@seams/wallet 0.17.0 → 0.19.0

package/dist/{esm/sdk/ecdsaDerivationClientWasm-DQlajPpE.js → public/sdk/ecdsaDerivationClientWasm-DmwKWUEb.js}

@@ -1 +1 @@
-import{h as e,r as t}from"./domainIds-C3fUa33Q.js";import{jt as n}from"./emailOtpEcdsaDerivationIdentity-BDVjvnmO.js";import{F as r,P as i}from"./ecdsaCapabilityManifest-DzA996y9.js";import{t as a}from"./executeWorkerOperation-DKCRRq5E.js";const o={WORKER_READY:`WORKER_READY`},s={PrepareThresholdEcdsaDerivationRoleLocalClientBootstrap:7e4,FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrap:70001,CreateRouterAbEcdsaRegistrationCeremony:70005,VerifyRouterAbEcdsaRegistrationClientProofs:70006,CloseRouterAbEcdsaRegistrationCeremony:70007,FinalizeRouterAbEcdsaRegistrationActivation:70008,CreateRouterAbEcdsaPostRegistrationCeremony:70009,FinalizeRouterAbEcdsaExplicitExport:70010,CloseRouterAbEcdsaPostRegistrationCeremony:70011,StoreThresholdEcdsaRoleLocalSigningMaterial:70004,RehydrateEcdsaRoleLocalSigningMaterial:70015,PersistInitialCanonicalEcdsaActivation:70016,ReconcileCanonicalEcdsaActivation:70017,PrewarmEcdsaRegistrationCrypto:70018,VerifyRouterAbEcdsaPostRegistrationProofs:70019,SignWalletRecoveryEcdsaMaterialPossessionProof:70020,PrepareLinkedDeviceEcdsaSourceContribution:70022,StoreLinkedDeviceEcdsaHolderMaterial:70023,DisposeLinkedDeviceEcdsaHolderMaterials:70024,CreateEcdsaHolderOrdinaryExportRequest:70027,FinalizeEcdsaHolderOrdinaryExport:70028},c={PrepareThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess:70100,FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess:70101,CreateRouterAbEcdsaRegistrationCeremonySuccess:70105,VerifyRouterAbEcdsaRegistrationClientProofsSuccess:70106,CloseRouterAbEcdsaRegistrationCeremonySuccess:70107,FinalizeRouterAbEcdsaRegistrationActivationSuccess:70108,CreateRouterAbEcdsaPostRegistrationCeremonySuccess:70109,FinalizeRouterAbEcdsaExplicitExportSuccess:70110,CloseRouterAbEcdsaPostRegistrationCeremonySuccess:70111,StoreThresholdEcdsaRoleLocalSigningMaterialSuccess:70104,RehydrateEcdsaRoleLocalSigningMaterialSuccess:70115,PersistInitialCanonicalEcdsaActivationSuccess:70116,ReconcileCanonicalEcdsaActivationSuccess:70117,PrewarmEcdsaRegistrationCryptoSuccess:70118,VerifyRouterAbEcdsaPostRegistrationProofsSuccess:70119,SignWalletRecoveryEcdsaMaterialPossessionProofSuccess:70120,PrepareLinkedDeviceEcdsaSourceContributionSuccess:70122,StoreLinkedDeviceEcdsaHolderMaterialSuccess:70123,DisposeLinkedDeviceEcdsaHolderMaterialsSuccess:70124,CreateEcdsaHolderOrdinaryExportRequestSuccess:70127,FinalizeEcdsaHolderOrdinaryExportSuccess:70128},l={SessionInit:71e3,SessionStep:71001,SessionAbort:71002,Admit:71003,Destroy:71004,Reserve:71005,Commit:71006,ListAvailable:71007,ClearWallet:71008},u={SessionInitSuccess:71100,SessionStepSuccess:71101,SessionAbortSuccess:71102,AdmitSuccess:71103,DestroySuccess:71104,ReserveSuccess:71105,CommitSuccess:71106,ListAvailableSuccess:71107,ClearWalletSuccess:71108},d={ComputeSignatureShare:72e3},f={ComputeSignatureShareSuccess:72100};var p=class extends Error{code;coreCode;workerKind;constructor(e){super(e.message),this.name=`SignerWorkerOperationError`,this.code=(e.code||`SIGNER_INTERNAL`).trim(),this.coreCode=e.coreCode?.trim()||void 0,this.workerKind=e.workerKind}};function m(e){if(!e||typeof e!=`object`)return;let t=e.code;if(typeof t!=`string`)return;let n=t.trim();return n.length?n:void 0}function h(e){if(!e||typeof e!=`object`)return;let t=e.coreCode;if(typeof t!=`string`)return;let n=t.trim();return n.length?n:void 0}const g=2e4;function _(e){return{presignatureId:e.presignatureId,materialHandle:e.materialHandle,bigR33:new Uint8Array(e.bigR33),createdAtMs:e.createdAtMs,expiresAtMs:e.expiresAtMs}}async function v(e){return await a({ctx:e.workerCtx,kind:`ecdsaDerivationClient`,request:e.request})}async function y(e){return await a({ctx:e.workerCtx,kind:`ecdsaDerivationClient`,request:e.request})}async function b(e){return await a({ctx:e.workerCtx,kind:`ecdsaPresignClient`,request:e.request})}async function x(e){return await a({ctx:e.workerCtx,kind:`ecdsaOnlineClient`,request:e.request})}async function S(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.PrepareThresholdEcdsaDerivationRoleLocalClientBootstrap,timeoutMs:g,payload:e.command}});if(t.type!==c.PrepareThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess)throw Error(`PrepareThresholdEcdsaDerivationRoleLocalClientBootstrap failed`);return t.payload}async function C(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrap,timeoutMs:g,payload:e.command}});if(t.type!==c.FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess)throw Error(`FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrap failed`);return t.payload}async function w(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CreateRouterAbEcdsaRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CreateRouterAbEcdsaRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA registration ceremony creation failed`);return t.payload}async function T(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.VerifyRouterAbEcdsaRegistrationClientProofs,timeoutMs:g,payload:e.command}});if(t.type!==c.VerifyRouterAbEcdsaRegistrationClientProofsSuccess)throw Error(`Router A/B ECDSA registration client proof verification failed`);return t.payload}async function E(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.FinalizeRouterAbEcdsaRegistrationActivation,timeoutMs:g,payload:e.command}});if(t.type!==c.FinalizeRouterAbEcdsaRegistrationActivationSuccess)throw Error(`Router A/B ECDSA registration activation finalization failed`);return t.payload}async function D(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.PersistInitialCanonicalEcdsaActivation,timeoutMs:g,payload:e.command}});if(t.type!==c.PersistInitialCanonicalEcdsaActivationSuccess)throw Error(`Initial canonical ECDSA activation persistence failed`);return t.payload}async function O(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.ReconcileCanonicalEcdsaActivation,timeoutMs:g,payload:e.command}});if(t.type!==c.ReconcileCanonicalEcdsaActivationSuccess)throw Error(`Canonical ECDSA activation reconciliation failed`);let n=t.payload;return n.kind===`canonical_ecdsa_activation_committed_finalization_required_v1`?{kind:`canonical_ecdsa_activation_reconciliation_pending_v1`,journalId:n.journalId,reason:`wallet_custody_rejoin_required`,activationCommand:null}:n}async function k(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CloseRouterAbEcdsaRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CloseRouterAbEcdsaRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA registration ceremony close failed`);return t.payload}async function A(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CreateRouterAbEcdsaPostRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CreateRouterAbEcdsaPostRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA post-registration ceremony creation failed`);return t.payload}async function j(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.FinalizeRouterAbEcdsaExplicitExport,timeoutMs:g,payload:e.command}});if(t.type!==c.FinalizeRouterAbEcdsaExplicitExportSuccess)throw Error(`Router A/B ECDSA post-registration client proof finalization failed`);return t.payload}async function M(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CloseRouterAbEcdsaPostRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CloseRouterAbEcdsaPostRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA post-registration ceremony close failed`);return t.payload}async function N(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.StoreThresholdEcdsaRoleLocalSigningMaterial,timeoutMs:g,payload:{materialHandle:e.materialHandle,bindingDigest:e.bindingDigest,stateBlob:e.stateBlob}}});if(t.type!==c.StoreThresholdEcdsaRoleLocalSigningMaterialSuccess)throw Error(`StoreThresholdEcdsaRoleLocalSigningMaterial failed`);return t.payload}function P(e,t){return t.durableMaterialRef===e.durableMaterialRef&&t.bindingDigest===e.bindingDigest}async function F(a){let o=n(a.authority);if(!o)throw Error(`ECDSA role-local signing material authority is invalid`);let l=e(a.materialActivation);if(!l.ok)throw Error(l.error.message);let u=l.value,d=await v({workerCtx:a.workerCtx,request:{type:s.RehydrateEcdsaRoleLocalSigningMaterial,timeoutMs:g,payload:{kind:`open_ecdsa_role_local_signing_material_v1`,authority:o,materialActivation:u}}});if(d.type!==c.RehydrateEcdsaRoleLocalSigningMaterialSuccess)throw Error(`OpenEcdsaRoleLocalSigningMaterial failed`);let f=d.payload;switch(f.kind){case`ecdsa_role_local_signing_material_unavailable_v1`:return{ok:!1,reason:f.reason};case`ecdsa_role_local_signing_material_opened_v1`:{let e=i(f.materialRef);if(!t(u,e.materialActivation))throw Error(`ECDSA role-local signing material open changed its activation identity`);let n=r(f.liveHandle);if(!P(e,n))throw Error(`ECDSA role-local signing material hydration changed its identity`);return{ok:!0,liveHandle:n,materialRef:e}}default:{let e=f;throw Error(`ECDSA role-local signing material hydration response kind is invalid: ${String(e)}`)}}}async function I(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.SignWalletRecoveryEcdsaMaterialPossessionProof,timeoutMs:g,payload:{kind:`sign_wallet_recovery_ecdsa_material_possession_proof_v1`,challenge:e.challenge,stateBlob:e.stateBlob}}});if(t.type!==c.SignWalletRecoveryEcdsaMaterialPossessionProofSuccess)throw Error(`Wallet recovery ECDSA possession proof signing failed`);return t.payload}async function ee(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.PrepareLinkedDeviceEcdsaSourceContribution,timeoutMs:g,payload:{kind:`prepare_linked_device_ecdsa_source_contribution_v1`,preparation:e.preparation,...e.linkedHolderHandleId===void 0?{}:{linkedHolderHandleId:e.linkedHolderHandleId}}}});if(t.type!==c.PrepareLinkedDeviceEcdsaSourceContributionSuccess)throw Error(`Linked-device ECDSA source contribution preparation failed`);return t.payload}function L(e){let t=Array.isArray(e.outgoingMessages)?e.outgoingMessages.map(e=>new Uint8Array(e)):[];switch(e.event){case`final_batch_ready`:return{stage:`presign`,event:e.event,outgoingMessages:t,candidateBigR33:new Uint8Array(e.candidateBigR33)};case`presign_done`:return{stage:`done`,event:e.event,outgoingMessages:t,presignatureHandle:e.presignatureHandle,presignatureBigR33:new Uint8Array(e.presignatureBigR33)};case`none`:case`triples_done`:return{stage:e.stage,event:e.event,outgoingMessages:t}}}async function R(e){let t=e.groupPublicKey33.slice(),n=await b({workerCtx:e.workerCtx,request:{type:l.SessionInit,timeoutMs:g,payload:{authority:{kind:`role_local_derivation_handle`,materialHandle:e.materialHandle,material:e.material},sessionId:e.sessionId,groupPublicKey33:t.buffer,ceremonyExpiresAtMs:e.ceremonyExpiresAtMs,materialExpiresAtMs:e.materialExpiresAtMs,poolIdentity:e.poolIdentity},transfer:[t.buffer]}});if(n.type!==u.SessionInitSuccess)throw Error(`ThresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandle failed`);if(n.payload.authority.kind!==`role_local_derivation_handle`)throw Error(`ECDSA role-local presign returned a different authority`);return L(n.payload.progress)}async function z(e){let t=e.groupPublicKey33.slice(),n=await b({workerCtx:e.workerCtx,request:{type:l.SessionInit,timeoutMs:g,payload:{authority:{kind:`linked_holder_signing_material`,holderHandleId:e.holderHandleId},sessionId:e.sessionId,groupPublicKey33:t.buffer,ceremonyExpiresAtMs:e.ceremonyExpiresAtMs,materialExpiresAtMs:e.materialExpiresAtMs,poolIdentity:e.poolIdentity},transfer:[t.buffer]}});if(n.type!==u.SessionInitSuccess)throw Error(`Linked holder ECDSA presign initialization failed`);if(n.payload.authority.kind!==`linked_holder_signing_material`)throw Error(`Linked holder ECDSA presign returned a different authority`);return L(n.payload.progress)}async function B(e){if(e.holderHandleId.trim().length===0)throw Error(`ECDSA holder handle must be non-empty`);let t=await y({workerCtx:e.workerCtx,request:{type:s.CreateEcdsaHolderOrdinaryExportRequest,timeoutMs:g,payload:{kind:`create_ecdsa_holder_ordinary_export_request_v1`,holderHandleId:e.holderHandleId,request:e.request},transfer:[]}});if(t.type!==c.CreateEcdsaHolderOrdinaryExportRequestSuccess)throw Error(`ECDSA holder ordinary-export request preparation failed`);if(t.payload.holderHandleId!==e.holderHandleId)throw Error(`ECDSA holder ordinary-export request returned a different holder`);if(t.payload.requestDigestB64u.trim().length===0)throw Error(`ECDSA holder ordinary-export request digest is empty`);return t.payload}async function V(e){if(e.holderHandleId.trim().length===0)throw Error(`ECDSA holder handle must be non-empty`);if(e.requestDigestB64u!==e.expectedBinding.export_request_digest_b64u)throw Error(`ECDSA holder ordinary-export request digest differs from its binding`);let t=await y({workerCtx:e.workerCtx,request:{type:s.FinalizeEcdsaHolderOrdinaryExport,timeoutMs:g,payload:{kind:`finalize_ecdsa_holder_ordinary_export_v1`,holderHandleId:e.holderHandleId,requestDigestB64u:e.requestDigestB64u,expectedBinding:e.expectedBinding,forwardedResponse:e.forwardedResponse},transfer:[]}});if(t.type!==c.FinalizeEcdsaHolderOrdinaryExportSuccess)throw Error(`ECDSA holder ordinary-export finalization failed`);if(t.payload.holderHandleId!==e.holderHandleId)throw Error(`ECDSA holder ordinary-export finalization returned a different holder`);return t.payload}async function H(e){if(e.holderHandleId.trim().length===0)throw Error(`Linked holder ECDSA handle must be non-empty`);if(e.ownedSigningShare32.byteLength!==32)throw Error(`Linked holder ECDSA signing share must contain 32 bytes`);if(e.activationReceiptJson.trim().length===0)throw Error(`Linked holder ECDSA activation receipt must be non-empty`);let t=e.ownedSigningShare32.slice();try{let n=await a({kind:`ecdsaDerivationClient`,ctx:e.workerCtx,request:{type:s.StoreLinkedDeviceEcdsaHolderMaterial,timeoutMs:g,payload:{holderHandleId:e.holderHandleId,ownedSigningShare32:t.buffer,activationReceiptJson:e.activationReceiptJson},transfer:[t.buffer]}});if(n.type!==c.StoreLinkedDeviceEcdsaHolderMaterialSuccess)throw Error(`Linked holder ECDSA material import failed`);if(n.payload.holderHandleId!==e.holderHandleId)throw Error(`Linked holder ECDSA material import returned a different handle`);return n.payload}finally{t.byteLength>0&&t.fill(0)}}async function U(e){let t=await a({kind:`ecdsaDerivationClient`,ctx:e.workerCtx,request:{type:s.DisposeLinkedDeviceEcdsaHolderMaterials,timeoutMs:g,payload:e.disposal,transfer:[]}});if(t.type!==c.DisposeLinkedDeviceEcdsaHolderMaterialsSuccess)throw Error(`Linked holder ECDSA material disposal failed`);if(t.payload.kind!==e.disposal.kind)throw Error(`Linked holder ECDSA material disposal returned a different scope`);if(e.disposal.kind===`one`&&t.payload.kind===`one`&&t.payload.holderHandleId!==e.disposal.holderHandleId)throw Error(`Linked holder ECDSA material disposal returned a different handle`)}async function W(e){if(e.holderHandleId.trim().length===0)throw Error(`Linked holder ECDSA handle must be non-empty`);await U({disposal:{kind:`one`,holderHandleId:e.holderHandleId},workerCtx:e.workerCtx})}async function G(e){let t=!1,n;for(let r of e.holderHandleIds)try{await W({holderHandleId:r,workerCtx:e.workerCtx})}catch(e){t||(t=!0,n=e)}if(t)throw n}async function K(e){await U({disposal:{kind:`all`},workerCtx:e.workerCtx})}async function q(e){let t=e.incomingMessages.map(e=>e.slice()),n=t.map(e=>e.buffer),r=await b({workerCtx:e.workerCtx,request:{type:l.SessionStep,timeoutMs:g,payload:{sessionId:e.sessionId,stage:e.stage,incomingMessages:t.map(e=>e.buffer)},transfer:n}});if(r.type!==u.SessionStepSuccess)throw Error(`ThresholdEcdsaRoleLocalPresignSessionStep failed`);return L(r.payload)}async function J(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.SessionAbort,timeoutMs:g,payload:{sessionId:e.sessionId}}});if(t.type!==u.SessionAbortSuccess)throw Error(`ThresholdEcdsaRoleLocalPresignSessionAbort failed`);let n=t.payload;if(n.kind!==`threshold_ecdsa_presign_session_aborted`||n.sessionId!==e.sessionId)throw Error(`ThresholdEcdsaRoleLocalPresignSessionAbort returned invalid result`)}async function Y(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.Admit,timeoutMs:g,payload:{materialHandle:e.materialHandle,expectedPresignatureId:e.expectedPresignatureId,poolIdentity:e.poolIdentity,admissionMode:e.admissionMode}}});if(t.type!==u.AdmitSuccess)throw Error(`ThresholdEcdsaRoleLocalAdmitPresignature failed`);if(t.payload.kind!==`ecdsa_client_presignature_admitted_v1`||t.payload.materialHandle!==e.materialHandle||t.payload.presignatureId!==e.expectedPresignatureId)throw Error(`ThresholdEcdsaRoleLocalAdmitPresignature returned invalid binding`);return t.payload.storage}async function X(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.Destroy,timeoutMs:g,payload:{materialHandle:e.materialHandle,poolIdentity:e.poolIdentity}}});if(t.type!==u.DestroySuccess)throw Error(`ThresholdEcdsaRoleLocalDestroyPresignature failed`);if(t.payload.kind!==`ecdsa_client_presignature_destroyed_v1`||t.payload.materialHandle!==e.materialHandle)throw Error(`ThresholdEcdsaRoleLocalDestroyPresignature returned invalid handle`)}async function Z(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.Reserve,timeoutMs:g,payload:{materialHandle:e.materialHandle,expectedPresignatureId:e.expectedPresignatureId,poolIdentity:e.poolIdentity,requestBinding:e.requestBinding,reservationId:e.reservationId,leaseExpiresAtMs:e.leaseExpiresAtMs}}});if(t.type!==u.ReserveSuccess)throw Error(`ThresholdEcdsaRoleLocalReservePresignature failed`);return t.payload}async function Q(e){if((await b({workerCtx:e.workerCtx,request:{type:l.Commit,timeoutMs:g,payload:{materialHandle:e.materialHandle,poolIdentity:e.poolIdentity,requestBinding:e.requestBinding,reservationId:e.reservationId}}})).type!==u.CommitSuccess)throw Error(`ThresholdEcdsaRoleLocalCommitPresignature failed`)}async function $(e,t){let n=await b({workerCtx:t.workerCtx,request:{type:l.ListAvailable,timeoutMs:g,payload:{authority:{kind:e},poolIdentity:t.poolIdentity}}});if(n.type!==u.ListAvailableSuccess)throw Error(`ThresholdEcdsaListAvailablePresignatures failed`);return n.payload.map(_)}async function te(e){let t=e.groupPublicKey33.slice(),n=e.expectedPresignBigR33.slice(),r=e.digest32.slice(),i=e.clientRerandomizationContribution32.slice(),a=e.signingWorkerRerandomizationContribution32.slice(),o=await x({workerCtx:e.workerCtx,request:{type:d.ComputeSignatureShare,timeoutMs:g,payload:{materialHandle:e.materialHandle,poolIdentity:e.poolIdentity,requestBinding:e.requestBinding,reservationId:e.reservationId,groupPublicKey33:t.buffer,expectedPresignBigR33:n.buffer,digest32:r.buffer,clientRerandomizationContribution32:i.buffer,signingWorkerRerandomizationContribution32:a.buffer},transfer:[t.buffer,n.buffer,r.buffer,i.buffer,a.buffer]}});if(o.type!==f.ComputeSignatureShareSuccess)throw Error(`ThresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandle failed`);return new Uint8Array(o.payload)}export{Z as A,Y as C,J as D,X as E,p as F,o as I,h as L,s as M,c as N,R as O,l as P,m as R,$ as S,te as T,O as _,A as a,H as b,G as c,j as d,E as f,ee as g,S as h,B as i,T as j,q as k,C as l,D as m,M as n,w as o,F as p,k as r,W as s,K as t,V as u,I as v,Q as w,z as x,N as y};
+import{h as e,r as t}from"./domainIds-C3fUa33Q.js";import{jt as n}from"./emailOtpEcdsaDerivationIdentity-CupWCKNg.js";import{F as r,P as i}from"./ecdsaCapabilityManifest-DRc423SV.js";import{t as a}from"./executeWorkerOperation-DKCRRq5E.js";const o={WORKER_READY:`WORKER_READY`},s={PrepareThresholdEcdsaDerivationRoleLocalClientBootstrap:7e4,FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrap:70001,CreateRouterAbEcdsaRegistrationCeremony:70005,VerifyRouterAbEcdsaRegistrationClientProofs:70006,CloseRouterAbEcdsaRegistrationCeremony:70007,FinalizeRouterAbEcdsaRegistrationActivation:70008,CreateRouterAbEcdsaPostRegistrationCeremony:70009,FinalizeRouterAbEcdsaExplicitExport:70010,CloseRouterAbEcdsaPostRegistrationCeremony:70011,StoreThresholdEcdsaRoleLocalSigningMaterial:70004,RehydrateEcdsaRoleLocalSigningMaterial:70015,PersistInitialCanonicalEcdsaActivation:70016,ReconcileCanonicalEcdsaActivation:70017,PrewarmEcdsaRegistrationCrypto:70018,VerifyRouterAbEcdsaPostRegistrationProofs:70019,SignWalletRecoveryEcdsaMaterialPossessionProof:70020,PrepareLinkedDeviceEcdsaSourceContribution:70022,StoreLinkedDeviceEcdsaHolderMaterial:70023,DisposeLinkedDeviceEcdsaHolderMaterials:70024,CreateEcdsaHolderOrdinaryExportRequest:70027,FinalizeEcdsaHolderOrdinaryExport:70028},c={PrepareThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess:70100,FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess:70101,CreateRouterAbEcdsaRegistrationCeremonySuccess:70105,VerifyRouterAbEcdsaRegistrationClientProofsSuccess:70106,CloseRouterAbEcdsaRegistrationCeremonySuccess:70107,FinalizeRouterAbEcdsaRegistrationActivationSuccess:70108,CreateRouterAbEcdsaPostRegistrationCeremonySuccess:70109,FinalizeRouterAbEcdsaExplicitExportSuccess:70110,CloseRouterAbEcdsaPostRegistrationCeremonySuccess:70111,StoreThresholdEcdsaRoleLocalSigningMaterialSuccess:70104,RehydrateEcdsaRoleLocalSigningMaterialSuccess:70115,PersistInitialCanonicalEcdsaActivationSuccess:70116,ReconcileCanonicalEcdsaActivationSuccess:70117,PrewarmEcdsaRegistrationCryptoSuccess:70118,VerifyRouterAbEcdsaPostRegistrationProofsSuccess:70119,SignWalletRecoveryEcdsaMaterialPossessionProofSuccess:70120,PrepareLinkedDeviceEcdsaSourceContributionSuccess:70122,StoreLinkedDeviceEcdsaHolderMaterialSuccess:70123,DisposeLinkedDeviceEcdsaHolderMaterialsSuccess:70124,CreateEcdsaHolderOrdinaryExportRequestSuccess:70127,FinalizeEcdsaHolderOrdinaryExportSuccess:70128},l={SessionInit:71e3,SessionStep:71001,SessionAbort:71002,Admit:71003,Destroy:71004,Reserve:71005,Commit:71006,ListAvailable:71007,ClearWallet:71008},u={SessionInitSuccess:71100,SessionStepSuccess:71101,SessionAbortSuccess:71102,AdmitSuccess:71103,DestroySuccess:71104,ReserveSuccess:71105,CommitSuccess:71106,ListAvailableSuccess:71107,ClearWalletSuccess:71108},d={ComputeSignatureShare:72e3},f={ComputeSignatureShareSuccess:72100};var p=class extends Error{code;coreCode;workerKind;constructor(e){super(e.message),this.name=`SignerWorkerOperationError`,this.code=(e.code||`SIGNER_INTERNAL`).trim(),this.coreCode=e.coreCode?.trim()||void 0,this.workerKind=e.workerKind}};function m(e){if(!e||typeof e!=`object`)return;let t=e.code;if(typeof t!=`string`)return;let n=t.trim();return n.length?n:void 0}function h(e){if(!e||typeof e!=`object`)return;let t=e.coreCode;if(typeof t!=`string`)return;let n=t.trim();return n.length?n:void 0}const g=2e4;function _(e){return{presignatureId:e.presignatureId,materialHandle:e.materialHandle,bigR33:new Uint8Array(e.bigR33),createdAtMs:e.createdAtMs,expiresAtMs:e.expiresAtMs}}async function v(e){return await a({ctx:e.workerCtx,kind:`ecdsaDerivationClient`,request:e.request})}async function y(e){return await a({ctx:e.workerCtx,kind:`ecdsaDerivationClient`,request:e.request})}async function b(e){return await a({ctx:e.workerCtx,kind:`ecdsaPresignClient`,request:e.request})}async function x(e){return await a({ctx:e.workerCtx,kind:`ecdsaOnlineClient`,request:e.request})}async function S(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.PrepareThresholdEcdsaDerivationRoleLocalClientBootstrap,timeoutMs:g,payload:e.command}});if(t.type!==c.PrepareThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess)throw Error(`PrepareThresholdEcdsaDerivationRoleLocalClientBootstrap failed`);return t.payload}async function C(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrap,timeoutMs:g,payload:e.command}});if(t.type!==c.FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess)throw Error(`FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrap failed`);return t.payload}async function w(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CreateRouterAbEcdsaRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CreateRouterAbEcdsaRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA registration ceremony creation failed`);return t.payload}async function T(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.VerifyRouterAbEcdsaRegistrationClientProofs,timeoutMs:g,payload:e.command}});if(t.type!==c.VerifyRouterAbEcdsaRegistrationClientProofsSuccess)throw Error(`Router A/B ECDSA registration client proof verification failed`);return t.payload}async function E(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.FinalizeRouterAbEcdsaRegistrationActivation,timeoutMs:g,payload:e.command}});if(t.type!==c.FinalizeRouterAbEcdsaRegistrationActivationSuccess)throw Error(`Router A/B ECDSA registration activation finalization failed`);return t.payload}async function D(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.PersistInitialCanonicalEcdsaActivation,timeoutMs:g,payload:e.command}});if(t.type!==c.PersistInitialCanonicalEcdsaActivationSuccess)throw Error(`Initial canonical ECDSA activation persistence failed`);return t.payload}async function O(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.ReconcileCanonicalEcdsaActivation,timeoutMs:g,payload:e.command}});if(t.type!==c.ReconcileCanonicalEcdsaActivationSuccess)throw Error(`Canonical ECDSA activation reconciliation failed`);let n=t.payload;return n.kind===`canonical_ecdsa_activation_committed_finalization_required_v1`?{kind:`canonical_ecdsa_activation_reconciliation_pending_v1`,journalId:n.journalId,reason:`wallet_custody_rejoin_required`,activationCommand:null}:n}async function k(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CloseRouterAbEcdsaRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CloseRouterAbEcdsaRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA registration ceremony close failed`);return t.payload}async function A(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CreateRouterAbEcdsaPostRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CreateRouterAbEcdsaPostRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA post-registration ceremony creation failed`);return t.payload}async function j(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.FinalizeRouterAbEcdsaExplicitExport,timeoutMs:g,payload:e.command}});if(t.type!==c.FinalizeRouterAbEcdsaExplicitExportSuccess)throw Error(`Router A/B ECDSA post-registration client proof finalization failed`);return t.payload}async function M(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CloseRouterAbEcdsaPostRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CloseRouterAbEcdsaPostRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA post-registration ceremony close failed`);return t.payload}async function N(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.StoreThresholdEcdsaRoleLocalSigningMaterial,timeoutMs:g,payload:{materialHandle:e.materialHandle,bindingDigest:e.bindingDigest,stateBlob:e.stateBlob}}});if(t.type!==c.StoreThresholdEcdsaRoleLocalSigningMaterialSuccess)throw Error(`StoreThresholdEcdsaRoleLocalSigningMaterial failed`);return t.payload}function P(e,t){return t.durableMaterialRef===e.durableMaterialRef&&t.bindingDigest===e.bindingDigest}async function F(a){let o=n(a.authority);if(!o)throw Error(`ECDSA role-local signing material authority is invalid`);let l=e(a.materialActivation);if(!l.ok)throw Error(l.error.message);let u=l.value,d=await v({workerCtx:a.workerCtx,request:{type:s.RehydrateEcdsaRoleLocalSigningMaterial,timeoutMs:g,payload:{kind:`open_ecdsa_role_local_signing_material_v1`,authority:o,materialActivation:u}}});if(d.type!==c.RehydrateEcdsaRoleLocalSigningMaterialSuccess)throw Error(`OpenEcdsaRoleLocalSigningMaterial failed`);let f=d.payload;switch(f.kind){case`ecdsa_role_local_signing_material_unavailable_v1`:return{ok:!1,reason:f.reason};case`ecdsa_role_local_signing_material_opened_v1`:{let e=i(f.materialRef);if(!t(u,e.materialActivation))throw Error(`ECDSA role-local signing material open changed its activation identity`);let n=r(f.liveHandle);if(!P(e,n))throw Error(`ECDSA role-local signing material hydration changed its identity`);return{ok:!0,liveHandle:n,materialRef:e}}default:{let e=f;throw Error(`ECDSA role-local signing material hydration response kind is invalid: ${String(e)}`)}}}async function I(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.SignWalletRecoveryEcdsaMaterialPossessionProof,timeoutMs:g,payload:{kind:`sign_wallet_recovery_ecdsa_material_possession_proof_v1`,challenge:e.challenge,stateBlob:e.stateBlob}}});if(t.type!==c.SignWalletRecoveryEcdsaMaterialPossessionProofSuccess)throw Error(`Wallet recovery ECDSA possession proof signing failed`);return t.payload}async function ee(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.PrepareLinkedDeviceEcdsaSourceContribution,timeoutMs:g,payload:{kind:`prepare_linked_device_ecdsa_source_contribution_v1`,preparation:e.preparation,...e.linkedHolderHandleId===void 0?{}:{linkedHolderHandleId:e.linkedHolderHandleId}}}});if(t.type!==c.PrepareLinkedDeviceEcdsaSourceContributionSuccess)throw Error(`Linked-device ECDSA source contribution preparation failed`);return t.payload}function L(e){let t=Array.isArray(e.outgoingMessages)?e.outgoingMessages.map(e=>new Uint8Array(e)):[];switch(e.event){case`final_batch_ready`:return{stage:`presign`,event:e.event,outgoingMessages:t,candidateBigR33:new Uint8Array(e.candidateBigR33)};case`presign_done`:return{stage:`done`,event:e.event,outgoingMessages:t,presignatureHandle:e.presignatureHandle,presignatureBigR33:new Uint8Array(e.presignatureBigR33)};case`none`:case`triples_done`:return{stage:e.stage,event:e.event,outgoingMessages:t}}}async function R(e){let t=e.groupPublicKey33.slice(),n=await b({workerCtx:e.workerCtx,request:{type:l.SessionInit,timeoutMs:g,payload:{authority:{kind:`role_local_derivation_handle`,materialHandle:e.materialHandle,material:e.material},sessionId:e.sessionId,groupPublicKey33:t.buffer,ceremonyExpiresAtMs:e.ceremonyExpiresAtMs,materialExpiresAtMs:e.materialExpiresAtMs,poolIdentity:e.poolIdentity},transfer:[t.buffer]}});if(n.type!==u.SessionInitSuccess)throw Error(`ThresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandle failed`);if(n.payload.authority.kind!==`role_local_derivation_handle`)throw Error(`ECDSA role-local presign returned a different authority`);return L(n.payload.progress)}async function z(e){let t=e.groupPublicKey33.slice(),n=await b({workerCtx:e.workerCtx,request:{type:l.SessionInit,timeoutMs:g,payload:{authority:{kind:`linked_holder_signing_material`,holderHandleId:e.holderHandleId},sessionId:e.sessionId,groupPublicKey33:t.buffer,ceremonyExpiresAtMs:e.ceremonyExpiresAtMs,materialExpiresAtMs:e.materialExpiresAtMs,poolIdentity:e.poolIdentity},transfer:[t.buffer]}});if(n.type!==u.SessionInitSuccess)throw Error(`Linked holder ECDSA presign initialization failed`);if(n.payload.authority.kind!==`linked_holder_signing_material`)throw Error(`Linked holder ECDSA presign returned a different authority`);return L(n.payload.progress)}async function B(e){if(e.holderHandleId.trim().length===0)throw Error(`ECDSA holder handle must be non-empty`);let t=await y({workerCtx:e.workerCtx,request:{type:s.CreateEcdsaHolderOrdinaryExportRequest,timeoutMs:g,payload:{kind:`create_ecdsa_holder_ordinary_export_request_v1`,holderHandleId:e.holderHandleId,request:e.request},transfer:[]}});if(t.type!==c.CreateEcdsaHolderOrdinaryExportRequestSuccess)throw Error(`ECDSA holder ordinary-export request preparation failed`);if(t.payload.holderHandleId!==e.holderHandleId)throw Error(`ECDSA holder ordinary-export request returned a different holder`);if(t.payload.requestDigestB64u.trim().length===0)throw Error(`ECDSA holder ordinary-export request digest is empty`);return t.payload}async function V(e){if(e.holderHandleId.trim().length===0)throw Error(`ECDSA holder handle must be non-empty`);if(e.requestDigestB64u!==e.expectedBinding.export_request_digest_b64u)throw Error(`ECDSA holder ordinary-export request digest differs from its binding`);let t=await y({workerCtx:e.workerCtx,request:{type:s.FinalizeEcdsaHolderOrdinaryExport,timeoutMs:g,payload:{kind:`finalize_ecdsa_holder_ordinary_export_v1`,holderHandleId:e.holderHandleId,requestDigestB64u:e.requestDigestB64u,expectedBinding:e.expectedBinding,forwardedResponse:e.forwardedResponse},transfer:[]}});if(t.type!==c.FinalizeEcdsaHolderOrdinaryExportSuccess)throw Error(`ECDSA holder ordinary-export finalization failed`);if(t.payload.holderHandleId!==e.holderHandleId)throw Error(`ECDSA holder ordinary-export finalization returned a different holder`);return t.payload}async function H(e){if(e.holderHandleId.trim().length===0)throw Error(`Linked holder ECDSA handle must be non-empty`);if(e.ownedSigningShare32.byteLength!==32)throw Error(`Linked holder ECDSA signing share must contain 32 bytes`);if(e.activationReceiptJson.trim().length===0)throw Error(`Linked holder ECDSA activation receipt must be non-empty`);let t=e.ownedSigningShare32.slice();try{let n=await a({kind:`ecdsaDerivationClient`,ctx:e.workerCtx,request:{type:s.StoreLinkedDeviceEcdsaHolderMaterial,timeoutMs:g,payload:{holderHandleId:e.holderHandleId,ownedSigningShare32:t.buffer,activationReceiptJson:e.activationReceiptJson},transfer:[t.buffer]}});if(n.type!==c.StoreLinkedDeviceEcdsaHolderMaterialSuccess)throw Error(`Linked holder ECDSA material import failed`);if(n.payload.holderHandleId!==e.holderHandleId)throw Error(`Linked holder ECDSA material import returned a different handle`);return n.payload}finally{t.byteLength>0&&t.fill(0)}}async function U(e){let t=await a({kind:`ecdsaDerivationClient`,ctx:e.workerCtx,request:{type:s.DisposeLinkedDeviceEcdsaHolderMaterials,timeoutMs:g,payload:e.disposal,transfer:[]}});if(t.type!==c.DisposeLinkedDeviceEcdsaHolderMaterialsSuccess)throw Error(`Linked holder ECDSA material disposal failed`);if(t.payload.kind!==e.disposal.kind)throw Error(`Linked holder ECDSA material disposal returned a different scope`);if(e.disposal.kind===`one`&&t.payload.kind===`one`&&t.payload.holderHandleId!==e.disposal.holderHandleId)throw Error(`Linked holder ECDSA material disposal returned a different handle`)}async function W(e){if(e.holderHandleId.trim().length===0)throw Error(`Linked holder ECDSA handle must be non-empty`);await U({disposal:{kind:`one`,holderHandleId:e.holderHandleId},workerCtx:e.workerCtx})}async function G(e){let t=!1,n;for(let r of e.holderHandleIds)try{await W({holderHandleId:r,workerCtx:e.workerCtx})}catch(e){t||(t=!0,n=e)}if(t)throw n}async function K(e){await U({disposal:{kind:`all`},workerCtx:e.workerCtx})}async function q(e){let t=e.incomingMessages.map(e=>e.slice()),n=t.map(e=>e.buffer),r=await b({workerCtx:e.workerCtx,request:{type:l.SessionStep,timeoutMs:g,payload:{sessionId:e.sessionId,stage:e.stage,incomingMessages:t.map(e=>e.buffer)},transfer:n}});if(r.type!==u.SessionStepSuccess)throw Error(`ThresholdEcdsaRoleLocalPresignSessionStep failed`);return L(r.payload)}async function J(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.SessionAbort,timeoutMs:g,payload:{sessionId:e.sessionId}}});if(t.type!==u.SessionAbortSuccess)throw Error(`ThresholdEcdsaRoleLocalPresignSessionAbort failed`);let n=t.payload;if(n.kind!==`threshold_ecdsa_presign_session_aborted`||n.sessionId!==e.sessionId)throw Error(`ThresholdEcdsaRoleLocalPresignSessionAbort returned invalid result`)}async function Y(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.Admit,timeoutMs:g,payload:{materialHandle:e.materialHandle,expectedPresignatureId:e.expectedPresignatureId,poolIdentity:e.poolIdentity,admissionMode:e.admissionMode}}});if(t.type!==u.AdmitSuccess)throw Error(`ThresholdEcdsaRoleLocalAdmitPresignature failed`);if(t.payload.kind!==`ecdsa_client_presignature_admitted_v1`||t.payload.materialHandle!==e.materialHandle||t.payload.presignatureId!==e.expectedPresignatureId)throw Error(`ThresholdEcdsaRoleLocalAdmitPresignature returned invalid binding`);return t.payload.storage}async function X(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.Destroy,timeoutMs:g,payload:{materialHandle:e.materialHandle,poolIdentity:e.poolIdentity}}});if(t.type!==u.DestroySuccess)throw Error(`ThresholdEcdsaRoleLocalDestroyPresignature failed`);if(t.payload.kind!==`ecdsa_client_presignature_destroyed_v1`||t.payload.materialHandle!==e.materialHandle)throw Error(`ThresholdEcdsaRoleLocalDestroyPresignature returned invalid handle`)}async function Z(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.Reserve,timeoutMs:g,payload:{materialHandle:e.materialHandle,expectedPresignatureId:e.expectedPresignatureId,poolIdentity:e.poolIdentity,requestBinding:e.requestBinding,reservationId:e.reservationId,leaseExpiresAtMs:e.leaseExpiresAtMs}}});if(t.type!==u.ReserveSuccess)throw Error(`ThresholdEcdsaRoleLocalReservePresignature failed`);return t.payload}async function Q(e){if((await b({workerCtx:e.workerCtx,request:{type:l.Commit,timeoutMs:g,payload:{materialHandle:e.materialHandle,poolIdentity:e.poolIdentity,requestBinding:e.requestBinding,reservationId:e.reservationId}}})).type!==u.CommitSuccess)throw Error(`ThresholdEcdsaRoleLocalCommitPresignature failed`)}async function $(e,t){let n=await b({workerCtx:t.workerCtx,request:{type:l.ListAvailable,timeoutMs:g,payload:{authority:{kind:e},poolIdentity:t.poolIdentity}}});if(n.type!==u.ListAvailableSuccess)throw Error(`ThresholdEcdsaListAvailablePresignatures failed`);return n.payload.map(_)}async function te(e){let t=e.groupPublicKey33.slice(),n=e.expectedPresignBigR33.slice(),r=e.digest32.slice(),i=e.clientRerandomizationContribution32.slice(),a=e.signingWorkerRerandomizationContribution32.slice(),o=await x({workerCtx:e.workerCtx,request:{type:d.ComputeSignatureShare,timeoutMs:g,payload:{materialHandle:e.materialHandle,poolIdentity:e.poolIdentity,requestBinding:e.requestBinding,reservationId:e.reservationId,groupPublicKey33:t.buffer,expectedPresignBigR33:n.buffer,digest32:r.buffer,clientRerandomizationContribution32:i.buffer,signingWorkerRerandomizationContribution32:a.buffer},transfer:[t.buffer,n.buffer,r.buffer,i.buffer,a.buffer]}});if(o.type!==f.ComputeSignatureShareSuccess)throw Error(`ThresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandle failed`);return new Uint8Array(o.payload)}export{Z as A,Y as C,J as D,X as E,p as F,o as I,h as L,s as M,c as N,R as O,l as P,m as R,$ as S,te as T,O as _,A as a,H as b,G as c,j as d,E as f,ee as g,S as h,B as i,T as j,q as k,C as l,D as m,M as n,w as o,F as p,k as r,W as s,K as t,V as u,I as v,Q as w,z as x,N as y};

package/dist/{esm/sdk/ecdsaDerivationExport-DyugdheE.js → public/sdk/ecdsaDerivationExport-DX89rq_u.js}

@@ -1 +1 @@
-import{r as e}from"./domainIds-C3fUa33Q.js";import{c as t,u as n}from"./chains-CPmd4s9f.js";import{i as r,r as i}from"./base64-DW79QA0h.js";import{r as a}from"./secureRandomId-LwBFx84B.js";import{s as o}from"./walletDbName-DRzPv5Ir.js";import{g as s}from"./capabilityKinds-D0Yrp9uf.js";import{r as c}from"./canonicalPrimitives-BOzRXzfv.js";import{c as l,o as u}from"./ecdsaChainTarget-DkOrgv4y.js";import{i as d,n as f}from"./signerDomain-BFqRQ0Jl.js";import{$ as p,C as m,J as h,Kt as g,N as _,Z as v,en as y,h as ee,tn as b,v as x}from"./emailOtpEcdsaDerivationIdentity-BDVjvnmO.js";import{B as te,C as ne,E as S,I as re,R as ie,S as C,x as ae,y as w,z as oe}from"./ecdsaCapabilityManifest-DzA996y9.js";import{r as T}from"./types-CQTWmtqu.js";import{o as se}from"./walletSessionAuthorizationStore-D-MhJ0PC.js";import{t as ce}from"./thresholdEcdsa-murTq-xz.js";import{p as le}from"./nearEd25519YaoSigningPreparation-CqBNMG87.js";import{a as ue,i as de,r as fe}from"./walletSessionAuthorizationProjection-DuU6w0FP.js";import{a as pe,d as me,i as he,n as ge,u as _e}from"./ecdsaDerivationClientWasm-DQlajPpE.js";import{a as ve,r as ye,t as be}from"./walletSessionFailure-C6TAQTZn.js";import{a as E,o as D}from"./signingQueue-C1Pb07gm.js";import{t as O}from"./bytes-DZRW2UDg.js";const xe=`router-ab-ed25519-yao-seed-export-v1`;function Se(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=e,n=typeof t.id==`string`&&t.id.trim()?t.id.trim():void 0;return t.success===!0&&`data`in t&&t.error===void 0?{id:n,success:!0,data:t.data}:t.success===!1&&typeof t.error==`string`&&t.data===void 0?{id:n,success:!1,error:t.error}:null}function k(e){return e.kind===`credential_free_ecdsa_session_activation_authorization_v1`}function Ce(e,t){return e.error||e.message||e.code||t}function A(e){return p({kind:`router_ab_ecdsa_post_registration_session_activation_v1`,public_capability:e.publicCapability,session_policy:{threshold_session_id:e.thresholdSessionId,wallet_session_mint_id:e.walletSessionMintId,ttl_ms:e.ttlMs,remaining_uses:e.remainingUses,runtime_policy_scope:e.runtimePolicyScope}})}function we(e,t){let n=t.public_identity;return e.applicationBindingDigestB64u===t.context.application_binding_digest_b64u&&e.contextBinding32B64u===n.context_binding_b64u&&e.derivationClientSharePublicKey33B64u===n.derivation_client_share_public_key33_b64u&&e.relayerPublicKey33B64u===n.server_public_key33_b64u&&e.groupPublicKey33B64u===n.threshold_public_key33_b64u&&e.ethereumAddress.toLowerCase()===O(i(n.ethereum_address20_b64u))&&w(e.publicCapability,t)}function Te(e,t){let n=e.normal_signing.scope;return n.wallet_id===String(t.walletId)&&n.ecdsa_threshold_key_id===String(t.ecdsaThresholdKeyId)&&n.signing_root_id===String(t.signingRootId)&&n.signing_root_version===String(t.signingRootVersion)}function Ee(e){let t=e.persistedRoleLocalMaterial.publicFacts;if(!w(e.sessionActivation.public_capability,e.publicCapability)||e.sessionActivation.session.threshold_session_id!==e.thresholdSessionId||!Te(e.sessionActivation,t))throw Error(`Strict ECDSA session activation returned a different registered key identity`)}function De(t){let n=t.sessionActivation.activation,r=t.sessionActivation.authorization,i=r.record,a=y(n.public_capability.material_activation),o=0;for(let t of i.capabilitySubjects)t.kind===`sign`&&t.keyFamily===`ecdsa_secp256k1`&&e(t.materialActivation,a)&&(o+=1);if(Ee({publicCapability:t.publicCapability,persistedRoleLocalMaterial:t.persistedRoleLocalMaterial,thresholdSessionId:t.thresholdSessionId,sessionActivation:n}),String(i.walletId)!==t.walletId||String(i.walletId)!==String(n.public_capability.client_id)||i.authMethodId!==t.persistedRoleLocalMaterial.authority.walletAuthMethodId||i.authorizationId!==n.session.authorization_id||i.quotaId!==n.session.quota_id||i.expiresAtMs!==n.session.expires_at_ms||n.session.remaining_uses!==t.remainingUses||r.operationCredential.walletSessionId!==n.session.wallet_session_id||!e(a,t.persistedRoleLocalMaterial.materialActivation)||o!==1)throw Error(`Strict ECDSA credential-free activation authority does not match its session`)}function j(e){let t=e.persistedRoleLocalMaterial.publicFacts;if(!e.walletId||!e.thresholdSessionId)throw Error(`Strict ECDSA session activation requires exact wallet and session identity`);if(!Number.isSafeInteger(e.ttlMs)||e.ttlMs<1)throw Error(`Strict ECDSA session activation requires a positive ttlMs`);if(!Number.isSafeInteger(e.remainingUses)||e.remainingUses<1)throw Error(`Strict ECDSA session activation requires positive remainingUses`);if(String(t.walletId)!==e.walletId||!we(t,e.publicCapability))throw Error(`Strict ECDSA session activation requires exact registered role-local material`)}function Oe(e){switch(e.kind){case`rehydrated`:return e;case`device_link_required`:throw Error(`device_link_required: registered ECDSA role-local material is unavailable on this device`);case`corrupt`:throw Error(`Registered ECDSA role-local material is corrupt (${e.reason}): ${e.message}`);default:{let t=e;throw Error(`Unsupported ECDSA role-local material resolution: ${String(t)}`)}}}async function M(e){let t=Oe(await D({purpose:`registration_activation`,source:E(e.persistedRoleLocalMaterial),workerCtx:e.workerCtx}));return{kind:`existing_ecdsa_role_local_material_activated_v1`,roleLocalMaterial:t.liveHandle,roleLocalMaterialRef:t.materialRef,publicFacts:e.persistedRoleLocalMaterial.publicFacts,publicCapability:e.publicCapability}}async function ke(e){j(e);let t=await ce(e.relayerUrl,{auth:e.routeAuth,request:A(e)});if(!t.ok)throw Error(Ce(t,`Strict ECDSA session activation failed`));return await N({workerCtx:e.workerCtx,publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.persistedRoleLocalMaterial,walletId:e.walletId,thresholdSessionId:e.thresholdSessionId,ttlMs:e.ttlMs,remainingUses:e.remainingUses,runtimePolicyScope:e.runtimePolicyScope,sessionActivation:t.value})}async function N(e){return j(e),Ee({publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.persistedRoleLocalMaterial,thresholdSessionId:e.thresholdSessionId,sessionActivation:e.sessionActivation}),{sessionActivation:e.sessionActivation,roleLocalActivation:await M(e)}}async function Ae(e){return j(e),De(e),{sessionActivation:e.sessionActivation.activation,authorization:e.sessionActivation.authorization,roleLocalActivation:await M(e)}}async function je(e,t){let n=o(e.lanePolicy.runtimePolicyScope);if(!n)throw Error(`Strict ECDSA session activation requires runtimePolicyScope`);let r={workerCtx:e.workerCtx,publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.existingRoleLocalMaterial,walletId:String(e.key.walletId),thresholdSessionId:e.lanePolicy.thresholdSessionId,ttlMs:e.lanePolicy.ttlMs,remainingUses:e.lanePolicy.remainingUses,runtimePolicyScope:n},s=e.sessionActivation?k(e.sessionActivation)?await Ae({...r,sessionActivation:e.sessionActivation}):await N({...r,sessionActivation:e.sessionActivation}):await ke({...r,walletSessionMintId:Me(),relayerUrl:e.relayerUrl,routeAuth:e.bootstrapAuth}),c=s.sessionActivation.public_capability.public_identity,l=`authorization`in s?{thresholdSessionId:s.sessionActivation.session.threshold_session_id,authorizationSessionId:s.sessionActivation.session.authorization_session_id,authorizationId:s.sessionActivation.session.authorization_id,walletSessionId:s.sessionActivation.session.wallet_session_id,quotaId:s.sessionActivation.session.quota_id,expiresAtMs:s.sessionActivation.session.expires_at_ms,remainingUses:s.sessionActivation.session.remaining_uses,walletSession:s.authorization.record,operationCredential:s.authorization.operationCredential}:{thresholdSessionId:s.sessionActivation.session.threshold_session_id,authorizationSessionId:s.sessionActivation.session.authorization_session_id,authorizationId:s.sessionActivation.session.authorization_id,walletSessionId:s.sessionActivation.session.wallet_session_id,quotaId:s.sessionActivation.session.quota_id,expiresAtMs:s.sessionActivation.session.expires_at_ms,remainingUses:s.sessionActivation.session.remaining_uses,walletSession:s.sessionActivation.session.wallet_session,operationCredential:s.sessionActivation.session.operation_credential},u=await g({walletId:String(e.key.walletId),signingRootId:e.key.signingRootId,signingRootVersion:e.key.signingRootVersion});return{ok:!0,bootstrapKind:`strict_post_registration`,keygenSessionId:String(e.requestId||``).trim()||a(`tecdsa-keygen`,32,`threshold ECDSA session IDs`),rpId:t,keyHandle:String(e.keyHandle),clientVerifyingShareB64u:c.derivation_client_share_public_key33_b64u,thresholdEcdsaPublicKeyB64u:c.threshold_public_key33_b64u,ethereumAddress:O(i(c.ethereum_address20_b64u)),relayerKeyId:u,relayerVerifyingShareB64u:c.server_public_key33_b64u,participantIds:e.key.participantIds.map(Number),thresholdSessionId:l.thresholdSessionId,authorizationSessionId:l.authorizationSessionId,authorizationId:l.authorizationId,walletSessionId:l.walletSessionId,quotaId:l.quotaId,expiresAtMs:l.expiresAtMs,remainingUses:l.remainingUses,runtimePolicyScope:n,signingRootId:String(e.key.signingRootId),signingRootVersion:String(e.key.signingRootVersion),walletSession:l.walletSession,operationCredential:l.operationCredential,roleLocalActivation:s.roleLocalActivation,routerAbEcdsaDerivationNormalSigning:s.sessionActivation.normal_signing,secretSourceKind:`persisted_role_local`}}function Me(){let e=s(a(`wallet-session-mint`,32,`Wallet Session mint IDs`));if(!e.ok)throw Error(`Failed to create Wallet Session mint identity`);return e.value}async function Ne(e){let t=e.touchIdPrompt.getRpId();if(!t)return{ok:!1,code:`invalid_args`,message:`Missing rpId for WebAuthn`};try{return await je(e,t)}catch(e){return{ok:!1,code:`strict_post_registration_failed`,message:e instanceof Error?e.message:String(e)}}}const P=`stale_ecdsa_key_identity`;function Pe(e){if(!e)throw Error(`Strict ECDSA session bootstrap requires Wallet Session authority`);switch(e.kind){case`opaque_wallet_session_operation_credential_v1`:return e;case`publishable_key`:throw Error(`Strict ECDSA session bootstrap requires Wallet Session authority`)}throw Error(`Strict ECDSA session bootstrap authority is invalid`)}function Fe(e){let t=String(e.code||``).trim(),n=String(e.message||``).trim().toLowerCase();return t===`stale_session_state`&&n.includes(`threshold-ecdsa bootstrap`)&&n.includes(`client verifying share`)&&n.includes(`integrated key record`)}function Ie(e){let t=String(e.message||e.code||`threshold-ecdsa bootstrap failed`).trim(),n=Fe(e)?P:String(e.code||`threshold_ecdsa_bootstrap_failed`).trim()||`threshold_ecdsa_bootstrap_failed`,r=Error(t||`threshold-ecdsa bootstrap failed`);return r.code=n,r}function Le(e){let t=Error(e);return t.code=P,t}function Re(e){switch(e.authKind){case`email_otp`:return`email_otp`;case`passkey`:return`passkey`}return`unknown`}function ze(e){switch(e.bootstrap.secretSourceKind){case`persisted_role_local`:return e.request.authKind===`email_otp`?ae({authSubjectId:e.request.emailOtpWorkerSessionHandle.authSubjectId}):C({credentialIdB64u:e.request.passkeyCredentialIdB64u,rpId:e.bootstrap.rpId})}}function F(e,t){let n=String(e||``).trim().toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(n))throw Error(`threshold-ecdsa exact activation returned invalid ${t}`);return n}function Be(e){let t=F(e.bootstrapOwnerAddress,`server owner address`);if(t!==F(e.key.thresholdOwnerAddress,`key owner address`))throw Le(`threshold-ecdsa exact activation owner address mismatches server bootstrap result`);return t}async function Ve(e,t){let n=l(String(t.key.walletId)),r=t.lanePolicy.chainTarget,i=String(t.lanePolicy.thresholdSessionId).trim();if(e.routerAbNormalSigning.mode!==`enabled`)throw Error(`Router A/B ECDSA derivation normal signing must be enabled for activation`);let a={walletId:n,chainTarget:r,targetKey:u(r),operationId:i||null,authMethod:Re(t),evmFamilyKeyFingerprint:ee(t.key),keyHandle:t.keyHandle,chainTargetKey:u(r),ecdsaThresholdKeyId:String(t.key.ecdsaThresholdKeyId),thresholdSessionId:i||null,freshAuthRetrySideEffectState:`not_applicable`,hasRequestedEcdsaThresholdKeyId:!0,requestedSessionId:i||null,authKind:t.walletSessionRouteAuth?.kind||`none`,passkeyCredentialBound:t.authKind===`passkey`},o;try{o=await Ne({touchIdPrompt:e.touchIdPrompt,relayerUrl:t.relayerUrl,requestId:t.requestId,workerCtx:e.workerCtx,...`preauthorizedSessionActivation`in t&&t.preauthorizedSessionActivation?{sessionActivation:t.preauthorizedSessionActivation}:{bootstrapAuth:Pe(t.walletSessionRouteAuth)},keyHandle:t.keyHandle,key:t.key,lanePolicy:t.lanePolicy,publicCapability:t.publicCapability,existingRoleLocalMaterial:t.existingRoleLocalMaterial})}catch(e){try{console.warn(`[threshold-ecdsa][bootstrap][exception]`,{...a,message:e instanceof Error?e.message:String(e)})}catch{}throw e}if(!o.ok){try{console.warn(`[threshold-ecdsa][bootstrap][failure]`,{...a,code:o.code||``,message:o.message||``})}catch{}throw Ie({code:o.code,message:o.message})}let s=String(t.key.ecdsaThresholdKeyId).trim();if(!s)throw Error(`threshold-ecdsa bootstrap returned empty ecdsaThresholdKeyId`);let c=re(s),d=oe(String(o.keyHandle||``).trim()),f=String(o.relayerKeyId||``).trim();if(!f)throw Error(`threshold-ecdsa bootstrap returned empty relayerKeyId`);let p=te(f),m=String(o.clientVerifyingShareB64u||``).trim();if(!m)throw Error(`threshold-ecdsa bootstrap returned empty clientVerifyingShareB64u`);let h=ie(m),g=String(o.thresholdSessionId||``).trim();if(!g)throw Error(`threshold-ecdsa bootstrap returned empty thresholdSessionId`);let _=Number(o.expiresAtMs);if(!Number.isFinite(_))throw Error(`threshold-ecdsa bootstrap returned invalid expiresAtMs`);let v=Number(o.remainingUses);if(!Number.isFinite(v))throw Error(`threshold-ecdsa bootstrap returned invalid remainingUses`);let y=t.key.participantIds.map(e=>Number(e));if(!y)throw Error(`threshold-ecdsa bootstrap returned empty participantIds`);let b=Be({key:t.key,bootstrapOwnerAddress:o.ethereumAddress}),x=ne({walletId:n,chainTarget:r,keyHandle:d,ecdsaThresholdKeyId:c,signingRootId:o.signingRootId,signingRootVersion:o.signingRootVersion,applicationBindingDigestB64u:o.roleLocalActivation.publicCapability.context.application_binding_digest_b64u,clientParticipantId:1,relayerParticipantId:2,participantIds:y,contextBinding32B64u:o.roleLocalActivation.publicFacts.contextBinding32B64u,derivationClientSharePublicKey33B64u:o.roleLocalActivation.publicFacts.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:o.roleLocalActivation.publicFacts.relayerPublicKey33B64u,groupPublicKey33B64u:o.roleLocalActivation.publicFacts.groupPublicKey33B64u,ethereumAddress:o.roleLocalActivation.publicFacts.ethereumAddress,publicCapability:o.roleLocalActivation.publicCapability}),S=o.routerAbEcdsaDerivationNormalSigning,C=o.roleLocalActivation.roleLocalMaterial,ae=ze({request:t,bootstrap:o}),w={ok:!0,thresholdSessionId:g,authorizationSessionId:o.authorizationSessionId,authorizationId:o.authorizationId,walletSessionId:o.walletSessionId,quotaId:o.quotaId,expiresAtMs:_,remainingUses:v,runtimePolicyScope:o.runtimePolicyScope,walletSession:o.walletSession,operationCredential:o.operationCredential,clientVerifyingShareB64u:h};return{thresholdEcdsaKeyRef:{type:`threshold-ecdsa-secp256k1`,userId:n,chainTarget:r,relayerUrl:t.relayerUrl,keyHandle:d,ecdsaThresholdKeyId:c,backendBinding:{materialKind:`role_local_worker_handle`,relayerKeyId:p,clientVerifyingShareB64u:h,roleLocalMaterialHandle:C,roleLocalMaterialRef:o.roleLocalActivation.roleLocalMaterialRef,publicFacts:x,authMethod:ae},participantIds:y,thresholdEcdsaPublicKeyB64u:o.thresholdEcdsaPublicKeyB64u,ethereumAddress:b,relayerVerifyingShareB64u:o.relayerVerifyingShareB64u,routerAbEcdsaDerivationNormalSigning:S},session:w}}async function He(e,t){return await Ve(e,t)}function Ue(e){let t;try{t=c(e.evidenceSetDigest)}catch(e){throw Error(e instanceof Error?e.message:`ECDSA explicit export evidence digest is invalid`)}let n=Math.floor(Number(e.expiresAtMs)),r=v(e.operation);if(r.operation_kind!==`evm.export_key`)throw Error(`ECDSA explicit export operation kind is invalid`);if(!Number.isSafeInteger(n)||n<=Date.now())throw Error(`ECDSA explicit export operation authorization expiry is invalid`);let i=We(e.unseal);return{kind:`verified_step_up`,evidenceSetDigest:t,operation:r,expiresAtMs:n,quotaUse:`none`,unseal:i}}function We(e){switch(e.kind){case`not_requested`:return{kind:`not_requested`};case`email_otp_grant`:{let t=String(e.grant||``).trim(),n=String(e.challenge_id||``).trim();if(!t||!n)throw Error(`ECDSA explicit export Email OTP unseal grant is invalid`);return{kind:`email_otp_grant`,grant:t,challenge_id:n}}default:{let t=e;throw Error(`Unsupported ECDSA explicit export unseal state: ${String(t)}`)}}}async function I(e){let t=String(e.relayerUrl||``).trim();if(!t)throw Error(`ECDSA explicit export relayer URL is required`);return{kind:`explicit_key_export_ecdsa_activation_result`,purpose:`explicit_key_export`,material:{kind:`auth_neutral_ecdsa_export_material_v1`,relayerUrl:t,persistedMaterial:e.existingRoleLocalMaterial},authorization:Ue(e.authorization)}}function L(e,t){let n=String(e||t||``).trim();if(!n)throw Error(`Missing relayer url (configs.network.relayer.url)`);return n}function R(e){return`key`in e&&!!e.key&&`keyHandle`in e&&!!String(e.keyHandle||``).trim()}function z(e){return R(e)?e.key.walletId:e.walletId}function B(e){return R(e)?e.lanePolicy.chainTarget:e.chainTarget}function Ge(e){return e.kind===`email_otp_ecdsa_bootstrap`?{authMethod:f.emailOtp,signerSource:d.emailOtpRegistration}:{authMethod:f.passkey,signerSource:d.passkeyRegistration}}function Ke(e){switch(e.kind){case`passkey_preauthorized_ecdsa_bootstrap`:case`wallet_session_reconnect_ecdsa_bootstrap`:return e.authorizationAuthority;case`passkey_fresh_ecdsa_bootstrap`:case`email_otp_ecdsa_bootstrap`:return e.existingRoleLocalMaterial.authority}}function qe(e){if(!(`sessionActivation`in e.request)||!e.request.sessionActivation)return;let t=e.request.sessionActivation,n=k(t)?t.activation:t,r=k(t)?t.authorization:{record:t.session.wallet_session,operationCredential:t.session.operation_credential};ue({walletId:e.walletId,authority:e.authority,walletSession:r.record,operationCredential:r.operationCredential,expectedAuthorizationId:n.session.authorization_id,expectedWalletSessionId:n.session.wallet_session_id,expectedQuotaId:n.session.quota_id,expectedExpiresAtMs:n.session.expires_at_ms}),e.request.kind===`passkey_preauthorized_ecdsa_bootstrap`&&de({expected:e.request.authorizationIdentity,walletSession:r.record})}function Je(e,t){let n=(e,n,r)=>({kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},...r,...n?{walletSessionRouteAuth:n}:{}}),r=e=>({kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u,preauthorizedSessionActivation:e.sessionActivation});switch(e.kind){case`passkey_fresh_ecdsa_bootstrap`:return n(e,e.routeAuth,{authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u});case`passkey_preauthorized_ecdsa_bootstrap`:return r(e);case`wallet_session_reconnect_ecdsa_bootstrap`:return n(e,e.routeAuth,{authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u});case`email_otp_ecdsa_bootstrap`:{let r={authKind:`email_otp`,emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle};return e.sessionActivation?{kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},...r,preauthorizedSessionActivation:e.sessionActivation}:n(e,e.routeAuth,r)}}throw Error(`[SigningEngine][ecdsa] unsupported ECDSA bootstrap request`)}function Ye(e,t){return{purpose:`explicit_key_export`,relayerUrl:t,existingRoleLocalMaterial:e.existingRoleLocalMaterial,authorization:e.authorization}}function Xe(e,t){return{purpose:`explicit_key_export`,relayerUrl:t,existingRoleLocalMaterial:e.existingRoleLocalMaterial,authorization:e.authorization}}async function Ze(e,t){if(t.kind===`reuse_warm_ecdsa_bootstrap`)throw Error(`[SigningEngine][ecdsa] reuse_warm bootstrap must resolve an existing exact material request before activation`);let n=Ke(t),r=l(z(t)),i=B(t),a=L(t.relayerUrl,e.defaultRelayerUrl),o=e.getSignerWorkerContext(),s={touchIdPrompt:e.touchIdPrompt,workerCtx:o,routerAbNormalSigning:e.routerAbNormalSigning};qe({request:t,walletId:r,authority:n});let c=await He(s,Je(t,a)),u=Ge(t);return await e.persistThresholdEcdsaBootstrapForWalletTarget({walletId:r,chainTarget:i,bootstrap:c,signerAuth:u}),await t.beforeAuthorizationPersistence?.(),await fe(se,{walletId:r,authority:n,bootstrap:c}),c}async function Qe(e,t){return await I(Ye(t,L(t.relayerUrl,e.defaultRelayerUrl)))}async function $e(e,t){return await I(Xe(t,L(t.relayerUrl,e.defaultRelayerUrl)))}async function V(e,t,n){let r=String(t),i=(e.get(r)||Promise.resolve()).catch(()=>void 0),a,o=new Promise(e=>{a=e}),s=i.then(()=>o);e.set(r,s),await i;try{return await n()}finally{a(),e.get(r)===s&&e.delete(r)}}function et(e,t){return t.runtimeScopeBootstrap&&(e.runtimeScopeBootstrap=t.runtimeScopeBootstrap),t.operationIntent&&(e.operationIntent=t.operationIntent),typeof t.ttlMs==`number`&&(e.ttlMs=t.ttlMs),e}function H(e){return et({kind:`email_otp_ecdsa_activation`,purpose:`transaction_signing`,walletKey:e.walletKey,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,source:e.source,relayerUrl:e.relayerUrl,sessionIdentity:e.sessionIdentity,sessionKind:e.sessionKind,sessionBudgetUses:e.sessionBudgetUses,runtimePolicy:e.runtimePolicy,emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle,emailOtpAuthContext:e.emailOtpAuthContext,...`preauthorizedSessionActivation`in e?{preauthorizedSessionActivation:e.preauthorizedSessionActivation}:{walletSessionRouteAuth:e.walletSessionRouteAuth}},e)}function U(e){if(le(e.context)!==e.expected)throw Error(`Email OTP ${e.label} activation requires ${e.expected} retention`)}function tt(e){return U({context:e.emailOtpAuthContext,expected:`session`,label:`session bootstrap`}),H(e)}function nt(e){return U({context:e.emailOtpAuthContext,expected:`session`,label:`recovered session`}),H(e)}function rt(e){return U({context:e.emailOtpAuthContext,expected:`session`,label:`preauthorized session bootstrap`}),H(e)}function it(e){return U({context:e.emailOtpAuthContext,expected:`single_use`,label:`per-operation reauth`}),H(e)}function at(e){return{kind:`email_otp_ecdsa_export_activation`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}function ot(e){return{kind:`passkey_ecdsa_export_activation`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}function st(e){switch(e.kind){case`default_policy`:return;case`scoped_policy`:return e.scope}throw Error(`[SigningEngine][ecdsa] unsupported ECDSA activation policy`)}function W(e,t){t.runtimeScopeBootstrap&&(e.runtimeScopeBootstrap=t.runtimeScopeBootstrap),t.operationIntent&&(e.operationIntent=t.operationIntent);let n=st(t.runtimePolicy);return`walletId`in e&&(typeof t.ttlMs==`number`&&(e.ttlMs=t.ttlMs),n&&(e.runtimePolicyScope=n)),e}function ct(e){switch(e.kind){case`passkey_ecdsa_activation`:return{kind:`passkey_existing_session_activation`,request:e};case`email_otp_ecdsa_activation`:return{kind:`email_otp_existing_session_activation`,request:e}}throw Error(`[SigningEngine][ecdsa] unsupported activation request`)}function lt(e){let t=String(e.webauthnAuthentication.rawId||e.webauthnAuthentication.id||``).trim();if(!t)throw Error(`[SigningEngine][ecdsa] passkey activation requires credential identity`);return t}function ut(e){let t=ct(e);switch(t.kind){case`passkey_existing_session_activation`:return W({kind:`passkey_fresh_ecdsa_bootstrap`,keyHandle:t.request.walletKey.keyHandle,key:x(t.request.walletKey),lanePolicy:t.request.lanePolicy,publicCapability:t.request.publicCapability,existingRoleLocalMaterial:t.request.existingRoleLocalMaterial,source:t.request.source,relayerUrl:t.request.relayerUrl,requestId:t.request.requestId,passkeyCredentialIdB64u:lt(t.request),routeAuth:t.request.walletSessionRouteAuth},t.request);case`email_otp_existing_session_activation`:{let e={kind:`email_otp_ecdsa_bootstrap`,keyHandle:t.request.walletKey.keyHandle,key:x(t.request.walletKey),lanePolicy:t.request.lanePolicy,publicCapability:t.request.publicCapability,existingRoleLocalMaterial:t.request.existingRoleLocalMaterial,source:`email_otp`,relayerUrl:t.request.relayerUrl,emailOtpWorkerSessionHandle:t.request.emailOtpWorkerSessionHandle,emailOtpAuthContext:t.request.emailOtpAuthContext};return t.request.preauthorizedSessionActivation?W({...e,sessionActivation:t.request.preauthorizedSessionActivation},t.request):W({...e,routeAuth:t.request.walletSessionRouteAuth},t.request)}}throw Error(`[SigningEngine][ecdsa] unsupported activation request`)}function dt(e){return{kind:`passkey_ecdsa_export_bootstrap`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}async function ft(e){let t=e.bootstrap.thresholdEcdsaKeyRef.backendBinding;if(!t)throw Error(`[WarmSessionStore] threshold ECDSA bootstrap is missing its backend binding`);let n=pt(t);if(!n)return;let r=await e.deps.persistEcdsaRoleLocalReadyRecord({record:n,storageKeyFacts:S(n)});if(!r.ok)throw Error(`[WarmSessionStore] threshold ECDSA role-local ready record persistence failed (${r.code}): ${r.message}`)}function pt(e){switch(e.materialKind){case`role_local_ready_state_blob`:return e.ecdsaRoleLocalReadyRecord;case`role_local_worker_handle`:case`role_local_durable_public_anchor`:case`role_local_durable_sealed_ref`:case`metadata_only`:return null;default:{let t=e;throw Error(`[WarmSessionStore] unsupported threshold ECDSA backend binding: ${JSON.stringify(t)}`)}}}async function G(e,t){let n=l(z(t));return await V(e.queueByWallet,n,async()=>{let n=await Ze(e.activationDeps,t);return await ft({deps:e,bootstrap:n}),n})}async function mt(e,t){return await G(e,ut(t))}async function ht(e,t){return await Qe(e.activationDeps,dt(t))}async function gt(e,t){let n={kind:`email_otp_ecdsa_export_bootstrap`,purpose:`explicit_key_export`,existingRoleLocalMaterial:t.existingRoleLocalMaterial,relayerUrl:t.relayerUrl,authorization:t.authorization};return await $e(e.activationDeps,n)}const K=`ecdsa-derivation:role-local:product-export-confirmation:v5`,q=`ecdsa-derivation:role-local:product-export-authorization:v5`;function J(e){return{kind:`operation_step_up`}}function Y(e){return{authorizationKind:e.kind,authorizationId:e.evidenceSetDigest}}function X(){let e=globalThis.crypto;if(!e||typeof e.getRandomValues!=`function`)throw Error(`crypto.getRandomValues is required for threshold ECDSA export`);return r(e.getRandomValues(new Uint8Array(32)))}async function Z(e){let t=String(e.relayerUrl||``).trim().replace(/\/+$/g,``);if(!t)throw Error(`[SigningEngine][ecdsa-export] relayer URL is required`);if(e.authorization.kind===`wallet_session_bearer`&&!e.authorization.token.trim())throw Error(`[SigningEngine][ecdsa-export] Wallet Session operation credential is required`);let n={"Content-Type":`application/json`};e.authorization.kind===`wallet_session_bearer`&&(n.Authorization=`Bearer ${e.authorization.token}`);try{let r=await fetch(`${t}${_}`,{method:`POST`,credentials:e.authorization.kind===`legacy_cookie`?`include`:`omit`,headers:n,body:JSON.stringify({request:e.request,requestDigestB64u:e.requestDigestB64u})}),i=await r.json().catch(()=>null);if(!r.ok){let e=i&&typeof i==`object`&&!Array.isArray(i)?i:null;return{ok:!1,code:String(e?.code||`http_error`),message:String(e?.message||`HTTP ${r.status}`)}}return{ok:!0,value:h(i)}}catch(e){return{ok:!1,error:e instanceof Error?e.message:String(e)}}}async function _t(e){return await Z({...e,authorization:{kind:`legacy_cookie`}})}async function vt(e){return await Z({relayerUrl:e.relayerUrl,request:e.request,requestDigestB64u:e.requestDigestB64u,authorization:{kind:`wallet_session_bearer`,token:e.operationCredential.token}})}function Q(e){let t=Math.min(e.issuedAtUnixMs+6e4,e.authorizationExpiresAtMsCeiling??1/0);if(Number.isFinite(t)&&t>e.issuedAtUnixMs)return t;throw new be({failure:ye(ve.expired),message:`Wallet Session expired before ECDSA export authorization`})}function yt(e){if(String(e.material.persistedMaterial.publicFacts.walletId)!==String(e.walletSessionUserId))throw Error(`[SigningEngine][ecdsa-export] explicit export wallet mismatch`)}async function $(e){return r(await n(t(e)))}function bt(e){switch(e.kind){case`rehydrated`:return e;case`device_link_required`:throw Error(`[SigningEngine][ecdsa-export] device_link_required: local threshold ECDSA material is unavailable`);case`corrupt`:throw Error(`[SigningEngine][ecdsa-export] local threshold ECDSA material is corrupt (${e.reason}): ${e.message}`);default:{let t=e;throw Error(`Unsupported ECDSA export material resolution: ${String(t)}`)}}}async function xt(e){return bt(await D({purpose:`explicit_key_export`,source:E(e.persistedMaterial),workerCtx:e.workerCtx}))}function St(e){let t=Y(e.material.operationAuthorization),n=e.material.persistedMaterial.publicFacts;return{version:q,operation:`explicit_key_export`,keyHandle:n.keyHandle,walletId:String(n.walletId),ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,relayerKeyId:n.publicCapability.signer_set.selected_server.server_id,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,contextBinding32B64u:e.contextBinding32B64u,publicIdentity:e.publicIdentity,exportRequestNonce32B64u:e.exportRequestNonce32B64u,confirmationDigest32B64u:e.confirmationDigest32B64u,issuedAtUnixMs:e.issuedAtUnixMs,expiresAtUnixMs:e.expiresAtUnixMs,authorizationKind:t.authorizationKind,authorizationId:t.authorizationId,materialActivation:b(e.material.persistedMaterial.materialActivation),participantIds:n.participantIds}}async function Ct(e,t){let n=t.persistedMaterial.publicFacts,r=b(t.persistedMaterial.materialActivation);switch(t.factorAuthorization.kind){case`passkey`:{let e=String(t.factorAuthorization.credential.rawId||t.factorAuthorization.credential.id||``).trim();if(!e)throw Error(`[SigningEngine][ecdsa-export] passkey authorization credential is missing`);if(e!==t.factorAuthorization.passkeyCredentialIdB64u)throw Error(`[SigningEngine][ecdsa-export] passkey export authorization credential mismatch`);break}case`email_otp_verified`:break;default:{let e=t.factorAuthorization;throw Error(`Unsupported ECDSA export authorization: ${String(e)}`)}}let i=Date.now(),a=Q({issuedAtUnixMs:i,authorizationExpiresAtMsCeiling:t.operationAuthorization.expiresAtMs}),o={derivationClientSharePublicKey33B64u:n.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:n.relayerPublicKey33B64u,groupPublicKey33B64u:n.groupPublicKey33B64u,ethereumAddress:n.ethereumAddress},s=X(),c=Y(t.operationAuthorization),l=await $({version:K,walletId:String(n.walletId),ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,relayerKeyId:n.publicCapability.signer_set.selected_server.server_id,contextBinding32B64u:n.contextBinding32B64u,publicIdentity:o,authorizationKind:c.authorizationKind,authorizationId:c.authorizationId,materialActivation:r,exportRequestNonce32B64u:s,issuedAtUnixMs:i,expiresAtUnixMs:a}),u=await $(St({ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,contextBinding32B64u:n.contextBinding32B64u,publicIdentity:o,exportRequestNonce32B64u:s,confirmationDigest32B64u:l,issuedAtUnixMs:i,expiresAtUnixMs:a,material:t})),d=n.publicCapability,f=`ecdsa-export:${s}`,p=await pe({workerCtx:e.getSignerWorkerContext(),command:{kind:`create_router_ab_ecdsa_explicit_export_ceremony_v1`,ceremonyId:f,request:{context:d.context,lifecycle:{lifecycle_id:f,work_kind:`key_export`,primitive_request_kind:`export`,root_share_epoch:d.activation_epoch,account_id:String(n.walletId),session_id:T.thresholdEcdsaSession(f),signer_set_id:d.signer_set.signer_set_id,selected_server_id:d.signer_set.selected_server.server_id},public_identity:d.public_identity,signer_set:d.signer_set,router_id:d.router_id,client_id:d.client_id,authorization:J(t.operationAuthorization),authorization_id:t.operationAuthorization.evidenceSetDigest,operation:t.operationAuthorization.operation,material_activation:r,export_authorization_digest_b64u:u,export_nonce:s,expires_at_ms:a,deriver_recipient_keys:d.deriver_recipient_keys}}});if(p.kind!==`router_ab_ecdsa_explicit_export_ceremony_created_v1`)throw Error(`[SigningEngine][ecdsa-export] strict export ceremony kind mismatch`);try{let i=await _t({relayerUrl:t.relayerUrl,request:p.request,requestDigestB64u:p.requestDigestB64u});if(!i.ok)throw Error(i.error||i.message||i.code||`Strict ECDSA explicit export request failed`);let a=await me({workerCtx:e.getSignerWorkerContext(),command:{kind:`finalize_router_ab_ecdsa_explicit_export_v1`,ceremonyId:f,clientProofFinalization:{kind:`finalize_encrypted_client_proof_bundles_v2`,bundles:i.value.response.bundles},signingWorkerExport:i.value.signing_worker_export,authorizationKind:c.authorizationKind,authorizationId:c.authorizationId,materialActivation:r,roleLocalMaterial:t.liveMaterial.liveHandle,roleLocalMaterialRef:t.liveMaterial.materialRef,publicFacts:n}});return{publicKeyHex:a.publicKeyHex,privateKeyHex:a.privateKeyHex,ethereumAddress:a.ethereumAddress}}catch(t){throw await ge({workerCtx:e.getSignerWorkerContext(),command:{kind:`close_router_ab_ecdsa_post_registration_ceremony_v1`,ceremonyId:f}}).catch(()=>void 0),t}}async function wt(e,t){let n=t.exportProvision.material;yt({material:n,walletSessionUserId:t.walletSessionUserId});let r=String(n.relayerUrl||``).trim();if(!r)throw Error(`[SigningEngine][ecdsa-export] relayer URL is required`);let i=n.persistedMaterial;return await Ct(e,{persistedMaterial:i,liveMaterial:await xt({persistedMaterial:i,workerCtx:e.getSignerWorkerContext()}),relayerUrl:r,operationAuthorization:t.exportProvision.authorization,factorAuthorization:t.factorAuthorization})}function Tt(t){let n=t.runtime.normalSigning.scope,r=t.operationAuthorization.operation,i=y(r.material_activation);if(r.operation_kind!==`evm.export_key`||r.wallet_id!==String(t.runtime.walletId)||r.key_handle!==t.runtime.publicFacts.keyHandle||r.relayer_key_id!==t.runtime.relayerKeyId||r.participant_ids[0]!==t.runtime.publicFacts.participantIds[0]||r.participant_ids[1]!==t.runtime.publicFacts.participantIds[1]||r.signing_worker_id!==n.signing_worker.server_id||r.normal_signing_scope.wallet_id!==n.wallet_id||r.normal_signing_scope.context.application_binding_digest_b64u!==n.context.application_binding_digest_b64u||r.normal_signing_scope.public_identity.context_binding_b64u!==n.public_identity.context_binding_b64u||r.normal_signing_scope.public_identity.threshold_public_key33_b64u!==n.public_identity.threshold_public_key33_b64u||r.normal_signing_scope.signing_worker.server_id!==n.signing_worker.server_id||!e(i,t.runtime.materialActivation)||!e(y(r.normal_signing_scope.material_activation),t.runtime.materialActivation))throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority operation identity changed`)}async function Et(e,t){Tt(t);let n=t.runtime,r=n.normalSigning.scope;if(t.operationAuthorization.exportTopology.signer_set.selected_server.server_id!==r.signing_worker.server_id)throw Error(`[SigningEngine][ecdsa-export] active export topology changed`);let i=r.material_activation,a=Date.now(),o=Q({issuedAtUnixMs:a,authorizationExpiresAtMsCeiling:t.operationAuthorization.expiresAtMs}),s={derivationClientSharePublicKey33B64u:r.public_identity.derivation_client_share_public_key33_b64u,relayerPublicKey33B64u:r.public_identity.server_public_key33_b64u,groupPublicKey33B64u:r.public_identity.threshold_public_key33_b64u,ethereumAddress:n.publicFacts.thresholdOwnerAddress},l=X(),u=Y(t.operationAuthorization),d=await $({version:K,walletId:String(n.walletId),ecdsaThresholdKeyId:r.ecdsa_threshold_key_id,relayerKeyId:n.relayerKeyId,contextBinding32B64u:r.public_identity.context_binding_b64u,publicIdentity:s,authorizationKind:u.authorizationKind,authorizationId:u.authorizationId,materialActivation:i,exportRequestNonce32B64u:l,issuedAtUnixMs:a,expiresAtUnixMs:o}),f=await $({version:q,operation:`explicit_key_export`,keyHandle:n.publicFacts.keyHandle,walletId:String(n.walletId),ecdsaThresholdKeyId:r.ecdsa_threshold_key_id,relayerKeyId:n.relayerKeyId,signingRootId:r.signing_root_id,signingRootVersion:r.signing_root_version,contextBinding32B64u:r.public_identity.context_binding_b64u,publicIdentity:s,exportRequestNonce32B64u:l,confirmationDigest32B64u:d,issuedAtUnixMs:a,expiresAtUnixMs:o,authorizationKind:u.authorizationKind,authorizationId:u.authorizationId,materialActivation:i,participantIds:n.publicFacts.participantIds}),p=`ecdsa-export:${l}`,m={context:r.context,lifecycle:{lifecycle_id:p,work_kind:`key_export`,primitive_request_kind:`export`,root_share_epoch:r.activation_epoch,account_id:r.wallet_id,session_id:T.thresholdEcdsaSession(p),signer_set_id:t.operationAuthorization.exportTopology.signer_set.signer_set_id,selected_server_id:t.operationAuthorization.exportTopology.signer_set.selected_server.server_id},public_identity:r.public_identity,signer_set:t.operationAuthorization.exportTopology.signer_set,router_id:t.operationAuthorization.exportTopology.router_id,client_id:String(n.walletId),authorization:J(t.operationAuthorization),operation:t.operationAuthorization.operation,authorization_id:c(t.operationAuthorization.evidenceSetDigest),material_activation:i,export_authorization_digest_b64u:f,export_nonce:l,expires_at_ms:o,deriver_recipient_keys:t.operationAuthorization.exportTopology.deriver_recipient_keys},h=await he({holderHandleId:n.holderRuntime.holderHandleId,request:m,workerCtx:e.getSignerWorkerContext()});if(h.kind!==`ecdsa_holder_ordinary_export_request_created_v1`)throw Error(`[SigningEngine][ecdsa-export] active holder export request kind mismatch`);let g=await vt({relayerUrl:t.relayerUrl,request:h.request,requestDigestB64u:h.requestDigestB64u,operationCredential:n.operationCredential});if(!g.ok)throw Error(g.error||g.message||g.code||`Active Wallet Authority ECDSA export request failed`);let _={wallet_id:r.wallet_id,key_handle:n.publicFacts.keyHandle,ecdsa_threshold_key_id:r.ecdsa_threshold_key_id,signing_root_id:r.signing_root_id,signing_root_version:r.signing_root_version,activation_epoch:r.activation_epoch,signing_worker_id:r.signing_worker.server_id,context_binding_b64u:r.public_identity.context_binding_b64u,threshold_public_key33_b64u:r.public_identity.threshold_public_key33_b64u,export_request_digest_b64u:h.requestDigestB64u,export_authorization_digest_b64u:f,export_nonce:l,authorization_kind:`verified_step_up`,authorization_id:t.operationAuthorization.evidenceSetDigest,material_activation:i,lifecycle_id:p,recipient_identity:h.request.client_id,recipient_public_key:h.request.client_ephemeral_public_key,expires_at_ms:h.request.expires_at_ms},v=await _e({holderHandleId:n.holderRuntime.holderHandleId,requestDigestB64u:h.requestDigestB64u,expectedBinding:_,forwardedResponse:g.value,workerCtx:e.getSignerWorkerContext()});return{publicKeyHex:v.publicKeyHex,privateKeyHex:v.privateKeyHex,ethereumAddress:v.ethereumAddress}}export{k as _,it as a,tt as c,mt as d,G as f,A as g,z as h,at as i,gt as l,B as m,wt as n,rt as o,V as p,ot as r,nt as s,Et as t,ht as u,xe as v,Se as y};
+import{r as e}from"./domainIds-C3fUa33Q.js";import{c as t,u as n}from"./chains-CPmd4s9f.js";import{i as r,r as i}from"./base64-BmKR3UqU.js";import{r as a}from"./secureRandomId-8LSc91aN.js";import{s as o}from"./walletDbName-BxWApBQF.js";import{g as s}from"./capabilityKinds-D0Yrp9uf.js";import{r as c}from"./canonicalPrimitives-BMP5yILS.js";import{c as l,o as u}from"./ecdsaChainTarget-DkOrgv4y.js";import{i as d,n as f}from"./signerDomain-BFqRQ0Jl.js";import{$ as p,C as m,J as h,Kt as g,N as _,Z as v,en as y,h as ee,tn as b,v as x}from"./emailOtpEcdsaDerivationIdentity-CupWCKNg.js";import{B as te,C as ne,E as S,I as re,R as ie,S as C,x as ae,y as w,z as oe}from"./ecdsaCapabilityManifest-DRc423SV.js";import{r as T}from"./types-CQTWmtqu.js";import{o as se}from"./walletSessionAuthorizationStore-DnUMtkev.js";import{t as ce}from"./thresholdEcdsa-Ci7yz395.js";import{p as le}from"./nearEd25519YaoSigningPreparation-yKDLQXBS.js";import{a as ue,i as de,r as fe}from"./walletSessionAuthorizationProjection-DuU6w0FP.js";import{a as pe,d as me,i as he,n as ge,u as _e}from"./ecdsaDerivationClientWasm-DmwKWUEb.js";import{a as ve,r as ye,t as be}from"./walletSessionFailure-C6TAQTZn.js";import{a as E,o as D}from"./signingQueue-gW7wmOuL.js";import{t as O}from"./bytes-DZRW2UDg.js";const xe=`router-ab-ed25519-yao-seed-export-v1`;function Se(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=e,n=typeof t.id==`string`&&t.id.trim()?t.id.trim():void 0;return t.success===!0&&`data`in t&&t.error===void 0?{id:n,success:!0,data:t.data}:t.success===!1&&typeof t.error==`string`&&t.data===void 0?{id:n,success:!1,error:t.error}:null}function k(e){return e.kind===`credential_free_ecdsa_session_activation_authorization_v1`}function Ce(e,t){return e.error||e.message||e.code||t}function A(e){return p({kind:`router_ab_ecdsa_post_registration_session_activation_v1`,public_capability:e.publicCapability,session_policy:{threshold_session_id:e.thresholdSessionId,wallet_session_mint_id:e.walletSessionMintId,ttl_ms:e.ttlMs,remaining_uses:e.remainingUses,runtime_policy_scope:e.runtimePolicyScope}})}function we(e,t){let n=t.public_identity;return e.applicationBindingDigestB64u===t.context.application_binding_digest_b64u&&e.contextBinding32B64u===n.context_binding_b64u&&e.derivationClientSharePublicKey33B64u===n.derivation_client_share_public_key33_b64u&&e.relayerPublicKey33B64u===n.server_public_key33_b64u&&e.groupPublicKey33B64u===n.threshold_public_key33_b64u&&e.ethereumAddress.toLowerCase()===O(i(n.ethereum_address20_b64u))&&w(e.publicCapability,t)}function Te(e,t){let n=e.normal_signing.scope;return n.wallet_id===String(t.walletId)&&n.ecdsa_threshold_key_id===String(t.ecdsaThresholdKeyId)&&n.signing_root_id===String(t.signingRootId)&&n.signing_root_version===String(t.signingRootVersion)}function Ee(e){let t=e.persistedRoleLocalMaterial.publicFacts;if(!w(e.sessionActivation.public_capability,e.publicCapability)||e.sessionActivation.session.threshold_session_id!==e.thresholdSessionId||!Te(e.sessionActivation,t))throw Error(`Strict ECDSA session activation returned a different registered key identity`)}function De(t){let n=t.sessionActivation.activation,r=t.sessionActivation.authorization,i=r.record,a=y(n.public_capability.material_activation),o=0;for(let t of i.capabilitySubjects)t.kind===`sign`&&t.keyFamily===`ecdsa_secp256k1`&&e(t.materialActivation,a)&&(o+=1);if(Ee({publicCapability:t.publicCapability,persistedRoleLocalMaterial:t.persistedRoleLocalMaterial,thresholdSessionId:t.thresholdSessionId,sessionActivation:n}),String(i.walletId)!==t.walletId||String(i.walletId)!==String(n.public_capability.client_id)||i.authMethodId!==t.persistedRoleLocalMaterial.authority.walletAuthMethodId||i.authorizationId!==n.session.authorization_id||i.quotaId!==n.session.quota_id||i.expiresAtMs!==n.session.expires_at_ms||n.session.remaining_uses!==t.remainingUses||r.operationCredential.walletSessionId!==n.session.wallet_session_id||!e(a,t.persistedRoleLocalMaterial.materialActivation)||o!==1)throw Error(`Strict ECDSA credential-free activation authority does not match its session`)}function j(e){let t=e.persistedRoleLocalMaterial.publicFacts;if(!e.walletId||!e.thresholdSessionId)throw Error(`Strict ECDSA session activation requires exact wallet and session identity`);if(!Number.isSafeInteger(e.ttlMs)||e.ttlMs<1)throw Error(`Strict ECDSA session activation requires a positive ttlMs`);if(!Number.isSafeInteger(e.remainingUses)||e.remainingUses<1)throw Error(`Strict ECDSA session activation requires positive remainingUses`);if(String(t.walletId)!==e.walletId||!we(t,e.publicCapability))throw Error(`Strict ECDSA session activation requires exact registered role-local material`)}function Oe(e){switch(e.kind){case`rehydrated`:return e;case`device_link_required`:throw Error(`device_link_required: registered ECDSA role-local material is unavailable on this device`);case`corrupt`:throw Error(`Registered ECDSA role-local material is corrupt (${e.reason}): ${e.message}`);default:{let t=e;throw Error(`Unsupported ECDSA role-local material resolution: ${String(t)}`)}}}async function M(e){let t=Oe(await D({purpose:`registration_activation`,source:E(e.persistedRoleLocalMaterial),workerCtx:e.workerCtx}));return{kind:`existing_ecdsa_role_local_material_activated_v1`,roleLocalMaterial:t.liveHandle,roleLocalMaterialRef:t.materialRef,publicFacts:e.persistedRoleLocalMaterial.publicFacts,publicCapability:e.publicCapability}}async function ke(e){j(e);let t=await ce(e.relayerUrl,{auth:e.routeAuth,request:A(e)});if(!t.ok)throw Error(Ce(t,`Strict ECDSA session activation failed`));return await N({workerCtx:e.workerCtx,publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.persistedRoleLocalMaterial,walletId:e.walletId,thresholdSessionId:e.thresholdSessionId,ttlMs:e.ttlMs,remainingUses:e.remainingUses,runtimePolicyScope:e.runtimePolicyScope,sessionActivation:t.value})}async function N(e){return j(e),Ee({publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.persistedRoleLocalMaterial,thresholdSessionId:e.thresholdSessionId,sessionActivation:e.sessionActivation}),{sessionActivation:e.sessionActivation,roleLocalActivation:await M(e)}}async function Ae(e){return j(e),De(e),{sessionActivation:e.sessionActivation.activation,authorization:e.sessionActivation.authorization,roleLocalActivation:await M(e)}}async function je(e,t){let n=o(e.lanePolicy.runtimePolicyScope);if(!n)throw Error(`Strict ECDSA session activation requires runtimePolicyScope`);let r={workerCtx:e.workerCtx,publicCapability:e.publicCapability,persistedRoleLocalMaterial:e.existingRoleLocalMaterial,walletId:String(e.key.walletId),thresholdSessionId:e.lanePolicy.thresholdSessionId,ttlMs:e.lanePolicy.ttlMs,remainingUses:e.lanePolicy.remainingUses,runtimePolicyScope:n},s=e.sessionActivation?k(e.sessionActivation)?await Ae({...r,sessionActivation:e.sessionActivation}):await N({...r,sessionActivation:e.sessionActivation}):await ke({...r,walletSessionMintId:Me(),relayerUrl:e.relayerUrl,routeAuth:e.bootstrapAuth}),c=s.sessionActivation.public_capability.public_identity,l=`authorization`in s?{thresholdSessionId:s.sessionActivation.session.threshold_session_id,authorizationSessionId:s.sessionActivation.session.authorization_session_id,authorizationId:s.sessionActivation.session.authorization_id,walletSessionId:s.sessionActivation.session.wallet_session_id,quotaId:s.sessionActivation.session.quota_id,expiresAtMs:s.sessionActivation.session.expires_at_ms,remainingUses:s.sessionActivation.session.remaining_uses,walletSession:s.authorization.record,operationCredential:s.authorization.operationCredential}:{thresholdSessionId:s.sessionActivation.session.threshold_session_id,authorizationSessionId:s.sessionActivation.session.authorization_session_id,authorizationId:s.sessionActivation.session.authorization_id,walletSessionId:s.sessionActivation.session.wallet_session_id,quotaId:s.sessionActivation.session.quota_id,expiresAtMs:s.sessionActivation.session.expires_at_ms,remainingUses:s.sessionActivation.session.remaining_uses,walletSession:s.sessionActivation.session.wallet_session,operationCredential:s.sessionActivation.session.operation_credential},u=await g({walletId:String(e.key.walletId),signingRootId:e.key.signingRootId,signingRootVersion:e.key.signingRootVersion});return{ok:!0,bootstrapKind:`strict_post_registration`,keygenSessionId:String(e.requestId||``).trim()||a(`tecdsa-keygen`,32,`threshold ECDSA session IDs`),rpId:t,keyHandle:String(e.keyHandle),clientVerifyingShareB64u:c.derivation_client_share_public_key33_b64u,thresholdEcdsaPublicKeyB64u:c.threshold_public_key33_b64u,ethereumAddress:O(i(c.ethereum_address20_b64u)),relayerKeyId:u,relayerVerifyingShareB64u:c.server_public_key33_b64u,participantIds:e.key.participantIds.map(Number),thresholdSessionId:l.thresholdSessionId,authorizationSessionId:l.authorizationSessionId,authorizationId:l.authorizationId,walletSessionId:l.walletSessionId,quotaId:l.quotaId,expiresAtMs:l.expiresAtMs,remainingUses:l.remainingUses,runtimePolicyScope:n,signingRootId:String(e.key.signingRootId),signingRootVersion:String(e.key.signingRootVersion),walletSession:l.walletSession,operationCredential:l.operationCredential,roleLocalActivation:s.roleLocalActivation,routerAbEcdsaDerivationNormalSigning:s.sessionActivation.normal_signing,secretSourceKind:`persisted_role_local`}}function Me(){let e=s(a(`wallet-session-mint`,32,`Wallet Session mint IDs`));if(!e.ok)throw Error(`Failed to create Wallet Session mint identity`);return e.value}async function Ne(e){let t=e.touchIdPrompt.getRpId();if(!t)return{ok:!1,code:`invalid_args`,message:`Missing rpId for WebAuthn`};try{return await je(e,t)}catch(e){return{ok:!1,code:`strict_post_registration_failed`,message:e instanceof Error?e.message:String(e)}}}const P=`stale_ecdsa_key_identity`;function Pe(e){if(!e)throw Error(`Strict ECDSA session bootstrap requires Wallet Session authority`);switch(e.kind){case`opaque_wallet_session_operation_credential_v1`:return e;case`publishable_key`:throw Error(`Strict ECDSA session bootstrap requires Wallet Session authority`)}throw Error(`Strict ECDSA session bootstrap authority is invalid`)}function Fe(e){let t=String(e.code||``).trim(),n=String(e.message||``).trim().toLowerCase();return t===`stale_session_state`&&n.includes(`threshold-ecdsa bootstrap`)&&n.includes(`client verifying share`)&&n.includes(`integrated key record`)}function Ie(e){let t=String(e.message||e.code||`threshold-ecdsa bootstrap failed`).trim(),n=Fe(e)?P:String(e.code||`threshold_ecdsa_bootstrap_failed`).trim()||`threshold_ecdsa_bootstrap_failed`,r=Error(t||`threshold-ecdsa bootstrap failed`);return r.code=n,r}function Le(e){let t=Error(e);return t.code=P,t}function Re(e){switch(e.authKind){case`email_otp`:return`email_otp`;case`passkey`:return`passkey`}return`unknown`}function ze(e){switch(e.bootstrap.secretSourceKind){case`persisted_role_local`:return e.request.authKind===`email_otp`?ae({authSubjectId:e.request.emailOtpWorkerSessionHandle.authSubjectId}):C({credentialIdB64u:e.request.passkeyCredentialIdB64u,rpId:e.bootstrap.rpId})}}function F(e,t){let n=String(e||``).trim().toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(n))throw Error(`threshold-ecdsa exact activation returned invalid ${t}`);return n}function Be(e){let t=F(e.bootstrapOwnerAddress,`server owner address`);if(t!==F(e.key.thresholdOwnerAddress,`key owner address`))throw Le(`threshold-ecdsa exact activation owner address mismatches server bootstrap result`);return t}async function Ve(e,t){let n=l(String(t.key.walletId)),r=t.lanePolicy.chainTarget,i=String(t.lanePolicy.thresholdSessionId).trim();if(e.routerAbNormalSigning.mode!==`enabled`)throw Error(`Router A/B ECDSA derivation normal signing must be enabled for activation`);let a={walletId:n,chainTarget:r,targetKey:u(r),operationId:i||null,authMethod:Re(t),evmFamilyKeyFingerprint:ee(t.key),keyHandle:t.keyHandle,chainTargetKey:u(r),ecdsaThresholdKeyId:String(t.key.ecdsaThresholdKeyId),thresholdSessionId:i||null,freshAuthRetrySideEffectState:`not_applicable`,hasRequestedEcdsaThresholdKeyId:!0,requestedSessionId:i||null,authKind:t.walletSessionRouteAuth?.kind||`none`,passkeyCredentialBound:t.authKind===`passkey`},o;try{o=await Ne({touchIdPrompt:e.touchIdPrompt,relayerUrl:t.relayerUrl,requestId:t.requestId,workerCtx:e.workerCtx,...`preauthorizedSessionActivation`in t&&t.preauthorizedSessionActivation?{sessionActivation:t.preauthorizedSessionActivation}:{bootstrapAuth:Pe(t.walletSessionRouteAuth)},keyHandle:t.keyHandle,key:t.key,lanePolicy:t.lanePolicy,publicCapability:t.publicCapability,existingRoleLocalMaterial:t.existingRoleLocalMaterial})}catch(e){try{console.warn(`[threshold-ecdsa][bootstrap][exception]`,{...a,message:e instanceof Error?e.message:String(e)})}catch{}throw e}if(!o.ok){try{console.warn(`[threshold-ecdsa][bootstrap][failure]`,{...a,code:o.code||``,message:o.message||``})}catch{}throw Ie({code:o.code,message:o.message})}let s=String(t.key.ecdsaThresholdKeyId).trim();if(!s)throw Error(`threshold-ecdsa bootstrap returned empty ecdsaThresholdKeyId`);let c=re(s),d=oe(String(o.keyHandle||``).trim()),f=String(o.relayerKeyId||``).trim();if(!f)throw Error(`threshold-ecdsa bootstrap returned empty relayerKeyId`);let p=te(f),m=String(o.clientVerifyingShareB64u||``).trim();if(!m)throw Error(`threshold-ecdsa bootstrap returned empty clientVerifyingShareB64u`);let h=ie(m),g=String(o.thresholdSessionId||``).trim();if(!g)throw Error(`threshold-ecdsa bootstrap returned empty thresholdSessionId`);let _=Number(o.expiresAtMs);if(!Number.isFinite(_))throw Error(`threshold-ecdsa bootstrap returned invalid expiresAtMs`);let v=Number(o.remainingUses);if(!Number.isFinite(v))throw Error(`threshold-ecdsa bootstrap returned invalid remainingUses`);let y=t.key.participantIds.map(e=>Number(e));if(!y)throw Error(`threshold-ecdsa bootstrap returned empty participantIds`);let b=Be({key:t.key,bootstrapOwnerAddress:o.ethereumAddress}),x=ne({walletId:n,chainTarget:r,keyHandle:d,ecdsaThresholdKeyId:c,signingRootId:o.signingRootId,signingRootVersion:o.signingRootVersion,applicationBindingDigestB64u:o.roleLocalActivation.publicCapability.context.application_binding_digest_b64u,clientParticipantId:1,relayerParticipantId:2,participantIds:y,contextBinding32B64u:o.roleLocalActivation.publicFacts.contextBinding32B64u,derivationClientSharePublicKey33B64u:o.roleLocalActivation.publicFacts.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:o.roleLocalActivation.publicFacts.relayerPublicKey33B64u,groupPublicKey33B64u:o.roleLocalActivation.publicFacts.groupPublicKey33B64u,ethereumAddress:o.roleLocalActivation.publicFacts.ethereumAddress,publicCapability:o.roleLocalActivation.publicCapability}),S=o.routerAbEcdsaDerivationNormalSigning,C=o.roleLocalActivation.roleLocalMaterial,ae=ze({request:t,bootstrap:o}),w={ok:!0,thresholdSessionId:g,authorizationSessionId:o.authorizationSessionId,authorizationId:o.authorizationId,walletSessionId:o.walletSessionId,quotaId:o.quotaId,expiresAtMs:_,remainingUses:v,runtimePolicyScope:o.runtimePolicyScope,walletSession:o.walletSession,operationCredential:o.operationCredential,clientVerifyingShareB64u:h};return{thresholdEcdsaKeyRef:{type:`threshold-ecdsa-secp256k1`,userId:n,chainTarget:r,relayerUrl:t.relayerUrl,keyHandle:d,ecdsaThresholdKeyId:c,backendBinding:{materialKind:`role_local_worker_handle`,relayerKeyId:p,clientVerifyingShareB64u:h,roleLocalMaterialHandle:C,roleLocalMaterialRef:o.roleLocalActivation.roleLocalMaterialRef,publicFacts:x,authMethod:ae},participantIds:y,thresholdEcdsaPublicKeyB64u:o.thresholdEcdsaPublicKeyB64u,ethereumAddress:b,relayerVerifyingShareB64u:o.relayerVerifyingShareB64u,routerAbEcdsaDerivationNormalSigning:S},session:w}}async function He(e,t){return await Ve(e,t)}function Ue(e){let t;try{t=c(e.evidenceSetDigest)}catch(e){throw Error(e instanceof Error?e.message:`ECDSA explicit export evidence digest is invalid`)}let n=Math.floor(Number(e.expiresAtMs)),r=v(e.operation);if(r.operation_kind!==`evm.export_key`)throw Error(`ECDSA explicit export operation kind is invalid`);if(!Number.isSafeInteger(n)||n<=Date.now())throw Error(`ECDSA explicit export operation authorization expiry is invalid`);let i=We(e.unseal);return{kind:`verified_step_up`,evidenceSetDigest:t,operation:r,expiresAtMs:n,quotaUse:`none`,unseal:i}}function We(e){switch(e.kind){case`not_requested`:return{kind:`not_requested`};case`email_otp_grant`:{let t=String(e.grant||``).trim(),n=String(e.challenge_id||``).trim();if(!t||!n)throw Error(`ECDSA explicit export Email OTP unseal grant is invalid`);return{kind:`email_otp_grant`,grant:t,challenge_id:n}}default:{let t=e;throw Error(`Unsupported ECDSA explicit export unseal state: ${String(t)}`)}}}async function I(e){let t=String(e.relayerUrl||``).trim();if(!t)throw Error(`ECDSA explicit export relayer URL is required`);return{kind:`explicit_key_export_ecdsa_activation_result`,purpose:`explicit_key_export`,material:{kind:`auth_neutral_ecdsa_export_material_v1`,relayerUrl:t,persistedMaterial:e.existingRoleLocalMaterial},authorization:Ue(e.authorization)}}function L(e,t){let n=String(e||t||``).trim();if(!n)throw Error(`Missing relayer url (configs.network.relayer.url)`);return n}function R(e){return`key`in e&&!!e.key&&`keyHandle`in e&&!!String(e.keyHandle||``).trim()}function z(e){return R(e)?e.key.walletId:e.walletId}function B(e){return R(e)?e.lanePolicy.chainTarget:e.chainTarget}function Ge(e){return e.kind===`email_otp_ecdsa_bootstrap`?{authMethod:f.emailOtp,signerSource:d.emailOtpRegistration}:{authMethod:f.passkey,signerSource:d.passkeyRegistration}}function Ke(e){switch(e.kind){case`passkey_preauthorized_ecdsa_bootstrap`:case`wallet_session_reconnect_ecdsa_bootstrap`:return e.authorizationAuthority;case`passkey_fresh_ecdsa_bootstrap`:case`email_otp_ecdsa_bootstrap`:return e.existingRoleLocalMaterial.authority}}function qe(e){if(!(`sessionActivation`in e.request)||!e.request.sessionActivation)return;let t=e.request.sessionActivation,n=k(t)?t.activation:t,r=k(t)?t.authorization:{record:t.session.wallet_session,operationCredential:t.session.operation_credential};ue({walletId:e.walletId,authority:e.authority,walletSession:r.record,operationCredential:r.operationCredential,expectedAuthorizationId:n.session.authorization_id,expectedWalletSessionId:n.session.wallet_session_id,expectedQuotaId:n.session.quota_id,expectedExpiresAtMs:n.session.expires_at_ms}),e.request.kind===`passkey_preauthorized_ecdsa_bootstrap`&&de({expected:e.request.authorizationIdentity,walletSession:r.record})}function Je(e,t){let n=(e,n,r)=>({kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},...r,...n?{walletSessionRouteAuth:n}:{}}),r=e=>({kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u,preauthorizedSessionActivation:e.sessionActivation});switch(e.kind){case`passkey_fresh_ecdsa_bootstrap`:return n(e,e.routeAuth,{authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u});case`passkey_preauthorized_ecdsa_bootstrap`:return r(e);case`wallet_session_reconnect_ecdsa_bootstrap`:return n(e,e.routeAuth,{authKind:`passkey`,passkeyCredentialIdB64u:e.passkeyCredentialIdB64u});case`email_otp_ecdsa_bootstrap`:{let r={authKind:`email_otp`,emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle};return e.sessionActivation?{kind:`session_bootstrap`,purpose:`transaction_signing`,relayerUrl:t,keyHandle:m(e.keyHandle),key:e.key,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,...e.requestId?{requestId:e.requestId}:{},...r,preauthorizedSessionActivation:e.sessionActivation}:n(e,e.routeAuth,r)}}throw Error(`[SigningEngine][ecdsa] unsupported ECDSA bootstrap request`)}function Ye(e,t){return{purpose:`explicit_key_export`,relayerUrl:t,existingRoleLocalMaterial:e.existingRoleLocalMaterial,authorization:e.authorization}}function Xe(e,t){return{purpose:`explicit_key_export`,relayerUrl:t,existingRoleLocalMaterial:e.existingRoleLocalMaterial,authorization:e.authorization}}async function Ze(e,t){if(t.kind===`reuse_warm_ecdsa_bootstrap`)throw Error(`[SigningEngine][ecdsa] reuse_warm bootstrap must resolve an existing exact material request before activation`);let n=Ke(t),r=l(z(t)),i=B(t),a=L(t.relayerUrl,e.defaultRelayerUrl),o=e.getSignerWorkerContext(),s={touchIdPrompt:e.touchIdPrompt,workerCtx:o,routerAbNormalSigning:e.routerAbNormalSigning};qe({request:t,walletId:r,authority:n});let c=await He(s,Je(t,a)),u=Ge(t);return await e.persistThresholdEcdsaBootstrapForWalletTarget({walletId:r,chainTarget:i,bootstrap:c,signerAuth:u}),await t.beforeAuthorizationPersistence?.(),await fe(se,{walletId:r,authority:n,bootstrap:c}),c}async function Qe(e,t){return await I(Ye(t,L(t.relayerUrl,e.defaultRelayerUrl)))}async function $e(e,t){return await I(Xe(t,L(t.relayerUrl,e.defaultRelayerUrl)))}async function V(e,t,n){let r=String(t),i=(e.get(r)||Promise.resolve()).catch(()=>void 0),a,o=new Promise(e=>{a=e}),s=i.then(()=>o);e.set(r,s),await i;try{return await n()}finally{a(),e.get(r)===s&&e.delete(r)}}function et(e,t){return t.runtimeScopeBootstrap&&(e.runtimeScopeBootstrap=t.runtimeScopeBootstrap),t.operationIntent&&(e.operationIntent=t.operationIntent),typeof t.ttlMs==`number`&&(e.ttlMs=t.ttlMs),e}function H(e){return et({kind:`email_otp_ecdsa_activation`,purpose:`transaction_signing`,walletKey:e.walletKey,lanePolicy:e.lanePolicy,publicCapability:e.publicCapability,existingRoleLocalMaterial:e.existingRoleLocalMaterial,source:e.source,relayerUrl:e.relayerUrl,sessionIdentity:e.sessionIdentity,sessionKind:e.sessionKind,sessionBudgetUses:e.sessionBudgetUses,runtimePolicy:e.runtimePolicy,emailOtpWorkerSessionHandle:e.emailOtpWorkerSessionHandle,emailOtpAuthContext:e.emailOtpAuthContext,...`preauthorizedSessionActivation`in e?{preauthorizedSessionActivation:e.preauthorizedSessionActivation}:{walletSessionRouteAuth:e.walletSessionRouteAuth}},e)}function U(e){if(le(e.context)!==e.expected)throw Error(`Email OTP ${e.label} activation requires ${e.expected} retention`)}function tt(e){return U({context:e.emailOtpAuthContext,expected:`session`,label:`session bootstrap`}),H(e)}function nt(e){return U({context:e.emailOtpAuthContext,expected:`session`,label:`recovered session`}),H(e)}function rt(e){return U({context:e.emailOtpAuthContext,expected:`session`,label:`preauthorized session bootstrap`}),H(e)}function it(e){return U({context:e.emailOtpAuthContext,expected:`single_use`,label:`per-operation reauth`}),H(e)}function at(e){return{kind:`email_otp_ecdsa_export_activation`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}function ot(e){return{kind:`passkey_ecdsa_export_activation`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}function st(e){switch(e.kind){case`default_policy`:return;case`scoped_policy`:return e.scope}throw Error(`[SigningEngine][ecdsa] unsupported ECDSA activation policy`)}function W(e,t){t.runtimeScopeBootstrap&&(e.runtimeScopeBootstrap=t.runtimeScopeBootstrap),t.operationIntent&&(e.operationIntent=t.operationIntent);let n=st(t.runtimePolicy);return`walletId`in e&&(typeof t.ttlMs==`number`&&(e.ttlMs=t.ttlMs),n&&(e.runtimePolicyScope=n)),e}function ct(e){switch(e.kind){case`passkey_ecdsa_activation`:return{kind:`passkey_existing_session_activation`,request:e};case`email_otp_ecdsa_activation`:return{kind:`email_otp_existing_session_activation`,request:e}}throw Error(`[SigningEngine][ecdsa] unsupported activation request`)}function lt(e){let t=String(e.webauthnAuthentication.rawId||e.webauthnAuthentication.id||``).trim();if(!t)throw Error(`[SigningEngine][ecdsa] passkey activation requires credential identity`);return t}function ut(e){let t=ct(e);switch(t.kind){case`passkey_existing_session_activation`:return W({kind:`passkey_fresh_ecdsa_bootstrap`,keyHandle:t.request.walletKey.keyHandle,key:x(t.request.walletKey),lanePolicy:t.request.lanePolicy,publicCapability:t.request.publicCapability,existingRoleLocalMaterial:t.request.existingRoleLocalMaterial,source:t.request.source,relayerUrl:t.request.relayerUrl,requestId:t.request.requestId,passkeyCredentialIdB64u:lt(t.request),routeAuth:t.request.walletSessionRouteAuth},t.request);case`email_otp_existing_session_activation`:{let e={kind:`email_otp_ecdsa_bootstrap`,keyHandle:t.request.walletKey.keyHandle,key:x(t.request.walletKey),lanePolicy:t.request.lanePolicy,publicCapability:t.request.publicCapability,existingRoleLocalMaterial:t.request.existingRoleLocalMaterial,source:`email_otp`,relayerUrl:t.request.relayerUrl,emailOtpWorkerSessionHandle:t.request.emailOtpWorkerSessionHandle,emailOtpAuthContext:t.request.emailOtpAuthContext};return t.request.preauthorizedSessionActivation?W({...e,sessionActivation:t.request.preauthorizedSessionActivation},t.request):W({...e,routeAuth:t.request.walletSessionRouteAuth},t.request)}}throw Error(`[SigningEngine][ecdsa] unsupported activation request`)}function dt(e){return{kind:`passkey_ecdsa_export_bootstrap`,purpose:`explicit_key_export`,existingRoleLocalMaterial:e.existingRoleLocalMaterial,relayerUrl:e.relayerUrl,authorization:e.authorization}}async function ft(e){let t=e.bootstrap.thresholdEcdsaKeyRef.backendBinding;if(!t)throw Error(`[WarmSessionStore] threshold ECDSA bootstrap is missing its backend binding`);let n=pt(t);if(!n)return;let r=await e.deps.persistEcdsaRoleLocalReadyRecord({record:n,storageKeyFacts:S(n)});if(!r.ok)throw Error(`[WarmSessionStore] threshold ECDSA role-local ready record persistence failed (${r.code}): ${r.message}`)}function pt(e){switch(e.materialKind){case`role_local_ready_state_blob`:return e.ecdsaRoleLocalReadyRecord;case`role_local_worker_handle`:case`role_local_durable_public_anchor`:case`role_local_durable_sealed_ref`:case`metadata_only`:return null;default:{let t=e;throw Error(`[WarmSessionStore] unsupported threshold ECDSA backend binding: ${JSON.stringify(t)}`)}}}async function G(e,t){let n=l(z(t));return await V(e.queueByWallet,n,async()=>{let n=await Ze(e.activationDeps,t);return await ft({deps:e,bootstrap:n}),n})}async function mt(e,t){return await G(e,ut(t))}async function ht(e,t){return await Qe(e.activationDeps,dt(t))}async function gt(e,t){let n={kind:`email_otp_ecdsa_export_bootstrap`,purpose:`explicit_key_export`,existingRoleLocalMaterial:t.existingRoleLocalMaterial,relayerUrl:t.relayerUrl,authorization:t.authorization};return await $e(e.activationDeps,n)}const K=`ecdsa-derivation:role-local:product-export-confirmation:v5`,q=`ecdsa-derivation:role-local:product-export-authorization:v5`;function J(e){return{kind:`operation_step_up`}}function Y(e){return{authorizationKind:e.kind,authorizationId:e.evidenceSetDigest}}function X(){let e=globalThis.crypto;if(!e||typeof e.getRandomValues!=`function`)throw Error(`crypto.getRandomValues is required for threshold ECDSA export`);return r(e.getRandomValues(new Uint8Array(32)))}async function Z(e){let t=String(e.relayerUrl||``).trim().replace(/\/+$/g,``);if(!t)throw Error(`[SigningEngine][ecdsa-export] relayer URL is required`);if(e.authorization.kind===`wallet_session_bearer`&&!e.authorization.token.trim())throw Error(`[SigningEngine][ecdsa-export] Wallet Session operation credential is required`);let n={"Content-Type":`application/json`};e.authorization.kind===`wallet_session_bearer`&&(n.Authorization=`Bearer ${e.authorization.token}`);try{let r=await fetch(`${t}${_}`,{method:`POST`,credentials:e.authorization.kind===`legacy_cookie`?`include`:`omit`,headers:n,body:JSON.stringify({request:e.request,requestDigestB64u:e.requestDigestB64u})}),i=await r.json().catch(()=>null);if(!r.ok){let e=i&&typeof i==`object`&&!Array.isArray(i)?i:null;return{ok:!1,code:String(e?.code||`http_error`),message:String(e?.message||`HTTP ${r.status}`)}}return{ok:!0,value:h(i)}}catch(e){return{ok:!1,error:e instanceof Error?e.message:String(e)}}}async function _t(e){return await Z({...e,authorization:{kind:`legacy_cookie`}})}async function vt(e){return await Z({relayerUrl:e.relayerUrl,request:e.request,requestDigestB64u:e.requestDigestB64u,authorization:{kind:`wallet_session_bearer`,token:e.operationCredential.token}})}function Q(e){let t=Math.min(e.issuedAtUnixMs+6e4,e.authorizationExpiresAtMsCeiling??1/0);if(Number.isFinite(t)&&t>e.issuedAtUnixMs)return t;throw new be({failure:ye(ve.expired),message:`Wallet Session expired before ECDSA export authorization`})}function yt(e){if(String(e.material.persistedMaterial.publicFacts.walletId)!==String(e.walletSessionUserId))throw Error(`[SigningEngine][ecdsa-export] explicit export wallet mismatch`)}async function $(e){return r(await n(t(e)))}function bt(e){switch(e.kind){case`rehydrated`:return e;case`device_link_required`:throw Error(`[SigningEngine][ecdsa-export] device_link_required: local threshold ECDSA material is unavailable`);case`corrupt`:throw Error(`[SigningEngine][ecdsa-export] local threshold ECDSA material is corrupt (${e.reason}): ${e.message}`);default:{let t=e;throw Error(`Unsupported ECDSA export material resolution: ${String(t)}`)}}}async function xt(e){return bt(await D({purpose:`explicit_key_export`,source:E(e.persistedMaterial),workerCtx:e.workerCtx}))}function St(e){let t=Y(e.material.operationAuthorization),n=e.material.persistedMaterial.publicFacts;return{version:q,operation:`explicit_key_export`,keyHandle:n.keyHandle,walletId:String(n.walletId),ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,relayerKeyId:n.publicCapability.signer_set.selected_server.server_id,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,contextBinding32B64u:e.contextBinding32B64u,publicIdentity:e.publicIdentity,exportRequestNonce32B64u:e.exportRequestNonce32B64u,confirmationDigest32B64u:e.confirmationDigest32B64u,issuedAtUnixMs:e.issuedAtUnixMs,expiresAtUnixMs:e.expiresAtUnixMs,authorizationKind:t.authorizationKind,authorizationId:t.authorizationId,materialActivation:b(e.material.persistedMaterial.materialActivation),participantIds:n.participantIds}}async function Ct(e,t){let n=t.persistedMaterial.publicFacts,r=b(t.persistedMaterial.materialActivation);switch(t.factorAuthorization.kind){case`passkey`:{let e=String(t.factorAuthorization.credential.rawId||t.factorAuthorization.credential.id||``).trim();if(!e)throw Error(`[SigningEngine][ecdsa-export] passkey authorization credential is missing`);if(e!==t.factorAuthorization.passkeyCredentialIdB64u)throw Error(`[SigningEngine][ecdsa-export] passkey export authorization credential mismatch`);break}case`email_otp_verified`:break;default:{let e=t.factorAuthorization;throw Error(`Unsupported ECDSA export authorization: ${String(e)}`)}}let i=Date.now(),a=Q({issuedAtUnixMs:i,authorizationExpiresAtMsCeiling:t.operationAuthorization.expiresAtMs}),o={derivationClientSharePublicKey33B64u:n.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:n.relayerPublicKey33B64u,groupPublicKey33B64u:n.groupPublicKey33B64u,ethereumAddress:n.ethereumAddress},s=X(),c=Y(t.operationAuthorization),l=await $({version:K,walletId:String(n.walletId),ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,relayerKeyId:n.publicCapability.signer_set.selected_server.server_id,contextBinding32B64u:n.contextBinding32B64u,publicIdentity:o,authorizationKind:c.authorizationKind,authorizationId:c.authorizationId,materialActivation:r,exportRequestNonce32B64u:s,issuedAtUnixMs:i,expiresAtUnixMs:a}),u=await $(St({ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,contextBinding32B64u:n.contextBinding32B64u,publicIdentity:o,exportRequestNonce32B64u:s,confirmationDigest32B64u:l,issuedAtUnixMs:i,expiresAtUnixMs:a,material:t})),d=n.publicCapability,f=`ecdsa-export:${s}`,p=await pe({workerCtx:e.getSignerWorkerContext(),command:{kind:`create_router_ab_ecdsa_explicit_export_ceremony_v1`,ceremonyId:f,request:{context:d.context,lifecycle:{lifecycle_id:f,work_kind:`key_export`,primitive_request_kind:`export`,root_share_epoch:d.activation_epoch,account_id:String(n.walletId),session_id:T.thresholdEcdsaSession(f),signer_set_id:d.signer_set.signer_set_id,selected_server_id:d.signer_set.selected_server.server_id},public_identity:d.public_identity,signer_set:d.signer_set,router_id:d.router_id,client_id:d.client_id,authorization:J(t.operationAuthorization),authorization_id:t.operationAuthorization.evidenceSetDigest,operation:t.operationAuthorization.operation,material_activation:r,export_authorization_digest_b64u:u,export_nonce:s,expires_at_ms:a,deriver_recipient_keys:d.deriver_recipient_keys}}});if(p.kind!==`router_ab_ecdsa_explicit_export_ceremony_created_v1`)throw Error(`[SigningEngine][ecdsa-export] strict export ceremony kind mismatch`);try{let i=await _t({relayerUrl:t.relayerUrl,request:p.request,requestDigestB64u:p.requestDigestB64u});if(!i.ok)throw Error(i.error||i.message||i.code||`Strict ECDSA explicit export request failed`);let a=await me({workerCtx:e.getSignerWorkerContext(),command:{kind:`finalize_router_ab_ecdsa_explicit_export_v1`,ceremonyId:f,clientProofFinalization:{kind:`finalize_encrypted_client_proof_bundles_v2`,bundles:i.value.response.bundles},signingWorkerExport:i.value.signing_worker_export,authorizationKind:c.authorizationKind,authorizationId:c.authorizationId,materialActivation:r,roleLocalMaterial:t.liveMaterial.liveHandle,roleLocalMaterialRef:t.liveMaterial.materialRef,publicFacts:n}});return{publicKeyHex:a.publicKeyHex,privateKeyHex:a.privateKeyHex,ethereumAddress:a.ethereumAddress}}catch(t){throw await ge({workerCtx:e.getSignerWorkerContext(),command:{kind:`close_router_ab_ecdsa_post_registration_ceremony_v1`,ceremonyId:f}}).catch(()=>void 0),t}}async function wt(e,t){let n=t.exportProvision.material;yt({material:n,walletSessionUserId:t.walletSessionUserId});let r=String(n.relayerUrl||``).trim();if(!r)throw Error(`[SigningEngine][ecdsa-export] relayer URL is required`);let i=n.persistedMaterial;return await Ct(e,{persistedMaterial:i,liveMaterial:await xt({persistedMaterial:i,workerCtx:e.getSignerWorkerContext()}),relayerUrl:r,operationAuthorization:t.exportProvision.authorization,factorAuthorization:t.factorAuthorization})}function Tt(t){let n=t.runtime.normalSigning.scope,r=t.operationAuthorization.operation,i=y(r.material_activation);if(r.operation_kind!==`evm.export_key`||r.wallet_id!==String(t.runtime.walletId)||r.key_handle!==t.runtime.publicFacts.keyHandle||r.relayer_key_id!==t.runtime.relayerKeyId||r.participant_ids[0]!==t.runtime.publicFacts.participantIds[0]||r.participant_ids[1]!==t.runtime.publicFacts.participantIds[1]||r.signing_worker_id!==n.signing_worker.server_id||r.normal_signing_scope.wallet_id!==n.wallet_id||r.normal_signing_scope.context.application_binding_digest_b64u!==n.context.application_binding_digest_b64u||r.normal_signing_scope.public_identity.context_binding_b64u!==n.public_identity.context_binding_b64u||r.normal_signing_scope.public_identity.threshold_public_key33_b64u!==n.public_identity.threshold_public_key33_b64u||r.normal_signing_scope.signing_worker.server_id!==n.signing_worker.server_id||!e(i,t.runtime.materialActivation)||!e(y(r.normal_signing_scope.material_activation),t.runtime.materialActivation))throw Error(`[SigningEngine][ecdsa-export] active Wallet Authority operation identity changed`)}async function Et(e,t){Tt(t);let n=t.runtime,r=n.normalSigning.scope;if(t.operationAuthorization.exportTopology.signer_set.selected_server.server_id!==r.signing_worker.server_id)throw Error(`[SigningEngine][ecdsa-export] active export topology changed`);let i=r.material_activation,a=Date.now(),o=Q({issuedAtUnixMs:a,authorizationExpiresAtMsCeiling:t.operationAuthorization.expiresAtMs}),s={derivationClientSharePublicKey33B64u:r.public_identity.derivation_client_share_public_key33_b64u,relayerPublicKey33B64u:r.public_identity.server_public_key33_b64u,groupPublicKey33B64u:r.public_identity.threshold_public_key33_b64u,ethereumAddress:n.publicFacts.thresholdOwnerAddress},l=X(),u=Y(t.operationAuthorization),d=await $({version:K,walletId:String(n.walletId),ecdsaThresholdKeyId:r.ecdsa_threshold_key_id,relayerKeyId:n.relayerKeyId,contextBinding32B64u:r.public_identity.context_binding_b64u,publicIdentity:s,authorizationKind:u.authorizationKind,authorizationId:u.authorizationId,materialActivation:i,exportRequestNonce32B64u:l,issuedAtUnixMs:a,expiresAtUnixMs:o}),f=await $({version:q,operation:`explicit_key_export`,keyHandle:n.publicFacts.keyHandle,walletId:String(n.walletId),ecdsaThresholdKeyId:r.ecdsa_threshold_key_id,relayerKeyId:n.relayerKeyId,signingRootId:r.signing_root_id,signingRootVersion:r.signing_root_version,contextBinding32B64u:r.public_identity.context_binding_b64u,publicIdentity:s,exportRequestNonce32B64u:l,confirmationDigest32B64u:d,issuedAtUnixMs:a,expiresAtUnixMs:o,authorizationKind:u.authorizationKind,authorizationId:u.authorizationId,materialActivation:i,participantIds:n.publicFacts.participantIds}),p=`ecdsa-export:${l}`,m={context:r.context,lifecycle:{lifecycle_id:p,work_kind:`key_export`,primitive_request_kind:`export`,root_share_epoch:r.activation_epoch,account_id:r.wallet_id,session_id:T.thresholdEcdsaSession(p),signer_set_id:t.operationAuthorization.exportTopology.signer_set.signer_set_id,selected_server_id:t.operationAuthorization.exportTopology.signer_set.selected_server.server_id},public_identity:r.public_identity,signer_set:t.operationAuthorization.exportTopology.signer_set,router_id:t.operationAuthorization.exportTopology.router_id,client_id:String(n.walletId),authorization:J(t.operationAuthorization),operation:t.operationAuthorization.operation,authorization_id:c(t.operationAuthorization.evidenceSetDigest),material_activation:i,export_authorization_digest_b64u:f,export_nonce:l,expires_at_ms:o,deriver_recipient_keys:t.operationAuthorization.exportTopology.deriver_recipient_keys},h=await he({holderHandleId:n.holderRuntime.holderHandleId,request:m,workerCtx:e.getSignerWorkerContext()});if(h.kind!==`ecdsa_holder_ordinary_export_request_created_v1`)throw Error(`[SigningEngine][ecdsa-export] active holder export request kind mismatch`);let g=await vt({relayerUrl:t.relayerUrl,request:h.request,requestDigestB64u:h.requestDigestB64u,operationCredential:n.operationCredential});if(!g.ok)throw Error(g.error||g.message||g.code||`Active Wallet Authority ECDSA export request failed`);let _={wallet_id:r.wallet_id,key_handle:n.publicFacts.keyHandle,ecdsa_threshold_key_id:r.ecdsa_threshold_key_id,signing_root_id:r.signing_root_id,signing_root_version:r.signing_root_version,activation_epoch:r.activation_epoch,signing_worker_id:r.signing_worker.server_id,context_binding_b64u:r.public_identity.context_binding_b64u,threshold_public_key33_b64u:r.public_identity.threshold_public_key33_b64u,export_request_digest_b64u:h.requestDigestB64u,export_authorization_digest_b64u:f,export_nonce:l,authorization_kind:`verified_step_up`,authorization_id:t.operationAuthorization.evidenceSetDigest,material_activation:i,lifecycle_id:p,recipient_identity:h.request.client_id,recipient_public_key:h.request.client_ephemeral_public_key,expires_at_ms:h.request.expires_at_ms},v=await _e({holderHandleId:n.holderRuntime.holderHandleId,requestDigestB64u:h.requestDigestB64u,expectedBinding:_,forwardedResponse:g.value,workerCtx:e.getSignerWorkerContext()});return{publicKeyHex:v.publicKeyHex,privateKeyHex:v.privateKeyHex,ethereumAddress:v.ethereumAddress}}export{k as _,it as a,tt as c,mt as d,G as f,A as g,z as h,at as i,gt as l,B as m,wt as n,rt as o,V as p,ot as r,nt as s,Et as t,ht as u,xe as v,Se as y};

package/dist/public/sdk/{ecdsaWalletRecords-C_v74n5X.js → ecdsaWalletRecords-CxxUt3fS.js}

@@ -1 +1 @@
-import"./accountIds-Cpvlkvbe.js";import"./registrationSignerPlan-BHkqlian.js";import"./signerDomain-BFqRQ0Jl.js";import{C as e,D as t,E as n,S as r,n as i}from"./accountLifecycle-D61FIpFS.js";import"./registrationIds-Br-zI4_5.js";function a(a){return{storeWalletEcdsaSignerRecords:t=>e(a.accountLifecycle,t),storeWalletEmailOtpEcdsaSignerRecords:e=>t(a.accountLifecycle,e),storeWalletEcdsaRecoverySignerRecords:e=>r(a.accountLifecycle,e),finalizeWalletEcdsaRegistration:e=>i(a.accountLifecycle,e),storeWalletEmailOtpEcdsaRegistrationData:e=>n(a.accountLifecycle,e)}}export{a as createEcdsaWalletRecordsService};
+import"./accountIds-Cpvlkvbe.js";import"./registrationSignerPlan-BHkqlian.js";import"./signerDomain-BFqRQ0Jl.js";import{C as e,D as t,E as n,S as r,n as i}from"./accountLifecycle-fLNUdjct.js";import"./registrationIds-B1OpqRAt.js";function a(a){return{storeWalletEcdsaSignerRecords:t=>e(a.accountLifecycle,t),storeWalletEmailOtpEcdsaSignerRecords:e=>t(a.accountLifecycle,e),storeWalletEcdsaRecoverySignerRecords:e=>r(a.accountLifecycle,e),finalizeWalletEcdsaRegistration:e=>i(a.accountLifecycle,e),storeWalletEmailOtpEcdsaRegistrationData:e=>n(a.accountLifecycle,e)}}export{a as createEcdsaWalletRecordsService};