@seams/wallet 0.17.0 → 0.19.0

package/dist/{esm/sdk/walletSessionAuthorizationStore-D-MhJ0PC.js → public/sdk/walletSessionAuthorizationStore-DnUMtkev.js}

@@ -1 +1 @@
-import{D as e,O as t,T as n,h as r}from"./domainIds-C3fUa33Q.js";import{i,t as a}from"./activeWalletSession-Ba6X4CUN.js";import{d as o,h as s,m as c}from"./capabilityKinds-D0Yrp9uf.js";import{r as l}from"./canonicalPrimitives-BOzRXzfv.js";import{i as u,r as d,t as f}from"./singletons-DxIyVhNb.js";import{t as p}from"./walletOwnershipGeneration-pMmmJ6XA.js";var m=class extends Error{kind=`upgrade_required`;code=`upgrade_required`;constructor(e){super(e),this.name=`WalletSessionAuthorizationUpgradeRequiredError`}};const h=u.walletSessionAuthorizations;function g(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=Object.keys(e);if(n.length!==t.length||n.some(e=>!t.includes(e)))return null;let r=new Map;for(let t of n)r.set(t,Reflect.get(e,t));return r}function _(e,t){if(!(typeof e!=`object`||!e||Array.isArray(e)))return Reflect.get(e,t)}function v(e){switch(e){case`expired`:case`exhausted`:case`replaced`:case`wallet_locked`:case`invalidated`:return e;default:return null}}const y=[`kind`,`walletId`,`authorityId`,`authMethodId`,`authorizationId`,`quotaId`,`authorityDigestB64u`,`authorityRevocationEpoch`,`capabilitySubjects`,`issuedAtMs`,`expiresAtMs`],b=[...y,`retiredAtMs`,`retirementReason`],x=[`record_version`,`wallet_session_id`,`authorization_id`,`wallet_id`,`wallet_authority_id`,`wallet_auth_method_id`,`authority_digest_b64u`,`authority_revocation_epoch`,`status`,`issued_at_ms`,`expires_at_ms`,`record`,`operation_credential`],S=/^wallet_session_authorization_v([0-9]+)$/;function C(e){if(typeof e!=`string`)return null;let t=S.exec(e);if(!t)return null;let n=Number(t[1]);return Number.isSafeInteger(n)?n:null}function w(e){let t=typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.prototype.hasOwnProperty.call(e,`record_version`),n=C(_(e,`record_version`)),r=t?null:C(_(_(e,`record`),`recordVersion`)),i=n??r;return i===null?{kind:`unknown`}:i>=3&&i<6?{kind:`legacy`,version:i}:t&&i===6?{kind:`current`,version:i}:t&&i>6?{kind:`future`,version:i}:{kind:`unknown`}}function T(e,t){if(w(e).kind!==`future`||_(e,`wallet_id`)!==t.walletId)return!1;let n=_(e,`wallet_authority_id`),r=_(e,`wallet_auth_method_id`);return typeof n!=`string`||typeof r!=`string`?!0:n===t.authorityId&&r===t.authMethodId}function E(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0}function D(e){let t=_(e,`wallet_session_id`);if(typeof t!=`string`)throw Error(`Stored Wallet Session authorization key is invalid`);return t}function O(e){switch(e.kind){case`sign`:case`export_keys`:return`${e.kind}:${e.keyFamily}:${e.materialActivation.activationId}`;case`link_devices`:case`revoke_devices`:return e.kind;default:return k(e)}}function k(e){throw Error(`Unknown Wallet Capability subject: ${String(e)}`)}function A(e){let t=_(e,`kind`);if(t===`sign`||t===`export_keys`){let n=g(e,[`kind`,`keyFamily`,`materialActivation`]);if(!n)return null;let i=n.get(`keyFamily`);if(i!==`ed25519`&&i!==`ecdsa_secp256k1`)return null;let a=r(n.get(`materialActivation`));return a.ok?{kind:t,keyFamily:i,materialActivation:a.value}:null}return(t===`link_devices`||t===`revoke_devices`)&&g(e,[`kind`])?{kind:t}:null}function j(e){if(!Array.isArray(e)||e.length===0)return null;let t=[];for(let n of e){let e=A(n);if(!e)return null;t.push(e)}let n=new Set;for(let e of t){let t=O(e);if(n.has(t))return null;n.add(t)}let[r,...i]=t;return r?[r,...i]:null}function M(r){let i=_(r,`kind`),a=i===`active_wallet_session_v1`?g(r,y):i===`retired_wallet_session_v1`?g(r,b):null;if(!a)return null;let s=t(a.get(`walletId`)),u=e(a.get(`authorityId`)),d=n(a.get(`authMethodId`)),f=c(a.get(`authorizationId`)),p=o(a.get(`quotaId`));if(!s.ok||!u.ok||!d.ok||!f.ok||!p.ok)return null;let m;try{m=l(a.get(`authorityDigestB64u`))}catch{return null}let h=j(a.get(`capabilitySubjects`)),x=a.get(`authorityRevocationEpoch`),S=a.get(`issuedAtMs`),C=a.get(`expiresAtMs`);if(!h||!E(x)||!E(S)||!E(C)||C<=S)return null;let w={walletId:s.value,authorityId:u.value,authMethodId:d.value,authorizationId:f.value,quotaId:p.value,authorityDigestB64u:m,authorityRevocationEpoch:x,capabilitySubjects:h,issuedAtMs:S,expiresAtMs:C};if(i===`active_wallet_session_v1`)return{kind:`active_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs};if(i===`retired_wallet_session_v1`){let e=a.get(`retiredAtMs`);if(!E(e)||e<w.issuedAtMs)return null;let t=v(a.get(`retirementReason`));return!t||t===`expired`&&e<w.expiresAtMs?null:{kind:`retired_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs,retiredAtMs:e,retirementReason:t}}return null}function N(e){if(!E(e.retiredAtMs))throw Error(`Retired Wallet Session v1 time is invalid`);let t=M({kind:`retired_wallet_session_v1`,walletId:e.active.walletId,authorityId:e.active.authorityId,authMethodId:e.active.authMethodId,authorizationId:e.active.authorizationId,quotaId:e.active.quotaId,authorityDigestB64u:e.active.authorityDigestB64u,authorityRevocationEpoch:e.active.authorityRevocationEpoch,capabilitySubjects:e.active.capabilitySubjects,issuedAtMs:e.active.issuedAtMs,expiresAtMs:e.active.expiresAtMs,retiredAtMs:e.retiredAtMs,retirementReason:e.reason});if(!t||t.kind!==`retired_wallet_session_v1`)throw Error(`Retired Wallet Session v1 is invalid`);return t}function P(e,t){let n=M(e);if(!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let r;try{r=i(t)}catch{throw Error(`Wallet Session operation credential is invalid`)}let a={record_version:`wallet_session_authorization_v6`,wallet_session_id:r.walletSessionId,authorization_id:n.authorizationId,wallet_id:n.walletId,wallet_authority_id:n.authorityId,wallet_auth_method_id:n.authMethodId,authority_digest_b64u:n.authorityDigestB64u,authority_revocation_epoch:n.authorityRevocationEpoch,status:`active`,issued_at_ms:n.issuedAtMs,expires_at_ms:n.expiresAtMs,record:{kind:n.kind,walletId:n.walletId,authorityId:n.authorityId,authMethodId:n.authMethodId,authorizationId:n.authorizationId,walletSessionId:r.walletSessionId,quotaId:n.quotaId,authorityDigestB64u:n.authorityDigestB64u,authorityRevocationEpoch:n.authorityRevocationEpoch,capabilitySubjects:n.capabilitySubjects,issuedAtMs:n.issuedAtMs,expiresAtMs:n.expiresAtMs},operation_credential:r};if(!F(a))throw Error(`Wallet Session authorization v6 is invalid`);return a}function F(e){let t=g(e,x);if(!t||t.get(`record_version`)!==`wallet_session_authorization_v6`||t.get(`status`)!==`active`)return null;let n=s(t.get(`wallet_session_id`)),r=c(t.get(`authorization_id`));if(!n.ok||!r.ok)return null;let a;try{a=i(t.get(`operation_credential`))}catch{return null}if(n.value!==a.walletSessionId)return null;let o=g(t.get(`record`),[...y,`walletSessionId`]);if(!o)return null;let l=s(o.get(`walletSessionId`));if(!l.ok||l.value!==n.value)return null;let u=M({kind:o.get(`kind`),walletId:o.get(`walletId`),authorityId:o.get(`authorityId`),authMethodId:o.get(`authMethodId`),authorizationId:o.get(`authorizationId`),quotaId:o.get(`quotaId`),authorityDigestB64u:o.get(`authorityDigestB64u`),authorityRevocationEpoch:o.get(`authorityRevocationEpoch`),capabilitySubjects:o.get(`capabilitySubjects`),issuedAtMs:o.get(`issuedAtMs`),expiresAtMs:o.get(`expiresAtMs`)});return!u||u.kind!==`active_wallet_session_v1`||t.get(`wallet_id`)!==u.walletId||t.get(`wallet_authority_id`)!==u.authorityId||t.get(`wallet_auth_method_id`)!==u.authMethodId||t.get(`authority_digest_b64u`)!==u.authorityDigestB64u||t.get(`authority_revocation_epoch`)!==u.authorityRevocationEpoch||t.get(`issued_at_ms`)!==u.issuedAtMs||t.get(`expires_at_ms`)!==u.expiresAtMs||r.value!==u.authorizationId?null:{record:u,operationCredential:a,physicalKey:n.value}}async function I(e){let t=M(e.active);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);await p(e.ctx,t.walletId,n.ownershipGeneration);let r=P(t,n),o=!0,s=e.ctx.store(h),c=await s.index(d.walletId).getAll(t.walletId);for(let e of c){let r=w(e);if(r.kind===`future`)continue;if(r.kind===`legacy`){await s.delete(D(e));continue}if(r.kind!==`current`)throw Error(`Stored Wallet Session authorization row is corrupt`);let i=F(e);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let c=i.record;if(i.operationCredential.walletSessionId===n.walletSessionId&&(i.operationCredential.token!==n.token||i.operationCredential.ownershipGeneration!==n.ownershipGeneration))throw Error(`Stored Wallet Session conflicts with the issued operation credential`);if(i.operationCredential.ownershipGeneration<n.ownershipGeneration){await s.delete(i.physicalKey);continue}if(!(c.kind!==`active_wallet_session_v1`||c.authorityId!==t.authorityId||c.authMethodId!==t.authMethodId)){if(c.authorizationId===t.authorizationId&&i.operationCredential.walletSessionId===n.walletSessionId){o=!a(c,t);continue}await s.delete(i.physicalKey)}}return o&&await s.put(r),t}async function L(e){let t=e.ctx.store(h),n=await t.index(d.walletId).getAll(e.walletId),r=null,i=!1;for(let a of n){if(T(a,e)){i=!0;continue}let n=w(a);if(n.kind===`legacy`){await t.delete(D(a));continue}if(n.kind!==`current`)return{kind:`corrupt`};let o=F(a);if(!o)return{kind:`corrupt`};if(!(o.record.walletId!==e.walletId||o.record.authorityId!==e.authorityId||o.record.authMethodId!==e.authMethodId)){if(r)return{kind:`corrupt`};r=o}}return i?{kind:`upgrade_required`}:r?{kind:`found`,...r}:{kind:`missing`}}var R=class{constructor(e=f){this.manager=e}async writeExactWithOperationCredential(e){let t=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);return await this.replaceExactActive({active:t,operationCredential:n}),t}async refreshExactWithOperationCredential(e){let t=M(e.expected),n=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`||!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session refresh is invalid`);for(let e of y)if(!(e===`kind`||e===`capabilitySubjects`)&&t[e]!==n[e])throw Error(`Wallet Session refresh changed its exact identity`);let r=P(n,i(e.operationCredential));return this.manager.runTransaction([h],`readwrite`,B.bind(null,t,r))}async readExact(e){return this.manager.runTransaction([h],`readwrite`,V.bind(null,e))}async readExactWithOperationCredential(e){let t=await this.readExactActiveForWallet(e);switch(t.kind){case`found`:case`missing`:case`upgrade_required`:return t;case`corrupt`:throw Error(`Stored Wallet Session authorization v6 is corrupt`);case`persistence_unavailable`:throw Error(`Wallet Session authorization persistence is unavailable`)}}async readExactActiveForWallet(e){try{return await this.manager.runTransaction([h],`readwrite`,H.bind(null,e))}catch(e){return e instanceof z?{kind:`corrupt`}:{kind:`persistence_unavailable`}}}async retireExactActiveForWallet(e){if(!E(e.retiredAtMs))throw Error(`Wallet Session v1 retirement time is invalid`);return this.manager.runTransaction([h],`readwrite`,U.bind(null,e))}async replaceExactActive(e){return this.manager.runTransaction([h,u.appState,u.ecdsaClientPresignatures],`readwrite`,W.bind(null,e))}async clearWallet(e){await this.manager.runTransaction([h],`readwrite`,G.bind(null,e))}async clearAll(){await this.manager.runTransaction([h],`readwrite`,K)}},z=class extends Error{};async function B(e,t,n){let r=n.store(h),i=t.operation_credential,o=await r.get(i.walletSessionId);if(o===void 0)return`superseded`;let s=F(o);if(!s)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return!a(s.record,e)||s.operationCredential.token!==i.token?`superseded`:(await r.put(t),`updated`)}async function V(e,t){let n=t.store(h),r=await n.get(e);if(r===void 0)return null;switch(w(r).kind){case`future`:throw new m(`Wallet Session authorization requires a newer client`);case`legacy`:return await n.delete(D(r)),null;case`current`:break;case`unknown`:throw Error(`Stored Wallet Session authorization v6 is corrupt`)}let i=F(r);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return i.record}async function H(e,t){let n=await L({ctx:t,walletId:e.walletId,authorityId:e.authorityId,authMethodId:e.authMethodId});if(n.kind===`corrupt`)throw new z(`Stored Wallet Session authorization v6 is corrupt`);return n}async function U(e,t){let n=t.store(h),r=[],i=await n.index(d.walletId).getAll(e.walletId);for(let t of i){let i=w(t);if(i.kind===`future`)continue;if(i.kind===`legacy`){await n.delete(D(t));continue}if(i.kind!==`current`)continue;let a=F(t);if(!a)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let o=a.record;if(o.kind!==`active_wallet_session_v1`)continue;let s=N({active:o,reason:e.reason,retiredAtMs:e.retiredAtMs});await n.delete(a.physicalKey),r.push(s)}return r}function W(e,t){return I({ctx:t,active:e.active,operationCredential:e.operationCredential})}async function G(e,t){let n=t.store(h),r=await n.index(d.walletId).getAllKeys(e);for(let e of r)await n.delete(e)}function K(e){return e.store(h).clear()}const q=new R;export{P as a,I as i,F as n,q as o,L as r,m as t};
+import{D as e,O as t,T as n,h as r}from"./domainIds-C3fUa33Q.js";import{i,t as a}from"./activeWalletSession-BpbnpU9s.js";import{d as o,h as s,m as c}from"./capabilityKinds-D0Yrp9uf.js";import{r as l}from"./canonicalPrimitives-BMP5yILS.js";import{i as u,r as d,t as f}from"./singletons-CAsc9LvA.js";import{t as p}from"./walletOwnershipGeneration-DSGfjuV2.js";var m=class extends Error{kind=`upgrade_required`;code=`upgrade_required`;constructor(e){super(e),this.name=`WalletSessionAuthorizationUpgradeRequiredError`}};const h=u.walletSessionAuthorizations;function g(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=Object.keys(e);if(n.length!==t.length||n.some(e=>!t.includes(e)))return null;let r=new Map;for(let t of n)r.set(t,Reflect.get(e,t));return r}function _(e,t){if(!(typeof e!=`object`||!e||Array.isArray(e)))return Reflect.get(e,t)}function v(e){switch(e){case`expired`:case`exhausted`:case`replaced`:case`wallet_locked`:case`invalidated`:return e;default:return null}}const y=[`kind`,`walletId`,`authorityId`,`authMethodId`,`authorizationId`,`quotaId`,`authorityDigestB64u`,`authorityRevocationEpoch`,`capabilitySubjects`,`issuedAtMs`,`expiresAtMs`],b=[...y,`retiredAtMs`,`retirementReason`],x=[`record_version`,`wallet_session_id`,`authorization_id`,`wallet_id`,`wallet_authority_id`,`wallet_auth_method_id`,`authority_digest_b64u`,`authority_revocation_epoch`,`status`,`issued_at_ms`,`expires_at_ms`,`record`,`operation_credential`],S=/^wallet_session_authorization_v([0-9]+)$/;function C(e){if(typeof e!=`string`)return null;let t=S.exec(e);if(!t)return null;let n=Number(t[1]);return Number.isSafeInteger(n)?n:null}function w(e){let t=typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.prototype.hasOwnProperty.call(e,`record_version`),n=C(_(e,`record_version`)),r=t?null:C(_(_(e,`record`),`recordVersion`)),i=n??r;return i===null?{kind:`unknown`}:i>=3&&i<6?{kind:`legacy`,version:i}:t&&i===6?{kind:`current`,version:i}:t&&i>6?{kind:`future`,version:i}:{kind:`unknown`}}function T(e,t){if(w(e).kind!==`future`||_(e,`wallet_id`)!==t.walletId)return!1;let n=_(e,`wallet_authority_id`),r=_(e,`wallet_auth_method_id`);return typeof n!=`string`||typeof r!=`string`?!0:n===t.authorityId&&r===t.authMethodId}function E(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0}function D(e){let t=_(e,`wallet_session_id`);if(typeof t!=`string`)throw Error(`Stored Wallet Session authorization key is invalid`);return t}function O(e){switch(e.kind){case`sign`:case`export_keys`:return`${e.kind}:${e.keyFamily}:${e.materialActivation.activationId}`;case`link_devices`:case`revoke_devices`:return e.kind;default:return k(e)}}function k(e){throw Error(`Unknown Wallet Capability subject: ${String(e)}`)}function A(e){let t=_(e,`kind`);if(t===`sign`||t===`export_keys`){let n=g(e,[`kind`,`keyFamily`,`materialActivation`]);if(!n)return null;let i=n.get(`keyFamily`);if(i!==`ed25519`&&i!==`ecdsa_secp256k1`)return null;let a=r(n.get(`materialActivation`));return a.ok?{kind:t,keyFamily:i,materialActivation:a.value}:null}return(t===`link_devices`||t===`revoke_devices`)&&g(e,[`kind`])?{kind:t}:null}function j(e){if(!Array.isArray(e)||e.length===0)return null;let t=[];for(let n of e){let e=A(n);if(!e)return null;t.push(e)}let n=new Set;for(let e of t){let t=O(e);if(n.has(t))return null;n.add(t)}let[r,...i]=t;return r?[r,...i]:null}function M(r){let i=_(r,`kind`),a=i===`active_wallet_session_v1`?g(r,y):i===`retired_wallet_session_v1`?g(r,b):null;if(!a)return null;let s=t(a.get(`walletId`)),u=e(a.get(`authorityId`)),d=n(a.get(`authMethodId`)),f=c(a.get(`authorizationId`)),p=o(a.get(`quotaId`));if(!s.ok||!u.ok||!d.ok||!f.ok||!p.ok)return null;let m;try{m=l(a.get(`authorityDigestB64u`))}catch{return null}let h=j(a.get(`capabilitySubjects`)),x=a.get(`authorityRevocationEpoch`),S=a.get(`issuedAtMs`),C=a.get(`expiresAtMs`);if(!h||!E(x)||!E(S)||!E(C)||C<=S)return null;let w={walletId:s.value,authorityId:u.value,authMethodId:d.value,authorizationId:f.value,quotaId:p.value,authorityDigestB64u:m,authorityRevocationEpoch:x,capabilitySubjects:h,issuedAtMs:S,expiresAtMs:C};if(i===`active_wallet_session_v1`)return{kind:`active_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs};if(i===`retired_wallet_session_v1`){let e=a.get(`retiredAtMs`);if(!E(e)||e<w.issuedAtMs)return null;let t=v(a.get(`retirementReason`));return!t||t===`expired`&&e<w.expiresAtMs?null:{kind:`retired_wallet_session_v1`,walletId:w.walletId,authorityId:w.authorityId,authMethodId:w.authMethodId,authorizationId:w.authorizationId,quotaId:w.quotaId,authorityDigestB64u:w.authorityDigestB64u,authorityRevocationEpoch:w.authorityRevocationEpoch,capabilitySubjects:w.capabilitySubjects,issuedAtMs:w.issuedAtMs,expiresAtMs:w.expiresAtMs,retiredAtMs:e,retirementReason:t}}return null}function N(e){if(!E(e.retiredAtMs))throw Error(`Retired Wallet Session v1 time is invalid`);let t=M({kind:`retired_wallet_session_v1`,walletId:e.active.walletId,authorityId:e.active.authorityId,authMethodId:e.active.authMethodId,authorizationId:e.active.authorizationId,quotaId:e.active.quotaId,authorityDigestB64u:e.active.authorityDigestB64u,authorityRevocationEpoch:e.active.authorityRevocationEpoch,capabilitySubjects:e.active.capabilitySubjects,issuedAtMs:e.active.issuedAtMs,expiresAtMs:e.active.expiresAtMs,retiredAtMs:e.retiredAtMs,retirementReason:e.reason});if(!t||t.kind!==`retired_wallet_session_v1`)throw Error(`Retired Wallet Session v1 is invalid`);return t}function P(e,t){let n=M(e);if(!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let r;try{r=i(t)}catch{throw Error(`Wallet Session operation credential is invalid`)}let a={record_version:`wallet_session_authorization_v6`,wallet_session_id:r.walletSessionId,authorization_id:n.authorizationId,wallet_id:n.walletId,wallet_authority_id:n.authorityId,wallet_auth_method_id:n.authMethodId,authority_digest_b64u:n.authorityDigestB64u,authority_revocation_epoch:n.authorityRevocationEpoch,status:`active`,issued_at_ms:n.issuedAtMs,expires_at_ms:n.expiresAtMs,record:{kind:n.kind,walletId:n.walletId,authorityId:n.authorityId,authMethodId:n.authMethodId,authorizationId:n.authorizationId,walletSessionId:r.walletSessionId,quotaId:n.quotaId,authorityDigestB64u:n.authorityDigestB64u,authorityRevocationEpoch:n.authorityRevocationEpoch,capabilitySubjects:n.capabilitySubjects,issuedAtMs:n.issuedAtMs,expiresAtMs:n.expiresAtMs},operation_credential:r};if(!F(a))throw Error(`Wallet Session authorization v6 is invalid`);return a}function F(e){let t=g(e,x);if(!t||t.get(`record_version`)!==`wallet_session_authorization_v6`||t.get(`status`)!==`active`)return null;let n=s(t.get(`wallet_session_id`)),r=c(t.get(`authorization_id`));if(!n.ok||!r.ok)return null;let a;try{a=i(t.get(`operation_credential`))}catch{return null}if(n.value!==a.walletSessionId)return null;let o=g(t.get(`record`),[...y,`walletSessionId`]);if(!o)return null;let l=s(o.get(`walletSessionId`));if(!l.ok||l.value!==n.value)return null;let u=M({kind:o.get(`kind`),walletId:o.get(`walletId`),authorityId:o.get(`authorityId`),authMethodId:o.get(`authMethodId`),authorizationId:o.get(`authorizationId`),quotaId:o.get(`quotaId`),authorityDigestB64u:o.get(`authorityDigestB64u`),authorityRevocationEpoch:o.get(`authorityRevocationEpoch`),capabilitySubjects:o.get(`capabilitySubjects`),issuedAtMs:o.get(`issuedAtMs`),expiresAtMs:o.get(`expiresAtMs`)});return!u||u.kind!==`active_wallet_session_v1`||t.get(`wallet_id`)!==u.walletId||t.get(`wallet_authority_id`)!==u.authorityId||t.get(`wallet_auth_method_id`)!==u.authMethodId||t.get(`authority_digest_b64u`)!==u.authorityDigestB64u||t.get(`authority_revocation_epoch`)!==u.authorityRevocationEpoch||t.get(`issued_at_ms`)!==u.issuedAtMs||t.get(`expires_at_ms`)!==u.expiresAtMs||r.value!==u.authorizationId?null:{record:u,operationCredential:a,physicalKey:n.value}}async function I(e){let t=M(e.active);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);await p(e.ctx,t.walletId,n.ownershipGeneration);let r=P(t,n),o=!0,s=e.ctx.store(h),c=await s.index(d.walletId).getAll(t.walletId);for(let e of c){let r=w(e);if(r.kind===`future`)continue;if(r.kind===`legacy`){await s.delete(D(e));continue}if(r.kind!==`current`)throw Error(`Stored Wallet Session authorization row is corrupt`);let i=F(e);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let c=i.record;if(i.operationCredential.walletSessionId===n.walletSessionId&&(i.operationCredential.token!==n.token||i.operationCredential.ownershipGeneration!==n.ownershipGeneration))throw Error(`Stored Wallet Session conflicts with the issued operation credential`);if(i.operationCredential.ownershipGeneration<n.ownershipGeneration){await s.delete(i.physicalKey);continue}if(!(c.kind!==`active_wallet_session_v1`||c.authorityId!==t.authorityId||c.authMethodId!==t.authMethodId)){if(c.authorizationId===t.authorizationId&&i.operationCredential.walletSessionId===n.walletSessionId){o=!a(c,t);continue}await s.delete(i.physicalKey)}}return o&&await s.put(r),t}async function L(e){let t=e.ctx.store(h),n=await t.index(d.walletId).getAll(e.walletId),r=null,i=!1;for(let a of n){if(T(a,e)){i=!0;continue}let n=w(a);if(n.kind===`legacy`){await t.delete(D(a));continue}if(n.kind!==`current`)return{kind:`corrupt`};let o=F(a);if(!o)return{kind:`corrupt`};if(!(o.record.walletId!==e.walletId||o.record.authorityId!==e.authorityId||o.record.authMethodId!==e.authMethodId)){if(r)return{kind:`corrupt`};r=o}}return i?{kind:`upgrade_required`}:r?{kind:`found`,...r}:{kind:`missing`}}var R=class{constructor(e=f){this.manager=e}async writeExactWithOperationCredential(e){let t=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=i(e.operationCredential);return await this.replaceExactActive({active:t,operationCredential:n}),t}async refreshExactWithOperationCredential(e){let t=M(e.expected),n=M(e.record);if(!t||t.kind!==`active_wallet_session_v1`||!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session refresh is invalid`);for(let e of y)if(!(e===`kind`||e===`capabilitySubjects`)&&t[e]!==n[e])throw Error(`Wallet Session refresh changed its exact identity`);let r=P(n,i(e.operationCredential));return this.manager.runTransaction([h],`readwrite`,B.bind(null,t,r))}async readExact(e){return this.manager.runTransaction([h],`readwrite`,V.bind(null,e))}async readExactWithOperationCredential(e){let t=await this.readExactActiveForWallet(e);switch(t.kind){case`found`:case`missing`:case`upgrade_required`:return t;case`corrupt`:throw Error(`Stored Wallet Session authorization v6 is corrupt`);case`persistence_unavailable`:throw Error(`Wallet Session authorization persistence is unavailable`)}}async readExactActiveForWallet(e){try{return await this.manager.runTransaction([h],`readwrite`,H.bind(null,e))}catch(e){return e instanceof z?{kind:`corrupt`}:{kind:`persistence_unavailable`}}}async retireExactActiveForWallet(e){if(!E(e.retiredAtMs))throw Error(`Wallet Session v1 retirement time is invalid`);return this.manager.runTransaction([h],`readwrite`,U.bind(null,e))}async replaceExactActive(e){return this.manager.runTransaction([h,u.appState,u.ecdsaClientPresignatures],`readwrite`,W.bind(null,e))}async clearWallet(e){await this.manager.runTransaction([h],`readwrite`,G.bind(null,e))}async clearAll(){await this.manager.runTransaction([h],`readwrite`,K)}},z=class extends Error{};async function B(e,t,n){let r=n.store(h),i=t.operation_credential,o=await r.get(i.walletSessionId);if(o===void 0)return`superseded`;let s=F(o);if(!s)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return!a(s.record,e)||s.operationCredential.token!==i.token?`superseded`:(await r.put(t),`updated`)}async function V(e,t){let n=t.store(h),r=await n.get(e);if(r===void 0)return null;switch(w(r).kind){case`future`:throw new m(`Wallet Session authorization requires a newer client`);case`legacy`:return await n.delete(D(r)),null;case`current`:break;case`unknown`:throw Error(`Stored Wallet Session authorization v6 is corrupt`)}let i=F(r);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return i.record}async function H(e,t){let n=await L({ctx:t,walletId:e.walletId,authorityId:e.authorityId,authMethodId:e.authMethodId});if(n.kind===`corrupt`)throw new z(`Stored Wallet Session authorization v6 is corrupt`);return n}async function U(e,t){let n=t.store(h),r=[],i=await n.index(d.walletId).getAll(e.walletId);for(let t of i){let i=w(t);if(i.kind===`future`)continue;if(i.kind===`legacy`){await n.delete(D(t));continue}if(i.kind!==`current`)continue;let a=F(t);if(!a)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let o=a.record;if(o.kind!==`active_wallet_session_v1`)continue;let s=N({active:o,reason:e.reason,retiredAtMs:e.retiredAtMs});await n.delete(a.physicalKey),r.push(s)}return r}function W(e,t){return I({ctx:t,active:e.active,operationCredential:e.operationCredential})}async function G(e,t){let n=t.store(h),r=await n.index(d.walletId).getAllKeys(e);for(let e of r)await n.delete(e)}function K(e){return e.store(h).clear()}const q=new R;export{P as a,I as i,F as n,q as o,L as r,m as t};

package/dist/public/sdk/warmSessionHydration-D8Vdro9n.js

@@ -0,0 +1 @@
+import{t as e}from"./prfCache-BAFh1skJ.js";function t(t){return{hydrateSigningSession:n=>e(t.getWarmSessionMaterialWriter(),n)}}export{t as createWarmSessionHydrationService};

package/dist/{esm/sdk/webauthnP256-XgYu-Y6E.js → public/sdk/webauthnP256-_ajaNl90.js}

@@ -1 +1 @@
-import{r as e,t}from"./base64-DW79QA0h.js";import{n}from"./evmCryptoWasm-DeobzyP-.js";function r(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n++)if(e[n]!==t[n])return!1;return!0}var i=class{algorithm=`webauthnP256`;constructor(e,t){this.workerCtx=e,this.beforeSigning=t}async buildWebauthnSignature(e){if(!this.workerCtx)throw Error(`[WebAuthnP256Engine] workerCtx is required for wasm-backed WebAuthn signature packing`);return await n({challenge32:e.challenge32,authenticatorData:e.authenticatorData,clientDataJSON:e.clientDataJSON,signatureDer:e.signatureDer,pubKeyX32:e.pubKeyX32,pubKeyY32:e.pubKeyY32,workerCtx:this.workerCtx})}async sign(n,i){if(n.kind!==`webauthn`||n.algorithm!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] unsupported sign request`);if(n.challenge32.length!==32)throw Error(`[WebAuthnP256Engine] challenge32 must be 32 bytes`);if(i.type!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] keyRef must be webauthnP256`);if(i.pubKeyX.length!==32||i.pubKeyY.length!==32)throw Error(`[WebAuthnP256Engine] pubKeyX/pubKeyY must be 32 bytes each`);if(i.credentialId.length===0)throw Error(`[WebAuthnP256Engine] credentialId must be non-empty`);let a=async a=>{let o=a&&typeof a==`object`?a:{};if(!r(t(String(o.rawId||``).trim()),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn credential rawId does not match keyRef`);let s=o.response,c=e(String(s?.authenticatorData||``)),l=e(String(s?.clientDataJSON||``)),u=e(String(s?.signature||``));if(c.length===0||l.length===0||u.length===0)throw Error(`[WebAuthnP256Engine] missing authenticatorData/clientDataJSON/signature in credential`);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:c,clientDataJSON:l,signatureDer:u,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})};if(n.credential)return await a(n.credential);if(typeof navigator>`u`||!navigator.credentials||typeof navigator.credentials.get!=`function`)throw Error(`[WebAuthnP256Engine] WebAuthn not available (must run in a browser context)`);let o=new Uint8Array(n.challenge32),s=new Uint8Array(i.credentialId);this.beforeSigning?.();let c=await navigator.credentials.get({publicKey:{challenge:o,allowCredentials:[{type:`public-key`,id:s}],rpId:n.rpId??i.rpId,userVerification:`preferred`}});if(!c)throw Error(`[WebAuthnP256Engine] user cancelled WebAuthn assertion`);if(!r(new Uint8Array(c.rawId),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn assertion returned unexpected credentialId`);let l=c.response;if(!l||!l.authenticatorData||!l.clientDataJSON||!l.signature)throw Error(`[WebAuthnP256Engine] invalid WebAuthn assertion response`);let u=new Uint8Array(l.authenticatorData),d=new Uint8Array(l.clientDataJSON),f=new Uint8Array(l.signature);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:u,clientDataJSON:d,signatureDer:f,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})}};export{i as WebAuthnP256Engine};
+import{r as e,t}from"./base64-BmKR3UqU.js";import{n}from"./evmCryptoWasm-DeobzyP-.js";function r(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n++)if(e[n]!==t[n])return!1;return!0}var i=class{algorithm=`webauthnP256`;constructor(e,t){this.workerCtx=e,this.beforeSigning=t}async buildWebauthnSignature(e){if(!this.workerCtx)throw Error(`[WebAuthnP256Engine] workerCtx is required for wasm-backed WebAuthn signature packing`);return await n({challenge32:e.challenge32,authenticatorData:e.authenticatorData,clientDataJSON:e.clientDataJSON,signatureDer:e.signatureDer,pubKeyX32:e.pubKeyX32,pubKeyY32:e.pubKeyY32,workerCtx:this.workerCtx})}async sign(n,i){if(n.kind!==`webauthn`||n.algorithm!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] unsupported sign request`);if(n.challenge32.length!==32)throw Error(`[WebAuthnP256Engine] challenge32 must be 32 bytes`);if(i.type!==`webauthnP256`)throw Error(`[WebAuthnP256Engine] keyRef must be webauthnP256`);if(i.pubKeyX.length!==32||i.pubKeyY.length!==32)throw Error(`[WebAuthnP256Engine] pubKeyX/pubKeyY must be 32 bytes each`);if(i.credentialId.length===0)throw Error(`[WebAuthnP256Engine] credentialId must be non-empty`);let a=async a=>{let o=a&&typeof a==`object`?a:{};if(!r(t(String(o.rawId||``).trim()),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn credential rawId does not match keyRef`);let s=o.response,c=e(String(s?.authenticatorData||``)),l=e(String(s?.clientDataJSON||``)),u=e(String(s?.signature||``));if(c.length===0||l.length===0||u.length===0)throw Error(`[WebAuthnP256Engine] missing authenticatorData/clientDataJSON/signature in credential`);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:c,clientDataJSON:l,signatureDer:u,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})};if(n.credential)return await a(n.credential);if(typeof navigator>`u`||!navigator.credentials||typeof navigator.credentials.get!=`function`)throw Error(`[WebAuthnP256Engine] WebAuthn not available (must run in a browser context)`);let o=new Uint8Array(n.challenge32),s=new Uint8Array(i.credentialId);this.beforeSigning?.();let c=await navigator.credentials.get({publicKey:{challenge:o,allowCredentials:[{type:`public-key`,id:s}],rpId:n.rpId??i.rpId,userVerification:`preferred`}});if(!c)throw Error(`[WebAuthnP256Engine] user cancelled WebAuthn assertion`);if(!r(new Uint8Array(c.rawId),i.credentialId))throw Error(`[WebAuthnP256Engine] WebAuthn assertion returned unexpected credentialId`);let l=c.response;if(!l||!l.authenticatorData||!l.clientDataJSON||!l.signature)throw Error(`[WebAuthnP256Engine] invalid WebAuthn assertion response`);let u=new Uint8Array(l.authenticatorData),d=new Uint8Array(l.clientDataJSON),f=new Uint8Array(l.signature);return await this.buildWebauthnSignature({challenge32:n.challenge32,authenticatorData:u,clientDataJSON:d,signatureDer:f,pubKeyX32:i.pubKeyX,pubKeyY32:i.pubKeyY})}};export{i as WebAuthnP256Engine};

package/dist/public/sdk/{webauthnPromptCoordinator-D5sP8Q7e.js → webauthnPromptCoordinator-9bVeHcTZ.js}

@@ -1 +1 @@
-import{t as e}from"./secureRandomId-LwBFx84B.js";var t=class extends Error{code;constructor(e,t){super(t),this.name=`WebAuthnPromptCoordinatorError`,this.code=e}};function n(e,t){switch(e.kind){case`registration_modal`:return t.kind===`registration_modal`&&e.requestId===t.requestId;case`hosted_auth_menu_registration`:return t.kind===`hosted_auth_menu_registration`&&e.authMenuSessionId===t.authMenuSessionId&&e.requestId===t.requestId;default:return r(e)}}function r(e){throw Error(`Unknown registration WebAuthn prompt owner: ${String(e)}`)}function i(){return`webauthn-reservation-${e(18,`WebAuthn reservation IDs`)}`}function a(){return`webauthn-operation-${e(18,`WebAuthn operation IDs`)}`}const o=new class{state={kind:`idle`};idleWaiters=new Set;reservationExpiryTimer=null;consumedReservationIds=new Set;async reserveRegistrationPrompt(e){if(this.throwIfReservationCancelled(e.cancellation),Date.now()>=e.expiresAtMs)throw new t(`webauthn_prompt_reservation_expired`,`WebAuthn prompt reservation expired before acquisition`);for(;this.state.kind!==`idle`;)await this.waitUntilIdle(e.expiresAtMs,e.cancellation),this.throwIfReservationCancelled(e.cancellation);let n={kind:`reserved_registration_webauthn_prompt_v1`,reservationId:i(),owner:e.owner,expiresAtMs:e.expiresAtMs};return this.state={kind:`reserved`,reservation:n},this.armReservationExpiry(n),n}releaseReservation(e){this.state.kind===`reserved`&&this.state.reservation.reservationId===e.reservationId&&(this.clearReservationExpiry(),this.state={kind:`idle`},this.notifyIdle())}isLiveReservation(e){return Date.now()<e.reservation.expiresAtMs&&this.state.kind===`reserved`&&this.state.reservation.reservationId===e.reservation.reservationId&&n(e.reservation.owner,e.owner)}runReserved(e){this.assertLiveReservation(e.reservation,e.owner);let t=a();return this.consumedReservationIds.add(e.reservation.reservationId),this.clearReservationExpiry(),this.state={kind:`running`,operationId:t,owner:e.owner},this.startOperation(t,e.operation)}runImmediate(e){if(this.state.kind!==`idle`)throw new t(`webauthn_prompt_busy`,`Another WebAuthn prompt owns the coordinator`);let n=a();return this.state={kind:`running`,operationId:n,owner:e.owner},this.startOperation(n,e.operation)}startOperation(e,t){let n;try{n=t()}catch(t){throw this.finishOperation(e),t}let r=this.finishOperation.bind(this,e);return n.then(r,r),n}assertLiveReservation(e,r){if(this.consumedReservationIds.has(e.reservationId))throw new t(`webauthn_prompt_reservation_reused`,`WebAuthn prompt reservation was already consumed`);if(Date.now()>=e.expiresAtMs)throw this.releaseReservation(e),new t(`webauthn_prompt_reservation_expired`,`WebAuthn prompt reservation expired`);if(this.state.kind!==`reserved`||this.state.reservation.reservationId!==e.reservationId)throw new t(`webauthn_prompt_reservation_reused`,`WebAuthn prompt reservation is no longer active`);if(!n(e.owner,r))throw new t(`webauthn_prompt_reservation_owner_mismatch`,`WebAuthn prompt reservation owner does not match`)}finishOperation(e){this.state.kind!==`running`||this.state.operationId!==e||(this.state={kind:`idle`},this.notifyIdle())}waitUntilIdle(e,n){let r=Math.max(1,e-Date.now());return new Promise((e,i)=>{let a={resolve:e,reject:i,signal:n.kind===`abort_signal`?n.signal:null,onAbort:null,timer:setTimeout(()=>{this.idleWaiters.delete(a),this.removeWaiterAbortListener(a),i(new t(`webauthn_prompt_reservation_expired`,`WebAuthn prompt reservation expired while waiting for the coordinator`))},r)};a.signal&&(a.onAbort=()=>{this.idleWaiters.delete(a),clearTimeout(a.timer),this.removeWaiterAbortListener(a),i(Error(`WebAuthn prompt reservation acquisition cancelled`))},a.signal.addEventListener(`abort`,a.onAbort,{once:!0})),this.idleWaiters.add(a)})}notifyIdle(){for(let e of this.idleWaiters)clearTimeout(e.timer),this.removeWaiterAbortListener(e),e.resolve();this.idleWaiters.clear()}armReservationExpiry(e){this.clearReservationExpiry(),this.reservationExpiryTimer=setTimeout(this.releaseReservation.bind(this,e),Math.max(1,e.expiresAtMs-Date.now()))}clearReservationExpiry(){this.reservationExpiryTimer!==null&&(clearTimeout(this.reservationExpiryTimer),this.reservationExpiryTimer=null)}throwIfReservationCancelled(e){if(e.kind===`abort_signal`&&e.signal.aborted)throw Error(`WebAuthn prompt reservation acquisition cancelled`)}removeWaiterAbortListener(e){!e.signal||!e.onAbort||(e.signal.removeEventListener(`abort`,e.onAbort),e.onAbort=null)}};export{o as t};
+import{t as e}from"./secureRandomId-8LSc91aN.js";var t=class extends Error{code;constructor(e,t){super(t),this.name=`WebAuthnPromptCoordinatorError`,this.code=e}};function n(e,t){switch(e.kind){case`registration_modal`:return t.kind===`registration_modal`&&e.requestId===t.requestId;case`hosted_auth_menu_registration`:return t.kind===`hosted_auth_menu_registration`&&e.authMenuSessionId===t.authMenuSessionId&&e.requestId===t.requestId;default:return r(e)}}function r(e){throw Error(`Unknown registration WebAuthn prompt owner: ${String(e)}`)}function i(){return`webauthn-reservation-${e(18,`WebAuthn reservation IDs`)}`}function a(){return`webauthn-operation-${e(18,`WebAuthn operation IDs`)}`}const o=new class{state={kind:`idle`};idleWaiters=new Set;reservationExpiryTimer=null;consumedReservationIds=new Set;async reserveRegistrationPrompt(e){if(this.throwIfReservationCancelled(e.cancellation),Date.now()>=e.expiresAtMs)throw new t(`webauthn_prompt_reservation_expired`,`WebAuthn prompt reservation expired before acquisition`);for(;this.state.kind!==`idle`;)await this.waitUntilIdle(e.expiresAtMs,e.cancellation),this.throwIfReservationCancelled(e.cancellation);let n={kind:`reserved_registration_webauthn_prompt_v1`,reservationId:i(),owner:e.owner,expiresAtMs:e.expiresAtMs};return this.state={kind:`reserved`,reservation:n},this.armReservationExpiry(n),n}releaseReservation(e){this.state.kind===`reserved`&&this.state.reservation.reservationId===e.reservationId&&(this.clearReservationExpiry(),this.state={kind:`idle`},this.notifyIdle())}isLiveReservation(e){return Date.now()<e.reservation.expiresAtMs&&this.state.kind===`reserved`&&this.state.reservation.reservationId===e.reservation.reservationId&&n(e.reservation.owner,e.owner)}runReserved(e){this.assertLiveReservation(e.reservation,e.owner);let t=a();return this.consumedReservationIds.add(e.reservation.reservationId),this.clearReservationExpiry(),this.state={kind:`running`,operationId:t,owner:e.owner},this.startOperation(t,e.operation)}runImmediate(e){if(this.state.kind!==`idle`)throw new t(`webauthn_prompt_busy`,`Another WebAuthn prompt owns the coordinator`);let n=a();return this.state={kind:`running`,operationId:n,owner:e.owner},this.startOperation(n,e.operation)}startOperation(e,t){let n;try{n=t()}catch(t){throw this.finishOperation(e),t}let r=this.finishOperation.bind(this,e);return n.then(r,r),n}assertLiveReservation(e,r){if(this.consumedReservationIds.has(e.reservationId))throw new t(`webauthn_prompt_reservation_reused`,`WebAuthn prompt reservation was already consumed`);if(Date.now()>=e.expiresAtMs)throw this.releaseReservation(e),new t(`webauthn_prompt_reservation_expired`,`WebAuthn prompt reservation expired`);if(this.state.kind!==`reserved`||this.state.reservation.reservationId!==e.reservationId)throw new t(`webauthn_prompt_reservation_reused`,`WebAuthn prompt reservation is no longer active`);if(!n(e.owner,r))throw new t(`webauthn_prompt_reservation_owner_mismatch`,`WebAuthn prompt reservation owner does not match`)}finishOperation(e){this.state.kind!==`running`||this.state.operationId!==e||(this.state={kind:`idle`},this.notifyIdle())}waitUntilIdle(e,n){let r=Math.max(1,e-Date.now());return new Promise((e,i)=>{let a={resolve:e,reject:i,signal:n.kind===`abort_signal`?n.signal:null,onAbort:null,timer:setTimeout(()=>{this.idleWaiters.delete(a),this.removeWaiterAbortListener(a),i(new t(`webauthn_prompt_reservation_expired`,`WebAuthn prompt reservation expired while waiting for the coordinator`))},r)};a.signal&&(a.onAbort=()=>{this.idleWaiters.delete(a),clearTimeout(a.timer),this.removeWaiterAbortListener(a),i(Error(`WebAuthn prompt reservation acquisition cancelled`))},a.signal.addEventListener(`abort`,a.onAbort,{once:!0})),this.idleWaiters.add(a)})}notifyIdle(){for(let e of this.idleWaiters)clearTimeout(e.timer),this.removeWaiterAbortListener(e),e.resolve();this.idleWaiters.clear()}armReservationExpiry(e){this.clearReservationExpiry(),this.reservationExpiryTimer=setTimeout(this.releaseReservation.bind(this,e),Math.max(1,e.expiresAtMs-Date.now()))}clearReservationExpiry(){this.reservationExpiryTimer!==null&&(clearTimeout(this.reservationExpiryTimer),this.reservationExpiryTimer=null)}throwIfReservationCancelled(e){if(e.kind===`abort_signal`&&e.signal.aborted)throw Error(`WebAuthn prompt reservation acquisition cancelled`)}removeWaiterAbortListener(e){!e.signal||!e.onAbort||(e.signal.removeEventListener(`abort`,e.onAbort),e.onAbort=null)}};export{o as t};