMaterial:e.existingRoleLocalMaterial,authorization:e.authorization}}function Xe(e,t){return{purpose:`explicit_key_export`,relayerUrl:t,existingRoleLocalMaterial:e.existingRoleLocalMaterial,authorization:e.authorization}}async function Ze(e,t){if(t.kind===`reuse_warm_ecdsa_bootstrap`)throw Error(`[SigningEngine][ecdsa] reuse_warm bootstrap must resolve an existing exact material request before activation`);let n=Ke(t),r=l(z(t)),i=B(t),a=L(t.relayerUrl,e.defaultRelayerUrl),o=e.getSignerWorkerContext(),s={touchIdPrompt:e.touchIdPrompt,workerCtx:o,routerAbNormalSigning:e.routerAbNormalSigning};qe({request:t,walletId:r,authority:n});let c=await He(s,Je(t,a)),u=Ge(t);return await e.persistThresholdEcdsaBootstrapForWalletTarget({walletId:r,chainTarget:i,bootstrap:c,signerAuth:u}),await t.beforeAuthorizationPersistence?.(),await fe(se,{walletId:r,authority:n,bootstrap:c}),c}async function Qe(e,t){return await I(Ye(t,L(t.relayerUrl,e.defaultRelayerUrl)))}async function $e(e,t){return await I(Xe(t,L(t.relayerUrl,e.defaultRelayerUrl)))}async function V(e,t,n){let r=String(t),i=(e.get(r)\|\|Promise.resolve()).catch(()=>void 0),a,o=new Promise(e=>{a=e}),s=i.then(()=>o);e.set(r,s),await i;try{return await n()}finally{a(),e.get(r)===s&&e.delete(r)}}function et(e,t){return t.runtimeScopeBootstrap&&(e.runtimeScopeBootstrap=t.runtimeScopeBootstrap),t.operationIntent&&(e.operationIntent=t.operationIntent),typeof t.ttlMs==`number`&&(e.ttlMs=t.ttlMs),e}function H(e){return et({kind:`email_otp_ecdsa_activation`,purpose:`transaction_signing`,walletKey:e.walletKey,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,source:e.source,relayerUrl:e.relayerUrl,sessionIdentity:e.sessionIdentity,sessionKind:e.sessionKind,sessionBudgetUses:e.sessionBudgetUses,runtimePolicy:e.runtimePolicy,emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle,emailOtpAuthContext:e.emailOtpAuthContext,...`preauthorizedSessionActivation`in e?{preauthorizedSessionActivation:e.preauthorizedSessionActivation}:{walletSessionRouteAuth:e.walletSessionRouteAuth}},e)}function U(e){if(le(e.context)!==e.expected)throw Error(`Email OTP ${e.label} activation requires ${e.expected} retention`)}function tt(e){return U({context:e.emailOtpAuthContext,expected:`session`,label:`session bootstrap`}),H(e)}function nt(e){return U({context:e.emailOtpAuthContext,expected:`session`,label:`recovered session`}),H(e)}function rt(e){return U({context:e.emailOtpAuthContext,expected:`session`,label:`preauthorized session bootstrap`}),H(e)}function it(e){return U({context:e.emailOtpAuthContext,expected:`single_use`,label:`per-operation reauth`}),H(e)}function at(e){return{kind:`email_otp_ecdsa_export_activation`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}function ot(e){return{kind:`passkey_ecdsa_export_activation`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}function st(e){switch(e.kind){case`default_policy`:return;case`scoped_policy`:return e.scope}throw Error(`[SigningEngine][ecdsa] unsupported ECDSA activation policy`)}function W(e,t){t.runtimeScopeBootstrap&&(e.runtimeScopeBootstrap=t.runtimeScopeBootstrap),t.operationIntent&&(e.operationIntent=t.operationIntent);let n=st(t.runtimePolicy);return`walletId`in e&&(typeof t.ttlMs==`number`&&(e.ttlMs=t.ttlMs),n&&(e.runtimePolicyScope=n)),e}function ct(e){switch(e.kind){case`passkey_ecdsa_activation`:return{kind:`passkey_existing_session_activation`,request:e};case`email_otp_ecdsa_activation`:return{kind:`email_otp_existing_session_activation`,request:e}}throw Error(`[SigningEngine][ecdsa] unsupported activation request`)}function lt(e){let t=String(e.webauthnAuthentication.rawId\|\|e.webauthnAuthentication.id\|\|``).trim();if(!t)throw Error(`[SigningEngine][ecdsa] passkey activation requires credential identity`);return t}function ut(e){let t=ct(e);switch(t.kind){case`passkey_existing_session_activation`:return W({kind:`passkey_fresh_ecdsa_bootstrap`,keyHandle:t.request.walletKey.keyHandle,key:x(t.request.walletKey),lanePolicy:t.request.lanePolicy,publicCapability:t.request.publicCapability,existingRoleLocalMaterial:t.request.existingRoleLocalMaterial,source:t.request.source,relayerUrl:t.request.relayerUrl,requestId:t.request.requestId,passkeyCredentialIdB64u:lt(t.request),routeAuth:t.request.walletSessionRouteAuth},t.request);case`email_otp_existing_session_activation`:{let e={kind:`email_otp_ecdsa_bootstrap`,keyHandle:t.request.walletKey.keyHandle,key:x(t.request.walletKey),lanePolicy:t.request.lanePolicy,publicCapability:t.request.publicCapability,existingRoleLocalMaterial:t.request.existingRoleLocalMaterial,source:`email_otp`,relayerUrl:t.request.relayerUrl,emailOtpWorkerSessionHandle:t.request.emailOtpWorkerSessionHandle,emailOtpAuthContext:t.request.emailOtpAuthContext};return t.request.preauthorizedSessionActivation?W({...e,sessionActivation:t.request.preauthorizedSessionActivation},t.request):W({...e,routeAuth:t.request.walletSessionRouteAuth},t.request)}}throw Error(`[SigningEngine][ecdsa] unsupported activation request`)}function dt(e){return{kind:`passkey_ecdsa_export_bootstrap`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}async function ft(e){let t=e.bootstrap.thresholdEcdsaKeyRef.backendBinding;if(!t)throw Error(`[WarmSessionStore] threshold ECDSA bootstrap is missing its backend binding`);let n=pt(t);if(!n)return;let r=await e.deps.persistEcdsaRoleLocalReadyRecord({record:n,storageKeyFacts:S(n)});if(!r.ok)throw Error(`[WarmSessionStore] threshold ECDSA role-local ready record persistence failed (${r.code}): ${r.message}`)}function pt(e){switch(e.materialKind){case`role_local_ready_state_blob`:return e.ecdsaRoleLocalReadyRecord;case`role_local_worker_handle`:case`role_local_durable_public_anchor`:case`role_local_durable_sealed_ref`:case`metadata_only`:return null;default:{let t=e;throw Error(`[WarmSessionStore] unsupported threshold ECDSA backend binding: ${JSON.stringify(t)}`)}}}async function G(e,t){let n=l(z(t));return await V(e.queueByWallet,n,async()=>{let n=await Ze(e.activationDeps,t);return await ft({deps:e,bootstrap:n}),n})}async function mt(e,t){return await G(e,ut(t))}async function ht(e,t){return await Qe(e.activationDeps,dt(t))}async function gt(e,t){let n={kind:`email_otp_ecdsa_export_bootstrap`,purpose:`explicit_key_export`,existingRoleLocalMaterial:t.existingRoleLocalMaterial,relayerUrl:t.relayerUrl,authorization:t.authorization};return await $e(e.activationDeps,n)}const K=`ecdsa-derivation:role-local:product-export-confirmation:v5`,q=`ecdsa-derivation:role-local:product-export-authorization:v5`;function J(e){return{kind:`operation_step_up`}}function Y(e){return{authorizationKind:e.kind,authorizationId:e.evidenceSetDigest}}function X(){let e=globalThis.crypto;if(!e\|\|typeof e.getRandomValues!=`function`)throw Error(`crypto.getRandomValues is required for threshold ECDSA export`);return r(e.getRandomValues(new Uint8Array(32)))}async function Z(e){let t=String(e.relayerUrl\|\|``).trim().replace(/\/+$/g,``);if(!t)throw Error(`[SigningEngine][ecdsa-export] relayer URL is required`);if(e.authorization.kind===`wallet_session_bearer`&&!e.authorization.token.trim())throw Error(`[SigningEngine][ecdsa-export] Wallet Session operation credential is required`);let n={"Content-Type":`application/json`};e.authorization.kind===`wallet_session_bearer`&&(n.Authorization=`Bearer ${e.authorization.token}`);try{let r=await fetch(`${t}${_}`,{method:`POST`,credentials:e.authorization.kind===`legacy_cookie`?`include`:`omit`,headers:n,body:JSON.stringify({request:e.request,requestDigestB64u:e.requestDigestB64u})}),i=await r.json().catch(()=>null);if(!r.ok){let e=i&&typeof i==`object`&&!Array.isArray(i)?i:null;return{ok:!1,code:String(e?.code\|\|`http_error`),message:String(e?.message\|\|`HTTP ${r.status}`)}}return{ok:!0,value:h(i)}}catch(e){return{ok:!1,error:e instanceof Error?e.message:String(e)}}}async function _t(e){return await Z({...e,authorization:{kind:`legacy_cookie`}})}async function vt(e){return await Z({relayerUrl:e.relayerUrl,request:e.request,requestDigestB64u:e.requestDigestB64u,authorization:{kind:`wallet_session_bearer`,token:e.operationCredential.token}})}function Q(e){let t=Math.min(e.issuedAtUnixMs+6e4,e.authorizationExpiresAtMsCeiling??1/0);if(Number.isFinite(t)&&t>e.issuedAtUnixMs)return t;throw new be({failure:ye(ve.expired),message:`Wallet Session expired before ECDSA export authorization`})}function yt(e){if(String(e.material.persistedMaterial.publicFacts.walletId)!==String(e.walletSessionUserId))throw Error(`[SigningEngine][ecdsa-export] explicit export wallet mismatch`)}async function $(e){return r(await n(t(e)))}function bt(e){switch(e.kind){case`rehydrated`:return e;case`device_link_required`:throw Error(`[SigningEngine][ecdsa-export] device_link_required: local threshold ECDSA material is unavailable`);case`corrupt`:throw Error(`[SigningEngine][ecdsa-export] local threshold ECDSA material is corrupt (${e.reason}): ${e.message}`);default:{let t=e;throw Error(`Unsupported ECDSA export material resolution: ${String(t)}`)}}}async function xt(e){return bt(await D({purpose:`explicit_key_export`,source:E(e.persistedMaterial),workerCtx:e.workerCtx}))}function St(e){let t=Y(e.material.operationAuthorization),n=e.material.persistedMaterial.publicFacts;return{version:q,operation:`explicit_key_export`,keyHandle:n.keyHandle,walletId:String(n.walletId),ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,relayerKeyId:n.publicCapability.signer_set.selected_server.server_id,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,contextBinding32B64u:e.contextBinding32B64u,publicIdentity:e.publicIdentity,exportRequestNonce32B64u:e.exportRequestNonce32B64u,confirmationDigest32B64u:e.confirmationDigest32B64u,issuedAtUnixMs:e.issuedAtUnixMs,expiresAtUnixMs:e.expiresAtUnixMs,authorizationKind:t.authorizationKind,authorizationId:t.authorizationId,materialActivation:b(e.material.persistedMaterial.materialActivation),participantIds:n.participantIds}}async function Ct(e,t){let n=t.persistedMaterial.publicFacts,r=b(t.persistedMaterial.materialActivation);switch(t.factorAuthorization.kind){case`passkey`:{let e=String(t.factorAuthorization.credential.rawId\|\|t.factorAuthorization.credential.id\|\|``).trim();if(!e)throw Error(`[SigningEngine][ecdsa-export] passkey authorization credential is missing`);if(e!==t.factorAuthorization.passkeyCredentialIdB64u)throw Error(`[SigningEngine][ecdsa-export] passkey export authorization credential mismatch`);break}case`email_otp_verified`:break;default:{let e=t.factorAuthorization;throw Error(`Unsupported ECDSA export authorization: ${String(e)}`)}}let i=Date.now(),a=Q({issuedAtUnixMs:i,authorizationExpiresAtMsCeiling:t.operationAuthorization.expiresAtMs}),o={derivationClientSharePublicKey33B64u:n.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:n.relayerPublicKey33B64u,groupPublicKey33B64u:n.groupPublicKey33B64u,ethereumAddress:n.ethereumAddress},s=X(),c=Y(t.operationAuthorization),l=await $({version:K,walletId:String(n.walletId),ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,relayerKeyId:n.publicCapability.signer_set.selected_server.server_id,contextBinding32B64u:n.contextBinding32B64u,publicIdentity:o,authorizationKind:c.authorizationKind,authorizationId:c.authorizationId,materialActivation:r,exportRequestNonce32B64u:s,issuedAtUnixMs:i,expiresAtUnixMs:a}),u=await $(St({ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,contextBinding32B64u:n.contextBinding32B64u,publicIdentity:o,exportRequestNonce32B64u:s,confirmationDigest32B64u:l,issuedAtUnixMs:i,expiresAtUnixMs:a,material:t})),d=n.publicCapability,f=`ecdsa-export:${s}`,p=await pe({workerCtx:e.getSignerWorkerContext(),command:{kind:`create_router_ab_ecdsa_explicit_export_ceremony_v1`,ceremonyId:f,request:{context:d.context,lifecycle:{lifecycle_id:f,work_kind:`key_export`,primitive_request_kind:`export`,root_share_epoch:d.activation_epoch,account_id:String(n.walletId),session_id:T.thresholdEcdsaSession(f),signer_set_id:d.signer_set.signer_set_id,selected_server_id:d.signer_set.selected_server.server_id},public_identity:d.public_identity,signer_set:d.signer_set,router_id:d.router_id,client_id:d.client_id,authorization:J(t.operationAuthorization),authorization_id:t.operationAuthorization.evidenceSetDigest,operation:t.operationAuthorization.operation,material_activation:r,export_authorization_digest_b64u:u,export_nonce:s,expires_at_ms:a,deriver_recipient_keys:d.deriver_recipient_keys}}});if(p.kind!==`router_ab_ecdsa_explicit_export_ceremony_created_v1`)throw Error(`[SigningEngine][ecdsa-export] strict export ceremony kind mismatch`);try{let i=await _t({relayerUrl:t.relayerUrl,request:p.request,requestDigestB64u:p.requestDigestB64u});if(!i.ok)throw Error(i.error\|\|i.message\|\|i.code\|\|`Strict ECDSA explicit export request failed`);let a=await me({workerCtx:e.getSignerWorkerContext(),command:{kind:`finalize_router_ab_ecdsa_explicit_export_v1`,ceremonyId:f,clientProofFinalization:{kind:`finalize_encrypted_client_proof_bundles_v2`,bundles:i.value.response.bundles},signingWorkerExport:i.value.signing_worker_export,authorizationKind:c.authorizationKind,authorizationId:c.authorizationId,materialActivation:r,roleLocalMaterial:t.liveMaterial.liveHandle,roleLocalMaterialRef:t.liveMaterial.materialRef,publicFacts:n}});return{publicKeyHex:a.publicKeyHex,privateKeyHex:a.privateKeyHex,ethereumAddress:a.ethereumAddress}}catch(t){throw await ge({workerCtx:e.getSignerWorkerContext(),command:{kind:`close_router_ab_ecdsa_post_registration_ceremony_v1`,ceremonyId:f}}).catch(()=>void 0),t}}async function wt(e,t){let n=t.exportProvision.material;yt({material:n,walletSessionUserId:t.walletSessionUserId});let r=String(n.relayerUrl\|\|``).trim();if(!r)throw Error(`[SigningEngine][ecdsa-export] relayer URL is required`);let i=n.persistedMaterial;return await Ct(e,{persistedMaterial:i,liveMaterial:await xt({persistedMaterial:i,workerCtx:e.getSignerWorkerContext()}),relayerUrl:r,operationAuthorization:t.exportProvision.authorization,factorAuthorization:t.factorAuthorization})}function Tt(t){let n=t.runtime.normalSigning.scope,r=t.operationAuthorization.operation,i=y(r.material_activation);if(r.operation_kind!==`evm.export_key`\|\|r.wallet_id!==String(t.runtime.walletId)\|\|r.key_handle!==t.runtime.publicFacts.keyHandle\|\|r.relayer_key_id!==t.runtime.relayerKeyId\|\|r.participant_ids[0]!==t.runtime.publicFacts.participantIds[0]\|\|r.participant_ids[1]!==t.runtime.publicFacts.participantIds[1]\|\|r.signing_worker_id!==n.signing_worker.server_id\|\|r.normal_signing_scope.wallet_id!==n.wallet_id\|\|r.normal_signing_scope.context.application_binding_digest_b64u!==n.context.application_binding_digest_b64u\|\|r.normal_signing_scope.public_identity.context_binding_b64u!==n.public_identity.context_binding_b64u\|\|r.normal_signing_scope.public_identity.threshold_public_key33_b64u!==n.public_identity.threshold_public_key33_b64u\|\|r.normal_signing_scope.signing_worker.server_id!==n.signing_worker.server_id\|\|!e(i,t.runtime.materialActivation)\|\|!e(y(r.normal_signing_scope.material_activation),t.runtime.materialActivation))throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority operation identity changed`)}async function Et(e,t){Tt(t);let n=t.runtime,r=n.normalSigning.scope;if(t.operationAuthorization.exportTopology.signer_set.selected_server.server_id!==r.signing_worker.server_id)throw Error(`[SigningEngine][ecdsa-export] active export topology changed`);let i=r.material_activation,a=Date.now(),o=Q({issuedAtUnixMs:a,authorizationExpiresAtMsCeiling:t.operationAuthorization.expiresAtMs}),s={derivationClientSharePublicKey33B64u:r.public_identity.derivation_client_share_public_key33_b64u,relayerPublicKey33B64u:r.public_identity.server_public_key33_b64u,groupPublicKey33B64u:r.public_identity.threshold_public_key33_b64u,ethereumAddress:n.publicFacts.thresholdOwnerAddress},l=X(),u=Y(t.operationAuthorization),d=await $({version:K,walletId:String(n.walletId),ecdsaThresholdKeyId:r.ecdsa_threshold_key_id,relayerKeyId:n.relayerKeyId,contextBinding32B64u:r.public_identity.context_binding_b64u,publicIdentity:s,authorizationKind:u.authorizationKind,authorizationId:u.authorizationId,materialActivation:i,exportRequestNonce32B64u:l,issuedAtUnixMs:a,expiresAtUnixMs:o}),f=await $({version:q,operation:`explicit_key_export`,keyHandle:n.publicFacts.keyHandle,walletId:String(n.walletId),ecdsaThresholdKeyId:r.ecdsa_threshold_key_id,relayerKeyId:n.relayerKeyId,signingRootId:r.signing_root_id,signingRootVersion:r.signing_root_version,contextBinding32B64u:r.public_identity.context_binding_b64u,publicIdentity:s,exportRequestNonce32B64u:l,confirmationDigest32B64u:d,issuedAtUnixMs:a,expiresAtUnixMs:o,authorizationKind:u.authorizationKind,authorizationId:u.authorizationId,materialActivation:i,participantIds:n.publicFacts.participantIds}),p=`ecdsa-export:${l}`,m={context:r.context,lifecycle:{lifecycle_id:p,work_kind:`key_export`,primitive_request_kind:`export`,root_share_epoch:r.activation_epoch,account_id:r.wallet_id,session_id:T.thresholdEcdsaSession(p),signer_set_id:t.operationAuthorization.exportTopology.signer_set.signer_set_id,selected_server_id:t.operationAuthorization.exportTopology.signer_set.selected_server.server_id},public_identity:r.public_identity,signer_set:t.operationAuthorization.exportTopology.signer_set,router_id:t.operationAuthorization.exportTopology.router_id,client_id:String(n.walletId),authorization:J(t.operationAuthorization),operation:t.operationAuthorization.operation,authorization_id:c(t.operationAuthorization.evidenceSetDigest),material_activation:i,export_authorization_digest_b64u:f,export_nonce:l,expires_at_ms:o,deriver_recipient_keys:t.operationAuthorization.exportTopology.deriver_recipient_keys},h=await he({holderHandleId:n.holderRuntime.holderHandleId,request:m,workerCtx:e.getSignerWorkerContext()});if(h.kind!==`ecdsa_holder_ordinary_export_request_created_v1`)throw Error(`[SigningEngine][ecdsa-export] active holder export request kind mismatch`);let g=await vt({relayerUrl:t.relayerUrl,request:h.request,requestDigestB64u:h.requestDigestB64u,operationCredential:n.operationCredential});if(!g.ok)throw Error(g.error\|\|g.message\|\|g.code\|\|`Active Wallet Authority ECDSA export request failed`);let _={wallet_id:r.wallet_id,key_handle:n.publicFacts.keyHandle,ecdsa_threshold_key_id:r.ecdsa_threshold_key_id,signing_root_id:r.signing_root_id,signing_root_version:r.signing_root_version,activation_epoch:r.activation_epoch,signing_worker_id:r.signing_worker.server_id,context_binding_b64u:r.public_identity.context_binding_b64u,threshold_public_key33_b64u:r.public_identity.threshold_public_key33_b64u,export_request_digest_b64u:h.requestDigestB64u,export_authorization_digest_b64u:f,export_nonce:l,authorization_kind:`verified_step_up`,authorization_id:t.operationAuthorization.evidenceSetDigest,material_activation:i,lifecycle_id:p,recipient_identity:h.request.client_id,recipient_public_key:h.request.client_ephemeral_public_key,expires_at_ms:h.request.expires_at_ms},v=await _e({holderHandleId:n.holderRuntime.holderHandleId,requestDigestB64u:h.requestDigestB64u,expectedBinding:_,forwardedResponse:g.value,workerCtx:e.getSignerWorkerContext()});return{publicKeyHex:v.publicKeyHex,privateKeyHex:v.privateKeyHex,ethereumAddress:v.ethereumAddress}}export{k as _,it as a,tt as c,mt as d,G as f,A as g,z as h,at as i,gt as l,B as m,wt as n,rt as o,V as p,ot as r,nt as s,Et as t,ht as u,xe as v,Se as y};

package/dist/esm/sdk/{ecdsaWalletRecords-CHfrYvKr.js → ecdsaWalletRecords-C_v74n5X.js} RENAMED Viewed

	@@ -1 +1 @@
1	- import"./accountIds-Cpvlkvbe.js";import"./registrationSignerPlan-~~CPzHavPM~~.js";import"./signerDomain-~~Dp7BhfmZ~~.js";import{C as e,D as t,E as n,S as r,n as i}from"./accountLifecycle-~~CBOkr0vU~~.js";import"./registrationIds-~~BaK3jUS6~~.js";function a(a){return{storeWalletEcdsaSignerRecords:t=>e(a.accountLifecycle,t),storeWalletEmailOtpEcdsaSignerRecords:e=>t(a.accountLifecycle,e),storeWalletEcdsaRecoverySignerRecords:e=>r(a.accountLifecycle,e),finalizeWalletEcdsaRegistration:e=>i(a.accountLifecycle,e),storeWalletEmailOtpEcdsaRegistrationData:e=>n(a.accountLifecycle,e)}}export{a as createEcdsaWalletRecordsService};
1	+ import"./accountIds-Cpvlkvbe.js";import"./registrationSignerPlan-BHkqlian.js";import"./signerDomain-BFqRQ0Jl.js";import{C as e,D as t,E as n,S as r,n as i}from"./accountLifecycle-D61FIpFS.js";import"./registrationIds-Br-zI4_5.js";function a(a){return{storeWalletEcdsaSignerRecords:t=>e(a.accountLifecycle,t),storeWalletEmailOtpEcdsaSignerRecords:e=>t(a.accountLifecycle,e),storeWalletEcdsaRecoverySignerRecords:e=>r(a.accountLifecycle,e),finalizeWalletEcdsaRegistration:e=>i(a.accountLifecycle,e),storeWalletEmailOtpEcdsaRegistrationData:e=>n(a.accountLifecycle,e)}}export{a as createEcdsaWalletRecordsService};

package/dist/{public/sdk/emailOtpEcdsaDerivationIdentity-Bik0N8v9.js → esm/sdk/emailOtpEcdsaDerivationIdentity-BDVjvnmO.js} RENAMED Viewed

	@@ -1 +1 @@
1	- import{E as e,M as t,O as n,T as r,_ as i,a,h as o,j as s,n as c,s as l,x as u,y as ee}from"./domainIds-BzkGsRqO.js";import{c as d,h as te,k as f,u as p}from"./chains-C_X_fNuS.js";import{_ as ne,l as re,t as m,w as ie,x as ae,y as oe}from"./primitives-CqrjmIAH.js";import{i as h,r as g}from"./base64-DW79QA0h.js";import{i as se,n as ce}from"./activeWalletSession-WdZkhtBB.js";import{d as le,g as ue,h as de,m as fe,n as pe,u as me}from"./capabilityKinds-N8xo_IEh.js";import{n as he,r as ge}from"./canonicalPrimitives-Dsbsxgxc.js";import{c as _,l as _e}from"./ecdsaChainTarget-Bfatk3oP.js";import{n as ve}from"./signerDomain-Dp7BhfmZ.js";import{c as ye}from"./digestEncoding-BX3VW9eF.js";import{r as be}from"./types-hKLqDUhR.js";function xe(e,t){let n=te(e,t);if(!/^x25519:[0-9a-f]{64}$/.test(n))throw Error(`${t} must use x25519:<64 lowercase hex chars> encoding`);return n}function Se(e,t,n){let r=Object.keys(e).sort(),i=[...t].sort();if(r.length!==i.length\|\|r.some((e,t)=>e!==i[t]))throw Error(`${n} has invalid fields`)}function v(e,t){if(typeof e!=`string`\|\|e.trim()!==e\|\|!e)throw Error(`${t} is required`);if(!/^[\x20-\x7e]+$/.test(e))throw Error(`${t} must be printable ASCII`);return e}function y(e){let t=f(e,`authorization`);switch(t.kind){case`reusable_wallet_session`:return Se(t,[`kind`,`wallet_session_id`],`authorization`),{kind:`reusable_wallet_session`,wallet_session_id:v(t.wallet_session_id,`authorization.wallet_session_id`)};case`operation_step_up`:return Se(t,[`kind`],`authorization`),{kind:`operation_step_up`};default:throw Error(`authorization.kind is not supported`)}}function b(e){let t=f(e,`material_activation`);if(Se(t,[`kind`,`activation_id`,`capability`,`material_owner`,`key_binding`,`lifecycle_binding`,`signing_worker`],`material_activation`),t.kind!==`mpc_material_activation_ref`)throw Error(`material_activation.kind is not supported`);return{kind:`mpc_material_activation_ref`,activation_id:v(t.activation_id,`material_activation.activation_id`),capability:v(t.capability,`material_activation.capability`),material_owner:v(t.material_owner,`material_activation.material_owner`),key_binding:v(t.key_binding,`material_activation.key_binding`),lifecycle_binding:v(t.lifecycle_binding,`material_activation.lifecycle_binding`),signing_worker:v(t.signing_worker,`material_activation.signing_worker`)}}function Ce(e){return b({kind:e.kind,activation_id:e.activationId,capability:e.capability,material_owner:e.materialOwner,key_binding:e.keyBinding,lifecycle_binding:e.lifecycleBinding,signing_worker:e.signingWorker})}function we(e){let t=b(e),n=o({kind:t.kind,activationId:t.activation_id,capability:t.capability,materialOwner:t.material_owner,keyBinding:t.key_binding,lifecycleBinding:t.lifecycle_binding,signingWorker:t.signing_worker});if(!n.ok)throw Error(`material_activation is invalid: ${n.error.message}`);return n.value}function Te(e){return new TextEncoder().encode(e)}function x(e,t){let n=Te(t),r=n.length>>>0;e.push(r>>>24&255,r>>>16&255,r>>>8&255,r&255),e.push(...n)}function Ee(e){let t=y(e),n=[];switch(x(n,t.kind),t.kind){case`reusable_wallet_session`:x(n,t.wallet_session_id);break;case`operation_step_up`:break}return new Uint8Array(n)}function S(e){let t=b(e),n=[];return x(n,t.kind),x(n,t.activation_id),x(n,t.capability),x(n,t.material_owner),x(n,t.key_binding),x(n,t.lifecycle_binding),x(n,t.signing_worker),new Uint8Array(n)}function C(e,t){return e.kind===t.kind&&e.activation_id===t.activation_id&&e.capability===t.capability&&e.material_owner===t.material_owner&&e.key_binding===t.key_binding&&e.lifecycle_binding===t.lifecycle_binding&&e.signing_worker===t.signing_worker}function De(e){let t=e.trim(),n=g(t);if(n.length!==33\|\|h(n)!==t)throw Error(`ECDSA client root public key must be canonical base64url for 33 bytes`);return t}function Oe(e,t){let n=String(e??``).trim();if(!n)throw Error(`${t} is required`);return n}function ke(e){return Oe(e,`ecdsaThresholdKeyId`)}function Ae(e){return Oe(e,`signingRootId`)}function je(e){return Oe(e,`signingRootVersion`)}async function Me(e){let t=ye(e);return`ederivation-relayer-${h(await p(d({version:`threshold_ecdsa_derivation_relayer_key_id_v1`,schemeId:`threshold-secp256k1-ecdsa-2p-v1`,walletId:e.walletId,evmFamilySigningKeySlotId:t})))}`}function w(e,t){if(typeof e!=`string`\|\|e.trim()!==e\|\|e.length===0)throw Error(`${t} must be a non-empty canonical string`);return e}function T(e,t,n){if(typeof e!=`string`\|\|!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be unpadded base64url`);let r;try{r=g(e)}catch{throw Error(`${t} must be valid base64url`)}if(r.length===0\|\|n!==null&&r.length!==n\|\|h(r)!==e)throw Error(`${t} has an invalid canonical byte length`);return e}function Ne(e){return w(e,`ECDSA signer id`)}function Pe(e){return w(e,`ECDSA server generation`)}function Fe(e){return w(e,`ECDSA manifest id`)}function Ie(e){if(!Number.isSafeInteger(e)\|\|Number(e)<1)throw Error(`ECDSA manifest revision must be a positive safe integer`);return e}function Le(e){return T(e,`ECDSA ciphertext digest`,32)}function Re(e){return T(e,`ECDSA pending ciphertext digest`,32)}function ze(e){return T(e,`ECDSA activation digest`,32)}function Be(e){return w(e,`ECDSA lifecycle id`)}function Ve(e){return w(e,`ECDSA material sealing key id`)}function He(e){return T(e,`ECDSA AES-GCM IV`,12)}function Ue(e){return T(e,`ECDSA ciphertext`,null)}function We(e){if(typeof e!=`string`\|\|e.trim()!==e)throw Error(`ECDSA server activation request must be canonical JSON`);let t;try{t=JSON.parse(e)}catch{throw Error(`ECDSA server activation request must be canonical JSON`)}if(typeof t!=`object`\|\|!t\|\|Array.isArray(t)\|\|d(t)!==e)throw Error(`ECDSA server activation request must be a canonical JSON object`);return e}function E(e){return e.factor.kind===`passkey`}function D(e){return e.factor.kind===`email_otp`}function Ge(e,t){return e.walletId!==t.walletId\|\|e.bindingId!==t.bindingId?!1:E(e)?E(t)?e.factor.credentialIdB64u===t.factor.credentialIdB64u&&e.verifier.rpId===t.verifier.rpId:!1:D(e)&&D(t)?e.factor.provider===t.factor.provider&&e.factor.providerUserId===t.factor.providerUserId&&e.verifier.emailHashHex===t.verifier.emailHashHex:!1}function Ke(t){if(!t\|\|typeof t!=`object`\|\|Array.isArray(t))return null;let i=t,a=Object.keys(i);if(a.length!==4\|\|!a.every(e=>[`kind`,`walletId`,`authorityDigest`,`walletAuthMethodId`].includes(e))\|\|i.kind!==`wallet_auth_authority_ref`)return null;let o=n(i.walletId),s=e(i.authorityDigest),c=r(i.walletAuthMethodId);return!o.ok\|\|!s.ok\|\|!c.ok?null:{kind:`wallet_auth_authority_ref`,walletId:o.value,authorityDigest:s.value,walletAuthMethodId:c.value}}function qe(e){let t=String(e\|\|``).trim().toLowerCase();return t===`google`\|\|t===`email`?t:null}function O(e,t){if(e.ok)return e.value;throw Error(t)}function Je(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function Ye(e,t){for(let n of t)if(Je(e,n))return!0;return!1}function Xe(e){let i=O(n(e.walletId),`Passkey wallet auth authority requires walletId`),a=O(t(e.rpId),`Passkey wallet auth authority requires rpId`),o=O(s(e.credentialIdB64u),`Passkey wallet auth authority requires credentialIdB64u`),c=O(r(`passkey:${a}:${o}`),`Passkey wallet auth authority requires bindingId`);return{walletId:i,factor:{kind:`passkey`,credentialIdB64u:o},verifier:{kind:`webauthn`,rpId:a},bindingId:c}}function Ze(e){let t=qe(e.provider);if(!t)throw Error(`Email OTP factor identity requires provider`);return{kind:`email_otp`,provider:t,providerUserId:O(l(e.providerUserId),`Email OTP factor identity requires providerUserId`)}}function Qe(e){let t=O(n(e.walletId),`Email OTP wallet auth authority requires walletId`),i=Ze(e),a=String(e.emailHashHex\|\|``).trim();if(!a)throw Error(`Email OTP wallet auth authority requires emailHashHex`);let o=O(r(`email_otp:${t}:${a}`),`Email OTP wallet auth authority requires bindingId`);return{walletId:t,factor:i,verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:a},bindingId:o}}function $e(e){return e.factor.provider}function et(e){return e.factor.providerUserId}function tt(e){return e.verifier.emailHashHex}function nt(e){let i=e.factor;if(!i\|\|typeof i!=`object`\|\|Array.isArray(i))return null;let a=e.verifier;if(!a\|\|typeof a!=`object`\|\|Array.isArray(a))return null;let o=i,c=a,l=String(o.kind\|\|``).trim().toLowerCase(),u=String(c.kind\|\|``).trim().toLowerCase();if(l!==`passkey`\|\|u!==`webauthn`)return null;try{if(Ye(e,[`kind`,`rpId`,`credentialIdB64u`,`provider`,`providerUserId`]))return null;let i=n(e.walletId),a=t(c.rpId),l=s(o.credentialIdB64u),u=r(e.bindingId);return!i.ok\|\|!a.ok\|\|!l.ok\|\|!u.ok?null:{walletId:i.value,factor:{kind:`passkey`,credentialIdB64u:l.value},verifier:{kind:`webauthn`,rpId:a.value},bindingId:u.value}}catch{return null}}function rt(e){let t=e.factor;if(!t\|\|typeof t!=`object`\|\|Array.isArray(t))return null;let i=e.verifier;if(!i\|\|typeof i!=`object`\|\|Array.isArray(i))return null;let a=t,o=i,s=String(a.kind\|\|``).trim().toLowerCase(),c=String(o.kind\|\|``).trim().toLowerCase();if(s!==`email_otp`\|\|c!==`email_otp_wallet_auth_method`)return null;try{if(Ye(e,[`kind`,`rpId`,`credentialIdB64u`,`provider`,`providerUserId`]))return null;let t=n(e.walletId),i=qe(a.provider),s=l(a.providerUserId),c=String(o.emailHashHex\|\|``).trim(),u=r(e.bindingId);return!t.ok\|\|!i\|\|!s.ok\|\|!c\|\|!u.ok?null:{walletId:t.value,factor:{kind:`email_otp`,provider:i,providerUserId:s.value},verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:c},bindingId:u.value}}catch{return null}}function it(e){if(!e\|\|typeof e!=`object`\|\|Array.isArray(e))return null;let t=e;return nt(t)\|\|rt(t)}function at(e){return!e\|\|typeof e!=`object`\|\|Array.isArray(e)?null:rt(e)}function ot(e){return!e\|\|typeof e!=`object`\|\|Array.isArray(e)?null:nt(e)}function st(e){return`seams:wallet-authority-binding:v1\|${d(e.authority)}`}async function ct(t){return O(e(h(await p(st(t)))),`Wallet authority binding digest must be non-empty`)}async function lt(e){return{kind:`wallet_auth_authority_ref`,walletId:e.authority.walletId,authorityDigest:await ct({authority:e.authority}),walletAuthMethodId:e.authority.bindingId}}const ut=5*6e4,dt=`/router-ab/ecdsa-derivation/export`,ft=`/router-ab/ecdsa-derivation/presignature-pool/fill/init`,pt=`/router-ab/ecdsa-derivation/presignature-pool/fill/step`,mt=`/router-ab/ecdsa-derivation/session/activate`,ht=`/router-ab/ecdsa-derivation/operation-step-up`,gt=[1,2];function _t(e,t){if(e===`reusable_wallet_session`\|\|e===`verified_step_up`)return e;throw Error(`${t} must be reusable_wallet_session or verified_step_up`)}function vt(e){let t=f(e,`operationStepUpAuthorizationResponse.export_topology`);k(t,`operationStepUpAuthorizationResponse.export_topology`,[`signer_set`,`deriver_recipient_keys`,`router_id`]);let n=Ft(t.signer_set,`operationStepUpAuthorizationResponse.export_topology.signer_set`),r=Rt(t.deriver_recipient_keys,`operationStepUpAuthorizationResponse.export_topology.deriver_recipient_keys`);if(r.deriver_a.key_epoch!==n.signer_a.key_epoch\|\|r.deriver_b.key_epoch!==n.signer_b.key_epoch)throw Error(`operationStepUpAuthorizationResponse.export_topology recipient key epochs do not match signer_set`);return{signer_set:n,deriver_recipient_keys:r,router_id:A(t.router_id,`operationStepUpAuthorizationResponse.export_topology.router_id`)}}function yt(e){let t=f(e,`operationStepUpAuthorizationResponse`),n=Gn(t.operation_kind);if(k(t,`operationStepUpAuthorizationResponse`,[`ok`,`kind`,`authorization`,`expires_at_ms`,`operation_kind`,...n===`evm.export_key`?[`export_topology`]:[]]),t.ok!==!0\|\|t.kind!==`verified_step_up`)throw Error(`operationStepUpAuthorizationResponse is invalid`);let r=f(t.authorization,`operationStepUpAuthorizationResponse.authorization`);if(k(r,`operationStepUpAuthorizationResponse.authorization`,[`kind`,`evidence_set_digest`,`unseal`]),r.kind!==`operation_step_up`)throw Error(`operationStepUpAuthorizationResponse.authorization.kind is invalid`);let i=M(t.expires_at_ms,`operationStepUpAuthorizationResponse.expires_at_ms`);if(i<=Date.now())throw Error(`operationStepUpAuthorizationResponse.expires_at_ms is expired`);let a=f(r.unseal,`operationStepUpAuthorizationResponse.authorization.unseal`),o=A(a.kind,`operationStepUpAuthorizationResponse.authorization.unseal.kind`),s;switch(o){case`not_requested`:k(a,`operationStepUpAuthorizationResponse.authorization.unseal`,[`kind`]),s={kind:`not_requested`};break;case`email_otp_grant`:k(a,`operationStepUpAuthorizationResponse.authorization.unseal`,[`kind`,`grant`,`challenge_id`]),s={kind:`email_otp_grant`,grant:A(a.grant,`operationStepUpAuthorizationResponse.authorization.unseal.grant`),challenge_id:A(a.challenge_id,`operationStepUpAuthorizationResponse.authorization.unseal.challenge_id`)};break;default:throw Error(`operationStepUpAuthorizationResponse.authorization.unseal.kind is invalid`)}let c={ok:!0,kind:`verified_step_up`,authorization:{kind:`operation_step_up`,evidence_set_digest:ge(r.evidence_set_digest),unseal:s},expires_at_ms:i};return n===`evm.sign_transaction`?{...c,operation_kind:`evm.sign_transaction`}:{...c,operation_kind:`evm.export_key`,export_topology:vt(t.export_topology)}}async function bt(e){return h(await p(d({domain:`router-ab-ecdsa-operation-step-up/challenge/v1`,operation:Wn(e)})))}function k(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`)}function A(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} is required`);if(!/^[\x20-\x7e]+$/.test(n))throw Error(`${t} must be printable ASCII`);return n}function j(e,t){let n=ee(A(e,t));if(!n.ok)throw Error(`${t} is invalid`);return n.value}function xt(e,t){let n=u(A(e,t));if(!n.ok)throw Error(`${t} is invalid`);return n.value}function St(e,t){let n=me(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function Ct(e,t){let n=fe(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function wt(e,t){let n=de(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function Tt(e,t){let n=le(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function M(e,t){if(typeof e!=`number`\|\|!Number.isSafeInteger(e)\|\|e<=0)throw Error(`${t} must be a positive safe integer`);return e}function N(e,t){if(typeof e!=`number`\|\|!Number.isSafeInteger(e)\|\|e<=0)throw Error(`${t} must be a positive safe-integer counter`);return e}function Et(e,t){if(typeof e!=`number`\|\|!Number.isFinite(e))throw Error(`${t} must be a finite number`);let n=Math.floor(e);if(n!==e\|\|n<0\|\|n>4294967295)throw Error(`${t} must be a u32 integer`);return n}function Dt(e,t){if(typeof e!=`number`\|\|!Number.isFinite(e))throw Error(`${t} must be a finite number`);let n=Math.floor(e);if(n!==e\|\|n<0\|\|n>255)throw Error(`${t} must be a byte`);return n}function P(e,t,n){let r=A(e,t);if(!/^[A-Za-z0-9_-]+$/.test(r))throw Error(`${t} must be unpadded base64url`);let i;try{i=g(r)}catch{throw Error(`${t} must be valid base64url`)}if(i.length!==n)throw Error(`${t} must decode to ${n} bytes`);return r}function F(e,t){let n=P(e,t,33),r=g(n);if(r[0]!==2&&r[0]!==3)throw Error(`${t} must be a compressed secp256k1 public key`);return n}function Ot(e,t){let n=A(e,t);if(!/^[A-Za-z0-9_-]+$/.test(n))throw Error(`${t} must be unpadded base64url`);let r;try{r=g(n)}catch{throw Error(`${t} must be valid base64url`)}if(r.length===0)throw Error(`${t} must decode to non-empty bytes`);return n}function kt(e,t){let n=A(e,t);if(!/^x25519:[0-9a-f]{64}$/.test(n))throw Error(`${t} must use x25519:<64 lowercase hex chars> encoding`);return n}function I(e,t,n){if(!(e instanceof Uint8Array))throw Error(`${t} must be a Uint8Array`);if(e.length!==n)throw Error(`${t} must contain ${n} bytes`);return e}function At(e,t){let n=A(e,t);if(n!==`ecdsa_secp256k1_recoverable_v1`)throw Error(`${t} must be ecdsa_secp256k1_recoverable_v1`);return n}function L(e,t){let n=f(e,t);if(k(n,t,[`bytes`]),!Array.isArray(n.bytes))throw Error(`${t}.bytes must be an array`);if(n.bytes.length!==32)throw Error(`${t}.bytes must contain 32 bytes`);return{bytes:n.bytes.map((e,n)=>Dt(e,`${t}.bytes[${n}]`))}}function R(e){let t=f(e,`scope.context`);k(t,`scope.context`,[`application_binding_digest_b64u`]);let n=g(A(t.application_binding_digest_b64u,`scope.context.application_binding_digest_b64u`));if(n.length!==32)throw Error(`scope.context.application_binding_digest_b64u must decode to 32 bytes`);return{application_binding_digest_b64u:h(n)}}function jt(e){let t=f(e,`scope.public_identity`);return k(t,`scope.public_identity`,[`context_binding_b64u`,`derivation_client_share_public_key33_b64u`,`server_public_key33_b64u`,`threshold_public_key33_b64u`,`ethereum_address20_b64u`,`client_share_retry_counter`,`server_share_retry_counter`]),{context_binding_b64u:P(t.context_binding_b64u,`scope.public_identity.context_binding_b64u`,32),derivation_client_share_public_key33_b64u:F(t.derivation_client_share_public_key33_b64u,`scope.public_identity.derivation_client_share_public_key33_b64u`),server_public_key33_b64u:F(t.server_public_key33_b64u,`scope.public_identity.server_public_key33_b64u`),threshold_public_key33_b64u:F(t.threshold_public_key33_b64u,`scope.public_identity.threshold_public_key33_b64u`),ethereum_address20_b64u:P(t.ethereum_address20_b64u,`scope.public_identity.ethereum_address20_b64u`,20),client_share_retry_counter:Et(t.client_share_retry_counter,`scope.public_identity.client_share_retry_counter`),server_share_retry_counter:Et(t.server_share_retry_counter,`scope.public_identity.server_share_retry_counter`)}}function Mt(e){return Nt(e,`scope.signing_worker`)}function Nt(e,t){let n=f(e,t);return k(n,t,[`server_id`,`key_epoch`,`recipient_encryption_key`]),{server_id:A(n.server_id,`${t}.server_id`),key_epoch:A(n.key_epoch,`${t}.key_epoch`),recipient_encryption_key:xe(n.recipient_encryption_key,`${t}.recipient_encryption_key`)}}function Pt(e,t,n){let r=f(e,t);if(k(r,t,[`role`,`signer_id`,`key_epoch`]),A(r.role,`${t}.role`)!==n)throw Error(`${t}.role must be ${n}`);return{role:n,signer_id:A(r.signer_id,`${t}.signer_id`),key_epoch:A(r.key_epoch,`${t}.key_epoch`)}}function Ft(e,t){let n=f(e,t);k(n,t,[`signer_set_id`,`policy`,`signer_a`,`signer_b`,`selected_server`]);let r=A(n.policy,`${t}.policy`);if(r!==`all_2`)throw Error(`${t}.policy must be all_2`);let i=Pt(n.signer_a,`${t}.signer_a`,`signer_a`),a=Pt(n.signer_b,`${t}.signer_b`,`signer_b`);if(i.signer_id===a.signer_id)throw Error(`${t} requires distinct signer ids`);return{signer_set_id:A(n.signer_set_id,`${t}.signer_set_id`),policy:r,signer_a:i,signer_b:a,selected_server:Nt(n.selected_server,`${t}.selected_server`)}}function It(e){let t=`registration.lifecycle`,n=f(e,t);if(k(n,t,[`lifecycle_id`,`work_kind`,`primitive_request_kind`,`root_share_epoch`,`account_id`,`session_id`,`signer_set_id`,`selected_server_id`]),n.work_kind!==`registration_prepare`)throw Error(`${t}.work_kind must be registration_prepare`);if(n.primitive_request_kind!==`registration`)throw Error(`${t}.primitive_request_kind must be registration`);return{lifecycle_id:A(n.lifecycle_id,`${t}.lifecycle_id`),work_kind:`registration_prepare`,primitive_request_kind:`registration`,root_share_epoch:j(n.root_share_epoch,`${t}.root_share_epoch`),account_id:A(n.account_id,`${t}.account_id`),session_id:A(n.session_id,`${t}.session_id`),signer_set_id:A(n.signer_set_id,`${t}.signer_set_id`),selected_server_id:A(n.selected_server_id,`${t}.selected_server_id`)}}function Lt(e,t,n){let r=f(e,t);if(k(r,t,[`role`,`key_epoch`,`public_key`]),r.role!==n)throw Error(`${t}.role must be ${n}`);return{role:n,key_epoch:A(r.key_epoch,`${t}.key_epoch`),public_key:xe(r.public_key,`${t}.public_key`)}}function Rt(e,t=`registration.deriver_recipient_keys`){let n=f(e,t);return k(n,t,[`deriver_a`,`deriver_b`]),{deriver_a:Lt(n.deriver_a,`${t}.deriver_a`,`signer_a`),deriver_b:Lt(n.deriver_b,`${t}.deriver_b`,`signer_b`)}}function zt(e){let t=`registration`,n=f(e,t);if(k(n,t,[`registration_purpose`,`context`,`lifecycle`,`signer_set`,`router_id`,`client_id`,`replay_nonce`,`expires_at_ms`,`deriver_recipient_keys`]),n.registration_purpose!==`wallet_registration`&&n.registration_purpose!==`wallet_add_signer`)throw Error(`${t}.registration_purpose is invalid`);let r=It(n.lifecycle),i=Ft(n.signer_set,`${t}.signer_set`);if(r.signer_set_id!==i.signer_set_id)throw Error(`${t}.lifecycle signer set does not match signer_set`);if(r.selected_server_id!==i.selected_server.server_id)throw Error(`${t}.lifecycle selected server does not match signer_set`);let a=Rt(n.deriver_recipient_keys);if(a.deriver_a.key_epoch!==i.signer_a.key_epoch)throw Error(`${t}.deriver_a recipient key epoch does not match signer_set`);if(a.deriver_b.key_epoch!==i.signer_b.key_epoch)throw Error(`${t}.deriver_b recipient key epoch does not match signer_set`);return{registration_purpose:n.registration_purpose,context:R(n.context),lifecycle:r,signer_set:i,router_id:A(n.router_id,`${t}.router_id`),client_id:A(n.client_id,`${t}.client_id`),replay_nonce:A(n.replay_nonce,`${t}.replay_nonce`),expires_at_ms:M(n.expires_at_ms,`${t}.expires_at_ms`),deriver_recipient_keys:a}}function Bt(e,t){let n=f(e,t);if(k(n,t,[`kind`,`transcriptDigestB64u`,`payloadB64u`]),n.kind!==`recipient_proof_bundle`)throw Error(`${t}.kind must be recipient_proof_bundle`);return{kind:`recipient_proof_bundle`,transcriptDigestB64u:P(n.transcriptDigestB64u,`${t}.transcriptDigestB64u`,32),payloadB64u:Ot(n.payloadB64u,`${t}.payloadB64u`)}}function Vt(e){let t=`registrationForwarded`,n=f(e,t);if(k(n,t,[`result`,`response`]),n.result!==`forwarded`)throw Error(`${t}.result must be forwarded`);return{result:`forwarded`,response:qt(n.response,`${t}.response`)}}function Ht(e){return Ut(e,Wt)}function Ut(e,t){let n=`explicitExportForwarded`,r=f(e,n);if(k(r,n,[`result`,`response`,`signing_worker_export`]),r.result!==`forwarded`)throw Error(`${n}.result must be forwarded`);return{result:`forwarded`,response:qt(r.response,`${n}.response`),signing_worker_export:t(r.signing_worker_export)}}function Wt(e){return Kt(e,b)}function Gt(e,t,n){let r=f(e,n);k(r,n,[`wallet_id`,`key_handle`,`ecdsa_threshold_key_id`,`signing_root_id`,`signing_root_version`,`activation_epoch`,`signing_worker_id`,`context_binding_b64u`,`threshold_public_key33_b64u`,`export_request_digest_b64u`,`export_authorization_digest_b64u`,`export_nonce`,`authorization_kind`,`authorization_id`,`material_activation`,`lifecycle_id`,`recipient_identity`,`recipient_public_key`,`expires_at_ms`]);let i=t(r.material_activation);if(i.material_owner!==r.wallet_id\|\|i.signing_worker!==r.signing_worker_id)throw Error(`${n}.material_activation is not bound to wallet and worker`);return{wallet_id:A(r.wallet_id,`${n}.wallet_id`),key_handle:A(r.key_handle,`${n}.key_handle`),ecdsa_threshold_key_id:A(r.ecdsa_threshold_key_id,`${n}.ecdsa_threshold_key_id`),signing_root_id:A(r.signing_root_id,`${n}.signing_root_id`),signing_root_version:A(r.signing_root_version,`${n}.signing_root_version`),activation_epoch:j(r.activation_epoch,`${n}.activation_epoch`),signing_worker_id:A(r.signing_worker_id,`${n}.signing_worker_id`),context_binding_b64u:P(r.context_binding_b64u,`${n}.context_binding_b64u`,32),threshold_public_key33_b64u:F(r.threshold_public_key33_b64u,`${n}.threshold_public_key33_b64u`),export_request_digest_b64u:P(r.export_request_digest_b64u,`${n}.export_request_digest_b64u`,32),export_authorization_digest_b64u:P(r.export_authorization_digest_b64u,`${n}.export_authorization_digest_b64u`,32),export_nonce:A(r.export_nonce,`${n}.export_nonce`),authorization_kind:_t(r.authorization_kind,`${n}.authorization_kind`),authorization_id:A(r.authorization_id,`${n}.authorization_id`),material_activation:i,lifecycle_id:A(r.lifecycle_id,`${n}.lifecycle_id`),recipient_identity:A(r.recipient_identity,`${n}.recipient_identity`),recipient_public_key:kt(r.recipient_public_key,`${n}.recipient_public_key`),expires_at_ms:M(r.expires_at_ms,`${n}.expires_at_ms`)}}function Kt(e,t){let n=`signingWorkerExportShare`,r=f(e,n);if(k(r,n,[`version`,`algorithm`,`binding`,`ciphertext_and_tag`]),r.version!==`router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1`)throw Error(`${n}.version is invalid`);if(r.algorithm!==`hpke_x25519_hkdf_sha256_aes256gcm_v1`)throw Error(`${n}.algorithm is invalid`);if(!Array.isArray(r.ciphertext_and_tag)\|\|r.ciphertext_and_tag.length<=48)throw Error(`${n}.ciphertext_and_tag is invalid`);return{version:`router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1`,algorithm:`hpke_x25519_hkdf_sha256_aes256gcm_v1`,binding:Gt(r.binding,t,`${n}.binding`),ciphertext_and_tag:r.ciphertext_and_tag.map((e,t)=>Dt(e,`${n}.ciphertext_and_tag[${t}]`))}}function qt(e,t){let n=f(e,t);k(n,t,[`bundles`]);let r=`${t}.bundles`,i=f(n.bundles,r);return k(i,r,[`signerA`,`signerB`]),{bundles:{signerA:Bt(i.signerA,`${r}.signerA`),signerB:Bt(i.signerB,`${r}.signerB`)}}}function Jt(e){let t=`registrationActivation.publicFacts`,n=f(e,t);if(k(n,t,[`registrationRequestDigestB64u`,`proofTranscriptDigestB64u`,`contextBinding32B64u`,`derivationClientSharePublicKey33B64u`,`clientShareRetryCounter`,`participantId`]),n.participantId!==1)throw Error(`${t}.participantId must be 1`);return{registrationRequestDigestB64u:P(n.registrationRequestDigestB64u,`${t}.registrationRequestDigestB64u`,32),proofTranscriptDigestB64u:P(n.proofTranscriptDigestB64u,`${t}.proofTranscriptDigestB64u`,32),contextBinding32B64u:P(n.contextBinding32B64u,`${t}.contextBinding32B64u`,32),derivationClientSharePublicKey33B64u:F(n.derivationClientSharePublicKey33B64u,`${t}.derivationClientSharePublicKey33B64u`),clientShareRetryCounter:Et(n.clientShareRetryCounter,`${t}.clientShareRetryCounter`),participantId:1}}function Yt(e){let t=`registrationActivationReceipt`,n=f(e,t);k(n,t,[`activation_correlation_id`,`activation_request_digest`,`server_generation`,`ecdsa_activation`,`lifecycle_id`,`transcript_digest`]);let r=`${t}.ecdsa_activation`,i=f(n.ecdsa_activation,r);k(i,r,[`context`,`public_identity`,`signing_worker`,`material_activation`,`activation_epoch`,`activation_digest_b64u`,`activated_at_ms`]);let a=Nt(i.signing_worker,`${r}.signing_worker`),o=b(i.material_activation);if(o.signing_worker!==a.server_id)throw Error(`${r}.material_activation.signing_worker does not match signing_worker`);let s=P(i.activation_digest_b64u,`${r}.activation_digest_b64u`,32),c=L(n.transcript_digest,`${t}.transcript_digest`);return{activation_correlation_id:he(n.activation_correlation_id),activation_request_digest:L(n.activation_request_digest,`${t}.activation_request_digest`),server_generation:Pe(n.server_generation),ecdsa_activation:{context:R(i.context),public_identity:jt(i.public_identity),signing_worker:a,material_activation:o,activation_epoch:j(i.activation_epoch,`${r}.activation_epoch`),activation_digest_b64u:s,activated_at_ms:M(i.activated_at_ms,`${r}.activated_at_ms`)},lifecycle_id:A(n.lifecycle_id,`${t}.lifecycle_id`),transcript_digest:c}}function Xt(e){return Yt(e)}function z(e,t){return e.server_id===t.server_id&&e.key_epoch===t.key_epoch&&e.recipient_encryption_key===t.recipient_encryption_key}function Zt(e,t){return e.registrationRequestDigestB64u===t.registrationRequestDigestB64u&&e.proofTranscriptDigestB64u===t.proofTranscriptDigestB64u&&e.contextBinding32B64u===t.contextBinding32B64u&&e.derivationClientSharePublicKey33B64u===t.derivationClientSharePublicKey33B64u&&e.clientShareRetryCounter===t.clientShareRetryCounter&&e.participantId===t.participantId}function Qt(e,t){return e.signer_set_id===t.signer_set_id&&e.policy===t.policy&&e.signer_a.role===t.signer_a.role&&e.signer_a.signer_id===t.signer_a.signer_id&&e.signer_a.key_epoch===t.signer_a.key_epoch&&e.signer_b.role===t.signer_b.role&&e.signer_b.signer_id===t.signer_b.signer_id&&e.signer_b.key_epoch===t.signer_b.key_epoch&&z(e.selected_server,t.selected_server)}function B(e){let t=`ecdsaPublicCapability`,n=f(e,t);if(k(n,t,[`kind`,`context`,`public_identity`,`material_activation`,`signer_set`,`deriver_recipient_keys`,`router_id`,`client_id`,`activation_epoch`,`registration_request_digest_b64u`,`proof_transcript_digest_b64u`]),n.kind!==`router_ab_ecdsa_derivation_public_capability_v1`)throw Error(`${t}.kind is invalid`);let r=Ft(n.signer_set,`${t}.signer_set`),i=Rt(n.deriver_recipient_keys,`${t}.deriver_recipient_keys`);if(i.deriver_a.key_epoch!==r.signer_a.key_epoch\|\|i.deriver_b.key_epoch!==r.signer_b.key_epoch)throw Error(`${t} Deriver recipient key epochs do not match signer_set`);return{kind:`router_ab_ecdsa_derivation_public_capability_v1`,context:R(n.context),public_identity:jt(n.public_identity),material_activation:b(n.material_activation),signer_set:r,deriver_recipient_keys:i,router_id:A(n.router_id,`${t}.router_id`),client_id:A(n.client_id,`${t}.client_id`),activation_epoch:j(n.activation_epoch,`${t}.activation_epoch`),registration_request_digest_b64u:P(n.registration_request_digest_b64u,`${t}.registration_request_digest_b64u`,32),proof_transcript_digest_b64u:P(n.proof_transcript_digest_b64u,`${t}.proof_transcript_digest_b64u`,32)}}function $t(e){let t=`postRegistrationSessionActivation.session_policy`,n=f(e,t);return k(n,t,[`threshold_session_id`,`wallet_session_mint_id`,`ttl_ms`,`remaining_uses`,`runtime_policy_scope`]),{threshold_session_id:xt(n.threshold_session_id,`${t}.threshold_session_id`),wallet_session_mint_id:tn(n.wallet_session_mint_id,`${t}.wallet_session_mint_id`),ttl_ms:N(n.ttl_ms,`${t}.ttl_ms`),remaining_uses:N(n.remaining_uses,`${t}.remaining_uses`),runtime_policy_scope:oe(n.runtime_policy_scope)}}function en(e){let t=`postRegistrationSessionActivationPolicy`,n=f(e,t);if(k(n,t,[`kind`,`key_handle`,`session_policy`]),n.kind!==`router_ab_ecdsa_post_registration_session_activation_policy_v1`)throw Error(`${t}.kind is invalid`);return{kind:`router_ab_ecdsa_post_registration_session_activation_policy_v1`,key_handle:A(n.key_handle,`${t}.key_handle`),session_policy:$t(n.session_policy)}}function tn(e,t){let n=ue(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function V(e,t){return e.context_binding_b64u===t.context_binding_b64u&&e.derivation_client_share_public_key33_b64u===t.derivation_client_share_public_key33_b64u&&e.server_public_key33_b64u===t.server_public_key33_b64u&&e.threshold_public_key33_b64u===t.threshold_public_key33_b64u&&e.ethereum_address20_b64u===t.ethereum_address20_b64u&&e.client_share_retry_counter===t.client_share_retry_counter&&e.server_share_retry_counter===t.server_share_retry_counter}function nn(e,t){for(let n of e.capabilitySubjects)if(!(n.kind!==`sign`\|\|n.keyFamily!==`ecdsa_secp256k1`))return C(t.material_activation,Ce(n.materialActivation));return!1}function rn(e){let t=`postRegistrationSessionActivation`,n=f(e,t);if(k(n,t,[`kind`,`public_capability`,`session_policy`]),n.kind!==`router_ab_ecdsa_post_registration_session_activation_v1`)throw Error(`${t}.kind is invalid`);return{kind:`router_ab_ecdsa_post_registration_session_activation_v1`,public_capability:B(n.public_capability),session_policy:$t(n.session_policy)}}function an(e){let t=`postRegistrationSessionActivated`,n=f(e,t);if(k(n,t,[`kind`,`public_capability`,`session`,`normal_signing`]),n.kind!==`router_ab_ecdsa_post_registration_session_activated_v1`)throw Error(`${t}.kind is invalid`);let r=B(n.public_capability),i=f(n.session,`${t}.session`);k(i,`${t}.session`,[`authorization_session_id`,`authorization_id`,`threshold_session_id`,`wallet_session_id`,`quota_id`,`expires_at_ms`,`remaining_uses`,`wallet_session`,`operation_credential`]);let a=Ln(n.normal_signing),o=Ct(i.authorization_id,`${t}.session.authorization_id`),s=wt(i.wallet_session_id,`${t}.session.wallet_session_id`),c=M(i.expires_at_ms,`${t}.session.expires_at_ms`),l=ce(i.wallet_session),u=se(i.operation_credential);if(!V(r.public_identity,a.scope.public_identity)\|\|r.context.application_binding_digest_b64u!==a.scope.context.application_binding_digest_b64u\|\|a.scope.activation_epoch!==r.activation_epoch\|\|!z(a.scope.signing_worker,r.signer_set.selected_server)\|\|l.authorizationId!==o\|\|l.walletId!==r.client_id\|\|l.expiresAtMs!==c\|\|!nn(l,r)\|\|u.walletSessionId!==s)throw Error(`${t} exact Wallet Session does not match the activated capability`);return{kind:`router_ab_ecdsa_post_registration_session_activated_v1`,public_capability:r,session:{authorization_session_id:St(i.authorization_session_id,`${t}.session.authorization_session_id`),authorization_id:o,threshold_session_id:xt(i.threshold_session_id,`${t}.session.threshold_session_id`),wallet_session_id:s,quota_id:Tt(i.quota_id,`${t}.session.quota_id`),expires_at_ms:c,remaining_uses:N(i.remaining_uses,`${t}.session.remaining_uses`),wallet_session:l,operation_credential:u},normal_signing:a}}function on(e){let t=`credentialFreeSessionActivated`,n=f(e,t);if(k(n,t,[`kind`,`public_capability`,`session`,`normal_signing`]),n.kind!==`router_ab_ecdsa_credential_free_session_activated_v1`)throw Error(`${t}.kind is invalid`);let r=B(n.public_capability),i=f(n.session,`${t}.session`);k(i,`${t}.session`,[`authorization_session_id`,`authorization_id`,`threshold_session_id`,`wallet_session_id`,`quota_id`,`expires_at_ms`,`remaining_uses`]);let a=Ln(n.normal_signing);if(!V(r.public_identity,a.scope.public_identity)\|\|r.context.application_binding_digest_b64u!==a.scope.context.application_binding_digest_b64u\|\|a.scope.activation_epoch!==r.activation_epoch\|\|!z(a.scope.signing_worker,r.signer_set.selected_server))throw Error(`${t} normal-signing state does not match public capability`);return{kind:`router_ab_ecdsa_credential_free_session_activated_v1`,public_capability:r,session:{authorization_session_id:St(i.authorization_session_id,`${t}.session.authorization_session_id`),authorization_id:Ct(i.authorization_id,`${t}.session.authorization_id`),threshold_session_id:xt(i.threshold_session_id,`${t}.session.threshold_session_id`),wallet_session_id:wt(i.wallet_session_id,`${t}.session.wallet_session_id`),quota_id:Tt(i.quota_id,`${t}.session.quota_id`),expires_at_ms:M(i.expires_at_ms,`${t}.session.expires_at_ms`),remaining_uses:N(i.remaining_uses,`${t}.session.remaining_uses`)},normal_signing:a}}function sn(e,t=`signing_digest_b64u`){return{bytes:Array.from(g(P(e,t,32)))}}function H(e,t){return e.bytes.length===32&&t.bytes.length===32&&e.bytes.every((e,n)=>e===t.bytes[n])}function cn(e,t){return e.bytes.length===t.bytes.length&&e.bytes.every((e,n)=>e===t.bytes[n])}function ln(e,t){return e.deriver_a.role===t.deriver_a.role&&e.deriver_a.key_epoch===t.deriver_a.key_epoch&&e.deriver_a.public_key===t.deriver_a.public_key&&e.deriver_b.role===t.deriver_b.role&&e.deriver_b.key_epoch===t.deriver_b.key_epoch&&e.deriver_b.public_key===t.deriver_b.public_key}function un(e,t){let n=e.ecdsa_activation,r=t.ecdsa_activation;return e.activation_correlation_id===t.activation_correlation_id&&cn(e.activation_request_digest,t.activation_request_digest)&&e.server_generation===t.server_generation&&e.lifecycle_id===t.lifecycle_id&&cn(e.transcript_digest,t.transcript_digest)&&n.context.application_binding_digest_b64u===r.context.application_binding_digest_b64u&&V(n.public_identity,r.public_identity)&&z(n.signing_worker,r.signing_worker)&&C(n.material_activation,r.material_activation)&&n.activation_epoch===r.activation_epoch&&n.activation_digest_b64u===r.activation_digest_b64u&&n.activated_at_ms===r.activated_at_ms}function dn(e,t){let n=e.scope,r=t.scope;return e.kind===t.kind&&n.wallet_id===r.wallet_id&&n.ecdsa_threshold_key_id===r.ecdsa_threshold_key_id&&n.signing_root_id===r.signing_root_id&&n.signing_root_version===r.signing_root_version&&n.context.application_binding_digest_b64u===r.context.application_binding_digest_b64u&&V(n.public_identity,r.public_identity)&&C(n.material_activation,r.material_activation)&&z(n.signing_worker,r.signing_worker)&&n.activation_epoch===r.activation_epoch}function fn(e,t){return e.kind===t.kind&&e.context.application_binding_digest_b64u===t.context.application_binding_digest_b64u&&V(e.public_identity,t.public_identity)&&C(e.material_activation,t.material_activation)&&Qt(e.signer_set,t.signer_set)&&ln(e.deriver_recipient_keys,t.deriver_recipient_keys)&&e.router_id===t.router_id&&e.client_id===t.client_id&&e.activation_epoch===t.activation_epoch&&e.registration_request_digest_b64u===t.registration_request_digest_b64u&&e.proof_transcript_digest_b64u===t.proof_transcript_digest_b64u}function U(e){return new TextEncoder().encode(A(e,`canonical string`))}function pn(e){let t=e.reduce((e,t)=>e+t.length,0),n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function W(e,t){for(let n of t)e.push(n)}function mn(e,t){W(e,g(t.lane_digest_b64u)),W(e,g(t.intent_digest_b64u)),W(e,g(t.display_digest_b64u))}function hn(e,t){if(!Number.isInteger(t)\|\|t<0\|\|t>65535)throw Error(`canonical u16 must be an integer between 0 and 65535`);e.push(t>>>8&255,t&255)}function gn(e,t){if(!Number.isInteger(t)\|\|t<0\|\|t>4294967295)throw Error(`canonical u32 must be an integer between 0 and 4294967295`);e.push(t>>>24&255,t>>>16&255,t>>>8&255,t&255)}function _n(e,t){if(!Number.isSafeInteger(t)\|\|t<0)throw Error(`canonical u64 must be a non-negative safe integer`);let n=BigInt(t);for(let t=56;t>=0;t-=8)e.push(Number(n>>BigInt(t)&255n))}function G(e,t){gn(e,t.length),W(e,t)}function vn(e,t){let n=U(t);hn(e,n.length),W(e,n)}function yn(e,t){G(e,U(t.server_id)),G(e,U(t.key_epoch)),G(e,U(t.recipient_encryption_key))}async function bn(e){let t=globalThis.crypto?.subtle;if(!t)throw Error(`crypto.subtle is required for Router A/B ECDSA derivation request digest binding`);let n=new ArrayBuffer(e.byteLength);return new Uint8Array(n).set(e),new Uint8Array(await t.digest(`SHA-256`,n))}async function xn(e){let t=I(e,`clientRerandomizationContribution32`,32);return await bn(pn([U(`router-ab-ecdsa-derivation/client-rerandomization-commitment/v1`),t]))}function Sn(e){let t=R(e),n=[];W(n,U(`router-ab-ecdsa-derivation/context/v1`)),vn(n,`router-ab-ecdsa-derivation-v1`),vn(n,`secp256k1`),W(n,g(t.application_binding_digest_b64u)),n.push(gt.length);for(let e of gt)hn(n,e);return new Uint8Array(n)}function Cn(e){let t=[];return W(t,U(`router-ab-ecdsa-derivation/role-local/context-binding/v1`)),t.push(1),t.push(1),hn(t,e.length),W(t,e),new Uint8Array(t)}async function wn(e){return An(Cn(Sn(e)))}function Tn(e){let t=jt(e),n=[];return G(n,U(`router-ab-ecdsa-derivation/public-identity/v1`)),G(n,U(t.context_binding_b64u)),G(n,U(t.derivation_client_share_public_key33_b64u)),G(n,U(t.server_public_key33_b64u)),G(n,U(t.threshold_public_key33_b64u)),G(n,U(t.ethereum_address20_b64u)),gn(n,t.client_share_retry_counter),gn(n,t.server_share_retry_counter),new Uint8Array(n)}function En(e){let t=K(e),n=[];return G(n,U(`router-ab-ecdsa-derivation/normal-signing-scope/v1`)),G(n,U(t.wallet_id)),G(n,U(t.ecdsa_threshold_key_id)),G(n,U(t.signing_root_id)),G(n,U(t.signing_root_version)),G(n,Sn(t.context)),G(n,Tn(t.public_identity)),n.push(...S(t.material_activation)),yn(n,t.signing_worker),G(n,U(t.activation_epoch)),new Uint8Array(n)}function Dn(e){return En(e)}function On(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function kn(e,t){try{return On(Dn(e),Dn(t))}catch{return!1}}async function An(e){return{bytes:Array.from(await bn(e))}}async function jn(e){let t=K(e),n=await wn(t.context);if(!H(sn(t.public_identity.context_binding_b64u,`scope.public_identity.context_binding_b64u`),n))throw Error(`scope.public_identity.context_binding_b64u does not match scope.context`);return t}function Mn(e){let t=q(e),n=[];return G(n,U(`router-ab-ecdsa-derivation/normal-signing-request/v1`)),G(n,En(t.scope)),G(n,U(t.request_id)),G(n,U(t.operation_id)),mn(n,t.operation_digests),n.push(...Ee(t.authorization)),n.push(...S(t.material_activation)),G(n,U(t.client_presignature_id)),_n(n,t.expires_at_ms),W(n,g(t.signing_digest_b64u)),G(n,g(t.client_rerandomization_commitment32_b64u)),new Uint8Array(n)}async function Nn(e){let t=q(e);return await jn(t.scope),An(Mn(t))}function Pn(e){let t=J(e),n=[];return G(n,U(`router-ab-ecdsa-derivation/normal-signing-finalize-request/v1`)),G(n,En(t.scope)),G(n,U(t.request_id)),G(n,U(t.operation_id)),mn(n,t.operation_digests),n.push(...Ee(t.authorization)),n.push(...S(t.material_activation)),_n(n,t.expires_at_ms),W(n,g(t.signing_digest_b64u)),G(n,U(t.server_presignature_id)),G(n,g(t.client_signature_share32_b64u)),G(n,g(t.client_rerandomization_contribution32_b64u)),new Uint8Array(n)}async function Fn(e){let t=J(e);return await jn(t.scope),An(Pn(t))}function K(e){let t=f(e,`scope`);return k(t,`scope`,[`wallet_id`,`ecdsa_threshold_key_id`,`signing_root_id`,`signing_root_version`,`context`,`public_identity`,`material_activation`,`signing_worker`,`activation_epoch`]),{wallet_id:A(t.wallet_id,`scope.wallet_id`),ecdsa_threshold_key_id:A(t.ecdsa_threshold_key_id,`scope.ecdsa_threshold_key_id`),signing_root_id:A(t.signing_root_id,`scope.signing_root_id`),signing_root_version:A(t.signing_root_version,`scope.signing_root_version`),context:R(t.context),public_identity:jt(t.public_identity),material_activation:b(t.material_activation),signing_worker:Mt(t.signing_worker),activation_epoch:j(t.activation_epoch,`scope.activation_epoch`)}}function In(e){if(e==null)return null;let t=f(e,`routerAbEcdsaDerivationNormalSigning`);if(k(t,`routerAbEcdsaDerivationNormalSigning`,[`kind`,`scope`]),A(t.kind,`routerAbEcdsaDerivationNormalSigning.kind`)!==`router_ab_ecdsa_derivation_normal_signing_v1`)throw Error(`routerAbEcdsaDerivationNormalSigning.kind is not supported`);return{kind:`router_ab_ecdsa_derivation_normal_signing_v1`,scope:K(t.scope)}}function Ln(e){let t=In(e);if(!t)throw Error(`Router A/B ECDSA derivation normal-signing state is required`);return t}function Rn(e){let t=a([A(e.ecdsaThresholdKeyId,`ecdsaThresholdKeyId`),A(e.signingRootId,`signingRootId`),A(e.signingRootVersion,`signingRootVersion`),j(e.activationEpoch,`activationEpoch`)].join(`:`));if(!t.ok)throw Error(`activeStateId ${t.error.message}`);return t.value}function zn(e){return Rn({ecdsaThresholdKeyId:e.scope.ecdsa_threshold_key_id,signingRootId:e.scope.signing_root_id,signingRootVersion:e.scope.signing_root_version,activationEpoch:e.scope.activation_epoch})}function Bn(e,t){let n=f(e,t);return k(n,t,[`lane_digest_b64u`,`intent_digest_b64u`,`display_digest_b64u`]),{lane_digest_b64u:P(n.lane_digest_b64u,`${t}.lane_digest_b64u`,32),intent_digest_b64u:P(n.intent_digest_b64u,`${t}.intent_digest_b64u`,32),display_digest_b64u:P(n.display_digest_b64u,`${t}.display_digest_b64u`,32)}}function Vn(e){return q({scope:e.scope,request_id:e.requestId,operation_id:e.operationId,operation_digests:e.operationDigests,authorization:e.authorization,material_activation:e.materialActivation,client_presignature_id:e.clientPresignatureId,expires_at_ms:e.expiresAtMs,signing_digest_b64u:h(I(e.signingDigest32,`signingDigest32`,32)),client_rerandomization_commitment32_b64u:h(I(e.clientRerandomizationCommitment32,`clientRerandomizationCommitment32`,32))})}function q(e){let t=f(e,`ecdsaSigningRequest`);k(t,`ecdsaSigningRequest`,[`scope`,`request_id`,`operation_id`,`operation_digests`,`authorization`,`material_activation`,`client_presignature_id`,`expires_at_ms`,`signing_digest_b64u`,`client_rerandomization_commitment32_b64u`]);let n={scope:K(t.scope),request_id:A(t.request_id,`ecdsaSigningRequest.request_id`),operation_id:A(t.operation_id,`ecdsaSigningRequest.operation_id`),operation_digests:Bn(t.operation_digests,`ecdsaSigningRequest.operation_digests`),authorization:y(t.authorization),material_activation:b(t.material_activation),client_presignature_id:A(t.client_presignature_id,`ecdsaSigningRequest.client_presignature_id`),expires_at_ms:M(t.expires_at_ms,`ecdsaSigningRequest.expires_at_ms`),signing_digest_b64u:P(t.signing_digest_b64u,`ecdsaSigningRequest.signing_digest_b64u`,32),client_rerandomization_commitment32_b64u:P(t.client_rerandomization_commitment32_b64u,`ecdsaSigningRequest.client_rerandomization_commitment32_b64u`,32)};if(n.operation_digests.intent_digest_b64u!==n.signing_digest_b64u)throw Error(`ecdsaSigningRequest intent digest must equal the admitted signing digest`);return n}function Hn(e){let t=f(e,`webauthn_authentication`);k(t,`webauthn_authentication`,[`id`,`rawId`,`type`,`authenticatorAttachment`,`response`,`clientExtensionResults`]);let n=f(t.response,`webauthn_authentication.response`);k(n,`webauthn_authentication.response`,[`clientDataJSON`,`authenticatorData`,`signature`,`userHandle`]);let r=t.authenticatorAttachment===null?null:A(t.authenticatorAttachment,`webauthn_authentication.authenticatorAttachment`),i=n.userHandle===null?null:A(n.userHandle,`webauthn_authentication.response.userHandle`);return{id:A(t.id,`webauthn_authentication.id`),rawId:A(t.rawId,`webauthn_authentication.rawId`),type:A(t.type,`webauthn_authentication.type`),authenticatorAttachment:r,response:{clientDataJSON:A(n.clientDataJSON,`webauthn_authentication.response.clientDataJSON`),authenticatorData:A(n.authenticatorData,`webauthn_authentication.response.authenticatorData`),signature:A(n.signature,`webauthn_authentication.response.signature`),userHandle:i},clientExtensionResults:t.clientExtensionResults}}function Un(e){let t=f(e,`operationStepUpAuthorizationRequest`);if(k(t,`operationStepUpAuthorizationRequest`,[`kind`,`operation`,`proof`]),t.kind!==`router_ab_ecdsa_operation_step_up_v1`)throw Error(`operationStepUpAuthorizationRequest.kind must be router_ab_ecdsa_operation_step_up_v1`);let n=Wn(t.operation),r=f(t.proof,`operationStepUpAuthorizationRequest.proof`),i=it(r.authority),a;switch(r.kind){case`passkey`:if(k(r,`operationStepUpAuthorizationRequest.proof`,[`kind`,`authority`,`webauthn_authentication`]),!i\|\|!E(i))throw Error(`operationStepUpAuthorizationRequest.proof requires an exact passkey authority`);a={kind:`passkey`,authority:i,webauthn_authentication:Hn(r.webauthn_authentication)};break;case`email_otp`:if(k(r,`operationStepUpAuthorizationRequest.proof`,[`kind`,`authority`,`challenge_id`,`otp_code`]),!i\|\|!D(i))throw Error(`operationStepUpAuthorizationRequest.proof requires an exact Email OTP authority`);a={kind:`email_otp`,authority:i,challenge_id:A(r.challenge_id,`operationStepUpAuthorizationRequest.proof.challenge_id`),otp_code:A(r.otp_code,`operationStepUpAuthorizationRequest.proof.otp_code`)};break;default:throw Error(`operationStepUpAuthorizationRequest.proof.kind is invalid`)}return{kind:`router_ab_ecdsa_operation_step_up_v1`,operation:n,proof:a}}function Wn(e){let t=f(e,`ecdsaOperationStepUpPreparation`);if(k(t,`operationStepUpGrantRequest.operation`,[`wallet_id`,`operation_kind`,`operation_id`,`operation_digests`,`material_activation`,`normal_signing_scope`,`signing_worker_id`,`key_handle`,`relayer_key_id`,`participant_ids`,`expires_at_ms`]),!Array.isArray(t.participant_ids)\|\|t.participant_ids.length!==2\|\|!t.participant_ids.every(e=>Number.isSafeInteger(e)&&e>0))throw Error(`operationStepUpGrantRequest.operation.participant_ids must contain two positive integers`);return{wallet_id:A(t.wallet_id,`operationStepUpGrantRequest.operation.wallet_id`),operation_kind:Gn(t.operation_kind),operation_id:A(t.operation_id,`operationStepUpGrantRequest.operation.operation_id`),operation_digests:Bn(t.operation_digests,`operationStepUpGrantRequest.operation.operation_digests`),material_activation:b(t.material_activation),normal_signing_scope:K(t.normal_signing_scope),signing_worker_id:A(t.signing_worker_id,`operationStepUpGrantRequest.operation.signing_worker_id`),key_handle:A(t.key_handle,`operationStepUpGrantRequest.operation.key_handle`),relayer_key_id:A(t.relayer_key_id,`operationStepUpGrantRequest.operation.relayer_key_id`),participant_ids:[Number(t.participant_ids[0]),Number(t.participant_ids[1])],expires_at_ms:M(t.expires_at_ms,`operationStepUpGrantRequest.operation.expires_at_ms`)}}function Gn(e){switch(e){case pe.signTransaction:case pe.exportKey:return e;default:throw Error(`operationStepUpGrantRequest.operation.operation_kind must be evm.sign_transaction or evm.export_key`)}}function Kn(e){return J({scope:e.scope,request_id:e.requestId,operation_id:e.operationId,operation_digests:e.operationDigests,authorization:e.authorization,material_activation:e.materialActivation,expires_at_ms:e.expiresAtMs,signing_digest_b64u:h(I(e.signingDigest32,`signingDigest32`,32)),server_presignature_id:e.serverPresignatureId,client_signature_share32_b64u:h(I(e.clientSignatureShare32,`clientSignatureShare32`,32)),client_rerandomization_contribution32_b64u:h(I(e.clientRerandomizationContribution32,`clientRerandomizationContribution32`,32))})}function J(e){let t=f(e,`ecdsaFinalizeCoreRequest`);return k(t,`ecdsaFinalizeCoreRequest`,[`scope`,`request_id`,`operation_id`,`operation_digests`,`authorization`,`material_activation`,`expires_at_ms`,`signing_digest_b64u`,`server_presignature_id`,`client_signature_share32_b64u`,`client_rerandomization_contribution32_b64u`]),qn(t)}function qn(e){let t={scope:K(e.scope),request_id:A(e.request_id,`ecdsaFinalizeRequest.request_id`),operation_id:A(e.operation_id,`ecdsaFinalizeRequest.operation_id`),operation_digests:Bn(e.operation_digests,`ecdsaFinalizeRequest.operation_digests`),authorization:y(e.authorization),material_activation:b(e.material_activation),expires_at_ms:M(e.expires_at_ms,`ecdsaFinalizeRequest.expires_at_ms`),signing_digest_b64u:P(e.signing_digest_b64u,`ecdsaFinalizeRequest.signing_digest_b64u`,32),server_presignature_id:A(e.server_presignature_id,`ecdsaFinalizeRequest.server_presignature_id`),client_signature_share32_b64u:P(e.client_signature_share32_b64u,`ecdsaFinalizeRequest.client_signature_share32_b64u`,32),client_rerandomization_contribution32_b64u:P(e.client_rerandomization_contribution32_b64u,`ecdsaFinalizeRequest.client_rerandomization_contribution32_b64u`,32)};if(t.operation_digests.intent_digest_b64u!==t.signing_digest_b64u)throw Error(`ecdsaFinalizeRequest intent digest must equal the admitted signing digest`);return t}function Jn(e){let t=f(e,`ecdsaPrepareResponse`);return k(t,`ecdsaPrepareResponse`,[`scope`,`request_id`,`request_digest`,`signing_digest`,`server_presignature_id`,`server_big_r33_b64u`,`signing_worker_rerandomization_contribution32_b64u`,`signature_scheme`,`prepared_at_ms`,`expires_at_ms`]),{scope:K(t.scope),request_id:A(t.request_id,`ecdsaPrepareResponse.request_id`),request_digest:L(t.request_digest,`ecdsaPrepareResponse.request_digest`),signing_digest:L(t.signing_digest,`ecdsaPrepareResponse.signing_digest`),server_presignature_id:A(t.server_presignature_id,`ecdsaPrepareResponse.server_presignature_id`),server_big_r33_b64u:P(t.server_big_r33_b64u,`ecdsaPrepareResponse.server_big_r33_b64u`,33),signing_worker_rerandomization_contribution32_b64u:P(t.signing_worker_rerandomization_contribution32_b64u,`ecdsaPrepareResponse.signing_worker_rerandomization_contribution32_b64u`,32),signature_scheme:At(t.signature_scheme,`ecdsaPrepareResponse.signature_scheme`),prepared_at_ms:M(t.prepared_at_ms,`ecdsaPrepareResponse.prepared_at_ms`),expires_at_ms:M(t.expires_at_ms,`ecdsaPrepareResponse.expires_at_ms`)}}async function Yn(e,t){let n=q(e),r=Jn(t);if(!kn(r.scope,n.scope))throw Error(`ecdsaPrepareResponse.scope does not match request`);if(r.request_id!==n.request_id)throw Error(`ecdsaPrepareResponse.request_id does not match request`);if(r.server_presignature_id!==n.client_presignature_id)throw Error(`ecdsaPrepareResponse.server_presignature_id does not match request`);if(!H(r.signing_digest,sn(n.signing_digest_b64u)))throw Error(`ecdsaPrepareResponse.signing_digest does not match request`);if(r.expires_at_ms!==n.expires_at_ms)throw Error(`ecdsaPrepareResponse.expires_at_ms does not match request`);if(!H(r.request_digest,await Nn(n)))throw Error(`ecdsaPrepareResponse.request_digest does not match request`);return r}function Xn(e){let t=f(e,`ecdsaSigningResponse`);return k(t,`ecdsaSigningResponse`,[`scope`,`request_id`,`request_digest`,`signing_digest`,`signature_scheme`,`signature65_b64u`]),{scope:K(t.scope),request_id:A(t.request_id,`ecdsaSigningResponse.request_id`),request_digest:L(t.request_digest,`ecdsaSigningResponse.request_digest`),signing_digest:L(t.signing_digest,`ecdsaSigningResponse.signing_digest`),signature_scheme:At(t.signature_scheme,`ecdsaSigningResponse.signature_scheme`),signature65_b64u:P(t.signature65_b64u,`ecdsaSigningResponse.signature65_b64u`,65)}}async function Zn(e,t){let n=J(e),r=Xn(t);if(!kn(r.scope,n.scope))throw Error(`ecdsaSigningResponse.scope does not match request`);if(r.request_id!==n.request_id)throw Error(`ecdsaSigningResponse.request_id does not match request`);if(!H(r.signing_digest,sn(n.signing_digest_b64u)))throw Error(`ecdsaSigningResponse.signing_digest does not match request`);if(!H(r.request_digest,await Fn(n)))throw Error(`ecdsaSigningResponse.request_digest does not match request`);return r}function Qn(e){let t=typeof e==`string`?e.trim():``;if(!t.startsWith(`ederivation-key-`))throw Error(`Threshold ECDSA key handle is invalid`);return t}function $n(e,t){let n=String(e??``).trim();if(!n)throw Error(`[threshold-ecdsa-key-handle] ${t} is required`);return n}function er(e){return String(e??``).trim()\|\|`default`}async function tr(e){return`ederivation-key-${h(await p(d({domain:`seams.threshold_ecdsa.key_handle.v1`,ecdsaThresholdKeyId:$n(e.ecdsaThresholdKeyId,`ecdsaThresholdKeyId`),signingRootId:$n(e.signingRootId,`signingRootId`),signingRootVersion:er(e.signingRootVersion)})))}`}function Y(e){return{code:`missing`,message:`${e} is required`}}function X(e,t){return{code:`invalid`,message:`${e} ${t}`}}function Z(e,t){if(e==null)return{ok:!1,error:Y(t)};if(typeof e!=`string`)return{ok:!1,error:X(t,`must be a string`)};let n=e.trim();return n?c(n)?{ok:!1,error:X(t,`must not contain whitespace or control characters`)}:{ok:!0,value:n}:{ok:!1,error:Y(t)}}function nr(e,t){if(e==null)return{ok:!1,error:Y(t)};if(typeof e!=`string`\|\|e.length===0)return{ok:!1,error:X(t,`must be non-empty base64url`)};try{let n=g(e);if(n.length===0\|\|h(n)!==e)return{ok:!1,error:X(t,`must be canonical unpadded base64url`)}}catch{return{ok:!1,error:X(t,`must be canonical unpadded base64url`)}}return{ok:!0,value:e}}function rr(e,t,n){if(e==null)return{ok:!1,error:Y(t)};try{return{ok:!0,value:n(ge(e))}}catch{return{ok:!1,error:X(t,`must be canonical base64url for 32 bytes`)}}}function ir(e){return e}function ar(e){return e}function or(e){return e}function Q(e,t,n){let r=new Set(t);for(let t of Object.keys(e))if(!r.has(t))throw Error(`${n}.${t} is not supported`);for(let r of t)if(!(r in e))throw Error(`${n}.${r} is required`)}function sr(e){return Z(e,`laneHolderParticipantId`)}function cr(e){return Z(e,`signingWorkerParticipantId`)}function lr(e){return Z(e,`signingWorkerRecipientKeyId`)}function ur(e){return Z(e,`laneHolderCustodyBindingId`)}function dr(e){return rr(e,`participantBindingDigestB64u`,or)}function fr(e){return rr(e,`custodyBindingDigestB64u`,ir)}function pr(e){return rr(e,`hpkePublicKeyDigestB64u`,ar)}function mr(e){return{kind:`lane_holder_custody_identity_v1`,custodyBindingId:e.custodyBindingId,custodyBindingDigestB64u:e.custodyBindingDigestB64u}}function hr(e){return{kind:`signing_worker_recipient_identity_v1`,recipientKeyId:e.recipientKeyId,hpkePublicKeyB64u:e.hpkePublicKeyB64u,hpkePublicKeyDigestB64u:e.hpkePublicKeyDigestB64u}}function gr(e,t=`laneHolderCustodyIdentity`){let n=f(e,t);if(Q(n,[`kind`,`custodyBindingId`,`custodyBindingDigestB64u`],t),n.kind!==`lane_holder_custody_identity_v1`)throw Error(`${t}.kind is invalid`);let r=ur(n.custodyBindingId);if(!r.ok)throw Error(`${t}.${r.error.message}`);let i=fr(n.custodyBindingDigestB64u);if(!i.ok)throw Error(`${t}.${i.error.message}`);return mr({custodyBindingId:r.value,custodyBindingDigestB64u:i.value})}function _r(e,t=`signingWorkerRecipientIdentity`){let n=f(e,t);if(Q(n,[`kind`,`recipientKeyId`,`hpkePublicKeyB64u`,`hpkePublicKeyDigestB64u`],t),n.kind!==`signing_worker_recipient_identity_v1`)throw Error(`${t}.kind is invalid`);let r=lr(n.recipientKeyId);if(!r.ok)throw Error(`${t}.${r.error.message}`);let i=nr(n.hpkePublicKeyB64u,`${t}.hpkePublicKeyB64u`);if(!i.ok)throw Error(i.error.message);let a=pr(n.hpkePublicKeyDigestB64u);if(!a.ok)throw Error(`${t}.${a.error.message}`);return hr({recipientKeyId:r.value,hpkePublicKeyB64u:i.value,hpkePublicKeyDigestB64u:a.value})}function vr(e){return{kind:`lane_holder_participant_v1`,participantId:e.participantId,custodyBindingId:e.custody.custodyBindingId,custodyBindingDigestB64u:e.custody.custodyBindingDigestB64u,hpkePublicKeyB64u:e.hpkePublicKeyB64u,hpkePublicKeyDigestB64u:e.hpkePublicKeyDigestB64u,participantBindingDigestB64u:e.participantBindingDigestB64u}}function yr(e){return{kind:`signing_worker_participant_v1`,participantId:e.participantId,recipientKeyId:e.recipient.recipientKeyId,hpkePublicKeyB64u:e.recipient.hpkePublicKeyB64u,hpkePublicKeyDigestB64u:e.recipient.hpkePublicKeyDigestB64u,participantBindingDigestB64u:e.participantBindingDigestB64u}}function br(e,t=`laneHolderParticipant`){let n=f(e,t);if(Q(n,[`kind`,`participantId`,`custodyBindingId`,`custodyBindingDigestB64u`,`hpkePublicKeyB64u`,`hpkePublicKeyDigestB64u`,`participantBindingDigestB64u`],t),n.kind!==`lane_holder_participant_v1`)throw Error(`${t}.kind is invalid`);let r=sr(n.participantId);if(!r.ok)throw Error(`${t}.${r.error.message}`);let i=gr({kind:`lane_holder_custody_identity_v1`,custodyBindingId:n.custodyBindingId,custodyBindingDigestB64u:n.custodyBindingDigestB64u},`${t}.custody`),a=nr(n.hpkePublicKeyB64u,`${t}.hpkePublicKeyB64u`);if(!a.ok)throw Error(a.error.message);let o=pr(n.hpkePublicKeyDigestB64u);if(!o.ok)throw Error(`${t}.${o.error.message}`);let s=dr(n.participantBindingDigestB64u);if(!s.ok)throw Error(`${t}.${s.error.message}`);return vr({participantId:r.value,custody:i,hpkePublicKeyB64u:a.value,hpkePublicKeyDigestB64u:o.value,participantBindingDigestB64u:s.value})}function xr(e,t=`signingWorkerParticipant`){let n=f(e,t);if(Q(n,[`kind`,`participantId`,`recipientKeyId`,`hpkePublicKeyB64u`,`hpkePublicKeyDigestB64u`,`participantBindingDigestB64u`],t),n.kind!==`signing_worker_participant_v1`)throw Error(`${t}.kind is invalid`);let r=cr(n.participantId);if(!r.ok)throw Error(`${t}.${r.error.message}`);let i=_r({kind:`signing_worker_recipient_identity_v1`,recipientKeyId:n.recipientKeyId,hpkePublicKeyB64u:n.hpkePublicKeyB64u,hpkePublicKeyDigestB64u:n.hpkePublicKeyDigestB64u},`${t}.recipient`),a=dr(n.participantBindingDigestB64u);if(!a.ok)throw Error(`${t}.${a.error.message}`);return yr({participantId:r.value,recipient:i,participantBindingDigestB64u:a.value})}const Sr=[`kind`,`signerId`,`participantIds`,`signingWorkerId`,`custodyKeyManifestDigestB64u`,`sourceIdentityDigestB64u`];function Cr(e,t=`walletSignerId`){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} is required`);if(c(n))throw Error(`${t} must not contain whitespace or control characters`);return n}function wr(e,t){if(typeof e!=`number`\|\|!Number.isSafeInteger(e)\|\|e<=0)throw Error(`${t} must be a positive safe integer`);return e}function Tr(e,t){if(!Array.isArray(e)\|\|e.length!==2)throw Error(`${t} must contain exactly two participant ids`);let n=wr(e[0],`${t}[0]`),r=wr(e[1],`${t}[1]`);if(n===r)throw Error(`${t} must contain distinct participant ids`);return[n,r]}function Er(e){let t=Tr(e.participantIds,`participantIds`);return{kind:`owner_lane_participant_continuity_v1`,signerId:Cr(e.signerId),participantIds:t,signingWorkerId:re(i(e.signingWorkerId),`signingWorkerId`),custodyKeyManifestDigestB64u:m(e.custodyKeyManifestDigestB64u,`custodyKeyManifestDigestB64u`),sourceIdentityDigestB64u:m(e.sourceIdentityDigestB64u,`sourceIdentityDigestB64u`)}}function Dr(e,t=`ownerParticipantContinuity`){let n=f(e,t);if(ne(n,Sr,t),n.kind!==`owner_lane_participant_continuity_v1`)throw Error(`${t}.kind must be owner_lane_participant_continuity_v1`);return Er({signerId:Cr(n.signerId,`${t}.signerId`),participantIds:Tr(n.participantIds,`${t}.participantIds`),signingWorkerId:re(i(n.signingWorkerId),`${t}.signingWorkerId`),custodyKeyManifestDigestB64u:m(n.custodyKeyManifestDigestB64u,`${t}.custodyKeyManifestDigestB64u`),sourceIdentityDigestB64u:m(n.sourceIdentityDigestB64u,`${t}.sourceIdentityDigestB64u`)})}function $(e,t){let n=String(e??``).trim();if(!n)throw Error(`[evm-family-ecdsa] ${t} is required`);return n}function Or(e){return $(e,`rpId`)}function kr(e){return ye({walletId:_(e.walletId),signingRootId:jr(e.signingRootId),signingRootVersion:Mr(e.signingRootVersion)})}function Ar(e){return $(e,`ecdsaThresholdKeyId`)}function jr(e){return $(e,`signingRootId`)}function Mr(e){return String(e??``).trim()\|\|`default`}function Nr(e){let t=String(e??``).trim().toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(t))throw Error(`[evm-family-ecdsa] thresholdOwnerAddress must be an EVM address`);return t}function Pr(e){return Nr(e)}function Fr(e){return Or(e)}function Ir(e){return $(e,`keyHandle`)}function Lr(e){return Ar(String(e.record.ecdsaThresholdKeyId??``).trim())}function Rr(e){return{signingRootId:jr(e.signingRootId),signingRootVersion:Mr(e.signingRootVersion)}}function zr(e){return Rr({signingRootId:e.record.signingRootId,signingRootVersion:e.record.signingRootVersion})}function Br(e){let t=ae(e.runtimePolicyScope);return Rr({signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion})}function Vr(e){let t=$(e,`thresholdEcdsaPublicKeyB64u`),n;try{n=g(t)}catch{throw Error(`[evm-family-ecdsa] thresholdEcdsaPublicKeyB64u must be base64url`)}if(n.length!==33)throw Error(`[evm-family-ecdsa] thresholdEcdsaPublicKeyB64u must decode to 33 bytes`);return t}function Hr(e){let t=Math.floor(Number(e));if(!Number.isSafeInteger(t)\|\|t<1\|\|t>65535)throw Error(`[evm-family-ecdsa] participantId must be a positive safe integer`);return t}function Ur(e){let t=ie(e);if(!t?.length)throw Error(`[evm-family-ecdsa] participantIds are required`);return t.map(Hr)}function Wr(e){return e.map(e=>String(Number(e))).join(`,`)}function Gr(e){let t=2166136261;for(let n=0;n<e.length;n+=1)t^=e.charCodeAt(n),t=Math.imul(t,16777619)>>>0;return t.toString(16).padStart(8,`0`)}function Kr(e){return{walletId:e.walletId,keyScope:`evm-family`,ecdsaThresholdKeyId:Ar(e.ecdsaThresholdKeyId),signingRootId:jr(e.signingRootId),signingRootVersion:Mr(e.signingRootVersion),participantIds:Ur(e.participantIds),thresholdOwnerAddress:Nr(e.thresholdOwnerAddress)}}function qr(e){return Kr({walletId:_(e.walletId),ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,participantIds:e.participantIds,thresholdOwnerAddress:e.thresholdOwnerAddress})}function Jr(e){return _e({walletId:_(e)})}async function Yr(e){return await tr(e)}function Xr(e){return{kind:`verified_ecdsa_public_facts`,keyHandle:e.keyHandle,publicKeyB64u:Vr(e.publicKeyB64u),participantIds:Ur(e.participantIds),thresholdOwnerAddress:Nr(e.thresholdOwnerAddress)}}function Zr(e){return{walletId:e.walletId,keyScope:e.keyFacts.keyScope,ecdsaThresholdKeyId:e.keyFacts.ecdsaThresholdKeyId,signingRootId:e.keyFacts.signingRootId,signingRootVersion:e.keyFacts.signingRootVersion,participantIds:e.keyFacts.participantIds,thresholdOwnerAddress:e.keyFacts.thresholdOwnerAddress}}function Qr(e){let t=Ir(e.keyHandle),n=qr(e),r=Xr({keyHandle:t,publicKeyB64u:e.thresholdEcdsaPublicKeyB64u,participantIds:n.participantIds,thresholdOwnerAddress:n.thresholdOwnerAddress});return{kind:`evm_family_ecdsa_wallet_key`,walletId:n.walletId,keyHandle:t,chainTarget:e.chainTarget,keyFacts:{kind:`evm_family_ecdsa_key_facts`,keyScope:n.keyScope,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,participantIds:r.participantIds,thresholdOwnerAddress:r.thresholdOwnerAddress,thresholdEcdsaPublicKeyB64u:r.publicKeyB64u}}}function $r(e){let t=[];if(String(e.expected.keyHandle)!==String(e.actual.keyHandle)&&t.push(`keyHandle`),String(e.expected.publicKeyB64u)!==String(e.actual.publicKeyB64u)&&t.push(`publicKeyB64u`),Wr(e.expected.participantIds)!==Wr(e.actual.participantIds)&&t.push(`participantIds`),String(e.expected.thresholdOwnerAddress)!==String(e.actual.thresholdOwnerAddress)&&t.push(`thresholdOwnerAddress`),t.length)throw Error(`[evm-family-ecdsa] ${e.context} public facts mismatch: ${t.join(`, `)}`)}function ei(e){return{kind:`passkey_ecdsa_auth_binding`,authMethod:ve.passkey,rpId:Or(e.rpId),credentialIdB64u:$(e.credentialIdB64u,`credentialIdB64u`)}}function ti(e){return{kind:`resolved_evm_family_ecdsa_key`,walletId:_(e.walletId),publicFacts:e.publicFacts,authBinding:e.authBinding}}function ni(e){return{kind:`hydrated_ecdsa_signer_material`,walletId:e.walletId,materialActivation:e.materialActivation,publicFacts:e.publicFacts,transport:e.transport,clientShare:e.clientShare,routerAbEcdsaDerivationNormalSigning:e.routerAbEcdsaDerivationNormalSigning}}function ri(e){let t=Math.floor(Number(e.ttlMs)),n=Math.floor(Number(e.remainingUses));if(!Number.isFinite(t)\|\|t<=0)throw Error(`[evm-family-ecdsa] ttlMs must be a positive finite value`);if(!Number.isFinite(n)\|\|n<=0)throw Error(`[evm-family-ecdsa] remainingUses must be a positive finite value`);return{chainTarget:e.chainTarget,thresholdSessionId:be.thresholdEcdsaSession(e.thresholdSessionId),ttlMs:t,remainingUses:n,runtimePolicyScope:e.runtimePolicyScope}}function ii(e){let t=Math.floor(Number(e.ttlMs)),n=Math.floor(Number(e.remainingUses));if(!Number.isFinite(t)\|\|t<=0)throw Error(`[evm-family-ecdsa] ttlMs must be a positive finite value`);if(!Number.isFinite(n)\|\|n<=0)throw Error(`[evm-family-ecdsa] remainingUses must be a positive finite value`);return{chainTarget:e.chainTarget,thresholdSessionId:be.thresholdEcdsaSession(e.thresholdSessionId),ttlMs:t,remainingUses:n,runtimePolicyScope:e.runtimePolicyScope}}function ai(e){return`evmfam-ecdsa:${Gr(d({version:`evm_family_ecdsa_key_fingerprint_v2`,walletId:String(e.walletId),baseEcdsaSubjectId:String(Jr(e.walletId)),keyScope:e.keyScope,ecdsaThresholdKeyId:String(e.ecdsaThresholdKeyId),signingRootId:String(e.signingRootId),signingRootVersion:String(e.signingRootVersion),participantIds:e.participantIds.map(e=>Number(e)),thresholdOwnerAddress:String(e.thresholdOwnerAddress)}))}`}function oi(e){return`evmfam-ecdsa:${Gr(d({version:`evm_family_ecdsa_public_facts_fingerprint_v1`,walletId:String(_(e.walletId)),keyHandle:String(e.publicFacts.keyHandle),publicKeyB64u:String(e.publicFacts.publicKeyB64u),participantIds:e.publicFacts.participantIds.map(e=>Number(e)),thresholdOwnerAddress:String(e.publicFacts.thresholdOwnerAddress)}))}`}function si(e,t){let n=String(e??``).trim();if(!n)throw Error(`[email-otp-derivation] ${t} is required`);return n}function ci(e){return si(e,`authSubjectId`)}function li(e){return ke(e)}function ui(e){return Ae(e)}function di(e){return je(e)}export{rn as $,y as $t,dr as A,it as At,Vn as B,He as Bt,Ir as C,tt as Ct,Pr as D,E as Dt,Vr as E,D as Et,ft as F,ze as Ft,K as G,Ne as Gt,on as H,Ve as Ht,pt as I,Fe as It,Ht as J,Ae as Jt,In as K,Me as Kt,mt as L,Ie as Lt,Qn as M,Ge as Mt,dt as N,lt as Nt,Dr as O,at as Ot,ht as P,We as Pt,en as Q,b as Qt,ut as R,Ue as Rt,Br as S,Xe as St,Fr as T,et as Tt,Yn as U,Re as Ut,bt as V,Be as Vt,Zn as W,Pe as Wt,yt as X,ke as Xt,Un as Y,je as Yt,Wn as Z,S as Zt,kr as _,V as _t,$r as a,Jt as at,Lr as b,z as bt,ri as c,Fn as ct,ei as d,xn as dt,we as en,an as et,ti as f,ln as ft,oi as g,fn as gt,ai as h,dn as ht,ci as i,Vt as it,xr as j,Ke as jt,br as k,ot as kt,Qr as l,Nn as lt,Yr as m,kn as mt,di as n,C as nn,Xt as nt,qr as o,Ln as ot,Xr as p,Qt as pt,B as q,De as qt,li as r,xe as rn,zt as rt,ii as s,zn as st,ui as t,Ce as tn,Yt as tt,ni as u,Dn as ut,Zr as v,un as vt,Hr as w,$e as wt,zr as x,Qe as xt,Rr as y,Zt as yt,Kn as z,Le as zt};
1	+ import{E as e,M as t,O as n,T as r,_ as i,a,h as o,j as s,n as c,s as l,x as u,y as ee}from"./domainIds-C3fUa33Q.js";import{c as d,h as te,k as f,u as p}from"./chains-CPmd4s9f.js";import{_ as ne,l as re,t as m,w as ie,x as ae,y as oe}from"./primitives-cC0a9GRC.js";import{i as h,r as g}from"./base64-DW79QA0h.js";import{i as se,n as ce}from"./activeWalletSession-Ba6X4CUN.js";import{d as le,g as ue,h as de,m as fe,n as pe,u as me}from"./capabilityKinds-D0Yrp9uf.js";import{n as he,r as ge}from"./canonicalPrimitives-BOzRXzfv.js";import{c as _,l as _e}from"./ecdsaChainTarget-DkOrgv4y.js";import{n as ve}from"./signerDomain-BFqRQ0Jl.js";import{c as ye}from"./digestEncoding-CbEFYvlJ.js";import{r as be}from"./types-CQTWmtqu.js";function xe(e,t){let n=te(e,t);if(!/^x25519:[0-9a-f]{64}$/.test(n))throw Error(`${t} must use x25519:<64 lowercase hex chars> encoding`);return n}function Se(e,t,n){let r=Object.keys(e).sort(),i=[...t].sort();if(r.length!==i.length\|\|r.some((e,t)=>e!==i[t]))throw Error(`${n} has invalid fields`)}function v(e,t){if(typeof e!=`string`\|\|e.trim()!==e\|\|!e)throw Error(`${t} is required`);if(!/^[\x20-\x7e]+$/.test(e))throw Error(`${t} must be printable ASCII`);return e}function y(e){let t=f(e,`authorization`);switch(t.kind){case`reusable_wallet_session`:return Se(t,[`kind`,`wallet_session_id`],`authorization`),{kind:`reusable_wallet_session`,wallet_session_id:v(t.wallet_session_id,`authorization.wallet_session_id`)};case`operation_step_up`:return Se(t,[`kind`],`authorization`),{kind:`operation_step_up`};default:throw Error(`authorization.kind is not supported`)}}function b(e){let t=f(e,`material_activation`);if(Se(t,[`kind`,`activation_id`,`capability`,`material_owner`,`key_binding`,`lifecycle_binding`,`signing_worker`],`material_activation`),t.kind!==`mpc_material_activation_ref`)throw Error(`material_activation.kind is not supported`);return{kind:`mpc_material_activation_ref`,activation_id:v(t.activation_id,`material_activation.activation_id`),capability:v(t.capability,`material_activation.capability`),material_owner:v(t.material_owner,`material_activation.material_owner`),key_binding:v(t.key_binding,`material_activation.key_binding`),lifecycle_binding:v(t.lifecycle_binding,`material_activation.lifecycle_binding`),signing_worker:v(t.signing_worker,`material_activation.signing_worker`)}}function Ce(e){return b({kind:e.kind,activation_id:e.activationId,capability:e.capability,material_owner:e.materialOwner,key_binding:e.keyBinding,lifecycle_binding:e.lifecycleBinding,signing_worker:e.signingWorker})}function we(e){let t=b(e),n=o({kind:t.kind,activationId:t.activation_id,capability:t.capability,materialOwner:t.material_owner,keyBinding:t.key_binding,lifecycleBinding:t.lifecycle_binding,signingWorker:t.signing_worker});if(!n.ok)throw Error(`material_activation is invalid: ${n.error.message}`);return n.value}function Te(e){return new TextEncoder().encode(e)}function x(e,t){let n=Te(t),r=n.length>>>0;e.push(r>>>24&255,r>>>16&255,r>>>8&255,r&255),e.push(...n)}function Ee(e){let t=y(e),n=[];switch(x(n,t.kind),t.kind){case`reusable_wallet_session`:x(n,t.wallet_session_id);break;case`operation_step_up`:break}return new Uint8Array(n)}function S(e){let t=b(e),n=[];return x(n,t.kind),x(n,t.activation_id),x(n,t.capability),x(n,t.material_owner),x(n,t.key_binding),x(n,t.lifecycle_binding),x(n,t.signing_worker),new Uint8Array(n)}function C(e,t){return e.kind===t.kind&&e.activation_id===t.activation_id&&e.capability===t.capability&&e.material_owner===t.material_owner&&e.key_binding===t.key_binding&&e.lifecycle_binding===t.lifecycle_binding&&e.signing_worker===t.signing_worker}function De(e){let t=e.trim(),n=g(t);if(n.length!==33\|\|h(n)!==t)throw Error(`ECDSA client root public key must be canonical base64url for 33 bytes`);return t}function Oe(e,t){let n=String(e??``).trim();if(!n)throw Error(`${t} is required`);return n}function ke(e){return Oe(e,`ecdsaThresholdKeyId`)}function Ae(e){return Oe(e,`signingRootId`)}function je(e){return Oe(e,`signingRootVersion`)}async function Me(e){let t=ye(e);return`ederivation-relayer-${h(await p(d({version:`threshold_ecdsa_derivation_relayer_key_id_v1`,schemeId:`threshold-secp256k1-ecdsa-2p-v1`,walletId:e.walletId,evmFamilySigningKeySlotId:t})))}`}function w(e,t){if(typeof e!=`string`\|\|e.trim()!==e\|\|e.length===0)throw Error(`${t} must be a non-empty canonical string`);return e}function T(e,t,n){if(typeof e!=`string`\|\|!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be unpadded base64url`);let r;try{r=g(e)}catch{throw Error(`${t} must be valid base64url`)}if(r.length===0\|\|n!==null&&r.length!==n\|\|h(r)!==e)throw Error(`${t} has an invalid canonical byte length`);return e}function Ne(e){return w(e,`ECDSA signer id`)}function Pe(e){return w(e,`ECDSA server generation`)}function Fe(e){return w(e,`ECDSA manifest id`)}function Ie(e){if(!Number.isSafeInteger(e)\|\|Number(e)<1)throw Error(`ECDSA manifest revision must be a positive safe integer`);return e}function Le(e){return T(e,`ECDSA ciphertext digest`,32)}function Re(e){return T(e,`ECDSA pending ciphertext digest`,32)}function ze(e){return T(e,`ECDSA activation digest`,32)}function Be(e){return w(e,`ECDSA lifecycle id`)}function Ve(e){return w(e,`ECDSA material sealing key id`)}function He(e){return T(e,`ECDSA AES-GCM IV`,12)}function Ue(e){return T(e,`ECDSA ciphertext`,null)}function We(e){if(typeof e!=`string`\|\|e.trim()!==e)throw Error(`ECDSA server activation request must be canonical JSON`);let t;try{t=JSON.parse(e)}catch{throw Error(`ECDSA server activation request must be canonical JSON`)}if(typeof t!=`object`\|\|!t\|\|Array.isArray(t)\|\|d(t)!==e)throw Error(`ECDSA server activation request must be a canonical JSON object`);return e}function E(e){return e.factor.kind===`passkey`}function D(e){return e.factor.kind===`email_otp`}function Ge(e,t){return e.walletId!==t.walletId\|\|e.bindingId!==t.bindingId?!1:E(e)?E(t)?e.factor.credentialIdB64u===t.factor.credentialIdB64u&&e.verifier.rpId===t.verifier.rpId:!1:D(e)&&D(t)?e.factor.provider===t.factor.provider&&e.factor.providerUserId===t.factor.providerUserId&&e.verifier.emailHashHex===t.verifier.emailHashHex:!1}function Ke(t){if(!t\|\|typeof t!=`object`\|\|Array.isArray(t))return null;let i=t,a=Object.keys(i);if(a.length!==4\|\|!a.every(e=>[`kind`,`walletId`,`authorityDigest`,`walletAuthMethodId`].includes(e))\|\|i.kind!==`wallet_auth_authority_ref`)return null;let o=n(i.walletId),s=e(i.authorityDigest),c=r(i.walletAuthMethodId);return!o.ok\|\|!s.ok\|\|!c.ok?null:{kind:`wallet_auth_authority_ref`,walletId:o.value,authorityDigest:s.value,walletAuthMethodId:c.value}}function qe(e){let t=String(e\|\|``).trim().toLowerCase();return t===`google`\|\|t===`email`?t:null}function O(e,t){if(e.ok)return e.value;throw Error(t)}function Je(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function Ye(e,t){for(let n of t)if(Je(e,n))return!0;return!1}function Xe(e){let i=O(n(e.walletId),`Passkey wallet auth authority requires walletId`),a=O(t(e.rpId),`Passkey wallet auth authority requires rpId`),o=O(s(e.credentialIdB64u),`Passkey wallet auth authority requires credentialIdB64u`),c=O(r(`passkey:${a}:${o}`),`Passkey wallet auth authority requires bindingId`);return{walletId:i,factor:{kind:`passkey`,credentialIdB64u:o},verifier:{kind:`webauthn`,rpId:a},bindingId:c}}function Ze(e){let t=qe(e.provider);if(!t)throw Error(`Email OTP factor identity requires provider`);return{kind:`email_otp`,provider:t,providerUserId:O(l(e.providerUserId),`Email OTP factor identity requires providerUserId`)}}function Qe(e){let t=O(n(e.walletId),`Email OTP wallet auth authority requires walletId`),i=Ze(e),a=String(e.emailHashHex\|\|``).trim();if(!a)throw Error(`Email OTP wallet auth authority requires emailHashHex`);let o=O(r(`email_otp:${t}:${a}`),`Email OTP wallet auth authority requires bindingId`);return{walletId:t,factor:i,verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:a},bindingId:o}}function $e(e){return e.factor.provider}function et(e){return e.factor.providerUserId}function tt(e){return e.verifier.emailHashHex}function nt(e){let i=e.factor;if(!i\|\|typeof i!=`object`\|\|Array.isArray(i))return null;let a=e.verifier;if(!a\|\|typeof a!=`object`\|\|Array.isArray(a))return null;let o=i,c=a,l=String(o.kind\|\|``).trim().toLowerCase(),u=String(c.kind\|\|``).trim().toLowerCase();if(l!==`passkey`\|\|u!==`webauthn`)return null;try{if(Ye(e,[`kind`,`rpId`,`credentialIdB64u`,`provider`,`providerUserId`]))return null;let i=n(e.walletId),a=t(c.rpId),l=s(o.credentialIdB64u),u=r(e.bindingId);return!i.ok\|\|!a.ok\|\|!l.ok\|\|!u.ok?null:{walletId:i.value,factor:{kind:`passkey`,credentialIdB64u:l.value},verifier:{kind:`webauthn`,rpId:a.value},bindingId:u.value}}catch{return null}}function rt(e){let t=e.factor;if(!t\|\|typeof t!=`object`\|\|Array.isArray(t))return null;let i=e.verifier;if(!i\|\|typeof i!=`object`\|\|Array.isArray(i))return null;let a=t,o=i,s=String(a.kind\|\|``).trim().toLowerCase(),c=String(o.kind\|\|``).trim().toLowerCase();if(s!==`email_otp`\|\|c!==`email_otp_wallet_auth_method`)return null;try{if(Ye(e,[`kind`,`rpId`,`credentialIdB64u`,`provider`,`providerUserId`]))return null;let t=n(e.walletId),i=qe(a.provider),s=l(a.providerUserId),c=String(o.emailHashHex\|\|``).trim(),u=r(e.bindingId);return!t.ok\|\|!i\|\|!s.ok\|\|!c\|\|!u.ok?null:{walletId:t.value,factor:{kind:`email_otp`,provider:i,providerUserId:s.value},verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:c},bindingId:u.value}}catch{return null}}function it(e){if(!e\|\|typeof e!=`object`\|\|Array.isArray(e))return null;let t=e;return nt(t)\|\|rt(t)}function at(e){return!e\|\|typeof e!=`object`\|\|Array.isArray(e)?null:rt(e)}function ot(e){return!e\|\|typeof e!=`object`\|\|Array.isArray(e)?null:nt(e)}function st(e){return`seams:wallet-authority-binding:v1\|${d(e.authority)}`}async function ct(t){return O(e(h(await p(st(t)))),`Wallet authority binding digest must be non-empty`)}async function lt(e){return{kind:`wallet_auth_authority_ref`,walletId:e.authority.walletId,authorityDigest:await ct({authority:e.authority}),walletAuthMethodId:e.authority.bindingId}}const ut=5*6e4,dt=`/router-ab/ecdsa-derivation/export`,ft=`/router-ab/ecdsa-derivation/presignature-pool/fill/init`,pt=`/router-ab/ecdsa-derivation/presignature-pool/fill/step`,mt=`/router-ab/ecdsa-derivation/session/activate`,ht=`/router-ab/ecdsa-derivation/operation-step-up`,gt=[1,2];function _t(e,t){if(e===`reusable_wallet_session`\|\|e===`verified_step_up`)return e;throw Error(`${t} must be reusable_wallet_session or verified_step_up`)}function vt(e){let t=f(e,`operationStepUpAuthorizationResponse.export_topology`);k(t,`operationStepUpAuthorizationResponse.export_topology`,[`signer_set`,`deriver_recipient_keys`,`router_id`]);let n=Ft(t.signer_set,`operationStepUpAuthorizationResponse.export_topology.signer_set`),r=Rt(t.deriver_recipient_keys,`operationStepUpAuthorizationResponse.export_topology.deriver_recipient_keys`);if(r.deriver_a.key_epoch!==n.signer_a.key_epoch\|\|r.deriver_b.key_epoch!==n.signer_b.key_epoch)throw Error(`operationStepUpAuthorizationResponse.export_topology recipient key epochs do not match signer_set`);return{signer_set:n,deriver_recipient_keys:r,router_id:A(t.router_id,`operationStepUpAuthorizationResponse.export_topology.router_id`)}}function yt(e){let t=f(e,`operationStepUpAuthorizationResponse`),n=Gn(t.operation_kind);if(k(t,`operationStepUpAuthorizationResponse`,[`ok`,`kind`,`authorization`,`expires_at_ms`,`operation_kind`,...n===`evm.export_key`?[`export_topology`]:[]]),t.ok!==!0\|\|t.kind!==`verified_step_up`)throw Error(`operationStepUpAuthorizationResponse is invalid`);let r=f(t.authorization,`operationStepUpAuthorizationResponse.authorization`);if(k(r,`operationStepUpAuthorizationResponse.authorization`,[`kind`,`evidence_set_digest`,`unseal`]),r.kind!==`operation_step_up`)throw Error(`operationStepUpAuthorizationResponse.authorization.kind is invalid`);let i=M(t.expires_at_ms,`operationStepUpAuthorizationResponse.expires_at_ms`);if(i<=Date.now())throw Error(`operationStepUpAuthorizationResponse.expires_at_ms is expired`);let a=f(r.unseal,`operationStepUpAuthorizationResponse.authorization.unseal`),o=A(a.kind,`operationStepUpAuthorizationResponse.authorization.unseal.kind`),s;switch(o){case`not_requested`:k(a,`operationStepUpAuthorizationResponse.authorization.unseal`,[`kind`]),s={kind:`not_requested`};break;case`email_otp_grant`:k(a,`operationStepUpAuthorizationResponse.authorization.unseal`,[`kind`,`grant`,`challenge_id`]),s={kind:`email_otp_grant`,grant:A(a.grant,`operationStepUpAuthorizationResponse.authorization.unseal.grant`),challenge_id:A(a.challenge_id,`operationStepUpAuthorizationResponse.authorization.unseal.challenge_id`)};break;default:throw Error(`operationStepUpAuthorizationResponse.authorization.unseal.kind is invalid`)}let c={ok:!0,kind:`verified_step_up`,authorization:{kind:`operation_step_up`,evidence_set_digest:ge(r.evidence_set_digest),unseal:s},expires_at_ms:i};return n===`evm.sign_transaction`?{...c,operation_kind:`evm.sign_transaction`}:{...c,operation_kind:`evm.export_key`,export_topology:vt(t.export_topology)}}async function bt(e){return h(await p(d({domain:`router-ab-ecdsa-operation-step-up/challenge/v1`,operation:Wn(e)})))}function k(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`)}function A(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} is required`);if(!/^[\x20-\x7e]+$/.test(n))throw Error(`${t} must be printable ASCII`);return n}function j(e,t){let n=ee(A(e,t));if(!n.ok)throw Error(`${t} is invalid`);return n.value}function xt(e,t){let n=u(A(e,t));if(!n.ok)throw Error(`${t} is invalid`);return n.value}function St(e,t){let n=me(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function Ct(e,t){let n=fe(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function wt(e,t){let n=de(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function Tt(e,t){let n=le(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function M(e,t){if(typeof e!=`number`\|\|!Number.isSafeInteger(e)\|\|e<=0)throw Error(`${t} must be a positive safe integer`);return e}function N(e,t){if(typeof e!=`number`\|\|!Number.isSafeInteger(e)\|\|e<=0)throw Error(`${t} must be a positive safe-integer counter`);return e}function Et(e,t){if(typeof e!=`number`\|\|!Number.isFinite(e))throw Error(`${t} must be a finite number`);let n=Math.floor(e);if(n!==e\|\|n<0\|\|n>4294967295)throw Error(`${t} must be a u32 integer`);return n}function Dt(e,t){if(typeof e!=`number`\|\|!Number.isFinite(e))throw Error(`${t} must be a finite number`);let n=Math.floor(e);if(n!==e\|\|n<0\|\|n>255)throw Error(`${t} must be a byte`);return n}function P(e,t,n){let r=A(e,t);if(!/^[A-Za-z0-9_-]+$/.test(r))throw Error(`${t} must be unpadded base64url`);let i;try{i=g(r)}catch{throw Error(`${t} must be valid base64url`)}if(i.length!==n)throw Error(`${t} must decode to ${n} bytes`);return r}function F(e,t){let n=P(e,t,33),r=g(n);if(r[0]!==2&&r[0]!==3)throw Error(`${t} must be a compressed secp256k1 public key`);return n}function Ot(e,t){let n=A(e,t);if(!/^[A-Za-z0-9_-]+$/.test(n))throw Error(`${t} must be unpadded base64url`);let r;try{r=g(n)}catch{throw Error(`${t} must be valid base64url`)}if(r.length===0)throw Error(`${t} must decode to non-empty bytes`);return n}function kt(e,t){let n=A(e,t);if(!/^x25519:[0-9a-f]{64}$/.test(n))throw Error(`${t} must use x25519:<64 lowercase hex chars> encoding`);return n}function I(e,t,n){if(!(e instanceof Uint8Array))throw Error(`${t} must be a Uint8Array`);if(e.length!==n)throw Error(`${t} must contain ${n} bytes`);return e}function At(e,t){let n=A(e,t);if(n!==`ecdsa_secp256k1_recoverable_v1`)throw Error(`${t} must be ecdsa_secp256k1_recoverable_v1`);return n}function L(e,t){let n=f(e,t);if(k(n,t,[`bytes`]),!Array.isArray(n.bytes))throw Error(`${t}.bytes must be an array`);if(n.bytes.length!==32)throw Error(`${t}.bytes must contain 32 bytes`);return{bytes:n.bytes.map((e,n)=>Dt(e,`${t}.bytes[${n}]`))}}function R(e){let t=f(e,`scope.context`);k(t,`scope.context`,[`application_binding_digest_b64u`]);let n=g(A(t.application_binding_digest_b64u,`scope.context.application_binding_digest_b64u`));if(n.length!==32)throw Error(`scope.context.application_binding_digest_b64u must decode to 32 bytes`);return{application_binding_digest_b64u:h(n)}}function jt(e){let t=f(e,`scope.public_identity`);return k(t,`scope.public_identity`,[`context_binding_b64u`,`derivation_client_share_public_key33_b64u`,`server_public_key33_b64u`,`threshold_public_key33_b64u`,`ethereum_address20_b64u`,`client_share_retry_counter`,`server_share_retry_counter`]),{context_binding_b64u:P(t.context_binding_b64u,`scope.public_identity.context_binding_b64u`,32),derivation_client_share_public_key33_b64u:F(t.derivation_client_share_public_key33_b64u,`scope.public_identity.derivation_client_share_public_key33_b64u`),server_public_key33_b64u:F(t.server_public_key33_b64u,`scope.public_identity.server_public_key33_b64u`),threshold_public_key33_b64u:F(t.threshold_public_key33_b64u,`scope.public_identity.threshold_public_key33_b64u`),ethereum_address20_b64u:P(t.ethereum_address20_b64u,`scope.public_identity.ethereum_address20_b64u`,20),client_share_retry_counter:Et(t.client_share_retry_counter,`scope.public_identity.client_share_retry_counter`),server_share_retry_counter:Et(t.server_share_retry_counter,`scope.public_identity.server_share_retry_counter`)}}function Mt(e){return Nt(e,`scope.signing_worker`)}function Nt(e,t){let n=f(e,t);return k(n,t,[`server_id`,`key_epoch`,`recipient_encryption_key`]),{server_id:A(n.server_id,`${t}.server_id`),key_epoch:A(n.key_epoch,`${t}.key_epoch`),recipient_encryption_key:xe(n.recipient_encryption_key,`${t}.recipient_encryption_key`)}}function Pt(e,t,n){let r=f(e,t);if(k(r,t,[`role`,`signer_id`,`key_epoch`]),A(r.role,`${t}.role`)!==n)throw Error(`${t}.role must be ${n}`);return{role:n,signer_id:A(r.signer_id,`${t}.signer_id`),key_epoch:A(r.key_epoch,`${t}.key_epoch`)}}function Ft(e,t){let n=f(e,t);k(n,t,[`signer_set_id`,`policy`,`signer_a`,`signer_b`,`selected_server`]);let r=A(n.policy,`${t}.policy`);if(r!==`all_2`)throw Error(`${t}.policy must be all_2`);let i=Pt(n.signer_a,`${t}.signer_a`,`signer_a`),a=Pt(n.signer_b,`${t}.signer_b`,`signer_b`);if(i.signer_id===a.signer_id)throw Error(`${t} requires distinct signer ids`);return{signer_set_id:A(n.signer_set_id,`${t}.signer_set_id`),policy:r,signer_a:i,signer_b:a,selected_server:Nt(n.selected_server,`${t}.selected_server`)}}function It(e){let t=`registration.lifecycle`,n=f(e,t);if(k(n,t,[`lifecycle_id`,`work_kind`,`primitive_request_kind`,`root_share_epoch`,`account_id`,`session_id`,`signer_set_id`,`selected_server_id`]),n.work_kind!==`registration_prepare`)throw Error(`${t}.work_kind must be registration_prepare`);if(n.primitive_request_kind!==`registration`)throw Error(`${t}.primitive_request_kind must be registration`);return{lifecycle_id:A(n.lifecycle_id,`${t}.lifecycle_id`),work_kind:`registration_prepare`,primitive_request_kind:`registration`,root_share_epoch:j(n.root_share_epoch,`${t}.root_share_epoch`),account_id:A(n.account_id,`${t}.account_id`),session_id:A(n.session_id,`${t}.session_id`),signer_set_id:A(n.signer_set_id,`${t}.signer_set_id`),selected_server_id:A(n.selected_server_id,`${t}.selected_server_id`)}}function Lt(e,t,n){let r=f(e,t);if(k(r,t,[`role`,`key_epoch`,`public_key`]),r.role!==n)throw Error(`${t}.role must be ${n}`);return{role:n,key_epoch:A(r.key_epoch,`${t}.key_epoch`),public_key:xe(r.public_key,`${t}.public_key`)}}function Rt(e,t=`registration.deriver_recipient_keys`){let n=f(e,t);return k(n,t,[`deriver_a`,`deriver_b`]),{deriver_a:Lt(n.deriver_a,`${t}.deriver_a`,`signer_a`),deriver_b:Lt(n.deriver_b,`${t}.deriver_b`,`signer_b`)}}function zt(e){let t=`registration`,n=f(e,t);if(k(n,t,[`registration_purpose`,`context`,`lifecycle`,`signer_set`,`router_id`,`client_id`,`replay_nonce`,`expires_at_ms`,`deriver_recipient_keys`]),n.registration_purpose!==`wallet_registration`&&n.registration_purpose!==`wallet_add_signer`)throw Error(`${t}.registration_purpose is invalid`);let r=It(n.lifecycle),i=Ft(n.signer_set,`${t}.signer_set`);if(r.signer_set_id!==i.signer_set_id)throw Error(`${t}.lifecycle signer set does not match signer_set`);if(r.selected_server_id!==i.selected_server.server_id)throw Error(`${t}.lifecycle selected server does not match signer_set`);let a=Rt(n.deriver_recipient_keys);if(a.deriver_a.key_epoch!==i.signer_a.key_epoch)throw Error(`${t}.deriver_a recipient key epoch does not match signer_set`);if(a.deriver_b.key_epoch!==i.signer_b.key_epoch)throw Error(`${t}.deriver_b recipient key epoch does not match signer_set`);return{registration_purpose:n.registration_purpose,context:R(n.context),lifecycle:r,signer_set:i,router_id:A(n.router_id,`${t}.router_id`),client_id:A(n.client_id,`${t}.client_id`),replay_nonce:A(n.replay_nonce,`${t}.replay_nonce`),expires_at_ms:M(n.expires_at_ms,`${t}.expires_at_ms`),deriver_recipient_keys:a}}function Bt(e,t){let n=f(e,t);if(k(n,t,[`kind`,`transcriptDigestB64u`,`payloadB64u`]),n.kind!==`recipient_proof_bundle`)throw Error(`${t}.kind must be recipient_proof_bundle`);return{kind:`recipient_proof_bundle`,transcriptDigestB64u:P(n.transcriptDigestB64u,`${t}.transcriptDigestB64u`,32),payloadB64u:Ot(n.payloadB64u,`${t}.payloadB64u`)}}function Vt(e){let t=`registrationForwarded`,n=f(e,t);if(k(n,t,[`result`,`response`]),n.result!==`forwarded`)throw Error(`${t}.result must be forwarded`);return{result:`forwarded`,response:qt(n.response,`${t}.response`)}}function Ht(e){return Ut(e,Wt)}function Ut(e,t){let n=`explicitExportForwarded`,r=f(e,n);if(k(r,n,[`result`,`response`,`signing_worker_export`]),r.result!==`forwarded`)throw Error(`${n}.result must be forwarded`);return{result:`forwarded`,response:qt(r.response,`${n}.response`),signing_worker_export:t(r.signing_worker_export)}}function Wt(e){return Kt(e,b)}function Gt(e,t,n){let r=f(e,n);k(r,n,[`wallet_id`,`key_handle`,`ecdsa_threshold_key_id`,`signing_root_id`,`signing_root_version`,`activation_epoch`,`signing_worker_id`,`context_binding_b64u`,`threshold_public_key33_b64u`,`export_request_digest_b64u`,`export_authorization_digest_b64u`,`export_nonce`,`authorization_kind`,`authorization_id`,`material_activation`,`lifecycle_id`,`recipient_identity`,`recipient_public_key`,`expires_at_ms`]);let i=t(r.material_activation);if(i.material_owner!==r.wallet_id\|\|i.signing_worker!==r.signing_worker_id)throw Error(`${n}.material_activation is not bound to wallet and worker`);return{wallet_id:A(r.wallet_id,`${n}.wallet_id`),key_handle:A(r.key_handle,`${n}.key_handle`),ecdsa_threshold_key_id:A(r.ecdsa_threshold_key_id,`${n}.ecdsa_threshold_key_id`),signing_root_id:A(r.signing_root_id,`${n}.signing_root_id`),signing_root_version:A(r.signing_root_version,`${n}.signing_root_version`),activation_epoch:j(r.activation_epoch,`${n}.activation_epoch`),signing_worker_id:A(r.signing_worker_id,`${n}.signing_worker_id`),context_binding_b64u:P(r.context_binding_b64u,`${n}.context_binding_b64u`,32),threshold_public_key33_b64u:F(r.threshold_public_key33_b64u,`${n}.threshold_public_key33_b64u`),export_request_digest_b64u:P(r.export_request_digest_b64u,`${n}.export_request_digest_b64u`,32),export_authorization_digest_b64u:P(r.export_authorization_digest_b64u,`${n}.export_authorization_digest_b64u`,32),export_nonce:A(r.export_nonce,`${n}.export_nonce`),authorization_kind:_t(r.authorization_kind,`${n}.authorization_kind`),authorization_id:A(r.authorization_id,`${n}.authorization_id`),material_activation:i,lifecycle_id:A(r.lifecycle_id,`${n}.lifecycle_id`),recipient_identity:A(r.recipient_identity,`${n}.recipient_identity`),recipient_public_key:kt(r.recipient_public_key,`${n}.recipient_public_key`),expires_at_ms:M(r.expires_at_ms,`${n}.expires_at_ms`)}}function Kt(e,t){let n=`signingWorkerExportShare`,r=f(e,n);if(k(r,n,[`version`,`algorithm`,`binding`,`ciphertext_and_tag`]),r.version!==`router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1`)throw Error(`${n}.version is invalid`);if(r.algorithm!==`hpke_x25519_hkdf_sha256_aes256gcm_v1`)throw Error(`${n}.algorithm is invalid`);if(!Array.isArray(r.ciphertext_and_tag)\|\|r.ciphertext_and_tag.length<=48)throw Error(`${n}.ciphertext_and_tag is invalid`);return{version:`router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1`,algorithm:`hpke_x25519_hkdf_sha256_aes256gcm_v1`,binding:Gt(r.binding,t,`${n}.binding`),ciphertext_and_tag:r.ciphertext_and_tag.map((e,t)=>Dt(e,`${n}.ciphertext_and_tag[${t}]`))}}function qt(e,t){let n=f(e,t);k(n,t,[`bundles`]);let r=`${t}.bundles`,i=f(n.bundles,r);return k(i,r,[`signerA`,`signerB`]),{bundles:{signerA:Bt(i.signerA,`${r}.signerA`),signerB:Bt(i.signerB,`${r}.signerB`)}}}function Jt(e){let t=`registrationActivation.publicFacts`,n=f(e,t);if(k(n,t,[`registrationRequestDigestB64u`,`proofTranscriptDigestB64u`,`contextBinding32B64u`,`derivationClientSharePublicKey33B64u`,`clientShareRetryCounter`,`participantId`]),n.participantId!==1)throw Error(`${t}.participantId must be 1`);return{registrationRequestDigestB64u:P(n.registrationRequestDigestB64u,`${t}.registrationRequestDigestB64u`,32),proofTranscriptDigestB64u:P(n.proofTranscriptDigestB64u,`${t}.proofTranscriptDigestB64u`,32),contextBinding32B64u:P(n.contextBinding32B64u,`${t}.contextBinding32B64u`,32),derivationClientSharePublicKey33B64u:F(n.derivationClientSharePublicKey33B64u,`${t}.derivationClientSharePublicKey33B64u`),clientShareRetryCounter:Et(n.clientShareRetryCounter,`${t}.clientShareRetryCounter`),participantId:1}}function Yt(e){let t=`registrationActivationReceipt`,n=f(e,t);k(n,t,[`activation_correlation_id`,`activation_request_digest`,`server_generation`,`ecdsa_activation`,`lifecycle_id`,`transcript_digest`]);let r=`${t}.ecdsa_activation`,i=f(n.ecdsa_activation,r);k(i,r,[`context`,`public_identity`,`signing_worker`,`material_activation`,`activation_epoch`,`activation_digest_b64u`,`activated_at_ms`]);let a=Nt(i.signing_worker,`${r}.signing_worker`),o=b(i.material_activation);if(o.signing_worker!==a.server_id)throw Error(`${r}.material_activation.signing_worker does not match signing_worker`);let s=P(i.activation_digest_b64u,`${r}.activation_digest_b64u`,32),c=L(n.transcript_digest,`${t}.transcript_digest`);return{activation_correlation_id:he(n.activation_correlation_id),activation_request_digest:L(n.activation_request_digest,`${t}.activation_request_digest`),server_generation:Pe(n.server_generation),ecdsa_activation:{context:R(i.context),public_identity:jt(i.public_identity),signing_worker:a,material_activation:o,activation_epoch:j(i.activation_epoch,`${r}.activation_epoch`),activation_digest_b64u:s,activated_at_ms:M(i.activated_at_ms,`${r}.activated_at_ms`)},lifecycle_id:A(n.lifecycle_id,`${t}.lifecycle_id`),transcript_digest:c}}function Xt(e){return Yt(e)}function z(e,t){return e.server_id===t.server_id&&e.key_epoch===t.key_epoch&&e.recipient_encryption_key===t.recipient_encryption_key}function Zt(e,t){return e.registrationRequestDigestB64u===t.registrationRequestDigestB64u&&e.proofTranscriptDigestB64u===t.proofTranscriptDigestB64u&&e.contextBinding32B64u===t.contextBinding32B64u&&e.derivationClientSharePublicKey33B64u===t.derivationClientSharePublicKey33B64u&&e.clientShareRetryCounter===t.clientShareRetryCounter&&e.participantId===t.participantId}function Qt(e,t){return e.signer_set_id===t.signer_set_id&&e.policy===t.policy&&e.signer_a.role===t.signer_a.role&&e.signer_a.signer_id===t.signer_a.signer_id&&e.signer_a.key_epoch===t.signer_a.key_epoch&&e.signer_b.role===t.signer_b.role&&e.signer_b.signer_id===t.signer_b.signer_id&&e.signer_b.key_epoch===t.signer_b.key_epoch&&z(e.selected_server,t.selected_server)}function B(e){let t=`ecdsaPublicCapability`,n=f(e,t);if(k(n,t,[`kind`,`context`,`public_identity`,`material_activation`,`signer_set`,`deriver_recipient_keys`,`router_id`,`client_id`,`activation_epoch`,`registration_request_digest_b64u`,`proof_transcript_digest_b64u`]),n.kind!==`router_ab_ecdsa_derivation_public_capability_v1`)throw Error(`${t}.kind is invalid`);let r=Ft(n.signer_set,`${t}.signer_set`),i=Rt(n.deriver_recipient_keys,`${t}.deriver_recipient_keys`);if(i.deriver_a.key_epoch!==r.signer_a.key_epoch\|\|i.deriver_b.key_epoch!==r.signer_b.key_epoch)throw Error(`${t} Deriver recipient key epochs do not match signer_set`);return{kind:`router_ab_ecdsa_derivation_public_capability_v1`,context:R(n.context),public_identity:jt(n.public_identity),material_activation:b(n.material_activation),signer_set:r,deriver_recipient_keys:i,router_id:A(n.router_id,`${t}.router_id`),client_id:A(n.client_id,`${t}.client_id`),activation_epoch:j(n.activation_epoch,`${t}.activation_epoch`),registration_request_digest_b64u:P(n.registration_request_digest_b64u,`${t}.registration_request_digest_b64u`,32),proof_transcript_digest_b64u:P(n.proof_transcript_digest_b64u,`${t}.proof_transcript_digest_b64u`,32)}}function $t(e){let t=`postRegistrationSessionActivation.session_policy`,n=f(e,t);return k(n,t,[`threshold_session_id`,`wallet_session_mint_id`,`ttl_ms`,`remaining_uses`,`runtime_policy_scope`]),{threshold_session_id:xt(n.threshold_session_id,`${t}.threshold_session_id`),wallet_session_mint_id:tn(n.wallet_session_mint_id,`${t}.wallet_session_mint_id`),ttl_ms:N(n.ttl_ms,`${t}.ttl_ms`),remaining_uses:N(n.remaining_uses,`${t}.remaining_uses`),runtime_policy_scope:oe(n.runtime_policy_scope)}}function en(e){let t=`postRegistrationSessionActivationPolicy`,n=f(e,t);if(k(n,t,[`kind`,`key_handle`,`session_policy`]),n.kind!==`router_ab_ecdsa_post_registration_session_activation_policy_v1`)throw Error(`${t}.kind is invalid`);return{kind:`router_ab_ecdsa_post_registration_session_activation_policy_v1`,key_handle:A(n.key_handle,`${t}.key_handle`),session_policy:$t(n.session_policy)}}function tn(e,t){let n=ue(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function V(e,t){return e.context_binding_b64u===t.context_binding_b64u&&e.derivation_client_share_public_key33_b64u===t.derivation_client_share_public_key33_b64u&&e.server_public_key33_b64u===t.server_public_key33_b64u&&e.threshold_public_key33_b64u===t.threshold_public_key33_b64u&&e.ethereum_address20_b64u===t.ethereum_address20_b64u&&e.client_share_retry_counter===t.client_share_retry_counter&&e.server_share_retry_counter===t.server_share_retry_counter}function nn(e,t){for(let n of e.capabilitySubjects)if(!(n.kind!==`sign`\|\|n.keyFamily!==`ecdsa_secp256k1`))return C(t.material_activation,Ce(n.materialActivation));return!1}function rn(e){let t=`postRegistrationSessionActivation`,n=f(e,t);if(k(n,t,[`kind`,`public_capability`,`session_policy`]),n.kind!==`router_ab_ecdsa_post_registration_session_activation_v1`)throw Error(`${t}.kind is invalid`);return{kind:`router_ab_ecdsa_post_registration_session_activation_v1`,public_capability:B(n.public_capability),session_policy:$t(n.session_policy)}}function an(e){let t=`postRegistrationSessionActivated`,n=f(e,t);if(k(n,t,[`kind`,`public_capability`,`session`,`normal_signing`]),n.kind!==`router_ab_ecdsa_post_registration_session_activated_v1`)throw Error(`${t}.kind is invalid`);let r=B(n.public_capability),i=f(n.session,`${t}.session`);k(i,`${t}.session`,[`authorization_session_id`,`authorization_id`,`threshold_session_id`,`wallet_session_id`,`quota_id`,`expires_at_ms`,`remaining_uses`,`wallet_session`,`operation_credential`]);let a=Ln(n.normal_signing),o=Ct(i.authorization_id,`${t}.session.authorization_id`),s=wt(i.wallet_session_id,`${t}.session.wallet_session_id`),c=M(i.expires_at_ms,`${t}.session.expires_at_ms`),l=ce(i.wallet_session),u=se(i.operation_credential);if(!V(r.public_identity,a.scope.public_identity)\|\|r.context.application_binding_digest_b64u!==a.scope.context.application_binding_digest_b64u\|\|a.scope.activation_epoch!==r.activation_epoch\|\|!z(a.scope.signing_worker,r.signer_set.selected_server)\|\|l.authorizationId!==o\|\|l.walletId!==r.client_id\|\|l.expiresAtMs!==c\|\|!nn(l,r)\|\|u.walletSessionId!==s)throw Error(`${t} exact Wallet Session does not match the activated capability`);return{kind:`router_ab_ecdsa_post_registration_session_activated_v1`,public_capability:r,session:{authorization_session_id:St(i.authorization_session_id,`${t}.session.authorization_session_id`),authorization_id:o,threshold_session_id:xt(i.threshold_session_id,`${t}.session.threshold_session_id`),wallet_session_id:s,quota_id:Tt(i.quota_id,`${t}.session.quota_id`),expires_at_ms:c,remaining_uses:N(i.remaining_uses,`${t}.session.remaining_uses`),wallet_session:l,operation_credential:u},normal_signing:a}}function on(e){let t=`credentialFreeSessionActivated`,n=f(e,t);if(k(n,t,[`kind`,`public_capability`,`session`,`normal_signing`]),n.kind!==`router_ab_ecdsa_credential_free_session_activated_v1`)throw Error(`${t}.kind is invalid`);let r=B(n.public_capability),i=f(n.session,`${t}.session`);k(i,`${t}.session`,[`authorization_session_id`,`authorization_id`,`threshold_session_id`,`wallet_session_id`,`quota_id`,`expires_at_ms`,`remaining_uses`]);let a=Ln(n.normal_signing);if(!V(r.public_identity,a.scope.public_identity)\|\|r.context.application_binding_digest_b64u!==a.scope.context.application_binding_digest_b64u\|\|a.scope.activation_epoch!==r.activation_epoch\|\|!z(a.scope.signing_worker,r.signer_set.selected_server))throw Error(`${t} normal-signing state does not match public capability`);return{kind:`router_ab_ecdsa_credential_free_session_activated_v1`,public_capability:r,session:{authorization_session_id:St(i.authorization_session_id,`${t}.session.authorization_session_id`),authorization_id:Ct(i.authorization_id,`${t}.session.authorization_id`),threshold_session_id:xt(i.threshold_session_id,`${t}.session.threshold_session_id`),wallet_session_id:wt(i.wallet_session_id,`${t}.session.wallet_session_id`),quota_id:Tt(i.quota_id,`${t}.session.quota_id`),expires_at_ms:M(i.expires_at_ms,`${t}.session.expires_at_ms`),remaining_uses:N(i.remaining_uses,`${t}.session.remaining_uses`)},normal_signing:a}}function sn(e,t=`signing_digest_b64u`){return{bytes:Array.from(g(P(e,t,32)))}}function H(e,t){return e.bytes.length===32&&t.bytes.length===32&&e.bytes.every((e,n)=>e===t.bytes[n])}function cn(e,t){return e.bytes.length===t.bytes.length&&e.bytes.every((e,n)=>e===t.bytes[n])}function ln(e,t){return e.deriver_a.role===t.deriver_a.role&&e.deriver_a.key_epoch===t.deriver_a.key_epoch&&e.deriver_a.public_key===t.deriver_a.public_key&&e.deriver_b.role===t.deriver_b.role&&e.deriver_b.key_epoch===t.deriver_b.key_epoch&&e.deriver_b.public_key===t.deriver_b.public_key}function un(e,t){let n=e.ecdsa_activation,r=t.ecdsa_activation;return e.activation_correlation_id===t.activation_correlation_id&&cn(e.activation_request_digest,t.activation_request_digest)&&e.server_generation===t.server_generation&&e.lifecycle_id===t.lifecycle_id&&cn(e.transcript_digest,t.transcript_digest)&&n.context.application_binding_digest_b64u===r.context.application_binding_digest_b64u&&V(n.public_identity,r.public_identity)&&z(n.signing_worker,r.signing_worker)&&C(n.material_activation,r.material_activation)&&n.activation_epoch===r.activation_epoch&&n.activation_digest_b64u===r.activation_digest_b64u&&n.activated_at_ms===r.activated_at_ms}function dn(e,t){let n=e.scope,r=t.scope;return e.kind===t.kind&&n.wallet_id===r.wallet_id&&n.ecdsa_threshold_key_id===r.ecdsa_threshold_key_id&&n.signing_root_id===r.signing_root_id&&n.signing_root_version===r.signing_root_version&&n.context.application_binding_digest_b64u===r.context.application_binding_digest_b64u&&V(n.public_identity,r.public_identity)&&C(n.material_activation,r.material_activation)&&z(n.signing_worker,r.signing_worker)&&n.activation_epoch===r.activation_epoch}function fn(e,t){return e.kind===t.kind&&e.context.application_binding_digest_b64u===t.context.application_binding_digest_b64u&&V(e.public_identity,t.public_identity)&&C(e.material_activation,t.material_activation)&&Qt(e.signer_set,t.signer_set)&&ln(e.deriver_recipient_keys,t.deriver_recipient_keys)&&e.router_id===t.router_id&&e.client_id===t.client_id&&e.activation_epoch===t.activation_epoch&&e.registration_request_digest_b64u===t.registration_request_digest_b64u&&e.proof_transcript_digest_b64u===t.proof_transcript_digest_b64u}function U(e){return new TextEncoder().encode(A(e,`canonical string`))}function pn(e){let t=e.reduce((e,t)=>e+t.length,0),n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function W(e,t){for(let n of t)e.push(n)}function mn(e,t){W(e,g(t.lane_digest_b64u)),W(e,g(t.intent_digest_b64u)),W(e,g(t.display_digest_b64u))}function hn(e,t){if(!Number.isInteger(t)\|\|t<0\|\|t>65535)throw Error(`canonical u16 must be an integer between 0 and 65535`);e.push(t>>>8&255,t&255)}function gn(e,t){if(!Number.isInteger(t)\|\|t<0\|\|t>4294967295)throw Error(`canonical u32 must be an integer between 0 and 4294967295`);e.push(t>>>24&255,t>>>16&255,t>>>8&255,t&255)}function _n(e,t){if(!Number.isSafeInteger(t)\|\|t<0)throw Error(`canonical u64 must be a non-negative safe integer`);let n=BigInt(t);for(let t=56;t>=0;t-=8)e.push(Number(n>>BigInt(t)&255n))}function G(e,t){gn(e,t.length),W(e,t)}function vn(e,t){let n=U(t);hn(e,n.length),W(e,n)}function yn(e,t){G(e,U(t.server_id)),G(e,U(t.key_epoch)),G(e,U(t.recipient_encryption_key))}async function bn(e){let t=globalThis.crypto?.subtle;if(!t)throw Error(`crypto.subtle is required for Router A/B ECDSA derivation request digest binding`);let n=new ArrayBuffer(e.byteLength);return new Uint8Array(n).set(e),new Uint8Array(await t.digest(`SHA-256`,n))}async function xn(e){let t=I(e,`clientRerandomizationContribution32`,32);return await bn(pn([U(`router-ab-ecdsa-derivation/client-rerandomization-commitment/v1`),t]))}function Sn(e){let t=R(e),n=[];W(n,U(`router-ab-ecdsa-derivation/context/v1`)),vn(n,`router-ab-ecdsa-derivation-v1`),vn(n,`secp256k1`),W(n,g(t.application_binding_digest_b64u)),n.push(gt.length);for(let e of gt)hn(n,e);return new Uint8Array(n)}function Cn(e){let t=[];return W(t,U(`router-ab-ecdsa-derivation/role-local/context-binding/v1`)),t.push(1),t.push(1),hn(t,e.length),W(t,e),new Uint8Array(t)}async function wn(e){return An(Cn(Sn(e)))}function Tn(e){let t=jt(e),n=[];return G(n,U(`router-ab-ecdsa-derivation/public-identity/v1`)),G(n,U(t.context_binding_b64u)),G(n,U(t.derivation_client_share_public_key33_b64u)),G(n,U(t.server_public_key33_b64u)),G(n,U(t.threshold_public_key33_b64u)),G(n,U(t.ethereum_address20_b64u)),gn(n,t.client_share_retry_counter),gn(n,t.server_share_retry_counter),new Uint8Array(n)}function En(e){let t=K(e),n=[];return G(n,U(`router-ab-ecdsa-derivation/normal-signing-scope/v1`)),G(n,U(t.wallet_id)),G(n,U(t.ecdsa_threshold_key_id)),G(n,U(t.signing_root_id)),G(n,U(t.signing_root_version)),G(n,Sn(t.context)),G(n,Tn(t.public_identity)),n.push(...S(t.material_activation)),yn(n,t.signing_worker),G(n,U(t.activation_epoch)),new Uint8Array(n)}function Dn(e){return En(e)}function On(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function kn(e,t){try{return On(Dn(e),Dn(t))}catch{return!1}}async function An(e){return{bytes:Array.from(await bn(e))}}async function jn(e){let t=K(e),n=await wn(t.context);if(!H(sn(t.public_identity.context_binding_b64u,`scope.public_identity.context_binding_b64u`),n))throw Error(`scope.public_identity.context_binding_b64u does not match scope.context`);return t}function Mn(e){let t=q(e),n=[];return G(n,U(`router-ab-ecdsa-derivation/normal-signing-request/v1`)),G(n,En(t.scope)),G(n,U(t.request_id)),G(n,U(t.operation_id)),mn(n,t.operation_digests),n.push(...Ee(t.authorization)),n.push(...S(t.material_activation)),G(n,U(t.client_presignature_id)),_n(n,t.expires_at_ms),W(n,g(t.signing_digest_b64u)),G(n,g(t.client_rerandomization_commitment32_b64u)),new Uint8Array(n)}async function Nn(e){let t=q(e);return await jn(t.scope),An(Mn(t))}function Pn(e){let t=J(e),n=[];return G(n,U(`router-ab-ecdsa-derivation/normal-signing-finalize-request/v1`)),G(n,En(t.scope)),G(n,U(t.request_id)),G(n,U(t.operation_id)),mn(n,t.operation_digests),n.push(...Ee(t.authorization)),n.push(...S(t.material_activation)),_n(n,t.expires_at_ms),W(n,g(t.signing_digest_b64u)),G(n,U(t.server_presignature_id)),G(n,g(t.client_signature_share32_b64u)),G(n,g(t.client_rerandomization_contribution32_b64u)),new Uint8Array(n)}async function Fn(e){let t=J(e);return await jn(t.scope),An(Pn(t))}function K(e){let t=f(e,`scope`);return k(t,`scope`,[`wallet_id`,`ecdsa_threshold_key_id`,`signing_root_id`,`signing_root_version`,`context`,`public_identity`,`material_activation`,`signing_worker`,`activation_epoch`]),{wallet_id:A(t.wallet_id,`scope.wallet_id`),ecdsa_threshold_key_id:A(t.ecdsa_threshold_key_id,`scope.ecdsa_threshold_key_id`),signing_root_id:A(t.signing_root_id,`scope.signing_root_id`),signing_root_version:A(t.signing_root_version,`scope.signing_root_version`),context:R(t.context),public_identity:jt(t.public_identity),material_activation:b(t.material_activation),signing_worker:Mt(t.signing_worker),activation_epoch:j(t.activation_epoch,`scope.activation_epoch`)}}function In(e){if(e==null)return null;let t=f(e,`routerAbEcdsaDerivationNormalSigning`);if(k(t,`routerAbEcdsaDerivationNormalSigning`,[`kind`,`scope`]),A(t.kind,`routerAbEcdsaDerivationNormalSigning.kind`)!==`router_ab_ecdsa_derivation_normal_signing_v1`)throw Error(`routerAbEcdsaDerivationNormalSigning.kind is not supported`);return{kind:`router_ab_ecdsa_derivation_normal_signing_v1`,scope:K(t.scope)}}function Ln(e){let t=In(e);if(!t)throw Error(`Router A/B ECDSA derivation normal-signing state is required`);return t}function Rn(e){let t=a([A(e.ecdsaThresholdKeyId,`ecdsaThresholdKeyId`),A(e.signingRootId,`signingRootId`),A(e.signingRootVersion,`signingRootVersion`),j(e.activationEpoch,`activationEpoch`)].join(`:`));if(!t.ok)throw Error(`activeStateId ${t.error.message}`);return t.value}function zn(e){return Rn({ecdsaThresholdKeyId:e.scope.ecdsa_threshold_key_id,signingRootId:e.scope.signing_root_id,signingRootVersion:e.scope.signing_root_version,activationEpoch:e.scope.activation_epoch})}function Bn(e,t){let n=f(e,t);return k(n,t,[`lane_digest_b64u`,`intent_digest_b64u`,`display_digest_b64u`]),{lane_digest_b64u:P(n.lane_digest_b64u,`${t}.lane_digest_b64u`,32),intent_digest_b64u:P(n.intent_digest_b64u,`${t}.intent_digest_b64u`,32),display_digest_b64u:P(n.display_digest_b64u,`${t}.display_digest_b64u`,32)}}function Vn(e){return q({scope:e.scope,request_id:e.requestId,operation_id:e.operationId,operation_digests:e.operationDigests,authorization:e.authorization,material_activation:e.materialActivation,client_presignature_id:e.clientPresignatureId,expires_at_ms:e.expiresAtMs,signing_digest_b64u:h(I(e.signingDigest32,`signingDigest32`,32)),client_rerandomization_commitment32_b64u:h(I(e.clientRerandomizationCommitment32,`clientRerandomizationCommitment32`,32))})}function q(e){let t=f(e,`ecdsaSigningRequest`);k(t,`ecdsaSigningRequest`,[`scope`,`request_id`,`operation_id`,`operation_digests`,`authorization`,`material_activation`,`client_presignature_id`,`expires_at_ms`,`signing_digest_b64u`,`client_rerandomization_commitment32_b64u`]);let n={scope:K(t.scope),request_id:A(t.request_id,`ecdsaSigningRequest.request_id`),operation_id:A(t.operation_id,`ecdsaSigningRequest.operation_id`),operation_digests:Bn(t.operation_digests,`ecdsaSigningRequest.operation_digests`),authorization:y(t.authorization),material_activation:b(t.material_activation),client_presignature_id:A(t.client_presignature_id,`ecdsaSigningRequest.client_presignature_id`),expires_at_ms:M(t.expires_at_ms,`ecdsaSigningRequest.expires_at_ms`),signing_digest_b64u:P(t.signing_digest_b64u,`ecdsaSigningRequest.signing_digest_b64u`,32),client_rerandomization_commitment32_b64u:P(t.client_rerandomization_commitment32_b64u,`ecdsaSigningRequest.client_rerandomization_commitment32_b64u`,32)};if(n.operation_digests.intent_digest_b64u!==n.signing_digest_b64u)throw Error(`ecdsaSigningRequest intent digest must equal the admitted signing digest`);return n}function Hn(e){let t=f(e,`webauthn_authentication`);k(t,`webauthn_authentication`,[`id`,`rawId`,`type`,`authenticatorAttachment`,`response`,`clientExtensionResults`]);let n=f(t.response,`webauthn_authentication.response`);k(n,`webauthn_authentication.response`,[`clientDataJSON`,`authenticatorData`,`signature`,`userHandle`]);let r=t.authenticatorAttachment===null?null:A(t.authenticatorAttachment,`webauthn_authentication.authenticatorAttachment`),i=n.userHandle===null?null:A(n.userHandle,`webauthn_authentication.response.userHandle`);return{id:A(t.id,`webauthn_authentication.id`),rawId:A(t.rawId,`webauthn_authentication.rawId`),type:A(t.type,`webauthn_authentication.type`),authenticatorAttachment:r,response:{clientDataJSON:A(n.clientDataJSON,`webauthn_authentication.response.clientDataJSON`),authenticatorData:A(n.authenticatorData,`webauthn_authentication.response.authenticatorData`),signature:A(n.signature,`webauthn_authentication.response.signature`),userHandle:i},clientExtensionResults:t.clientExtensionResults}}function Un(e){let t=f(e,`operationStepUpAuthorizationRequest`);if(k(t,`operationStepUpAuthorizationRequest`,[`kind`,`operation`,`proof`]),t.kind!==`router_ab_ecdsa_operation_step_up_v1`)throw Error(`operationStepUpAuthorizationRequest.kind must be router_ab_ecdsa_operation_step_up_v1`);let n=Wn(t.operation),r=f(t.proof,`operationStepUpAuthorizationRequest.proof`),i=it(r.authority),a;switch(r.kind){case`passkey`:if(k(r,`operationStepUpAuthorizationRequest.proof`,[`kind`,`authority`,`webauthn_authentication`]),!i\|\|!E(i))throw Error(`operationStepUpAuthorizationRequest.proof requires an exact passkey authority`);a={kind:`passkey`,authority:i,webauthn_authentication:Hn(r.webauthn_authentication)};break;case`email_otp`:if(k(r,`operationStepUpAuthorizationRequest.proof`,[`kind`,`authority`,`challenge_id`,`otp_code`]),!i\|\|!D(i))throw Error(`operationStepUpAuthorizationRequest.proof requires an exact Email OTP authority`);a={kind:`email_otp`,authority:i,challenge_id:A(r.challenge_id,`operationStepUpAuthorizationRequest.proof.challenge_id`),otp_code:A(r.otp_code,`operationStepUpAuthorizationRequest.proof.otp_code`)};break;default:throw Error(`operationStepUpAuthorizationRequest.proof.kind is invalid`)}return{kind:`router_ab_ecdsa_operation_step_up_v1`,operation:n,proof:a}}function Wn(e){let t=f(e,`ecdsaOperationStepUpPreparation`);if(k(t,`operationStepUpGrantRequest.operation`,[`wallet_id`,`operation_kind`,`operation_id`,`operation_digests`,`material_activation`,`normal_signing_scope`,`signing_worker_id`,`key_handle`,`relayer_key_id`,`participant_ids`,`expires_at_ms`]),!Array.isArray(t.participant_ids)\|\|t.participant_ids.length!==2\|\|!t.participant_ids.every(e=>Number.isSafeInteger(e)&&e>0))throw Error(`operationStepUpGrantRequest.operation.participant_ids must contain two positive integers`);return{wallet_id:A(t.wallet_id,`operationStepUpGrantRequest.operation.wallet_id`),operation_kind:Gn(t.operation_kind),operation_id:A(t.operation_id,`operationStepUpGrantRequest.operation.operation_id`),operation_digests:Bn(t.operation_digests,`operationStepUpGrantRequest.operation.operation_digests`),material_activation:b(t.material_activation),normal_signing_scope:K(t.normal_signing_scope),signing_worker_id:A(t.signing_worker_id,`operationStepUpGrantRequest.operation.signing_worker_id`),key_handle:A(t.key_handle,`operationStepUpGrantRequest.operation.key_handle`),relayer_key_id:A(t.relayer_key_id,`operationStepUpGrantRequest.operation.relayer_key_id`),participant_ids:[Number(t.participant_ids[0]),Number(t.participant_ids[1])],expires_at_ms:M(t.expires_at_ms,`operationStepUpGrantRequest.operation.expires_at_ms`)}}function Gn(e){switch(e){case pe.signTransaction:case pe.exportKey:return e;default:throw Error(`operationStepUpGrantRequest.operation.operation_kind must be evm.sign_transaction or evm.export_key`)}}function Kn(e){return J({scope:e.scope,request_id:e.requestId,operation_id:e.operationId,operation_digests:e.operationDigests,authorization:e.authorization,material_activation:e.materialActivation,expires_at_ms:e.expiresAtMs,signing_digest_b64u:h(I(e.signingDigest32,`signingDigest32`,32)),server_presignature_id:e.serverPresignatureId,client_signature_share32_b64u:h(I(e.clientSignatureShare32,`clientSignatureShare32`,32)),client_rerandomization_contribution32_b64u:h(I(e.clientRerandomizationContribution32,`clientRerandomizationContribution32`,32))})}function J(e){let t=f(e,`ecdsaFinalizeCoreRequest`);return k(t,`ecdsaFinalizeCoreRequest`,[`scope`,`request_id`,`operation_id`,`operation_digests`,`authorization`,`material_activation`,`expires_at_ms`,`signing_digest_b64u`,`server_presignature_id`,`client_signature_share32_b64u`,`client_rerandomization_contribution32_b64u`]),qn(t)}function qn(e){let t={scope:K(e.scope),request_id:A(e.request_id,`ecdsaFinalizeRequest.request_id`),operation_id:A(e.operation_id,`ecdsaFinalizeRequest.operation_id`),operation_digests:Bn(e.operation_digests,`ecdsaFinalizeRequest.operation_digests`),authorization:y(e.authorization),material_activation:b(e.material_activation),expires_at_ms:M(e.expires_at_ms,`ecdsaFinalizeRequest.expires_at_ms`),signing_digest_b64u:P(e.signing_digest_b64u,`ecdsaFinalizeRequest.signing_digest_b64u`,32),server_presignature_id:A(e.server_presignature_id,`ecdsaFinalizeRequest.server_presignature_id`),client_signature_share32_b64u:P(e.client_signature_share32_b64u,`ecdsaFinalizeRequest.client_signature_share32_b64u`,32),client_rerandomization_contribution32_b64u:P(e.client_rerandomization_contribution32_b64u,`ecdsaFinalizeRequest.client_rerandomization_contribution32_b64u`,32)};if(t.operation_digests.intent_digest_b64u!==t.signing_digest_b64u)throw Error(`ecdsaFinalizeRequest intent digest must equal the admitted signing digest`);return t}function Jn(e){let t=f(e,`ecdsaPrepareResponse`);return k(t,`ecdsaPrepareResponse`,[`scope`,`request_id`,`request_digest`,`signing_digest`,`server_presignature_id`,`server_big_r33_b64u`,`signing_worker_rerandomization_contribution32_b64u`,`signature_scheme`,`prepared_at_ms`,`expires_at_ms`]),{scope:K(t.scope),request_id:A(t.request_id,`ecdsaPrepareResponse.request_id`),request_digest:L(t.request_digest,`ecdsaPrepareResponse.request_digest`),signing_digest:L(t.signing_digest,`ecdsaPrepareResponse.signing_digest`),server_presignature_id:A(t.server_presignature_id,`ecdsaPrepareResponse.server_presignature_id`),server_big_r33_b64u:P(t.server_big_r33_b64u,`ecdsaPrepareResponse.server_big_r33_b64u`,33),signing_worker_rerandomization_contribution32_b64u:P(t.signing_worker_rerandomization_contribution32_b64u,`ecdsaPrepareResponse.signing_worker_rerandomization_contribution32_b64u`,32),signature_scheme:At(t.signature_scheme,`ecdsaPrepareResponse.signature_scheme`),prepared_at_ms:M(t.prepared_at_ms,`ecdsaPrepareResponse.prepared_at_ms`),expires_at_ms:M(t.expires_at_ms,`ecdsaPrepareResponse.expires_at_ms`)}}async function Yn(e,t){let n=q(e),r=Jn(t);if(!kn(r.scope,n.scope))throw Error(`ecdsaPrepareResponse.scope does not match request`);if(r.request_id!==n.request_id)throw Error(`ecdsaPrepareResponse.request_id does not match request`);if(r.server_presignature_id!==n.client_presignature_id)throw Error(`ecdsaPrepareResponse.server_presignature_id does not match request`);if(!H(r.signing_digest,sn(n.signing_digest_b64u)))throw Error(`ecdsaPrepareResponse.signing_digest does not match request`);if(r.expires_at_ms!==n.expires_at_ms)throw Error(`ecdsaPrepareResponse.expires_at_ms does not match request`);if(!H(r.request_digest,await Nn(n)))throw Error(`ecdsaPrepareResponse.request_digest does not match request`);return r}function Xn(e){let t=f(e,`ecdsaSigningResponse`);return k(t,`ecdsaSigningResponse`,[`scope`,`request_id`,`request_digest`,`signing_digest`,`signature_scheme`,`signature65_b64u`]),{scope:K(t.scope),request_id:A(t.request_id,`ecdsaSigningResponse.request_id`),request_digest:L(t.request_digest,`ecdsaSigningResponse.request_digest`),signing_digest:L(t.signing_digest,`ecdsaSigningResponse.signing_digest`),signature_scheme:At(t.signature_scheme,`ecdsaSigningResponse.signature_scheme`),signature65_b64u:P(t.signature65_b64u,`ecdsaSigningResponse.signature65_b64u`,65)}}async function Zn(e,t){let n=J(e),r=Xn(t);if(!kn(r.scope,n.scope))throw Error(`ecdsaSigningResponse.scope does not match request`);if(r.request_id!==n.request_id)throw Error(`ecdsaSigningResponse.request_id does not match request`);if(!H(r.signing_digest,sn(n.signing_digest_b64u)))throw Error(`ecdsaSigningResponse.signing_digest does not match request`);if(!H(r.request_digest,await Fn(n)))throw Error(`ecdsaSigningResponse.request_digest does not match request`);return r}function Qn(e){let t=typeof e==`string`?e.trim():``;if(!t.startsWith(`ederivation-key-`))throw Error(`Threshold ECDSA key handle is invalid`);return t}function $n(e,t){let n=String(e??``).trim();if(!n)throw Error(`[threshold-ecdsa-key-handle] ${t} is required`);return n}function er(e){return String(e??``).trim()\|\|`default`}async function tr(e){return`ederivation-key-${h(await p(d({domain:`seams.threshold_ecdsa.key_handle.v1`,ecdsaThresholdKeyId:$n(e.ecdsaThresholdKeyId,`ecdsaThresholdKeyId`),signingRootId:$n(e.signingRootId,`signingRootId`),signingRootVersion:er(e.signingRootVersion)})))}`}function Y(e){return{code:`missing`,message:`${e} is required`}}function X(e,t){return{code:`invalid`,message:`${e} ${t}`}}function Z(e,t){if(e==null)return{ok:!1,error:Y(t)};if(typeof e!=`string`)return{ok:!1,error:X(t,`must be a string`)};let n=e.trim();return n?c(n)?{ok:!1,error:X(t,`must not contain whitespace or control characters`)}:{ok:!0,value:n}:{ok:!1,error:Y(t)}}function nr(e,t){if(e==null)return{ok:!1,error:Y(t)};if(typeof e!=`string`\|\|e.length===0)return{ok:!1,error:X(t,`must be non-empty base64url`)};try{let n=g(e);if(n.length===0\|\|h(n)!==e)return{ok:!1,error:X(t,`must be canonical unpadded base64url`)}}catch{return{ok:!1,error:X(t,`must be canonical unpadded base64url`)}}return{ok:!0,value:e}}function rr(e,t,n){if(e==null)return{ok:!1,error:Y(t)};try{return{ok:!0,value:n(ge(e))}}catch{return{ok:!1,error:X(t,`must be canonical base64url for 32 bytes`)}}}function ir(e){return e}function ar(e){return e}function or(e){return e}function Q(e,t,n){let r=new Set(t);for(let t of Object.keys(e))if(!r.has(t))throw Error(`${n}.${t} is not supported`);for(let r of t)if(!(r in e))throw Error(`${n}.${r} is required`)}function sr(e){return Z(e,`laneHolderParticipantId`)}function cr(e){return Z(e,`signingWorkerParticipantId`)}function lr(e){return Z(e,`signingWorkerRecipientKeyId`)}function ur(e){return Z(e,`laneHolderCustodyBindingId`)}function dr(e){return rr(e,`participantBindingDigestB64u`,or)}function fr(e){return rr(e,`custodyBindingDigestB64u`,ir)}function pr(e){return rr(e,`hpkePublicKeyDigestB64u`,ar)}function mr(e){return{kind:`lane_holder_custody_identity_v1`,custodyBindingId:e.custodyBindingId,custodyBindingDigestB64u:e.custodyBindingDigestB64u}}function hr(e){return{kind:`signing_worker_recipient_identity_v1`,recipientKeyId:e.recipientKeyId,hpkePublicKeyB64u:e.hpkePublicKeyB64u,hpkePublicKeyDigestB64u:e.hpkePublicKeyDigestB64u}}function gr(e,t=`laneHolderCustodyIdentity`){let n=f(e,t);if(Q(n,[`kind`,`custodyBindingId`,`custodyBindingDigestB64u`],t),n.kind!==`lane_holder_custody_identity_v1`)throw Error(`${t}.kind is invalid`);let r=ur(n.custodyBindingId);if(!r.ok)throw Error(`${t}.${r.error.message}`);let i=fr(n.custodyBindingDigestB64u);if(!i.ok)throw Error(`${t}.${i.error.message}`);return mr({custodyBindingId:r.value,custodyBindingDigestB64u:i.value})}function _r(e,t=`signingWorkerRecipientIdentity`){let n=f(e,t);if(Q(n,[`kind`,`recipientKeyId`,`hpkePublicKeyB64u`,`hpkePublicKeyDigestB64u`],t),n.kind!==`signing_worker_recipient_identity_v1`)throw Error(`${t}.kind is invalid`);let r=lr(n.recipientKeyId);if(!r.ok)throw Error(`${t}.${r.error.message}`);let i=nr(n.hpkePublicKeyB64u,`${t}.hpkePublicKeyB64u`);if(!i.ok)throw Error(i.error.message);let a=pr(n.hpkePublicKeyDigestB64u);if(!a.ok)throw Error(`${t}.${a.error.message}`);return hr({recipientKeyId:r.value,hpkePublicKeyB64u:i.value,hpkePublicKeyDigestB64u:a.value})}function vr(e){return{kind:`lane_holder_participant_v1`,participantId:e.participantId,custodyBindingId:e.custody.custodyBindingId,custodyBindingDigestB64u:e.custody.custodyBindingDigestB64u,hpkePublicKeyB64u:e.hpkePublicKeyB64u,hpkePublicKeyDigestB64u:e.hpkePublicKeyDigestB64u,participantBindingDigestB64u:e.participantBindingDigestB64u}}function yr(e){return{kind:`signing_worker_participant_v1`,participantId:e.participantId,recipientKeyId:e.recipient.recipientKeyId,hpkePublicKeyB64u:e.recipient.hpkePublicKeyB64u,hpkePublicKeyDigestB64u:e.recipient.hpkePublicKeyDigestB64u,participantBindingDigestB64u:e.participantBindingDigestB64u}}function br(e,t=`laneHolderParticipant`){let n=f(e,t);if(Q(n,[`kind`,`participantId`,`custodyBindingId`,`custodyBindingDigestB64u`,`hpkePublicKeyB64u`,`hpkePublicKeyDigestB64u`,`participantBindingDigestB64u`],t),n.kind!==`lane_holder_participant_v1`)throw Error(`${t}.kind is invalid`);let r=sr(n.participantId);if(!r.ok)throw Error(`${t}.${r.error.message}`);let i=gr({kind:`lane_holder_custody_identity_v1`,custodyBindingId:n.custodyBindingId,custodyBindingDigestB64u:n.custodyBindingDigestB64u},`${t}.custody`),a=nr(n.hpkePublicKeyB64u,`${t}.hpkePublicKeyB64u`);if(!a.ok)throw Error(a.error.message);let o=pr(n.hpkePublicKeyDigestB64u);if(!o.ok)throw Error(`${t}.${o.error.message}`);let s=dr(n.participantBindingDigestB64u);if(!s.ok)throw Error(`${t}.${s.error.message}`);return vr({participantId:r.value,custody:i,hpkePublicKeyB64u:a.value,hpkePublicKeyDigestB64u:o.value,participantBindingDigestB64u:s.value})}function xr(e,t=`signingWorkerParticipant`){let n=f(e,t);if(Q(n,[`kind`,`participantId`,`recipientKeyId`,`hpkePublicKeyB64u`,`hpkePublicKeyDigestB64u`,`participantBindingDigestB64u`],t),n.kind!==`signing_worker_participant_v1`)throw Error(`${t}.kind is invalid`);let r=cr(n.participantId);if(!r.ok)throw Error(`${t}.${r.error.message}`);let i=_r({kind:`signing_worker_recipient_identity_v1`,recipientKeyId:n.recipientKeyId,hpkePublicKeyB64u:n.hpkePublicKeyB64u,hpkePublicKeyDigestB64u:n.hpkePublicKeyDigestB64u},`${t}.recipient`),a=dr(n.participantBindingDigestB64u);if(!a.ok)throw Error(`${t}.${a.error.message}`);return yr({participantId:r.value,recipient:i,participantBindingDigestB64u:a.value})}const Sr=[`kind`,`signerId`,`participantIds`,`signingWorkerId`,`custodyKeyManifestDigestB64u`,`sourceIdentityDigestB64u`];function Cr(e,t=`walletSignerId`){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} is required`);if(c(n))throw Error(`${t} must not contain whitespace or control characters`);return n}function wr(e,t){if(typeof e!=`number`\|\|!Number.isSafeInteger(e)\|\|e<=0)throw Error(`${t} must be a positive safe integer`);return e}function Tr(e,t){if(!Array.isArray(e)\|\|e.length!==2)throw Error(`${t} must contain exactly two participant ids`);let n=wr(e[0],`${t}[0]`),r=wr(e[1],`${t}[1]`);if(n===r)throw Error(`${t} must contain distinct participant ids`);return[n,r]}function Er(e){let t=Tr(e.participantIds,`participantIds`);return{kind:`owner_lane_participant_continuity_v1`,signerId:Cr(e.signerId),participantIds:t,signingWorkerId:re(i(e.signingWorkerId),`signingWorkerId`),custodyKeyManifestDigestB64u:m(e.custodyKeyManifestDigestB64u,`custodyKeyManifestDigestB64u`),sourceIdentityDigestB64u:m(e.sourceIdentityDigestB64u,`sourceIdentityDigestB64u`)}}function Dr(e,t=`ownerParticipantContinuity`){let n=f(e,t);if(ne(n,Sr,t),n.kind!==`owner_lane_participant_continuity_v1`)throw Error(`${t}.kind must be owner_lane_participant_continuity_v1`);return Er({signerId:Cr(n.signerId,`${t}.signerId`),participantIds:Tr(n.participantIds,`${t}.participantIds`),signingWorkerId:re(i(n.signingWorkerId),`${t}.signingWorkerId`),custodyKeyManifestDigestB64u:m(n.custodyKeyManifestDigestB64u,`${t}.custodyKeyManifestDigestB64u`),sourceIdentityDigestB64u:m(n.sourceIdentityDigestB64u,`${t}.sourceIdentityDigestB64u`)})}function $(e,t){let n=String(e??``).trim();if(!n)throw Error(`[evm-family-ecdsa] ${t} is required`);return n}function Or(e){return $(e,`rpId`)}function kr(e){return ye({walletId:_(e.walletId),signingRootId:jr(e.signingRootId),signingRootVersion:Mr(e.signingRootVersion)})}function Ar(e){return $(e,`ecdsaThresholdKeyId`)}function jr(e){return $(e,`signingRootId`)}function Mr(e){return String(e??``).trim()\|\|`default`}function Nr(e){let t=String(e??``).trim().toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(t))throw Error(`[evm-family-ecdsa] thresholdOwnerAddress must be an EVM address`);return t}function Pr(e){return Nr(e)}function Fr(e){return Or(e)}function Ir(e){return $(e,`keyHandle`)}function Lr(e){return Ar(String(e.record.ecdsaThresholdKeyId??``).trim())}function Rr(e){return{signingRootId:jr(e.signingRootId),signingRootVersion:Mr(e.signingRootVersion)}}function zr(e){return Rr({signingRootId:e.record.signingRootId,signingRootVersion:e.record.signingRootVersion})}function Br(e){let t=ae(e.runtimePolicyScope);return Rr({signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion})}function Vr(e){let t=$(e,`thresholdEcdsaPublicKeyB64u`),n;try{n=g(t)}catch{throw Error(`[evm-family-ecdsa] thresholdEcdsaPublicKeyB64u must be base64url`)}if(n.length!==33)throw Error(`[evm-family-ecdsa] thresholdEcdsaPublicKeyB64u must decode to 33 bytes`);return t}function Hr(e){let t=Math.floor(Number(e));if(!Number.isSafeInteger(t)\|\|t<1\|\|t>65535)throw Error(`[evm-family-ecdsa] participantId must be a positive safe integer`);return t}function Ur(e){let t=ie(e);if(!t?.length)throw Error(`[evm-family-ecdsa] participantIds are required`);return t.map(Hr)}function Wr(e){return e.map(e=>String(Number(e))).join(`,`)}function Gr(e){let t=2166136261;for(let n=0;n<e.length;n+=1)t^=e.charCodeAt(n),t=Math.imul(t,16777619)>>>0;return t.toString(16).padStart(8,`0`)}function Kr(e){return{walletId:e.walletId,keyScope:`evm-family`,ecdsaThresholdKeyId:Ar(e.ecdsaThresholdKeyId),signingRootId:jr(e.signingRootId),signingRootVersion:Mr(e.signingRootVersion),participantIds:Ur(e.participantIds),thresholdOwnerAddress:Nr(e.thresholdOwnerAddress)}}function qr(e){return Kr({walletId:_(e.walletId),ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,participantIds:e.participantIds,thresholdOwnerAddress:e.thresholdOwnerAddress})}function Jr(e){return _e({walletId:_(e)})}async function Yr(e){return await tr(e)}function Xr(e){return{kind:`verified_ecdsa_public_facts`,keyHandle:e.keyHandle,publicKeyB64u:Vr(e.publicKeyB64u),participantIds:Ur(e.participantIds),thresholdOwnerAddress:Nr(e.thresholdOwnerAddress)}}function Zr(e){return{walletId:e.walletId,keyScope:e.keyFacts.keyScope,ecdsaThresholdKeyId:e.keyFacts.ecdsaThresholdKeyId,signingRootId:e.keyFacts.signingRootId,signingRootVersion:e.keyFacts.signingRootVersion,participantIds:e.keyFacts.participantIds,thresholdOwnerAddress:e.keyFacts.thresholdOwnerAddress}}function Qr(e){let t=Ir(e.keyHandle),n=qr(e),r=Xr({keyHandle:t,publicKeyB64u:e.thresholdEcdsaPublicKeyB64u,participantIds:n.participantIds,thresholdOwnerAddress:n.thresholdOwnerAddress});return{kind:`evm_family_ecdsa_wallet_key`,walletId:n.walletId,keyHandle:t,chainTarget:e.chainTarget,keyFacts:{kind:`evm_family_ecdsa_key_facts`,keyScope:n.keyScope,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,participantIds:r.participantIds,thresholdOwnerAddress:r.thresholdOwnerAddress,thresholdEcdsaPublicKeyB64u:r.publicKeyB64u}}}function $r(e){let t=[];if(String(e.expected.keyHandle)!==String(e.actual.keyHandle)&&t.push(`keyHandle`),String(e.expected.publicKeyB64u)!==String(e.actual.publicKeyB64u)&&t.push(`publicKeyB64u`),Wr(e.expected.participantIds)!==Wr(e.actual.participantIds)&&t.push(`participantIds`),String(e.expected.thresholdOwnerAddress)!==String(e.actual.thresholdOwnerAddress)&&t.push(`thresholdOwnerAddress`),t.length)throw Error(`[evm-family-ecdsa] ${e.context} public facts mismatch: ${t.join(`, `)}`)}function ei(e){return{kind:`passkey_ecdsa_auth_binding`,authMethod:ve.passkey,rpId:Or(e.rpId),credentialIdB64u:$(e.credentialIdB64u,`credentialIdB64u`)}}function ti(e){return{kind:`resolved_evm_family_ecdsa_key`,walletId:_(e.walletId),publicFacts:e.publicFacts,authBinding:e.authBinding}}function ni(e){return{kind:`hydrated_ecdsa_signer_material`,walletId:e.walletId,materialActivation:e.materialActivation,publicFacts:e.publicFacts,transport:e.transport,clientShare:e.clientShare,routerAbEcdsaDerivationNormalSigning:e.routerAbEcdsaDerivationNormalSigning}}function ri(e){let t=Math.floor(Number(e.ttlMs)),n=Math.floor(Number(e.remainingUses));if(!Number.isFinite(t)\|\|t<=0)throw Error(`[evm-family-ecdsa] ttlMs must be a positive finite value`);if(!Number.isFinite(n)\|\|n<=0)throw Error(`[evm-family-ecdsa] remainingUses must be a positive finite value`);return{chainTarget:e.chainTarget,thresholdSessionId:be.thresholdEcdsaSession(e.thresholdSessionId),ttlMs:t,remainingUses:n,runtimePolicyScope:e.runtimePolicyScope}}function ii(e){let t=Math.floor(Number(e.ttlMs)),n=Math.floor(Number(e.remainingUses));if(!Number.isFinite(t)\|\|t<=0)throw Error(`[evm-family-ecdsa] ttlMs must be a positive finite value`);if(!Number.isFinite(n)\|\|n<=0)throw Error(`[evm-family-ecdsa] remainingUses must be a positive finite value`);return{chainTarget:e.chainTarget,thresholdSessionId:be.thresholdEcdsaSession(e.thresholdSessionId),ttlMs:t,remainingUses:n,runtimePolicyScope:e.runtimePolicyScope}}function ai(e){return`evmfam-ecdsa:${Gr(d({version:`evm_family_ecdsa_key_fingerprint_v2`,walletId:String(e.walletId),baseEcdsaSubjectId:String(Jr(e.walletId)),keyScope:e.keyScope,ecdsaThresholdKeyId:String(e.ecdsaThresholdKeyId),signingRootId:String(e.signingRootId),signingRootVersion:String(e.signingRootVersion),participantIds:e.participantIds.map(e=>Number(e)),thresholdOwnerAddress:String(e.thresholdOwnerAddress)}))}`}function oi(e){return`evmfam-ecdsa:${Gr(d({version:`evm_family_ecdsa_public_facts_fingerprint_v1`,walletId:String(_(e.walletId)),keyHandle:String(e.publicFacts.keyHandle),publicKeyB64u:String(e.publicFacts.publicKeyB64u),participantIds:e.publicFacts.participantIds.map(e=>Number(e)),thresholdOwnerAddress:String(e.publicFacts.thresholdOwnerAddress)}))}`}function si(e,t){let n=String(e??``).trim();if(!n)throw Error(`[email-otp-derivation] ${t} is required`);return n}function ci(e){return si(e,`authSubjectId`)}function li(e){return ke(e)}function ui(e){return Ae(e)}function di(e){return je(e)}export{rn as $,y as $t,dr as A,it as At,Vn as B,He as Bt,Ir as C,tt as Ct,Pr as D,E as Dt,Vr as E,D as Et,ft as F,ze as Ft,K as G,Ne as Gt,on as H,Ve as Ht,pt as I,Fe as It,Ht as J,Ae as Jt,In as K,Me as Kt,mt as L,Ie as Lt,Qn as M,Ge as Mt,dt as N,lt as Nt,Dr as O,at as Ot,ht as P,We as Pt,en as Q,b as Qt,ut as R,Ue as Rt,Br as S,Xe as St,Fr as T,et as Tt,Yn as U,Re as Ut,bt as V,Be as Vt,Zn as W,Pe as Wt,yt as X,ke as Xt,Un as Y,je as Yt,Wn as Z,S as Zt,kr as _,V as _t,$r as a,Jt as at,Lr as b,z as bt,ri as c,Fn as ct,ei as d,xn as dt,we as en,an as et,ti as f,ln as ft,oi as g,fn as gt,ai as h,dn as ht,ci as i,Vt as it,xr as j,Ke as jt,br as k,ot as kt,Qr as l,Nn as lt,Yr as m,kn as mt,di as n,C as nn,Xt as nt,qr as o,Ln as ot,Xr as p,Qt as pt,B as q,De as qt,li as r,xe as rn,zt as rt,ii as s,zn as st,ui as t,Ce as tn,Yt as tt,ni as u,Dn as ut,Zr as v,un as vt,Hr as w,$e as wt,zr as x,Qe as xt,Rr as y,Zt as yt,Kn as z,Le as zt};

package/dist/esm/sdk/{errors-DIWY1KR9.js → errors-ADOZT8oV.js} RENAMED Viewed

	@@ -1 +1 @@
1	- function e(e){try{return typeof e==`string`?e:e&&typeof e.message==`string`?e.message:String(e??``)}catch{return``}}function t(e){return`${e}B64u`}t(`seed`),t(`canonicalSeed`),t(`xClientBase`),t(`clientOutputMask`),t(`clientRecoverableSecret`),t(`prfFirst`),t(`prfSecond`),t(`signingShare32`),t(`clientNonceHandle`);function n(t){if(t instanceof Error)return t;let n=Error(e(t));try{let e=t;typeof e?.name==`string`&&(n.name=e.name),typeof e?.stack==`string`&&(n.stack=e.stack),e&&e.code!==void 0&&(n.code=e.code),e&&e.details!==void 0&&(n.details=e.details)}catch{}return n}function r(t){let n=e(t);if(i(t))return!1;if(a(t))return!0;let r=n.toLowerCase();return n.includes(`The operation either timed out or was not allowed`)\|\|n.includes(`NotAllowedError`)\|\|n.includes(`AbortError`)\|\|r.includes(`user cancelled`)\|\|r.includes(`user canceled`)\|\|r.includes(`user aborted`)\|\|r.includes(`was cancelled`)\|\|r.includes(`was canceled`)}function i(t){let n=e(t).toLowerCase();return n.includes(`relying party id`)\|\|n.includes(`registrable domain suffix`)\|\|n.includes(`claimed rp id`)\|\|n.includes(`/.well-known/webauthn`)\|\|n.includes(`.well-known/webauthn`)}function a(t){if(i(t))return!1;let n=e(t).toLowerCase(),r=t,a=String(r?.name\|\|``).trim(),o=r?.code,s=String(o\|\|``).trim().toLowerCase().replace(/[\s-]+/g,`_`);return o===4001\|\|s===`4001`\|\|s===`cancelled`\|\|s===`canceled`\|\|s===`abort_error`\|\|s===`user_cancelled`\|\|s===`user_canceled`\|\|s===`user_rejected`\|\|s===`action_rejected`\|\|s===`request_rejected`\|\|a===`NotAllowedError`\|\|a===`AbortError`\|\|n.includes(`user cancelled`)\|\|n.includes(`user canceled`)\|\|n.includes(`user rejected`)\|\|n.includes(`request cancelled`)\|\|n.includes(`request canceled`)\|\|n.includes(`operation cancelled`)\|\|n.includes(`operation canceled`)}function o(e){switch(e){case`registration`:return`Registration was cancelled. Please try again when you're ready to set up your passkey.`;case`login`:return`Login was cancelled. Please try again when you're ready to authenticate.`;default:return`Operation was cancelled. Please try again when you're ready.`}}function s(t,n=`registration`,a){let s=e(t);return i(t)?`${n===`registration`?`Registration`:`Login`} failed because the configured WebAuthn RP ID is not valid for this app origin. Check VITE_RP_ID_BASE and the /.well-known/webauthn related-origin configuration for this environment.`:r(t)?o(n):s.includes(`PRF outputs missing`)?`${n===`registration`?`Registration`:`Login`} failed because your browser did not return the required passkey PRF results. On some mobile browsers this is not available for create(); try updating your browser or use a desktop browser. We’re working on an alternate path for broader device support.`:s.includes(`one of the credentials already registered`)?`A passkey for '${a\|\|`this account`}' already exists. Please try logging in instead.`:s.includes(`Cannot deserialize the contract state`)?`Contract state deserialization failed. This may be due to a contract upgrade. Please try again or contact support.`:s.includes(`Web3Authn contract registration check failed`)?`Contract registration check failed: ${s.replace(`Web3Authn contract registration check failed: `,``)}`:s.includes(`Unknown error occurred`)?`${n===`registration`?`Registration`:`Login`} failed due to an unknown error. Please check your connection and try again.`:s}export{i as a,a as i,s as n,n as o,r,e as t};
1	+ function e(e){try{return typeof e==`string`?e:e&&typeof e.message==`string`?e.message:String(e??``)}catch{return``}}function t(e){return`${e}B64u`}t(`seed`),t(`canonicalSeed`),t(`xClientBase`),t(`clientOutputMask`),t(`clientRecoverableSecret`),t(`prfFirst`),t(`prfSecond`),t(`signingShare32`),t(`clientNonceHandle`);function n(t){if(t instanceof Error)return t;let n=Error(e(t));try{let e=t;typeof e?.name==`string`&&(n.name=e.name),typeof e?.stack==`string`&&(n.stack=e.stack),e&&e.code!==void 0&&(n.code=e.code),e&&e.details!==void 0&&(n.details=e.details)}catch{}return n}function r(t){let n=e(t);if(i(t))return!1;if(a(t))return!0;let r=n.toLowerCase();return n.includes(`The operation either timed out or was not allowed`)\|\|n.includes(`NotAllowedError`)\|\|n.includes(`AbortError`)\|\|r.includes(`user cancelled`)\|\|r.includes(`user canceled`)\|\|r.includes(`user aborted`)\|\|r.includes(`was cancelled`)\|\|r.includes(`was canceled`)}function i(t){let n=e(t).toLowerCase();return n.includes(`relying party id`)\|\|n.includes(`registrable domain suffix`)\|\|n.includes(`claimed rp id`)\|\|n.includes(`/.well-known/webauthn`)\|\|n.includes(`.well-known/webauthn`)}function a(t){if(i(t))return!1;let n=e(t).toLowerCase(),r=t,a=String(r?.name\|\|``).trim(),o=r?.code,s=String(o\|\|``).trim().toLowerCase().replace(/[\s-]+/g,`_`);return o===4001\|\|s===`4001`\|\|s===`cancelled`\|\|s===`canceled`\|\|s===`abort_error`\|\|s===`user_cancelled`\|\|s===`user_canceled`\|\|s===`user_rejected`\|\|s===`action_rejected`\|\|s===`request_rejected`\|\|a===`NotAllowedError`\|\|a===`AbortError`\|\|n.includes(`user cancelled`)\|\|n.includes(`user canceled`)\|\|n.includes(`user rejected`)\|\|n.includes(`request cancelled`)\|\|n.includes(`request canceled`)\|\|n.includes(`operation cancelled`)\|\|n.includes(`operation canceled`)}function o(e){switch(e){case`registration`:return`Registration was cancelled. Please try again when you're ready to set up your passkey.`;case`login`:return`Login was cancelled. Please try again when you're ready to authenticate.`;default:return`Operation was cancelled. Please try again when you're ready.`}}function s(t,n=`registration`,a){let s=e(t);return i(t)?`${n===`registration`?`Registration`:`Login`} failed because the configured WebAuthn RP ID is not valid for this app origin. Check VITE_RP_ID_BASE and the /.well-known/webauthn related-origin configuration for this environment.`:t&&typeof t==`object`&&`code`in t&&t.code===`production_paused`?`New sign-ups for this app are paused. The app owner must update its Seams billing.`:r(t)?o(n):s.includes(`PRF outputs missing`)?`${n===`registration`?`Registration`:`Login`} failed because your browser did not return the required passkey PRF results. On some mobile browsers this is not available for create(); try updating your browser or use a desktop browser. We’re working on an alternate path for broader device support.`:s.includes(`one of the credentials already registered`)?`A passkey for '${a\|\|`this account`}' already exists. Please try logging in instead.`:s.includes(`Cannot deserialize the contract state`)?`Contract state deserialization failed. This may be due to a contract upgrade. Please try again or contact support.`:s.includes(`Web3Authn contract registration check failed`)?`Contract registration check failed: ${s.replace(`Web3Authn contract registration check failed: `,``)}`:s.includes(`Unknown error occurred`)?`${n===`registration`?`Registration`:`Login`} failed due to an unknown error. Please check your connection and try again.`:s}export{i as a,a as i,s as n,n as o,r,e as t};

package/dist/esm/sdk/export-viewer-host-DsRaS0UH.js ADDED Viewed

@@ -0,0 +1 @@

+ import{t as e}from"./surface-measurement-reporter-BJhfiPw6.js";import{n as t,t as n}from"./appearance-4DmzKUWf.js";let r=null,i=0;var a=class{surface;state;constructor(e,t,n,r,i,a){this.session=e,this.context=t,this.state={kind:`mounted`,lifecycle:i,binding:r,reporter:null},this.surface=a({parent:document.body,context:t,model:n,onClosed:this.closed})}start(){this.state.kind!==`disposed`&&(o(this.state.lifecycle,`opened`),this.state.kind===`mounted`&&this.bindMeasurement(this.state.binding))}matches(e,t){return this.surface.element.isConnected&&this.context===t&&this.session.kind===e.kind&&this.session.id===e.id}update(e,n,r){this.state.kind!==`disposed`&&(r&&(this.state.lifecycle=r),this.surface.update(e),t(this.state.binding,n)||this.bindMeasurement(n))}dispose(){r===this&&(r=null),this.surface.dispose()}closed=()=>{let e=this.state;e.kind!==`disposed`&&(this.state={kind:`disposed`},r===this&&(r=null,i+=1),e.reporter?.disconnect(),o(e.lifecycle,`closed`))};bindMeasurement(t){let n=this.state;if(n.kind===`disposed`||(n.reporter?.disconnect(),n.binding=t,n.reporter=null,t.kind===`disabled`))return;let r=e({kind:`request_surface`,element:this.surface.element,requestId:t.requestId,postMeasurement:t.postMeasurement});this.state===n?n.reporter=r:r.disconnect()}};function o(e,t){try{e?.(t)}catch{}}function s(e){let t=e.surfaceMeasurementBinding;return t.kind===`wallet_iframe`&&(t.hostSurfaceVariant??e.variant)===`modal`?`wallet-iframe`:`standalone`}function c(e){if(!e)return;let t=e.title.trim(),n=e.body?.trim(),r=e.steps?.map(l).filter(u);if(!(!t&&!n&&!r?.length))return{title:t,body:n,steps:r}}function l(e){return e.trim()}function u(e){return e.length>0}function d(e){return!!e.publicKey.trim()||!!e.privateKey.trim()}function f(e,t){return{id:`${e.scheme}-${t}`,scheme:e.scheme,label:e.label.trim(),publicKey:e.publicKey.trim(),address:e.address?.trim()??``}}function p(e){let t=e.accountId.trim(),n=c(e.guidance),r=e.errorMessage?.trim();if(r)return{kind:`failed`,accountId:t,guidance:n,message:r};let i=e.keys?.filter(d)??[];if(i.length===0){let t=e.publicKey?.trim()??``,n=e.privateKey?.trim()??``;(t||n)&&i.push({scheme:`ed25519`,label:`NEAR Ed25519`,publicKey:t,privateKey:n})}if(e.loading){let e={kind:`loading`,accountId:t,guidance:n,entries:[]};for(let[t,n]of i.entries())e.entries.push({...f(n,t),material:{kind:`loading`}});return e}let a={kind:`ready`,accountId:t,guidance:n,entries:[]};for(let[e,t]of i.entries()){let n=t.privateKey.trim();a.entries.push({...f(t,e),material:n?{kind:`ready`,value:n}:{kind:`unavailable`}})}return a}function m(e){let t=e.trim();return!!t&&r?.session.kind===`tracked`&&r.session.id===t&&r.surface.element.isConnected}async function h(e){if(typeof document>`u`)throw Error(`Export viewer host requires a DOM environment`);let t=++i,o={variant:e.variant,appearance:n({requestedAppearance:e.appearance,requestedMode:e.theme}),content:p(e)},c=e.sessionId?.trim(),l=c?{kind:`tracked`,id:c}:{kind:`untracked`},u=s(e),{mountExportPrivateKeySurface:d}=await import(`./mountExportPrivateKeySurface-C8_tpDHF.js`);if(t!==i)return;if(r?.matches(l,u)){r.update(o,e.surfaceMeasurementBinding,e.onLifecycle);return}if(r?.dispose(),t!==i)return;let f=new a(l,u,o,e.surfaceMeasurementBinding,e.onLifecycle??null,d);r=f;try{f.start()}catch(e){throw f.dispose(),e}}function g(){i+=1,r?.dispose()}export{g as n,h as r,m as t};