@seams/wallet 0.23.0 → 0.24.0

package/dist/esm/sdk/registration-CeOmKyCG.js

@@ -1 +0,0 @@
-import{n as e}from"./chunk-dVx5-UGu.js";import{D as t,I as n,M as r,N as i,O as a,R as o,S as s,T as c,h as l,i as u,j as d,o as f,r as p,s as m,w as h,x as g}from"./domainIds-C3fUa33Q.js";import{C as _,M as v,O as y,S as b,c as x,d as S,f as C,g as w,j as T,k as E,l as D,n as ee,t as O,u as k}from"./chains-CPmd4s9f.js";import{$ as A,J as j,K as M,N,X as P,Y as F,Z as te,a as I,i as ne,it as re,n as ie,q as ae,rt as oe}from"./activeWalletSession-BtEHhe99.js";import{i as L,r as R}from"./base64-BmKR3UqU.js";import{r as se}from"./secureRandomId-8LSc91aN.js";import{s as ce}from"./walletDbName-BVZhb4xF.js";import{c as le,d as ue,f as de,l as fe,s as pe,u as me}from"./signingSessionSeal-DqbjG8c8.js";import{d as he,g as ge,h as _e,m as ve}from"./capabilityKinds-CqHVzVsJ.js";import{i as ye,n as be,r as xe}from"./canonicalPrimitives-D_1HyEuJ.js";import{n as Se,o as Ce,t as we}from"./errors-CI1xdN0d.js";import{c as Te,d as Ee,r as De,t as z}from"./accountIds-BzZs7YoX.js";import{c as Oe,d as ke,i as Ae,l as je,n as Me,r as Ne,s as Pe}from"./registrationSignerPlan-B66FjqIp.js";import{a as Fe,c as Ie,i as Le,o as Re,r as ze,s as Be}from"./ecdsaChainTarget-svSlzhze.js";import{c as Ve,d as He,h as Ue,m as We,n as Ge,s as Ke}from"./signerDomain-YEHkugWX.js";import{D as qe,E as Je,O as Ye,T as Xe,j as Ze,v as Qe,w as $e,x as et,y as tt}from"./registrationIntent-DW_kKWlx.js";import{a as nt,i as rt,n as it,r as at}from"./presignatures-DGLNs29C.js";import{t as ot}from"./keyMaterialEnvelope-B3v6HLtz.js";import{B as st,F as ct,H as lt,J as ut,N as dt,P as ft,R as pt,Y as mt,at as ht,b as gt,lt as _t,nt as vt,ot as yt,q as bt,st as xt}from"./walletCapabilityBindings-CKOK39sP.js";import{$ as St,Bt as Ct,Ct as wt,Et as Tt,Ft as Et,It as Dt,Nt as Ot,Ot as kt,Rt as At,St as jt,T as Mt,Tt as Nt,Vt as Pt,Y as Ft,an as It,at as Lt,ct as Rt,dn as zt,et as Bt,ft as Vt,kt as Ht,ln as Ut,nn as Wt,st as Gt,tn as Kt,un as qt,w as Jt}from"./emailOtpEcdsaDerivationIdentity-DreNrM6n.js";import{r as Yt}from"./walletAuthMethodRecord-Cv_MYpxt.js";import{a as Xt,i as Zt,n as Qt,o as $t,t as en}from"./signerSlot-CpyIfl3J.js";import{A as tn,B as nn,I as rn,N as an,P as on,i as sn,j as cn}from"./ecdsaCapabilityManifest-B3u6J5gn.js";import{g as ln,i as B,p as un,s as dn}from"./sdkSentEvents-BzMVO1AR.js";import{A as fn,D as pn,E as mn,O as hn,T as gn,c as _n,g as vn,k as yn,l as V,o as bn,s as xn,w as Sn}from"./wallet-recovery-BEui57xM.js";import{n as Cn}from"./authenticatorOptions-BB_sU4uA.js";import{X as wn,j as Tn}from"./walletOwnershipGeneration-CQzaodhB.js";import{c as En,r as Dn}from"./types-BrEW276O.js";import{o as On}from"./walletSessionAuthorizationStore-DYRMCkiT.js";import{o as kn,u as An}from"./helpers-BXezXx19.js";import{i as jn}from"./profileAccountProjection-C1z9sKHa.js";import{M as Mn,d as Nn,f as Pn,p as Fn,u as In}from"./accountLifecycle-CXTlwnAS.js";import{c as Ln,r as Rn}from"./walletCustodyEcdsaContinuity-5XsLsT8D.js";import{D as zn,S as Bn,T as Vn,b as Hn,c as Un,d as Wn,f as Gn,k as Kn,m as qn,n as Jn,r as Yn,s as Xn,t as Zn,u as Qn,v as $n,w as er,x as tr}from"./nearEd25519YaoMaterialActivation-BK8_DxHs.js";import{A as nr,a as rr,d as ir,f as ar,j as or,o as sr,u as cr}from"./nearEd25519YaoSigningPreparation-BgCxoh9S.js";import{n as lr}from"./lanes-l274pbT5.js";import{i as ur,n as dr,o as fr,t as pr}from"./pendingWalletRecoveryCodeBackup-LbstFwcY.js";import{t as mr}from"./walletSessionAuthorizationStatus-_KtCVFYW.js";import{n as hr}from"./prfCache-D25ZCg5n.js";import{u as gr}from"./trace-CWTzEALZ.js";import{t as _r}from"./webauthnPromptCoordinator-CBkTiMP0.js";import{t as vr}from"./intentDigest--FZ63NBy.js";import{n as yr}from"./challengeDelivery-C88JNwKf.js";import{n as br}from"./walletSessionAuthorizationProjection-UdGeS6x3.js";function xr(){return Reflect.get(globalThis,`__SEAMS_REGISTRATION_BENCHMARK_DIAGNOSTICS`)===!0}function Sr(){}function Cr(e){if(e.keySet!==`near_ed25519_v1`)throw Error(`The custody worker began an EVM run for a NEAR request`);return e}function wr(e){if(e.keySet!==`evm_family_ecdsa_v1`)throw Error(`The custody worker began a NEAR run for an EVM request`);return e}function Tr(e){if(e.keySet!==`evm_family_ecdsa_v1`)throw Error(`The custody worker completed a NEAR run for an EVM request`);return e}function Er(e){switch(e.origin){case`establish`:case`establish_factor_after_round`:return{origin:`establish`,walletId:e.walletId};case`join`:return{origin:`join`,custodyJson:e.custodyJson,factorSecret:e.factorSecret};case`recover`:return{origin:`recover`,custodyJson:e.custodyJson,recoveryCode:e.recoveryCode};case`recover_and_reseal`:return{origin:`recover_and_reseal`,custodyJson:e.custodyJson,recoveryCode:e.recoveryCode,replacementFactorJson:e.replacementFactorJson,replacementFactorSecret:e.replacementFactorSecret};default:return Or(e)}}async function Dr(e){switch(e.origin){case`establish`:return{kind:`establish`,factorJson:e.factorJson,factorSecret:e.factorSecret,recoveryCodesJson:e.recoveryCodesJson};case`establish_factor_after_round`:{let t=await e.factor();return{kind:`establish`,factorJson:t.factorJson,factorSecret:t.factorSecret,recoveryCodesJson:e.recoveryCodesJson}}case`join`:case`recover`:return{kind:`existing`};case`recover_and_reseal`:return{kind:`recover_reseal`,replacementFactorJson:e.replacementFactorJson,replacementFactorSecret:e.replacementFactorSecret};default:return Or(e)}}function Or(e){throw Error(`Unsupported wallet custody origin: ${String(e)}`)}function kr(e,t){if(e.walletId!==t.activation.walletId)throw Error(`EVM custody activation changed the wallet identity`);if(e.keyManifestDigestB64u!==t.activation.keyManifestDigestB64u)throw Error(`EVM custody activation changed the key manifest digest`);if(e.clientRootPublicKey33B64u!==t.activation.clientRootPublicKey33B64u)throw Error(`EVM custody activation changed the client root public key`)}function Ar(e,t,n){if(xr())try{console.info(`[WalletCustody] timing `+JSON.stringify({event:`wallet_custody_timing`,ceremonyId:e,stage:`custody.${t}`,durationMs:Math.round((performance.now()-n)*10)/10,outcome:`success`}))}catch{}}async function jr(e){let t=e.ceremonyId||se(`wallet-custody-ceremony`,32,`wallet custody ceremony IDs`),{custody:n,keySetRun:r}=e,i=!1;try{if(r.keySet===`near_ed25519_v1`){let a=performance.now(),o;if(r.checkpointJson!==void 0){if(n.origin!==`join`)throw Error(`Checkpoint restoration requires existing custody`);o=(await e.runStep(`restoreNearRegistration`,{ceremonyId:t,custodyJson:n.custodyJson,factorSecret:n.factorSecret,checkpointJson:r.checkpointJson})).yaoExecuteRequestJson}else o=Cr(await e.runStep(`beginWalletCustodyKeySetRun`,{ceremonyId:t,keySet:`near_ed25519_v1`,custody:Er(n),protocolInputsJson:r.protocolInputsJson})).yaoExecuteRequestJson;if(Ar(t,`begin`,a),i=!0,r.beforeRouterRound){a=performance.now();let n=await e.runStep(`checkpointNearRegistration`,{ceremonyId:t});Ar(t,`checkpoint`,a),await r.beforeRouterRound(n.checkpointJson)}a=performance.now();let s=await r.runRouterRound(o);Ar(t,`router_round`,a),a=performance.now(),await e.runStep(`completeWalletCustodyKeySetRun`,{ceremonyId:t,keySet:`near_ed25519_v1`,protocolResultJson:s,nearEd25519SigningKeyId:r.nearEd25519SigningKeyId,recordedKeyManifestDigestB64u:e.recordedKeyManifestDigestB64u}),Ar(t,`complete`,a),await r.afterRouterRoundCompleted?.(s),a=performance.now();let c=await e.runStep(`finishWalletCustodyKeySetRun`,{ceremonyId:t,finish:await Dr(n)});return Ar(t,`finish`,a),c}if(n.origin===`establish_factor_after_round`)throw Error(`An EVM custody run seals under its factor before the relayer round`);let a=await e.runStep(`beginWalletCustodyKeySetRun`,{ceremonyId:t,keySet:`evm_family_ecdsa_v1`,custody:n,protocolInputsJson:r.protocolInputsJson,evmFamilySigningKeySlotId:r.evmFamilySigningKeySlotId,recordedKeyManifestDigestB64u:e.recordedKeyManifestDigestB64u});i=!0;let o=wr(a);await r.beforeRelayerRound();let s=await r.runRelayerRound({contextBinding32B64u:o.ecdsaContextBinding32B64u,clientSharePublicKey33B64u:o.ecdsaClientSharePublicKey33B64u,clientShareRetryCounter:o.ecdsaClientShareRetryCounter,preActivationCommitPayload:o.preActivationCommitPayload}),c=Tr(await e.runStep(`completeWalletCustodyKeySetRun`,{ceremonyId:t,keySet:`evm_family_ecdsa_v1`,protocolResultJson:s}));return kr(o.preActivationCommitPayload,c),{...o.preActivationCommitPayload,clientRootPublicKey33B64u:c.activation.clientRootPublicKey33B64u,ecdsaReadyStateBlobB64u:c.activation.ecdsaReadyStateBlobB64u,ecdsaPublicFacts:c.activation.ecdsaPublicFacts}}catch(n){throw i&&await e.runStep(`discardWalletCustodyCeremony`,{ceremonyId:t}).catch(Sr),n}}const Mr=[1,2];function Nr(e){let t=[],n=new Set;for(let r of e){let e=O(r.network);if(e!==`evm`&&e!==`tempo`)continue;let i=Le(r),a=Re(i);n.has(a)||(n.add(a),t.push({chainTarget:i}))}return t}function Pr(e){let t=[],n=new Set;for(let r of e.chains){let i=O(r.network);if(i!==`evm`&&i!==`tempo`||!(i===`tempo`?e.signerOptions.tempo:e.signerOptions.evm).enabled)continue;let a=Le(r),o=Re(a);n.has(o)||(n.add(o),t.push({chainTarget:a}))}return t}function Fr(e){for(let t of e.signers)if(t.kind===`near_ed25519`)return!0;return!1}function Ir(e){let t=e.ecdsaChainTargets??Rr(e.configs,e.options);return zr(e.accountProvisioning??Ae(),t)}function Lr(e){let t=null;for(let n of e.configs.network.chains)if(ee(n.network)){t=Hr(e);break}return zr(t,Rr(e.configs,e.options))}function Rr(e,t){let n=Pr({signerOptions:t.signerOptions??e.signing.thresholdEcdsa.provisioningDefaults,chains:e.network.chains}),r=[];for(let e of n)r.push(e.chainTarget);return r}function zr(e,t){let n=[];if(e&&n.push({kind:`near_ed25519`,accountProvisioning:e,signerSlot:1,participantIds:[...te],derivationVersion:1}),t.length&&n.push({kind:`evm_family_ecdsa`,chainTargets:[...t],participantIds:[...Mr]}),!n.length)throw Error(`Wallet registration requires at least one configured, enabled signer`);return{kind:`signer_set`,signers:n}}function Br(e){let t=Te(e);if(!t.ok)throw Error(t.message);return ke(t.value)}function Vr(e){let t=String(e.walletId||``).trim(),n=String(e.relayerAccountId||``).trim();if(!t)throw Error(`Relayer named NEAR registration requires walletId`);if(!n)throw Error(`Relayer named NEAR registration requires relayer accountId`);return Br(`${t}.${n}`)}function Hr(e){let t=e.preference??e.configs.registration.nearAccountProvisioning;switch(t.kind){case`implicit_account`:return Ae();case`relayer_named_subaccount`:if(e.wallet.kind!==`provided`)throw Error(`Relayer named NEAR registration requires a provided walletId`);return Vr({walletId:e.wallet.walletId,relayerAccountId:e.configs.network.relayer.accountId});default:return t}}function Ur(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<1)throw Error(`${t} must be a positive integer`);return e}function Wr(e,t){let n=s(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function Gr(e,t){if(!Array.isArray(e)||e.length!==32)throw Error(`${t} must contain exactly 32 bytes`);let n=[];for(let r of e){if(typeof r!=`number`||!Number.isInteger(r)||r<0||r>255)throw Error(`${t} must contain exactly 32 bytes`);n.push(r)}return Object.freeze(n)}function Kr(e,t){if(!Array.isArray(e)||e.length===0)throw Error(`${t} must contain bytes`);return e.map(e=>{if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`${t} must contain bytes`);return e})}function qr(e){if(!Array.isArray(e)||e.length!==2||!Number.isSafeInteger(e[0])||!Number.isSafeInteger(e[1])||e[0]<1||e[1]<1||e[0]===e[1])throw Error(`participantIds must contain two distinct positive integers`);return[Number(e[0]),Number(e[1])]}function Jr(e){let t=E(e,`capability.registrationContinuity`);if(t.kind===`recovery`)return{kind:`recovery`,activationTranscript:Kr(t.activationTranscript,`capability.registrationContinuity.activationTranscript`)};if(t.kind!==`registration`)throw Error(`capability.registrationContinuity kind is invalid`);let n=ht(t.admissionRequest),r=vt(t.admissionReceipt);if(!n.ok)throw Error(`capability registration continuity transcript is invalid: ${n.message}`);if(!r.ok)throw Error(`capability registration continuity transcript is invalid: ${r.message}`);return{kind:`registration`,admissionRequest:n.value,admissionReceipt:r.value,activationTranscript:Kr(t.activationTranscript,`capability.registrationContinuity.activationTranscript`)}}function Yr(e){let t=E(e,`capability`);if(t.kind!==`router_ab_ed25519_yao_active_capability_v1`)throw Error(`Yao recovery capability kind is invalid`);let n=E(t.applicationBinding,`capability.applicationBinding`),r=E(t.lifecycle,`capability.lifecycle`),i;try{i=Ut(t.materialActivation)}catch(e){throw Error(`capability.materialActivation is invalid: ${e instanceof Error?e.message:String(e)}`)}return{materialActivation:i,activeCapabilityBinding:Gr(t.activeCapabilityBinding,`capability.activeCapabilityBinding`),registeredPublicKey:Gr(t.registeredPublicKey,`capability.registeredPublicKey`),nearAccountId:z(T(t.nearAccountId,`capability.nearAccountId`)),applicationBinding:{wallet_id:T(n.wallet_id,`applicationBinding.wallet_id`),near_ed25519_signing_key_id:T(n.near_ed25519_signing_key_id,`applicationBinding.near_ed25519_signing_key_id`),signing_root_id:T(n.signing_root_id,`applicationBinding.signing_root_id`),key_creation_signer_slot:Ur(n.key_creation_signer_slot,`applicationBinding.key_creation_signer_slot`)},participantIds:qr(t.participantIds),runtimePolicyScope:j(E(t.runtimePolicyScope,`capability.runtimePolicyScope`)),lifecycle:{lifecycleId:T(r.lifecycleId,`lifecycle.lifecycleId`),rootShareEpoch:T(r.rootShareEpoch,`lifecycle.rootShareEpoch`),accountId:T(r.accountId,`lifecycle.accountId`),thresholdSessionId:Wr(T(r.thresholdSessionId,`lifecycle.thresholdSessionId`),`lifecycle.thresholdSessionId`),signerSetId:T(r.signerSetId,`lifecycle.signerSetId`),signingWorkerId:T(r.signingWorkerId,`lifecycle.signingWorkerId`)},stateEpoch:Ur(t.stateEpoch,`capability.stateEpoch`),registrationContinuity:Jr(t.registrationContinuity)}}var Xr=class e{static __wrap(t){let n=Object.create(e.prototype);return n.__wbg_ptr=t,si.register(n,n.__wbg_ptr,n),n}__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,si.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmactivatedclientv1_free(e,0)}create_signing_share(e,t,n,r,i){let a=H(n,K.__wbindgen_malloc),o=G,s=U(r,K.__wbindgen_malloc,K.__wbindgen_realloc),c=G,l=H(i,K.__wbindgen_malloc),u=G,d=K.wasmactivatedclientv1_create_signing_share(this.__wbg_ptr,e,t,a,o,s,c,l,u);if(d[2])throw W(d[1]);return Zr.__wrap(d[0])}static import_linked_material(t,n,r,i){let a=H(t,K.__wbindgen_malloc),o=G,s=U(i,K.__wbindgen_malloc,K.__wbindgen_realloc),c=G,l=K.wasmactivatedclientv1_import_linked_material(a,o,n,r,s,c);if(l[2])throw W(l[1]);return e.__wrap(l[0])}static import_local_material(t,n,r,i,a,o,s,c,l){let u=H(t,K.__wbindgen_malloc),d=G,f=H(n,K.__wbindgen_malloc),p=G,m=H(r,K.__wbindgen_malloc),h=G,g=H(i,K.__wbindgen_malloc),_=G,v=H(a,K.__wbindgen_malloc),y=G,b=H(l,K.__wbindgen_malloc),x=G,S=K.wasmactivatedclientv1_import_local_material(u,d,f,p,m,h,g,_,v,y,o,s,c,b,x);if(S[2])throw W(S[1]);return e.__wrap(S[0])}registered_public_key(){let e=K.wasmactivatedclientv1_registered_public_key(this.__wbg_ptr);var t=yi(e[0],e[1]).slice();return K.__wbindgen_free(e[0],e[1]*1,1),t}seal_local_material(e,t,n){let r=H(e,K.__wbindgen_malloc),i=G,a=H(t,K.__wbindgen_malloc),o=G,s=H(n,K.__wbindgen_malloc),c=G,l=K.wasmactivatedclientv1_seal_local_material(this.__wbg_ptr,r,i,a,o,s,c);if(l[3])throw W(l[2]);var u=yi(l[0],l[1]).slice();return K.__wbindgen_free(l[0],l[1]*1,1),u}state_epoch(){let e=K.wasmactivatedclientv1_state_epoch(this.__wbg_ptr);return BigInt.asUintN(64,e)}};Symbol.dispose&&(Xr.prototype[Symbol.dispose]=Xr.prototype.free);var Zr=class e{static __wrap(t){let n=Object.create(e.prototype);return n.__wbg_ptr=t,ci.register(n,n.__wbg_ptr,n),n}__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,ci.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmclientsigningsharev1_free(e,0)}client_commitments_json(){let e,t;try{let n=K.wasmclientsigningsharev1_client_commitments_json(this.__wbg_ptr);return e=n[0],t=n[1],Si(n[0],n[1])}finally{K.__wbindgen_free(e,t,1)}}client_signature_share_b64u(){let e,t;try{let n=K.wasmclientsigningsharev1_client_signature_share_b64u(this.__wbg_ptr);return e=n[0],t=n[1],Si(n[0],n[1])}finally{K.__wbindgen_free(e,t,1)}}client_verifying_share(){let e=K.wasmclientsigningsharev1_client_verifying_share(this.__wbg_ptr);var t=yi(e[0],e[1]).slice();return K.__wbindgen_free(e[0],e[1]*1,1),t}};Symbol.dispose&&(Zr.prototype[Symbol.dispose]=Zr.prototype.free);var Qr=class{__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,li.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmed25519yaoclientrootexportsessionv1_free(e,0)}complete(e){let t=U(e,K.__wbindgen_malloc,K.__wbindgen_realloc),n=G,r=K.wasmed25519yaoclientrootexportsessionv1_complete(this.__wbg_ptr,t,n);if(r[2])throw W(r[1]);return ni.__wrap(r[0])}execute_request_json(){let e,t;try{let n=K.wasmed25519yaoclientrootexportsessionv1_execute_request_json(this.__wbg_ptr);return e=n[0],t=n[1],Si(n[0],n[1])}finally{K.__wbindgen_free(e,t,1)}}constructor(e,t,n,r,i,a,o,s,c,l,u,d,f){let p=U(e,K.__wbindgen_malloc,K.__wbindgen_realloc),m=G,h=U(t,K.__wbindgen_malloc,K.__wbindgen_realloc),g=G,_=H(i,K.__wbindgen_malloc),v=G,y=U(a,K.__wbindgen_malloc,K.__wbindgen_realloc),b=G,x=H(o,K.__wbindgen_malloc),S=G,C=H(s,K.__wbindgen_malloc),w=G,T=H(c,K.__wbindgen_malloc),E=G,D=H(l,K.__wbindgen_malloc),ee=G,O=H(u,K.__wbindgen_malloc),k=G,A=H(d,K.__wbindgen_malloc),j=G,M=H(f,K.__wbindgen_malloc),N=G,P=K.wasmed25519yaoclientrootexportsessionv1_new(p,m,h,g,n,r,_,v,y,b,x,S,C,w,T,E,D,ee,O,k,A,j,M,N);if(P[2])throw W(P[1]);return this.__wbg_ptr=P[0],li.register(this,this.__wbg_ptr,this),this}};Symbol.dispose&&(Qr.prototype[Symbol.dispose]=Qr.prototype.free);var $r=class{__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,ui.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmed25519yaolaneclientv1_free(e,0)}complete(e){let t=K.wasmed25519yaolaneclientv1_complete(this.__wbg_ptr,e);if(t[2])throw W(t[1]);return W(t[0])}execute_request_json(){let e,t;try{let i=K.wasmed25519yaolaneclientv1_execute_request_json(this.__wbg_ptr);var n=i[0],r=i[1];if(i[3])throw n=0,r=0,W(i[2]);return e=n,t=r,Si(n,r)}finally{K.__wbindgen_free(e,t,1)}}constructor(){return this.__wbg_ptr=K.wasmed25519yaolaneclientv1_new(),ui.register(this,this.__wbg_ptr,this),this}prepare(e,t,n,r,i,a,o,s,c,l){_i(a,ei);let u=H(o,K.__wbindgen_malloc),d=G,f=H(s,K.__wbindgen_malloc),p=G,m=H(c,K.__wbindgen_malloc),h=G,g=H(l,K.__wbindgen_malloc),_=G,v=K.wasmed25519yaolaneclientv1_prepare(this.__wbg_ptr,e,t,n,r,i,a.__wbg_ptr,u,d,f,p,m,h,g,_);if(v[2])throw W(v[1]);return W(v[0])}};Symbol.dispose&&($r.prototype[Symbol.dispose]=$r.prototype.free);var ei=class e{static __wrap(t){let n=Object.create(e.prototype);return n.__wbg_ptr=t,di.register(n,n.__wbg_ptr,n),n}__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,di.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmed25519yaolanesourcev1_free(e,0)}constructor(e,t,n,r,i,a){let o=H(e,K.__wbindgen_malloc),s=G,c=U(t,K.__wbindgen_malloc,K.__wbindgen_realloc),l=G,u=H(n,K.__wbindgen_malloc),d=G,f=H(r,K.__wbindgen_malloc),p=G,m=H(i,K.__wbindgen_malloc),h=G,g=H(a,K.__wbindgen_malloc),_=G,v=K.wasmed25519yaolanesourcev1_new(o,s,c,l,u,d,f,p,m,h,g,_);if(v[2])throw W(v[1]);return this.__wbg_ptr=v[0],di.register(this,this.__wbg_ptr,this),this}};Symbol.dispose&&(ei.prototype[Symbol.dispose]=ei.prototype.free);var ti=class{__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,fi.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmed25519yaosourcepreservingregistrationsessionv1_free(e,0)}constructor(e,t,n,r,i,a,o,s,c){_i(i,ei);let l=H(a,K.__wbindgen_malloc),u=G,d=H(o,K.__wbindgen_malloc),f=G,p=H(s,K.__wbindgen_malloc),m=G,h=H(c,K.__wbindgen_malloc),g=G,_=K.wasmed25519yaosourcepreservingregistrationsessionv1_new(e,t,n,r,i.__wbg_ptr,l,u,d,f,p,m,h,g);if(_[2])throw W(_[1]);return this.__wbg_ptr=_[0],fi.register(this,this.__wbg_ptr,this),this}take_execute_request_json(){let e,t;try{let i=K.wasmed25519yaosourcepreservingregistrationsessionv1_take_execute_request_json(this.__wbg_ptr);var n=i[0],r=i[1];if(i[3])throw n=0,r=0,W(i[2]);return e=n,t=r,Si(n,r)}finally{K.__wbindgen_free(e,t,1)}}};Symbol.dispose&&(ti.prototype[Symbol.dispose]=ti.prototype.free);var ni=class e{static __wrap(t){let n=Object.create(e.prototype);return n.__wbg_ptr=t,pi.register(n,n.__wbg_ptr,n),n}__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,pi.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmexporteded25519seedv1_free(e,0)}take_export_artifact_json(){let e,t;try{let i=K.wasmexporteded25519seedv1_take_export_artifact_json(this.__wbg_ptr);var n=i[0],r=i[1];if(i[3])throw n=0,r=0,W(i[2]);return e=n,t=r,Si(n,r)}finally{K.__wbindgen_free(e,t,1)}}};Symbol.dispose&&(ni.prototype[Symbol.dispose]=ni.prototype.free);var ri=class{__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,mi.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmordinaryed25519activationclientmaterialv1_free(e,0)}destroy(){K.wasmordinaryed25519activationclientmaterialv1_destroy(this.__wbg_ptr)}constructor(e,t,n,r,i,a){let o=U(e,K.__wbindgen_malloc,K.__wbindgen_realloc),s=G,c=U(t,K.__wbindgen_malloc,K.__wbindgen_realloc),l=G,u=U(n,K.__wbindgen_malloc,K.__wbindgen_realloc),d=G,f=H(r,K.__wbindgen_malloc),p=G,m=U(i,K.__wbindgen_malloc,K.__wbindgen_realloc),h=G,g=U(a,K.__wbindgen_malloc,K.__wbindgen_realloc),_=G,v=K.wasmordinaryed25519activationclientmaterialv1_new(o,s,c,l,u,d,f,p,m,h,g,_);if(v[2])throw W(v[1]);return this.__wbg_ptr=v[0],mi.register(this,this.__wbg_ptr,this),this}take_client_material(){let e=K.wasmordinaryed25519activationclientmaterialv1_take_client_material(this.__wbg_ptr);if(e[3])throw W(e[2]);var t=yi(e[0],e[1]).slice();return K.__wbindgen_free(e[0],e[1]*1,1),t}};Symbol.dispose&&(ri.prototype[Symbol.dispose]=ri.prototype.free);var ii=class{__destroy_into_raw(){let e=this.__wbg_ptr;return this.__wbg_ptr=0,hi.unregister(this),e}free(){let e=this.__destroy_into_raw();K.__wbg_wasmwalletcustodyseedexportsessionv1_free(e,0)}complete(e){let t=U(e,K.__wbindgen_malloc,K.__wbindgen_realloc),n=G,r=K.wasmwalletcustodyseedexportsessionv1_complete(this.__wbg_ptr,t,n);if(r[2])throw W(r[1]);return ni.__wrap(r[0])}execute_request_json(){let e,t;try{let n=K.wasmwalletcustodyseedexportsessionv1_execute_request_json(this.__wbg_ptr);return e=n[0],t=n[1],Si(n[0],n[1])}finally{K.__wbindgen_free(e,t,1)}}constructor(e,t,n,r,i,a,o,s,c,l,u,d,f){let p=U(e,K.__wbindgen_malloc,K.__wbindgen_realloc),m=G,h=U(t,K.__wbindgen_malloc,K.__wbindgen_realloc),g=G,_=H(i,K.__wbindgen_malloc),v=G,y=U(a,K.__wbindgen_malloc,K.__wbindgen_realloc),b=G,x=H(o,K.__wbindgen_malloc),S=G,C=H(s,K.__wbindgen_malloc),w=G,T=H(c,K.__wbindgen_malloc),E=G,D=H(l,K.__wbindgen_malloc),ee=G,O=H(u,K.__wbindgen_malloc),k=G,A=H(d,K.__wbindgen_malloc),j=G,M=H(f,K.__wbindgen_malloc),N=G,P=K.wasmwalletcustodyseedexportsessionv1_new(p,m,h,g,n,r,_,v,y,b,x,S,C,w,T,E,D,ee,O,k,A,j,M,N);if(P[2])throw W(P[1]);return this.__wbg_ptr=P[0],hi.register(this,this.__wbg_ptr,this),this}};Symbol.dispose&&(ii.prototype[Symbol.dispose]=ii.prototype.free);function ai(e,t,n,r,i,a,o,s,c,l,u,d,f,p){let m=H(e,K.__wbindgen_malloc),h=G,g=U(t,K.__wbindgen_malloc,K.__wbindgen_realloc),_=G,v=H(n,K.__wbindgen_malloc),y=G,b=H(r,K.__wbindgen_malloc),x=G,S=H(i,K.__wbindgen_malloc),C=G,w=H(a,K.__wbindgen_malloc),T=G,E=H(o,K.__wbindgen_malloc),D=G,ee=H(s,K.__wbindgen_malloc),O=G,k=H(d,K.__wbindgen_malloc),A=G,j=H(f,K.__wbindgen_malloc),M=G,N=H(p,K.__wbindgen_malloc),P=G,F=K.openWalletCustodyEd25519MaterialV1(m,h,g,_,v,y,b,x,S,C,w,T,E,D,ee,O,c,l,u,k,A,j,M,N,P);if(F[2])throw W(F[1]);return Xr.__wrap(F[0])}function oi(){let e={__proto__:null,__wbg_Error_92b29b0548f8b746:function(e,t){return Error(Si(e,t))},__wbg_Number_9a4e0ecb0fa16705:function(e){return Number(e)},__wbg_String_8564e559799eccda:function(e,t){let n=U(String(t),K.__wbindgen_malloc,K.__wbindgen_realloc),r=G;xi().setInt32(e+4,r,!0),xi().setInt32(e+0,n,!0)},__wbg___wbindgen_bigint_get_as_i64_d968e41184ae354f:function(e,t){let n=t,r=typeof n==`bigint`?n:void 0;xi().setBigInt64(e+8,Ei(r)?BigInt(0):r,!0),xi().setInt32(e+0,!Ei(r),!0)},__wbg___wbindgen_boolean_get_fa956cfa2d1bd751:function(e){let t=e,n=typeof t==`boolean`?t:void 0;return Ei(n)?16777215:n?1:0},__wbg___wbindgen_debug_string_c25d447a39f5578f:function(e,t){let n=U(vi(t),K.__wbindgen_malloc,K.__wbindgen_realloc),r=G;xi().setInt32(e+4,r,!0),xi().setInt32(e+0,n,!0)},__wbg___wbindgen_in_aca499c5de7ff5e5:function(e,t){return e in t},__wbg___wbindgen_is_bigint_2f76dc55065b4273:function(e){return typeof e==`bigint`},__wbg___wbindgen_is_function_1ff95bcc5517c252:function(e){return typeof e==`function`},__wbg___wbindgen_is_object_a27215656b807791:function(e){let t=e;return typeof t==`object`&&!!t},__wbg___wbindgen_is_string_ea5e6cc2e4141dfe:function(e){return typeof e==`string`},__wbg___wbindgen_is_undefined_c05833b95a3cf397:function(e){return e===void 0},__wbg___wbindgen_jsval_eq_e659fcf7b0e32763:function(e,t){return e===t},__wbg___wbindgen_jsval_loose_eq_db4c3b15f63fc170:function(e,t){return e==t},__wbg___wbindgen_number_get_394265ed1e1b84ee:function(e,t){let n=t,r=typeof n==`number`?n:void 0;xi().setFloat64(e+8,Ei(r)?0:r,!0),xi().setInt32(e+0,!Ei(r),!0)},__wbg___wbindgen_string_get_b0ca35b86a603356:function(e,t){let n=t,r=typeof n==`string`?n:void 0;var i=Ei(r)?0:U(r,K.__wbindgen_malloc,K.__wbindgen_realloc),a=G;xi().setInt32(e+4,a,!0),xi().setInt32(e+0,i,!0)},__wbg___wbindgen_throw_344f42d3211c4765:function(e,t){throw Error(Si(e,t))},__wbg_call_8a2dd23819f8a60a:function(){return Ti(function(e,t){return e.call(t)},arguments)},__wbg_call_a6e5c5dce5018821:function(){return Ti(function(e,t,n){return e.call(t,n)},arguments)},__wbg_crypto_38df2bab126b63dc:function(e){return e.crypto},__wbg_done_89b2b13e91a60321:function(e){return e.done},__wbg_entries_015dc610cd81ede0:function(e){return Object.entries(e)},__wbg_getRandomValues_c44a50d8cfdaebeb:function(){return Ti(function(e,t){e.getRandomValues(t)},arguments)},__wbg_get_507a50627bffa49b:function(e,t){return e[t>>>0]},__wbg_get_78f252d074a84d0b:function(){return Ti(function(e,t){return Reflect.get(e,t)},arguments)},__wbg_get_c7eb1f358a7654df:function(){return Ti(function(e,t){return Reflect.get(e,t)},arguments)},__wbg_get_unchecked_6e0ad6d2a41b06f6:function(e,t){return e[t>>>0]},__wbg_get_with_ref_key_6412cf3094599694:function(e,t){return e[t]},__wbg_instanceof_ArrayBuffer_4480b9e0068a8adb:function(e){let t;try{t=e instanceof ArrayBuffer}catch{t=!1}return t},__wbg_instanceof_Map_e5b5e3db98422fcc:function(e){let t;try{t=e instanceof Map}catch{t=!1}return t},__wbg_instanceof_Uint8Array_309b927aaf7a3fc7:function(e){let t;try{t=e instanceof Uint8Array}catch{t=!1}return t},__wbg_isArray_0677c962b281d01a:function(e){return Array.isArray(e)},__wbg_isSafeInteger_04f36e4056f1b851:function(e){return Number.isSafeInteger(e)},__wbg_iterator_6f722e4a93058b71:function(){return Symbol.iterator},__wbg_length_1f0964f4a5e2c6d8:function(e){return e.length},__wbg_length_370319915dc99107:function(e){return e.length},__wbg_msCrypto_bd5a034af96bcba6:function(e){return e.msCrypto},__wbg_new_cd45aabdf6073e84:function(e){return new Uint8Array(e)},__wbg_new_da52cf8fe3429cb2:function(){return{}},__wbg_new_with_length_e6785c33c8e4cce8:function(e){return new Uint8Array(e>>>0)},__wbg_next_6dbf2c0ac8cde20f:function(e){return e.next},__wbg_next_71f2aa1cb3d1e37e:function(){return Ti(function(e){return e.next()},arguments)},__wbg_node_84ea875411254db1:function(e){return e.node},__wbg_process_44c7a14e11e9f69e:function(e){return e.process},__wbg_prototypesetcall_4770620bbe4688a0:function(e,t,n){Uint8Array.prototype.set.call(yi(e,t),n)},__wbg_randomFillSync_6c25eac9869eb53c:function(){return Ti(function(e,t){e.randomFillSync(t)},arguments)},__wbg_require_b4edbdcf3e2a1ef0:function(){return Ti(function(){return module.require},arguments)},__wbg_set_6be42768c690e380:function(e,t,n){e[t]=n},__wbg_set_8535240470bf2500:function(){return Ti(function(e,t,n){return Reflect.set(e,t,n)},arguments)},__wbg_static_accessor_GLOBAL_4ef717fb391d88b7:function(){let e=typeof global>`u`?null:global;return Ei(e)?0:gi(e)},__wbg_static_accessor_GLOBAL_THIS_8d1badc68b5a74f4:function(){let e=typeof globalThis>`u`?null:globalThis;return Ei(e)?0:gi(e)},__wbg_static_accessor_SELF_146583524fe1469b:function(){let e=typeof self>`u`?null:self;return Ei(e)?0:gi(e)},__wbg_static_accessor_WINDOW_f2829a2234d7819e:function(){let e=typeof window>`u`?null:window;return Ei(e)?0:gi(e)},__wbg_subarray_3ed232c8a6baee09:function(e,t,n){return e.subarray(t>>>0,n>>>0)},__wbg_value_a5d5488a9589444a:function(e){return e.value},__wbg_versions_276b2795b1c6a219:function(e){return e.versions},__wbindgen_cast_0000000000000001:function(e){return e},__wbindgen_cast_0000000000000002:function(e){return e},__wbindgen_cast_0000000000000003:function(e,t){return yi(e,t)},__wbindgen_cast_0000000000000004:function(e,t){return Si(e,t)},__wbindgen_cast_0000000000000005:function(e){return BigInt.asUintN(64,e)},__wbindgen_init_externref_table:function(){let e=K.__wbindgen_externrefs,t=e.grow(4);e.set(0,void 0),e.set(t+0,void 0),e.set(t+1,null),e.set(t+2,!0),e.set(t+3,!1)}};return{__proto__:null,"./router_ab_ed25519_yao_client_bg.js":e}}const si=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmactivatedclientv1_free(e,1)),ci=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmclientsigningsharev1_free(e,1)),li=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmed25519yaoclientrootexportsessionv1_free(e,1)),ui=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmed25519yaolaneclientv1_free(e,1)),di=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmed25519yaolanesourcev1_free(e,1)),fi=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmed25519yaosourcepreservingregistrationsessionv1_free(e,1)),pi=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmexporteded25519seedv1_free(e,1)),mi=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmordinaryed25519activationclientmaterialv1_free(e,1)),hi=typeof FinalizationRegistry>`u`?{register:()=>{},unregister:()=>{}}:new FinalizationRegistry(e=>K.__wbg_wasmwalletcustodyseedexportsessionv1_free(e,1));function gi(e){let t=K.__externref_table_alloc();return K.__wbindgen_externrefs.set(t,e),t}function _i(e,t){if(!(e instanceof t))throw Error(`expected instance of ${t.name}`)}function vi(e){let t=typeof e;if(t==`number`||t==`boolean`||e==null)return`${e}`;if(t==`string`)return`"${e}"`;if(t==`symbol`){let t=e.description;return t==null?`Symbol`:`Symbol(${t})`}if(t==`function`){let t=e.name;return typeof t==`string`&&t.length>0?`Function(${t})`:`Function`}if(Array.isArray(e)){let t=e.length,n=`[`;t>0&&(n+=vi(e[0]));for(let r=1;r<t;r++)n+=`, `+vi(e[r]);return n+=`]`,n}let n=/\[object ([^\]]+)\]/.exec(toString.call(e)),r;if(n&&n.length>1)r=n[1];else return toString.call(e);if(r==`Object`)try{return`Object(`+JSON.stringify(e)+`)`}catch{return`Object`}return e instanceof Error?`${e.name}: ${e.message}\n${e.stack}`:r}function yi(e,t){return e>>>=0,wi().subarray(e/1,e/1+t)}let bi=null;function xi(){return(bi===null||bi.buffer.detached===!0||bi.buffer.detached===void 0&&bi.buffer!==K.memory.buffer)&&(bi=new DataView(K.memory.buffer)),bi}function Si(e,t){return ki(e>>>0,t)}let Ci=null;function wi(){return(Ci===null||Ci.byteLength===0)&&(Ci=new Uint8Array(K.memory.buffer)),Ci}function Ti(e,t){try{return e.apply(this,t)}catch(e){let t=gi(e);K.__wbindgen_exn_store(t)}}function Ei(e){return e==null}function H(e,t){let n=t(e.length*1,1)>>>0;return wi().set(e,n/1),G=e.length,n}function U(e,t,n){if(n===void 0){let n=Ai.encode(e),r=t(n.length,1)>>>0;return wi().subarray(r,r+n.length).set(n),G=n.length,r}let r=e.length,i=t(r,1)>>>0,a=wi(),o=0;for(;o<r;o++){let t=e.charCodeAt(o);if(t>127)break;a[i+o]=t}if(o!==r){o!==0&&(e=e.slice(o)),i=n(i,r,r=o+e.length*3,1)>>>0;let t=wi().subarray(i+o,i+r),a=Ai.encodeInto(e,t);o+=a.written,i=n(i,r,o,1)>>>0}return G=o,i}function W(e){let t=K.__wbindgen_externrefs.get(e);return K.__externref_table_dealloc(e),t}let Di=new TextDecoder(`utf-8`,{ignoreBOM:!0,fatal:!0});Di.decode();let Oi=0;function ki(e,t){return Oi+=t,Oi>=2146435072&&(Di=new TextDecoder(`utf-8`,{ignoreBOM:!0,fatal:!0}),Di.decode(),Oi=t),Di.decode(wi().subarray(e,e+t))}const Ai=new TextEncoder;`encodeInto`in Ai||(Ai.encodeInto=function(e,t){let n=Ai.encode(e);return t.set(n),{read:e.length,written:n.length}});let G=0,K;function ji(e,t){return K=e.exports,bi=null,Ci=null,K.__wbindgen_start(),K}async function Mi(e,t){if(typeof Response==`function`&&e instanceof Response){if(typeof WebAssembly.instantiateStreaming==`function`)try{return await WebAssembly.instantiateStreaming(e,t)}catch(t){if(e.ok&&n(e.type)&&e.headers.get(`Content-Type`)!==`application/wasm`)console.warn("`WebAssembly.instantiateStreaming` failed because your server does not serve Wasm with `application/wasm` MIME type. Falling back to `WebAssembly.instantiate` which is slower. Original error:\n",t);else throw t}let r=await e.arrayBuffer();return await WebAssembly.instantiate(r,t)}else{let n=await WebAssembly.instantiate(e,t);return n instanceof WebAssembly.Instance?{instance:n,module:e}:n}function n(e){switch(e){case`basic`:case`cors`:case`default`:return!0}return!1}}async function Ni(e){if(K!==void 0)return K;e!==void 0&&(Object.getPrototypeOf(e)===Object.prototype?{module_or_path:e}=e:console.warn(`using deprecated parameters for the initialization function; pass a single object instead`)),e===void 0&&(e=new URL(`router_ab_ed25519_yao_client_bg.wasm`,import.meta.url));let t=oi();(typeof e==`string`||typeof Request==`function`&&e instanceof Request||typeof URL==`function`&&e instanceof URL)&&(e=fetch(e));let{instance:n,module:r}=await Mi(await e,t);return ji(n,r)}const Pi=`router_ab_ed25519_yao_active_client_v1`;function Fi(e){switch(e.authorization.kind){case`passkey`:return{protocol:e.protocol,authorization:{kind:`passkey`,webauthnAuthentication:An(e.authorization.webauthnAuthentication)}};case`email_otp_factor`:return{protocol:e.protocol,authorization:{kind:`email_otp_factor`,providerSubjectId:e.authorization.providerSubjectId,walletAuthMethodId:e.authorization.walletAuthMethodId,challengeId:e.authorization.challengeId,otpCode:e.authorization.otpCode}}}}const Ii=Symbol(`router-ab-ed25519-yao-active-client-construction`);function Li(e,t){if(!(e instanceof Uint8Array)||e.length!==32)throw Error(`${t} must contain 32 bytes`);return e}function Ri(e){return e.authorization.kind===`passkey`}function zi(e){switch(e.kind){case`wallet_custody_seed_v1`:return ii;case`ed25519_yao_client_root_v1`:return Qr;default:return Ki(e.kind)}}function Bi(e){let t=[JSON.stringify(e.admission),JSON.stringify(e.applicationBinding),e.participantIds[0],e.participantIds[1],e.custodyEnvelope.factorSecret,e.custodyEnvelope.bindingJson,e.custodyEnvelope.nonce,e.custodyEnvelope.ciphertext,e.custodyEnvelope.aadHash,e.custodyEnvelope.ciphertextDigest,e.entropy.recipientKeyMaterial,e.entropy.deriverASealSeed,e.entropy.deriverBSealSeed];return new(zi(e.custodyEnvelope))(...t)}function Vi(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=Object.keys(e);if(t.length!==4||![`kind`,`challengeId`,`loginGrant`,`expiresAtMs`].every(e=>t.includes(e))||Reflect.get(e,`kind`)!==`email_otp_login_grant`)return null;let n=Reflect.get(e,`challengeId`),r=Reflect.get(e,`loginGrant`),i=Reflect.get(e,`expiresAtMs`);return typeof n!=`string`||n.trim().length===0||typeof r!=`string`||r.trim().length===0||typeof i!=`number`||!Number.isSafeInteger(i)||i<=0?null:{kind:`email_otp_login_grant`,challengeId:n,loginGrant:r}}function Hi(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`Router export admission response must be an object`);let t=Object.keys(e),n=t.length===1&&t[0]===`protocol`,r=t.length===2&&t.includes(`protocol`)&&t.includes(`factorRelease`);if(!n&&!r)throw Error(`Router export admission response contains unexpected fields`);let i=bt(Reflect.get(e,`protocol`));if(!i.ok)throw Error(i.message);return n?{kind:`protocol_only`,protocol:i.value}:{kind:`protocol_with_factor_release`,protocol:i.value,factorRelease:Vi(Reflect.get(e,`factorRelease`))}}function Ui(){return{recipientKeyMaterial:Ji(),deriverASealSeed:Ji(),deriverBSealSeed:Ji()}}function Wi(e){e.recipientKeyMaterial.fill(0),e.deriverASealSeed.fill(0),e.deriverBSealSeed.fill(0)}function Gi(e,t){if(e.length!==t.length)return!1;let n=0;for(let r=0;r<e.length;r+=1)n|=e[r]^t[r];return n===0}function Ki(e){throw Error(`Unhandled Ed25519 Yao Client lifecycle: ${String(e)}`)}function qi(e){switch(e.kind){case`active`:return e.activated;case`disposed`:throw Error(`Ed25519 Yao Client state is disposed`);default:return Ki(e)}}function Ji(){let e=new Uint8Array(32);do globalThis.crypto.getRandomValues(e);while(e.every(Yi));return e}function Yi(e){return e===0}function Xi(e){let t=JSON.parse(e);if(typeof t!=`object`||!t||Array.isArray(t))throw Error(`Client commitments must be an object`);let n=Object.keys(t);if(n.length!==2||!n.includes(`hiding`)||!n.includes(`binding`))throw Error(`Client commitments contain unexpected fields`);let r=Reflect.get(t,`hiding`),i=Reflect.get(t,`binding`);if(typeof r!=`string`||typeof i!=`string`)throw Error(`Client commitments must contain hiding and binding strings`);return{hiding:r,binding:i}}function Zi(e,t){let n=t.binding.ceremony.lifecycle;return n.lifecycle_id===e.scope.lifecycle_id&&n.root_share_epoch===e.scope.root_share_epoch&&n.account_id===e.scope.account_id&&n.session_id===e.scope.threshold_session_id&&n.signer_set_id===e.scope.signer_set_id&&n.selected_server_id===e.scope.signing_worker_id&&zt(t.binding.ceremony.material_activation,e.scope.material_activation)&&t.binding.state_epoch===e.state_epoch&&Gi(t.binding.registered_public_key,e.registered_public_key)&&Gi(t.binding.runtime_policy_binding,e.runtime_policy_binding)&&Gi(t.binding.authorization_digest,e.authorization.authorization_digest)}function Qi(e){let t=JSON.parse(e);if(typeof t!=`object`||!t||Array.isArray(t))throw Error(`Ed25519 Yao export artifact must be an object`);let n=Object.keys(t).sort(),r=[`artifactKind`,`privateKey`,`publicKey`];if(n.length!==r.length||n.some((e,t)=>e!==r[t]))throw Error(`Ed25519 Yao export artifact contains unexpected fields`);if(Reflect.get(t,`artifactKind`)!==`near-ed25519-seed-v1`||typeof Reflect.get(t,`publicKey`)!=`string`||typeof Reflect.get(t,`privateKey`)!=`string`||!String(Reflect.get(t,`publicKey`)).startsWith(`ed25519:`)||!String(Reflect.get(t,`privateKey`)).startsWith(`ed25519:`))throw Error(`Ed25519 Yao export artifact is invalid`);let i=Reflect.get(t,`publicKey`),a=Reflect.get(t,`privateKey`);if(typeof i!=`string`||typeof a!=`string`)throw Error(`Ed25519 Yao export artifact is invalid`);return{artifactKind:`near-ed25519-seed-v1`,publicKey:i,privateKey:a}}function $i(e){let t=new URL(e.routerOrigin);if(t.protocol!==`http:`&&t.protocol!==`https:`||t.pathname!==`/`)throw Error(`Router origin must be an HTTP origin without a path`);if(t.search||t.hash)throw Error(`Router origin must not contain query or hash`);if(typeof e.fetch!=`function`)throw Error(`Router fetch is required`);switch(e.authorization.kind){case`bearer`:if(!e.authorization.value.trim())throw Error(`Router bearer authorization is required`);break;case`recovery_challenge`:if(!e.authorization.challengeId.trim())throw Error(`Router recovery challenge ID is required`);break;case`cookies`:break}return{routerOrigin:t.origin,routing:e.routing,authorization:e.authorization,fetch:e.fetch,traceContext:ea(e.traceContext)}}function ea(e){if(!e)return yn();if(e.kind!==`router_ab_trace_context_v1`)throw Error(`Router trace context kind is invalid`);let t=fn(e.value);if(!t.ok)throw Error(t.message);return t.value}async function ta(e){let t=e.headers.get(`Server-Timing`),n;try{n=await e.json()}catch(e){return{ok:!1,message:e instanceof Error?e.message:String(e)}}if(e.ok){let r=t||na(e.url);return{ok:!0,value:n,...r?{serverTiming:r}:{}}}let r=C(n)?.code;return{ok:!1,message:JSON.stringify(n),...typeof r==`string`?{code:r}:{}}}function na(e){if(!e||typeof performance>`u`||typeof performance.getEntriesByName!=`function`)return null;let t=performance.getEntriesByName(e,`resource`);for(let e=t.length-1;e>=0;--e){let n=t[e];if(!n||n.entryType!==`resource`)continue;let r=ra(Reflect.get(n,`serverTiming`));if(r)return r}return null}function ra(e){if(!Array.isArray(e))return null;let t=[];for(let n of e){if(typeof n!=`object`||!n)continue;let e=String(Reflect.get(n,`name`)||``).trim(),r=Number(Reflect.get(n,`duration`));/^[a-z0-9_]+$/.test(e)&&(!Number.isFinite(r)||r<0||t.push(`${e};dur=${r}`))}return t.length>0?t.join(`, `):null}var ia=class{config;constructor(e){this.config=$i(e)}async send(e){let t;try{let n=!(e.kind===`export_admit`||e.kind===`export_execute`)&&this.config.authorization.kind===`bearer`?this.config.authorization.value:null,r=e.kind===`recovery_admit`&&this.config.authorization.kind===`recovery_challenge`?this.config.authorization.challengeId:null,i=this.config.authorization.kind===`cookies`;t=await this.config.fetch.call(globalThis,new URL(e.path,this.config.routerOrigin),{method:`POST`,headers:{...fa(this.config.routing),...n?{authorization:n}:{},...r?{[pt]:r}:{},"content-type":`application/json`,[hn]:this.config.traceContext.value},credentials:i?`include`:`omit`,body:JSON.stringify(e.body)})}catch(e){return{ok:!1,message:e instanceof Error?e.message:String(e)}}return ta(t)}},aa=class{activeMetadata;lifecycle;constructor(e){if(e[Ii]!==!0)throw Error(`Ed25519 Yao Client state requires verified WASM completion`);this.activeMetadata={kind:e.metadata.kind,scope:{lifecycle_id:e.metadata.scope.lifecycle_id,root_share_epoch:e.metadata.scope.root_share_epoch,account_id:e.metadata.scope.account_id,threshold_session_id:e.metadata.scope.threshold_session_id,signer_set_id:e.metadata.scope.signer_set_id,signing_worker_id:e.metadata.scope.signing_worker_id,material_activation:e.metadata.scope.material_activation},applicationBinding:{wallet_id:e.metadata.applicationBinding.wallet_id,near_ed25519_signing_key_id:e.metadata.applicationBinding.near_ed25519_signing_key_id,signing_root_id:e.metadata.applicationBinding.signing_root_id,key_creation_signer_slot:e.metadata.applicationBinding.key_creation_signer_slot},participantIds:[e.metadata.participantIds[0],e.metadata.participantIds[1]],registeredPublicKey:e.metadata.registeredPublicKey.slice(),signingWorkerVerifyingShare:e.metadata.signingWorkerVerifyingShare.slice(),stateEpoch:e.metadata.stateEpoch,transcript:e.metadata.transcript.slice(),activeCapabilityBinding:[...e.metadata.activeCapabilityBinding],materialActivation:e.metadata.materialActivation},this.lifecycle={kind:`active`,activated:e.activated}}sealLocalMaterial(e){let t=qi(this.lifecycle);try{return{kind:`router_ab_ed25519_yao_sealed_local_material_v1`,nonce:e.nonce.slice(),ciphertext:t.seal_local_material(Li(e.ownedPasskeyPrfFirst,`passkey PRF.first`),e.binding,e.nonce)}}finally{e.ownedPasskeyPrfFirst.fill(0)}}async createSigningShare(e){let t=qi(this.lifecycle),n=Li(e.admittedDigest,`admitted digest`),r=Li(e.signingWorkerVerifyingShare,`SigningWorker verifying share`);if(!Gi(r,this.activeMetadata.signingWorkerVerifyingShare))throw Error(`SigningWorker verifying share does not match activated Client state`);let i=t.create_signing_share(this.activeMetadata.participantIds[0],this.activeMetadata.participantIds[1],n,JSON.stringify(e.signingWorkerCommitments),r);try{return{clientCommitments:Xi(i.client_commitments_json()),clientVerifyingShare:i.client_verifying_share(),clientSignatureShareB64u:i.client_signature_share_b64u()}}finally{i.free()}}metadata(){return{kind:this.activeMetadata.kind,scope:{lifecycle_id:this.activeMetadata.scope.lifecycle_id,root_share_epoch:this.activeMetadata.scope.root_share_epoch,account_id:this.activeMetadata.scope.account_id,threshold_session_id:this.activeMetadata.scope.threshold_session_id,signer_set_id:this.activeMetadata.scope.signer_set_id,signing_worker_id:this.activeMetadata.scope.signing_worker_id,material_activation:this.activeMetadata.scope.material_activation},applicationBinding:{wallet_id:this.activeMetadata.applicationBinding.wallet_id,near_ed25519_signing_key_id:this.activeMetadata.applicationBinding.near_ed25519_signing_key_id,signing_root_id:this.activeMetadata.applicationBinding.signing_root_id,key_creation_signer_slot:this.activeMetadata.applicationBinding.key_creation_signer_slot},participantIds:[this.activeMetadata.participantIds[0],this.activeMetadata.participantIds[1]],registeredPublicKey:this.activeMetadata.registeredPublicKey.slice(),signingWorkerVerifyingShare:this.activeMetadata.signingWorkerVerifyingShare.slice(),stateEpoch:this.activeMetadata.stateEpoch,transcript:this.activeMetadata.transcript.slice(),activeCapabilityBinding:[...this.activeMetadata.activeCapabilityBinding],materialActivation:this.activeMetadata.materialActivation}}status(){switch(this.lifecycle.kind){case`active`:return{kind:`active`};case`disposed`:return{kind:`disposed`};default:return Ki(this.lifecycle)}}dispose(){switch(this.lifecycle.kind){case`active`:{let e=this.lifecycle.activated;this.lifecycle={kind:`disposed`},e.free();return}case`disposed`:return;default:return Ki(this.lifecycle)}}};function oa(e){let t=null;try{return t=Xr.import_local_material(Li(e.ownedPasskeyPrfFirst,`passkey PRF.first`),e.binding,e.sealed.nonce,e.sealed.ciphertext,e.metadata.registeredPublicKey,e.metadata.stateEpoch,e.metadata.participantIds[0],e.metadata.participantIds[1],e.metadata.signingWorkerVerifyingShare),new aa({[Ii]:!0,metadata:e.metadata,activated:t})}catch(e){throw t?.free(),e}finally{e.ownedPasskeyPrfFirst.fill(0)}}function sa(e){let t=null;try{if(t=Xr.import_linked_material(Li(e.ownedClientScalarShare,`linked-device Ed25519 Client share`),e.metadata.participantIds[0],e.metadata.participantIds[1],JSON.stringify(e.publicReceipt)),t.state_epoch()!==e.metadata.stateEpoch||!Gi(t.registered_public_key(),e.metadata.registeredPublicKey)||!Gi(e.publicReceipt.signing_worker_verifying_share,e.metadata.signingWorkerVerifyingShare))throw Error(`linked-device Ed25519 material metadata does not match its receipt`);return new aa({[Ii]:!0,metadata:e.metadata,activated:t})}catch(e){throw t?.free(),e}finally{e.ownedClientScalarShare.fill(0)}}function ca(e){let t=null;try{return t=ai(e.ownedFactorSecret,e.envelope.bindingJson,e.envelope.nonce,e.envelope.ciphertext,e.envelope.aadHash,e.envelope.ciphertextDigest,e.applicationBindingDigest,e.metadata.registeredPublicKey,e.metadata.stateEpoch,e.metadata.participantIds[0],e.metadata.participantIds[1],e.metadata.signingWorkerVerifyingShare,e.sealed.nonce,e.sealed.ciphertext),new aa({[Ii]:!0,metadata:e.metadata,activated:t})}catch(e){throw t?.free(),e}finally{e.ownedFactorSecret.fill(0)}}let la=null;function ua(e){throw la=null,e}var da=class e{constructor(){}static async initializeBundled(){return la??=Ni().catch(ua),await la,new e}importLocalMaterial(e){return oa(e)}importLinkedMaterial(e){return sa(e)}openCustodyCache(e){return ca(e)}async exportSeed(e){let t=await e.transport.send({kind:`export_admit`,path:ft,body:Fi({protocol:e.request,authorization:e.authorization})});if(!t.ok)return t;let n;try{n=Hi(t.value)}catch(e){return{ok:!1,message:e instanceof Error?e.message:String(e)}}if(!Zi(e.request,n.protocol))return{ok:!1,message:`Router export admission does not match the requested exact capability`};let r;if(Ri(e)){if(n.kind!==`protocol_only`)return{ok:!1,message:`Passkey export admission returned an Email OTP factor release`};r=e.custodyEnvelope}else{if(n.kind!==`protocol_with_factor_release`)return{ok:!1,message:`Email OTP export admission did not return the matching factor release`};let t=n.factorRelease;if(!t||t.challengeId!==e.authorization.challengeId)return{ok:!1,message:`Email OTP export admission did not return the matching factor release`};try{r=await e.resolveCustodyEnvelope(t)}catch(e){return{ok:!1,message:e instanceof Error?e.message:String(e)}}}let i=Ui(),a;try{a=Bi({admission:n.protocol,applicationBinding:e.request.application_binding,participantIds:e.request.participant_ids,custodyEnvelope:r,entropy:i})}catch(e){return{ok:!1,message:e instanceof Error?e.message:String(e)}}finally{r.factorSecret.fill(0),Wi(i)}try{let t=ut(JSON.parse(a.execute_request_json()));if(!t.ok)return{ok:!1,message:t.message};let n=await e.transport.send({kind:`export_execute`,path:ct,body:{protocol:t.value}});if(!n.ok)return n;let r=mt(n.value);if(!r.ok)return{ok:!1,message:r.message};let i=a.complete(JSON.stringify(r.value));try{return{ok:!0,artifact:Qi(i.take_export_artifact_json())}}finally{i.free()}}catch(e){return{ok:!1,message:e instanceof Error?e.message:String(e)}}finally{a.free()}}};function fa(e){switch(e.kind){case`discovery`:return{};case`direct`:case`regional`:return oe(e);default:return Ki(e)}}function pa(e){return{materialActivation:e.materialActivation,lifecycleId:e.scope.lifecycle_id,signingRootVersion:e.scope.root_share_epoch,signingRootId:e.applicationBinding.signing_root_id,signerSetId:e.scope.signer_set_id,thresholdSessionId:e.scope.threshold_session_id,activationTranscriptB64u:L(e.transcript),activationCapabilityBindingB64u:L(Uint8Array.from(e.activeCapabilityBinding))}}function ma(e){if(!Ze(e.binding))throw Error(`wallet custody cache accepts wallet custody seed envelopes only`);return{bindingJson:Xe(e),nonceB64u:e.nonceB64u,ciphertextB64u:e.sealedCustodySecretB64u,aadHashB64u:e.aadHashB64u,ciphertextDigestB64u:e.ciphertextDigestB64u}}function ha(e){let{binding:t}=e.material,{activation:n}=e;return{kind:Pi,scope:{lifecycle_id:n.lifecycleId,root_share_epoch:n.signingRootVersion,account_id:t.walletId,threshold_session_id:n.thresholdSessionId,signer_set_id:n.signerSetId,signing_worker_id:t.signingWorkerId,material_activation:qt(n.materialActivation)},applicationBinding:{wallet_id:t.walletId,near_ed25519_signing_key_id:t.nearEd25519SigningKeyId,signing_root_id:n.signingRootId,key_creation_signer_slot:t.signerSlot},participantIds:t.participantIds,registeredPublicKey:R(t.registeredPublicKeyB64u),signingWorkerVerifyingShare:R(t.signingWorkerVerifyingShareB64u),stateEpoch:BigInt(t.stateEpoch),transcript:R(n.activationTranscriptB64u),activeCapabilityBinding:Array.from(R(n.activationCapabilityBindingB64u)),materialActivation:n.materialActivation}}async function ga(e){let t=ha({material:e.material,activation:e.activation});return(await da.initializeBundled()).openCustodyCache({ownedFactorSecret:e.ownedFactorSecret,envelope:{bindingJson:e.envelope.bindingJson,nonce:R(e.envelope.nonceB64u),ciphertext:R(e.envelope.ciphertextB64u),aadHash:R(e.envelope.aadHashB64u),ciphertextDigest:R(e.envelope.ciphertextDigestB64u)},applicationBindingDigest:R(e.material.binding.applicationBindingDigestB64u),sealed:{kind:`router_ab_ed25519_yao_sealed_local_material_v1`,nonce:R(e.material.sealed.nonceB64u),ciphertext:R(e.material.sealed.ciphertextB64u)},metadata:t})}async function _a(e){let t=await e.loadCachedMaterial();return t.kind===`found`?{kind:`opened`,activeClient:await ga({material:t.material,activation:e.activation,envelope:e.envelope,ownedFactorSecret:e.ownedFactorSecret})}:(e.ownedFactorSecret.fill(0),{kind:`rejoin_required`})}function va(e){let t=String(e.rpId).trim(),n=String(e.nearAccountId).trim(),r=String(e.nearEd25519SigningKeyId).trim(),i=String(e.relayerKeyId).trim(),a=String(e.credentialIdB64u).trim(),o=A(e.participantIds),s=Math.floor(Number(e.signerSlot));if(!t||!n||!r||!i||!a||!o||!Number.isSafeInteger(s)||s<1)throw Error(`Passkey Ed25519 sealed restore metadata is incomplete`);return{rpId:t,nearAccountId:n,nearEd25519SigningKeyId:r,relayerKeyId:i,participantIds:[...o],runtimePolicyScope:e.runtimePolicyScope,signerSlot:s,routerAbNormalSigning:e.routerAbNormalSigning,credentialIdB64u:a,materialActivation:e.materialActivation}}async function ya(e){let t=String(e.session.thresholdSessionId||``).trim(),n=String(e.session.walletSessionAuth.walletSessionToken||``).trim(),r=String(e.session.signingLane.identity.signer.account.wallet.walletId||``).trim(),i=String(e.prfFirstB64u||``).trim(),a=Math.floor(Number(e.session.signingWalletSession.expiresAtMs)||0),o=Math.floor(Number(e.session.remainingUses)),s=e.session.signingLane.identity.auth;if(s.kind!==`passkey`)throw Error(`Ed25519 Yao sealed refresh persistence requires a passkey lane`);if(!t||!n||!r||!i||a<=0||!Number.isSafeInteger(o)||o<0)throw Error(`Ed25519 Yao sealed refresh persistence received an invalid session`);let c=e.session.signingLane.identity.signer;if(r!==String(c.account.wallet.walletId)||e.ed25519Restore.nearAccountId!==String(c.account.nearAccountId)||e.ed25519Restore.nearEd25519SigningKeyId!==String(c.nearEd25519SigningKeyId)||e.ed25519Restore.signerSlot!==c.signerSlot||e.ed25519Restore.rpId!==String(s.rpId)||e.ed25519Restore.credentialIdB64u!==s.credentialIdB64u||!p(e.ed25519Restore.materialActivation,e.materialActivation)||e.ed25519Restore.routerAbNormalSigning?.signingWorkerId!==e.session.routerAbNormalSigning.signingWorkerId)throw Error(`Ed25519 Yao sealed refresh metadata does not match the exact session`);let l={curve:`ed25519`,authMethod:`passkey`,walletId:r,relayerUrl:e.session.relayerUrl,walletSessionToken:n,ed25519Restore:e.ed25519Restore};await e.persistence.hydrateSigningSession({thresholdSessionId:t,prfFirstB64u:i,expiresAtMs:a,remainingUses:o,transport:l})}const ba=`[Registration] wallet timing summary`,xa=new Map(Object.entries({yao_credential_digest:`yaoServerCredentialDigestMs`,yao_d1_admission_read:`yaoServerD1AdmissionReadMs`,yao_router_execution:`yaoServerRouterExecutionMs`,yao_result_reconstruction:`yaoServerResultReconstructionMs`,yao_router_prepare_pair:`yaoServerRouterPreparePairMs`,yao_router_role_execution:`yaoServerRouterRoleExecutionMs`,yao_router_signing_worker_delivery:`yaoServerRouterSigningWorkerDeliveryMs`,ecdsa_respond_d1_claim:`ecdsaRespondD1ClaimMs`,ecdsa_respond_reconcile:`ecdsaRespondReconcileMs`,ecdsa_respond_router:`ecdsaRespondRouterMs`,ecdsa_respond_d1_commit:`ecdsaRespondD1CommitMs`,ecdsa_respond_total:`ecdsaRespondTotalMs`,ecdsa_activate_d1_claim:`ecdsaActivateD1ClaimMs`,ecdsa_activate_reconcile:`ecdsaActivateReconcileMs`,ecdsa_activate_router:`ecdsaActivateRouterMs`,ecdsa_activate_bootstrap:`ecdsaActivateBootstrapMs`,ecdsa_activate_session_provision:`ecdsaActivateSessionProvisionMs`,ecdsa_activate_d1_commit:`ecdsaActivateD1CommitMs`,ecdsa_activate_policy_lookup:`ecdsaActivatePolicyLookupMs`,ecdsa_activate_jwt_mint:`ecdsaActivateJwtMintMs`,ecdsa_activate_total:`ecdsaActivateTotalMs`,ecdsa_rt_authorize:`ecdsaRtAuthorizeMs`,ecdsa_rt_admission:`ecdsaRtAdmissionMs`,ecdsa_rt_derivers:`ecdsaRtDeriversMs`,ecdsa_rt_deriver_a:`ecdsaRtDeriverAMs`,ecdsa_rt_deriver_b:`ecdsaRtDeriverBMs`,ecdsa_rt_completion:`ecdsaRtCompletionMs`,ecdsa_rt_total:`ecdsaRtTotalMs`,ecdsa_rt_act_session:`ecdsaRtActSessionMs`,ecdsa_rt_act_worker:`ecdsaRtActWorkerMs`,ecdsa_rt_act_total:`ecdsaRtActTotalMs`,ecdsa_a_parse:`ecdsaDeriverAParseMs`,ecdsa_a_preload:`ecdsaDeriverAPreloadMs`,ecdsa_a_execute:`ecdsaDeriverAExecuteMs`,ecdsa_a_total:`ecdsaDeriverATotalMs`,ecdsa_b_parse:`ecdsaDeriverBParseMs`,ecdsa_b_preload:`ecdsaDeriverBPreloadMs`,ecdsa_b_execute:`ecdsaDeriverBExecuteMs`,ecdsa_b_total:`ecdsaDeriverBTotalMs`,ecdsa_sw_parse:`ecdsaSigningWorkerParseMs`,ecdsa_sw_activate:`ecdsaSigningWorkerActivateMs`,ecdsa_sw_total:`ecdsaSigningWorkerTotalMs`,near_finalize_authority:`nearFinalizeAuthorityMs`,near_finalize_fingerprint:`nearFinalizeFingerprintMs`,near_finalize_side_effect:`nearFinalizeSideEffectMs`,near_finalize_cleanup:`nearFinalizeCleanupMs`,near_finalize_session_projection:`nearFinalizeSessionProjectionMs`,near_finalize_session_seal:`nearFinalizeSessionSealMs`,near_finalize_total:`nearFinalizeTotalMs`}));function Sa(e,t,n){xr()&&console.info(`[Registration] ECDSA Server-Timing header presence`,{leg:t,present:!!n?.trim()}),Ca(e,n)}function Ca(e,t){if(e)for(let[n,r]of wa(t))e.record(n,r)}function wa(e){if(!e)return[];let t=[];for(let n of e.split(`,`)){let e=n.split(`;`),r=String(e[0]||``).trim(),i=xa.get(r);if(i)for(let n of e.slice(1)){let[e,r]=n.split(`=`);if(String(e||``).trim()!==`dur`)continue;let a=Number(String(r||``).trim());if(!Number.isFinite(a)||a<0)break;t.push([i,a]);break}}return t}function Ta(e){Da({ceremonyId:e.ceremonyId,stage:e.stage,durationMs:Math.max(0,performance.now()-e.startedAt),outcome:e.outcome})}function Ea(e,t,n){Da({ceremonyId:e,stage:`session_hydration.${t}`,durationMs:n,outcome:`success`})}function Da(e){if(xr())try{console.info(`[Registration] NEAR timing`,JSON.stringify({event:`near_registration_timing`,ceremonyId:e.ceremonyId,stage:e.stage,durationMs:e.durationMs,outcome:e.outcome}))}catch{}}const Oa=[`passkeyAuthConfirmationMs`,`passkeyAuthPrfExtractionMs`,`passkeyAuthCredentialRedactionMs`,`passkeyAuthWorkerReadyMs`,`passkeyAuthWorkerRequestRoundTripMs`,`passkeyAuthWorkerResponseValidationMs`,`passkeyAuthRequestSetupMs`,`passkeyAuthPromptUserMs`,`passkeyAuthPromptElementDefineMs`,`passkeyAuthPromptMountMs`,`passkeyAuthPromptHostFirstUpdateMs`,`passkeyAuthPromptHostInteractiveMs`,`passkeyAuthPromptConfirmEventMs`,`passkeyAuthPromptDecisionWaitMs`,`passkeyAuthCredentialCreateStartMs`,`passkeyAuthCredentialCreateMs`,`passkeyAuthCredentialSerializeMs`,`passkeyAuthDuplicateRetryCount`,`passkeyAuthMainThreadTotalMs`],ka=[`emailOtpYaoEnrollmentMaterialWaitMs`,`emailOtpYaoWorkerRegistrationMs`,`emailOtpYaoTotalMs`],Aa=[`ecdsaClientBootstrapMs`,`ecdsaRegistrationTotalMs`,`ecdsaRegistrationClientCreateMs`,`ecdsaRegistrationGatewayRespondMs`,`ecdsaRegistrationClientProofVerifyMs`,`ecdsaRegistrationGatewayActivateMs`,`ecdsaRegistrationClientActivationFinalizeMs`],ja=[`ecdsaRegistrationPersistenceMs`,`ecdsaRegistrationSessionFinalizeMs`,`ecdsaRegistrationLocalRecordPersistenceMs`,`ecdsaRegistrationTargetCount`,`ecdsaRegistrationClientFinalizeMs`,`ecdsaRegistrationClientMaterialStoreMs`,`ecdsaRegistrationServerBootstrapMs`,`ecdsaRegistrationPasskeyBootstrapStoreMs`,`ecdsaRegistrationRoleLocalRecordPersistenceMs`,`ecdsaRegistrationWarmSessionHydrationMs`,`ecdsaRegistrationWarmSessionWorkerReadyMs`,`ecdsaRegistrationWarmSessionWorkerPutMs`,`ecdsaRegistrationWarmSessionSealedRecordPersistMs`,`ecdsaRegistrationWarmSessionSealResolveTransportMs`,`ecdsaRegistrationWarmSessionSealExistingRecordReadMs`,`ecdsaRegistrationWarmSessionSealPolicyReadMs`,`ecdsaRegistrationWarmSessionSealApplyServerSealMs`,`ecdsaRegistrationWarmSessionSealApplyRuntimeSetupMs`,`ecdsaRegistrationWarmSessionSealApplyClientSealMs`,`ecdsaRegistrationWarmSessionSealApplyServerRouteMs`,`ecdsaRegistrationWarmSessionSealApplyClientUnsealMs`,`ecdsaRegistrationWarmSessionSealApplyPolicyUpdateMs`,`ecdsaRegistrationWarmSessionSealRegisterMs`,`ecdsaRegistrationWarmSessionSealVerifyReadMs`,`ecdsaRegistrationEmailOtpSessionCommitMs`],Ma=[...Aa,...ja],Na=[`registrationWarmupMs`,`registrationWarmupWaitMs`,`registrationWarmupAuthenticatedWalletStateMs`,`registrationWarmupNoncePrefetchMs`,`registrationWarmupKeyMaterialReadMs`,`registrationWarmupUiConfirmPrewarmMs`,`registrationWarmupEmailOtpWorkerPrewarmMs`,`registrationWarmupEmailOtpYaoWasmInitMs`,`managedRegistrationGrantMs`,`registrationIntentMs`,`registrationIntentDigestMs`,`authProofMs`,...Oa,`emailOtpEnrollmentMaterialMs`,...ka,`yaoBranchTotalMs`,`yaoAdmissionMs`,`yaoClientSessionCreateMs`,`yaoClientCompletionMs`,`yaoServerCredentialDigestMs`,`yaoServerD1AdmissionReadMs`,`yaoServerRouterExecutionMs`,`yaoServerResultReconstructionMs`,`yaoServerRouterPreparePairMs`,`yaoServerRouterRoleExecutionMs`,`yaoServerRouterSigningWorkerDeliveryMs`,`ecdsaRespondD1ClaimMs`,`ecdsaRespondReconcileMs`,`ecdsaRespondRouterMs`,`ecdsaRespondD1CommitMs`,`ecdsaRespondTotalMs`,`ecdsaActivateD1ClaimMs`,`ecdsaActivateReconcileMs`,`ecdsaActivateRouterMs`,`ecdsaActivateBootstrapMs`,`ecdsaActivateSessionProvisionMs`,`ecdsaActivateD1CommitMs`,`ecdsaActivatePolicyLookupMs`,`ecdsaActivateJwtMintMs`,`ecdsaActivateTotalMs`,`ecdsaRtAuthorizeMs`,`ecdsaRtAdmissionMs`,`ecdsaRtDeriversMs`,`ecdsaRtDeriverAMs`,`ecdsaRtDeriverBMs`,`ecdsaRtCompletionMs`,`ecdsaRtTotalMs`,`ecdsaRtActSessionMs`,`ecdsaRtActWorkerMs`,`ecdsaRtActTotalMs`,`ecdsaDeriverAParseMs`,`ecdsaDeriverAPreloadMs`,`ecdsaDeriverAExecuteMs`,`ecdsaDeriverATotalMs`,`ecdsaDeriverBParseMs`,`ecdsaDeriverBPreloadMs`,`ecdsaDeriverBExecuteMs`,`ecdsaDeriverBTotalMs`,`ecdsaSigningWorkerParseMs`,`ecdsaSigningWorkerActivateMs`,`ecdsaSigningWorkerTotalMs`,`nearFinalizeAuthorityMs`,`nearFinalizeFingerprintMs`,`nearFinalizeSideEffectMs`,`nearFinalizeCleanupMs`,`nearFinalizeSessionProjectionMs`,`nearFinalizeSessionSealMs`,`nearFinalizeTotalMs`,`walletRegisterStartMs`,...Aa,`emailOtpRecoveryCodeBackupMs`,`walletRegisterFinalizeMs`,...ja];function q(e){throw Error(`Unexpected registration timing branch: ${String(e)}`)}function Pa(e){switch(e.kind){case`near_ed25519`:return`near_ed25519`;case`evm_family_ecdsa`:return`evm_family_ecdsa`;default:return q(e)}}function Fa(e){return{kind:`signer_set`,branches:e.branches.map(Pa)}}function Ia(e,t){return e.branches.includes(t)}function La(e){return Math.max(0,Math.round(performance.now()-e))}function Ra(e){switch(e){case`registrationIntentLoadMs`:case`registrationIntentDigestMs`:case`registrationIntentConsumeMs`:case`registrationPreparationPersistMs`:case`registrationPreparationLoadMs`:case`registrationPreparationConsumeMs`:case`registrationPreparationScopeCheckMs`:case`registrationAuthorityVerifyMs`:case`registrationEcdsaPrepareMs`:case`registrationCeremonyPersistMs`:case`registerPrepareTotalMs`:case`registerStartTotalMs`:case`registrationEcdsaRespondMs`:case`registrationFinalizeReplayLoadMs`:case`registrationCeremonyLoadMs`:case`registrationEcdsaBootstrapVerifyMs`:case`sponsoredNearAccountCreateMs`:case`registrationKeygenMs`:case`registrationEmailOtpEnrollmentPlanMs`:case`relaySessionMintMs`:case`relayGoogleEmailOtpActivationPlanMs`:case`relayPersistenceMs`:case`registrationFinalizeReplayCacheMs`:case`registerFinalizeTotalMs`:return e;default:return null}}function za(e){if(!b(e)||e.kind!==`wallet_registration_route_diagnostics_v1`||e.route!==`wallets_register_start`&&e.route!==`wallets_register_ecdsa_derivation_respond`&&e.route!==`wallets_register_finalize`||!Array.isArray(e.entries))return null;let t=[];for(let n of e.entries){if(!b(n))continue;let e=Ra(n.name),r=Number(n.durationMs);!e||!Number.isFinite(r)||r<0||t.push({name:e,durationMs:r})}return{kind:`wallet_registration_route_diagnostics_v1`,route:e.route,entries:t}}function Ba(e){return{kind:e.kind,route:e.route,entries:e.entries.map(Va)}}function Va(e){return{name:e.name,durationMs:e.durationMs}}function Ha(e,t){let n={};for(let r of e)n[r]=t[r];return n}function Ua(e){let t={};for(let n of e)t[n]=0;return t}function Wa(e){switch(e.authMethod){case`passkey`:return{kind:`passkey`,authProofMs:e.buckets.authProofMs,...Ha(Oa,e.buckets),emailOtpEnrollmentMaterialMs:0,emailOtpRecoveryCodeBackupMs:0};case`email_otp`:return{kind:`email_otp`,authProofMs:e.buckets.authProofMs,...Ua(Oa),emailOtpEnrollmentMaterialMs:e.buckets.emailOtpEnrollmentMaterialMs,emailOtpRecoveryCodeBackupMs:e.buckets.emailOtpRecoveryCodeBackupMs};default:return q(e.authMethod)}}function Ga(e){return Ia(e.signerSet,`near_ed25519`)?{kind:`ed25519_yao_enabled`,...Ha(ka,e.buckets)}:{kind:`ed25519_disabled`,...Ua(ka)}}function Ka(e){return Ia(e.signerSet,`evm_family_ecdsa`)?{kind:`ecdsa_enabled`,...Ha(Ma,e.buckets)}:{kind:`ecdsa_disabled`,...Ua(Ma)}}const qa=[`registrationWarmupWaitMs`,`managedRegistrationGrantMs`,`registrationIntentMs`,`registrationIntentDigestMs`,`authProofMs`,`emailOtpEnrollmentMaterialMs`,`emailOtpYaoEnrollmentMaterialWaitMs`,`emailOtpYaoWorkerRegistrationMs`,`emailOtpYaoTotalMs`,`walletRegisterStartMs`,`ecdsaClientBootstrapMs`,`ecdsaRegistrationTotalMs`,`emailOtpRecoveryCodeBackupMs`,`walletRegisterFinalizeMs`,`ecdsaRegistrationPersistenceMs`];function Ja(e){return e.startsWith(`registrationWarmup`)?`warmup`:e.startsWith(`passkeyAuth`)||e===`authProofMs`?`auth`:e.includes(`Yao`)||e.includes(`yao`)?`ed25519_yao`:e.includes(`ecdsa`)?`ecdsa`:`registration`}function Ya(e){return{name:e.name,kind:e.kind,startOffsetMs:e.startOffsetMs,endOffsetMs:e.endOffsetMs}}function Xa(e,t){let n=t.map(t=>({start:Math.max(0,Math.min(e,t.startOffsetMs)),end:Math.max(0,Math.min(e,t.endOffsetMs))})).filter(e=>e.end>e.start).sort((e,t)=>e.start-t.start||e.end-t.end),r=0,i=0,a=0;for(let e of n){if(a<=i){i=e.start,a=e.end;continue}if(e.start>a){r+=a-i,i=e.start,a=e.end;continue}a=Math.max(a,e.end)}return a>i?r+a-i:r}function Za(e){let t=qa.map(t=>({name:t,durationMs:e.buckets[t]})),n=t.reduce((e,t)=>e+Math.max(0,t.durationMs),0),r=t.filter(e=>e.durationMs>0).sort((e,t)=>t.durationMs===e.durationMs?e.name.localeCompare(t.name):t.durationMs-e.durationMs).slice(0,5),i=Xa(e.totalElapsedMs,e.spans);return{kind:`registration_critical_path_summary_v2`,totalElapsedMs:e.totalElapsedMs,measuredWorkMs:n,spanUnionMs:i,spanCoverageRatio:e.totalElapsedMs>0?Math.min(1,i/e.totalElapsedMs):1,unattributedElapsedMs:Math.max(0,e.totalElapsedMs-i),overlappedOrBackgroundMs:Math.max(0,n-e.totalElapsedMs),topBuckets:r,spans:e.spans.map(Ya)}}function Qa(e){let t=Ha(Na,e.buckets);return{...t,auth:Wa({authMethod:e.authMethod,buckets:t}),ed25519:Ga({signerSet:e.signerSet,buckets:t}),ecdsa:Ka({signerSet:e.signerSet,buckets:t}),emailOtpYaoPrewarm:{...e.emailOtpYaoPrewarm}}}var $a=class{startedAt;nearStageStartedAt;buckets;relayDiagnostics;spans;emailOtpYaoPrewarm;constructor(e){this.startedAt=e,this.nearStageStartedAt=e,this.buckets=Ua(Na),this.relayDiagnostics=[],this.spans=[],this.emailOtpYaoPrewarm=eo()}markNearStage(e,t){let n=performance.now();Da({ceremonyId:e,stage:t,durationMs:n-this.nearStageStartedAt,outcome:`success`}),this.nearStageStartedAt=n}async measure(e,t){let n=performance.now();try{return await t()}finally{this.buckets[e]=La(n),this.recordSpan(e,n,performance.now())}}record(e,t){let n=Math.max(0,Math.round(t));this.buckets[e]+=n}snapshot(){return Ha(Na,this.buckets)}spansSnapshot(){return this.spans.map(Ya)}recordSpan(e,t,n){this.spans.push({name:e,kind:Ja(e),startOffsetMs:Math.max(0,Math.round(t-this.startedAt)),endOffsetMs:Math.max(0,Math.round(n-this.startedAt))})}captureRouteDiagnostics(e){let t=za(e);t&&this.relayDiagnostics.push(t)}captureWarmupDiagnostics(e){this.buckets.registrationWarmupAuthenticatedWalletStateMs=e.authenticatedWalletStateMs,this.buckets.registrationWarmupNoncePrefetchMs=e.noncePrefetchMs,this.buckets.registrationWarmupKeyMaterialReadMs=e.keyMaterialReadMs,this.buckets.registrationWarmupUiConfirmPrewarmMs=e.uiConfirmPrewarmMs,this.buckets.registrationWarmupEmailOtpWorkerPrewarmMs=e.emailOtpWorkerPrewarmMs,this.buckets.registrationWarmupEmailOtpYaoWasmInitMs=e.emailOtpYaoWasmInitMs,this.emailOtpYaoPrewarm={...e.emailOtpYaoPrewarm}}emailOtpYaoPrewarmSnapshot(){return{...this.emailOtpYaoPrewarm}}capturePasskeyAuthDiagnostics(e){this.buckets.passkeyAuthConfirmationMs=e.requestConfirmationMs,this.buckets.passkeyAuthPrfExtractionMs=e.prfExtractionMs,this.buckets.passkeyAuthCredentialRedactionMs=e.credentialRedactionMs,this.buckets.passkeyAuthWorkerReadyMs=e.confirmationWorkerReadyMs,this.buckets.passkeyAuthWorkerRequestRoundTripMs=e.confirmationWorkerRequestRoundTripMs,this.buckets.passkeyAuthWorkerResponseValidationMs=e.confirmationWorkerResponseValidationMs,this.buckets.passkeyAuthRequestSetupMs=e.confirmationRequestSetupMs,this.buckets.passkeyAuthPromptUserMs=e.confirmationPromptUserMs,this.buckets.passkeyAuthPromptElementDefineMs=e.confirmationPromptElementDefineMs,this.buckets.passkeyAuthPromptMountMs=e.confirmationPromptMountMs,this.buckets.passkeyAuthPromptHostFirstUpdateMs=e.confirmationPromptHostFirstUpdateMs,this.buckets.passkeyAuthPromptHostInteractiveMs=e.confirmationPromptHostInteractiveMs,this.buckets.passkeyAuthPromptConfirmEventMs=e.confirmationPromptConfirmEventMs,this.buckets.passkeyAuthPromptDecisionWaitMs=e.confirmationPromptDecisionWaitMs,this.buckets.passkeyAuthCredentialCreateStartMs=e.confirmationCredentialCreateStartMs,this.buckets.passkeyAuthCredentialCreateMs=e.confirmationCredentialCreateMs,this.buckets.passkeyAuthCredentialSerializeMs=e.confirmationCredentialSerializeMs,this.buckets.passkeyAuthDuplicateRetryCount=e.confirmationDuplicateRetryCount,this.buckets.passkeyAuthMainThreadTotalMs=e.confirmationMainThreadTotalMs}routeDiagnosticsSnapshot(){return this.relayDiagnostics.map(Ba)}totalMs(){return La(this.startedAt)}};function eo(){return{kind:`not_requested`,elapsedMs:0,workerPrewarmMs:0,yaoWasmInitMs:0}}function to(e){let t=e.recorder.totalMs(),n=e.recorder.snapshot();return{kind:`registration_timing_summary_v2`,status:`succeeded`,authMethod:e.authMethod,signerSet:e.signerSet,totalMs:t,criticalPath:Za({totalElapsedMs:t,buckets:n,spans:e.recorder.spansSnapshot()}),relayDiagnostics:e.recorder.routeDiagnosticsSnapshot(),timings:Qa({authMethod:e.authMethod,signerSet:e.signerSet,buckets:n,emailOtpYaoPrewarm:e.recorder.emailOtpYaoPrewarmSnapshot()})}}function no(e){let t=e.recorder.totalMs(),n=e.recorder.snapshot();return{kind:`registration_timing_summary_v2`,status:`failed`,authMethod:e.authMethod,signerSet:e.signerSet,totalMs:t,criticalPath:Za({totalElapsedMs:t,buckets:n,spans:e.recorder.spansSnapshot()}),errorCode:e.errorCode,relayDiagnostics:e.recorder.routeDiagnosticsSnapshot(),timings:Qa({authMethod:e.authMethod,signerSet:e.signerSet,buckets:n,emailOtpYaoPrewarm:e.recorder.emailOtpYaoPrewarmSnapshot()})}}function ro(e){xr()&&(console.info(ba,e),console.info(`${ba} ${JSON.stringify(e)}`))}function io(e){let t={event:`seams_registration_timing_span_v1`,span:e.span,operation:`registration`,outcome:e.outcome,duration_ms:Math.max(0,Math.round(e.durationMs)),trace_id:e.traceContext.value};try{e.callback?.(t)}catch{}}function J(e){return{kind:`unavailable`,reason:e}}function ao(e){let t=e.selected;if(t.kind!==`resolved`)switch(t.kind){case`missing_selection`:return J(`selected_authority_missing`);case`missing_auth_method`:case`missing_authority`:case`integrity_error`:return J(`selected_authority_invalid`);default:return t}return t.selection.walletId!==e.walletId||t.authMethod.walletId!==e.walletId||t.authority.walletId!==e.walletId||t.selection.walletAuthMethodId!==t.authMethod.walletAuthMethodId||t.authMethod.walletAuthorityId!==t.authority.authorityId?J(`authority_identity_mismatch`):t.selection.lockState===`unlocked`?t.authMethod.status===`active`?t.authority.state===`active`?t.authMethod.kind===e.authMethod?{authority:t.authority,authMethod:t.authMethod}:J(`auth_method_mismatch`):J(`authority_inactive`):J(`auth_method_inactive`):J(`wallet_locked`)}function oo(e){let t=e.authority.signerActivations;return e.keyFamily===`ed25519`?t.ed25519?.materialActivation??null:t.ecdsa?.materialActivation??null}function so(e){return e.session.capabilitySubjects.filter(t=>t.kind===`sign`&&t.keyFamily===e.keyFamily&&p(t.materialActivation,e.materialActivation)).length===1}function co(e){return nr(e)?{keyFamily:`ecdsa_secp256k1`,materialActivation:e.signer.materialActivation}:{keyFamily:`ed25519`}}async function lo(e){let{input:t,ports:n}=e,r;try{r=await n.resolveSelectedWalletAuthority(String(t.walletId))}catch{return J(`persistence_unavailable`)}let i=ao({selected:r,walletId:t.walletId,authMethod:t.authMethod});if(`kind`in i)return i;let a=oo({authority:i.authority,keyFamily:t.requiredSigningSubject.keyFamily});if(!a)return J(`signer_material_missing`);if(t.requiredSigningSubject.keyFamily===`ecdsa_secp256k1`&&!p(t.requiredSigningSubject.materialActivation,a))return J(`signer_material_mismatch`);let o;try{o=await n.readExactWithOperationCredential({walletId:t.walletId,authorityId:i.authority.authorityId,authMethodId:i.authMethod.walletAuthMethodId})}catch{return J(`persistence_unavailable`)}switch(o.kind){case`found`:break;case`missing`:return J(`wallet_session_missing`);case`upgrade_required`:return J(`wallet_session_upgrade_required`)}let s=o.record,c=o.operationCredential;return s.walletId!==t.walletId||s.authorityId!==i.authority.authorityId||s.authMethodId!==i.authMethod.walletAuthMethodId||s.authorityDigestB64u!==i.authority.authorityDigestB64u||s.authorityRevocationEpoch!==i.authority.revocationEpoch||s.quotaId!==t.quotaId||c.walletSessionId!==t.walletSessionId||c.token.trim().length===0?J(`wallet_session_identity_mismatch`):t.expiry.kind===`unexpired`&&s.expiresAtMs<=t.expiry.nowMs?J(`wallet_session_expired`):t.expiry.kind===`expired`&&s.expiresAtMs>t.expiry.nowMs?J(`wallet_session_not_expired`):so({session:s,keyFamily:t.requiredSigningSubject.keyFamily,materialActivation:a})?{kind:`resolved`,resolved:{authMethod:i.authMethod,session:s,operationCredential:c,walletSessionId:c.walletSessionId,materialActivation:a}}:J(`wallet_session_capability_mismatch`)}function uo(e){return String(e||``).trim()}function fo(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>0?e:0}function po(e){let t=Math.floor(Number(e));return Number.isSafeInteger(t)&&t>=0?t:null}function mo(e){return e.expiresAtMs<=e.nowMs?{kind:`expired`}:e.remainingUses<=0?{kind:`exhausted`}:null}function ho(e,t){let n=uo(e);return n?{kind:`wallet_session_opaque`,walletSessionToken:n,credential:{kind:`wallet_session_opaque`,walletSessionToken:n,home:t}}:null}function go(e){let t=ho(uo(e.walletSessionToken),e.home);if(!t)return{ok:!1,reason:`missing_wallet_session_token`};let n=uo(e.walletId),r=uo(e.nearAccountId),i=uo(e.nearEd25519SigningKeyId);if(!n||!r||!i)return{ok:!1,reason:`wallet_binding_mismatch`};let a=_e(e.walletSessionId),o=ve(e.authorizationId),c=he(e.quotaId),l=s(e.thresholdSessionId);if(!a.ok||!o.ok)return{ok:!1,reason:`missing_session_identity`};if(!c.ok)return{ok:!1,reason:`missing_quota_id`};if(!l.ok)return{ok:!1,reason:`missing_threshold_session_id`};let u=po(e.nowMs),d=fo(e.remainingUses),f=fo(e.expiresAtMs);if(u==null||!Number.isSafeInteger(e.remainingUses)||!Number.isSafeInteger(e.expiresAtMs)||e.remainingUses<0||e.expiresAtMs<=0)return{ok:!1,reason:`invalid_budget`};let p=mo({remainingUses:Math.max(0,Math.floor(e.remainingUses)),expiresAtMs:Math.max(0,Math.floor(e.expiresAtMs)),nowMs:u});if(p?.kind===`expired`)return{ok:!1,reason:`expired`};if(p?.kind===`exhausted`)return{ok:!1,reason:`exhausted`};let m;try{m=P(e.runtimePolicyScope)}catch{return{ok:!1,reason:`missing_signing_root`}}return m.signingRootId!==uo(e.signingRootId)||m.signingRootVersion!==uo(e.signingRootVersion)?{ok:!1,reason:`signing_root_mismatch`}:{ok:!0,value:{curve:`ed25519`,auth:t,walletSessionId:a.value,authorizationId:o.value,quotaId:c.value,thresholdSessionId:l.value,remainingUses:d,expiresAtMs:f,runtimePolicyScope:e.runtimePolicyScope,signingRootId:m.signingRootId,signingRootVersion:uo(m.signingRootVersion),routerAbNormalSigning:e.routerAbNormalSigning}}}const _o=nt.signingSessionSeals,vo=nt.signingSessionRestoreLeases,yo=[rt.ed25519ThresholdSessionId,rt.ecdsaThresholdSessionId];function bo(e){return new Promise((t,n)=>{e.onsuccess=()=>t(e.result),e.onerror=()=>n(e.error||Error(`IndexedDB request failed`))})}function xo(e){return new Promise((t,n)=>{e.oncomplete=()=>t(),e.onabort=()=>n(e.error||Error(`IndexedDB transaction aborted`)),e.onerror=()=>n(e.error||Error(`IndexedDB transaction failed`))})}async function So(){if(it.isDisabled())return null;try{return at(await it.getDB())}catch{return null}}function Co(e,t){return new Promise((n,r)=>{let i=[],a=e.openCursor(t);a.onsuccess=()=>{let e=a.result;if(!e){n(i);return}i.push({primaryKey:e.primaryKey,value:e.value}),e.continue()},a.onerror=()=>r(a.error||Error(`IndexedDB cursor failed`))})}function wo(e){return new Promise((t,n)=>{let r=[],i=e.openCursor();i.onsuccess=()=>{let e=i.result;if(!e){t(r);return}r.push({primaryKey:e.primaryKey,value:e.value}),e.continue()},i.onerror=()=>n(i.error||Error(`IndexedDB cursor failed`))})}async function To(e,t){let n=new Map;for(let r of yo)try{let i=await Co(e.index(r),t);for(let e of i)n.set(String(e.primaryKey),e)}catch{}return n.size?[...n.values()]:await wo(e).catch(()=>[])}const Y=new class{async collectAllRawSealedRecordEntries(){let e=await So();if(!e)return[];let t=e.transaction(_o,`readonly`),n=await wo(t.objectStore(_o));return await xo(t).catch(()=>void 0),n}async collectRawSealedRecordEntriesByThresholdSessionId(e){let t=await So();if(!t)return[];let n=t.transaction(_o,`readonly`),r=await To(n.objectStore(_o),e);return await xo(n).catch(()=>void 0),r}async replaceSealedRecord(e){let t=await So();if(!t)return;let n=t.transaction(_o,`readwrite`),r=n.objectStore(_o);for(let t of e.staleStoreKeys)r.delete(t);r.put(e.row),await xo(n)}async replaceSealedRecordAndDeleteRestoreLease(e){let t=await So();if(!t)return!1;let n=t.transaction([_o,vo],`readwrite`),r=n.objectStore(_o);for(let t of e.staleStoreKeys)r.delete(t);return r.put(e.row),n.objectStore(vo).delete(e.restoreLeaseKey),await xo(n),!0}async deleteSealedRecords(e){if(!e.length)return;let t=await So();if(!t)return;let n=t.transaction(_o,`readwrite`),r=n.objectStore(_o);for(let t of e)r.delete(t);await xo(n).catch(()=>void 0)}async deleteRestoreLease(e){let t=await So();if(!t)return;let n=t.transaction(vo,`readwrite`);n.objectStore(vo).delete(e),await xo(n).catch(()=>void 0)}async deleteRestoreLeaseIf(e){let t=await So();if(!t)return;let n=t.transaction(vo,`readwrite`),r=n.objectStore(vo),i=await bo(r.get(e.leaseKey));e.shouldDelete(i)&&r.delete(e.leaseKey),await xo(n).catch(()=>void 0)}async withRestoreLeaseTransaction(e,t){let n=await So();if(!n)return null;try{let r=n.transaction([_o,vo],`readwrite`),i=r.objectStore(_o),a=r.objectStore(vo),o=await To(i,e),s=!1,c=await t({entries:o,getRawRestoreLease:async e=>await bo(a.get(e)),putRestoreLease:e=>a.put(e),abort:()=>{s=!0}});return s?(r.abort(),c):(await xo(r),c)}catch{return null}}};function Eo(e){throw Error(`Unhandled durable sealed-session identity: ${String(e)}`)}function Do(e){return{kind:`delete_durable_sealed_session`,durableRecord:e.durableRecord,deleteReason:e.deleteReason,preserveResolvedIdentity:e.preserveResolvedIdentity}}function Oo(e){switch(e.curve){case`ed25519`:return{authMethod:e.authMethod,curve:`ed25519`};case`ecdsa`:return{authMethod:e.authMethod,curve:`ecdsa`,chainTarget:e.chainTarget};default:return Eo(e)}}function ko(e){return[`ecdsa-material-v2`,e.walletId,e.authMethod,Re(e.chainTarget),e.materialActivation.activationId,e.materialActivation.capability,e.materialActivation.materialOwner,e.materialActivation.keyBinding,e.materialActivation.lifecycleBinding,e.materialActivation.signingWorker].map(e=>encodeURIComponent(String(e))).join(`:`)}const Ao=`ecdsa_inactive_sealed_material_v1`,jo=`sealed_record`;function Mo(e){let t=C(e)??{},n=o(t.ed25519),r=o(t.ecdsa);return{...n?{ed25519:n}:{},...r?{ecdsa:r}:{}}}function No(e){return Mo((C(e)??{}).thresholdSessionIds)}function Po(e){let t=C(e);if(!t)return!1;let n=[`signing`,`Grant`,`Id`].join(``),r=[`signing`,`grant`,`id`].join(`_`);return Object.prototype.hasOwnProperty.call(t,n)||Object.prototype.hasOwnProperty.call(t,r)}function Fo(e){let t=String(e||``).trim();return t===`ed25519`||t===`ecdsa`?t:void 0}function Io(e){let t=C(e);return t&&jo in t?t[jo]:e}function Lo(e){let t=e.ecdsaRestore?.chainTarget,n=o(e.thresholdSessionIds.ecdsa),r=o(e.thresholdSessionIds.ed25519);return{store_key:e.storeKey,wallet_id:e.walletId,auth_method:e.authMethod,curve:e.curve,signing_root_id:o(`signingRootId`in e?e.signingRootId:void 0),signing_root_version:o(`signingRootVersion`in e?e.signingRootVersion:void 0),ed25519_threshold_session_id:r,ecdsa_threshold_session_id:n,threshold_session_id:n||r,key_handle:o(e.ecdsaRestore?.keyHandle),chain_target_key:t?Re(t):void 0,expires_at_ms:e.expiresAtMs,updated_at:e.updatedAtMs,[jo]:e}}function Ro(e){return{store_key:e.storeKey,wallet_id:e.walletId,auth_method:e.authMethod,curve:e.curve,key_handle:e.ecdsaRestore.keyHandle,chain_target_key:Re(e.ecdsaRestore.chainTarget),updated_at:e.updatedAtMs,[jo]:e}}function zo(e){return Lo(e)}function Bo(e){let t=String(e||``).trim().toLowerCase();return/^0x[0-9a-f]{40}$/.test(t)?t:void 0}function Vo(e){return e.curve?e.curve:e.thresholdSessionIds.ecdsa?`ecdsa`:e.thresholdSessionIds.ed25519?`ed25519`:null}function Ho(e){try{return St(e)}catch{return null}}function Uo(e){switch(e){case`login`:case`registration`:case`manual-bootstrap`:case`email_otp`:return e;default:return null}}function Wo(e){try{let t=P(j(e)),n=o(t.signingRootId),r=o(t.signingRootVersion);return n&&r?{signingRootId:n,signingRootVersion:r}:null}catch{return null}}function Go(e){let t=C(e);if(!t)return;let n=null;try{n=Fe(C(t.chainTarget)??{})}catch{n=null}let r=Uo(t.source),i=At(t.authority),a=o(t.rpId),s=t.runtimePolicyScope&&typeof t.runtimePolicyScope==`object`?t.runtimePolicyScope:void 0,c=Wo(s),l=o(t.signingRootId),u=o(t.signingRootVersion);if(l&&c?.signingRootId&&l!==c.signingRootId||u&&c?.signingRootVersion&&u!==c.signingRootVersion)return;let d=l||c?.signingRootId||``,f=u||c?.signingRootVersion||``,p=o(t.credentialIdB64u),m=null;try{m=on(t.roleLocalMaterialRef)}catch{m=null}let h=Et(t.emailOtpAuthority),g=t.provider===`google`||t.provider===`email`?t.provider:null,_=o(t.providerSubjectId),v=o(t.emailHashHex),y=o(t.keyHandle),b=o(t.ecdsaThresholdKeyId),x=Bo(t.ethereumAddress),S=o(t.relayerKeyId),w=o(t.thresholdEcdsaPublicKeyB64u),T=Ho(t.routerAbEcdsaDerivationNormalSigning),E=null;try{E=Bt(t.publicCapability)}catch{E=null}let D=$o(t.participantIds);if(!n||!r||!d||!f||!y||!x||!S||!T||!E||!D.length)return;let ee=p&&a&&m&&i&&r!==`email_otp`?{source:r,authority:i,roleLocalMaterialRef:m,rpId:a,credentialIdB64u:p}:_&&g&&v&&m&&i&&h&&r===`email_otp`?{source:r,provider:g,providerSubjectId:_,emailHashHex:v,authority:i,emailOtpAuthority:h,roleLocalMaterialRef:m}:null;if(!ee)return;let O=o(t.clientVerifyingShareB64u);return{chainTarget:n,signingRootId:d,signingRootVersion:f,...ee,keyHandle:y,...b?{ecdsaThresholdKeyId:b}:{},ethereumAddress:x,relayerKeyId:S,...O?{clientVerifyingShareB64u:O}:{},...w?{thresholdEcdsaPublicKeyB64u:w}:{},participantIds:D,routerAbEcdsaDerivationNormalSigning:T,publicCapability:E,...s?{runtimePolicyScope:s}:{}}}function Ko(e){let t=C(e);if(!t)return;let r=o(t.nearAccountId),i=o(t.nearEd25519SigningKeyId),a=o(t.rpId),s=o(t.credentialIdB64u),c=o(t.providerSubjectId),u=t.provider===`google`||t.provider===`email`?t.provider:null,d=o(t.emailHashHex),f=o(t.authSubjectId),p=o(t.relayerKeyId),m=$o(t.participantIds),h=n(t.signerSlot),g=ue(t.routerAbNormalSigning),_=l(t.materialActivation),v=s&&!c&&_.ok?{credentialIdB64u:s,materialActivation:_.value}:u&&c&&d&&!s&&_.ok?{provider:u,providerSubjectId:c,emailHashHex:d,materialActivation:_.value}:null;if(!(!r||!i||!a||!p||!m.length||h==null||h<=0||!g||!v||f))return{nearAccountId:r,nearEd25519SigningKeyId:i,rpId:a,...v,relayerKeyId:p,participantIds:m,...t.runtimePolicyScope&&typeof t.runtimePolicyScope==`object`?{runtimePolicyScope:t.runtimePolicyScope}:{},signerSlot:h,routerAbNormalSigning:g}}function qo(e){let t=e.restore.materialActivation;return[`ed25519-material-v2`,e.walletId,e.authMethod,`ed25519`,t.activationId,t.capability,t.materialOwner,t.keyBinding,t.lifecycleBinding,t.signingWorker].map(Yo).join(`:`)}function Jo(e){let t=e.restore.roleLocalMaterialRef;return[`inactive-material`,e.walletId,e.authMethod,`ecdsa`,Re(e.restore.chainTarget),t.materialActivation.activationId].map(Yo).join(`:`)}function Yo(e){return encodeURIComponent(String(e||``).trim())}function Xo(e){let t=String(e||``).trim();return t===`passkey`||t===`email_otp`?t:void 0}function Zo(e){let t=C(e);return!!(o(t?.subjectId)||o(t?.userId))}function Qo(e){let t=C(e);return!!(o(t?.signingRootId)||o(t?.signingRootVersion))}function $o(e){return Array.isArray(e)?e.map(e=>Math.floor(Number(e))).filter(e=>Number.isFinite(e)&&e>0):[]}function es(e){return{authMethod:o(e?.authMethod)||null,curve:o(e?.curve)||null,storeKey:o(e?.storeKey)||null,walletId:o(e?.walletId)||null,thresholdSessionIds:No(e),hasEcdsaRestore:!!C(e?.ecdsaRestore),hasEd25519Restore:!!C(e?.ed25519Restore),issuedAtMs:n(e?.issuedAtMs),expiresAtMs:n(e?.expiresAtMs),remainingUses:n(e?.remainingUses),updatedAtMs:n(e?.updatedAtMs)}}function X(e,t,n){return{kind:e,storeKey:o(t?.storeKey)||null,walletId:o(t?.walletId)||null,reason:n,safeSummary:es(t)}}function ts(e){return{v:2,alg:pe,storageScope:fe,authMethod:e,secretKind:me}}function ns(e){e=Io(e);let t=C(e);if(!t)return X(`malformed`,null,`invalid_payload`);if(Po(t))return X(`delete_required`,t,`invalid_identity`);if(t.recordKind===`ecdsa_reauth_anchor_v1`)return X(`delete_required`,t,`invalid_header`);if(t.recordKind===Ao){let e=as(t);return e?{kind:`ecdsa_inactive_material`,record:e}:X(`malformed`,t,`invalid_identity`)}if(Number(t.v)===1)return X(`delete_required`,t,`invalid_header`);if(Number(t.v)!==2||String(t.alg||``).trim()!==`shamir3pass-v2`||String(t.storageScope||``).trim()!==`iframe_origin_indexeddb`||String(t.secretKind||``).trim()!==`signing_session_secret32`)return X(`malformed`,t,`invalid_header`);let r=String(t.authMethod||``).trim(),i=No(t),a=o(t.sealedSecretB64u),s=Fo(t.curve),c=o(t.subjectId),l=o(t.userId),u=o(t.walletId),d=o(t.signingRootId),f=o(t.signingRootVersion),p=f||(d?`default`:null),m=o(t.relayerUrl),h=o(t.keyVersion),g=o(t.groupId),_=n(t.issuedAtMs),v=n(t.expiresAtMs),y=n(t.remainingUses),b=n(t.updatedAtMs);if(!a||!h||g!==`rfc2409-group2`||r!==`passkey`&&r!==`email_otp`||!i.ed25519&&!i.ecdsa||!u)return X(`malformed`,t,`invalid_identity`);let x=Vo({curve:s,thresholdSessionIds:i});if(!x||_==null||_<=0||v==null||v<=0||y==null||y<0||b==null||b<=0)return X(`malformed`,t,`invalid_identity`);let S=C(t.ecdsaRestore),w=C(t.ed25519Restore),T=Go(t.ecdsaRestore),E=Ko(t.ed25519Restore);if(x===`ecdsa`){if(!i.ecdsa)return X(`malformed`,t,`invalid_identity`);if(c||l||d||f)return X(`delete_required`,t,`invalid_identity`);if(!S||!m)return X(`rebuild_required`,t,`missing_restore_metadata`);if(!$o(S.participantIds).length)return X(`delete_required`,t,`missing_participant_ids`);if(!T)return X(`rebuild_required`,t,`missing_restore_metadata`);let e=ko({walletId:u,authMethod:r,chainTarget:T.chainTarget,materialActivation:T.roleLocalMaterialRef.materialActivation}),n=o(t.storeKey);return n&&n!==e?X(`malformed`,t,`invalid_identity`):{kind:`current`,record:{...ts(r),storeKey:e,thresholdSessionIds:{...i.ed25519?{ed25519:i.ed25519}:{},ecdsa:i.ecdsa},sealedSecretB64u:a,curve:`ecdsa`,walletId:u,relayerUrl:m,keyVersion:h,groupId:le,ecdsaRestore:T,...E?{ed25519Restore:E}:{},issuedAtMs:_,expiresAtMs:v,remainingUses:y,updatedAtMs:b}}}if(!i.ed25519)return X(`malformed`,t,`invalid_identity`);if(c||l)return X(`delete_required`,t,`invalid_identity`);if(!w||!m)return X(`rebuild_required`,t,`missing_restore_metadata`);if(!$o(w.participantIds).length)return X(`delete_required`,t,`missing_participant_ids`);if(!E)return X(`rebuild_required`,t,`missing_restore_metadata`);let D=qo({walletId:u,authMethod:r,restore:E}),ee=o(t.storeKey);return ee&&ee!==D?X(`malformed`,t,`invalid_identity`):{kind:`current`,record:{...ts(r),storeKey:D,thresholdSessionIds:{ed25519:i.ed25519,...i.ecdsa?{ecdsa:i.ecdsa}:{}},sealedSecretB64u:a,curve:`ed25519`,walletId:u,...d?{signingRootId:d}:{},...p?{signingRootVersion:p}:{},relayerUrl:m,keyVersion:h,groupId:le,...T?{ecdsaRestore:T}:{},ed25519Restore:E,issuedAtMs:_,expiresAtMs:v,remainingUses:y,updatedAtMs:b}}}function rs(e){let t=ns(Io(e));return t.kind===`current`?t.record:null}function is(e){let t=C(e);if(!t||t.clientVerifyingShareB64u!=null)return null;let n,r,i,a;try{n=Fe(t.chainTarget&&typeof t.chainTarget==`object`?t.chainTarget:{}),r=j(t.runtimePolicyScope);let e=St(t.routerAbEcdsaDerivationNormalSigning);if(!e)return null;i=e,a=Bt(t.publicCapability)}catch{return null}let s=o(t.signingRootId),c=o(t.signingRootVersion),l=null;try{l=on(t.roleLocalMaterialRef)}catch{l=null}let u=At(t.authority),d=Et(t.emailOtpAuthority),f=o(t.keyHandle),p=o(t.ecdsaThresholdKeyId),m=o(t.ethereumAddress),h=o(t.relayerKeyId),g=o(t.thresholdEcdsaPublicKeyB64u),_=$o(t.participantIds);if(!s||!c||!f||!p||!m||!h||!g||!_.length)return null;let v={chainTarget:n,signingRootId:s,signingRootVersion:c,keyHandle:f,ecdsaThresholdKeyId:p,ethereumAddress:m,relayerKeyId:h,thresholdEcdsaPublicKeyB64u:g,participantIds:_,runtimePolicyScope:r,routerAbEcdsaDerivationNormalSigning:i,publicCapability:a};switch(t.source){case`email_otp`:{let e=t.provider===`google`||t.provider===`email`?t.provider:null,n=o(t.providerSubjectId),r=o(t.emailHashHex);return!e||!n||!r||!l||!u||!d||t.rpId!=null||t.credentialIdB64u!=null?null:{...v,source:`email_otp`,provider:e,providerSubjectId:n,emailHashHex:r,authority:u,emailOtpAuthority:d,roleLocalMaterialRef:l}}case`login`:case`registration`:case`manual-bootstrap`:{let e=o(t.rpId),n=o(t.credentialIdB64u);return!e||!n||!l||!u||t.providerSubjectId!=null||t.emailHashHex!=null?null:{...v,source:t.source,authority:u,roleLocalMaterialRef:l,rpId:e,credentialIdB64u:n}}default:return null}}function as(e){let t=C(Io(e));if(!t||t.recordKind!==Ao||Po(t)||t.thresholdSessionIds!=null||t.ed25519Restore!=null||t.curve!==`ecdsa`)return null;let r=Xo(t.authMethod),i=o(t.walletId),a=o(t.relayerUrl),s=is(t.ecdsaRestore),c=o(t.sealedSecretB64u),l=o(t.keyVersion),u=o(t.groupId),d=n(t.updatedAtMs),f=t.authorizationRetirementReason;if(!r||!i||!a||!s||t.alg!==`shamir3pass-v2`||t.storageScope!==`iframe_origin_indexeddb`||t.secretKind!==`signing_session_secret32`||!c||!l||u!==`rfc2409-group2`||t.issuedAtMs!=null||t.expiresAtMs!=null||t.remainingUses!=null||d==null||d<=0||f!==`expired`&&f!==`exhausted`)return null;let p=Jo({walletId:i,authMethod:r,restore:s});return o(t.storeKey)===p?os({storeKey:p,walletId:i,relayerUrl:a,sealedSecretB64u:c,keyVersion:l,updatedAtMs:d,authorizationRetirementReason:f,authMethod:r,ecdsaRestore:s}):null}function os(e){let{authMethod:t,ecdsaRestore:n}=e,r={recordKind:Ao,storeKey:e.storeKey,curve:`ecdsa`,walletId:e.walletId,relayerUrl:e.relayerUrl,alg:pe,storageScope:fe,secretKind:me,sealedSecretB64u:e.sealedSecretB64u,keyVersion:e.keyVersion,groupId:le,updatedAtMs:e.updatedAtMs,authorizationRetirementReason:e.authorizationRetirementReason};return t===`email_otp`&&n.source===`email_otp`||t===`passkey`&&n.source!==`email_otp`?{...r,authMethod:t,ecdsaRestore:n}:null}function ss(e){if(e.classification.kind===`ecdsa_inactive_material`||e.classification.kind===`rebuild_required`)return;let t=e.classification.kind===`malformed`?`malformed`:`rejected`,n={operation:e.operation,outcome:t,classificationKind:e.classification.kind,...e.classification};console.warn(`[SigningSessionSealedStore] rejected sealed record`,n)}function cs(e){let t=String(e.thresholdSessionId||``).trim(),r=Fo(e.curve),i=e.authMethod===`passkey`||e.authMethod===`email_otp`?e.authMethod:void 0;if(!r||!i)return null;let a=ls({thresholdSessionId:t,curve:r,thresholdSessionIds:e.thresholdSessionIds}),s=o(e.walletId),c=o(e.sealedSecretB64u),l=n(e.expiresAtMs),u=n(e.remainingUses),d=n(e.issuedAtMs),f=n(e.updatedAtMs),p=o(e.keyVersion);if(!t||!c||!p||e.groupId!==`rfc2409-group2`||!a.ed25519&&!a.ecdsa||d==null||d<=0||l==null||l<=0||u==null||u<0||f==null||f<=0)return null;let m=Go(e.ecdsaRestore),h=Ko(e.ed25519Restore);if(Zo(e)||r===`ecdsa`&&(!m?.chainTarget||!s||Qo(e)))return null;let g,_;e.curve===`ed25519`&&(g=o(e.signingRootId),_=o(e.signingRootVersion));let v=ns({...ts(i),thresholdSessionIds:a,sealedSecretB64u:c,curve:r,...s?{walletId:s}:{},...g?{signingRootId:g}:{},..._?{signingRootVersion:_}:{},...o(e.relayerUrl)?{relayerUrl:o(e.relayerUrl)}:{},keyVersion:p,groupId:le,...m?{ecdsaRestore:m}:{},...h?{ed25519Restore:h}:{},issuedAtMs:d,expiresAtMs:l,remainingUses:u,updatedAtMs:f});return v.kind===`current`?v.record:(ss({operation:`build current sealed session record`,classification:v}),null)}function ls(e){let t=Mo(e.thresholdSessionIds),n=String(e.thresholdSessionId||``).trim();return n&&(e.curve===`ed25519`&&t.ed25519===n||e.curve===`ecdsa`&&t.ecdsa===n)?t:{}}function us(e,t){let n=o(t),r=o(e.ecdsaThresholdKeyId),i=o(e.thresholdEcdsaPublicKeyB64u);if(!n||!r||!i)return null;let a;try{a=j(e.runtimePolicyScope)}catch{return null}let s={chainTarget:e.chainTarget,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,keyHandle:e.keyHandle,ecdsaThresholdKeyId:r,ethereumAddress:e.ethereumAddress,relayerKeyId:e.relayerKeyId,thresholdEcdsaPublicKeyB64u:i,participantIds:[...e.participantIds],runtimePolicyScope:a,routerAbEcdsaDerivationNormalSigning:e.routerAbEcdsaDerivationNormalSigning,publicCapability:e.publicCapability};switch(e.source){case`email_otp`:return{...s,source:`email_otp`,provider:e.provider,providerSubjectId:e.providerSubjectId,emailHashHex:e.emailHashHex,authority:e.authority,emailOtpAuthority:e.emailOtpAuthority,roleLocalMaterialRef:on(e.roleLocalMaterialRef)};case`login`:case`registration`:case`manual-bootstrap`:return{...s,source:e.source,authority:e.authority,roleLocalMaterialRef:on(e.roleLocalMaterialRef),rpId:e.rpId,credentialIdB64u:e.credentialIdB64u}}}function ds(e){let t=e.record,n=us(t.ecdsaRestore,t.relayerUrl);return n?os({storeKey:Jo({walletId:t.walletId,authMethod:t.authMethod,restore:n}),walletId:t.walletId,relayerUrl:t.relayerUrl,sealedSecretB64u:t.sealedSecretB64u,keyVersion:t.keyVersion,updatedAtMs:e.updatedAtMs,authorizationRetirementReason:e.retirement,authMethod:t.authMethod,ecdsaRestore:n}):null}function fs(e){let t=ds(e);if(!t)throw Error(`[SigningSessionSealedStore] inactive ECDSA material requires exact public restore facts`);return t}const ps=15e3;function ms(e){return se(e,32,`sealed signing session restore IDs`)}function hs(e){return{lease_key:e.leaseKey,owner_id:e.ownerId,attempt_id:e.attemptId,started_at_ms:e.startedAtMs,expires_at_ms:e.expiresAtMs,lease:e}}function gs(e){let t=new Set,n=o(e.walletId);return n&&t.add(n),t}function _s(e,t){let n=gs(e);if(!n.size)return!1;for(let e of gs(t))if(n.has(e))return!0;return!1}function vs(e,t){if(!_s(e,t)||e.authMethod!==t.authMethod||e.curve!==t.curve)return!1;if(e.curve===`ed25519`&&t.curve===`ed25519`)return p(e.ed25519Restore.materialActivation,t.ed25519Restore.materialActivation);if(e.curve===`ecdsa`){let n=o(e.ecdsaRestore?.keyHandle),r=o(t.ecdsaRestore?.keyHandle);if(!n||!r||n!==r)return!1;let i=e.ecdsaRestore?.chainTarget,a=t.ecdsaRestore?.chainTarget;if(!i||!a||!Be(i,a))return!1}return!0}function ys(e){return x({storeKey:e.storeKey,walletId:e.walletId,authMethod:e.authMethod,signingRootId:e.signingRootId??null,signingRootVersion:e.signingRootVersion??null,restore:e.ed25519Restore})}function bs(e,t){if(typeof e.primaryKey!=`string`||!e.primaryKey.trim())throw Error(`[SigningSessionSealedStore] exact Ed25519 record key is invalid`);return{primaryKey:e.primaryKey,record:t}}function xs(e,t){return e.record.updatedAtMs===t.record.updatedAtMs?e.primaryKey===e.record.storeKey?e:t.primaryKey===t.record.storeKey?t:e.primaryKey.localeCompare(t.primaryKey)<=0?e:t:e.record.updatedAtMs>t.record.updatedAtMs?e:t}async function Ss(e,t={writeCanonical:!1}){let n=e[0];if(!n)return null;let r=ys(n.record);for(let t of e.slice(1))if(ys(t.record)!==r)throw Error(`[SigningSessionSealedStore] exact Ed25519 material has conflicting public identity facts`);let i=e.reduce(xs),a=i.record.storeKey,o=[...new Set(e.map(e=>e.primaryKey))].filter(e=>e!==a);return(t.writeCanonical||o.length>0||i.primaryKey!==a)&&await Y.replaceSealedRecord({row:zo(i.record),staleStoreKeys:o}),i.record}async function Cs(e){let t=Io(e.value),n=ns(t);if(n.kind!==`current`)return n;let r=C(t);return Po(C(e.value))||Po(r)?X(`delete_required`,r,`invalid_identity`):n}function ws(e){return No(Io(e))}function Ts(e,t,n,r){ss({operation:e,classification:t}),(t.kind===`delete_required`||t.kind===`malformed`)&&r.push(n)}function Es(e){let t=C(e);if(!t)return null;if(C(t.lease))return Es(t.lease);if(Number(t.v)!==1||Po(t))return null;let r=o(t.leaseKey),i=o(t.ownerId),a=o(t.attemptId),s=n(t.startedAtMs),c=n(t.expiresAtMs);return!r||!i||!a||s==null||s<=0||c==null||c<=s?null:{v:1,leaseKey:r,ownerId:i,attemptId:a,startedAtMs:s,expiresAtMs:c}}function Ds(e){return{v:1,leaseKey:e.leaseKey,ownerId:e.ownerId,attemptId:ms(`restore-attempt`),startedAtMs:e.nowMs,expiresAtMs:e.nowMs+e.ttlMs}}function Os(e,t,n){return!(e.authMethod!==n.authMethod||e.thresholdSessionIds[n.curve]!==t||n.curve===`ecdsa`&&(!e.ecdsaRestore?.chainTarget||!Be(e.ecdsaRestore.chainTarget,n.chainTarget)))}function ks(e,t){if(e?.authMethod&&e.curve===`ed25519`||e?.authMethod&&e.curve===`ecdsa`&&e.chainTarget)return e;throw console.warn(`[SigningSessionSealedStore] rejected ambiguous sealed record access`,{operation:t}),Error(`[SigningSessionSealedStore] ${t} requires an explicit authMethod, curve, and ECDSA chain target`)}async function As(e){let t=await Y.collectRawSealedRecordEntriesByThresholdSessionId(e);return t.length?t:(await Y.collectAllRawSealedRecordEntries()).filter(t=>{let n=ws(t.value);return n.ed25519===e||n.ecdsa===e})}async function js(e,t,n){let r=await As(e),i=null,a=[],o=[];for(let s of r){let r=await Cs(s);if(r.kind===`current`){Os(r.record,e,t)&&(i=r.record,r.record.curve===`ed25519`&&a.push(bs(s,r.record)));continue}Ts(n,r,s.primaryKey,o)}return await Y.deleteSealedRecords(o),a.length>0?await Ss(a):i}async function Ms(e,t){try{let n=await As(e),r=[];for(let i of n){let n=await Cs(i),a=n.kind===`current`?n.record:null;a?.storeKey&&Os(a,e,t)&&r.push(i.primaryKey)}await Y.deleteSealedRecords(r)}catch{}}async function Ns(e){if(!gs(e).size||!e.authMethod)return[];try{let t=await Y.collectAllRawSealedRecordEntries(),n=[];for(let r of t){let t=await Cs(r),i=t.kind===`current`?t.record:null;i&&i.storeKey!==e.storeKey&&vs(i,e)&&n.push(i)}return n}catch{return[]}}function Ps(e){if(e.curve!==`ecdsa`)return null;let t=us(e.ecdsaRestore,e.relayerUrl);return t?Jo({walletId:e.walletId,authMethod:e.authMethod,restore:t}):null}async function Fs(e,t){let n=ks(t,`read`),r=String(e||``).trim();return r?await js(r,n,`read`):null}function Is(e,t){return e.curve===`ed25519`&&e.authMethod===t.authMethod&&p(e.ed25519Restore.materialActivation,t.materialActivation)}async function Ls(e){let t=await Y.collectAllRawSealedRecordEntries(),n=[],r=[];for(let i of t){let t=await Cs(i);if(t.kind===`current`){let n=t.record;Is(n,e)&&r.push(bs(i,n));continue}Ts(`read exact Ed25519 material`,t,i.primaryKey,n)}return await Y.deleteSealedRecords(n),await Ss(r)}async function Rs(e){let t=o(e.walletId);if(!t)return[];let n=ks(e.filter,`list exact account records`),r=e.filter.curve===`ecdsa`?e.filter.chainTarget:void 0,i=await Y.collectAllRawSealedRecordEntries(),a=[];try{let e=[],o=new Set,s=new Map;for(let c of i){let i=await Cs(c);if(i.kind!==`current`){Ts(`list exact account records`,i,c.primaryKey,a);continue}let l=i.record;if(l.walletId===t&&l.authMethod===n.authMethod&&l.thresholdSessionIds[n.curve]&&!(r&&(!l.ecdsaRestore?.chainTarget||!Be(l.ecdsaRestore.chainTarget,r)))){if(l.curve===`ed25519`){let e=s.get(l.storeKey)??[];e.push(bs(c,l)),s.set(l.storeKey,e);continue}o.has(l.storeKey)||(o.add(l.storeKey),e.push(l))}}for(let t of s.values()){let n=await Ss(t);n&&e.push(n)}return await Y.deleteSealedRecords(a),e}finally{await Y.deleteSealedRecords(a)}}async function zs(e){let t=o(e.walletId);if(!t)return[];if(e.filter.curve!==`ecdsa`)return console.warn(`[SigningSessionSealedStore] rejected non-ECDSA wallet-scoped list`,{operation:`list wallet ecdsa records`}),[];let n=await Y.collectAllRawSealedRecordEntries(),r=[];try{let i=[],a=new Set;for(let o of n){let n=await Cs(o);if(n.kind===`ecdsa_inactive_material`){let r=n.record;if(r.walletId!==t||e.filter.authMethod&&r.authMethod!==e.filter.authMethod||a.has(r.storeKey))continue;a.add(r.storeKey),i.push(r);continue}if(n.kind!==`current`){Ts(`list wallet ecdsa records`,n,o.primaryKey,r);continue}let s=n.record;s.walletId===t&&(e.filter.authMethod&&s.authMethod!==e.filter.authMethod||s.thresholdSessionIds.ecdsa&&s.ecdsaRestore?.chainTarget&&(a.has(s.storeKey)||(a.add(s.storeKey),i.push(s))))}return await Y.deleteSealedRecords(r),i}finally{await Y.deleteSealedRecords(r)}}async function Bs(e){let t=ns(e);if(t.kind!==`current`){ss({operation:`write exact sealed session`,classification:t});return}let n=t.record;if(n.curve===`ed25519`){let e=[{primaryKey:n.storeKey,record:n}],t=await Y.collectAllRawSealedRecordEntries();for(let r of t){let t=await Cs(r);t.kind===`current`&&t.record.curve===`ed25519`&&t.record.storeKey===n.storeKey&&e.push(bs(r,t.record))}await Ss(e,{writeCanonical:!0});return}let r=await Ns(n),i=Ps(n);await Y.replaceSealedRecord({row:zo(n),staleStoreKeys:[...r.map(e=>e.storeKey),...i?[i]:[]]})}function Vs(e,t,n){return Hs({current:e,inactive:fs({record:e,retirement:t,updatedAtMs:n})})}async function Hs(e){await Y.replaceSealedRecordAndDeleteRestoreLease({row:Ro(e.inactive),staleStoreKeys:[e.current.storeKey],restoreLeaseKey:e.current.storeKey})}async function Us(e){let t=ks(e.filter,`update policy`),n=String(e.thresholdSessionId||``).trim();if(!n)return;let r=await Fs(n,t);r&&await Gs(r,e)}async function Ws(e){let t=await Ls(e.locator);t&&await Gs(t,e)}async function Gs(e,t){let r=n(t.expiresAtMs??e.expiresAtMs),i=n(t.remainingUses??e.remainingUses),a=n(t.updatedAtMs);if(r==null||r<=0||i==null||i<0||a==null||a<=0)return;let o={...e,expiresAtMs:r,remainingUses:i,updatedAtMs:a};if(o.curve===`ecdsa`){let e=r<=Date.now()?`expired`:i===0?`exhausted`:null;if(e){await Vs(o,e,a);return}}await Bs(o)}async function Ks(e,t,n){let r=ks(t,`delete`),i=String(e||``).trim();if(!i)return;let a=await js(i,r,`delete`);await Ms(i,r),a&&n.deleteResolvedIdentity&&await Y.deleteRestoreLease(a.storeKey)}async function qs(e,t){let n=await Y.collectAllRawSealedRecordEntries(),r=[],i=[];for(let a of n){let n=await Cs(a);if(n.kind!==`current`){ss({operation:`delete exact Ed25519 material`,classification:n});continue}let o=n.record;Is(o,e)&&(r.push(a.primaryKey),t.deleteResolvedIdentity&&i.push(o.storeKey))}if(await Y.deleteSealedRecords(r),t.deleteResolvedIdentity)for(let e of i)await Y.deleteRestoreLease(e)}async function Js(e){let t=e.preserveResolvedIdentity?{deleteResolvedIdentity:!1}:{deleteResolvedIdentity:!0,resolvedIdentityDeleteReason:`durable_record_deleted`};if(e.durableRecord.curve===`ed25519`){await qs({kind:`ed25519_durable_material`,authMethod:e.durableRecord.authMethod,materialActivation:e.durableRecord.materialActivation},t);return}let n=Oo(e.durableRecord),r=await Ys(e.durableRecord.thresholdSessionId,n);if(e.preserveResolvedIdentity&&e.durableRecord.curve===`ecdsa`&&r?.curve===`ecdsa`&&(e.deleteReason===`expired`||e.deleteReason===`exhausted`)){await Vs(r,e.deleteReason,Date.now());return}await Ks(e.durableRecord.thresholdSessionId,n,t)}async function Ys(e,t){try{return await Fs(e,t)}catch{return null}}async function Xs(e){let t=ks(e,`acquire restore lease`),r=String(e.thresholdSessionId||``).trim();if(!r)return null;let i=n(e.nowMs??Date.now())??Date.now(),a=Math.max(1,n(e.ttlMs??ps)??ps),s=o(e.ownerId)||ms(`restore-owner`);return await js(r,t,`acquire restore lease`)?await Y.withRestoreLeaseTransaction(r,async e=>{let n=[];for(let t of e.entries){let e=rs(t.value);e?.storeKey&&!n.some(t=>t.storeKey===e.storeKey)&&n.push(e)}let o=n.find(e=>Os(e,r,t))||null;if(!o)return e.abort(),null;let c=Es(await e.getRawRestoreLease(o.storeKey));if(c&&c.expiresAtMs>i&&c.ownerId!==s)return e.abort(),null;let l=Ds({leaseKey:o.storeKey,ownerId:s,nowMs:i,ttlMs:a});return e.putRestoreLease(hs(l)),{...l,thresholdSessionId:r}}):null}async function Zs(e){!e?.leaseKey||!e.ownerId||!e.attemptId||await Y.deleteRestoreLeaseIf({leaseKey:e.leaseKey,shouldDelete:t=>{let n=Es(t);return n?.ownerId===e.ownerId&&n.attemptId===e.attemptId}})}function Qs(e){return String(e??``).trim()||null}function $s(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>0?e:null}function ec(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0?e:null}function tc(e){let t=A(e);return t?.length===2?[t[0],t[1]]:null}function nc(e){let t=e.ed25519Restore;switch(e.authMethod){case Ge.passkey:{let e=Qs(t.credentialIdB64u);return e?{kind:`passkey`,rpId:Mt(t.rpId),credentialIdB64u:e}:null}case Ge.emailOtp:{if(!(`provider`in t))return null;let e=Qs(t.providerSubjectId),n=Qs(t.emailHashHex);return!e||!n?null:{kind:`email_otp`,provider:t.provider,providerSubjectId:e,emailHashHex:n}}}}function rc(e){switch(e.kind){case`passkey`:return{kind:Ge.passkey,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u};case`email_otp`:return{kind:Ge.emailOtp,providerSubjectId:e.providerSubjectId}}}function ic(e){let t=e.ed25519Restore,n=Qs(e.thresholdSessionIds.ed25519),r=Qs(e.relayerUrl),i=Qs(t.relayerKeyId),a=$s(e.expiresAtMs),o=ec(e.remainingUses),s=en(t.signerSlot),c=tc(t.participantIds),l=ce(t.runtimePolicyScope),u=l?P(l):null,d=Qs(u?.signingRootVersion),f=ue(t.routerAbNormalSigning),p=nc(e);if(!n||!r||!i||!a||o===null||!s||!c||!l||!u||!d||!f||f.signingWorkerId!==i||!p||e.signingRootId!==u.signingRootId||e.signingRootVersion!==d)return null;try{return{kind:`exact_ed25519_sealed_session_runtime`,sealedRecord:e,walletId:Ie(e.walletId),nearAccountId:z(t.nearAccountId),nearEd25519SigningKeyId:Zt(t.nearEd25519SigningKeyId),signerSlot:s,factor:p,auth:rc(p),thresholdSessionId:Dn.thresholdEd25519Session(n),remainingUses:o,expiresAtMs:a,relayerUrl:r,relayerKeyId:i,participantIds:c,runtimePolicyScope:l,signingRootId:u.signingRootId,signingRootVersion:d,routerAbNormalSigning:f}}catch{return null}}async function ac(e){let t;switch(e.runtime.factor.kind){case`passkey`:t=Dt({walletId:e.runtime.walletId,factor:{kind:`passkey`,credentialIdB64u:e.runtime.factor.credentialIdB64u},verifier:{kind:`webauthn`,rpId:e.runtime.factor.rpId},bindingId:e.walletAuthMethodId});break;case`email_otp`:t=Et({walletId:e.runtime.walletId,factor:{kind:`email_otp`,provider:e.runtime.factor.provider,providerUserId:e.runtime.factor.providerSubjectId},verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:e.runtime.factor.emailHashHex},bindingId:e.walletAuthMethodId});break;default:return oc(e.runtime.factor)}if(!t)throw Error(`[SigningEngine][near] sealed Ed25519 authority is invalid`);return await Ct({authority:t})}function oc(e){throw Error(`Unsupported Ed25519 factor: ${String(e)}`)}async function sc(e){let{authorization:t,runtime:n}=e;if(t.session.walletId!==n.walletId||t.session.authMethodId!==t.selectedAuthMethod.walletAuthMethodId||t.session.quotaId!==t.status.quotaId||t.operationCredential.walletSessionId!==t.status.walletSessionId||t.operationCredential.token.trim().length===0||t.status.remainingUses<=0||!rr({session:t.session,materialActivation:n.sealedRecord.ed25519Restore.materialActivation}))return!1;if(n.factor.kind===`passkey`){if(t.selectedAuthMethod.kind!==`passkey`||String(t.selectedAuthMethod.rpId)!==String(n.factor.rpId)||t.selectedAuthMethod.credentialIdB64u!==n.factor.credentialIdB64u||t.selectedFactorAuthority.factor.kind!==`passkey`||t.selectedFactorAuthority.factor.credentialIdB64u!==n.factor.credentialIdB64u||t.selectedFactorAuthority.verifier.kind!==`webauthn`||String(t.selectedFactorAuthority.verifier.rpId)!==String(n.factor.rpId))return!1}else if(t.selectedAuthMethod.kind!==`email_otp`||t.selectedAuthMethod.emailHashHex!==n.factor.emailHashHex||t.selectedFactorAuthority.factor.kind!==`email_otp`||t.selectedFactorAuthority.factor.provider!==n.factor.provider||t.selectedFactorAuthority.factor.providerUserId!==n.factor.providerSubjectId||t.selectedFactorAuthority.verifier.kind!==`email_otp_wallet_auth_method`||t.selectedFactorAuthority.verifier.emailHashHex!==n.factor.emailHashHex)return!1;try{let e=await ac({runtime:n,walletAuthMethodId:t.selectedAuthMethod.walletAuthMethodId}),r=await Ct({authority:t.selectedFactorAuthority});return e.walletId===t.selectedAuthority.walletId&&e.walletAuthMethodId===t.selectedAuthMethod.walletAuthMethodId&&e.walletId===r.walletId&&e.walletAuthMethodId===r.walletAuthMethodId&&e.authorityDigest===r.authorityDigest}catch{return!1}}function cc(e,t){switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId&&e.credentialIdB64u===t.credentialIdB64u;case`email_otp`:return t.kind===`email_otp`&&e.providerSubjectId===t.providerSubjectId}}function lc(e){let t=e.laneIdentity.signer,n=e.record.ed25519Restore;return e.record.walletId===t.account.wallet.walletId&&n.nearAccountId===t.account.nearAccountId&&n.nearEd25519SigningKeyId===t.nearEd25519SigningKeyId&&n.signerSlot===t.signerSlot&&e.record.thresholdSessionIds.ed25519===e.laneIdentity.thresholdSessionId}function uc(e,t){return cc(e.auth,t.auth)}async function dc(e,t){let n=(await t.listExactSealedSessionsForWallet({walletId:e.walletId,filter:{authMethod:e.laneIdentity.auth.kind,curve:`ed25519`}})).filter(t=>t.curve===`ed25519`&&lc({record:t,laneIdentity:e.laneIdentity}));if(n.length===0)return{kind:`missing`};if(n.length>1)return{kind:`conflict`};let r=ic(n[0]);return!r||!uc(r,e.laneIdentity)?{kind:`corrupt`}:{kind:`resolved`,runtime:r}}async function fc(e){return await dc(e,{listExactSealedSessionsForWallet:Rs})}async function pc(e,t){return hc(await mc(e,t))}async function mc(e,t){let n=await Promise.all([t.listExactSealedSessionsForWallet({walletId:e,filter:{authMethod:Ge.passkey,curve:`ed25519`}}),t.listExactSealedSessionsForWallet({walletId:e,filter:{authMethod:Ge.emailOtp,curve:`ed25519`}})]),r=[];for(let e of n)for(let t of e)t.curve===`ed25519`&&r.push(t);return r}function hc(e){if(e.length===0)return{kind:`missing`};if(e.length>1)return{kind:`conflict`};let t=ic(e[0]);return t?{kind:`resolved`,runtime:t}:{kind:`corrupt`}}async function gc(e){return await pc(e,{listExactSealedSessionsForWallet:Rs})}async function _c(e,t){let n=await mc(e.walletId,t),r=[];for(let t of n)t.ed25519Restore.nearAccountId===e.nearAccountId&&t.ed25519Restore.nearEd25519SigningKeyId===e.nearEd25519SigningKeyId&&r.push(t);return hc(r)}async function vc(e){return await _c(e,{listExactSealedSessionsForWallet:Rs})}function yc(e,t){let n=String(e).trim();if(!n)throw Error(`${t} is required for Ed25519 Wallet Session state`);return n}function bc(e,t){if(!Number.isSafeInteger(e)||e<1)throw Error(`${t} must be positive for Ed25519 Wallet Session state`);return e}function xc(e){let t=Dn.thresholdEd25519Session(yc(e.signingWalletSession.thresholdSessionId,`thresholdSessionId`)),n=yc(e.signingWalletSession.auth.walletSessionToken,`walletSessionToken`),r=yc(e.relayerUrl,`relayerUrl`),i=yc(e.providerSubjectId,`providerSubjectId`),a=bc(e.signerSlot,`signerSlot`),o=bc(e.signingWalletSession.remainingUses,`remainingUses`);return{walletSessionAuth:{kind:`wallet_session_opaque`,home:e.signingWalletSession.auth.credential.home,walletSessionToken:n},walletSessionId:e.signingWalletSession.walletSessionId,quotaId:e.signingWalletSession.quotaId,thresholdSessionId:t,signingLane:lr({walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:a,auth:{kind:`email_otp`,providerSubjectId:i},walletSessionId:e.signingWalletSession.walletSessionId,quotaId:e.signingWalletSession.quotaId,thresholdSessionId:t,retention:`session`,sessionOrigin:`login`}),remainingUses:o,signingRootId:e.signingWalletSession.signingRootId,signingRootVersion:e.signingWalletSession.signingRootVersion,routerAbNormalSigning:e.signingWalletSession.routerAbNormalSigning,runtimePolicyScope:e.signingWalletSession.runtimePolicyScope,relayerUrl:r,signingWalletSession:e.signingWalletSession,authority:e.authority}}function Sc(e){let t=Dn.thresholdEd25519Session(yc(e.signingWalletSession.thresholdSessionId,`thresholdSessionId`)),n=yc(e.signingWalletSession.auth.walletSessionToken,`walletSessionToken`),r=yc(e.relayerUrl,`relayerUrl`),i=yc(e.credentialIdB64u,`credentialIdB64u`),a=bc(e.signerSlot,`signerSlot`);return{walletSessionAuth:{kind:`wallet_session_opaque`,home:e.signingWalletSession.auth.credential.home,walletSessionToken:n},walletSessionId:e.signingWalletSession.walletSessionId,quotaId:e.signingWalletSession.quotaId,thresholdSessionId:t,signingLane:lr({walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:a,auth:{kind:`passkey`,rpId:e.rpId,credentialIdB64u:i},walletSessionId:e.signingWalletSession.walletSessionId,quotaId:e.signingWalletSession.quotaId,thresholdSessionId:t,storageSource:`login`}),remainingUses:e.signingWalletSession.remainingUses,signingRootId:e.signingWalletSession.signingRootId,signingRootVersion:e.signingWalletSession.signingRootVersion,routerAbNormalSigning:e.signingWalletSession.routerAbNormalSigning,runtimePolicyScope:e.signingWalletSession.runtimePolicyScope,relayerUrl:r,signingWalletSession:e.signingWalletSession,authority:e.authority}}async function Cc(e){let t=e.authorization.operationCredential.token,n=e.authorization.session.authorizationId,r=await ac({runtime:e.runtime,walletAuthMethodId:e.authorization.selectedAuthMethod.walletAuthMethodId}),i=await Ct({authority:e.authorization.selectedFactorAuthority}),a=Math.min(e.runtime.expiresAtMs,e.authorization.status.expiresAtMs);if(!t||!n||e.authorization.session.walletId!==e.runtime.walletId||e.authorization.selectedAuthMethod.kind!==e.runtime.auth.kind||r.walletId!==e.runtime.walletId||r.walletAuthMethodId!==e.authorization.selectedAuthMethod.walletAuthMethodId||r.walletId!==i.walletId||r.walletAuthMethodId!==i.walletAuthMethodId||String(r.authorityDigest)!==String(i.authorityDigest)||e.authorization.operationCredential.walletSessionId!==e.authorization.status.walletSessionId||a<=e.nowMs)throw Error(`Ed25519 Wallet Session authorization does not match sealed material`);let o=go({walletId:e.runtime.walletId,nearAccountId:e.runtime.nearAccountId,nearEd25519SigningKeyId:e.runtime.nearEd25519SigningKeyId,walletSessionId:e.authorization.operationCredential.walletSessionId,authorizationId:n,quotaId:e.authorization.session.quotaId,thresholdSessionId:e.runtime.thresholdSessionId,remainingUses:Math.min(e.runtime.remainingUses,e.authorization.status.remainingUses),expiresAtMs:a,runtimePolicyScope:e.runtime.runtimePolicyScope,signingRootId:e.runtime.signingRootId,signingRootVersion:e.runtime.signingRootVersion,routerAbNormalSigning:e.runtime.routerAbNormalSigning,walletSessionToken:t,home:e.authorization.operationCredential.home,nowMs:e.nowMs});if(!o.ok)throw Error(`Ed25519 Wallet Session runtime is invalid: ${o.reason}`);if(e.runtime.factor.kind===`passkey`&&e.runtime.auth.kind===`passkey`)return Sc({walletId:e.runtime.walletId,nearAccountId:e.runtime.nearAccountId,nearEd25519SigningKeyId:e.runtime.nearEd25519SigningKeyId,signerSlot:e.runtime.signerSlot,rpId:e.runtime.factor.rpId,credentialIdB64u:e.runtime.factor.credentialIdB64u,relayerUrl:e.runtime.relayerUrl,authority:r,signingWalletSession:o.value});if(e.runtime.factor.kind===`email_otp`&&e.runtime.auth.kind===`email_otp`)return xc({walletId:e.runtime.walletId,nearAccountId:e.runtime.nearAccountId,nearEd25519SigningKeyId:e.runtime.nearEd25519SigningKeyId,providerSubjectId:e.runtime.auth.providerSubjectId,signerSlot:e.runtime.signerSlot,relayerUrl:e.runtime.relayerUrl,authority:r,signingWalletSession:o.value});throw Error(`Ed25519 sealed runtime factor and auth binding disagree`)}function wc(e){return{thresholdSessionId:e.thresholdSessionId,signer:e.signingLane.identity.signer,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,routerAbNormalSigning:e.routerAbNormalSigning,runtimePolicyScope:e.runtimePolicyScope,relayerUrl:e.relayerUrl}}function Tc(e){return e.authorization.capabilitySubjects.some(t=>t.kind===`sign`&&t.keyFamily===`ed25519`&&p(t.materialActivation,e.materialActivation))}function Ec(e){let t=e.state,n=e.authorization,r=t.signingLane.identity.signer.account.wallet.walletId,i=e.operationCredential.token,a=t.signingLane.identity.signer,o=Math.min(t.signingWalletSession.expiresAtMs,n.expiresAtMs);if(!i||!Tc({authorization:n,materialActivation:e.materialActivation})||n.walletId!==r||n.authMethodId!==t.authority.walletAuthMethodId||e.operationCredential.walletSessionId!==t.walletSessionId||n.authorizationId!==t.signingWalletSession.authorizationId||o<=e.nowMs||!Number.isSafeInteger(o))return null;let s=go({walletId:String(a.account.wallet.walletId),nearAccountId:String(a.account.nearAccountId),nearEd25519SigningKeyId:String(a.nearEd25519SigningKeyId),walletSessionId:String(t.walletSessionId),authorizationId:String(t.signingWalletSession.authorizationId),quotaId:String(t.quotaId),thresholdSessionId:String(t.thresholdSessionId),remainingUses:t.remainingUses,expiresAtMs:o,runtimePolicyScope:t.runtimePolicyScope,signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,routerAbNormalSigning:t.routerAbNormalSigning,walletSessionToken:i,home:e.operationCredential.home,nowMs:e.nowMs});if(!s.ok)return null;switch(t.signingLane.auth.kind){case`passkey`:return{...Sc({walletId:a.account.wallet.walletId,nearAccountId:a.account.nearAccountId,nearEd25519SigningKeyId:a.nearEd25519SigningKeyId,signerSlot:a.signerSlot,rpId:t.signingLane.auth.rpId,credentialIdB64u:t.signingLane.auth.credentialIdB64u,relayerUrl:t.relayerUrl,authority:t.authority,signingWalletSession:s.value}),walletSessionAuthorization:n,walletSessionOperationCredential:e.operationCredential};case`email_otp`:return{...xc({walletId:a.account.wallet.walletId,nearAccountId:a.account.nearAccountId,nearEd25519SigningKeyId:a.nearEd25519SigningKeyId,providerSubjectId:t.signingLane.auth.providerSubjectId,signerSlot:a.signerSlot,relayerUrl:t.relayerUrl,authority:t.authority,signingWalletSession:s.value}),walletSessionAuthorization:n,walletSessionOperationCredential:e.operationCredential};default:return Dc(t.signingLane.auth)}}function Dc(e){throw Error(`Unknown Ed25519 signing lane auth: ${String(e)}`)}async function Oc(e){let t=e.state.signingLane.identity.signer.account.wallet.walletId,n=await lo({ports:e.ports,input:{walletId:t,authMethod:En(e.state.signingLane.auth),walletSessionId:e.state.walletSessionId,quotaId:e.state.quotaId,requiredSigningSubject:co(e.state.signingLane.identity),expiry:{kind:`unexpired`,nowMs:e.nowMs}}});return n.kind!==`resolved`||n.resolved.authMethod.walletAuthMethodId!==e.state.authority.walletAuthMethodId?null:Ec({state:e.state,authorization:n.resolved.session,operationCredential:n.resolved.operationCredential,materialActivation:n.resolved.materialActivation,nowMs:e.nowMs})}function kc(e){return Pt(x({operation:`wallet_add_signer_activate_v2`,addSignerCeremonyId:e.addSignerCeremonyId,activationCorrelationId:e.activationCorrelationId,publicFacts:e.publicFacts}))}async function Ac(e){return L(await k(String(kc(e))))}function jc(e){let t;try{t=qe(e,`custody envelope`)}catch(e){return{ok:!1,reason:e instanceof Error?e.message:`custody envelope is invalid`}}let n=t.lifecycle.state;return n===`active`?t.binding.kind===`wallet_custody_seed_v1`?{ok:!0,custodyJson:JSON.stringify({envelopeBinding:{walletId:t.walletId,envelopeId:t.envelopeId,factor:t.factor,envelopeRevision:t.envelopeRevision,binding:t.binding,ownership:Je(t.ownership)},nonceB64u:t.nonceB64u,sealedCustodySecretB64u:t.sealedCustodySecretB64u,aadHashB64u:t.aadHashB64u,ciphertextDigestB64u:t.ciphertextDigestB64u})}:{ok:!1,reason:`generic custody wire rejects non-seed envelopes`}:{ok:!1,reason:`custody envelope is ${n}`}}function Mc(e){let t={};return xr()&&(t[`X-Seams-Benchmark-Diagnostics`]=`registration-flow`),e&&(t[hn]=e.value),Object.keys(t).length>0?t:void 0}function Nc(e){let t=R(e);if(t.length!==20)throw Error(`ECDSA activation returned an invalid address`);let n=``;for(let e of t)n+=e.toString(16).padStart(2,`0`);return`0x${n}`}var Pc=class extends Error{code=`wallet_unlock_required`;next=`unlock_exact_method`;projection;constructor(e){super(`Registration response was already committed; exact-method unlock is required`),this.name=`RegistrationExactMethodUnlockRequiredError`,this.projection=e}};function Fc(e){switch(e.kind){case`issued`:return e.session;case`already_committed`:throw new Pc(e.session);default:return q(e)}}function Ic(e){let t=e[0];if(t)for(let n of e.slice(1)){let e=Rc(t,n);if(e)throw Error(`ECDSA registration returned partitioned EVM-family wallet key material: ${e}`)}}function Lc(e){for(let t of e.walletKeys)if(!wt(t.publicCapability,e.session.publicCapability))throw Error(`ECDSA registration wallet key public capability does not match client-verified activation`)}function Rc(e,t){return e.keyScope!==`evm-family`||t.keyScope!==`evm-family`?`keyScope`:e.walletId===t.walletId?e.evmFamilySigningKeySlotId===t.evmFamilySigningKeySlotId?e.keyHandle===t.keyHandle?e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId?e.signingRootId===t.signingRootId?e.signingRootVersion===t.signingRootVersion?e.thresholdEcdsaPublicKeyB64u===t.thresholdEcdsaPublicKeyB64u?e.thresholdOwnerAddress.trim().toLowerCase()===t.thresholdOwnerAddress.trim().toLowerCase()?e.relayerKeyId===t.relayerKeyId?e.relayerVerifyingShareB64u===t.relayerVerifyingShareB64u?e.participantIds.join(`,`)===t.participantIds.join(`,`)?null:`participantIds`:`relayerVerifyingShareB64u`:`relayerKeyId`:`thresholdOwnerAddress`:`thresholdEcdsaPublicKeyB64u`:`signingRootVersion`:`signingRootId`:`ecdsaThresholdKeyId`:`keyHandle`:`evmFamilySigningKeySlotId`:`walletId`}function zc(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1){let r=e[n],i=t[n];if(!r||!i||Re(r)!==Re(i))return!1}return!0}async function Bc(e){try{await e.context.signingEngine.closeRouterAbEcdsaRegistrationCeremony({kind:`close_router_ab_ecdsa_registration_ceremony_v1`,ceremonyId:e.ceremonyId})}catch{return}}function Vc(e){let t=e.prepare;return{formatVersion:t.formatVersion,walletId:t.walletId,evmFamilySigningKeySlotId:t.evmFamilySigningKeySlotId,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,keyScope:t.keyScope,relayerKeyId:t.relayerKeyId,registrationPreparationId:t.registrationPreparationId,requestId:t.requestId,thresholdSessionId:t.thresholdSessionId,ttlMs:t.ttlMs,remainingUses:t.remainingUses,participantIds:[...t.participantIds],runtimePolicyScope:t.runtimePolicyScope,derivationClientSharePublicKey33B64u:e.verified.derivationClientSharePublicKey33B64u,clientShareRetryCounter:e.verified.clientShareRetryCounter,contextBinding32B64u:e.verified.contextBinding32B64u}}async function Hc(e){return{canonicalRequest:kc(e),requestDigest:xe(await Ac(e))}}async function Uc(e){try{return await Qn(e)}catch{return await Qn(e)}}async function Wc(e){return e.registrationTiming?await e.registrationTiming.measure(e.bucket,e.operation):await e.operation()}async function Gc(e){let[t,...n]=e.started.chainTargets;if(!t)throw Error(`Strict ECDSA ceremony requires at least one EVM-family target`);let r=e.addSignerCeremonyId,i=be(r);try{let a=await Wc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationClientCreateMs`,operation:e.context.signingEngine.createRouterAbEcdsaRegistrationCeremony.bind(e.context.signingEngine,{kind:`create_router_ab_ecdsa_registration_ceremony_v1`,ceremonyId:r,registration:e.started.strictRegistration})}),o=await Wc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationGatewayRespondMs`,operation:er.bind(void 0,{relayerUrl:e.relayerUrl,walletId:e.walletId,addSignerCeremonyId:r,ecdsa:{kind:`router_ab_ecdsa_registration_v1`,strictRegistration:a.registrationRequest,requestDigestB64u:a.registrationRequestDigestB64u}})}),s=await Wc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationClientProofVerifyMs`,operation:e.context.signingEngine.verifyRouterAbEcdsaRegistrationClientProofs.bind(e.context.signingEngine,{kind:`verify_router_ab_ecdsa_registration_client_proofs_v1`,bootstrapOwner:`wallet_custody`,ceremonyId:r,clientProofFinalization:{kind:`finalize_encrypted_client_proof_bundles_v2`,bundles:o.ecdsa.strictResult.response.bundles}})}),c=jc(e.custodyEnvelope);if(!c.ok)throw Error(c.reason);let l={response:null,journalId:null},u=await e.context.signingEngine.joinWalletCustodyEvmFamilyKeySet({walletId:e.walletId,custodyJson:c.custodyJson,factorSecret:e.factorSecret,evmFamilySigningKeySlotId:e.started.prepare.evmFamilySigningKeySlotId,applicationBindingDigestB64u:s.applicationBindingDigestB64u,runRelayerRound:async a=>{let o=Vt({registrationRequestDigestB64u:s.registrationRequestDigestB64u,proofTranscriptDigestB64u:s.proofTranscriptDigestB64u,contextBinding32B64u:a.contextBinding32B64u,derivationClientSharePublicKey33B64u:a.clientSharePublicKey33B64u,clientShareRetryCounter:a.clientShareRetryCounter,participantId:1}),c=await Hc({addSignerCeremonyId:r,activationCorrelationId:i,publicFacts:o}),u={bytes:Array.from(R(String(c.requestDigest)))},d=await e.context.signingEngine.persistInitialCanonicalEcdsaActivation({kind:`persist_initial_canonical_ecdsa_activation_v1`,bootstrapOwner:`wallet_custody`,ceremonyId:r,clientActivation:o,planInput:{authority:e.authority,targetMemberships:[t,...n],evmFamilySigningKeySlotId:It(e.started.prepare.evmFamilySigningKeySlotId,`registration ECDSA signing key slot`),ecdsaThresholdKeyId:rn(e.started.prepare.ecdsaThresholdKeyId),signingRootId:Kt(e.started.prepare.signingRootId),signingRootVersion:Wt(e.started.prepare.signingRootVersion),runtimePolicyScope:e.started.prepare.runtimePolicyScope,clientVerifyingPublicKey33B64u:tn(a.clientSharePublicKey33B64u),participantIds:[Jt(e.started.prepare.participantIds[0]),Jt(e.started.prepare.participantIds[1])],relayerKeyId:nn(e.started.prepare.relayerKeyId),bindingDigest:cn(a.contextBinding32B64u),journalId:i,requestDigest:c.requestDigest,canonicalRequest:c.canonicalRequest,createdAt:ye(new Date().toISOString())}});if(!d.ok)throw Error(`Canonical ECDSA activation persistence failed (${d.code}): ${d.message}`);l.journalId=d.journalId,l.response=await Wc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationGatewayActivateMs`,operation:Uc.bind(void 0,{relayerUrl:e.relayerUrl,walletId:e.walletId,addSignerCeremonyId:r,activationCorrelationId:i,publicFacts:o,expectedActivationRequestDigest:u})});let f=l.response.ecdsa.activation.ecdsa_activation.public_identity;return JSON.stringify({relayerKeyId:e.started.prepare.relayerKeyId,relayerPublicKey33B64u:f.server_public_key33_b64u,groupPublicKey33B64u:f.threshold_public_key33_b64u,ethereumAddress:Nc(f.ethereum_address20_b64u),relayerShareRetryCounter:f.server_share_retry_counter})}});if(!l.response||!l.journalId)throw Error(`Add-signer ECDSA custody join did not activate`);let d=l.response,f=l.journalId,p=u.commitPayload.clientRootPublicKey33B64u;if(!p)throw Error(`Add-signer ECDSA custody join returned no client root public key`);let m=Vc({prepare:e.started.prepare,verified:u.clientBootstrap}),h=tr({clientBootstrap:m,serverBootstrap:d.ecdsa.bootstrap,activationEpoch:d.ecdsa.activation.ecdsa_activation.activation_epoch});return{chainTargets:[t,...n],clientBootstrap:m,bootstrap:h,activatedThresholdSessionId:d.ecdsa.bootstrap.thresholdSessionId,journalId:f,activationReceipt:d.ecdsa.activation,custodyKeySet:{kind:`evm_family_ecdsa_v1`,keyManifestDigestB64u:u.commitPayload.keyManifestDigestB64u,clientRootPublicKey33B64u:p},custodyLocalMaterial:u.localMaterial}}catch(t){throw await Bc({context:e.context,ceremonyId:r}),t}}async function Kc(e){let t=await e.context.signingEngine.finalizeRouterAbEcdsaRegistrationActivation({kind:`finalize_router_ab_ecdsa_registration_activation_v1`,bootstrapOwner:`wallet_custody`,journalId:e.pending.journalId,activationReceipt:e.pending.activationReceipt,routerAbEcdsaDerivationNormalSigning:e.pending.bootstrap.routerAbEcdsaDerivationNormalSigning,readyStateBlobB64u:e.pending.custodyLocalMaterial.readyStateBlobB64u,walletCustodyPublicFacts:e.pending.custodyLocalMaterial.publicFacts});return{chainTargets:e.pending.chainTargets,authority:t.authority,clientBootstrap:e.pending.clientBootstrap,bootstrap:e.pending.bootstrap,activatedThresholdSessionId:e.pending.activatedThresholdSessionId,roleLocalMaterial:t.roleLocalMaterial,materialActivation:t.materialActivation,clientPublicFacts:t.publicFacts,publicCapability:t.publicCapability}}function qc(e){switch(e.tokens.kind){case`evm_family_ecdsa`:case`near_ed25519_and_evm_family_ecdsa`:return e.tokens.ecdsa;case`near_ed25519`:throw Error(`Registration-established session is missing ECDSA authorization`);default:return q(e.tokens)}}function Jc(e){let[t]=e.walletKeys;if(!t)throw Error(`ECDSA registration did not return wallet key material`);let n=qc(e.session.registrationEstablishedSession);if(String(e.session.registrationEstablishedSession.walletId)!==t.walletId||n.thresholdSessionId!==e.session.activatedThresholdSessionId||n.keyHandle!==t.keyHandle||!Yc(n.runtimePolicyScope,e.session.clientBootstrap.runtimePolicyScope)||!jt(n.routerAbEcdsaDerivationNormalSigning,e.session.bootstrap.routerAbEcdsaDerivationNormalSigning))throw Error(`Registration-established ECDSA session changed the signer identity`);for(let r of e.walletKeys)if(r.walletId!==t.walletId||r.keyHandle!==n.keyHandle||r.ecdsaThresholdKeyId!==t.ecdsaThresholdKeyId)throw Error(`ECDSA registration material changed the established session identity`)}function Yc(e,t){return e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}async function Xc(e,t){e.kind===`passkey`&&await Promise.allSettled([Promise.resolve().then(t),da.initializeBundled()])}function Zc(e){return Ht({walletId:e.walletId,rpId:e.rpId,credentialIdB64u:String(e.credential.rawId||e.credential.id||``).trim()})}async function Qc(e){if(!e.material)throw Error(`Email OTP registration ${e.operation} is missing enrollment material`);return await e.material}function $c(e){let t=e.admissionRequest,n=s(t.scope.threshold_session_id);if(!n.ok)throw Error(`Ed25519 registration threshold-session identity is invalid`);let r=t.participant_ids,i=j(e.finalized.runtimePolicyScope);if(t.application_binding.wallet_id!==e.walletId||t.application_binding.near_ed25519_signing_key_id!==e.finalized.nearEd25519SigningKeyId||t.application_binding.key_creation_signer_slot!==e.finalized.signerSlot||r[0]!==e.finalized.participantIds[0]||r[1]!==e.finalized.participantIds[1]||!Yc(i,e.expectedRuntimePolicyScope)||t.application_binding.signing_root_id!==`${i.projectId}:${i.envId}`||t.scope.root_share_epoch!==i.signingRootVersion||t.scope.signing_worker_id!==e.finalized.routerAbNormalSigning.signingWorkerId||e.finalized.relayerKeyId!==e.finalized.routerAbNormalSigning.signingWorkerId)throw Error(`Ed25519 registration material changed the admitted signer identity`);return{identity:{walletId:String(e.walletId),nearAccountId:e.finalized.nearAccountId,nearEd25519SigningKeyId:e.finalized.nearEd25519SigningKeyId,thresholdSessionId:n.value,signerSlot:e.finalized.signerSlot,signingRootId:t.application_binding.signing_root_id,signingRootVersion:t.scope.root_share_epoch,signingWorkerId:t.scope.signing_worker_id},stableServerScope:{relayerKeyId:e.finalized.relayerKeyId,participantIds:e.finalized.participantIds,runtimePolicyScope:i,routerAbNormalSigning:e.finalized.routerAbNormalSigning}}}function el(e){switch(e.tokens.kind){case`near_ed25519`:case`near_ed25519_and_evm_family_ecdsa`:return e.tokens.ed25519;case`evm_family_ecdsa`:throw Error(`Registration-established session is missing Ed25519 authorization`);default:return q(e.tokens)}}async function tl(e){let t=el(e.registrationEstablishedSession);if(t.nearAccountId!==String(e.nearAccountId)||t.nearEd25519SigningKeyId!==String(e.nearEd25519SigningKeyId)||t.thresholdSessionId!==String(e.thresholdSessionId)||!Yc(t.runtimePolicyScope,e.runtimePolicyScope))throw Error(`Registration-established Email OTP Ed25519 session changed signer identity`);let n=P(t.runtimePolicyScope),r=n.signingRootVersion;if(!r)throw Error(`Registration-established Ed25519 session is missing a signing-root version`);let i=go({walletId:String(e.walletId),nearAccountId:String(e.nearAccountId),nearEd25519SigningKeyId:String(e.nearEd25519SigningKeyId),walletSessionId:String(e.registrationEstablishedSession.walletSessionId),authorizationId:String(e.registrationEstablishedSession.authorizationId),quotaId:String(e.registrationEstablishedSession.quotaId),thresholdSessionId:t.thresholdSessionId,remainingUses:e.registrationEstablishedSession.remainingUses,expiresAtMs:e.registrationEstablishedSession.expiresAtMs,runtimePolicyScope:t.runtimePolicyScope,signingRootId:n.signingRootId,signingRootVersion:r,routerAbNormalSigning:t.routerAbNormalSigning,walletSessionToken:e.registrationEstablishedSession.operationCredential.token,home:e.registrationEstablishedSession.operationCredential.home,nowMs:Date.now()});if(!i.ok)throw Error(`Registration-established Email OTP Ed25519 session is unusable (${i.reason})`);let a=await Ct({authority:e.emailOtpAuthContext.authority});return xc({walletId:e.walletId,nearAccountId:z(e.nearAccountId),nearEd25519SigningKeyId:Xt(e.nearEd25519SigningKeyId),providerSubjectId:ar(e.emailOtpAuthContext),signerSlot:e.signerSlot,relayerUrl:e.relayerUrl,authority:a,signingWalletSession:i.value})}function nl(e){if(e.authMethod.kind!==`passkey`)throw Error(`Ed25519 Yao registration requires a passkey registration intent`);return{version:e.version,walletId:e.walletId,authMethod:e.authMethod,signerSelection:e.signerSelection,foundingWalletAuthMethodId:e.foundingWalletAuthMethodId,...e.runtimePolicyScope?{runtimePolicyScope:e.runtimePolicyScope}:{},nonceB64u:e.nonceB64u}}function rl(e){if(e.finalized.authMethod.kind!==`passkey`||e.finalized.rpId!==e.expectedRpId)throw Error(`Ed25519 Yao finalize returned a different passkey authority`);if(e.finalized.walletId!==e.expectedWalletId)throw Error(`Ed25519 Yao finalize returned a different wallet`);if(e.finalized.ed25519.publicKey!==e.clientPublicKey||e.finalized.ed25519.nearEd25519SigningKeyId!==e.finalized.resolvedAccount.nearEd25519SigningKeyId||e.finalized.ed25519.nearAccountId!==e.finalized.resolvedAccount.nearAccountId)throw Error(`Ed25519 Yao finalize returned mismatched signer identity`);return{rpId:e.finalized.rpId,credentialIdB64u:e.finalized.authMethod.credentialIdB64u}}function il(e){if(e.finalized.authMethod.kind!==`email_otp`||e.finalized.authMethod.registrationAuthorityId!==e.expectedRegistrationAuthorityId)throw Error(`Ed25519 Yao finalize returned a different Email OTP authority`);if(e.finalized.walletId!==e.expectedWalletId)throw Error(`Ed25519 Yao finalize returned a different wallet`);if(e.finalized.ed25519.publicKey!==e.clientPublicKey||e.finalized.ed25519.nearEd25519SigningKeyId!==e.finalized.resolvedAccount.nearEd25519SigningKeyId||e.finalized.ed25519.nearAccountId!==e.finalized.resolvedAccount.nearAccountId)throw Error(`Ed25519 Yao finalize returned mismatched signer identity`)}async function al(e,t){let n=await new ia(t).send({kind:`admit`,path:st,body:e.admissionRequest});if(!n.ok)throw Error(n.message);let r=vt(n.value);if(!r.ok)throw Error(r.message);return r.value}function ol(e){let t=el(e.session);return{thresholdSessionId:String(t.thresholdSessionId),prfFirstB64u:e.prfFirstB64u,expiresAtMs:e.session.expiresAtMs,remainingUses:e.session.remainingUses,diagnostics:{recordDuration:Ea.bind(void 0,e.ceremonyId)},...e.preparedServerSeal?{preparedServerSeal:e.preparedServerSeal}:{},transport:{curve:`ed25519`,authMethod:`passkey`,walletId:e.walletId,relayerUrl:e.relayerUrl,walletSessionToken:e.session.operationCredential.token,ed25519Restore:va({rpId:e.restore.rpId,nearAccountId:e.restore.nearAccountId,nearEd25519SigningKeyId:e.restore.nearEd25519SigningKeyId,relayerKeyId:e.restore.relayerKeyId,participantIds:e.restore.participantIds,runtimePolicyScope:t.runtimePolicyScope,signerSlot:e.restore.signerSlot,routerAbNormalSigning:t.routerAbNormalSigning,credentialIdB64u:e.restore.credentialIdB64u,materialActivation:e.restore.materialActivation})}}}function sl(e){if(e.operation!==`registration_activate`||e.signerPlanKind!==`evm_family_ecdsa`)return!1;let t=e.localMaterial.keyFamilies;return t.length===1&&t[0]===`ecdsa_secp256k1`}function cl(e){if(e.operation!==`registration_activate`||e.signerPlanKind!==`near_ed25519_and_evm_family_ecdsa`)return!1;let t=e.localMaterial.keyFamilies;return t.length===1&&t[0]===`ecdsa_secp256k1`}function ll(e){let t=e.registrationEstablishedSession.session.tokens;if(t.kind===`evm_family_ecdsa`||t.kind===`near_ed25519_and_evm_family_ecdsa`)return t;throw Error(`pending ECDSA activation returned no ECDSA projection`)}function ul(e,t,n){let r=t.registrationEstablishedSession.session,i=ll(t);return t.walletId===e.walletId&&t.custodyKeyManifestDigestB64u===e.localMaterial.custodyCommit.keyManifestDigestB64u&&t.walletCustody?.status===`committed`&&r.walletId===e.walletId&&r.walletSession.walletId===e.walletId&&r.walletSession.authMethodId===e.walletAuthMethodId&&r.tokens.kind===`evm_family_ecdsa`&&i.ecdsa.keyHandle===n.keyHandle&&i.ecdsa.thresholdSessionId===t.ecdsa.bootstrap.thresholdSessionId&&r.expiresAtMs===t.ecdsa.bootstrap.expiresAtMs&&r.remainingUses===t.ecdsa.bootstrap.remainingUses}function dl(e,t,n){let r=e.ecdsa_activation.public_identity;return Tt({registrationRequestDigestB64u:t.publicCapability.registration_request_digest_b64u,proofTranscriptDigestB64u:L(Uint8Array.from(e.transcript_digest.bytes)),contextBinding32B64u:r.context_binding_b64u,derivationClientSharePublicKey33B64u:r.derivation_client_share_public_key33_b64u,clientShareRetryCounter:r.client_share_retry_counter,participantId:1},n)}function fl(e,t){return e.derivationClientSharePublicKey33B64u===t.derivationClientSharePublicKey33B64u&&e.relayerPublicKey33B64u===t.relayerVerifyingShareB64u&&e.groupPublicKey33B64u===t.thresholdEcdsaPublicKeyB64u&&e.ethereumAddress===t.thresholdOwnerAddress.toLowerCase()}function pl(e,t){return e.server_public_key33_b64u===t.relayerVerifyingShareB64u&&e.threshold_public_key33_b64u===t.thresholdEcdsaPublicKeyB64u&&_l(e.ethereum_address20_b64u)===t.thresholdOwnerAddress&&e.server_share_retry_counter===t.relayerShareRetryCounter}function ml(e,t){return e.walletId===t.walletId&&e.keyHandle===t.keyHandle&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.evmFamilySigningKeySlotId===t.evmFamilySigningKeySlotId&&e.signingRootId===t.signingRootId&&e.signingRootVersion===t.signingRootVersion&&e.thresholdEcdsaPublicKeyB64u===t.thresholdEcdsaPublicKeyB64u&&e.ethereumAddress.toLowerCase()===t.thresholdOwnerAddress.toLowerCase()&&e.relayerKeyId===t.relayerKeyId&&e.relayerVerifyingShareB64u===t.relayerVerifyingShareB64u&&e.clientShareRetryCounter===t.clientShareRetryCounter&&e.relayerShareRetryCounter===t.relayerShareRetryCounter}function hl(e,t){let n={relayerUrl:e,registrationCeremonyId:t.registrationCeremonyId,signedSetup:t.signedSetup,idempotencyKey:t.idempotencyKey,walletCustodyCommit:t.localMaterial.custodyCommit,...t.auth.kind===`email_otp`?{emailOtpEnrollment:t.auth.enrollment}:{}},r={activationCorrelationId:t.localMaterial.ecdsa.activationJournalId,activationRequestDigestB64u:t.localMaterial.ecdsa.activationRequestDigestB64u,clientActivation:t.localMaterial.ecdsa.clientActivation};return{...n,signerPlanKind:t.signerPlanKind,ecdsa:r}}function gl(e){let t=e.ecdsa.walletKeys[0];if(!t)throw Error(`pending ECDSA activation returned no wallet keys`);return Ic(e.ecdsa.walletKeys),[t,...e.ecdsa.walletKeys.slice(1)]}function _l(e){let t=R(e);if(t.length!==20)throw Error(`pending ECDSA activation returned an invalid address`);let n=`0x`;for(let e of t)n+=e.toString(16).padStart(2,`0`);return n}function vl(e,t,n){if(!ul(e,t,n))throw Error(`pending ECDSA activation projection mismatch`);Sn(e,{operation:e.operation,walletId:t.walletId,walletAuthMethodId:t.foundingAuthMethod.walletAuthMethodId,authority:t.authority})}function yl(e){return e.ok===!0&&e.kind===`evm_family_ecdsa`&&e.registrationEstablishedSession.kind===`already_committed`}async function bl(e,t){if(e.auth.kind===`passkey`){if(t.authMethod.kind!==`passkey`||t.rpId!==e.auth.rpId||t.authMethod.credentialIdB64u!==e.auth.credentialIdB64u)throw Error(`pending ECDSA activation returned a different Passkey method`);return}if(t.authMethod.kind!==`email_otp`||t.authMethod.registrationAuthorityId!==e.auth.registrationAuthorityId)throw Error(`pending ECDSA activation returned a different Email OTP method`);let n=Et(t.authority),r=await S(e.auth.email);if(!n||n.factor.providerUserId!==e.auth.providerSubject||n.verifier.emailHashHex.toLowerCase()!==r.toLowerCase())throw Error(`pending ECDSA activation returned a different Email OTP identity`)}function xl(e,t,n){let r=t.ecdsa.activation,i=r.ecdsa_activation,a=i.public_identity,o=e.localMaterial.ecdsa.clientActivation;if(r.activation_correlation_id!==e.localMaterial.ecdsa.activationJournalId||L(Uint8Array.from(r.activation_request_digest.bytes))!==e.localMaterial.ecdsa.activationRequestDigestB64u||!dl(r,n,o)||!fl(t.ecdsa.bootstrap.publicIdentity,n)||i.context.application_binding_digest_b64u!==t.ecdsa.bootstrap.applicationBindingDigestB64u||!pl(a,n))throw Error(`pending ECDSA activation facts mismatch`);if(!ml(t.ecdsa.bootstrap,n))throw Error(`pending ECDSA bootstrap changed committed key identity`)}function Sl(e){let t=ll(e).ecdsa,n=e.ecdsa.activation.ecdsa_activation;if(!p(t.materialActivation,Ut(n.material_activation))||!jt(t.routerAbEcdsaDerivationNormalSigning,e.ecdsa.bootstrap.routerAbEcdsaDerivationNormalSigning))throw Error(`pending ECDSA activation facts do not match the committed projection`)}async function Cl(e){let t=e.response;if(!yl(t))throw Error(t.ok?`pending ECDSA activation replay did not return a committed projection`:`pending ECDSA activation replay failed`);let n=gl(t)[0];if(vl(e.pending,t,n),await bl(e.pending,t),xl(e.pending,t,n),Sl(t),e.pending.signerPlanKind===`evm_family_ecdsa`){if(t.nearProvisioning!==void 0)throw Error(`ECDSA-only registration unexpectedly has deferred NEAR provisioning`)}else if(t.nearProvisioning?.status!==`near_pending`)throw Error(`mixed registration did not retain deferred NEAR provisioning`);return t}async function wl(e){let t=new vn,n=Ut(e.activationReceipt.ecdsa_activation.material_activation),r=await t.lookupByMaterialActivation({walletId:e.authority.walletId,authority:e.authority,materialActivation:n});if(r.kind===`missing`){let t=await Rn(e);return{roleLocalMaterialRef:t.roleLocalMaterialRef,publication:[t]}}if(r.kind!==`active`)throw Error(`Pending ECDSA registration continuity is ${r.kind}`);let i=r.manifest,a=i.durableMaterial;if(!Nt(i.activation.serverActivation.serverActivationReceipt.protocolReceipt,e.activationReceipt)||!wt(a.roleLocalPublicFacts.publicCapability,e.publicCapability)||!Tn(i.signer.scope,sn({targetMemberships:e.chainTargets}))||a.roleLocalBinding.keyHandle!==e.keyHandle||a.roleLocalBinding.ecdsaThresholdKeyId!==e.ecdsaThresholdKeyId||a.roleLocalBinding.relayerKeyId!==e.relayerKeyId||a.bindingDigest!==e.publicFacts.contextBinding32B64u||i.signer.signingRootId!==e.signingRootId||i.signer.signingRootVersion!==e.signingRootVersion||!wn(a.runtimePolicyScope,e.runtimePolicyScope))throw Error(`Pending ECDSA registration conflicts with its restored activation`);return{roleLocalMaterialRef:{kind:`ecdsa_role_local_persisted_material_ref_v1`,durableMaterialRef:a.durableMaterialRef,bindingDigest:a.bindingDigest,materialActivation:n},publication:[]}}function Tl(e){let t=e[0];if(!t)throw Error(`ECDSA registration finalization returned no wallet keys`);return[t,...e.slice(1)]}function El(e){let t=e[0];if(!t)throw Error(`ECDSA registration activation returned no chain targets`);return[t.chainTarget,...e.slice(1).map(e=>e.chainTarget)]}async function Dl(e){let t=Tl(e.walletKeys);if(e.pending.auth.kind===`passkey`){if(e.response.authMethod.kind!==`passkey`||!e.response.authMethod.credentialPublicKeyB64u)throw Error(`ECDSA registration publication has no exact Passkey credential`);return await In({kind:`passkey`,walletId:e.pending.walletId,rpId:e.pending.auth.rpId,credentialIdB64u:e.pending.auth.credentialIdB64u,credentialPublicKeyB64u:e.response.authMethod.credentialPublicKeyB64u,transports:e.pending.auth.transports,walletKeys:t})}if(e.response.authMethod.kind!==`email_otp`)throw Error(`ECDSA Email OTP registration publication has a different auth method`);let n=Et(e.response.authority);if(!n)throw Error(`ECDSA Email OTP registration authority is invalid`);return await In({kind:`email_otp`,walletId:e.pending.walletId,email:e.pending.auth.email,registrationAuthorityId:e.pending.auth.registrationAuthorityId,authority:n,walletKeys:t})}function Ol(e){return{pending:e.pending,authority:e.response.authority,foundingAuthority:{authority:e.response.foundingAuthority,authMethod:e.response.foundingAuthMethod},request:{operation:e.pending.operation,registrationCeremonyId:e.pending.registrationCeremonyId,idempotencyKey:e.pending.idempotencyKey,walletId:e.pending.walletId,walletAuthMethodId:e.pending.walletAuthMethodId},walletSessionPublication:{kind:`issued`,walletSession:e.session.session.wallet_session,operationCredential:e.session.session.operation_credential},ecdsaContinuity:e.ecdsaContinuity,registration:e.registration}}async function kl(e){let t=await e.ports.activateWalletRegistration(hl(e.relayerUrl,e.pending)),n=await Cl({pending:e.pending,response:t}),r=gl(n),i={sessionPolicy:e.sessionPolicy,onEvent:e.onEvent,relayerUrl:e.relayerUrl,pending:e.pending,response:n,walletKeys:r,exactMethod:e.exactMethod,signingSurface:e.signingSurface},a=await e.ports.unlockPendingEcdsaRegistration(i),o=r[0];if(!o)throw Error(`ECDSA registration activation returned no primary key`);let s=await Ct({authority:n.authority}),c=await wl({authority:s,chainTargets:El(r),walletId:String(e.pending.walletId),keyHandle:o.keyHandle,ecdsaThresholdKeyId:o.ecdsaThresholdKeyId,signingRootId:o.signingRootId,signingRootVersion:o.signingRootVersion,relayerKeyId:o.relayerKeyId,participantIds:o.participantIds,publicCapability:o.publicCapability,activationReceipt:n.ecdsa.activation,runtimePolicyScope:ll(n).ecdsa.runtimePolicyScope,readyStateBlobB64u:a.readyStateBlobB64u,publicFacts:a.publicFacts}),l={kind:`ecdsa_role_local_worker_handle_v1`,materialHandle:an(c.roleLocalMaterialRef.durableMaterialRef),bindingDigest:c.roleLocalMaterialRef.bindingDigest,durableMaterialRef:c.roleLocalMaterialRef.durableMaterialRef},u=await e.signingSurface.finalizeWalletRegistrationEcdsaSessions({walletId:String(e.pending.walletId),session:{chainTargets:El(r),authority:s,bootstrap:{applicationBindingDigestB64u:n.ecdsa.bootstrap.applicationBindingDigestB64u},roleLocalMaterial:l,materialActivation:c.roleLocalMaterialRef.materialActivation,clientPublicFacts:{contextBinding32B64u:a.publicFacts.contextBinding32B64u,derivationClientSharePublicKey33B64u:a.publicFacts.derivationClientSharePublicKey33B64u,clientVerifyingShareB64u:a.publicFacts.clientVerifyingShare33B64u,relayerPublicKey33B64u:a.publicFacts.relayerPublicKey33B64u,groupPublicKey33B64u:a.publicFacts.groupPublicKey33B64u,ethereumAddress:a.publicFacts.ethereumAddress},publicCapability:o.publicCapability},walletKeys:r}),d=await Dl({pending:e.pending,response:n,walletKeys:u});if(await e.ports.publishPendingWalletRegistrationCommit(Ol({pending:e.pending,response:n,registration:d,session:a.session,ecdsaContinuity:c.publication})),e.pending.signerPlanKind===`near_ed25519_and_evm_family_ecdsa`&&e.pending.auth.kind===`passkey`&&a.kind===`passkey`){let t=fr(a.credential,`Pending NEAR registration continuation`),n=bh({context:e.nearContext,sessionAuthority:{record:a.session.session.wallet_session,operationCredential:a.session.session.operation_credential},factor:{kind:`passkey`,rpId:e.pending.auth.rpId,credentialIdB64u:ur(a.credential),prfFirstB64u:t},ownedFactorSecret:R(t).slice().buffer,custodyEnvelope:a.custody.envelope});e.nearCompletion===`await`&&await n}return{kind:`published`,registrationCeremonyId:e.pending.registrationCeremonyId,walletId:n.walletId,signingSession:{sessionId:String(a.session.session.threshold_session_id),status:`active`,authMethod:a.kind,remainingUses:a.session.session.remaining_uses,expiresAtMs:a.session.session.expires_at_ms}}}function Al(e,t,n){e?.(ln({flowId:`unlock:${t}`,accountId:t,...n}))}async function jl(e){let{context:t,authMethod:n,unlockSubjectId:r,loginResult:i,onEvent:a,afterCall:o}=e;return i.success&&t.signingEngine.setWalletAuthenticated({kind:`authenticated`,walletId:i.walletId,authMethod:n}),Al(a,r,{phase:dn.STEP_07_COMPLETED,status:`succeeded`,data:{...i.success&&i.kind===`near_wallet_unlocked`?{operationalPublicKey:i.operationalPublicKey??``}:{walletId:i.success?String(i.walletId):``}}}),await o?.(!0,i),i}async function Ml(e){let{message:t,unlockSubjectId:n,error:r,onEvent:i,onError:a,afterCall:o,callOnError:s=!0,callAfterCall:c=!0,cancelled:l=!1}=e;return s&&a?.(Ce(r)),Al(i,n,{phase:l?dn.CANCELLED:dn.FAILED,status:l?`cancelled`:`failed`,...l?{}:{message:t},interaction:{kind:`passkey_assert`,overlay:`hide`},error:{message:t}}),c&&await o?.(!1),{success:!1,error:t}}async function Nl(e){let t=xn(),n=null;try{let r=JSON.stringify(t.codeBytes.map(e=>({codeBytesB64u:L(e)}))),i=await jr({runStep:e.runStep,custody:e.factorAfterRouterRound?{origin:`establish_factor_after_round`,walletId:e.walletId,recoveryCodesJson:r,factor:e.factorAfterRouterRound}:{origin:`establish`,walletId:e.walletId,factorJson:e.factorJson,factorSecret:e.factorSecret,recoveryCodesJson:r},keySetRun:{keySet:`near_ed25519_v1`,protocolInputsJson:JSON.stringify({yaoAdmission:e.yaoAdmission,yaoApplication:e.yaoApplication,clientParticipantId:e.participantIds[0],signingWorkerParticipantId:e.participantIds[1],...e.continuityRegisteredPublicKeyB64u===void 0?{}:{continuityRegisteredPublicKeyB64u:e.continuityRegisteredPublicKeyB64u}}),nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,runRouterRound:async t=>{let r=await e.runRouterRound(t);return n=ql(r),r}}});if(!n)throw Error(`the NEAR custody ceremony produced no activation session id`);let a=await Kl(i,t);return{recoveryCodes:t.codes,activationReference:{kind:`router_ab_ed25519_yao_activation_reference_v1`,lifecycle_id:e.registrationCeremonyId,session_id:n},commitPayload:Gl(a),localMaterial:i.ed25519LocalMaterialB64u&&i.ed25519LocalMaterialNonceB64u&&i.ed25519ApplicationBindingDigestB64u?{b64u:i.ed25519LocalMaterialB64u,nonceB64u:i.ed25519LocalMaterialNonceB64u,applicationBindingDigestB64u:i.ed25519ApplicationBindingDigestB64u}:null}}finally{t&&_n(t),t=null}}function Pl(e){let t=e.establishedCustody;if(!t)throw Error(`wallet custody join requires an established envelope`);let n;try{n=JSON.parse(t.envelopeBindingJson)}catch{throw Error(`wallet custody envelope binding is not JSON`)}if(typeof n!=`object`||!n||Array.isArray(n))throw Error(`wallet custody envelope binding must be an object`);return JSON.stringify({envelopeBinding:n,nonceB64u:t.envelopeNonceB64u,sealedCustodySecretB64u:t.sealedCustodySecretB64u,aadHashB64u:t.envelopeAadHashB64u,ciphertextDigestB64u:t.envelopeCiphertextDigestB64u})}async function Fl(e){let t=xn(),n=null,r=null;try{let i=t;if(!i)throw Error(`recovery codes were not issued`);let a=await jr({runStep:e.runStep,custody:{origin:`establish`,walletId:e.walletId,factorJson:e.factorJson,factorSecret:e.factorSecret,recoveryCodesJson:JSON.stringify(t.codeBytes.map(e=>({codeBytesB64u:L(e)})))},keySetRun:{keySet:`evm_family_ecdsa_v1`,protocolInputsJson:JSON.stringify({applicationBindingDigestB64u:e.applicationBindingDigestB64u}),evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,beforeRelayerRound:e.confirmRecoveryCodesBackedUp.bind(void 0,t.codes),runRelayerRound:async t=>{let a=Qe(await Kl(t.preActivationCommitPayload,i));return n=a,r={contextBinding32B64u:t.contextBinding32B64u,derivationClientSharePublicKey33B64u:t.clientSharePublicKey33B64u,clientShareRetryCounter:t.clientShareRetryCounter,participantId:1},await e.runRelayerRound({...t,preActivationCommitPayload:a})}}});if(!n||!r)throw Error(`the EVM custody ceremony reached no activation round`);if(!a.ecdsaReadyStateBlobB64u||!a.ecdsaPublicFacts)throw Error(`the EVM custody ceremony produced no local signing material`);return{recoveryCodes:t.codes,commitPayload:n,clientBootstrap:r,localMaterial:{readyStateBlobB64u:a.ecdsaReadyStateBlobB64u,publicFacts:a.ecdsaPublicFacts}}}finally{t&&_n(t),t=null}}async function Il(e){let t=null,n=null,r=await jr({runStep:e.runStep,custody:{origin:`join`,custodyJson:e.custodyJson,factorSecret:e.factorSecret},keySetRun:{keySet:`evm_family_ecdsa_v1`,protocolInputsJson:JSON.stringify({applicationBindingDigestB64u:e.applicationBindingDigestB64u}),evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,beforeRelayerRound:async()=>void 0,runRelayerRound:async r=>(t=r.preActivationCommitPayload,n={contextBinding32B64u:r.contextBinding32B64u,derivationClientSharePublicKey33B64u:r.clientSharePublicKey33B64u,clientShareRetryCounter:r.clientShareRetryCounter,participantId:1},await e.runRelayerRound(r))}});if(!t||!n)throw Error(`the EVM custody join reached no activation round`);if(r.establishedCustody)throw Error(`an EVM custody join must not establish a second wallet seed`);if(!r.ecdsaReadyStateBlobB64u||!r.ecdsaPublicFacts)throw Error(`the EVM custody join produced no local signing material`);return{commitPayload:t,clientBootstrap:n,localMaterial:{readyStateBlobB64u:r.ecdsaReadyStateBlobB64u,publicFacts:r.ecdsaPublicFacts}}}function Ll(e){switch(e.factorReplacement.kind){case`preserve_existing`:return{origin:`recover`,custodyJson:e.custodyJson,recoveryCode:e.recoveryCode};case`reseal_replacement_factor`:return{origin:`recover_and_reseal`,custodyJson:e.custodyJson,recoveryCode:e.recoveryCode,replacementFactorJson:e.factorReplacement.factorJson,replacementFactorSecret:e.factorReplacement.factorSecret};default:return Rl(e.factorReplacement)}}function Rl(e){throw Error(`unsupported recovery factor replacement: ${String(e)}`)}async function zl(e){if(await Ul({walletId:e.walletId,evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,clientRootPublicKey33B64u:e.registeredClientRootPublicKey33B64u})!==e.recordedKeyManifestDigestB64u)throw Error(`EVM recovery manifest digest does not match the registered identity`);let t=await jr({runStep:e.runStep,custody:Ll(e),keySetRun:{keySet:`evm_family_ecdsa_v1`,protocolInputsJson:JSON.stringify({applicationBindingDigestB64u:e.applicationBindingDigestB64u}),evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,beforeRelayerRound:async()=>void 0,runRelayerRound:e.resolveRelayerPublicIdentity},recordedKeyManifestDigestB64u:e.recordedKeyManifestDigestB64u});if(!t.ecdsaReadyStateBlobB64u||!t.ecdsaPublicFacts)throw Error(`the EVM recovery produced no local signing material`);if(t.clientRootPublicKey33B64u!==e.registeredClientRootPublicKey33B64u)throw Error(`the EVM recovery changed the registered client root public key`);return{readyStateBlobB64u:t.ecdsaReadyStateBlobB64u,publicFacts:t.ecdsaPublicFacts,recoveryReplacementEnvelope:t.recoveryReplacementEnvelope??null}}async function Bl(e){let t=await Ul({walletId:e.walletId,evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,clientRootPublicKey33B64u:e.registeredClientRootPublicKey33B64u}),n=await jr({runStep:e.runStep,custody:{origin:`join`,custodyJson:e.custodyJson,factorSecret:e.factorSecret},keySetRun:{keySet:`evm_family_ecdsa_v1`,protocolInputsJson:JSON.stringify({applicationBindingDigestB64u:e.applicationBindingDigestB64u}),evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,beforeRelayerRound:async()=>void 0,runRelayerRound:async()=>e.relayerPublicIdentityJson},recordedKeyManifestDigestB64u:t});if(n.establishedCustody)throw Error(`an EVM cold unlock must not establish custody`);if(!n.ecdsaReadyStateBlobB64u||!n.ecdsaPublicFacts)throw Error(`the EVM cold unlock produced no local signing material`);return{readyStateBlobB64u:n.ecdsaReadyStateBlobB64u,publicFacts:n.ecdsaPublicFacts}}function Vl(e,t){e.push(t>>>24&255,t>>>16&255,t>>>8&255,t&255)}function Hl(e,t,n){let r=new TextEncoder().encode(t);Vl(e,r.length),e.push(...r),Vl(e,n.length),e.push(...n)}async function Ul(e){let t=String(e.walletId||``).trim(),n=String(e.evmFamilySigningKeySlotId||``).trim(),r=R(e.clientRootPublicKey33B64u);if(!t||!n||r.length!==33)throw Error(`EVM custody continuity identity is invalid`);let i=[];return Hl(i,`context`,new TextEncoder().encode(`seams/wallet-custody/key-set-manifest/evm-family-ecdsa/v1`)),Hl(i,`walletId`,new TextEncoder().encode(t)),Hl(i,`evmFamilySigningKeySlotId`,new TextEncoder().encode(n)),Hl(i,`clientRootPublicKey33`,r),L(await D(Uint8Array.from(i)))}async function Wl(e){let t=String(e.walletId||``).trim(),n=String(e.nearEd25519SigningKeyId||``).trim(),r=R(e.registeredPublicKeyB64u);if(!t||!n||r.length!==32)throw Error(`NEAR custody continuity identity is invalid`);let i=[];return Hl(i,`context`,new TextEncoder().encode(`seams/wallet-custody/key-set-manifest/near-ed25519/v1`)),Hl(i,`walletId`,new TextEncoder().encode(t)),Hl(i,`nearEd25519SigningKeyId`,new TextEncoder().encode(n)),Hl(i,`registeredPublicKey`,r),L(await D(Uint8Array.from(i)))}function Gl(e){let{ed25519LocalMaterialB64u:t,ed25519LocalMaterialNonceB64u:n,ed25519ApplicationBindingDigestB64u:r,ecdsaReadyStateBlobB64u:i,recoveryReplacementEnvelope:a,...o}=e;return o}async function Kl(e,t){let n=e.establishedCustody;if(!n)return e;if(n.recoveryManifestKekWraps.length!==t.codeBytes.length)throw Error(`recovery code and wrap counts do not match`);let r=await Promise.all(t.codeBytes.map(async(e,t)=>{let r=n.recoveryManifestKekWraps[t];if(!r)throw Error(`recovery code and wrap counts do not match`);return{locatorB64u:await bn(e),recoveryKeyId:r.recoveryKeyId}}));if(new Set(r.map(e=>e.locatorB64u)).size!==r.length)throw Error(`recovery code locators must be unique`);return{...e,establishedCustody:{...n,recoveryCodeLocators:r}}}function ql(e){let t;try{t=JSON.parse(e)}catch{throw Error(`the Router activation result is not JSON`)}let n=t?.binding?.session_id;if(!Array.isArray(n)||n.length===0)throw Error(`the Router activation result carries no session id`);return n.map(e=>{if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`the Router activation session id is not a byte array`);return e})}async function Jl(e){if(await Wl({walletId:e.walletId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,registeredPublicKeyB64u:e.registeredPublicKeyB64u})!==e.recordedKeyManifestDigestB64u)throw Error(`NEAR recovery manifest digest does not match the registered identity`);let t=null,n=null,r=await jr({runStep:e.runStep,custody:Ll(e),keySetRun:{keySet:`near_ed25519_v1`,protocolInputsJson:JSON.stringify({yaoAdmission:e.yaoAdmission,yaoApplication:e.yaoApplication,clientParticipantId:e.participantIds[0],signingWorkerParticipantId:e.participantIds[1],continuityRegisteredPublicKeyB64u:e.registeredPublicKeyB64u}),nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,runRouterRound:async n=>(t=await e.runRouterRound(n),t),afterRouterRoundCompleted:async t=>{n=await e.activateRouterRecovery(t)}},recordedKeyManifestDigestB64u:e.recordedKeyManifestDigestB64u});if(!r.ed25519LocalMaterialB64u||!r.ed25519LocalMaterialNonceB64u)throw Error(`the NEAR recovery sealed no local signing material`);if(!r.ed25519ApplicationBindingDigestB64u)throw Error(`the NEAR recovery omitted its application binding digest`);if(!t||!n)throw Error(`the NEAR recovery produced no Router activation`);return{localMaterial:{b64u:r.ed25519LocalMaterialB64u,nonceB64u:r.ed25519LocalMaterialNonceB64u,applicationBindingDigestB64u:r.ed25519ApplicationBindingDigestB64u},activationResultJson:t,activationReceipt:n,recoveryReplacementEnvelope:r.recoveryReplacementEnvelope??null}}async function Yl(e){return await Zl(e,e.registrationCeremonyId,void 0,`registration join`)}async function Xl(e){let t=String(e.registeredPublicKeyB64u||``).trim();if(!t)throw Error(`a cold unlock must name the key set it reproduces`);let n=null,r=null,i=await Zl({...e,preparation:{kind:`fresh`}},e.recoveryLifecycleId,t,`cold unlock`,async t=>{n=t,r=await e.activateRouterRecovery(t)});if(!n||!r)throw Error(`the NEAR cold unlock produced no Router recovery activation`);return{...i,activationResultJson:n,activationReceipt:r}}async function Zl(e,t,n,r,i){let a=null,o=await jr({runStep:e.runStep,custody:{origin:`join`,custodyJson:e.custodyJson,factorSecret:e.factorSecret},keySetRun:{keySet:`near_ed25519_v1`,...e.preparation.kind===`checkpoint`?{checkpointJson:e.preparation.checkpointJson}:{protocolInputsJson:JSON.stringify({yaoAdmission:e.yaoAdmission,yaoApplication:e.yaoApplication,clientParticipantId:e.participantIds[0],signingWorkerParticipantId:e.participantIds[1],...n?{continuityRegisteredPublicKeyB64u:n}:{}}),beforeRouterRound:e.beforeRouterRound},nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,runRouterRound:async t=>{let n=await e.runRouterRound(t);return a=ql(n),n},...i?{afterRouterRoundCompleted:i}:{}}});if(!a)throw Error(`the NEAR ${r} produced no activation session id`);if(o.establishedCustody)throw Error(`a NEAR ${r} must not establish custody`);if(!o.ed25519LocalMaterialB64u||!o.ed25519LocalMaterialNonceB64u)throw Error(`the NEAR ${r} sealed no local material`);return{commitPayload:Gl(o),activationReference:{kind:`router_ab_ed25519_yao_activation_reference_v1`,lifecycle_id:t,session_id:a},localMaterial:{b64u:o.ed25519LocalMaterialB64u,nonceB64u:o.ed25519LocalMaterialNonceB64u,applicationBindingDigestB64u:String(o.ed25519ApplicationBindingDigestB64u||``)}}}function Ql(e){switch(e.routeFamily){case`operation_step_up`:return{routeFamily:e.routeFamily,operation:e.operation,operationCredential:e.operationCredential};case`registration`:if(e.operation!==`registration`)throw Error(`Email OTP registration routes require registration operation`);return{routeFamily:`registration`,operation:e.operation};case`login`:if(!Ue(e.operation))throw Error(`Email OTP login routes require a login operation`);return{routeFamily:`login`,operation:e.operation};case`signing_session`:if(e.operation!==`transaction_sign`&&e.operation!==`export_key`)throw Error(`Email OTP signing-session routes require signing or export operation`);return{routeFamily:`signing_session`,authLane:e.authLane,operation:e.operation}}throw Error(`Unsupported Email OTP route family`)}var $l=class e extends Error{kind=`email_otp_signing_session_auth_state_error`;failure;constructor(t){super(eu(t)),this.name=`EmailOtpSigningSessionAuthStateError`,this.failure=t,Object.setPrototypeOf(this,e.prototype)}};function eu(e){return`Email OTP ${e.expectedCurve} signing-session auth lane is unavailable at ${e.source}; unlock wallet again`}function tu(e){throw new $l(e)}function nu(e){return e.freshRouteFamily===`registration`?Ql({routeFamily:`registration`,operation:He}):Ql({routeFamily:`login`,operation:e.operation??`wallet_unlock`})}function ru(e){return e?.kind!==`signing_session`&&tu({kind:`auth_lane_missing`,source:`route_plan`,expectedCurve:`unknown`}),e}function iu(e){return Ql({routeFamily:`signing_session`,authLane:e.authLane,operation:e.operation})}function au(e){if(e.kind===`signing_session`&&e.curve===`ecdsa`)return{kind:`threshold_ecdsa_session`,operationCredential:e.operationCredential,curve:`ecdsa`,thresholdSessionId:e.thresholdSessionId,chainTarget:e.chainTarget}}function ou(e){if(e.routeFamily===`signing_session`)return au(e.authLane)}async function su(e){return await e.workerCtx.requestWorkerOperation({kind:`emailOtp`,request:{type:`unlockEmailOtpAuthorityWallet`,timeoutMs:6e4,payload:{relayUrl:e.relayUrl,walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,challengeId:e.challengeId,otpCode:e.otpCode,ed25519:e.ed25519}}})}async function cu(e){return await e.base.workerCtx.requestWorkerOperation({kind:`emailOtp`,request:{type:`loginWithEmailOtpWallet`,timeoutMs:6e4,payload:{relayUrl:e.base.relayUrl,walletId:String(e.base.walletSession.walletId),authoritySelector:e.base.authoritySelector,userId:String(e.base.walletSession.walletSessionUserId),verification:e.base.verification,groupId:e.base.groupId,routePlan:e.base.routePlan,otpChannel:Ke,material:e.material},onEvent:e.base.onProgress}})}async function lu(e){let t=await cu({base:e,material:e.ecdsaSessionPolicy?{kind:`ecdsa`,ecdsaSessionHandleBinding:e.ecdsaSessionHandleBinding,runtimePolicyScope:e.runtimePolicyScope,ecdsaSessionPolicy:e.ecdsaSessionPolicy}:{kind:`ecdsa`,ecdsaSessionHandleBinding:e.ecdsaSessionHandleBinding,runtimePolicyScope:e.runtimePolicyScope}});if(t.kind!==`ecdsa`)throw Error(`Email OTP wallet unlock returned the wrong material branch`);if(e.ecdsaSessionPolicy){if(t.operation!==`wallet_unlock`)throw Error(`Email OTP wallet unlock returned a non-unlock ECDSA result`);return{kind:`ecdsa`,operation:`wallet_unlock`,recovery:t.recovery,emailOtpSessionHandle:t.emailOtpSessionHandle,ecdsaSession:t.ecdsaSession,ecdsaCustody:t.ecdsaCustody}}if(t.operation!==e.ecdsaSessionHandleBinding.operation)throw Error(`Email OTP ECDSA result operation does not match its request`);return{kind:`ecdsa`,operation:t.operation,recovery:t.recovery,emailOtpSessionHandle:t.emailOtpSessionHandle}}async function uu(e){let t=await cu({base:e,material:{kind:`ed25519_yao_recovery`,providerSubject:e.providerSubject,nearAccountId:e.nearAccountId,expectedOperationalPublicKey:e.expectedOperationalPublicKey,expectedThresholdSessionId:e.expectedThresholdSessionId,walletCustodyEd25519Material:e.walletCustodyEd25519Material,ed25519YaoRecovery:{kind:dt,signerSlot:e.signerSlot,remainingUses:e.remainingUses,orgId:e.orgId}}});if(t.kind===`ed25519_yao_capability`)return{kind:t.kind,recovery:t.recovery,activeClientHandle:t.activeClientHandle,metadata:t.metadata,ed25519YaoCapability:t.ed25519YaoCapability,walletSessionAuthorization:t.walletSessionAuthorization,...t.walletCustodyEd25519Material?{walletCustodyEd25519Material:t.walletCustodyEd25519Material}:{},ed25519ExportRootCustody:t.ed25519ExportRootCustody};if(t.kind!==`wallet_custody_cache_absent`)throw Error(`Email OTP Ed25519 Yao unlock returned the wrong material branch`);return{kind:`wallet_custody_cache_absent`,recovery:t.recovery,ed25519YaoRecovery:t.ed25519YaoRecovery}}async function du(e){let t=await cu({base:e,material:{kind:`wallet_unlock_capabilities`,ecdsa:{sessionHandleBinding:e.ecdsaSessionHandleBinding,runtimePolicyScope:e.runtimePolicyScope,sessionPolicy:e.ecdsaSessionPolicy},ed25519Yao:{providerSubject:e.providerSubject,nearAccountId:e.nearAccountId,expectedOperationalPublicKey:e.expectedOperationalPublicKey,expectedThresholdSessionId:e.expectedThresholdSessionId,walletCustodyEd25519Material:e.walletCustodyEd25519Material,recovery:{kind:dt,signerSlot:e.signerSlot,remainingUses:e.remainingUses,orgId:e.runtimePolicyScope.orgId}}}});if(t.kind!==`wallet_unlock_capabilities`)throw Error(`Email OTP capability unlock returned the wrong material branch`);return{kind:`wallet_unlock_capabilities`,recovery:t.recovery,walletSessionAuthorization:t.walletSessionAuthorization,ed25519ExportRootCustody:t.ed25519ExportRootCustody,ecdsa:{kind:`ecdsa`,operation:`wallet_unlock`,recovery:t.recovery,emailOtpSessionHandle:t.ecdsa.emailOtpSessionHandle,ecdsaSession:t.ecdsa.session,ecdsaCustody:t.ecdsa.custody},ed25519Yao:t.ed25519Yao.kind===`wallet_custody_cache_absent`?{kind:`wallet_custody_cache_absent`,recovery:t.recovery,ed25519YaoRecovery:t.ed25519Yao.bootstrap}:{kind:`ed25519_yao_capability`,recovery:t.recovery,activeClientHandle:t.ed25519Yao.activeClientHandle,metadata:t.ed25519Yao.metadata,ed25519YaoCapability:t.ed25519Yao.bootstrap,walletSessionAuthorization:t.walletSessionAuthorization,ed25519ExportRootCustody:t.ed25519ExportRootCustody}}}function fu(e){let t=e.walletSessionState.signingLane;if(t.auth.kind!==`passkey`)throw Error(`[SigningEngine][near] Passkey recovery returned another auth lane`);let n=t.identity.signer;return{walletId:n.account.wallet.walletId,nearAccountId:n.account.nearAccountId,thresholdSessionId:e.walletSessionState.thresholdSessionId,runtimePolicyScope:e.walletSessionState.runtimePolicyScope,materialActivation:e.materialActivation,auth:{kind:`passkey`,rpId:t.auth.rpId,credentialIdB64u:t.auth.credentialIdB64u},nearEd25519SigningKeyId:n.nearEd25519SigningKeyId,signerSlot:n.signerSlot}}function pu(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<1)throw Error(`${t} must be a positive integer`);return e}function mu(e){if(!Array.isArray(e)||e.length!==2||!Number.isSafeInteger(e[0])||!Number.isSafeInteger(e[1])||e[0]<1||e[1]<1||e[0]===e[1])throw Error(`participantIds must contain two distinct positive integers`);return[Number(e[0]),Number(e[1])]}function hu(e){return e.kind===`sign`&&e.keyFamily===`ed25519`}function gu(e,t,n,r,i,a){if(`sessionKind`in e||`walletSessionToken`in e)throw Error(`sync-account signer bootstrap must not carry a Wallet Session bearer`);if(T(e.walletId,`session.walletId`)!==n.walletId||T(e.nearAccountId,`session.nearAccountId`)!==n.nearAccountId||T(e.nearEd25519SigningKeyId,`session.nearEd25519SigningKeyId`)!==n.nearEd25519SigningKeyId)throw Error(`Yao recovery session identity does not match the verified passkey`);let o=j(E(e.runtimePolicyScope,`session.runtimePolicyScope`)),s=ue(e.routerAbNormalSigning);if(!s)throw Error(`Yao recovery session signing state is invalid`);let c=_e(e.walletSessionId),l=he(e.quotaId);if(!c.ok||!l.ok)throw Error(`Yao recovery Wallet Session identity is invalid`);let u=pu(e.expiresAtMs,`session.expiresAtMs`),d=pu(e.remainingUses,`session.remainingUses`),f=r.capabilitySubjects.find(hu);if(r.walletId!==n.walletId||r.authorityId!==a.walletAuthorityId||r.authMethodId!==a.walletAuthMethodId||r.authorityDigestB64u!==a.authorityDigestB64u||r.authorityRevocationEpoch!==a.authorityRevocationEpoch||r.expiresAtMs!==u||i.walletSessionId!==c.value||!f||!p(f.materialActivation,a.materialActivation))throw Error(`Yao recovery session does not match the exact Wallet Session`);return{thresholdSessionId:T(e.thresholdSessionId,`session.thresholdSessionId`),authorizationId:r.authorizationId,walletSessionId:i.walletSessionId,quotaId:l.value,expiresAtMs:u,remainingUses:d,runtimePolicyScope:o,participantIds:t,routerAbNormalSigning:s,walletSession:r,operationCredential:i}}function _u(e){let t=e.capability,n=e.session,r=P(n.runtimePolicyScope);if(!r||t.applicationBinding.wallet_id!==String(e.walletId)||t.applicationBinding.near_ed25519_signing_key_id!==e.nearEd25519SigningKeyId||t.applicationBinding.key_creation_signer_slot!==e.signerSlot||t.nearAccountId!==e.nearAccountId||t.lifecycle.accountId!==String(e.walletId)||t.lifecycle.signingWorkerId!==e.relayerKeyId||n.routerAbNormalSigning?.signingWorkerId!==e.relayerKeyId||n.participantIds[0]!==t.participantIds[0]||n.participantIds[1]!==t.participantIds[1]||!F(n.runtimePolicyScope,t.runtimePolicyScope)||n.runtimePolicyScope.signingRootVersion!==t.lifecycle.rootShareEpoch||t.applicationBinding.signing_root_id!==r.signingRootId||e.operationalPublicKey!==`ed25519:${Ee(Uint8Array.from(t.registeredPublicKey))}`)throw Error(`Yao recovery response does not preserve the registered wallet identity`)}function vu(e){if(_u(e),e.capability.lifecycle.thresholdSessionId!==e.session.thresholdSessionId)throw Error(`Yao recovery response does not preserve the threshold material lifecycle`)}function yu(e,t){if(_u(e),!p(e.capability.materialActivation,t))throw Error(`Yao warm recovery response does not preserve exact material activation`)}function bu(e){return`operationCredential`in e?e.operationCredential.token:e.walletSessionToken}function xu(e){let n=E(e,`sync-account response`);if(n.ok!==!0||n.verified!==!0)throw Error(`sync-account response is not verified`);let r=$t(T(n.walletId,`walletId`)),i=z(T(n.nearAccountId,`nearAccountId`)),a=T(n.nearEd25519SigningKeyId,`nearEd25519SigningKeyId`),o=E(n.thresholdEd25519,`thresholdEd25519`),s=mu(o.participantIds),l=E(n.ed25519YaoRecovery,`ed25519YaoRecovery`);if(l.kind!==`router_ab_ed25519_yao_sync_recovery_v1`)throw Error(`sync-account recovery kind is invalid`);let u=At(l.authorityRef);if(!u||String(u.walletId)!==String(r))throw Error(`sync-account recovery authority is invalid`);let d=c(n.walletAuthMethodId),f=t(n.walletAuthorityId),p=gt(n.foundingAuthority),m=Yt(n.foundingAuthMethod);if(!d.ok||!f.ok||d.value!==u.walletAuthMethodId||!p.ok||p.value.state!==`active`||p.value.provenance.kind!==`wallet_registration`||p.value.walletId!==r||p.value.authorityId!==f.value||!m||m.kind!==`passkey`||m.status!==`active`||m.walletId!==r||m.walletAuthorityId!==f.value||m.walletAuthMethodId!==d.value)throw Error(`sync-account exact auth-method identity is invalid`);let h=E(n.walletCustody,`walletCustody`);if(h.kind!==`wallet_custody_sync_bootstrap_v1`)throw Error(`walletCustody kind is invalid`);let g=Yr(l.capability),_=ie(n.walletSession),v=ne(n.operationCredential),y={authority:u,walletAuthMethodId:d.value,walletAuthorityId:f.value,foundingAuthority:p.value,foundingAuthMethod:m,walletId:r,nearAccountId:i,nearEd25519SigningKeyId:a,signerSlot:pu(n.signerSlot,`signerSlot`),operationalPublicKey:T(n.publicKey,`publicKey`),relayerKeyId:T(o.relayerKeyId,`thresholdEd25519.relayerKeyId`),keyVersion:T(o.keyVersion,`thresholdEd25519.keyVersion`),credentialIdB64u:T(n.credentialIdB64u,`credentialIdB64u`),credentialPublicKeyB64u:T(n.credentialPublicKeyB64u,`credentialPublicKeyB64u`),session:gu(E(o.session,`thresholdEd25519.session`),s,{walletId:String(r),nearAccountId:String(i),nearEd25519SigningKeyId:a},_,v,{walletAuthorityId:f.value,walletAuthMethodId:d.value,authorityDigestB64u:p.value.authorityDigestB64u,authorityRevocationEpoch:p.value.revocationEpoch,materialActivation:g.materialActivation}),capability:g,walletSession:_,operationCredential:v,walletCustody:{envelope:qe(h.envelope),storeVersion:T(h.storeVersion,`walletCustody.storeVersion`)}};return vu(y),y}function Su(e){let t=e.parsed,n=t.session,r=P(n.runtimePolicyScope),i=go({walletId:String(t.walletId),nearAccountId:String(t.nearAccountId),nearEd25519SigningKeyId:t.nearEd25519SigningKeyId,walletSessionId:n.walletSessionId,authorizationId:n.authorizationId,quotaId:n.quotaId,thresholdSessionId:e.thresholdSessionId,remainingUses:n.remainingUses,expiresAtMs:n.expiresAtMs,runtimePolicyScope:n.runtimePolicyScope,signingRootId:r.signingRootId,signingRootVersion:String(r.signingRootVersion||``),routerAbNormalSigning:n.routerAbNormalSigning,walletSessionToken:bu(n),home:`operationCredential`in n?n.operationCredential.home:n.home,nowMs:Math.min(Date.now(),n.expiresAtMs-1)});if(!i.ok)throw Error(`recovered Yao Wallet Session is unusable: ${i.reason}`);return Sc({walletId:Ie(t.walletId),nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:Zt(t.nearEd25519SigningKeyId),signerSlot:t.signerSlot,rpId:Mt(e.rpId),credentialIdB64u:t.credentialIdB64u,relayerUrl:e.relayerUrl,authority:t.authority,signingWalletSession:i.value})}function Cu(e){if(!b(e)||e.kind!==`wallet_custody_passkey_login_v1`)throw Error(`Passkey wallet unlock returned invalid custody data`);if(!b(e.ed25519))throw Error(`Passkey wallet unlock omitted Ed25519 custody continuity`);if(e.ed25519.kind===`absent`)return{kind:`wallet_custody_passkey_login_v1`,envelope:qe(e.envelope),storeVersion:T(e.storeVersion,`walletCustody.storeVersion`),ed25519:{kind:`absent`}};if(e.ed25519.kind!==`active`)throw Error(`Passkey wallet unlock returned invalid Ed25519 custody state`);let t=Number(e.ed25519.signerSlot),n=e.ed25519.participantIds;if(!Number.isSafeInteger(t)||t<1||!Array.isArray(n)||n.length!==2||!n.every(e=>Number.isSafeInteger(e)&&Number(e)>0)||n[0]===n[1])throw Error(`Passkey wallet unlock returned invalid Ed25519 signer identity`);return{kind:`wallet_custody_passkey_login_v1`,envelope:qe(e.envelope),storeVersion:T(e.storeVersion,`walletCustody.storeVersion`),ed25519:{kind:`active`,nearAccountId:T(e.ed25519.nearAccountId,`walletCustody.ed25519.nearAccountId`),nearEd25519SigningKeyId:T(e.ed25519.nearEd25519SigningKeyId,`walletCustody.ed25519.nearEd25519SigningKeyId`),signerSlot:t,publicKey:T(e.ed25519.publicKey,`walletCustody.ed25519.publicKey`),relayerKeyId:T(e.ed25519.relayerKeyId,`walletCustody.ed25519.relayerKeyId`),participantIds:[Number(n[0]),Number(n[1])],capability:Yr(e.ed25519.capability)}}}function wu(e){if(!b(e))throw Error(`ECDSA custody chain target is invalid`);let t=T(e.kind,`ecdsaCustody.chainTarget.kind`),n=Number(e.chainId),r=T(e.networkSlug,`ecdsaCustody.chainTarget.networkSlug`);if(!Number.isSafeInteger(n)||n<0||!r)throw Error(`ECDSA custody chain target is invalid`);if(t===`evm`){if(e.namespace!==`eip155`)throw Error(`ECDSA custody EVM namespace is invalid`);return{kind:`evm`,namespace:`eip155`,chainId:n,networkSlug:r}}if(t===`tempo`)return{kind:`tempo`,chainId:n,networkSlug:r};throw Error(`ECDSA custody chain target kind is invalid`)}function Tu(e){if(!b(e)||e.kind!==`wallet_custody_ecdsa_sync_continuity_v1`)throw Error(`Passkey wallet unlock returned invalid ECDSA custody continuity`);if(!Array.isArray(e.signers))throw Error(`Passkey wallet unlock returned invalid ECDSA custody signers`);let t=[];for(let n of e.signers){if(!b(n)||!b(n.walletKey))throw Error(`Passkey wallet unlock returned invalid ECDSA custody signer`);let e=n.walletKey,r=e.participantIds;if(!Array.isArray(r)||r.length!==2||r[0]!==1||r[1]!==2)throw Error(`Passkey wallet unlock returned invalid ECDSA custody participants`);t.push({chainTarget:wu(n.chainTarget),walletKey:{walletId:T(e.walletId,`ecdsaCustody.walletKey.walletId`),keyHandle:T(e.keyHandle,`ecdsaCustody.walletKey.keyHandle`),ecdsaThresholdKeyId:T(e.ecdsaThresholdKeyId,`ecdsaCustody.walletKey.ecdsaThresholdKeyId`),signingRootId:T(e.signingRootId,`ecdsaCustody.walletKey.signingRootId`),signingRootVersion:T(e.signingRootVersion,`ecdsaCustody.walletKey.signingRootVersion`),relayerKeyId:T(e.relayerKeyId,`ecdsaCustody.walletKey.relayerKeyId`),contextBinding32B64u:T(e.contextBinding32B64u,`ecdsaCustody.walletKey.contextBinding32B64u`),derivationClientSharePublicKey33B64u:T(e.derivationClientSharePublicKey33B64u,`ecdsaCustody.walletKey.derivationClientSharePublicKey33B64u`),participantIds:[1,2],publicCapability:Bt(e.publicCapability)},activationReceipt:Rt(n.activationReceipt),runtimePolicyScope:j(n.runtimePolicyScope)})}if(t.length===0)throw Error(`Passkey wallet unlock omitted ECDSA custody signers`);return{kind:`wallet_custody_ecdsa_sync_continuity_v1`,signers:t}}function Eu(e){let t=e.raw.sessionKind;if(t===`issued_exact_wallet_session`){let n=ne(e.raw.operationCredential);if(n.walletSessionId!==e.walletSessionId)throw Error(`Wallet unlock Ed25519 credential does not identify its session`);return{sessionKind:t,operationCredential:n}}if(t!==`already_committed_exact_wallet_session`)throw Error(`Wallet unlock returned an unsupported Ed25519 session kind`);if(e.raw.operationCredential!==void 0)throw Error(`Reused Ed25519 Wallet Session must not carry its own credential`);if(ne(e.unlockCredential).walletSessionId!==e.walletSessionId)throw Error(`Wallet unlock Ed25519 session reuses another Wallet Session`);return{sessionKind:t}}function Du(e,t){if(e===null)return null;if(!b(e))throw Error(`Wallet unlock returned invalid Ed25519 session data`);let n=s(e.thresholdSessionId),r=ve(e.authorizationId),i=_e(e.walletSessionId),a=he(e.quotaId),o=Number(e.expiresAtMs),c=Number(e.remainingUses),l=j(e.runtimePolicyScope),u=de(e.routerAbNormalSigning),d=e.participantIds;if(!n.ok||!r.ok||!i.ok||!a.ok||!Number.isSafeInteger(o)||o<=Date.now()||!Number.isSafeInteger(c)||c<1||!Array.isArray(d)||d.length!==2||!d.every(e=>Number.isSafeInteger(e)&&e>0)||d[0]===d[1])throw Error(`Wallet unlock returned invalid Ed25519 session lifecycle`);let f=Eu({raw:e,walletSessionId:i.value,unlockCredential:t});return{walletId:T(e.walletId,`ed25519Session.walletId`),nearAccountId:T(e.nearAccountId,`ed25519Session.nearAccountId`),nearEd25519SigningKeyId:T(e.nearEd25519SigningKeyId,`ed25519Session.nearEd25519SigningKeyId`),relayerKeyId:T(e.relayerKeyId,`ed25519Session.relayerKeyId`),participantIds:[Number(d[0]),Number(d[1])],thresholdSessionId:n.value,authorizationId:r.value,walletSessionId:i.value,quotaId:a.value,expiresAtMs:o,remainingUses:c,runtimePolicyScope:l,routerAbNormalSigning:u,...f}}function Ou(e){let t=e.authorization.record,n=Ut(e.ecdsaSession.public_capability.material_activation),r=0;for(let e of t.capabilitySubjects)e.kind===`sign`&&e.keyFamily===`ecdsa_secp256k1`&&p(e.materialActivation,n)&&(r+=1);if(t.walletId!==e.ed25519Session.walletId||t.walletId!==e.ecdsaSession.public_capability.client_id||t.authorizationId!==e.ed25519Session.authorizationId||t.authorizationId!==e.ecdsaSession.session.authorization_id||t.quotaId!==e.ed25519Session.quotaId||t.quotaId!==e.ecdsaSession.session.quota_id||t.expiresAtMs!==e.ed25519Session.expiresAtMs||t.expiresAtMs!==e.ecdsaSession.session.expires_at_ms||e.ed25519Session.walletSessionId!==e.ecdsaSession.session.wallet_session_id||e.authorization.operationCredential.walletSessionId!==e.ed25519Session.walletSessionId||e.ed25519Session.remainingUses!==e.ecdsaSession.session.remaining_uses||r!==1)throw Error(`Passkey ECDSA activation authority does not match its Wallet Session`)}function ku(e){let t=e.authorization.record;if(t.walletId!==e.ed25519Session.walletId||t.authorizationId!==e.ed25519Session.authorizationId||t.quotaId!==e.ed25519Session.quotaId||t.expiresAtMs!==e.ed25519Session.expiresAtMs||e.authorization.operationCredential.walletSessionId!==e.ed25519Session.walletSessionId)throw Error(`Passkey Ed25519 Wallet Session authorization is inconsistent`)}async function Au(e,t){let n=e.data.walletSession!==void 0;if(n!==(e.data.operationCredential!==void 0))throw Error(`Passkey wallet unlock returned a partial Wallet Session authorization`);if(n){if(e.ed25519Session.sessionKind!==`already_committed_exact_wallet_session`)throw Error(`Passkey wallet unlock returned competing Wallet Session credentials`);let t={record:ie(e.data.walletSession),operationCredential:ne(e.data.operationCredential)};return ku({ed25519Session:e.ed25519Session,authorization:t}),t}if(e.ed25519Session.sessionKind!==`issued_exact_wallet_session`)throw Error(`Passkey wallet unlock omitted the exact Wallet Session credential`);let r=await t.read({relayerUrl:e.relayServerUrl,operationCredential:e.ed25519Session.operationCredential},{walletSessionId:e.ed25519Session.walletSessionId,quotaId:e.ed25519Session.quotaId});if(r.status!==`active`||r.walletSessionId!==e.ed25519Session.walletSessionId||r.quotaId!==e.ed25519Session.quotaId||r.expiresAtMs!==e.ed25519Session.expiresAtMs||r.remainingUses!==e.ed25519Session.remainingUses)throw Error(`Passkey wallet unlock returned an inconsistent issued Wallet Session`);let i={record:r.authorization,operationCredential:e.ed25519Session.operationCredential};return ku({ed25519Session:e.ed25519Session,authorization:i}),i}async function ju(e,t){let n=await Au(e,t);return Ou({ed25519Session:e.ed25519Session,ecdsaSession:e.ecdsaSession,authorization:n}),n}function Mu(e){let t=Un(e)??Xn(e);return t?{success:!1,kind:`already_committed`,code:t.code,message:t.message,next:t.next,committed:t.committed}:null}async function Nu(e,t,n){try{if(t.type!==`passkey_assertion`)throw Error(`Passkey wallet unlock requires a passkey assertion`);let r=T(t.challengeId,`challengeId`),a=t.webauthn_authentication,o=String(t.expected_origin||``).trim(),s={unlockBackend:`passkey`,challengeId:r,...`walletId`in t&&t.walletId?{walletId:t.walletId}:{},webauthn_authentication:An(a),ed25519SessionRequest:t.ed25519SessionRequest,...o?{expected_origin:o}:{},...t.ecdsaSessionPolicy?{ecdsaSessionPolicy:Lt(t.ecdsaSessionPolicy)}:{}},c=i(e,`/wallet/unlock/verify`),l=await fetch(c,{method:`POST`,headers:{"Content-Type":`application/json`},credentials:`omit`,body:JSON.stringify(s)}),u=await l.json().catch(()=>({})),d=b(u)?u:{};if(!l.ok)return Mu(d)||{success:!1,error:typeof d.message==`string`?d.message:`HTTP ${l.status}`};if(d.ok!==!0)return Mu(d)||{success:!1,error:typeof d.message==`string`?d.message:`Wallet unlock verification failed`};let f=t.type===`passkey_assertion`&&t.ecdsaSessionPolicy!==void 0,p=Du(d.ed25519Session,d.operationCredential);if(t.ed25519SessionRequest.kind===`requested`&&!p)throw Error(`Wallet unlock omitted the requested Ed25519 Wallet Session`);if(t.ed25519SessionRequest.kind===`not_requested`&&p)throw Error(`Wallet unlock returned an unrequested Ed25519 Wallet Session`);let m=Cu(d.walletCustody),h,g,_,v;if(f){if(d.ecdsaSession===void 0)throw Error(`Wallet unlock omitted the requested ECDSA Wallet Session activation`);if(h=b(d.ecdsaSession)&&d.ecdsaSession.kind===`router_ab_ecdsa_credential_free_session_activated_v1`?Ft(d.ecdsaSession):Gt(d.ecdsaSession),d.ecdsaActivationReceipt===void 0||d.ecdsaCustody===void 0)throw Error(`Wallet unlock omitted ECDSA custody continuity`);if(_=Rt(d.ecdsaActivationReceipt),v=Tu(d.ecdsaCustody),!m)throw Error(`Wallet unlock omitted wallet custody for ECDSA activation`);if(h.kind===`router_ab_ecdsa_credential_free_session_activated_v1`){if(!p)throw Error(`Credential-free ECDSA activation requires an Ed25519 Wallet Session`);g=await ju({relayServerUrl:e,data:d,ed25519Session:p,ecdsaSession:h},n)}}else if(d.ecdsaSession!==void 0)throw Error(`Wallet unlock returned an unrequested ECDSA Wallet Session activation`);else p&&(g=await Au({relayServerUrl:e,data:d,ed25519Session:p},n));if(h&&_&&v&&m){if(h.kind===`router_ab_ecdsa_credential_free_session_activated_v1`){if(!g)throw Error(`Credential-free ECDSA activation omitted exact Wallet Session authority`);return{success:!0,ecdsaSession:h,ecdsaActivationReceipt:_,ecdsaCustody:v,ed25519Session:p,walletCustody:m,walletSessionAuthorization:g}}return{success:!0,ecdsaSession:h,ecdsaActivationReceipt:_,ecdsaCustody:v,ed25519Session:p,walletCustody:m}}if(m&&p&&g)return{success:!0,ed25519Session:p,walletCustody:m,walletSessionAuthorization:g};if(m&&!p)return{success:!0,ed25519Session:null,walletCustody:m};throw Error(`Passkey wallet unlock returned incomplete exact session state`)}catch(e){return{success:!1,error:we(e)||`Failed to verify wallet unlock`}}}async function Pu(e,t){try{let n=T(t.challengeId,`challengeId`),r=String(t.expected_origin||``).trim(),a={unlockBackend:`passkey`,challengeId:n,webauthn_authentication:An(t.webauthn_authentication),ed25519SessionRequest:t.ed25519SessionRequest,...r?{expected_origin:r}:{}},o=await fetch(i(e,`/wallet/unlock/verify`),{method:`POST`,headers:{"Content-Type":`application/json`},credentials:`omit`,body:JSON.stringify(a)}),s=await o.json().catch(()=>({})),c=b(s)?s:{};if(!o.ok||c.ok!==!0)return Mu(c)||{success:!1,error:typeof c.message==`string`?c.message:`Wallet Session unlock failed (HTTP ${o.status})`};if(c.walletCustody!==void 0&&c.walletCustody!==null)throw Error(`Linked passkey unlock returned custody data`);if(c.ecdsaSession!==void 0&&c.ecdsaSession!==null)throw Error(`Linked passkey unlock returned an ECDSA activation`);let l=Du(c.ed25519Session,c.operationCredential);if(t.ed25519SessionRequest.kind===`requested`&&!l)throw Error(`Linked passkey unlock omitted the requested Ed25519 Wallet Session`);if(t.ed25519SessionRequest.kind===`not_requested`&&l)throw Error(`Linked passkey unlock returned an unrequested Ed25519 Wallet Session`);return{success:!0,walletSession:ie(c.walletSession),operationCredential:ne(c.operationCredential),ed25519Session:l}}catch(e){return{success:!1,error:we(e)||`Failed to verify linked passkey Wallet Session`}}}function Fu(e){let t=g(e);if(!t.ok)throw Error(`ECDSA registration recovery could not create a session id`);return t.value}function Iu(e){let t=ge(e);if(!t.ok)throw Error(`ECDSA registration recovery could not create a Wallet Session mint id`);return t.value}function Lu(e){return Lt({kind:`router_ab_ecdsa_post_registration_session_activation_policy_v1`,key_handle:e.keyHandle,session_policy:{threshold_session_id:Fu(hr(`threshold-ecdsa-registration-recovery`)),wallet_session_mint_id:Iu(hr(`wallet-session-mint`)),ttl_ms:e.sessionPolicy.ttlMs,remaining_uses:e.sessionPolicy.unlockRemainingUses,runtime_policy_scope:e.runtimePolicyScope}})}async function Ru(e){let t=await fetch(i(e.relayerUrl,`/wallet/unlock/challenge`),{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({unlockBackend:`passkey`,userId:e.walletId,rpId:e.rpId})}),n=E(await t.json().catch(()=>({})),`Passkey unlock challenge response`);if(!t.ok||n.ok!==!0)throw Error(typeof n.message==`string`&&n.message?n.message:`wallet/unlock/challenge failed (HTTP ${t.status})`);return{challengeId:y(n.challengeId,`Passkey unlock challenge ID`),challengeB64u:y(n.challengeB64u,`Passkey unlock challenge`)}}function zu(e){return e===`ble`||e===`hybrid`||e===`internal`||e===`nfc`||e===`usb`}function Bu(e,t){return{id:e,type:`public-key`,transports:t.filter(zu)}}function Vu(e){let t=e.session.session.wallet_session;if(t.walletId!==e.pending.walletId||t.authMethodId!==e.pending.walletAuthMethodId||t.authorityId!==e.response.foundingAuthority.authorityId||t.expiresAtMs!==e.session.session.expires_at_ms||t.authorizationId!==e.session.session.authorization_id||t.quotaId!==e.session.session.quota_id||e.session.session.remaining_uses<=0||e.session.session.expires_at_ms<=Date.now()||e.session.session.wallet_session_id!==e.session.session.operation_credential.walletSessionId||!wt(e.session.public_capability,e.walletKey.publicCapability))throw Error(`ECDSA registration unlock did not issue the exact Wallet Session`)}function Hu(e){if(e.signers.length!==e.walletKeys.length)throw Error(`ECDSA registration unlock returned incomplete custody continuity`);let t=new Map;for(let n of e.walletKeys){let e=Re(n.chainTarget);if(t.has(e))throw Error(`ECDSA registration has duplicate custody targets`);t.set(e,n)}for(let n of e.signers){let r=Re(n.chainTarget),i=t.get(r);if(!i)throw Error(`ECDSA registration unlock returned an unknown target`);if(t.delete(r),n.walletKey.walletId!==e.pending.walletId||n.walletKey.keyHandle!==i.keyHandle||n.walletKey.ecdsaThresholdKeyId!==i.ecdsaThresholdKeyId||n.walletKey.signingRootId!==i.signingRootId||n.walletKey.signingRootVersion!==i.signingRootVersion||n.walletKey.relayerKeyId!==i.relayerKeyId||n.walletKey.contextBinding32B64u!==i.contextBinding32B64u||n.walletKey.derivationClientSharePublicKey33B64u!==i.derivationClientSharePublicKey33B64u||!wt(n.walletKey.publicCapability,i.publicCapability)||!Nt(n.activationReceipt,e.response.ecdsa.activation))throw Error(`ECDSA registration unlock returned different custody continuity`)}}function Uu(e){new Uint8Array(e).fill(0)}async function Wu(e){if(e.pending.auth.kind!==`passkey`)throw Error(`ECDSA registration passkey unlock has a different pending factor`);let t=e.walletKeys[0];if(!t)throw Error(`ECDSA registration unlock has no primary wallet key`);let n=typeof window<`u`?window.location.origin:``;if(!n)throw Error(`ECDSA registration passkey unlock requires an origin`);Al(e.onEvent,String(e.pending.walletId),{phase:dn.STEP_03_PASSKEY_CHALLENGE_STARTED,status:`running`,authMethod:`passkey`});let r=await Ru({relayerUrl:e.relayerUrl,walletId:String(e.pending.walletId),rpId:e.pending.auth.rpId});Al(e.onEvent,String(e.pending.walletId),{phase:dn.STEP_03_PASSKEY_PROMPT_STARTED,status:`waiting_for_user`,authMethod:`passkey`,interaction:{kind:`passkey_assert`,overlay:`show`}});let i=await e.signingSurface.getAuthenticationCredentialsSerialized({subjectId:String(e.pending.walletId),challengeB64u:r.challengeB64u,allowCredentials:[Bu(e.pending.auth.credentialIdB64u,e.pending.auth.transports)],includeSecondPrfOutput:!0});if(ur(i)!==e.pending.auth.credentialIdB64u)throw Error(`ECDSA registration unlock returned a different Passkey credential`);Al(e.onEvent,String(e.pending.walletId),{phase:dn.STEP_03_PASSKEY_PROMPT_SUCCEEDED,status:`succeeded`,authMethod:`passkey`,interaction:{kind:`passkey_assert`,overlay:`hide`}});let a=fr(i,`ECDSA registration recovery`),o=await Nu(e.relayerUrl,{type:`passkey_assertion`,challengeId:r.challengeId,walletId:String(e.pending.walletId),webauthn_authentication:i,ed25519SessionRequest:{kind:`not_requested`},expected_origin:n,ecdsaSessionPolicy:Lu({keyHandle:t.keyHandle,sessionPolicy:e.sessionPolicy,runtimePolicyScope:ll(e.response).ecdsa.runtimePolicyScope})},new mr);if(!o.success)throw Error(o.error||`Passkey ECDSA registration unlock failed`);if(o.ecdsaSession.kind!==`router_ab_ecdsa_post_registration_session_activated_v1`||!o.ecdsaCustody||!o.walletCustody)throw Error(`Passkey ECDSA registration unlock did not issue exact session custody`);Vu({pending:e.pending,response:e.response,session:o.ecdsaSession,walletKey:t}),Hu({pending:e.pending,response:e.response,walletKeys:e.walletKeys,signers:o.ecdsaCustody.signers});let s=Uint8Array.from(R(a)).buffer;try{let n=await e.signingSurface.rejoinWalletCustodyEvmFamilyKeySet({walletId:String(e.pending.walletId),custodyJson:Pl(e.pending.localMaterial.custodyCommit),factorSecret:s,evmFamilySigningKeySlotId:t.evmFamilySigningKeySlotId,applicationBindingDigestB64u:e.response.ecdsa.bootstrap.applicationBindingDigestB64u,registeredClientRootPublicKey33B64u:t.derivationClientSharePublicKey33B64u,relayerPublicIdentityJson:JSON.stringify({relayerKeyId:t.relayerKeyId,relayerPublicKey33B64u:t.relayerVerifyingShareB64u,groupPublicKey33B64u:t.thresholdEcdsaPublicKeyB64u,ethereumAddress:t.thresholdOwnerAddress,relayerShareRetryCounter:t.relayerShareRetryCounter})});return{kind:`passkey`,credential:i,custody:o.walletCustody,session:o.ecdsaSession,readyStateBlobB64u:n.readyStateBlobB64u,publicFacts:n.publicFacts}}finally{Uu(s)}}async function Gu(e){if(e.pending.auth.kind!==`email_otp`)throw Error(`ECDSA registration Email OTP unlock has a different pending factor`);let t=e.walletKeys[0];if(!t)throw Error(`ECDSA registration unlock has no primary wallet key`);let n=ll(e.response).ecdsa.runtimePolicyScope,r=await lu({walletSession:{walletId:Ie(e.pending.walletId),walletSessionUserId:String(e.pending.walletId)},authoritySelector:{kind:`wallet_auth_method`,walletAuthMethodId:e.pending.walletAuthMethodId},relayUrl:e.relayerUrl,groupId:le,routePlan:nu({freshRouteFamily:`login`,operation:We}),workerCtx:e.signingSurface.getSignerWorkerContext(),verification:{kind:`otp`,challengeId:e.exactMethod.challengeId,otpCode:e.exactMethod.otpCode},runtimePolicyScope:n,ecdsaSessionHandleBinding:{keyHandle:t.keyHandle,authSubjectId:e.pending.auth.providerSubject,operation:`wallet_unlock`,chainTarget:t.chainTarget},ecdsaSessionPolicy:Lu({keyHandle:t.keyHandle,sessionPolicy:e.sessionPolicy,runtimePolicyScope:n})});if(r.operation!==`wallet_unlock`)throw Error(`Email OTP ECDSA registration unlock returned the wrong operation`);return Vu({pending:e.pending,response:e.response,session:r.ecdsaSession,walletKey:t}),Hu({pending:e.pending,response:e.response,walletKeys:e.walletKeys,signers:r.ecdsaCustody.continuity.signers}),{kind:`email_otp`,session:r.ecdsaSession,readyStateBlobB64u:r.ecdsaCustody.readyStateBlobB64u,publicFacts:r.ecdsaCustody.publicFacts}}async function Ku(e){switch(e.exactMethod.kind){case`passkey`:return await Wu({relayerUrl:e.relayerUrl,sessionPolicy:e.sessionPolicy,onEvent:e.onEvent,pending:e.pending,response:e.response,walletKeys:e.walletKeys,exactMethod:e.exactMethod,signingSurface:e.signingSurface});case`email_otp`:return await Gu({relayerUrl:e.relayerUrl,sessionPolicy:e.sessionPolicy,onEvent:e.onEvent,pending:e.pending,response:e.response,walletKeys:e.walletKeys,exactMethod:e.exactMethod,signingSurface:e.signingSurface});default:throw e.exactMethod,Error(`Unsupported pending registration unlock method: ${String(e.exactMethod)}`)}}const qu={listPendingWalletRegistrationCommits:Ju,completeWalletRegistrationNearProvisioning:Gn,publishPendingWalletRegistrationCommit:Yu};async function Ju(){return await V.initialize(),await V.listPendingWalletRegistrationCommits()}async function Yu(e){return await V.publishPendingWalletRegistrationCommit(e)}function Xu(e){return e instanceof Error?e:Error(String(e||`pending registration replay failed`))}function Zu(e){return e.operation===`near_provisioning`&&e.phase===`joined`}function Qu(e,t){let n=e.localMaterial.ed25519.metadata,r=e.localMaterial.ed25519.localMaterial;return{binding:{kind:Mn,applicationBindingDigestB64u:r.applicationBindingDigestB64u,registeredPublicKeyB64u:n.registeredPublicKeyB64u,participantIds:n.participantIds,stateEpoch:n.stateEpoch,walletId:String(t.walletId),nearAccountId:t.ed25519.nearAccountId,nearEd25519SigningKeyId:t.ed25519.nearEd25519SigningKeyId,signerSlot:t.ed25519.signerSlot,signingWorkerId:n.signingWorkerId,signingWorkerVerifyingShareB64u:n.signingWorkerVerifyingShareB64u},sealed:{ciphertextB64u:r.b64u,nonceB64u:r.nonceB64u}}}function $u(e){let t=R(e.localMaterial.ed25519.metadata.registeredPublicKeyB64u);if(t.length!==32)throw Error(`pending registration has an invalid Ed25519 registered public key`);return`ed25519:${Ee(t)}`}function ed(e,t,n){let r=e.localMaterial.ed25519.metadata,i=e.localMaterial.custodyCommit;if(e.auth.kind===`passkey`){if(rl({clientPublicKey:n,finalized:t,expectedRpId:e.auth.rpId,expectedWalletId:e.walletId}).credentialIdB64u!==e.auth.credentialIdB64u)throw Error(`pending registration returned a different Passkey credential`)}else il({clientPublicKey:n,finalized:t,expectedRegistrationAuthorityId:e.auth.registrationAuthorityId,expectedWalletId:e.walletId});if(t.foundingAuthMethod.walletAuthMethodId!==e.walletAuthMethodId||t.foundingAuthMethod.walletId!==e.walletId||t.foundingAuthority.walletId!==e.walletId||t.ed25519.signerSlot!==r.signerSlot||t.ed25519.nearEd25519SigningKeyId!==r.nearEd25519SigningKeyId||t.ed25519.participantIds[0]!==r.participantIds[0]||t.ed25519.participantIds[1]!==r.participantIds[1]||t.ed25519.routerAbNormalSigning.signingWorkerId!==r.signingWorkerId||t.ed25519.relayerKeyId!==t.ed25519.routerAbNormalSigning.signingWorkerId||t.custodyKeyManifestDigestB64u!==i.keyManifestDigestB64u||i.registeredPublicKeyB64u!==void 0&&i.registeredPublicKeyB64u!==r.registeredPublicKeyB64u)throw Error(`pending registration does not match the committed NEAR projection`);Sn(e,{operation:e.operation,walletId:t.walletId,walletAuthMethodId:t.foundingAuthMethod.walletAuthMethodId,authority:t.authority})}function td(e,t){let n=t.registrationEstablishedSession.session,r=n.tokens.kind===`near_ed25519`||n.tokens.kind===`near_ed25519_and_evm_family_ecdsa`?n.tokens.ed25519:null,i=e.localMaterial.ed25519.metadata;if(n.walletId!==e.walletId||!r||r.nearAccountId!==t.ed25519.nearAccountId||r.nearEd25519SigningKeyId!==t.ed25519.nearEd25519SigningKeyId||r.routerAbNormalSigning.signingWorkerId!==i.signingWorkerId||!p(r.materialActivation,i.materialActivation))throw Error(`pending registration does not match the committed Wallet Session projection`)}function nd(e,t){td(e,t);let n=t.registrationEstablishedSession;if(n.kind===`issued`){if(n.session.walletSession.walletId!==e.walletId||n.session.walletSession.authMethodId!==e.walletAuthMethodId)throw Error(`pending registration issued a Wallet Session for another auth method`);return}if(n.next!==`unlock_exact_method`)throw Error(`pending registration replay has an invalid continuation`)}function rd(e,t,n){if(!t.ok||t.kind!==`near_ed25519`)throw Error(t.ok?`pending registration replay returned a different signer branch`:`pending registration replay failed: ${t.code}`);if(t.walletCustody?.status!==n)throw Error(`pending registration replay did not commit the expected wallet custody`);return ed(e,t,$u(e)),t}function id(e,t){let n=rd(e,t,e.signerPlanKind===`near_ed25519`?`committed`:`joined`);if(e.signerPlanKind===`near_ed25519_and_evm_family_ecdsa`&&(n.registrationEstablishedSession.kind!==`already_committed`||n.registrationEstablishedSession.session.tokens.kind!==`near_ed25519_and_evm_family_ecdsa`))throw Error(`NEAR completion must extend the committed ECDSA session`);return nd(e,n),n}async function ad(e,t){let n=$u(e),r={walletId:e.walletId,nearAccountId:z(t.ed25519.nearAccountId),nearEd25519SigningKeyId:t.ed25519.nearEd25519SigningKeyId,signerSlot:t.ed25519.signerSlot,operationalPublicKey:n,relayerKeyId:t.ed25519.relayerKeyId,keyVersion:t.ed25519.keyVersion,participantIds:t.ed25519.participantIds,custodyMaterial:Qu(e,t)};if(e.auth.kind===`passkey`){if(t.authMethod.kind!==`passkey`)throw Error(`pending Passkey registration replay returned a non-Passkey auth method`);return Nn({...r,rpId:e.auth.rpId,credentialIdB64u:e.auth.credentialIdB64u,credentialPublicKeyB64u:t.authMethod.credentialPublicKeyB64u,transports:e.auth.transports})}if(t.authMethod.kind!==`email_otp`)throw Error(`pending Email OTP registration replay returned a non-Email OTP auth method`);let i=Et(t.authority);if(!i)throw Error(`pending Email OTP registration replay returned an invalid authority`);return await Fn({...r,email:e.auth.email,registrationAuthorityId:e.auth.registrationAuthorityId,authority:i})}function od(e,t,n){return{pending:e,authority:t.authority,foundingAuthority:{authority:t.foundingAuthority,authMethod:t.foundingAuthMethod},request:{operation:e.operation,registrationCeremonyId:e.registrationCeremonyId,idempotencyKey:e.idempotencyKey,walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId},ecdsaContinuity:[],walletSessionPublication:t.registrationEstablishedSession.kind===`issued`?{kind:`issued`,walletSession:t.registrationEstablishedSession.session.walletSession,operationCredential:t.registrationEstablishedSession.session.operationCredential}:{kind:`credential_free_projection`,walletSession:t.registrationEstablishedSession.session.walletSession},registration:n}}function sd(e){switch(e.auth.kind){case`passkey`:return{kind:`passkey`};case`email_otp`:return{kind:`email_otp`,enrollment:e.auth.enrollment};default:throw e.auth,Error(`pending registration has an unsupported auth method`)}}function cd(e,t){return{relayerUrl:e,registrationCeremonyId:t.registrationCeremonyId,signedSetup:t.signedSetup,idempotencyKey:t.idempotencyKey,ed25519:{activationReference:t.localMaterial.ed25519.activationReference},auth:sd(t),walletCustodyCommit:t.localMaterial.custodyCommit}}async function ld(e){let t=cd(e.relayerUrl,e.pending),n=await e.ports.completeWalletRegistrationNearProvisioning(t);return id(e.pending,n)}async function ud(e){let t=await Gn({...cd(e.relayerUrl,e.pending),headers:re(e.operationCredential)}),n=id(e.pending,t),r=n.registrationEstablishedSession.session;if(r.tokens.kind!==`near_ed25519_and_evm_family_ecdsa`)throw Error(`Persisted mixed registration has no NEAR session`);let i=r.tokens.ed25519,a=yt({kind:`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`,walletId:e.pending.walletId,nearAccountId:n.ed25519.nearAccountId,nearEd25519SigningKeyId:n.ed25519.nearEd25519SigningKeyId,signerSlot:n.ed25519.signerSlot,thresholdSessionId:i.thresholdSessionId,signingWorkerId:n.ed25519.routerAbNormalSigning.signingWorkerId,participantIds:n.ed25519.participantIds});if(!a.ok)throw Error(a.message);let o=await fetch(`${e.relayerUrl.replace(/\/$/,``)}${lt}`,{method:`POST`,headers:{...re(e.operationCredential),"Content-Type":`application/json`},body:JSON.stringify(a.value)}),s=await o.json();if(!o.ok||!s||typeof s!=`object`)throw Error(`Persisted NEAR registration activation is unavailable`);let c=Yr(Reflect.get(s,`capability`)),l=e.pending.localMaterial.ed25519.metadata;if(c.registrationContinuity.kind!==`registration`||c.applicationBinding.wallet_id!==e.pending.walletId||c.applicationBinding.near_ed25519_signing_key_id!==l.nearEd25519SigningKeyId||c.lifecycle.lifecycleId!==e.pending.localMaterial.ed25519.activationReference.lifecycle_id||c.lifecycle.thresholdSessionId!==i.thresholdSessionId||c.lifecycle.signingWorkerId!==l.signingWorkerId||c.applicationBinding.key_creation_signer_slot!==l.signerSlot||L(Uint8Array.from(c.registeredPublicKey))!==l.registeredPublicKeyB64u||!p(c.materialActivation,l.materialActivation))throw Error(`Persisted NEAR registration activation changed identity`);let u=c.registrationContinuity;return{joined:{commitPayload:e.pending.localMaterial.custodyCommit,activationReference:e.pending.localMaterial.ed25519.activationReference,localMaterial:e.pending.localMaterial.ed25519.localMaterial,metadata:ha({material:Qu(e.pending,n),activation:{materialActivation:c.materialActivation,lifecycleId:c.lifecycle.lifecycleId,signingRootVersion:c.lifecycle.rootShareEpoch,signingRootId:c.applicationBinding.signing_root_id,signerSetId:c.lifecycle.signerSetId,thresholdSessionId:c.lifecycle.thresholdSessionId,activationTranscriptB64u:L(Uint8Array.from(u.activationTranscript)),activationCapabilityBindingB64u:L(Uint8Array.from(c.activeCapabilityBinding))}})},admissionRequest:u.admissionRequest,admissionReceipt:u.admissionReceipt}}async function dd(e){let t=await ld(e),n=await ad(e.pending,t);return await e.ports.publishPendingWalletRegistrationCommit(od(e.pending,t,n)),{kind:`published`,registrationCeremonyId:e.pending.registrationCeremonyId}}async function fd(e){let t=e.ports||qu,n=await t.listPendingWalletRegistrationCommits(),r=[];for(let i of n){if(sl(i)||cl(i)){r.push({kind:`unlock_required`,registrationCeremonyId:i.registrationCeremonyId,keyFamilies:i.localMaterial.keyFamilies,next:`unlock_exact_method`,reason:`ecdsa_local_finalization`});continue}if(i.operation===`near_provisioning`&&i.signerPlanKind===`near_ed25519_and_evm_family_ecdsa`){r.push({kind:`unlock_required`,reason:`near_provisioning`,registrationCeremonyId:i.registrationCeremonyId,next:`unlock_exact_method`});continue}if(Zu(i))try{r.push(await dd({relayerUrl:e.relayerUrl,pending:i,ports:t}))}catch(e){r.push({kind:`failed`,registrationCeremonyId:i.registrationCeremonyId,error:Xu(e)})}}return r}const pd={activateWalletRegistration:Wn,publishPendingWalletRegistrationCommit:Yu,unlockPendingEcdsaRegistration:Ku};async function md(e){await V.initialize();let t=null;for(let n of await V.listPendingWalletRegistrationCommits())if(!(n.operation!==`registration_activate`||n.walletId!==e)){if(t)throw Error(`wallet has multiple pending registration activations`);t=n}if(!t)return null;if(!sl(t)&&!cl(t))throw Error(`pending registration commit is not ECDSA-enabled`);return t}async function hd(e){if(e.pending.auth.kind!==e.exactMethod.kind)throw Error(`pending registration requires its exact authentication method`);return await kl({relayerUrl:e.relayerUrl,sessionPolicy:e.sessionPolicy,pending:e.pending,exactMethod:e.exactMethod,signingSurface:e.signingSurface,ports:pd,nearContext:e.nearContext,nearCompletion:e.nearCompletion,onEvent:e.onEvent})}async function gd(e){let t=performance.now();gr(`evm-family`,{event:`ecdsa_session_prefill`,trigger:e.trigger,chainTarget:e.chainTarget,status:`started`,startedAtMs:t});try{let n=await e.signingEngine.scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill({walletId:e.walletId,chainTarget:e.chainTarget},e.statusReads);gr(`evm-family`,{event:`ecdsa_session_prefill`,trigger:e.trigger,chainTarget:e.chainTarget,status:n.status,reason:n.reason,scheduleReason:`schedule`in n?n.schedule.reason:null,walletSessionId:n.walletSessionId,durationMs:performance.now()-t})}catch{gr(`evm-family`,{event:`ecdsa_session_prefill`,trigger:e.trigger,chainTarget:e.chainTarget,status:`failed`,reason:`unexpected_error`,durationMs:performance.now()-t})}}const _d=new Map,vd=new Set;function yd(e,t){for(let n of vd)try{n(e,t)}catch{}}function bd(e,t){let n=String(e),r=_d.get(n);if(r)return r;let i={state:{status:`near_pending`,updatedAtMs:t},inFlight:null};return _d.set(n,i),i}function xd(e){return _d.get(String(e))?.state??null}async function Sd(e){let t=_d.get(String(e));return t?t.inFlight?await t.inFlight:t.state:null}function Cd(e,t){let n=bd(e,t.updatedAtMs);n.state.status===`near_ready`&&t.status!==`near_ready`||(n.state=t,yd(e,t))}function wd(e){return vd.add(e),()=>{vd.delete(e)}}function Td(e){let t=bd(e.walletId,e.nowMs());if(t.inFlight)return t.inFlight;if(t.state.status===`near_ready`)return Promise.resolve(t.state);Cd(e.walletId,{status:`near_provisioning`,updatedAtMs:e.nowMs()});let n=(async()=>{try{return await e.attempt()}catch(t){return{status:`near_failed_retryable`,updatedAtMs:e.nowMs(),error:t instanceof Error?t.message:String(t),errorCode:`near_provisioning_failed`}}})().then(n=>(t.inFlight=null,Cd(e.walletId,n),n));return t.inFlight=n,n}function Ed(e){let t=e.registration;if(t.mode!==`managed`)return;let n=String(t.projectEnvironmentId||``).trim(),r=String(t.publishableKey||``).trim();if(!(!n||!r))return{projectEnvironmentId:n,publishableKey:r}}async function Dd(e){let t=(await V.listWalletAuthMethodsV2ForWallet(String(e.walletId))).filter(t=>t.kind===`passkey`&&t.status===`active`&&t.walletId===e.walletId&&String(t.rpId)===e.rpId&&String(t.credentialIdB64u)===e.credentialIdB64u),[n]=t;if(t.length!==1||!n)throw Error(`passkey authority requires one exact active V2 auth method`);return n}async function Od(e){let t=await Dd(e);return await Ct({authority:{walletId:t.walletId,factor:{kind:`passkey`,credentialIdB64u:t.credentialIdB64u},verifier:{kind:`webauthn`,rpId:t.rpId},bindingId:t.walletAuthMethodId}})}const kd=[`walletId`,`envelopeId`,`factor`,`envelopeRevision`,`binding`,`ownership`];function Ad(e){let t=jd(e.replacement.envelopeBindingJson);if(t.walletId!==e.expectedWalletId)throw Error(`recovery replacement envelope changed the wallet identity`);if(t.envelopeId!==e.replacement.envelopeId)throw Error(`recovery replacement envelope changed the envelope identity`);let n=qe({kind:tt,envelopeId:t.envelopeId,walletId:t.walletId,binding:t.binding,factor:t.factor,ownership:Ye(t.ownership,`recoveryReplacementEnvelope.binding.ownership`),envelopeVersion:tt,envelopeRevision:t.envelopeRevision,nonceB64u:e.replacement.envelopeNonceB64u,sealedCustodySecretB64u:e.replacement.sealedCustodySecretB64u,ciphertextDigestB64u:e.replacement.envelopeCiphertextDigestB64u,aadHashB64u:e.replacement.envelopeAadHashB64u,lifecycle:{state:`active`,activatedAtMs:e.activatedAtMs},createdAtMs:e.activatedAtMs,updatedAtMs:e.activatedAtMs},`recoveryReplacementEnvelope`);if(n.binding.kind!==`wallet_custody_seed_v1`)throw Error(`custody envelope must seal the wallet custody seed`);return n}function jd(e){let t;try{t=JSON.parse(e)}catch{throw Error(`recovery replacement envelope binding is not JSON`)}let n=E(t,`recoveryReplacementEnvelope.binding`);return M(n,kd,`recoveryReplacementEnvelope.binding`),n}const Md=`passkeyCustodyEnvelopeCacheV1`,Nd=`passkey_custody_envelope_cache_v1`;let Pd={kind:`unconfigured`};const Fd=new Map;function Id(e){throw Error(`unknown passkey custody session cache persistence state: ${String(e)}`)}function Ld(){switch(Pd.kind){case`configured`:return Pd.persistence;case`unconfigured`:throw Error(`passkey custody session cache persistence is not configured`);default:return Id(Pd)}}function Rd(e){Pd={kind:`configured`,persistence:e}}function zd(e,t){let n=String(e||``).trim(),r=String(t||``).trim();if(!n||!r)throw Error(`passkey custody session identity is required`);return`${n}:${r}`}function Bd(){return{kind:Nd,envelopes:[]}}function Vd(e){if(e==null)return Bd();if(typeof e!=`object`||Array.isArray(e))throw Error(`passkey custody envelope cache is invalid`);let t=e;if(t.kind!==Nd||!Array.isArray(t.envelopes))throw Error(`passkey custody envelope cache has an invalid shape`);return{kind:Nd,envelopes:t.envelopes.map(e=>{let t=qe(e);if(!Ze(t.binding))throw Error(`generic passkey custody cache cannot contain an Ed25519 export root`);return t})}}async function Hd(){return Vd(await Ld().readCacheEntry(Md))}async function Ud(e){await Ld().writeCacheEntry(Md,e)}async function Wd(e){if(e.envelope.lifecycle.state!==`active`)throw Error(`passkey custody session envelope is not active`);if(!Ze(e.envelope.binding))throw Error(`generic passkey custody cache accepts wallet custody seeds only`);if(String(e.envelope.walletId)!==String(e.walletId)||e.envelope.factor.kind!==`passkey`||String(e.envelope.factor.credentialIdB64u)!==String(e.credentialIdB64u))throw Error(`passkey custody session envelope identity changed`);let t=zd(String(e.walletId),String(e.credentialIdB64u));Fd.set(t,e.envelope);let n=(await Hd()).envelopes.filter(e=>e.factor.kind!==`passkey`||zd(String(e.walletId),String(e.factor.credentialIdB64u))!==t);n.push(e.envelope),await Ud({kind:Nd,envelopes:n.slice(-32)})}async function Gd(e){let t=zd(String(e.walletId),String(e.credentialIdB64u)),n=Fd.get(t);if(n)return n;let r=(await Hd()).envelopes.find(e=>e.lifecycle.state===`active`&&e.factor.kind===`passkey`&&zd(String(e.walletId),String(e.factor.credentialIdB64u))===t);return r?(Fd.set(t,r),r):null}function Kd(e){return Math.max(0,Math.round(performance.now()-e))}function qd(){return{kind:`registration_confirmation_diagnostics_v1`,workerReadyMs:0,workerRequestRoundTripMs:0,workerResponseValidationMs:0,requestSetupMs:0,promptUserMs:0,promptElementDefineMs:0,promptMountMs:0,promptHostFirstUpdateMs:0,promptHostInteractiveMs:0,promptConfirmEventMs:0,promptDecisionWaitMs:0,credentialCreateStartMs:0,credentialCreateMs:0,credentialSerializeMs:0,duplicateRetryCount:0,mainThreadTotalMs:0}}function Jd(e){let t=performance.now(),n=fr(e.credential,`Passkey registration authority`),r=Kd(t),i=performance.now(),a=kn(e.credential),o=Kd(i);return{kind:`passkey`,credential:e.credential,webauthnRegistration:a,prfFirstB64u:n,diagnostics:{kind:`passkey_registration_authority_diagnostics_v1`,requestConfirmationMs:e.requestConfirmationMs,prfExtractionMs:r,credentialRedactionMs:o,confirmationWorkerReadyMs:e.diagnostics.workerReadyMs,confirmationWorkerRequestRoundTripMs:e.diagnostics.workerRequestRoundTripMs,confirmationWorkerResponseValidationMs:e.diagnostics.workerResponseValidationMs,confirmationRequestSetupMs:e.diagnostics.requestSetupMs,confirmationPromptUserMs:e.diagnostics.promptUserMs,confirmationPromptElementDefineMs:e.diagnostics.promptElementDefineMs,confirmationPromptMountMs:e.diagnostics.promptMountMs,confirmationPromptHostFirstUpdateMs:e.diagnostics.promptHostFirstUpdateMs,confirmationPromptHostInteractiveMs:e.diagnostics.promptHostInteractiveMs,confirmationPromptConfirmEventMs:e.diagnostics.promptConfirmEventMs,confirmationPromptDecisionWaitMs:e.diagnostics.promptDecisionWaitMs,confirmationCredentialCreateStartMs:e.diagnostics.credentialCreateStartMs,confirmationCredentialCreateMs:e.diagnostics.credentialCreateMs,confirmationCredentialSerializeMs:e.diagnostics.credentialSerializeMs,confirmationDuplicateRetryCount:e.diagnostics.duplicateRetryCount,confirmationMainThreadTotalMs:e.diagnostics.mainThreadTotalMs}}}async function Yd(e){let t=performance.now();return Jd({credential:await e,diagnostics:qd(),requestConfirmationMs:Kd(t)})}async function Xd(e){let t=performance.now(),n=await e.context.signingEngine.requestRegistrationCredentialConfirmation({walletId:e.walletId,signerSlot:e.signerSlot,confirmerText:e.options.confirmerText,confirmationConfigOverride:e.confirmationConfigOverride,challengeB64u:e.registrationIntentDigestB64u}),r=Kd(t),i=n.registrationDiagnostics??qd();return Jd({credential:n.credential,diagnostics:i,requestConfirmationMs:r})}function Zd(e){let t=e.trim();if(!t)throw Error(`Registration finalize idempotency key is required`);return t}function Qd(e){let t=l(e.materialActivation);if(!t.ok)throw Error(`Email OTP Ed25519 material activation is invalid`);let n=String(e.nearAccountId||``).trim(),r=String(e.operationalPublicKey||``).trim(),i=String(e.thresholdSessionId||``).trim(),a=Number(e.signerSlot);if(!n||!r||!i)throw Error(`Email OTP Ed25519 signer identity is incomplete`);if(!Number.isSafeInteger(a)||a<1)throw Error(`Email OTP Ed25519 signer slot is invalid`);let o=ce(e.runtimePolicyScope);if(!o)throw Error(`Email OTP Ed25519 runtime policy scope is invalid`);return{materialActivation:t.value,nearAccountId:n,signerSlot:a,operationalPublicKey:r,thresholdSessionId:i,runtimePolicyScope:o}}function $d(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`Email OTP Ed25519 signer selection must be an object`);let t=e;if(t.kind===`absent`)return{kind:`absent`};if(t.kind!==`present`)throw Error(`Email OTP Ed25519 signer selection kind is invalid`);return{kind:`present`,...Qd(t)}}function ef(e){let t=rf(e,`wallet/email-otp/challenge signerSelection`);if(t.kind===`ed25519_only`)return{kind:`ed25519_only`,...Qd(t)};if(t.kind!==`ecdsa`)throw Error(`wallet/email-otp/challenge signerSelection kind is invalid`);return{kind:`ecdsa`,keyHandle:Z(t.keyHandle,`wallet/email-otp/challenge keyHandle`),runtimePolicyScope:j(t.runtimePolicyScope),ed25519:$d(t.ed25519)}}var tf=class extends Error{code;status;retryAfterMs;resetAtMs;constructor(e){super(e.message),this.name=`EmailOtpRouteError`;let t=af(e.code);t&&(this.code=t),this.status=e.status;let n=Number(e.retryAfterMs);Number.isFinite(n)&&n>=0&&(this.retryAfterMs=Math.floor(n));let r=Number(e.resetAtMs);Number.isFinite(r)&&r>=0&&(this.resetAtMs=Math.floor(r))}};function nf(e){let t=e||globalThis.fetch;if(typeof t!=`function`)throw Error(`fetch is unavailable in this runtime`);return t}function rf(e,t){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`${t} returned invalid JSON`);return e}function Z(e,t){return T(e,t)}function af(e){return v(e)}function of(e){let t={"Content-Type":`application/json`},n=String(e.publishableKey||``).trim();return n&&(t.Authorization=`Bearer ${n}`),t}function sf(e){return e.routeFamily===`registration`?Ql({routeFamily:`registration`,operation:He}):Ql({routeFamily:`login`,operation:e.operation??`wallet_unlock`})}function cf(e){let t=af(e.challenge.action);if(t&&t!==e.expectedAction)throw Error(`${e.context} returned ${t}; expected ${e.expectedAction}`)}async function lf(e){let t=await nf(e.fetchImpl)(e.url,{method:`POST`,headers:of({publishableKey:e.publishableKey}),credentials:`include`,body:JSON.stringify(e.body)}),n=await t.text(),r=null;try{r=n?JSON.parse(n):null}catch{throw Error(`${e.url} returned non-JSON response (HTTP ${t.status})`)}let i=rf(r,e.url);if(!t.ok||i.ok===!1)throw new tf({message:typeof i.message==`string`&&i.message.trim()||`${e.url} failed (HTTP ${t.status})`,status:t.status,code:i.code,retryAfterMs:i.retryAfterMs,resetAtMs:i.resetAtMs});return i}async function uf(e){if(e.restartRegistrationOffer===!0&&e.accountMode!==`register`)throw Error(`restartRegistrationOffer is only valid with register account mode`);let t=await lf({url:i(e.relayUrl,`/auth/google/verify`),fetchImpl:e.fetchImpl,publishableKey:Z(e.publishableKey,`publishableKey`),body:{id_token:Z(e.idToken,`idToken`),account_mode:e.accountMode,project_environment_id:Z(e.projectEnvironmentId,`projectEnvironmentId`),...e.loginWalletId?{wallet_id:Z(e.loginWalletId,`loginWalletId`)}:{},...e.restartRegistrationOffer===!0?{restart_registration_offer:!0}:{}}}),n=Z(t.mode,`auth/google/verify mode`),r=Z(t.walletId,`auth/google/verify walletId`),a=Z(t.providerSubject,`auth/google/verify providerSubject`),o=af(t.email);if(n===`existing_wallet`){if(t.hasEmailOtpEnrollment!==!0)throw Error(`auth/google/verify existing wallet is missing Email OTP enrollment`);if(!o)throw Error(`auth/google/verify existing wallet is missing email`);return{mode:n,walletId:r,providerSubject:a,email:o,hasEmailOtpEnrollment:!0}}if(n!==`register_started`)throw Error(`auth/google/verify returned unsupported mode: ${n}`);if(!o)throw Error(`auth/google/verify registration is missing email`);let s=rf(t.offer,`auth/google/verify offer`),c=(Array.isArray(s.candidates)?s.candidates:[]).map(df),l=c[0];if(!l)throw Error(`auth/google/verify offer has no wallet candidates`);return{mode:n,walletId:r,providerSubject:a,email:o,registrationAttemptId:Z(t.registrationAttemptId,`auth/google/verify registrationAttemptId`),expiresAtMs:ff(t.expiresAtMs,`auth/google/verify expiresAtMs`),offer:{offerId:Z(s.offerId,`auth/google/verify offer.offerId`),selectedCandidateId:Z(s.selectedCandidateId,`auth/google/verify offer.selectedCandidateId`),candidates:[l,...c.slice(1)]}}}function df(e){let t=rf(e,`auth/google/verify offer candidate`);return{candidateId:Z(t.candidateId,`offer candidate candidateId`),walletId:Z(t.walletId,`offer candidate walletId`)}}function ff(e,t){let n=Number(e);if(!Number.isSafeInteger(n)||n<=Date.now())throw Error(`${t} must be a future timestamp`);return n}async function pf(e){let t=e.operation??`wallet_unlock`;if(!e.fetchImpl&&e.workerCtx)return await e.workerCtx.requestWorkerOperation({kind:`emailOtp`,request:{type:`requestEmailOtpChallenge`,payload:{relayUrl:Z(e.relayUrl,`relayUrl`),walletId:Z(e.walletId,`walletId`),...e.walletAuthMethodId?{walletAuthMethodId:Z(e.walletAuthMethodId,`walletAuthMethodId`)}:{},routePlan:sf({routeFamily:`login`,operation:t}),otpChannel:Ke,...e.operationFingerprintDigest?{operationFingerprintDigest:e.operationFingerprintDigest}:{}}}});let n=await lf({url:i(e.relayUrl,`/wallet/email-otp/challenge`),fetchImpl:e.fetchImpl,body:{walletId:Z(e.walletId,`walletId`),...e.walletAuthMethodId?{walletAuthMethodId:Z(e.walletAuthMethodId,`walletAuthMethodId`)}:{},otpChannel:e.otpChannel||`email_otp`,operation:t,...e.operationFingerprintDigest?{operationFingerprintDigest:e.operationFingerprintDigest}:{}}}),r=rf(n.challenge,`wallet/email-otp/challenge`);cf({challenge:r,expectedAction:Ve.login,context:`wallet/email-otp/challenge`});let a=yr(n.delivery,`wallet/email-otp/challenge delivery`),o=Number(r.expiresAtMs),s={challengeId:Z(r.challengeId,`wallet/email-otp/challenge challengeId`),otpChannel:Ke,delivery:a,emailHint:a.emailHint,ownerProofBindingDigest:Z(r.ownerProofBindingDigest,`wallet/email-otp/challenge ownerProofBindingDigest`),walletAuthMethodId:Z(n.walletAuthMethodId,`wallet/email-otp/challenge walletAuthMethodId`),signerSelection:ef(n.signerSelection)};return Number.isFinite(o)&&(s.expiresAtMs=o),s}async function mf(e){if(!e.fetchImpl&&e.workerCtx)return await e.workerCtx.requestWorkerOperation({kind:`emailOtp`,request:{type:`requestEmailOtpEnrollmentChallenge`,payload:{relayUrl:Z(e.relayUrl,`relayUrl`),walletId:Z(e.walletId,`walletId`),routePlan:sf({routeFamily:`registration`}),otpChannel:Ke}}});let t=await lf({url:i(e.relayUrl,`/wallet/email-otp/registration/challenge`),fetchImpl:e.fetchImpl,body:{walletId:Z(e.walletId,`walletId`),otpChannel:e.otpChannel||`email_otp`}}),n=rf(t.challenge,`wallet/email-otp/registration/challenge`);cf({challenge:n,expectedAction:Ve.registration,context:`wallet/email-otp/registration/challenge`});let r=yr(t.delivery,`wallet/email-otp/registration/challenge delivery`),a=Number(n.expiresAtMs),o={challengeId:Z(n.challengeId,`wallet/email-otp/registration/challenge challengeId`),otpChannel:Ke,delivery:r,emailHint:r.emailHint};return Number.isFinite(a)&&(o.expiresAtMs=a),o}function hf(e,t){let n=typeof e==`string`?e.trim():``;if(!n)throw Error(`${t} is required for Email OTP registration authority`);return n}async function gf(e){let t=hf(e.authMethod.email,`email`).toLowerCase(),n=hf(e.authMethod.providerSubject,`providerSubject`),r=hf(e.relayUrl,`relayUrl`),i=hf(e.walletId,`walletId`),a=hf(e.registrationIntentDigestB64u,`registrationIntentDigestB64u`);if(e.authMethod.proofKind===`google_sso_registration`){let r=hf(e.authMethod.googleEmailOtpRegistrationAttemptId,`googleEmailOtpRegistrationAttemptId`);return{kind:`email_otp`,proof:{version:`email_otp_registration_proof_v1`,proofKind:`google_sso_registration`,providerSubject:n,email:t,googleEmailOtpRegistrationAttemptId:r,googleEmailOtpRegistrationOfferId:hf(e.authMethod.googleEmailOtpRegistrationOfferId,`googleEmailOtpRegistrationOfferId`),googleEmailOtpRegistrationCandidateId:hf(e.authMethod.googleEmailOtpRegistrationCandidateId,`googleEmailOtpRegistrationCandidateId`),registrationIntentDigestB64u:a},registrationAuthorityId:r,providerSubject:n,email:t}}let o=hf(e.authMethod.otpCode,`otpCode`),s=typeof e.authMethod.challengeId==`string`?e.authMethod.challengeId.trim():``,c=s?null:await mf({relayUrl:r,walletId:i,fetchImpl:e.fetchImpl}),l=s||hf(c?.challengeId,`challengeId`);return{kind:`email_otp`,proof:{version:`email_otp_registration_proof_v1`,proofKind:`otp_challenge`,providerSubject:n,email:t,challengeId:l,otpCode:o,otpChannel:Ke,registrationIntentDigestB64u:a},registrationAuthorityId:l,providerSubject:n,email:t}}function _f(e,t,n){if(e!==t)throw Error(`${n} does not match the verified add-signer intent`)}function vf(e,t){if(e.length!==2||e[0]!==t[0]||e[1]!==t[1])throw Error(`Yao participant IDs do not match the verified add-signer intent`)}function yf(e){let t=w(e.verifiedIntent.addSignerIntentGrant,`add-signer intent grant`);return{routerOrigin:w(e.httpTransport.routerOrigin,`Yao Router origin`),routing:{kind:`discovery`},authorization:{kind:`bearer`,value:`Bearer ${t}`},fetch:e.httpTransport.fetch}}async function bf(e){let t=e.verifiedIntent.intent,n=t.signerSelection.ed25519;_f(String(t.walletId),String(e.verifiedAuthority.walletId),`Passkey authority wallet ID`),_f(e.verifiedIntent.addSignerIntentDigestB64u,e.verifiedAuthority.addSignerIntentDigestB64u,`Passkey authority intent digest`),w(e.verifiedAuthority.credentialIdB64u,`passkey credential ID`);let r=j(t.runtimePolicyScope),i=ae(r),a=ht(e.admissionRequest);if(!a.ok)throw Error(a.message);let o=a.value,s=w(e.verifiedIntent.addSignerCeremonyId,`add-signer ceremony ID`);if(_f(o.scope.lifecycle_id,s,`Yao lifecycle ID`),_f(o.scope.threshold_session_id,s,`Yao Threshold Session ID`),_f(o.scope.account_id,String(t.walletId),`Yao account ID`),_f(o.scope.signer_set_id,String(Oe(n.signerSlot)),`Yao signer-set ID`),_f(o.scope.root_share_epoch,r.signingRootVersion,`Yao root-share epoch`),_f(o.application_binding.wallet_id,String(t.walletId),`Yao application wallet ID`),_f(o.application_binding.signing_root_id,i,`Yao signing-root ID`),o.application_binding.key_creation_signer_slot!==n.signerSlot)throw Error(`Yao signer slot does not match the verified add-signer intent`);vf(n.participantIds,o.participant_ids);let c=await Qt({kind:`wallet_add_signer_implicit_near_ed25519_key_v1`,walletId:t.walletId,signingRootId:i,signingRootVersion:r.signingRootVersion,signerSlot:n.signerSlot,participantIds:n.participantIds,keyPurpose:n.keyPurpose,keyVersion:n.keyVersion,derivationVersion:n.derivationVersion});return _f(o.application_binding.near_ed25519_signing_key_id,String(c),`Yao NEAR signing-key ID`),{kind:`prepared_passkey_ed25519_yao_add_signer_v1`,request:o,transportConfig:yf(e)}}async function xf(e){let t=await bf(e),n=await new ia(t.transportConfig).send({kind:`admit`,path:st,body:t.request});if(!n.ok)throw Error(n.message);let r=vt(n.value);if(!r.ok)throw Error(r.message);return{request:t.request,receipt:r.value}}var Sf=class e{kind=`restorable_mpc_material_ref`;durableMaterialRef;protocolProof=!0;constructor(e){this.durableMaterialRef=e,this.protocolProof}static build(t){let n=String(t||``).trim();if(!n)throw Error(`Restorable MPC material reference is required`);return new e(n)}};function Cf(e){return Sf.build(e)}const wf=`router_ab_ed25519_yao_active_client_v1`,Tf=`chacha20poly1305-hkdf-sha256-prf-first-v1`,Ef=(1n<<64n)-1n;function Q(e,t){let n=String(e??``).trim();if(!n)throw Error(`${t} is required for local Ed25519 material`);return n}function Df(e,t){let n=Number(e);if(!Number.isSafeInteger(n)||n<1)throw Error(`${t} must be a positive safe integer`);return n}function Of(e,t){let n=s(e);if(!n.ok)throw Error(`${t}: ${n.error.message}`);return n.value}function kf(e,t){let n=Q(e,t);if(R(n).length!==32)throw Error(`${t} must encode 32 bytes`);return n}function Af(e){if(!Array.isArray(e)||e.length!==2)throw Error(`participantIds must contain exactly two entries`);let t=[Df(e[0],`participantIds[0]`),Df(e[1],`participantIds[1]`)];if(t[0]>65535||t[1]>65535||t[0]===t[1])throw Error(`participantIds must contain two distinct u16 identifiers`);return t}function jf(e,t){let n=Q(e,t);if(!/^(0|[1-9][0-9]*)$/.test(n)||BigInt(n)>Ef)throw Error(`${t} must be a canonical u64`);return n}function Mf(e,t,n){let r=e.signingLane.identity.signer;return{walletId:Q(r.account.wallet.walletId,`walletId`),nearAccountId:Q(r.account.nearAccountId,`nearAccountId`),nearEd25519SigningKeyId:Q(r.nearEd25519SigningKeyId,`nearEd25519SigningKeyId`),thresholdSessionId:Of(e.signingLane.identity.thresholdSessionId,`thresholdSessionId`),signerSlot:Df(r.signerSlot,`signerSlot`),rpId:Q(t,`rpId`),credentialIdB64u:Q(n,`credentialIdB64u`),signingRootId:Q(e.signingRootId,`signingRootId`),signingRootVersion:Q(e.signingRootVersion,`signingRootVersion`),signingWorkerId:Q(e.routerAbNormalSigning.signingWorkerId,`signingWorkerId`)}}function Nf(e){let t=e.metadata;if(t.scope.account_id!==e.identity.walletId||t.applicationBinding.wallet_id!==e.identity.walletId||t.applicationBinding.near_ed25519_signing_key_id!==e.identity.nearEd25519SigningKeyId||t.scope.threshold_session_id!==e.identity.thresholdSessionId||t.applicationBinding.key_creation_signer_slot!==e.identity.signerSlot||t.applicationBinding.signing_root_id!==e.identity.signingRootId||t.scope.root_share_epoch!==e.identity.signingRootVersion||t.scope.signing_worker_id!==e.identity.signingWorkerId)throw Error(`Active Ed25519 Client metadata does not match the wallet signing lane`);return{kind:wf,walletId:e.identity.walletId,nearAccountId:e.identity.nearAccountId,nearEd25519SigningKeyId:e.identity.nearEd25519SigningKeyId,signerSlot:e.identity.signerSlot,rpId:e.identity.rpId,credentialIdB64u:e.identity.credentialIdB64u,lifecycleId:Q(t.scope.lifecycle_id,`lifecycleId`),thresholdSessionId:Of(t.scope.threshold_session_id,`thresholdSessionId`),materialActivation:Zn(t),signingRootId:e.identity.signingRootId,signingRootVersion:e.identity.signingRootVersion,signerSetId:Q(t.scope.signer_set_id,`signerSetId`),signingWorkerId:e.identity.signingWorkerId,participantIds:[t.participantIds[0],t.participantIds[1]],registeredPublicKeyB64u:L(t.registeredPublicKey),signingWorkerVerifyingShareB64u:L(t.signingWorkerVerifyingShare),stateEpoch:t.stateEpoch.toString(10),activationTranscriptB64u:L(t.transcript),activationCapabilityBindingB64u:L(Uint8Array.from(t.activeCapabilityBinding))}}function Pf(e){return new TextEncoder().encode(JSON.stringify([e.kind,e.walletId,e.nearAccountId,e.nearEd25519SigningKeyId,e.signerSlot,e.rpId,e.credentialIdB64u,e.lifecycleId,e.thresholdSessionId,e.materialActivation.kind,e.materialActivation.activationId,e.materialActivation.capability,e.materialActivation.materialOwner,e.materialActivation.keyBinding,e.materialActivation.lifecycleBinding,e.materialActivation.signingWorker,e.signingRootId,e.signingRootVersion,e.signerSetId,e.signingWorkerId,e.participantIds[0],e.participantIds[1],e.registeredPublicKeyB64u,e.signingWorkerVerifyingShareB64u,e.stateEpoch,e.activationTranscriptB64u,e.activationCapabilityBindingB64u]))}function Ff(e,t){if(e.walletId!==t.walletId||e.nearAccountId!==t.nearAccountId||e.nearEd25519SigningKeyId!==t.nearEd25519SigningKeyId||e.signerSlot!==t.signerSlot||e.rpId!==t.rpId||e.credentialIdB64u!==t.credentialIdB64u||e.signingRootId!==t.signingRootId||e.signingRootVersion!==t.signingRootVersion||e.signingWorkerId!==t.signingWorkerId)throw Error(`Stored Ed25519 Client material does not match the wallet signing lane`)}function If(e){let t=C(e);if(!t||t.kind!==wf)throw Error(`Stored Ed25519 Client material binding is invalid`);let n=l(t.materialActivation);if(!n.ok)throw Error(n.error.message);let r={kind:wf,walletId:Q(t.walletId,`binding.walletId`),nearAccountId:Q(t.nearAccountId,`binding.nearAccountId`),nearEd25519SigningKeyId:Q(t.nearEd25519SigningKeyId,`binding.nearEd25519SigningKeyId`),signerSlot:Df(t.signerSlot,`binding.signerSlot`),rpId:Q(t.rpId,`binding.rpId`),credentialIdB64u:Q(t.credentialIdB64u,`binding.credentialIdB64u`),lifecycleId:Q(t.lifecycleId,`binding.lifecycleId`),thresholdSessionId:Of(t.thresholdSessionId,`binding.thresholdSessionId`),materialActivation:n.value,signingRootId:Q(t.signingRootId,`binding.signingRootId`),signingRootVersion:Q(t.signingRootVersion,`binding.signingRootVersion`),signerSetId:Q(t.signerSetId,`binding.signerSetId`),signingWorkerId:Q(t.signingWorkerId,`binding.signingWorkerId`),participantIds:Af(t.participantIds),registeredPublicKeyB64u:kf(t.registeredPublicKeyB64u,`binding.registeredPublicKeyB64u`),signingWorkerVerifyingShareB64u:kf(t.signingWorkerVerifyingShareB64u,`binding.signingWorkerVerifyingShareB64u`),stateEpoch:jf(t.stateEpoch,`binding.stateEpoch`),activationTranscriptB64u:kf(t.activationTranscriptB64u,`binding.activationTranscriptB64u`),activationCapabilityBindingB64u:kf(t.activationCapabilityBindingB64u,`binding.activationCapabilityBindingB64u`)};if(r.materialActivation.materialOwner!==r.walletId||r.materialActivation.signingWorker!==r.signingWorkerId)throw Error(`Stored Ed25519 Client material activation does not match its binding`);return r}function Lf(e,t){let n=If(e);return Ff(n,t),n}function Rf(e){let t=C(e);if(!t)throw Error(`Stored Ed25519 Client stable server scope is invalid`);let n=ce(t.runtimePolicyScope);if(!n)throw Error(`Stored Ed25519 Client server runtime policy scope is invalid`);return{relayerKeyId:Q(t.relayerKeyId,`stableServerScope.relayerKeyId`),participantIds:Af(t.participantIds),runtimePolicyScope:n,routerAbNormalSigning:de(t.routerAbNormalSigning)}}async function zf(e){let t=e.stored.payload,n=C(t);if(!n)throw Error(`Stored Ed25519 Client local material locator is invalid`);let r=If(n.binding),i=`ed25519:${Ee(R(r.registeredPublicKeyB64u))}`,a=e.stored.payloadEnvelope;if(e.stored.profileId!==e.target.profileId||e.stored.chainIdKey!==e.target.chainIdKey||e.stored.accountAddress!==e.target.accountAddress||e.stored.keyKind!==wf||e.stored.schemaVersion!==3||e.stored.publicKey!==i||e.stored.signerId!==r.nearEd25519SigningKeyId||a?.encVersion!==1||a.alg!==Tf)throw Error(`Stored Ed25519 Client local material record is invalid`);let o=Dt({walletId:r.walletId,factor:{kind:`passkey`,credentialIdB64u:r.credentialIdB64u},verifier:{kind:`webauthn`,rpId:r.rpId},bindingId:e.authority.walletAuthMethodId});if(!o)throw Error(`Stored Ed25519 Client local material authority is invalid`);let s=await Ct({authority:o});if(s.authorityDigest!==e.authority.authorityDigest)throw Error(`Stored Ed25519 Client local material authority changed`);return{kind:`passkey_ed25519_yao_local_material_locator_v1`,authority:s,materialActivation:r.materialActivation,sealedMaterial:Cf(JSON.stringify([e.stored.profileId,e.stored.signerSlot,e.stored.chainIdKey,e.stored.keyKind,r.materialActivation.activationId])),stableServerScope:Rf(n.stableServerScope)}}function Bf(e){let t=C(e.stored.payload?.binding);if(e.stored.profileId!==e.target.profileId||e.stored.chainIdKey!==e.target.chainIdKey||e.stored.accountAddress!==e.target.accountAddress||e.stored.signerSlot!==e.input.signerSlot||e.stored.signerId!==e.input.nearEd25519SigningKeyId||e.stored.keyKind!==wf||t?.kind!==wf||t.walletId!==e.input.walletId||t.nearAccountId!==e.input.nearAccountId||t.nearEd25519SigningKeyId!==e.input.nearEd25519SigningKeyId||t.signerSlot!==e.input.signerSlot||t.rpId!==e.input.rpId||t.credentialIdB64u!==e.input.credentialIdB64u)throw Error(`Stored Ed25519 Client material locator does not match local custody`)}function Vf(e,t){let n=Q(t,`thresholdSessionId`);return{kind:Pi,scope:{lifecycle_id:e.lifecycleId,root_share_epoch:e.signingRootVersion,account_id:e.walletId,threshold_session_id:n,signer_set_id:e.signerSetId,signing_worker_id:e.signingWorkerId,material_activation:qt(e.materialActivation)},applicationBinding:{wallet_id:e.walletId,near_ed25519_signing_key_id:e.nearEd25519SigningKeyId,signing_root_id:e.signingRootId,key_creation_signer_slot:e.signerSlot},participantIds:e.participantIds,registeredPublicKey:R(e.registeredPublicKeyB64u),signingWorkerVerifyingShare:R(e.signingWorkerVerifyingShareB64u),stateEpoch:BigInt(e.stateEpoch),transcript:R(e.activationTranscriptB64u),activeCapabilityBinding:Array.from(R(e.activationCapabilityBindingB64u)),materialActivation:e.materialActivation}}function Hf(){let e=new Uint8Array(12);return globalThis.crypto.getRandomValues(e),e}function Uf(e){let t=e.identity,n=e.activeClient.metadata(),r=Nf({identity:t,metadata:n}),i=Hf(),a=e.activeClient.sealLocalMaterial({ownedPasskeyPrfFirst:e.ownedPasskeyPrfFirst,binding:Pf(r),nonce:i}),o={binding:r,stableServerScope:e.stableServerScope};switch(e.lifecycle.kind){case`registration_or_rehydration`:break;case`recovery_promotion`:o.lifecycleReceipt=e.lifecycle.promotionReceipt;break;default:e.lifecycle}return{profileId:e.target.profileId,signerSlot:t.signerSlot,chainIdKey:e.target.chainIdKey,accountAddress:e.target.accountAddress,keyKind:wf,algorithm:`ed25519`,publicKey:`ed25519:${Ee(n.registeredPublicKey)}`,signerId:t.nearEd25519SigningKeyId,payload:o,payloadEnvelope:{encVersion:1,alg:Tf,nonce:L(a.nonce),ciphertext:L(a.ciphertext),aad:ot({profileId:e.target.profileId,signerSlot:t.signerSlot,chainIdKey:e.target.chainIdKey,accountAddress:e.target.accountAddress,keyKind:wf,schemaVersion:3,signerId:t.nearEd25519SigningKeyId})},timestamp:Date.now(),schemaVersion:3}}async function Wf(e){let t=await Ln(e.store,{accountRefs:jn(e.identity.nearAccountId)});if(!t)throw Error(`Local Ed25519 material requires a persisted wallet profile`);let n=Uf({target:t,activeClient:e.activeClient,identity:e.identity,stableServerScope:e.stableServerScope,ownedPasskeyPrfFirst:R(e.passkeyPrfFirstB64u),lifecycle:{kind:`registration_or_rehydration`}});await e.store.storeKeyMaterial(n)}async function Gf(e){let t=Q(e.nearAccountId,`nearAccountId`),n=await Ln(e.store,{accountRefs:jn(t)});if(!n)return{kind:`unavailable`};let r=await e.store.getKeyMaterial(n.profileId,Df(e.signerSlot,`signerSlot`),n.chainIdKey,wf);return r?(Bf({stored:r,target:n,input:e}),{kind:`available`,locator:await zf({stored:r,target:n,authority:e.authority})}):{kind:`unavailable`}}function Kf(e){return e.publicLocator.walletId===e.identity.walletId&&e.publicLocator.nearAccountId===e.identity.nearAccountId&&e.publicLocator.signerSlot===e.identity.signerSlot}async function qf(e){let t=Dt({walletId:e.identity.walletId,factor:{kind:`passkey`,credentialIdB64u:e.identity.credentialIdB64u},verifier:{kind:`webauthn`,rpId:e.identity.rpId},bindingId:e.authority.walletAuthMethodId});if(!t)throw Error(`Passkey Ed25519 authority is invalid`);let n=await Ct({authority:t});if(n.authorityDigest!==e.authority.authorityDigest)throw Error(`Passkey Ed25519 authority does not match the Wallet Session`);return n}function Jf(e){if(!e||e.activeClient.status().kind!==`active`)return{kind:`absent`};let t=Zn(e.activeClient.metadata());return{kind:`live`,runtime:Jn(t),materialActivation:t}}function Yf(e){return{kind:`blocked`,plan:e}}async function Xf(e){let t=await qf(e),n=e.publicLocator.kind===`available`&&!Kf({publicLocator:e.publicLocator,identity:e.identity})?{kind:`conflict`}:e.publicLocator.kind===`available`?{...e.publicLocator,authority:t}:e.publicLocator,r;try{r=await Gf({store:e.store,walletId:String(e.identity.walletId),nearAccountId:String(e.identity.nearAccountId),nearEd25519SigningKeyId:String(e.identity.nearEd25519SigningKeyId),signerSlot:e.identity.signerSlot,rpId:e.identity.rpId,credentialIdB64u:e.identity.credentialIdB64u,authority:t})}catch{return{expectedAuthority:t,publicLocator:n,sealed:{kind:`corrupt`}}}return{expectedAuthority:t,publicLocator:n,sealed:r.kind===`available`?{kind:`available`,authority:r.locator.authority,materialActivation:r.locator.materialActivation,sealedMaterial:r.locator.sealedMaterial}:{kind:`missing`}}}function Zf(e,t){let n=Yn({publicLocator:e,sealed:{kind:`corrupt`},runtime:t,unlockSource:{kind:`unavailable`}});if(n.kind!==`blocked`)throw Error(`Corrupt Near Ed25519 material resolved to an executable hydration plan`);return n}async function Qf(e){let{expectedAuthority:t,publicLocator:n,sealed:r}=await Xf(e);if(r.kind===`corrupt`)return{kind:`blocked`,plan:Zf(n,{kind:`absent`})};let i=Yn({publicLocator:n,sealed:r,runtime:{kind:`absent`},unlockSource:{kind:`available`,authority:t}});switch(i.kind){case`rehydrate_material_activation`:return{kind:`prepared`,plan:i};case`blocked`:return{kind:`blocked`,plan:i};case`use_live_runtime`:case`reauthorize_public_anchor`:throw Error(`Sealed Near Ed25519 preparation resolved an invalid hydration plan`);default:throw Error(`Unsupported sealed Near Ed25519 preparation plan`)}}async function $f(e){let{expectedAuthority:t,publicLocator:n,sealed:r}=await Xf(e);if(r.kind===`corrupt`)return Yf(Zf(n,Jf(e.liveMaterial)));let i=e.unlockSource.kind===`available`?{kind:`available`,authority:t}:{kind:`unavailable`},a=Yn({publicLocator:n,sealed:r,runtime:Jf(e.liveMaterial),unlockSource:i});switch(a.kind){case`use_live_runtime`:{let t=e.liveMaterial;if(!t||t.activeClient.status().kind!==`active`||!p(a.materialActivation,Zn(t.activeClient.metadata())))throw Error(`Near Ed25519 live hydration plan lost its exact runtime`);return{kind:`live`,plan:a}}case`rehydrate_material_activation`:{if(e.unlockSource.kind!==`available`)throw Error(`Near Ed25519 rehydration plan lost its unlock source`);let t=await ep({store:e.store,identity:e.identity,passkeyPrfFirstB64u:e.unlockSource.passkeyPrfFirstB64u});if(t.kind!==`rehydrated`)throw Error(`Near Ed25519 rehydration plan lost its sealed material`);let n=Zn(t.activeClient.metadata());if(!p(a.materialActivation,n))throw t.activeClient.dispose(),Error(`Near Ed25519 rehydration changed the material activation`);return{kind:`rehydrated`,plan:a,activeClient:t.activeClient}}case`blocked`:return Yf(a);case`reauthorize_public_anchor`:throw Error(`Near Ed25519 material retirement requires explicit reauthorization`);default:throw Error(`Unsupported Near Ed25519 hydration plan`)}}async function ep(e){let t=e.identity,n=await Ln(e.store,{accountRefs:jn(t.nearAccountId)});if(!n)return{kind:`unavailable`};let r=await e.store.getKeyMaterial(n.profileId,t.signerSlot,n.chainIdKey,wf);return r?tp({stored:r,target:n,identity:t,ownedPasskeyPrfFirst:R(e.passkeyPrfFirstB64u)}):{kind:`unavailable`}}async function tp(e){let t=e.identity,n=e.stored,r=e.target,i=n.payloadEnvelope;if(n.profileId!==r.profileId||n.accountAddress!==r.accountAddress||n.signerId!==t.nearEd25519SigningKeyId||n.keyKind!==wf||n.schemaVersion!==3||i?.encVersion!==1||i.alg!==Tf)throw Error(`Stored Ed25519 Client material record is invalid`);let a=Lf(n.payload?.binding,t),o=Vf(a,t.thresholdSessionId),s=`ed25519:${Ee(o.registeredPublicKey)}`;if(n.publicKey!==s)throw Error(`Stored Ed25519 Client public key does not match its sealed binding`);return{kind:`rehydrated`,activeClient:(await da.initializeBundled()).importLocalMaterial({ownedPasskeyPrfFirst:e.ownedPasskeyPrfFirst,binding:Pf(a),sealed:{kind:`router_ab_ed25519_yao_sealed_local_material_v1`,nonce:R(i.nonce),ciphertext:R(i.ciphertext)},metadata:o})}}function np(e,t){return e.requestWorkerOperation(t)}function rp(e,t,n){return e.requestOperation({kind:`walletCustodyCeremony`,request:{type:t,payload:n}})}function ip(e){return rp.bind(void 0,e)}let ap=null,op=null,sp=null,cp=null;function lp(e){cp=e}function up(e){let t=cp;if(!t||e.kind!==`unlocked_wallet_ed25519_export_root_capability_v1`)return;let n=e.upgradedEnvelope;if(n!==void 0)try{t({walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,walletSessionId:e.walletSessionId,envelope:n})}catch(e){console.warn(`[walletCustody] the upgraded custody envelope was not forwarded:`,e instanceof Error?e.message:String(e||`unknown error`))}}function dp(e){return{requestOperation:np.bind(void 0,e)}}function fp(){sp!==null&&(clearTimeout(sp),sp=null)}function pp(){fp(),ap=null,op=null}function mp(e,t){fp();let n=Math.max(0,e.expiresAtMs-Date.now());sp=setTimeout(()=>{if(sp=null,!(ap!==e||op!==t)){if(e.expiresAtMs>Date.now()){mp(e,t);return}xp(t,{kind:`capability`,capabilityHandleId:e.capabilityHandleId})}},Math.min(n,2147483647))}function hp(e){if(!_(e))return null;if(e.kind===`unlocked_linked_device_ed25519_client_root_capability_v1`)return gp(e);let t=Object.keys(e),n=t.includes(`upgradedEnvelope`),r=n?[`kind`,`capabilityHandleId`,`walletId`,`walletAuthMethodId`,`walletSessionId`,`expiresAtMs`,`upgradedEnvelope`]:[`kind`,`capabilityHandleId`,`walletId`,`walletAuthMethodId`,`walletSessionId`,`expiresAtMs`];if(t.length!==r.length||t.some(e=>!r.includes(e))||e.kind!==`unlocked_wallet_ed25519_export_root_capability_v1`)return null;let i=u(e.capabilityHandleId),o=a(e.walletId),s=c(e.walletAuthMethodId),l=_e(e.walletSessionId);if(!i.ok||!o.ok||!s.ok||!l.ok)return null;let d;try{d=N(e.expiresAtMs,`unlocked Ed25519 export-root capability expiry`)}catch{return null}let f;if(n)try{f=qe(e.upgradedEnvelope)}catch{}return{kind:`unlocked_wallet_ed25519_export_root_capability_v1`,capabilityHandleId:i.value,walletId:o.value,walletAuthMethodId:s.value,walletSessionId:l.value,expiresAtMs:d,...f?{upgradedEnvelope:f}:{}}}function gp(e){let t=[`kind`,`capabilityHandleId`,`walletId`,`walletAuthMethodId`,`walletSessionId`,`expiresAtMs`],n=Object.keys(e);if(n.length!==t.length||n.some(e=>!t.includes(e)))return null;let r=u(e.capabilityHandleId),i=a(e.walletId),o=c(e.walletAuthMethodId),s=_e(e.walletSessionId);if(!r.ok||!i.ok||!o.ok||!s.ok)return null;let l;try{l=N(e.expiresAtMs,`unlocked Ed25519 Client-root capability expiry`)}catch{return null}return{kind:`unlocked_linked_device_ed25519_client_root_capability_v1`,capabilityHandleId:r.value,walletId:i.value,walletAuthMethodId:o.value,walletSessionId:s.value,expiresAtMs:l}}async function _p(e,t){let n=t.existingEnvelope.binding;if(!Ze(n)&&n.kind!==`ed25519_yao_client_root_v1`)return;let r=t.existingFactorSecret.slice(),i;try{i=await e.requestOperation({kind:`walletCustodyCeremony`,request:{type:`establishUnlockedWalletEd25519ExportRootCapability`,payload:{existingEnvelope:t.existingEnvelope,existingFactorSecret:r.buffer,walletId:t.walletId,walletAuthMethodId:t.walletAuthMethodId,walletSessionId:t.walletSessionId,expiresAtMs:t.expiresAtMs},transfer:[r.buffer]}})}finally{r.byteLength>0&&r.fill(0)}let a=hp(i);if(a===null)throw Error(`unlocked Ed25519 export-root capability worker returned no reference`);return fp(),ap=a,op=e,mp(a,e),up(a),a}function vp(e){let t=yp(e);return t?.kind===`unlocked_wallet_ed25519_export_root_capability_v1`?t:void 0}function yp(e){let t=ap;if(t&&t.walletId===e){if(t.expiresAtMs<=Date.now()){let e=op;e?xp(e,{kind:`capability`,capabilityHandleId:t.capabilityHandleId}):pp();return}return t}}function bp(){pp()}async function xp(e,t){let n=ap;n!==null&&(t.kind===`all`||t.kind===`capability`&&t.capabilityHandleId===n.capabilityHandleId||t.kind===`wallet`&&t.walletId===n.walletId||t.kind===`wallet_session`&&t.walletSessionId===n.walletSessionId)&&pp();try{await e.requestOperation({kind:`walletCustodyCeremony`,request:{type:`destroyUnlockedWalletEd25519ExportRootCapabilities`,payload:{scope:t}}})}catch{}}function Sp(e){let t=r(e);if(!t.ok)throw Error(t.error.message);return t.value}function Cp(e){let t=e.finalized.authMethod;if(!t||t.kind!==`passkey`)throw Error(`Passkey registration finalize returned non-passkey auth material`);let n=String(e.credential.rawId||e.credential.id||``).trim(),r=String(t.credentialIdB64u||``).trim();if(!n||r!==n)throw Error(`Passkey registration finalize returned credential id mismatch`);let i=String(t.credentialPublicKeyB64u||``).trim();if(!i)throw Error(`Passkey registration finalize returned missing credentialPublicKeyB64u`);return i}async function wp(e){let t=e.configs.signing.emailOtp.authPolicy;return sr({policy:t,retention:`session`,reason:`login`,authority:e.authority})}async function Tp(e){switch(e.authMethod.kind){case`passkey`:if(!e.passkeyAuthority)throw Error(`Passkey registration authority was not collected`);return{kind:`passkey`,rpId:e.authMethod.rpId,credential:e.passkeyAuthority.credential,credentialPublicKeyB64u:Cp({finalized:e.finalized,credential:e.passkeyAuthority.credential})};case`email_otp`:{let t=String(e.email||``).trim(),n=String(e.providerSubject||``).trim(),r=String(e.registrationAuthorityId||``).trim();if(!t||!n||!r)throw Error(`Email OTP registration persistence requires provider identity`);if(!Ot(e.finalized.authority))throw Error(`Email OTP registration finalize returned a different authority`);if(e.finalized.foundingAuthMethod.kind!==`email_otp`)throw Error(`Email OTP registration finalize returned a different founding method`);let i=Et({...e.finalized.authority,bindingId:e.finalized.foundingAuthMethod.walletAuthMethodId});if(!i)throw Error(`Email OTP registration finalize returned an invalid exact authority`);return{kind:`email_otp`,email:t,registrationAuthorityId:r,emailOtpAuthContext:await wp({configs:e.configs,authority:i}),authority:i}}default:return q(e.authMethod)}}function Ep(e){let[t,...n]=e.walletKeys,[r,...i]=e.expectedChainTargets;if(!t||!r)throw Error(`ECDSA registration persistence requires session, key, and target material`);if(e.walletKeys.length!==e.expectedChainTargets.length)throw Error(`ECDSA registration persistence requires one family session projected to every target`);if(e.session.chainTargets.length!==e.expectedChainTargets.length||!zc(e.session.chainTargets,e.expectedChainTargets))throw Error(`ECDSA registration family session target projection is incomplete`);return Ic(e.walletKeys),Lc({session:e.session,walletKeys:e.walletKeys}),Jc({session:e.session,walletKeys:e.walletKeys}),{kind:`evm_family_ecdsa`,session:e.session,walletKeys:[t,...n],expectedChainTargets:[r,...i]}}function Dp(e){let{walletId:t,authority:n,foundingAuthority:r,foundingAuthMethod:i,registrationDiagnostics:a,rpId:o,authMethod:s,custodyKeyManifestDigestB64u:c,ecdsa:l}=e,{activation:u,bootstrap:d,...f}=l,p={ok:!0,walletId:t,authority:n,foundingAuthority:r,foundingAuthMethod:i,...a?{registrationDiagnostics:a}:{},...c===void 0?{}:{custodyKeyManifestDigestB64u:c},kind:`evm_family_ecdsa`,ecdsa:f};if(s.kind===`passkey`){if(!o)throw Error(`Passkey activation is missing its relying-party id`);return{...p,rpId:o,authMethod:s}}if(o!==void 0)throw Error(`Email OTP activation returned a relying-party id`);return{...p,authMethod:s}}function Op(e){return{kind:`registration_persistence_plan_v1`,walletId:e.walletId,auth:e.auth,ecdsa:e.ecdsa,foundingAuthority:e.foundingAuthority,foundingAuthMethod:e.foundingAuthMethod}}function kp(e){let t=gn(e);if(!t)throw Error(`pending wallet registration commit is invalid`);return t}function Ap(e){let t=Ie(e.walletId),n=c(e.walletAuthMethodId);if(!n.ok)throw Error(n.error.message);let r=jp(e.auth),i={kind:`pending_wallet_registration_commit_v1`,registrationCeremonyId:Mp(e.registrationCeremonyId,`registrationCeremonyId`),idempotencyKey:Mp(e.idempotencyKey,`idempotencyKey`),walletId:t,walletAuthMethodId:n.value,signedSetup:Mp(e.signedSetup,`signedSetup`),auth:r,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs};if(e.operation===`registration_activate`)return kp({...i,operation:e.operation,signerPlanKind:e.signerPlanKind,localMaterial:e.localMaterial});if(e.signerPlanKind!==`near_ed25519`&&e.signerPlanKind!==`near_ed25519_and_evm_family_ecdsa`)throw Error(`near provisioning requires a NEAR signer plan`);return kp({...i,operation:e.operation,phase:`joined`,completion:e.completion,signerPlanKind:e.signerPlanKind,localMaterial:e.localMaterial})}function jp(e){if(e.kind===`passkey`){let t=Sp(e.rpId),n=d(e.credentialIdB64u);if(!n.ok)throw Error(n.error.message);return{kind:`passkey`,rpId:t,credentialIdB64u:n.value,transports:[...e.transports]}}let t=h(e.email);if(!t.ok)throw Error(t.error.message);let n=f(e.registrationAuthorityId);if(!n.ok)throw Error(n.error.message);let r=m(e.providerSubject);if(!r.ok)throw Error(r.error.message);return{kind:`email_otp`,email:t.value,registrationAuthorityId:n.value,providerSubject:r.value,enrollment:{enrollmentSealKeyVersion:Mp(e.enrollment.enrollmentSealKeyVersion,`enrollment.enrollmentSealKeyVersion`),serverSealedFactorCiphertextB64u:Mp(e.enrollment.serverSealedFactorCiphertextB64u,`enrollment.serverSealedFactorCiphertextB64u`),clientUnlockPublicKeyB64u:Mp(e.enrollment.clientUnlockPublicKeyB64u,`enrollment.clientUnlockPublicKeyB64u`),unlockKeyVersion:Mp(e.enrollment.unlockKeyVersion,`enrollment.unlockKeyVersion`)}}}function Mp(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} must be a non-empty canonical string`);return e}async function Np(e){e.registrationTiming.record(`ecdsaRegistrationTargetCount`,e.plan.ecdsa.walletKeys.length);let t=performance.now();try{return await e.context.signingEngine.finalizeWalletRegistrationEcdsaSessions({walletId:Ie(e.plan.walletId),session:e.plan.ecdsa.session,walletKeys:[...e.plan.ecdsa.walletKeys]})}finally{e.registrationTiming.record(`ecdsaRegistrationSessionFinalizeMs`,La(t))}}async function Pp(e){if(e.plan.auth.kind===`passkey`){await e.context.signingEngine.finalizeWalletEcdsaRegistration({walletId:e.plan.walletId,rpId:Sp(e.plan.auth.rpId),credential:e.plan.auth.credential,credentialPublicKeyB64u:e.plan.auth.credentialPublicKeyB64u,walletKeys:e.walletKeys});return}await e.context.signingEngine.storeWalletEmailOtpEcdsaRegistrationData({walletId:e.plan.walletId,email:e.plan.auth.email,registrationAuthorityId:e.plan.auth.registrationAuthorityId,authority:e.plan.auth.authority,walletKeys:e.walletKeys})}async function Fp(e){let t=await Np(e),n=performance.now();try{if(await Pp({context:e.context,plan:e.plan,walletKeys:t}),await V.persistFoundingWalletAuthority({authority:e.plan.foundingAuthority,authMethod:e.plan.foundingAuthMethod}),e.plan.auth.kind===`email_otp`){let t=h(e.plan.auth.email);if(!t.ok)throw Error(t.error.message);let n=await V.retainVerifiedEmailOtpLocalPresentation({walletId:e.plan.walletId,walletAuthMethodId:e.plan.foundingAuthMethod.walletAuthMethodId,emailAddress:t.value});if(n.kind!==`retained`)throw Error(`Verified Email OTP presentation was not retained: ${n.reason}`)}}finally{e.registrationTiming.record(`ecdsaRegistrationLocalRecordPersistenceMs`,La(n))}await br(On,e.plan.ecdsa.session.registrationEstablishedSession)}function Ip(e){return Fp.bind(void 0,e)}async function Lp(e){await e.registrationTiming.measure(`ecdsaRegistrationPersistenceMs`,Ip(e))}var Rp=e({REGISTRATION_TIMING_LABEL:()=>ba,addSigner:()=>tg,cancelHostedPasskeyRegistration:()=>Tm,prepareHostedPasskeyRegistration:()=>wm,registerPreparedHostedPasskeyRegistration:()=>Dm,registerWallet:()=>Hh,resumeNearRegistrationAfterUnlock:()=>bh,startHostedPasskeyRegistrationCredential:()=>Em});async function zp(e,t,n,r){if(r.length!==10||new Set(r).size!==10)throw Error(`Wallet custody must issue exactly ten distinct recovery codes`);switch((await Vp({backup:n,context:e,request:{kind:`wallet_recovery_code_backup_request_v1`,walletId:t,recoveryCodes:r,continuation:`registration_may_defer`}}))?.kind){case`wallet_recovery_codes_backed_up_v1`:return null;case`wallet_recovery_code_backup_deferred_v1`:return await pr.write({walletId:t,recoveryCodes:r});default:throw Error(`Wallet recovery-code backup result is invalid`)}}async function Bp(e,t,n,r,i){e.value=await zp(t,n,r,i)}async function Vp(e){if(!e.backup)return{kind:`wallet_recovery_code_backup_deferred_v1`};switch(e.backup.kind){case`defer_to_account_menu`:return{kind:`wallet_recovery_code_backup_deferred_v1`};case`show_builtin_dialog`:return await dr(e.request,e.context.signingEngine.getWalletIframeSurfaceMeasurementBinding());case`custom_handler`:return await e.backup.handler(e.request);default:return q(e.backup)}}function Hp(e){e.byteLength>0&&new Uint8Array(e).fill(0)}function Up(e){let t=e.established.metadata;return{binding:{kind:Mn,applicationBindingDigestB64u:e.established.localMaterial.applicationBindingDigestB64u,registeredPublicKeyB64u:L(t.registeredPublicKey),participantIds:t.participantIds,stateEpoch:String(t.stateEpoch),walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:e.signerSlot,signingWorkerId:t.scope.signing_worker_id,signingWorkerVerifyingShareB64u:L(t.signingWorkerVerifyingShare)},sealed:{ciphertextB64u:e.established.localMaterial.b64u,nonceB64u:e.established.localMaterial.nonceB64u}}}function Wp(e){let t=e.metadata;return{materialActivation:Zn(t),registeredPublicKeyB64u:L(t.registeredPublicKey),signingWorkerVerifyingShareB64u:L(t.signingWorkerVerifyingShare),stateEpoch:String(t.stateEpoch),signingWorkerId:t.scope.signing_worker_id,participantIds:t.participantIds,nearEd25519SigningKeyId:t.applicationBinding.near_ed25519_signing_key_id,signerSlot:t.applicationBinding.key_creation_signer_slot}}function Gp(e){let t=e.establishedCustody;if(!t)throw Error(`Mixed registration custody commit is missing its established envelope`);return{bindingJson:t.envelopeBindingJson,nonceB64u:t.envelopeNonceB64u,ciphertextB64u:t.sealedCustodySecretB64u,aadHashB64u:t.envelopeAadHashB64u,ciphertextDigestB64u:t.envelopeCiphertextDigestB64u}}function Kp(e){let t=e.commit.establishedCustody;if(!t)throw Error(`Passkey registration custody commit is missing its established envelope`);return Ad({expectedWalletId:e.walletId,replacement:t,activatedAtMs:e.activatedAtMs})}async function qp(e){await e.signingEngine.establishUnlockedWalletEd25519ExportRootCapabilityV1({existingEnvelope:Kp({commit:e.commit,walletId:e.walletId,activatedAtMs:Date.now()}),passkeyPrfFirstB64u:e.passkeyPrfFirstB64u,walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,walletSessionId:e.walletSessionId,expiresAtMs:e.expiresAtMs})}async function Jp(e){try{await _p(dp(e.context.signingEngine.getSignerWorkerContext()),{existingEnvelope:Kp({commit:e.commit,walletId:e.walletId,activatedAtMs:Date.now()}),existingFactorSecret:e.factorSecret32,walletId:e.walletId,walletAuthMethodId:String(e.emailOtpAuthContext.authority.bindingId),walletSessionId:e.walletSessionId,expiresAtMs:e.expiresAtMs})}catch(e){console.warn(`[registration][email-otp] unlocked Ed25519 export-root capability was not established:`,e instanceof Error?e.message:String(e||`unknown error`))}}async function Yp(e){let t=Kp(e);if(t.factor.kind!==`passkey`)throw Error(`Passkey registration custody commit has a non-passkey factor`);await Wd({walletId:e.walletId,credentialIdB64u:t.factor.credentialIdB64u,envelope:t})}function Xp(e){let t=e.joined.metadata,n=s(t.scope.threshold_session_id);if(!n.ok)throw Error(`Registration Ed25519 capability has an invalid threshold session`);return{kind:dt,session:{walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,authorityScope:{kind:`email_otp`,provider:ir(e.authContext),providerUserId:ar(e.authContext)},thresholdSessionId:n.value,authorizationId:e.sessionState.signingWalletSession.authorizationId,walletSessionId:e.sessionState.walletSessionId,quotaId:e.sessionState.quotaId,expiresAtMs:e.sessionState.signingWalletSession.expiresAtMs,participantIds:t.participantIds,remainingUses:e.sessionState.signingWalletSession.remainingUses,signingRootId:e.sessionState.signingRootId,signingRootVersion:e.sessionState.signingRootVersion,runtimePolicyScope:e.sessionState.runtimePolicyScope,routerAbNormalSigning:e.sessionState.routerAbNormalSigning},capability:{kind:`router_ab_ed25519_yao_active_capability_v1`,materialActivation:t.materialActivation,activeCapabilityBinding:t.activeCapabilityBinding,registeredPublicKey:[...t.registeredPublicKey],nearAccountId:e.nearAccountId,applicationBinding:t.applicationBinding,runtimePolicyScope:e.sessionState.runtimePolicyScope,participantIds:t.participantIds,lifecycle:{lifecycleId:t.scope.lifecycle_id,rootShareEpoch:t.scope.root_share_epoch,accountId:t.scope.account_id,thresholdSessionId:n.value,signerSetId:t.scope.signer_set_id,signingWorkerId:t.scope.signing_worker_id},stateEpoch:Number(t.stateEpoch),registrationContinuity:{kind:`registration`,admissionRequest:e.deferredNear.admissionRequest,admissionReceipt:e.admissionReceipt,activationTranscript:[...t.transcript]}}}}const Zp=Symbol(`hostedPasskeyRegistrationPrepared`),Qp=new WeakMap;function $p(e){let t=je(e);if(!t.ok)throw Error(t.message);return t.value}function em(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function tm(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`implicit_account`:return t.kind===`implicit_account`&&e.accountIdSource===t.accountIdSource;case`sponsored_named_account`:return t.kind===`sponsored_named_account`&&e.requestedAccountId===t.requestedAccountId&&e.sponsor===t.sponsor;default:return q(e)}}function nm(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`near_ed25519`:return t.kind===`near_ed25519`&&tm(e.accountProvisioning,t.accountProvisioning)&&e.signerSlot===t.signerSlot&&em(e.participantIds,t.participantIds)&&e.derivationVersion===t.derivationVersion;case`evm_family_ecdsa`:return t.kind===`evm_family_ecdsa`&&em(e.participantIds,t.participantIds)&&Pe(e.chainTargets)===Pe(t.chainTargets);default:return q(e)}}function rm(e,t){if(e.kind!==t.kind||e.signers.length!==t.signers.length)return!1;for(let n=0;n<e.signers.length;n+=1){let r=e.signers[n],i=t.signers[n];if(!r||!i||!nm(r,i))return!1}return!0}function im(e){return e.signingEngine.warmCriticalResources.bind(e.signingEngine,{kind:`none`})}function am(){return Promise.resolve(eo())}function om(e){return e.signers.some(e=>e.kind===`evm_family_ecdsa`)}function sm(e){return e.authMethod.kind!==`email_otp`||!Fr(e.signerSelection)?am:lm.bind(void 0,{prewarm:e.context.signingEngine.prewarmEmailOtpYao.bind(e.context.signingEngine)})}function cm(e,t){let n=La(t);return{kind:`failed`,elapsedMs:n,workerPrewarmMs:n,yaoWasmInitMs:0,failureStage:`worker_ready`}}function lm(e){let t=performance.now();return e.prewarm().catch(e=>cm(e,t))}function um(e){let[t,n]=e;return{kind:`completed`,diagnostics:{...t,emailOtpWorkerPrewarmMs:n.workerPrewarmMs,emailOtpYaoWasmInitMs:n.yaoWasmInitMs,emailOtpYaoPrewarm:n}}}function dm(e){return{kind:`failed`,error:e}}function fm(e){Bn({relayerUrl:e.relayerUrl,nearEd25519:e.signerSelection.signers.some(e=>e.kind===`near_ed25519`),evmFamilyEcdsa:om(e.signerSelection)}),Fr(e.signerSelection)&&Xc(e.authMethod,e.context.signingEngine.prewarmNearSigner.bind(e.context.signingEngine));let t=e.recorder.measure(`registrationWarmupMs`,im(e.context)),n=e.recorder.measure(`registrationWarmupEmailOtpYaoWasmInitMs`,sm({context:e.context,authMethod:e.authMethod,signerSelection:e.signerSelection}));return om(e.signerSelection)&&e.context.signingEngine.prewarmEcdsaRegistrationCrypto?.().catch(()=>{}),Promise.all([t,n]).then(um,dm)}function pm(e){e.warmup.then(t=>{t.kind===`completed`&&e.recorder.captureWarmupDiagnostics(t.diagnostics)})}function mm(e){return Ne($p(e))?.signerSlot??1}async function hm(e){return e.passkeyExecution?.kind===`use_hosted_preparation`?await e.passkeyExecution.authority:await Xd({context:e.context,walletId:e.walletId,signerSlot:e.signerSlot,registrationIntentDigestB64u:e.registrationIntentDigestB64u,options:e.options,confirmationConfigOverride:e.confirmationConfigOverride})}function gm(e){if(e[Zp]!==!0)throw Error(`Invalid hosted passkey registration preparation`);let t=Qp.get(e);if(!t)throw Error(`Hosted passkey registration preparation is unknown`);return t}function _m(e){if(e.lifecycle!==`ready`)throw Error(`Hosted passkey registration preparation is no longer usable`);if(Date.now()>=e.prepared.expiresAtMs)throw Tm(e.prepared),Error(`Hosted passkey registration preparation expired`);if(e.controller.signal.aborted)throw Error(`Hosted passkey registration preparation was cancelled`);if(!_r.isLiveReservation({reservation:e.prepared.reservation,owner:e.prepared.owner}))throw Tm(e.prepared),Error(`Hosted passkey registration prompt reservation is no longer active`)}function vm(e){return x({wallet:e.wallet,signerSelection:e.signerSelection,authMethod:e.authMethod,walletId:e.walletId,signerSlot:e.signerSlot,rpId:e.rpId,challengeB64u:e.challengeB64u})}function ym(){return Error(`Hosted passkey registration preparation was cancelled`)}function bm(e){if(e.aborted)throw ym()}function xm(e){let t=e.cancellation.signal;return bm(t),new Promise((n,r)=>{let i=!1,a=()=>{c(ym())},o=()=>{t.removeEventListener(`abort`,a)},s=e=>{i||(i=!0,o(),n(e))},c=e=>{i||(i=!0,o(),r(e))};t.addEventListener(`abort`,a,{once:!0}),e.operation.then(s,c)})}function Sm(e){switch(e.setup.kind){case`near_ed25519`:return{kind:`not_required`};case`evm_family_ecdsa`:case`near_ed25519_and_evm_family_ecdsa`:{let t=e.setup.registrationCeremonyId,n=th(e.setup.ecdsa),r=e.context.signingEngine.createRouterAbEcdsaRegistrationCeremony({kind:`create_router_ab_ecdsa_registration_ceremony_v1`,ceremonyId:t,registration:n.strictRegistration});return r.catch(()=>void 0),{kind:`started`,ceremonyId:t,operation:r}}default:return q(e.setup)}}function Cm(e){e.ceremony.kind!==`not_required`&&Bc({context:e.context,ceremonyId:e.ceremony.ceremonyId})}async function wm(e){let t=e.authMethod,n=Sp(String(t.rpId));if(Sp(String(e.context.signingEngine.getRpId()||``))!==n)throw Error(`Hosted passkey registration rpId does not match the wallet runtime`);let r=mm(e.signerSelection),i=e.expiresInMs??300*1e3;if(!Number.isSafeInteger(i)||i<=0)throw Error(`Hosted passkey registration expiry must be a positive safe integer`);let a=Date.now()+i,o={kind:`hosted_auth_menu_registration`,authMenuSessionId:e.authMenuSessionId,requestId:e.requestId},s=new AbortController,c=null,l=null,u={kind:`not_required`},d=()=>{s.abort(),c&&Tm(c)},f=()=>{e.cancellation.signal.removeEventListener(`abort`,d)};bm(e.cancellation.signal),e.cancellation.signal.addEventListener(`abort`,d,{once:!0});let p=new $a(performance.now());try{let i=await xm({operation:Jm({context:e.context,authMethod:t,wallet:e.wallet,signerSelection:e.signerSelection,recorder:p}),cancellation:e.cancellation}),d=nl(i.setup.intent);if(String(d.authMethod.rpId)!==String(n)||!rm(d.signerSelection,e.signerSelection))throw Error(`Hosted passkey registration setup changed its authority binding`);let m=$t(String(d.walletId)),h=String(i.setup.registrationIntentDigestB64u||``).trim();if(!h)throw Error(`Hosted passkey registration setup returned no challenge`);if(r!==mm(e.signerSelection))throw Error(`Hosted passkey registration signer slot changed during preparation`);if(u=Sm({context:e.context,setup:i.setup}),pm({recorder:p,warmup:i.registrationWarmup}),Date.now()>=a)throw Error(`Hosted passkey registration preparation expired before reservation`);let g=await _r.reserveRegistrationPrompt({owner:o,expiresAtMs:a,cancellation:e.cancellation});l=g;let _=vm({wallet:e.wallet,signerSelection:e.signerSelection,authMethod:t,walletId:m,signerSlot:r,rpId:n,challengeB64u:h}),v=Object.freeze({kind:`hosted_passkey_registration_prepared_v1`,walletId:m,signerSlot:r,rpId:n,challengeB64u:h,registrationIntentDigestB64u:h,expiresAtMs:a,owner:o,reservation:g,cancellation:{kind:`abort_signal`,signal:s.signal},[Zp]:!0});return Qp.set(v,{prepared:v,context:e.context,wallet:e.wallet,signerSelection:e.signerSelection,authMethod:t,options:e.options??{},...e.confirmationConfigOverride?{confirmationConfigOverride:e.confirmationConfigOverride}:{},setup:i,controller:s,removeExternalCancellationListener:f,binding:_,lifecycle:`ready`,authority:null,registrationStarted:!1,ecdsaClientCeremony:u}),c=v,v}catch(t){throw s.abort(),f(),Cm({context:e.context,ceremony:u}),c?Tm(c):l&&_r.releaseReservation(l),t}}function Tm(e){let t=gm(e);t.lifecycle===`finished`||t.lifecycle===`cancelled`||(t.lifecycle=`cancelled`,t.controller.abort(),t.removeExternalCancellationListener?.(),t.removeExternalCancellationListener=null,Cm({context:t.context,ceremony:t.ecdsaClientCeremony}),_r.releaseReservation(e.reservation))}function Em(e){let t=gm(e);_m(t),t.lifecycle=`consuming`;let n=Yd(t.context.signingEngine.startPreparedPasskeyRegistrationCredential({walletId:String(e.walletId),signerSlot:e.signerSlot,challengeB64u:e.challengeB64u,expectedRpId:String(e.rpId),reservation:e.reservation,owner:e.owner,cancellation:e.cancellation}));return t.authority=n,n.then(()=>{t.lifecycle===`consuming`&&(t.lifecycle=`consumed`)},()=>{Tm(e)}),n}async function Dm(e){let t=gm(e.prepared);if(t.lifecycle!==`consuming`&&t.lifecycle!==`consumed`||!t.authority)throw Error(`Hosted passkey registration credential must be started by its CTA`);if(t.registrationStarted)throw Error(`Hosted passkey registration continuation was already consumed`);t.registrationStarted=!0;try{return await Bh({context:t.context,authMethod:t.authMethod,wallet:t.wallet,signerSelection:t.signerSelection,options:t.options,authenticatorOptions:Cn(t.context.configs.webauthn.authenticatorOptions),...t.confirmationConfigOverride?{confirmationConfigOverride:t.confirmationConfigOverride}:{},passkeyExecution:{kind:`use_hosted_preparation`,prepared:e.prepared,authority:t.authority}})}finally{t.lifecycle=`finished`,Cm({context:t.context,ceremony:t.ecdsaClientCeremony}),t.controller.abort(),t.removeExternalCancellationListener?.(),t.removeExternalCancellationListener=null,_r.releaseReservation(e.prepared.reservation)}}async function Om(e){return Zd(`wallet-registration-near-provisioning:${await S([`wallet-registration-near-provisioning`,e.registrationCeremonyId,e.activationReference.lifecycle_id,e.activationReference.session_id.map(e=>e.toString(16).padStart(2,`0`)).join(``)].join(`:`))}`)}function km(e){let t=globalThis.crypto;if(t&&typeof t.randomUUID==`function`)return Zd(`${e}:${t.randomUUID()}`);let n=new Uint8Array(16);if(!t||typeof t.getRandomValues!=`function`)throw Error(`Secure randomness is required for registration finalization`);return t.getRandomValues(n),Zd(`${e}:${[...n].map(e=>e.toString(16).padStart(2,`0`)).join(``)}`)}function Am(e){return e.recorder.measure(`emailOtpEnrollmentMaterialMs`,()=>Mm({context:e.context,authMethod:e.authMethod,relayerUrl:e.relayerUrl,walletId:e.walletId,providerSubject:e.providerSubject,clientSecret32:e.clientSecret32}))}function jm(e){if(e.emailOtpSessionHandle.kind!==`not_requested`)throw Error(`Strict ECDSA registration received obsolete Email OTP root-share material`)}async function Mm(e){if(e.authMethod.kind!==`email_otp`)throw Error(`Email OTP enrollment material requires Email OTP auth`);try{let t=await e.context.signingEngine.prepareEmailOtpRegistrationEnrollmentMaterialInternal({relayUrl:e.relayerUrl,walletId:Ie(e.walletId),userId:e.providerSubject,clientSecret32:e.clientSecret32});return jm(t),t}finally{e.clientSecret32.fill(0)}}function Nm(e){let t=e.event.authMethod,n=Pm(e.accountId);return un({...e.event,flowId:`registration:${t}:${n}`,accountId:n,authMethod:t})}function Pm(e){let t=String(e||``).trim();if(!t)throw Error(`Registration event account id is required`);return t}function Fm(e){return b(e)&&`code`in e?String(e.code||``).trim():``}function Im(e,t){return Object.assign(Error(e),t?{code:t}:{})}function Lm(e){return Array.isArray(e)?e.filter(e=>{switch(e){case`ble`:case`hybrid`:case`internal`:case`nfc`:case`smart-card`:case`usb`:return!0;default:return!1}}):[]}function $(e,t,n){e?.(Nm({accountId:t,event:n}))}function Rm(e,t,n){let r=!1;return async i=>{if(!e||r)return await i;let a=setTimeout(()=>{r||(r=!0,$(e,t,{authMethod:`passkey`,phase:n,status:`running`}))},5e3);try{return await i}finally{clearTimeout(a)}}}async function zm(e){let t=String(e||``).trim().toLowerCase();if(!t)throw Error(`Email OTP registration auth context requires email`);return S(t)}function Bm(e){switch(e.proofKind){case`otp_challenge`:return`email`;case`google_sso_registration`:return`google`;default:return q(e)}}function Vm(e){switch(e.kind){case`passkey`:return{kind:`passkey`,webauthnRegistration:e.webauthnRegistration};case`email_otp`:return{kind:`email_otp`,emailOtpRegistrationProof:e.emailOtpRegistrationProof};default:return q(e)}}async function Hm(e){let t=performance.now();try{let n=await al(e.deferredNear,{routerOrigin:new URL(e.relayerUrl).origin,routing:e.home,authorization:{kind:`bearer`,value:`Bearer ${e.signedSetup}`},fetch:globalThis.fetch,...e.traceContext?{traceContext:e.traceContext}:{}});return Ta({ceremonyId:e.registrationCeremonyId,stage:`early_admission`,startedAt:t,outcome:`success`}),{deferredNear:e.deferredNear,admissionReceipt:n}}catch(n){throw Ta({ceremonyId:e.registrationCeremonyId,stage:`early_admission`,startedAt:t,outcome:`failure`}),n}}function Um(e){if(!e)throw Error(`Mixed registration did not start NEAR admission`);return e}function Wm(e,t,n){switch(e.kind){case`passkey`:return{auth:{kind:`passkey`,rpId:Mt(e.rpId),credentialIdB64u:t}};case`email_otp`:return{auth:{kind:`email_otp`,providerSubjectId:ar(e.emailOtpAuthContext)},remainingUses:n.remainingUses,expiresAtMs:n.expiresAtMs};default:return q(e)}}async function Gm(e){let t=Pt(x({operation:`wallet_registration_activate_v2`,registrationCeremonyId:e.registrationCeremonyId,activationCorrelationId:e.activationCorrelationId,idempotencyKey:e.idempotencyKey,publicFacts:e.publicFacts}));return{canonicalRequest:t,requestDigest:xe(L(await k(String(t))))}}async function Km(e){let t={authority:e.materialAuthority,targetMemberships:e.chainTargets,evmFamilySigningKeySlotId:It(e.ecdsaPrepare.prepare.evmFamilySigningKeySlotId,`registration ECDSA signing key slot`),ecdsaThresholdKeyId:rn(e.ecdsaPrepare.prepare.ecdsaThresholdKeyId),signingRootId:Kt(e.ecdsaPrepare.prepare.signingRootId),signingRootVersion:Wt(e.ecdsaPrepare.prepare.signingRootVersion),runtimePolicyScope:e.ecdsaPrepare.prepare.runtimePolicyScope,clientVerifyingPublicKey33B64u:tn(e.clientActivation.derivationClientSharePublicKey33B64u),participantIds:[Jt(e.ecdsaPrepare.prepare.participantIds[0]),Jt(e.ecdsaPrepare.prepare.participantIds[1])],relayerKeyId:nn(e.ecdsaPrepare.prepare.relayerKeyId),bindingDigest:cn(e.clientActivation.contextBinding32B64u),journalId:e.activationCorrelationId,requestDigest:e.activationCommand.requestDigest,canonicalRequest:e.activationCommand.canonicalRequest,createdAt:ye(new Date().toISOString())},n=await e.context.signingEngine.persistInitialCanonicalEcdsaActivation({kind:`persist_initial_canonical_ecdsa_activation_v1`,bootstrapOwner:`wallet_custody`,clientActivation:e.clientActivation,ceremonyId:e.ceremonyId,planInput:t});if(!n.ok)throw Error(`Canonical ECDSA activation persistence failed (${n.code}): ${n.message}`);return n}function qm(e){let t=R(e);if(t.length!==20)throw Error(`ECDSA activation address must contain 20 bytes`);return`0x${Array.from(t,e=>e.toString(16).padStart(2,`0`)).join(``)}`}async function Jm(e){let t=String(e.context.configs.network.relayer.url||``).trim();if(!t)throw Error(`registerWallet requires relayer.url`);let n=e.context.configs.registration,r=String(n?.publishableKey||``).trim(),i=String(n?.projectEnvironmentId||``).trim();if(!r||!i)throw Error(`registerWallet requires registration.publishableKey and registration.projectEnvironmentId`);let a=fm({recorder:e.recorder,context:e.context,relayerUrl:t,authMethod:e.authMethod,signerSelection:e.signerSelection}),o=await e.recorder.measure(`registrationIntentMs`,()=>zn({relayerUrl:t,request:{...e.wallet.kind===`provided`?{wallet:e.wallet}:{},signerSelection:e.signerSelection,authMethod:e.authMethod},auth:{publishableKey:r,environmentId:i}}));if(!o.ok)throw Im(o.message,o.code);return{relayerUrl:t,setup:o,registrationWarmup:a}}async function Ym(e){if(e.passkeyExecution.kind===`collect_during_registration`)return await Jm({context:e.context,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,recorder:e.recorder});if(e.authMethod.kind!==`passkey`)throw Error(`Hosted passkey preparation requires passkey registration`);let t=gm(e.passkeyExecution.prepared);if(t.context!==e.context||t.lifecycle===`cancelled`)throw Error(`Hosted passkey registration preparation belongs to a different operation`);let n=t.setup,r=nl(n.setup.intent),i=String(n.setup.registrationIntentDigestB64u||``).trim(),a=mm(e.signerSelection);if(vm({wallet:e.wallet,signerSelection:e.signerSelection,authMethod:e.authMethod,walletId:$t(String(r.walletId)),signerSlot:a,rpId:Sp(String(e.authMethod.rpId)),challengeB64u:i})!==t.binding||String(r.walletId)!==String(e.passkeyExecution.prepared.walletId)||i!==e.passkeyExecution.prepared.challengeB64u)throw Error(`Hosted passkey registration preparation binding changed`);return n}function Xm(e){if(e.passkeyExecution.kind===`collect_during_registration`)return{kind:`create_after_authority`};let t=gm(e.passkeyExecution.prepared);if(t.ecdsaClientCeremony.kind!==`started`||t.ecdsaClientCeremony.ceremonyId!==e.ceremonyId)throw Error(`Hosted passkey registration has no matching ECDSA client ceremony`);return{kind:`use_hosted_preparation`,ceremonyId:t.ecdsaClientCeremony.ceremonyId,operation:t.ecdsaClientCeremony.operation}}async function Zm(e){return await e}function Qm(e){switch(e.clientCeremony.kind){case`create_after_authority`:return e.context.signingEngine.createRouterAbEcdsaRegistrationCeremony.bind(e.context.signingEngine,{kind:`create_router_ab_ecdsa_registration_ceremony_v1`,ceremonyId:e.ceremonyId,registration:e.registration});case`use_hosted_preparation`:if(e.clientCeremony.ceremonyId!==e.ceremonyId)throw Error(`Prepared ECDSA client ceremony identity changed`);return Zm.bind(void 0,e.clientCeremony.operation);default:return q(e.clientCeremony)}}async function $m(e){let[t,...n]=e.ecdsaPrepare.chainTargets;if(!t)throw Error(`Strict ECDSA ceremony requires at least one EVM-family target`);let r=e.registrationCeremonyId,i=be(r),a=null;try{let o=await Wc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationClientCreateMs`,operation:Qm({context:e.context,ceremonyId:r,registration:e.ecdsaPrepare.strictRegistration,clientCeremony:e.clientCeremony})}),s=await Wc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationGatewayRespondMs`,operation:Vn.bind(void 0,{relayerUrl:e.relayerUrl,headers:Mc(e.traceContext),registrationCeremonyId:r,signerPlanKind:e.signerPlanKind,signedSetup:e.signedSetup,ecdsa:{kind:`router_ab_ecdsa_registration_v1`,strictRegistration:o.registrationRequest,requestDigestB64u:o.registrationRequestDigestB64u},...Vm(e.authority),onServerTiming:t=>Sa(e.registrationTiming,`respond`,t)})});if(s.kind===`near_ed25519`)throw Error(`ECDSA registration ceremony received an Ed25519-only respond result`);let c=s.kind===`near_ed25519_and_evm_family_ecdsa`?s.ed25519:null,l=c?Hm({home:e.home,relayerUrl:e.relayerUrl,registrationCeremonyId:r,signedSetup:e.signedSetup,deferredNear:c,traceContext:e.traceContext}):null;l?.catch(ph);let u=await Wc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationClientProofVerifyMs`,operation:e.context.signingEngine.verifyRouterAbEcdsaRegistrationClientProofs.bind(e.context.signingEngine,{kind:`verify_router_ab_ecdsa_registration_client_proofs_v1`,bootstrapOwner:`wallet_custody`,ceremonyId:r,clientProofFinalization:{kind:`finalize_encrypted_client_proof_bundles_v2`,bundles:s.ecdsa.strictResult.response.bundles}})}),d=await e.resolveActivateEmailOtp(),f=[t,...n],p=e.authority.kind===`passkey`?e.authority.walletCustodyFactorJson:d.walletCustodyFactorJson;if(!p)throw Error(`ECDSA registration has no wallet custody factor binding`);let m=e.authority.walletCustodyFactorSecret,h={},g=await e.context.signingEngine.establishWalletCustodyEvmFamilyKeySet({walletId:e.ecdsaPrepare.prepare.walletId,factorJson:p,factorSecret:m,evmFamilySigningKeySlotId:e.ecdsaPrepare.prepare.evmFamilySigningKeySlotId,applicationBindingDigestB64u:u.applicationBindingDigestB64u,confirmRecoveryCodesBackedUp:e.confirmRecoveryCodesBackedUp,runRelayerRound:async t=>{let n=Vt({registrationRequestDigestB64u:u.registrationRequestDigestB64u,proofTranscriptDigestB64u:u.proofTranscriptDigestB64u,contextBinding32B64u:t.contextBinding32B64u,derivationClientSharePublicKey33B64u:t.clientSharePublicKey33B64u,clientShareRetryCounter:t.clientShareRetryCounter,participantId:1}),o=await Gm({registrationCeremonyId:r,activationCorrelationId:i,idempotencyKey:e.idempotencyKey,publicFacts:n}),s=Gl(t.preActivationCommitPayload),p={activationJournalId:i,clientActivation:n,activationRequestDigestB64u:o.requestDigest};if(e.signerPlanKind===`near_ed25519_and_evm_family_ecdsa`){if(!c)throw Error(`Mixed registration has no NEAR continuation`);await e.persistPendingCommit({signerPlanKind:e.signerPlanKind,localMaterial:{keyFamilies:[`ecdsa_secp256k1`],custodyCommit:s,ecdsa:p},emailOtpEnrollment:d.enrollment,deferredNear:c}),a=e.startDeferredNearCustody({admission:Um(l),establishedEvmCustodyCommit:t.preActivationCommitPayload}),a.catch(ph)}else await e.persistPendingCommit({signerPlanKind:e.signerPlanKind,localMaterial:{keyFamilies:[`ecdsa_secp256k1`],custodyCommit:s,ecdsa:p},emailOtpEnrollment:d.enrollment});let m=await Km({context:e.context,ceremonyId:r,materialAuthority:e.materialAuthority,ecdsaPrepare:e.ecdsaPrepare,chainTargets:f,activationCorrelationId:i,activationCommand:o,clientActivation:n});if(String(m.journalId)!==String(i))throw Error(`ECDSA activation journal identity changed before activate`);let g=await Wc({registrationTiming:e.registrationTiming,bucket:`ecdsaRegistrationGatewayActivateMs`,operation:Wn.bind(void 0,{relayerUrl:e.relayerUrl,headers:Mc(e.traceContext),registrationCeremonyId:r,signerPlanKind:e.signerPlanKind,signedSetup:e.signedSetup,idempotencyKey:e.idempotencyKey,ecdsa:{clientActivation:n,activationCorrelationId:i,activationRequestDigestB64u:o.requestDigest},walletCustodyCommit:t.preActivationCommitPayload,...d.enrollment?{emailOtpEnrollment:d.enrollment}:{},onServerTiming:t=>Sa(e.registrationTiming,`activate`,t)})});if(g.kind!==`evm_family_ecdsa`||!g.ecdsa)throw Error(`ECDSA registration ceremony received a non-ECDSA activate result`);h.value=g,h.journalId=m.journalId;let _=g.ecdsa.activation.ecdsa_activation.public_identity;return JSON.stringify({relayerKeyId:e.ecdsaPrepare.prepare.relayerKeyId,relayerPublicKey33B64u:_.server_public_key33_b64u,groupPublicKey33B64u:_.threshold_public_key33_b64u,ethereumAddress:qm(_.ethereum_address20_b64u),relayerShareRetryCounter:_.server_share_retry_counter})}});if(!h.value||!h.journalId)throw Error(`Wallet custody ECDSA activation did not return its committed receipt`);let _=h.value;if(_.walletCustody?.status!==`committed`){let e=_.walletCustody?.status??`not_reported`;throw Error(`Wallet custody did not commit during ECDSA activation (${e})`)}let v=Vc({prepare:e.ecdsaPrepare.prepare,verified:g.clientBootstrap}),y=tr({clientBootstrap:v,serverBootstrap:_.ecdsa.bootstrap,activationEpoch:_.ecdsa.activation.ecdsa_activation.activation_epoch}),b=await e.context.signingEngine.finalizeRouterAbEcdsaRegistrationActivation({kind:`finalize_router_ab_ecdsa_registration_activation_v1`,bootstrapOwner:`wallet_custody`,journalId:h.journalId,activationReceipt:_.ecdsa.activation,routerAbEcdsaDerivationNormalSigning:y.routerAbEcdsaDerivationNormalSigning,readyStateBlobB64u:g.localMaterial.readyStateBlobB64u,walletCustodyPublicFacts:g.localMaterial.publicFacts});return{session:{chainTargets:[t,...n],clientBootstrap:v,bootstrap:y,activatedThresholdSessionId:_.ecdsa.bootstrap.thresholdSessionId,roleLocalMaterial:b.roleLocalMaterial,authority:await Ct({authority:_.authority}),materialActivation:b.materialActivation,clientPublicFacts:b.publicFacts,publicCapability:b.publicCapability,registrationEstablishedSession:Fc(_.registrationEstablishedSession)},activated:_,deferredNear:c,activateEmailOtp:{enrollment:d.enrollment},walletCustody:g,deferredNearCustodyWork:a}}catch(t){throw uh(a),await Bc({context:e.context,ceremonyId:r}),t}}function eh(e){switch(e.kind){case`evm`:return ze({chain:`evm`,chainId:e.chainId,networkSlug:e.networkSlug});case`tempo`:return ze({chain:`tempo`,chainId:e.chainId,networkSlug:e.networkSlug});default:return q(e)}}function th(e){let[t,...n]=e.chainTargets;if(!t)throw Error(`Registration setup ECDSA chain targets are required`);return{kind:e.kind,chainTargets:[eh(t),...n.map(eh)],prepare:e.prepare,strictRegistration:e.strictRegistration}}function nh(e,t){switch(e.kind){case`near_ed25519`:throw Error(`Registration setup returned an Ed25519-only signer branch`);case`evm_family_ecdsa`:case`near_ed25519_and_evm_family_ecdsa`:if(e.kind!==t)throw Error(`Registration setup returned a different signer branch`);return e;default:return q(e)}}function rh(e){switch(e.kind){case`evm_family_ecdsa`:return 1;case`near_ed25519_and_evm_family_ecdsa`:return e.ed25519Selection.signerSlot;default:return q(e)}}function ih(e){if(e.authMethod.kind===`passkey`){if(!e.passkeyAuthority)throw Error(`Passkey registration authority was not collected`);return{kind:`passkey`,rpId:e.authMethod.rpId,credentialIdB64u:String(e.passkeyAuthority.credential.rawId||e.passkeyAuthority.credential.id||``).trim(),transports:[...e.passkeyAuthority.webauthnRegistration.response.transports]}}return{kind:`email_otp`,email:e.email,registrationAuthorityId:e.registrationAuthorityId,providerSubject:e.providerSubject,enrollment:ah(e.emailOtpEnrollment)}}function ah(e){if(!e)throw Error(`Email OTP registration has no enrollment material for pending recovery`);return e}async function oh(e){let t=Date.now(),n=Ap({...e,createdAtMs:t,updatedAtMs:t});return await V.putPendingWalletRegistrationCommit(n),n}function sh(e){if(!e||e.operation!==`registration_activate`||e.signerPlanKind!==`near_ed25519_and_evm_family_ecdsa`)throw Error(`Mixed registration activation commit was not persisted`);return e}async function ch(e){let t=e.walletKeys;if(e.auth.kind===`passkey`){let n=String(e.auth.credential.rawId||e.auth.credential.id||``).trim();if(!n)throw Error(`Passkey registration publication has no credential id`);return await In({kind:`passkey`,walletId:e.walletId,rpId:Sp(e.auth.rpId),credentialIdB64u:n,credentialPublicKeyB64u:e.auth.credentialPublicKeyB64u,transports:e.auth.credential.response?.transports??[],walletKeys:t})}return await In({kind:`email_otp`,walletId:e.walletId,email:e.auth.email,registrationAuthorityId:e.auth.registrationAuthorityId,authority:e.auth.authority,walletKeys:t})}async function lh(e){let t=await Np({context:e.context,relayerUrl:e.relayerUrl,registrationTiming:e.registrationTiming,plan:e.plan}),n=await ch({auth:e.plan.auth,walletId:e.plan.walletId,walletKeys:t}),r=e.plan.ecdsa.session.registrationEstablishedSession;await V.publishPendingWalletRegistrationCommit({pending:e.pending,authority:e.activated.authority,foundingAuthority:{authority:e.activated.foundingAuthority,authMethod:e.activated.foundingAuthMethod},request:{operation:e.pending.operation,registrationCeremonyId:e.pending.registrationCeremonyId,idempotencyKey:e.pending.idempotencyKey,walletId:e.pending.walletId,walletAuthMethodId:e.pending.walletAuthMethodId},walletSessionPublication:{kind:`issued`,walletSession:r.walletSession,operationCredential:r.operationCredential},ecdsaContinuity:[],registration:n})}async function uh(e){if(e)try{Hp((await e).factorSecret32)}catch{}}function dh(e){switch(e.auth.kind){case`passkey`:{if(!e.passkeyAuthority)throw Error(`Deferred passkey registration requires authority material`);let t=String(e.passkeyAuthority.credential.rawId||e.passkeyAuthority.credential.id||``).trim(),n=String(e.passkeyAuthority.prfFirstB64u||``).trim();if(!t||!n)throw Error(`Deferred passkey registration requires credential PRF material`);return{kind:`passkey`,rpId:e.auth.rpId,credentialIdB64u:t,prfFirstB64u:n}}case`email_otp`:if(!e.emailOtpEnrollment)throw Error(`Deferred Email OTP registration requires enrollment material`);return{kind:`email_otp`,enrollment:e.emailOtpEnrollment,emailOtpAuthContext:e.auth.emailOtpAuthContext};default:return q(e.auth)}}async function fh(e,t,n){let r=performance.now();await V.advancePendingNearRegistration({expected:e,next:pn(e,t,n)}),Ar(e.registrationCeremonyId,`journal_prepared`,r)}function ph(){}async function mh(e,t){let n=e.factorSecretOwner.value;if(!n)throw Error(`Mixed registration has no NEAR custody factor secret`);e.factorSecretOwner.value=null;let r=performance.now(),i=`failure`;try{let r=await V.getPendingWalletRegistrationCommit({registrationCeremonyId:e.registrationCeremonyId,operation:`near_provisioning`});if(!r||r.operation!==`near_provisioning`||r.phase!==`planned`)throw Error(`NEAR registration has no planned continuation`);let a;try{let e=await t.admission;if(!_t(e.deferredNear.admissionRequest,r.admissionRequest))throw Error(`NEAR admission changed the authorized request`);a=e.admissionReceipt}catch(e){if(e instanceof Error&&e.message===`NEAR admission changed the authorized request`)throw e;a=void 0}let{joined:o,admissionReceipt:s}=await gh({home:e.home,pending:r,signingEngine:e.context.signingEngine,relayerUrl:e.relayerUrl,credential:e.signedSetup,traceContext:e.traceContext,factorSecret:n,...a?{admitted:a}:{}});return i=`success`,{admissionReceipt:s,joined:o,admissionRequest:r.admissionRequest,envelope:Kp({commit:t.establishedEvmCustodyCommit,walletId:r.walletId,activatedAtMs:Date.now()}),factorSecret32:n}}catch(e){throw Hp(n),e}finally{Ta({ceremonyId:e.registrationCeremonyId,stage:`custody_join`,startedAt:r,outcome:i})}}async function hh(e){return e.pending.phase===`execution_prepared`?e.pending.admissionReceipt:e.admitted?e.admitted:await al({status:`deferred`,admissionRequest:e.pending.admissionRequest},{routerOrigin:new URL(e.relayerUrl).origin,routing:e.home,authorization:{kind:`bearer`,value:`Bearer ${e.credential}`},fetch:globalThis.fetch,traceContext:e.traceContext})}async function gh(e){let t=e.pending;if(t.phase===`joined`&&t.completion.kind!==`encrypted_checkpoint`)throw Error(`Joined material has no encrypted execution checkpoint`);let n=t.phase===`joined`&&t.completion.kind===`encrypted_checkpoint`?t.completion.prepared:t;if(n.phase===`joined`)throw Error(`Invalid NEAR continuation phase`);let r=n.admissionRequest,i=performance.now(),a=await hh({home:e.home,pending:n,relayerUrl:e.relayerUrl,credential:e.credential,traceContext:e.traceContext,...e.admitted?{admitted:e.admitted}:{}});Ar(n.registrationCeremonyId,`admission`,i);let o=await e.signingEngine.joinWalletCustodyNearEd25519KeySet({routing:e.home,...n.phase===`planned`?{preparation:{kind:`fresh`},beforeRouterRound:fh.bind(void 0,n,a)}:{preparation:{kind:`checkpoint`,checkpointJson:n.checkpointJson}},custodyJson:Pl(n.baseCustodyCommit),factorSecret:e.factorSecret,nearEd25519SigningKeyId:r.application_binding.near_ed25519_signing_key_id,registrationCeremonyId:n.registrationCeremonyId,admissionRequest:r,admissionReceipt:a,participantIds:r.participant_ids,routerOrigin:new URL(e.relayerUrl).origin,authorization:`Bearer ${e.credential}`,traceContext:e.traceContext});if(t.phase===`joined`){if(L(o.metadata.registeredPublicKey)!==t.localMaterial.ed25519.metadata.registeredPublicKeyB64u||JSON.stringify(o.activationReference)!==JSON.stringify(t.localMaterial.ed25519.activationReference))throw Error(`Restored NEAR checkpoint changed the joined key`);return{joined:o,admissionReceipt:a}}let s=performance.now(),c=await V.getPendingWalletRegistrationCommit({registrationCeremonyId:n.registrationCeremonyId,operation:`near_provisioning`});if(!c||c.operation!==`near_provisioning`||c.phase!==`execution_prepared`)throw Error(`NEAR execution checkpoint was not persisted`);let l=Ap({operation:`near_provisioning`,signerPlanKind:`near_ed25519_and_evm_family_ecdsa`,completion:{kind:`encrypted_checkpoint`,prepared:c},registrationCeremonyId:c.registrationCeremonyId,idempotencyKey:await Om({registrationCeremonyId:c.registrationCeremonyId,activationReference:o.activationReference}),walletId:c.walletId,walletAuthMethodId:c.walletAuthMethodId,signedSetup:c.signedSetup,auth:c.auth,createdAtMs:c.createdAtMs,updatedAtMs:Date.now(),localMaterial:{keyFamilies:[`ed25519`],custodyCommit:o.commitPayload,ed25519:{activationReference:o.activationReference,localMaterial:o.localMaterial,metadata:Wp(o)}}});if(l.operation!==`near_provisioning`||l.phase!==`joined`)throw Error(`Invalid joined NEAR continuation`);return await V.advancePendingNearRegistration({expected:c,next:l}),Ar(n.registrationCeremonyId,`journal_joined`,s),{joined:o,admissionReceipt:a}}function _h(e){return e.chainTarget}function vh(e,t){if(e.auth.kind===`passkey`&&t.kind===`passkey`&&e.auth.rpId===t.rpId&&e.auth.credentialIdB64u===t.credentialIdB64u)return{kind:`passkey`,rpId:t.rpId,credentialIdB64u:t.credentialIdB64u,prfFirstB64u:t.prfFirstB64u};if(e.auth.kind===`email_otp`&&t.kind===`email_otp`&&e.auth.providerSubject===t.providerSubject){let n=Et({walletId:e.walletId,bindingId:e.walletAuthMethodId,factor:{kind:`email_otp`,provider:t.provider,providerUserId:t.providerSubject},verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:t.emailHashHex}});if(!n)throw Error(`NEAR continuation requires its founding Email OTP method`);return{kind:`email_otp`,enrollment:e.auth.enrollment,emailOtpAuthContext:sr({policy:`session`,retention:`session`,reason:`login`,authority:n})}}throw Error(`NEAR continuation requires its founding authentication method`)}async function yh(e){if(await Ch(e.sessionAuthority),e.pending.phase===`joined`&&e.pending.completion.kind===`sealed_material`){let t=await ud({pending:e.pending,relayerUrl:e.relayerUrl,operationCredential:e.sessionAuthority.operationCredential});return{joined:t.joined,admissionRequest:t.admissionRequest,admissionReceipt:t.admissionReceipt,envelope:e.envelope,factorSecret32:e.factorSecret}}let t=e.pending.phase===`joined`?e.pending.completion.prepared:e.pending;if(!t)throw Error(`NEAR continuation has no encrypted checkpoint`);let n=await gh({home:e.sessionAuthority.operationCredential.home,pending:e.pending,signingEngine:e.context.signingEngine,relayerUrl:e.relayerUrl,credential:e.sessionAuthority.operationCredential.token,traceContext:yn(),factorSecret:e.factorSecret});return{joined:n.joined,admissionReceipt:n.admissionReceipt,admissionRequest:t.admissionRequest,envelope:e.envelope,factorSecret32:e.factorSecret}}async function bh(e){let t=performance.now();try{let n=await V.listPendingWalletRegistrationCommits();for(let r of n){if(r.operation!==`near_provisioning`||r.walletId!==e.sessionAuthority.record.walletId||r.walletAuthMethodId!==e.sessionAuthority.record.authMethodId||r.signerPlanKind!==`near_ed25519_and_evm_family_ecdsa`||await V.getPendingWalletRegistrationCommit({registrationCeremonyId:r.registrationCeremonyId,operation:`registration_activate`}))continue;let n=e.context.configs.network.relayer.url,i=vh(r,e.factor),a=yh.bind(void 0,{context:e.context,pending:r,envelope:e.custodyEnvelope,relayerUrl:n,sessionAuthority:e.sessionAuthority,factorSecret:e.ownedFactorSecret});await Mh({context:e.context,walletId:r.walletId,commit:{context:e.context,registrationTiming:null,registrationStartedAt:t,relayerUrl:n,registrationCeremonyId:r.registrationCeremonyId,signedSetup:r.signedSetup,headers:Mc(),nearCustodyWork:a,sessionAuthority:e.sessionAuthority,expectedChainTargets:Nr(e.context.configs.network.chains).map(_h),walletId:r.walletId,authMaterial:i}})}}catch(e){console.warn(`[registration] NEAR continuation remains pending`,e instanceof Error?e.message:`continuation failed`)}finally{Hp(e.ownedFactorSecret)}}function xh(e){if(!e)throw Error(`Mixed registration did not start its NEAR custody join`);return e}function Sh(e,t,n,r){if(t.kind!==`already_committed`||t.session.tokens.kind!==`near_ed25519_and_evm_family_ecdsa`)throw Error(`NEAR completion must extend the current Wallet Session`);let i=t.session,a=e.record,o=i.walletSession;if(i.walletId!==a.walletId||i.authorizationId!==a.authorizationId||i.quotaId!==a.quotaId||i.walletSessionId!==e.operationCredential.walletSessionId||o.authorityId!==a.authorityId||o.authMethodId!==a.authMethodId||o.issuedAtMs!==a.issuedAtMs||o.expiresAtMs!==a.expiresAtMs||o.authorityRevocationEpoch!==a.authorityRevocationEpoch||o.expiresAtMs<=Date.now()||!I(a,o)||n.authorityId!==o.authorityId||n.walletId!==o.walletId||n.authorityDigestB64u!==o.authorityDigestB64u||n.revocationEpoch!==o.authorityRevocationEpoch||r.walletAuthMethodId!==o.authMethodId||r.walletId!==o.walletId||r.walletAuthorityId!==o.authorityId)throw Error(`NEAR completion changed the current Wallet Session authority`);return{kind:`registration_established_wallet_session_v2`,walletId:i.walletId,authorizationId:i.authorizationId,walletSessionId:i.walletSessionId,quotaId:i.quotaId,expiresAtMs:i.expiresAtMs,remainingUses:i.remainingUses,walletSession:o,operationCredential:e.operationCredential,tokens:i.tokens}}async function Ch(e){let t=await On.readExactWithOperationCredential({walletId:e.record.walletId,authorityId:e.record.authorityId,authMethodId:e.record.authMethodId});if(t.kind!==`found`||t.record.expiresAtMs<=Date.now()||t.record.authorizationId!==e.record.authorizationId||t.record.authorityRevocationEpoch!==e.record.authorityRevocationEpoch||t.operationCredential.token!==e.operationCredential.token)throw Error(`NEAR continuation requires the current unlocked Wallet Session`)}async function wh(e){let t=await V.getPendingWalletRegistrationCommit({registrationCeremonyId:e.registrationCeremonyId,operation:`near_provisioning`});if(!t||t.operation!==`near_provisioning`||t.phase!==`joined`||t.walletId!==e.walletId||t.walletAuthMethodId!==e.walletAuthMethodId)throw Error(`NEAR joined checkpoint was not persisted`);return t}async function Th(e){let{metadata:t,materialFacts:n}=e,r={materialActivation:Zn(t),lifecycleId:t.scope.lifecycle_id,signingRootVersion:t.scope.root_share_epoch,signingRootId:t.applicationBinding.signing_root_id,signerSetId:t.scope.signer_set_id,thresholdSessionId:n.identity.thresholdSessionId,activationTranscriptB64u:L(t.transcript),activationCapabilityBindingB64u:L(Uint8Array.from(t.activeCapabilityBinding))},i=null;try{i=await ga({material:e.material,activation:r,envelope:e.envelope,ownedFactorSecret:e.ownedFactorSecret}),await Wf({store:V,activeClient:i,identity:{walletId:n.identity.walletId,nearAccountId:n.identity.nearAccountId,nearEd25519SigningKeyId:n.identity.nearEd25519SigningKeyId,thresholdSessionId:n.identity.thresholdSessionId,signerSlot:n.identity.signerSlot,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,signingRootId:n.identity.signingRootId,signingRootVersion:n.identity.signingRootVersion,signingWorkerId:n.stableServerScope.routerAbNormalSigning.signingWorkerId},stableServerScope:n.stableServerScope,passkeyPrfFirstB64u:e.passkeyPrfFirstB64u}),await Ch(e.sessionAuthority),await e.signingEngine.activateVerifiedNearEd25519YaoMaterial({activeClient:i,facts:{thresholdSessionId:n.identity.thresholdSessionId,signer:or({walletId:Ie(n.identity.walletId),nearAccountId:z(n.identity.nearAccountId),nearEd25519SigningKeyId:Xt(n.identity.nearEd25519SigningKeyId),signerSlot:n.identity.signerSlot}),signingRootId:n.identity.signingRootId,signingRootVersion:n.identity.signingRootVersion,routerAbNormalSigning:n.stableServerScope.routerAbNormalSigning,runtimePolicyScope:n.stableServerScope.runtimePolicyScope,relayerUrl:e.relayerUrl}}),await Ch(e.sessionAuthority),i=null}catch(e){throw i?.dispose(),e}finally{e.ownedFactorSecret.fill(0)}}async function Eh(e){let t=performance.now(),n=`failure`;try{return await e.signingEngine.hydrateSigningSession(e.input),n=`success`,{kind:`completed`}}catch(e){return{kind:`failed`,error:e}}finally{Ta({ceremonyId:e.ceremonyId,stage:`session_hydration`,startedAt:t,outcome:n})}}async function Dh(e){let t=performance.now(),n=`failure`;try{return await e.signingEngine.prepareSigningSessionHydration(e.input),n=`success`,{kind:`completed`}}catch(e){return{kind:`failed`,error:e}}finally{Ta({ceremonyId:e.ceremonyId,stage:`session_seal_preparation`,startedAt:t,outcome:n})}}function Oh(e){let t=s(e.thresholdSessionId);if(!t.ok)throw Error(`Invalid admitted NEAR session identity`);let n=km(`near-session-client-seal`);return{kind:`preparing`,thresholdSessionId:String(t.value),preparationId:n,result:Dh({signingEngine:e.signingEngine,ceremonyId:e.ceremonyId,input:{preparationId:n,thresholdSessionId:String(t.value),prfFirstB64u:e.prfFirstB64u}})}}async function kh(e){try{await Ch(e.sessionAuthority);let t=await V.getPendingWalletRegistrationCommit({registrationCeremonyId:e.ceremonyId,operation:`near_provisioning`});return!t||t.operation!==`near_provisioning`||t.phase===`joined`||t.walletId!==e.sessionAuthority.record.walletId||t.walletAuthMethodId!==e.sessionAuthority.record.authMethodId?{kind:`none`}:Oh({signingEngine:e.signingEngine,ceremonyId:e.ceremonyId,thresholdSessionId:t.admissionRequest.scope.threshold_session_id,prfFirstB64u:e.prfFirstB64u})}catch{return{kind:`none`}}}function Ah(){return null}async function jh(e){let t=e.authMaterial,n=performance.now(),r=`failure`,i=null,a=Promise.resolve({kind:`completed`}),o={kind:`none`};try{t.kind===`passkey`&&(o=await kh({signingEngine:e.context.signingEngine,ceremonyId:e.registrationCeremonyId,sessionAuthority:e.sessionAuthority,prfFirstB64u:t.prfFirstB64u}));let n=await e.nearCustodyWork();i=n.factorSecret32;let s=n.joined,c=`ed25519:${Ee(s.metadata.registeredPublicKey)}`,l=s.activationReference,u=await Om({registrationCeremonyId:e.registrationCeremonyId,activationReference:l}),d=await wh({registrationCeremonyId:e.registrationCeremonyId,walletId:e.walletId,walletAuthMethodId:String(e.sessionAuthority.record.authMethodId)});await Ch(e.sessionAuthority),t.kind===`passkey`&&o.kind===`none`&&(o=Oh({signingEngine:e.context.signingEngine,ceremonyId:e.registrationCeremonyId,thresholdSessionId:s.metadata.scope.threshold_session_id,prfFirstB64u:t.prfFirstB64u}));let f;if(o.kind===`preparing`){let t=performance.now(),n=await o.result;if(Ta({ceremonyId:e.registrationCeremonyId,stage:`session_seal_preparation_wait`,startedAt:t,outcome:n.kind===`completed`?`success`:`failure`}),n.kind===`failed`)throw n.error;await Ch(e.sessionAuthority);let r=await e.context.signingEngine.readPreparedSigningSessionHydration({thresholdSessionId:o.thresholdSessionId,preparationId:o.preparationId});f={preparationId:o.preparationId,thresholdSessionId:o.thresholdSessionId,ciphertext:r.ciphertext}}let p=performance.now(),m={relayerUrl:e.relayerUrl,registrationCeremonyId:e.registrationCeremonyId,signedSetup:e.signedSetup,headers:{...e.headers,...re(e.sessionAuthority.operationCredential)},idempotencyKey:u,ed25519:{activationReference:l},walletCustodyCommit:s.commitPayload,onServerTiming:Ca.bind(void 0,e.registrationTiming)},h;if(f){if(e.authMaterial.kind!==`passkey`)throw Error(`Prepared session sealing requires a passkey authority`);h=await Gn({...m,auth:{kind:`passkey`},sessionSeal:{thresholdSessionId:f.thresholdSessionId,ciphertext:f.ciphertext}})}else h=await Gn({...m,auth:e.authMaterial});if(!h.ok)throw Error(`Deferred NEAR provisioning did not complete`);let g=h;if(g.kind!==`near_ed25519`)throw Error(`Deferred Ed25519 finalize returned a different signer branch`);if(g.walletCustody?.status!==`joined`){let e=g.walletCustody?.status??`not_reported`;throw Error(`Deferred NEAR custody join did not commit (${e})`)}if(f&&!g.sessionSeal)throw Error(`Deferred NEAR finalization did not return the prepared session seal`);Ta({ceremonyId:e.registrationCeremonyId,stage:`server_finalize`,startedAt:p,outcome:`success`});let _=Sh(e.sessionAuthority,g.registrationEstablishedSession,g.foundingAuthority,g.foundingAuthMethod),v=z(g.ed25519.nearAccountId),y=e.authMaterial.kind===`passkey`?e.authMaterial.credentialIdB64u:``;t.kind===`passkey`?rl({clientPublicKey:c,finalized:g,expectedRpId:t.rpId,expectedWalletId:e.walletId}):il({clientPublicKey:c,finalized:g,expectedRegistrationAuthorityId:d.auth.kind===`email_otp`?d.auth.registrationAuthorityId:``,expectedWalletId:e.walletId});let b=$c({admissionRequest:n.admissionRequest,finalized:g.ed25519,walletId:e.walletId,expectedRuntimePolicyScope:j(g.ed25519.runtimePolicyScope)}),x=s.metadata,S=Zn(x),C=Up({established:s,walletId:String(e.walletId),nearAccountId:String(v),nearEd25519SigningKeyId:g.ed25519.nearEd25519SigningKeyId,signerSlot:g.ed25519.signerSlot}),w=performance.now(),T=await ad(d,g);await Ch(e.sessionAuthority);let E=(await V.publishPendingWalletRegistrationCommitAndRetain({pending:d,ecdsaContinuity:[],authority:g.authority,foundingAuthority:{authority:g.foundingAuthority,authMethod:g.foundingAuthMethod},request:{operation:d.operation,registrationCeremonyId:e.registrationCeremonyId,idempotencyKey:d.idempotencyKey,walletId:e.walletId,walletAuthMethodId:g.foundingAuthMethod.walletAuthMethodId},walletSessionPublication:{kind:`credential_free_projection`,walletSession:_.walletSession},registration:T})).signerActivations[0];if(!E||E.signerSlot!==g.ed25519.signerSlot)throw Error(`Deferred Ed25519 registration persisted a different signer slot`);let D=new mr;for(let t of e.expectedChainTargets)gd({signingEngine:e.context.signingEngine,walletId:e.walletId,chainTarget:t,trigger:`registration`,statusReads:D});Ta({ceremonyId:e.registrationCeremonyId,stage:`local_publication`,startedAt:w,outcome:`success`}),await Ch(e.sessionAuthority),e.authMaterial.kind===`passkey`&&_.remainingUses>0&&(a=Eh({signingEngine:e.context.signingEngine,ceremonyId:e.registrationCeremonyId,input:ol({session:_,ceremonyId:e.registrationCeremonyId,walletId:String(e.walletId),relayerUrl:e.relayerUrl,prfFirstB64u:e.authMaterial.prfFirstB64u,preparedServerSeal:f&&g.sessionSeal?{preparationId:f.preparationId,...g.sessionSeal}:null,restore:{rpId:e.authMaterial.rpId,nearAccountId:String(v),nearEd25519SigningKeyId:g.ed25519.nearEd25519SigningKeyId,relayerKeyId:g.ed25519.relayerKeyId,participantIds:g.ed25519.participantIds,signerSlot:g.ed25519.signerSlot,credentialIdB64u:e.authMaterial.credentialIdB64u,materialActivation:S}})}));let ee=performance.now();await e.context.signingEngine.activateAuthenticatedWalletState({walletId:e.walletId,nearAccountId:v,signerSlot:g.ed25519.signerSlot,nearClient:e.context.nearClient}),await e.context.signingEngine.upsertEd25519YaoPublicCapabilityLaneReference({walletId:e.walletId,nearAccountId:v,thresholdSessionId:b.identity.thresholdSessionId,runtimePolicyScope:b.stableServerScope.runtimePolicyScope,materialActivation:S,...Wm(t,y,_),nearEd25519SigningKeyId:Xt(g.ed25519.nearEd25519SigningKeyId),signerSlot:g.ed25519.signerSlot}),Ta({ceremonyId:e.registrationCeremonyId,stage:`session_install`,startedAt:ee,outcome:`success`});let O=performance.now();if(t.kind===`email_otp`&&_.remainingUses>0){let r=await tl({registrationEstablishedSession:_,walletId:e.walletId,nearAccountId:String(v),nearEd25519SigningKeyId:g.ed25519.nearEd25519SigningKeyId,thresholdSessionId:b.identity.thresholdSessionId,runtimePolicyScope:b.stableServerScope.runtimePolicyScope,signerSlot:g.ed25519.signerSlot,relayerUrl:e.relayerUrl,emailOtpAuthContext:t.emailOtpAuthContext}),a=Xp({walletId:e.walletId,nearAccountId:String(v),nearEd25519SigningKeyId:g.ed25519.nearEd25519SigningKeyId,sessionState:r,joined:s,deferredNear:{status:`deferred`,admissionRequest:n.admissionRequest},admissionReceipt:n.admissionReceipt,authContext:t.emailOtpAuthContext});await e.context.signingEngine.activateEmailOtpEd25519RegistrationMaterialInternal({walletSession:{walletId:e.walletId,walletSessionUserId:String(e.walletId)},providerSubject:ar(t.emailOtpAuthContext),emailHashHex:cr(t.emailOtpAuthContext),signerSlot:g.ed25519.signerSlot,expectedOperationalPublicKey:c,expectedThresholdSessionId:b.identity.thresholdSessionId,bootstrap:a,material:C,envelope:ma(n.envelope),factorSecret32:i}),i=null}else if(t.kind===`passkey`){if(e.authMaterial.kind!==`passkey`)throw Error(`Deferred passkey registration has no Passkey authorization material`);if(!i)throw Error(`Deferred passkey registration has no custody factor secret`);await Th({signingEngine:e.context.signingEngine,sessionAuthority:e.sessionAuthority,metadata:x,material:C,materialFacts:b,envelope:ma(n.envelope),ownedFactorSecret:new Uint8Array(i),rpId:e.authMaterial.rpId,credentialIdB64u:e.authMaterial.credentialIdB64u,passkeyPrfFirstB64u:e.authMaterial.prfFirstB64u,relayerUrl:e.relayerUrl}),i=null}e.authMaterial.kind===`passkey`&&await Wd({walletId:String(e.walletId),credentialIdB64u:e.authMaterial.credentialIdB64u,envelope:n.envelope}),Ta({ceremonyId:e.registrationCeremonyId,stage:`signer_activation`,startedAt:O,outcome:`success`}),await Ch(e.sessionAuthority);let k=performance.now(),A=await a;if(Ta({ceremonyId:e.registrationCeremonyId,stage:`session_hydration_wait`,startedAt:k,outcome:A.kind===`completed`?`success`:`failure`}),A.kind===`failed`)throw A.error;await Ch(e.sessionAuthority);let M=performance.now();return await V.completePendingNearRegistration({pending:d,walletSession:_.walletSession,operationCredential:_.operationCredential,nearAccountId:String(v)}),Ta({ceremonyId:e.registrationCeremonyId,stage:`durable_ready`,startedAt:M,outcome:`success`}),r=`success`,{status:`near_ready`,updatedAtMs:Date.now(),nearAccountId:String(v)}}catch(t){let n=await V.getProfile(String(e.walletId)).catch(Ah);if(n?.nearProvisioning?.status===`near_ready`)return n.nearProvisioning;let r=Nh(t);try{await e.context.signingEngine.setWalletNearProvisioningState({walletId:String(e.walletId),status:`near_failed_retryable`,errorCode:r})}catch{}return{status:`near_failed_retryable`,updatedAtMs:Date.now(),error:Se(t,`registration`,String(e.walletId)),errorCode:r}}finally{await a,o.kind===`preparing`&&(await o.result,await e.context.signingEngine.discardSigningSessionHydration({thresholdSessionId:o.thresholdSessionId,preparationId:o.preparationId}).catch(ph)),i&&Hp(i),Ta({ceremonyId:e.registrationCeremonyId,stage:`provisioning_total`,startedAt:n,outcome:r}),Ta({ceremonyId:e.registrationCeremonyId,stage:`registration_total`,startedAt:e.registrationStartedAt,outcome:r})}}async function Mh(e){try{await e.context.signingEngine.setWalletNearProvisioningState({walletId:String(e.walletId),status:`near_provisioning`})}catch(t){let n=Nh(t),r={status:`near_failed_retryable`,updatedAtMs:Date.now(),error:Se(t,`registration`,String(e.walletId)),errorCode:n};try{await e.context.signingEngine.setWalletNearProvisioningState({walletId:String(e.walletId),status:`near_failed_retryable`,errorCode:n})}catch{}Cd(e.walletId,r);return}await Td({walletId:e.walletId,nowMs:Date.now,attempt:jh.bind(void 0,e.commit)})}function Nh(e){let t=e instanceof Error?e.message:String(e);return t.includes(`finalize`)?`near_finalize_failed`:t.includes(`seal`)||t.includes(`Yao`)?`near_seal_failed`:t.includes(`wallet session`)?`near_capability_persist_failed`:`near_provisioning_failed`}async function Ph(e){let t=Nh(e.error),n=Se(e.error,`registration`,String(e.walletId));try{await e.context.signingEngine.setWalletNearProvisioningState({walletId:String(e.walletId),status:`near_failed_retryable`,errorCode:t})}catch{}return Cd(e.walletId,{status:`near_failed_retryable`,updatedAtMs:Date.now(),error:n,errorCode:t}),{status:`retryable`,error:n,errorCode:t}}async function Fh(e){try{return await e.context.signingEngine.setWalletNearProvisioningState({walletId:String(e.walletId),status:`near_pending`}),Cd(e.walletId,{status:`near_pending`,updatedAtMs:Date.now()}),{status:`pending`}}catch(t){return await Ph({context:e.context,walletId:e.walletId,error:t})}}async function Ih(e){let{context:t,wallet:n,signerSelection:r}=e,i=e.options||{},{onEvent:a,onError:o,afterCall:s}=i,l=performance.now(),u=new $a(l),f=yn(),p=null,m=null,h=Pm(n.kind===`provided`?String(n.walletId):`wallet-registration`);$(a,h,{authMethod:e.authMethod.kind,phase:B.STEP_01_STARTED,status:`started`});try{let o=km(`wallet-registration-finalize`),h=await Ym({context:t,authMethod:e.authMethod,wallet:n,signerSelection:r,recorder:u,passkeyExecution:e.passkeyExecution});e.authMethod.kind===`email_otp`&&pm({recorder:u,warmup:h.registrationWarmup});let{relayerUrl:g,setup:_}=h,v=th(nh(_,e.kind).ecdsa),y=Xm({passkeyExecution:e.passkeyExecution,ceremonyId:_.registrationCeremonyId}),b={intent:_.intent,registrationIntentDigestB64u:_.registrationIntentDigestB64u},x=b.intent.walletId,S=Pm(String(x)),C=null,w=``,T=``,E=``,D=null,ee=null,O=null,k;if(e.authMethod.kind===`passkey`){$(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_04_PASSKEY_CREATE_STARTED,status:`waiting_for_user`,interaction:{kind:`passkey_create`,overlay:`show`}});let n={uiMode:`modal`,behavior:`requireClick`,...e.confirmationConfigOverride??i?.confirmationConfig??{}};O=await u.measure(`authProofMs`,()=>hm({context:t,walletId:x,signerSlot:rh(e),registrationIntentDigestB64u:b.registrationIntentDigestB64u,options:i,confirmationConfigOverride:n,passkeyExecution:e.passkeyExecution})),u.capturePasskeyAuthDiagnostics(O.diagnostics),p=performance.now();let r=d(String(O.credential.rawId||O.credential.id||``).trim());if(!r.ok)throw Error(`passkey credential id ${r.error.message}`);k={kind:`passkey`,webauthnRegistration:O.webauthnRegistration,walletCustodyFactorJson:JSON.stringify({envelopeId:`wallet-custody-envelope:${crypto.randomUUID()}`,factor:$e({rpId:Sp(e.authMethod.rpId),credentialIdB64u:r.value}),walletAuthMethodId:b.intent.foundingWalletAuthMethodId}),walletCustodyFactorSecret:R(O.prfFirstB64u).buffer},$(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_04_PASSKEY_CREATE_SUCCEEDED,status:`succeeded`,interaction:{kind:`passkey_create`,overlay:`hide`}})}else{let n=e.authMethod,r=crypto.getRandomValues(new Uint8Array(32));m=r.slice(),ee=r.slice().buffer;let i=await u.measure(`authProofMs`,()=>gf({authMethod:n,relayUrl:g,walletId:String(x),registrationIntentDigestB64u:b.registrationIntentDigestB64u}));C=Am({recorder:u,context:t,authMethod:n,relayerUrl:g,walletId:String(x),providerSubject:i.providerSubject,clientSecret32:r}),w=i.registrationAuthorityId,T=i.email,E=i.providerSubject,D=Bm(i.proof),k={kind:`email_otp`,emailOtpRegistrationProof:i.proof,walletCustodyFactorSecret:ee}}let A=c(_.walletAuthMethodId);if(!A.ok)throw Error(`Registration setup auth-method identity is invalid: ${A.error.message}`);let j;if(e.authMethod.kind===`passkey`){if(!O)throw Error(`ECDSA registration is missing its verified passkey authority`);j=await Ct({authority:{...Zc({walletId:x,rpId:e.authMethod.rpId,credential:O.credential}),bindingId:A.value}})}else{if(!D)throw Error(`Email OTP registration is missing its verified provider`);j=await Ct({authority:{...kt({walletId:x,provider:D,providerUserId:E,emailHashHex:await zm(T)}),bindingId:A.value}})}$(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_05_ED25519_SIGNER_PREPARE_STARTED,status:`running`});let M={value:e.kind===`near_ed25519_and_evm_family_ecdsa`?k.walletCustodyFactorSecret.slice(0):null},N=null,P={value:null},F;try{F=await u.measure(`ecdsaRegistrationTotalMs`,()=>$m({home:_.home,context:t,relayerUrl:g,registrationCeremonyId:_.registrationCeremonyId,signerPlanKind:e.kind,signedSetup:_.signedSetup,ecdsaPrepare:v,clientCeremony:y,authority:k,materialAuthority:j,idempotencyKey:o,resolveActivateEmailOtp:async()=>{let t=null,n=null;if(e.authMethod.kind===`email_otp`){let e=await Qc({material:C,operation:`activate`});t=e.emailOtpEnrollment??null,n=JSON.stringify({envelopeId:`wallet-custody-envelope:${crypto.randomUUID()}`,factor:et({enrollmentId:e.enrollmentId,enrollmentSealKeyVersion:e.enrollmentSealKeyVersion}),walletAuthMethodId:b.intent.foundingWalletAuthMethodId})}return{enrollment:t,walletCustodyFactorJson:n}},traceContext:f,registrationTiming:u,confirmRecoveryCodesBackedUp:Bp.bind(void 0,P,t,String(x),i.recoveryCodeBackup),persistPendingCommit:async t=>{let n={operation:`registration_activate`,registrationCeremonyId:_.registrationCeremonyId,idempotencyKey:o,walletId:String(x),walletAuthMethodId:String(b.intent.foundingWalletAuthMethodId),signedSetup:String(_.signedSetup),auth:ih({authMethod:e.authMethod,passkeyAuthority:O,email:T,registrationAuthorityId:w,providerSubject:E,emailOtpEnrollment:t.emailOtpEnrollment})};if(t.signerPlanKind===`near_ed25519_and_evm_family_ecdsa`){let e=Date.now(),r=sh(Ap({...n,signerPlanKind:t.signerPlanKind,localMaterial:t.localMaterial,createdAtMs:e,updatedAtMs:e})),i=mn(r,t.deferredNear.admissionRequest);await V.putPendingWalletRegistrationCommits([r,i]),N=r;return}N=await oh({...n,signerPlanKind:t.signerPlanKind,localMaterial:t.localMaterial})},startDeferredNearCustody:mh.bind(void 0,{home:_.home,context:t,factorSecretOwner:M,registrationCeremonyId:_.registrationCeremonyId,relayerUrl:g,signedSetup:String(_.signedSetup),traceContext:f})}))}finally{Hp(k.walletCustodyFactorSecret),M.value&&=(Hp(M.value),null)}if(P.value){let e=F.activated.walletCustody;if(e?.status!==`committed`)throw Error(`Deferred recovery codes lack a committed server issuance`);await pr.bindIssuedAtMs(P.value,e.issuedAtMs)}let te=F.session;if(F.activated.kind!==`evm_family_ecdsa`)throw Error(`Wallet registration activate returned a different signer branch`);let I=Dp(F.activated),ne=F.activateEmailOtp.enrollment;if(I.kind!==`evm_family_ecdsa`)throw Error(`Wallet registration finalize returned a different signer branch`);if(e.authMethod.kind===`email_otp`&&!Hn(I))throw Error(`Email OTP registration finalize returned a different auth method`);u.captureRouteDiagnostics(I.registrationDiagnostics);let re=I.ecdsa.walletKeys;if(re.length===0)throw Error(`Wallet registration finalize did not return ECDSA wallet keys`);let ie=await Tp({authMethod:e.authMethod,configs:t.configs,walletId:Ie(I.walletId),finalized:I,passkeyAuthority:O,email:T,providerSubject:E,registrationAuthorityId:w}),ae=Op({walletId:Ie(I.walletId),auth:ie,foundingAuthority:I.foundingAuthority,foundingAuthMethod:I.foundingAuthMethod,ecdsa:Ep({session:te,walletKeys:re,expectedChainTargets:te.chainTargets})});$(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_05_ED25519_SIGNER_PREPARE_SUCCEEDED,status:`succeeded`}),$(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_08_STORAGE_PERSIST_STARTED,status:`running`});let oe=Ie(I.walletId),L={status:`pending`};e.kind===`near_ed25519_and_evm_family_ecdsa`?(await lh({context:t,relayerUrl:g,registrationTiming:u,pending:sh(N),plan:ae,activated:F.activated}),L=await Fh({context:t,walletId:oe})):await Lp({context:t,relayerUrl:g,registrationTiming:u,plan:ae});let se=mr.fromRegistration(g,ae.ecdsa.session.registrationEstablishedSession);for(let e of te.chainTargets)gd({signingEngine:t.signingEngine,walletId:oe,chainTarget:e,trigger:`registration`,statusReads:se});let ce=ae.ecdsa.walletKeys[0];if(e.authMethod.kind===`passkey`){if(!O)throw Error(`Passkey registration authority was not collected`);let n=ae.ecdsa.session.registrationEstablishedSession;try{await qp({signingEngine:t.signingEngine,commit:F.walletCustody.commitPayload,passkeyPrfFirstB64u:O.prfFirstB64u,walletId:String(x),walletAuthMethodId:String(ae.foundingAuthMethod.walletAuthMethodId),walletSessionId:String(n.walletSessionId),expiresAtMs:n.expiresAtMs})}catch(n){if(e.kind!==`near_ed25519_and_evm_family_ecdsa`)throw n;L=await Ph({context:t,walletId:oe,error:n})}}else{if(ie.kind!==`email_otp`||!m)throw Error(`Email OTP registration has no custody capability material`);let e=ae.ecdsa.session.registrationEstablishedSession;await Jp({context:t,commit:F.walletCustody.commitPayload,factorSecret32:m,emailOtpAuthContext:ie.emailOtpAuthContext,walletId:String(x),walletSessionId:String(e.walletSessionId),expiresAtMs:e.expiresAtMs})}if(e.kind===`near_ed25519_and_evm_family_ecdsa`){let e=dh({auth:ae.auth,emailOtpEnrollment:ne,passkeyAuthority:O});try{Mh({context:t,walletId:oe,commit:{context:t,registrationTiming:u,registrationStartedAt:l,relayerUrl:g,registrationCeremonyId:_.registrationCeremonyId,signedSetup:_.signedSetup,headers:Mc(f),nearCustodyWork:xh.bind(void 0,F.deferredNearCustodyWork),sessionAuthority:{record:ae.ecdsa.session.registrationEstablishedSession.walletSession,operationCredential:ae.ecdsa.session.registrationEstablishedSession.operationCredential},expectedChainTargets:ae.ecdsa.expectedChainTargets,walletId:oe,authMaterial:e}})}catch(e){let t=Nh(e);L={status:`retryable`,error:Se(e,`registration`,String(oe)),errorCode:t},Cd(oe,{status:`near_failed_retryable`,updatedAtMs:Date.now(),error:L.error,errorCode:t})}}e.kind===`evm_family_ecdsa`&&await V.deletePendingWalletRegistrationCommit({registrationCeremonyId:_.registrationCeremonyId,operation:`registration_activate`});let le=e.kind===`near_ed25519_and_evm_family_ecdsa`?{success:!0,kind:`ecdsa_wallet_registered_near_pending`,walletId:I.walletId,capabilities:[{kind:`evm_family_ecdsa`,thresholdEcdsaEthereumAddress:ce.thresholdOwnerAddress,thresholdEcdsaPublicKeyB64u:ce.thresholdEcdsaPublicKeyB64u}],nearProvisioning:L}:{success:!0,kind:`wallet_registered`,walletId:I.walletId,capabilities:[{kind:`evm_family_ecdsa`,thresholdEcdsaEthereumAddress:ce.thresholdOwnerAddress,thresholdEcdsaPublicKeyB64u:ce.thresholdEcdsaPublicKeyB64u}]};if($(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_08_STORAGE_PERSIST_SUCCEEDED,status:`succeeded`}),$(a,S,{authMethod:e.authMethod.kind,phase:B.STEP_11_COMPLETED,status:`succeeded`}),p!==null){let e=performance.now();io({callback:i.onTimingSpan,span:`registration.post_touch_id`,outcome:`success`,durationMs:e-p,traceContext:f}),io({callback:i.onTimingSpan,span:`frontend.wallet_ready`,outcome:`success`,durationMs:0,traceContext:f})}return ro(to({recorder:u,authMethod:e.authMethod.kind,signerSet:Fa(e.signerPlan)})),Vh(e.context,le,e.authMethod.kind),s?.(!0,le),le}catch(t){let n=Fm(t),r=Se(t,`registration`,h);p!==null&&io({callback:i.onTimingSpan,span:`registration.post_touch_id`,outcome:`failure`,durationMs:performance.now()-p,traceContext:f});let c=Im(r,n);o?.(c),$(a,h,{authMethod:e.authMethod.kind,phase:B.FAILED,status:`failed`,message:r,interaction:{kind:`passkey_create`,overlay:`hide`},error:{...n?{code:n}:{},message:r}});let l={success:!1,error:r,...n?{errorCode:n}:{}};return ro(no({recorder:u,authMethod:e.authMethod.kind,signerSet:Fa(e.signerPlan),errorCode:n||null})),s?.(!1),l}finally{m?.fill(0)}}async function Lh(e){let{context:t,options:n}=e,r=Pm(e.wallet.kind===`provided`?String(e.wallet.walletId):`wallet-registration`),i=new $a(performance.now()),a=null;$(n.onEvent,r,{authMethod:`email_otp`,phase:B.STEP_01_STARTED,status:`started`});try{let r=await Jm({context:t,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,recorder:i});pm({recorder:i,warmup:r.registrationWarmup});let{relayerUrl:o,setup:s}=r,c=s.intent.walletId,l=Pm(String(c)),u=await i.measure(`authProofMs`,gf.bind(void 0,{authMethod:e.authMethod,relayUrl:o,walletId:String(c),registrationIntentDigestB64u:s.registrationIntentDigestB64u})),d=crypto.getRandomValues(new Uint8Array(32));a=d.slice();let f=d.slice().buffer,p=Am({recorder:i,context:t,authMethod:e.authMethod,relayerUrl:o,walletId:String(c),providerSubject:u.providerSubject,clientSecret32:d});$(n.onEvent,l,{authMethod:`email_otp`,phase:B.STEP_05_ED25519_SIGNER_PREPARE_STARTED,status:`running`});let m=await i.measure(`walletRegisterStartMs`,Vn.bind(void 0,{relayerUrl:o,registrationCeremonyId:s.registrationCeremonyId,signerPlanKind:`near_ed25519`,signedSetup:s.signedSetup,headers:{...Mc(),...oe(s.home)},kind:`email_otp`,emailOtpRegistrationProof:u.proof}));if(m.kind!==`near_ed25519`)throw Error(`Ed25519-only registration respond returned a different signer branch`);let h=await Qc({material:p,operation:`finalize`}),g;try{g=await t.signingEngine.establishWalletCustodyNearEd25519KeySet({home:s.home,walletId:String(c),factor:{factorJson:JSON.stringify({envelopeId:`wallet-custody-envelope:${crypto.randomUUID()}`,factor:et({enrollmentId:h.enrollmentId,enrollmentSealKeyVersion:h.enrollmentSealKeyVersion}),walletAuthMethodId:s.intent.foundingWalletAuthMethodId}),factorSecret:f},nearEd25519SigningKeyId:m.ed25519.admissionRequest.application_binding.near_ed25519_signing_key_id,registrationCeremonyId:s.registrationCeremonyId,admissionRequest:m.ed25519.admissionRequest,admissionReceipt:m.ed25519.admissionReceipt,participantIds:m.ed25519.admissionRequest.participant_ids,routerOrigin:new URL(o).origin,authorization:`Bearer ${String(s.signedSetup)}`})}finally{Hp(f)}let _=await zp(t,String(c),n.recoveryCodeBackup,g.recoveryCodes),v=Qe(g.commitPayload);if(!g.localMaterial)throw Error(`Email OTP registration produced no sealed local custody material`);let y=await Om({registrationCeremonyId:s.registrationCeremonyId,activationReference:g.activationReference}),b=await oh({operation:`near_provisioning`,completion:{kind:`sealed_material`},signerPlanKind:`near_ed25519`,registrationCeremonyId:s.registrationCeremonyId,idempotencyKey:y,walletId:String(c),walletAuthMethodId:String(s.intent.foundingWalletAuthMethodId),signedSetup:String(s.signedSetup),auth:{kind:`email_otp`,email:u.email,registrationAuthorityId:u.registrationAuthorityId,providerSubject:u.providerSubject,enrollment:h.emailOtpEnrollment},localMaterial:{keyFamilies:[`ed25519`],custodyCommit:v,ed25519:{activationReference:g.activationReference,localMaterial:g.localMaterial,metadata:Wp(g)}}}),x=`ed25519:${Ee(g.metadata.registeredPublicKey)}`,S=await i.measure(`walletRegisterFinalizeMs`,Gn.bind(void 0,{relayerUrl:o,registrationCeremonyId:s.registrationCeremonyId,signedSetup:s.signedSetup,headers:{...Mc(),...oe(s.home)},idempotencyKey:y,ed25519:{activationReference:g.activationReference},auth:{kind:`email_otp`,enrollment:h.emailOtpEnrollment},walletCustodyCommit:v}));if(!S.ok)throw Error(`Deferred NEAR provisioning did not complete`);if(i.captureRouteDiagnostics(S.registrationDiagnostics),S.kind!==`near_ed25519`)throw Error(`Wallet registration finalize returned a different signer branch`);if(!Hn(S))throw Error(`Email OTP registration finalize returned a different auth method`);if(S.walletCustody?.status!==`committed`){let e=S.walletCustody?.status??`not_reported`;throw Error(`Wallet custody did not commit (${e})`)}if(_&&await pr.bindIssuedAtMs(_,S.walletCustody.issuedAtMs),S.ed25519.signerSlot!==e.ed25519Selection.signerSlot)throw Error(`Ed25519 Yao finalize returned a different signer slot`);let C=Fc(S.registrationEstablishedSession);il({clientPublicKey:x,finalized:S,expectedRegistrationAuthorityId:u.registrationAuthorityId,expectedWalletId:c});let w=await Tp({authMethod:e.authMethod,configs:t.configs,walletId:Ie(S.walletId),finalized:S,passkeyAuthority:null,email:u.email,providerSubject:u.providerSubject,registrationAuthorityId:u.registrationAuthorityId});if(w.kind!==`email_otp`)throw Error(`Email OTP Ed25519 registration produced a different persistence authority`);$(n.onEvent,l,{authMethod:`email_otp`,phase:B.STEP_05_ED25519_SIGNER_PREPARE_SUCCEEDED,status:`succeeded`}),$(n.onEvent,l,{authMethod:`email_otp`,phase:B.STEP_08_STORAGE_PERSIST_STARTED,status:`running`});let T=$c({admissionRequest:m.ed25519.admissionRequest,finalized:S.ed25519,walletId:c,expectedRuntimePolicyScope:j(s.intent.runtimePolicyScope)}),E=g.metadata,D=z(S.ed25519.nearAccountId),ee=Up({established:g,walletId:String(S.walletId),nearAccountId:String(D),nearEd25519SigningKeyId:S.ed25519.nearEd25519SigningKeyId,signerSlot:S.ed25519.signerSlot}),O=await Fn({walletId:S.walletId,nearAccountId:D,nearEd25519SigningKeyId:S.ed25519.nearEd25519SigningKeyId,email:w.email,registrationAuthorityId:w.registrationAuthorityId,authority:w.authority,signerSlot:S.ed25519.signerSlot,operationalPublicKey:x,relayerKeyId:S.ed25519.relayerKeyId,keyVersion:S.ed25519.keyVersion,participantIds:[...S.ed25519.participantIds],custodyMaterial:ee}),k=await V.publishPendingWalletRegistrationCommit({pending:b,ecdsaContinuity:[],authority:S.authority,foundingAuthority:{authority:S.foundingAuthority,authMethod:S.foundingAuthMethod},request:{operation:`near_provisioning`,registrationCeremonyId:s.registrationCeremonyId,idempotencyKey:y,walletId:S.walletId,walletAuthMethodId:S.foundingAuthMethod.walletAuthMethodId},walletSessionPublication:{kind:`issued`,walletSession:C.walletSession,operationCredential:C.operationCredential},registration:O});mr.acceptRegistrationSession(o,C);let A=k.signerActivations[1];if(!A||A.signerSlot!==S.ed25519.signerSlot)throw Error(`Ed25519 Yao registration persisted a different signer slot`);if(await t.signingEngine.activateAuthenticatedWalletState({walletId:S.walletId,nearAccountId:D,signerSlot:S.ed25519.signerSlot,nearClient:t.nearClient}),await t.signingEngine.upsertEd25519YaoPublicCapabilityLaneReference({walletId:S.walletId,nearAccountId:D,thresholdSessionId:T.identity.thresholdSessionId,runtimePolicyScope:T.stableServerScope.runtimePolicyScope,materialActivation:Zn(E),auth:{kind:`email_otp`,providerSubjectId:u.providerSubject},nearEd25519SigningKeyId:Xt(S.ed25519.nearEd25519SigningKeyId),signerSlot:S.ed25519.signerSlot,remainingUses:C.remainingUses,expiresAtMs:C.expiresAtMs}),!a)throw Error(`Email OTP registration has no custody capability material`);await Jp({context:t,commit:v,factorSecret32:a,emailOtpAuthContext:w.emailOtpAuthContext,walletId:String(S.walletId),walletSessionId:String(C.walletSessionId),expiresAtMs:C.expiresAtMs}),$(n.onEvent,l,{authMethod:`email_otp`,phase:B.STEP_08_STORAGE_PERSIST_SUCCEEDED,status:`succeeded`}),$(n.onEvent,l,{authMethod:`email_otp`,phase:B.STEP_11_COMPLETED,status:`succeeded`});let M={success:!0,kind:`wallet_registered`,walletId:S.walletId,capabilities:[{kind:`near_ed25519`,accountProvisioning:S.accountProvisioning,resolvedAccount:S.resolvedAccount,nearEd25519SigningKeyId:Xt(S.ed25519.nearEd25519SigningKeyId),operationalPublicKey:x,nearAccountId:z(S.ed25519.nearAccountId),transactionId:S.resolvedAccount.kind===`sponsored_named_account`?S.resolvedAccount.transactionHash:null}]};return ro(to({recorder:i,authMethod:`email_otp`,signerSet:Fa(e.signerPlan)})),Vh(t,M,`email_otp`),n.afterCall?.(!0,M),M}catch(t){let a=Fm(t),o=Se(t,`registration`,r);n.onError?.(Im(o,a)),$(n.onEvent,r,{authMethod:`email_otp`,phase:B.FAILED,status:`failed`,message:o,error:{...a?{code:a}:{},message:o}});let s={success:!1,error:o,...a?{errorCode:a}:{}};return ro(no({recorder:i,authMethod:`email_otp`,signerSet:Fa(e.signerPlan),errorCode:a||null})),n.afterCall?.(!1),s}finally{a?.fill(0)}}function Rh(){}async function zh(e){let{context:t,options:n}=e,r=Pm(e.wallet.kind===`provided`?String(e.wallet.walletId):`wallet-registration`),i=yn(),a=null,o={kind:`none`};$(n.onEvent,r,{authMethod:`passkey`,phase:B.STEP_01_STARTED,status:`started`});try{let r=new $a(performance.now()),{relayerUrl:s,setup:c}=await Ym({context:t,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,recorder:r,passkeyExecution:e.passkeyExecution});r.markNearStage(c.registrationCeremonyId,`near_only.setup`);let l=nl(c.intent),u=Pm(String(l.walletId));$(n.onEvent,u,{authMethod:`passkey`,phase:B.STEP_04_PASSKEY_CREATE_STARTED,status:`waiting_for_user`,interaction:{kind:`passkey_create`,overlay:`show`}});let f=c.kind===`near_ed25519`&&c.ed25519.status===`described`?c.ed25519:null,p=hm({context:t,walletId:l.walletId,signerSlot:e.ed25519Selection.signerSlot,registrationIntentDigestB64u:c.registrationIntentDigestB64u,options:n,confirmationConfigOverride:{uiMode:`modal`,behavior:`requireClick`,...e.confirmationConfigOverride??n.confirmationConfig??{}},passkeyExecution:e.passkeyExecution}).then(e=>(a=performance.now(),r.capturePasskeyAuthDiagnostics(e.diagnostics),r.markNearStage(c.registrationCeremonyId,`near_only.authentication`),$(n.onEvent,u,{authMethod:`passkey`,phase:B.STEP_04_PASSKEY_CREATE_SUCCEEDED,status:`succeeded`,interaction:{kind:`passkey_create`,overlay:`hide`}}),e)),m=Rm(n.onEvent,u,B.STEP_05_ED25519_SIGNER_PROVISION_DELAYED),h=async(e,t)=>{let n=await m(Vn({relayerUrl:s,registrationCeremonyId:c.registrationCeremonyId,signerPlanKind:`near_ed25519`,signedSetup:c.signedSetup,headers:{...Mc(i),...oe(c.home)},kind:`passkey`,webauthnRegistration:e.webauthnRegistration,...t?{ed25519Execution:t}:{},onServerTiming:Ca.bind(void 0,r)}));if(r.markNearStage(c.registrationCeremonyId,`near_only.respond`),n.kind!==`near_ed25519`)throw Error(`Ed25519-only registration respond returned a different signer branch`);return n.ed25519},g=e=>{let t=d(String(e.credential.rawId||e.credential.id||``).trim());if(!t.ok)throw Error(`passkey credential id ${t.error.message}`);return t.value},_=null,v=t=>(_=R(t.prfFirstB64u).buffer,{factorJson:JSON.stringify({envelopeId:`wallet-custody-envelope:${crypto.randomUUID()}`,factor:$e({rpId:Sp(e.authMethod.rpId),credentialIdB64u:g(t)}),walletAuthMethodId:c.intent.foundingWalletAuthMethodId}),factorSecret:_}),y=(e,n)=>Oh({signingEngine:t.signingEngine,ceremonyId:c.registrationCeremonyId,thresholdSessionId:n,prfFirstB64u:e.prfFirstB64u}),b=e=>({home:c.home,walletId:String(l.walletId),nearEd25519SigningKeyId:e.admissionRequest.application_binding.near_ed25519_signing_key_id,registrationCeremonyId:c.registrationCeremonyId,admissionRequest:e.admissionRequest,admissionReceipt:e.admissionReceipt,participantIds:e.admissionRequest.participant_ids,routerOrigin:new URL(s).origin,authorization:`Bearer ${String(c.signedSetup)}`,traceContext:i}),x,S,C;try{if(f){S=f;let e=t.signingEngine.establishWalletCustodyNearEd25519KeySet({...b(f),factor:{factorAfterRouterRound:async()=>v(await p)},executeWithProof:async e=>{let t=await h(await p,JSON.parse(e));if(!xt(t.admissionReceipt.binding,f.admissionReceipt.binding))throw Error(`Registration respond issued another admission than setup described`);return t.status===`executed`?JSON.stringify(t.activationResult):null}});e.catch(Rh),x=await p,o=y(x,f.admissionRequest.scope.threshold_session_id),C=await m(e)}else x=await p,S=await h(x),o=y(x,S.admissionRequest.scope.threshold_session_id),C=await m(t.signingEngine.establishWalletCustodyNearEd25519KeySet({...b(S),factor:v(x)}))}finally{_&&Hp(_)}let w={value:g(x)};r.markNearStage(c.registrationCeremonyId,`near_only.custody`);let T=await zp(t,String(l.walletId),n.recoveryCodeBackup,C.recoveryCodes),E=Qe(C.commitPayload);if(!C.localMaterial)throw Error(`Passkey registration produced no sealed local custody material`);let D=await Om({registrationCeremonyId:c.registrationCeremonyId,activationReference:C.activationReference}),ee=await oh({operation:`near_provisioning`,completion:{kind:`sealed_material`},signerPlanKind:`near_ed25519`,registrationCeremonyId:c.registrationCeremonyId,idempotencyKey:D,walletId:String(l.walletId),walletAuthMethodId:String(c.intent.foundingWalletAuthMethodId),signedSetup:String(c.signedSetup),auth:{kind:`passkey`,rpId:e.authMethod.rpId,credentialIdB64u:w.value,transports:[...x.webauthnRegistration.response.transports]},localMaterial:{keyFamilies:[`ed25519`],custodyCommit:E,ed25519:{activationReference:C.activationReference,localMaterial:C.localMaterial,metadata:Wp(C)}}}),O=`ed25519:${Ee(C.metadata.registeredPublicKey)}`;if(r.markNearStage(c.registrationCeremonyId,`near_only.provision_checkpoint`),o.kind!==`preparing`)throw Error(`NEAR registration session seal preparation is missing`);let k=await o.result;if(k.kind===`failed`)throw k.error;let A=await t.signingEngine.readPreparedSigningSessionHydration({thresholdSessionId:o.thresholdSessionId,preparationId:o.preparationId}),M=await Rm(n.onEvent,u,B.STEP_06_RELAY_BOOTSTRAP_DELAYED)(Gn({relayerUrl:s,registrationCeremonyId:c.registrationCeremonyId,signedSetup:c.signedSetup,headers:{...Mc(i),...oe(c.home)},idempotencyKey:D,ed25519:{activationReference:C.activationReference},auth:{kind:`passkey`},sessionSeal:{thresholdSessionId:o.thresholdSessionId,ciphertext:A.ciphertext},walletCustodyCommit:E}));if(r.markNearStage(c.registrationCeremonyId,`near_only.finalize`),!M.ok||M.kind!==`near_ed25519`)throw Error(`Deferred NEAR provisioning returned a different signer branch`);if(!M.sessionSeal)throw Error(`NEAR finalization did not return the prepared session seal`);if(C.commitPayload&&M.walletCustody?.status!==`committed`){let e=M.walletCustody?.status??`not_reported`,t=M.walletCustody?.status===`rejected`?`: ${M.walletCustody.reason}`:``;throw Error(`Wallet custody did not commit (${e})${t}. The recovery codes shown are not usable.`)}if(T){if(M.walletCustody?.status!==`committed`)throw Error(`Deferred recovery codes lack a committed server issuance`);await pr.bindIssuedAtMs(T,M.walletCustody.issuedAtMs)}let N=Fc(M.registrationEstablishedSession),P=rl({clientPublicKey:O,finalized:M,expectedRpId:e.authMethod.rpId,expectedWalletId:l.walletId}),F=z(M.ed25519.nearAccountId),te=Cp({finalized:M,credential:x.credential}),I=$c({admissionRequest:S.admissionRequest,finalized:M.ed25519,walletId:l.walletId,expectedRuntimePolicyScope:j(l.runtimePolicyScope)}),ne=C.metadata,re=Up({established:C,walletId:String(M.walletId),nearAccountId:String(F),nearEd25519SigningKeyId:M.ed25519.nearEd25519SigningKeyId,signerSlot:M.ed25519.signerSlot});await Yp({commit:C.commitPayload,walletId:String(M.walletId),activatedAtMs:Date.now()}),await t.signingEngine.upsertEd25519YaoPublicCapabilityLaneReference({walletId:M.walletId,nearAccountId:z(M.ed25519.nearAccountId),thresholdSessionId:I.identity.thresholdSessionId,runtimePolicyScope:I.stableServerScope.runtimePolicyScope,materialActivation:Zn(ne),auth:{kind:`passkey`,rpId:Mt(P.rpId),credentialIdB64u:P.credentialIdB64u},nearEd25519SigningKeyId:Xt(M.ed25519.nearEd25519SigningKeyId),signerSlot:M.ed25519.signerSlot});let ie=Pn({walletId:M.walletId,nearAccountId:F,nearEd25519SigningKeyId:M.ed25519.nearEd25519SigningKeyId,rpId:Sp(P.rpId),credential:x.credential,credentialPublicKeyB64u:te,signerSlot:M.ed25519.signerSlot,operationalPublicKey:O,relayerKeyId:M.ed25519.relayerKeyId,keyVersion:M.ed25519.keyVersion,participantIds:[...M.ed25519.participantIds],custodyMaterial:re}),ae=await V.publishPendingWalletRegistrationCommit({pending:ee,ecdsaContinuity:[],authority:M.authority,foundingAuthority:{authority:M.foundingAuthority,authMethod:M.foundingAuthMethod},request:{operation:`near_provisioning`,registrationCeremonyId:c.registrationCeremonyId,idempotencyKey:D,walletId:M.walletId,walletAuthMethodId:M.foundingAuthMethod.walletAuthMethodId},walletSessionPublication:{kind:`issued`,walletSession:N.walletSession,operationCredential:N.operationCredential},registration:ie});mr.acceptRegistrationSession(s,N);let L=ae.signerActivations[1];if(!L||L.signerSlot!==M.ed25519.signerSlot)throw Error(`Ed25519 Yao registration persisted a different signer slot`);r.markNearStage(c.registrationCeremonyId,`near_only.publication`);let se=await Eh({signingEngine:t.signingEngine,ceremonyId:c.registrationCeremonyId,input:ol({session:N,ceremonyId:c.registrationCeremonyId,walletId:String(M.walletId),relayerUrl:s,prfFirstB64u:x.prfFirstB64u,preparedServerSeal:{preparationId:o.preparationId,...M.sessionSeal},restore:{rpId:P.rpId,nearAccountId:String(F),nearEd25519SigningKeyId:M.ed25519.nearEd25519SigningKeyId,relayerKeyId:M.ed25519.relayerKeyId,participantIds:M.ed25519.participantIds,signerSlot:M.ed25519.signerSlot,credentialIdB64u:P.credentialIdB64u,materialActivation:Zn(ne)}})});if(se.kind===`failed`)throw se.error;if(o={kind:`consumed`},r.markNearStage(c.registrationCeremonyId,`near_only.session_hydration`),await Th({signingEngine:t.signingEngine,sessionAuthority:{record:N.walletSession,operationCredential:N.operationCredential},metadata:ne,material:re,materialFacts:I,envelope:Gp(C.commitPayload),ownedFactorSecret:R(x.prfFirstB64u),rpId:P.rpId,credentialIdB64u:P.credentialIdB64u,passkeyPrfFirstB64u:x.prfFirstB64u,relayerUrl:s}),r.markNearStage(c.registrationCeremonyId,`near_only.material_activation`),await qp({signingEngine:t.signingEngine,commit:C.commitPayload,passkeyPrfFirstB64u:x.prfFirstB64u,walletId:String(M.walletId),walletAuthMethodId:String(M.foundingAuthMethod.walletAuthMethodId),walletSessionId:String(N.walletSessionId),expiresAtMs:N.expiresAtMs}),r.markNearStage(c.registrationCeremonyId,`near_only.export_capability`),await t.signingEngine.activateAuthenticatedWalletState({walletId:M.walletId,nearAccountId:F,signerSlot:M.ed25519.signerSlot,nearClient:t.nearClient}),$(n.onEvent,u,{authMethod:`passkey`,phase:B.STEP_11_COMPLETED,status:`succeeded`}),a!==null){let e=performance.now();io({callback:n.onTimingSpan,span:`registration.post_touch_id`,outcome:`success`,durationMs:e-a,traceContext:i}),io({callback:n.onTimingSpan,span:`frontend.wallet_ready`,outcome:`success`,durationMs:0,traceContext:i})}r.markNearStage(c.registrationCeremonyId,`near_only.wallet_ready`),ro(to({recorder:r,authMethod:`passkey`,signerSet:Fa(e.signerPlan)}));let ce={success:!0,kind:`wallet_registered`,walletId:M.walletId,capabilities:[{kind:`near_ed25519`,accountProvisioning:M.accountProvisioning,resolvedAccount:M.resolvedAccount,nearEd25519SigningKeyId:Xt(M.ed25519.nearEd25519SigningKeyId),operationalPublicKey:O,nearAccountId:z(M.ed25519.nearAccountId),transactionId:M.resolvedAccount.kind===`sponsored_named_account`?M.resolvedAccount.transactionHash:null}]};return Vh(t,ce,`passkey`),n.afterCall?.(!0,ce),ce}catch(e){let t=Fm(e),o=Se(e,`registration`,r);a!==null&&io({callback:n.onTimingSpan,span:`registration.post_touch_id`,outcome:`failure`,durationMs:performance.now()-a,traceContext:i}),n.onError?.(Im(o,t)),$(n.onEvent,r,{authMethod:`passkey`,phase:B.FAILED,status:`failed`,message:o,interaction:{kind:`passkey_create`,overlay:`hide`},error:{...t?{code:t}:{},message:o}});let s={success:!1,error:o,...t?{errorCode:t}:{}};return n.afterCall?.(!1),s}finally{o.kind===`preparing`&&(await o.result,await t.signingEngine.discardSigningSessionHydration({thresholdSessionId:o.thresholdSessionId,preparationId:o.preparationId}).catch(ph))}}async function Bh(e){let t=$p(e.signerSelection),n=Ne(t);if(n){let r=Me(t);if(r)return await Ih({kind:`near_ed25519_and_evm_family_ecdsa`,context:e.context,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,signerPlan:t,ed25519Selection:n,ecdsaSelection:r,options:e.options,passkeyExecution:e.passkeyExecution,...e.confirmationConfigOverride?{confirmationConfigOverride:e.confirmationConfigOverride}:{}});if(e.authMethod.kind===`email_otp`){if(e.passkeyExecution.kind!==`collect_during_registration`)throw Error(`Prepared registration authority requires passkey authentication`);return await Lh({context:e.context,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,signerPlan:t,ed25519Selection:n,options:e.options,passkeyExecution:e.passkeyExecution})}return await zh({context:e.context,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,signerPlan:t,ed25519Selection:n,options:e.options,passkeyExecution:e.passkeyExecution,...e.confirmationConfigOverride?{confirmationConfigOverride:e.confirmationConfigOverride}:{}})}let r=Me(t);if(!r)throw Error(`Wallet registration requires an ECDSA signer branch`);return await Ih({kind:`evm_family_ecdsa`,context:e.context,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,signerPlan:t,ecdsaSelection:r,options:e.options,passkeyExecution:e.passkeyExecution,...e.confirmationConfigOverride?{confirmationConfigOverride:e.confirmationConfigOverride}:{}})}function Vh(e,t,n){e.signingEngine.setWalletAuthenticated({kind:`authenticated`,walletId:t.walletId,authMethod:n})}async function Hh(e){try{return await Bh({context:e.context,authMethod:e.authMethod,wallet:e.wallet,signerSelection:e.signerSelection,options:e.options,authenticatorOptions:e.authenticatorOptions,...e.confirmationConfigOverride?{confirmationConfigOverride:e.confirmationConfigOverride}:{},passkeyExecution:{kind:`collect_during_registration`}})}finally{e.context.signingEngine.closeRegistrationPreparationModal()}}function Uh(e,t,n){try{$(e,t,n)}catch{}}function Wh(e,t){try{e?.(t)}catch{}}function Gh(e,t,n){try{t&&n?e?.(!0,n):e?.(!1)}catch{}}function Kh(e){let t=[];for(let n of e){let e=String(n.credentialId||``).trim();e&&t.push({id:e,type:`public-key`,transports:Lm(n.transports)})}if(t.length===0)throw Error(`Wallet add-signer requires an existing passkey credential`);return t}function qh(e,t){let n=String(e.id||``).trim(),r=String(e.rawId||``).trim();if(!n||!r||n!==r)throw Error(`Wallet add-signer selected an invalid passkey credential identity`);for(let e of t)if(e.id===r)return r;throw Error(`Wallet add-signer selected a passkey outside the authorized wallet`)}async function Jh(e){if(e.started.intent.walletId!==e.walletId)throw Error(`Wallet add-signer start returned a different wallet`);if(await vr(e.started.intent)!==e.expectedDigestB64u)throw Error(`Wallet add-signer start returned a different intent`);if(!String(e.started.addSignerCeremonyId||``).trim())throw Error(`Wallet add-signer start returned an invalid ceremony ID`)}function Yh(e,t){return e.length===2&&t.length===2&&e[0]===t[0]&&e[1]===t[1]}function Xh(e){let t=e.started.intent.signerSelection;if(t.mode!==`ed25519`)throw Error(`Wallet add-signer start intent changed signer branch`);let n=t.ed25519,r=e.started.ed25519.admissionRequest,i=e.finalized,a=i.ed25519,o=De(e.clientPublicKey);if(i.walletId!==e.walletId||i.rpId!==e.rpId||i.credentialIdB64u!==e.credentialIdB64u||a.publicKey!==e.clientPublicKey||a.nearAccountId!==o||a.signerSlot!==n.signerSlot||a.keyVersion!==n.keyVersion||a.recoveryExportCapable!==!0||!Yh(a.participantIds,n.participantIds)||a.nearEd25519SigningKeyId!==r.application_binding.near_ed25519_signing_key_id||a.relayerKeyId!==r.scope.signing_worker_id||r.application_binding.wallet_id!==e.walletId||r.application_binding.key_creation_signer_slot!==n.signerSlot)throw Error(`Wallet add-signer finalize returned mismatched Ed25519 Yao identity`);return i}function Zh(e){let t=e.intent.signerSelection;if(t.mode!==`ed25519`)throw Error(`Wallet add-signer start intent changed signer branch`);return{version:e.intent.version,walletId:e.intent.walletId,signerSelection:t,...e.intent.runtimePolicyScope?{runtimePolicyScope:e.intent.runtimePolicyScope}:{},nonceB64u:e.intent.nonceB64u}}async function Qh(e){if(e.started.intent.signerSelection.mode!==`ed25519`)throw Error(`Wallet add-signer start returned a different signer branch`);let t=null,n=null,r=null;try{if(e.started.authorizationKind!==`webauthn_assertion`)throw Error(`Wallet custody Ed25519 add-signer requires WebAuthn authorization`);let i=await xf({kind:`verified_passkey_ed25519_yao_add_signer_input_v1`,verifiedIntent:{kind:`verified_passkey_ed25519_add_signer_intent_v1`,intent:Zh(e.started),addSignerIntentDigestB64u:e.intentResponse.addSignerIntentDigestB64u,addSignerIntentGrant:e.intentResponse.addSignerIntentGrant,addSignerCeremonyId:e.started.addSignerCeremonyId},verifiedAuthority:{kind:`verified_passkey_ed25519_add_signer_authority_v1`,walletId:e.walletId,addSignerIntentDigestB64u:e.intentResponse.addSignerIntentDigestB64u,credentialIdB64u:e.credentialIdB64u},admissionRequest:e.started.ed25519.admissionRequest,httpTransport:{kind:`passkey_ed25519_yao_http_transport_v1`,routerOrigin:new URL(e.relayerUrl).origin,fetch:globalThis.fetch}}),a=jc(e.started.ed25519.custodyEnvelope);if(!a.ok)throw Error(a.reason);r=Uint8Array.from(R(e.passkeyPrfFirstB64u)).buffer;let o=await e.context.signingEngine.joinWalletCustodyNearEd25519KeySet({routing:{kind:`discovery`},preparation:{kind:`fresh`},custodyJson:a.custodyJson,factorSecret:r,nearEd25519SigningKeyId:i.request.application_binding.near_ed25519_signing_key_id,registrationCeremonyId:e.started.addSignerCeremonyId,admissionRequest:i.request,admissionReceipt:i.receipt,participantIds:i.request.participant_ids,routerOrigin:new URL(e.relayerUrl).origin,authorization:`Bearer ${String(e.intentResponse.addSignerIntentGrant)}`}),c=`ed25519:${Ee(o.metadata.registeredPublicKey)}`,l=await $n({relayerUrl:e.relayerUrl,walletId:e.walletId,addSignerCeremonyId:e.started.addSignerCeremonyId,idempotencyKey:km(`wallet-ed25519-add-signer-finalize`),kind:`near_ed25519`,ed25519:{activationReference:o.activationReference},custodyKeySet:{kind:`near_ed25519_v1`,keyManifestDigestB64u:o.commitPayload.keyManifestDigestB64u,registeredPublicKeyB64u:L(o.metadata.registeredPublicKey)}});if(l.kind!==`near_ed25519`)throw Error(`Wallet add-signer finalize returned a different signer branch`);let u=Xh({finalized:l,started:e.started,walletId:e.walletId,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,clientPublicKey:c});Uh(e.onEvent,e.eventAccountId,{authMethod:`passkey`,phase:B.STEP_08_STORAGE_PERSIST_STARTED,status:`running`});let d=await e.context.signingEngine.finalizeWalletEd25519SignerRegistration({walletId:e.walletId,nearAccountId:z(u.ed25519.nearAccountId),nearEd25519SigningKeyId:u.ed25519.nearEd25519SigningKeyId,auth:{kind:`passkey`,credential:e.credential},signerSlot:u.ed25519.signerSlot,operationalPublicKey:c,relayerKeyId:u.ed25519.relayerKeyId,keyVersion:u.ed25519.keyVersion,participantIds:[...u.ed25519.participantIds]});if(d.signerSlot!==u.ed25519.signerSlot)throw Error(`Wallet add-signer persisted a different Ed25519 signer slot`);t=d.rollbackReceipt;let f=e.started.ed25519.admissionRequest,p=s(f.scope.threshold_session_id);if(!p.ok)throw Error(`Wallet add-signer threshold-session identity is invalid`);let m=o.metadata;return await e.context.signingEngine.persistWalletCustodyEd25519Material({binding:{kind:Mn,applicationBindingDigestB64u:o.localMaterial.applicationBindingDigestB64u,registeredPublicKeyB64u:L(m.registeredPublicKey),participantIds:m.participantIds,stateEpoch:String(m.stateEpoch),walletId:String(u.walletId),nearAccountId:String(u.ed25519.nearAccountId),nearEd25519SigningKeyId:u.ed25519.nearEd25519SigningKeyId,signerSlot:u.ed25519.signerSlot,signingWorkerId:m.scope.signing_worker_id,signingWorkerVerifyingShareB64u:L(m.signingWorkerVerifyingShare)},sealed:{ciphertextB64u:o.localMaterial.b64u,nonceB64u:o.localMaterial.nonceB64u}}),n={nearAccountId:u.ed25519.nearAccountId,signerSlot:u.ed25519.signerSlot},await e.context.signingEngine.upsertEd25519YaoPublicCapabilityLaneReference({walletId:u.walletId,nearAccountId:z(u.ed25519.nearAccountId),thresholdSessionId:p.value,runtimePolicyScope:j(e.started.intent.runtimePolicyScope),materialActivation:Zn(m),auth:{kind:`passkey`,rpId:Mt(e.rpId),credentialIdB64u:e.credentialIdB64u},nearEd25519SigningKeyId:Xt(u.ed25519.nearEd25519SigningKeyId),signerSlot:u.ed25519.signerSlot}),t=null,Uh(e.onEvent,e.eventAccountId,{authMethod:`passkey`,phase:B.STEP_08_STORAGE_PERSIST_SUCCEEDED,status:`succeeded`}),{success:!0,kind:`wallet_signer_added`,walletId:u.walletId,capabilities:[{kind:`near_ed25519`,nearEd25519SigningKeyId:Xt(u.ed25519.nearEd25519SigningKeyId),operationalPublicKey:c,nearAccountId:z(u.ed25519.nearAccountId)}]}}catch(r){let i=[];if(n)try{await e.context.signingEngine.deleteWalletCustodyEd25519Material({nearAccountId:n.nearAccountId,signerSlot:n.signerSlot})}catch(e){i.push(e instanceof Error?e.message:String(e))}if(t)try{await e.context.signingEngine.rollbackWalletEd25519SignerRegistration(t)}catch(e){i.push(e instanceof Error?e.message:String(e))}if(i.length>0){let e=r instanceof Error?r.message:String(r);throw Error(`${e}; add-signer cleanup failed: ${i.join(`; `)}`)}throw r}finally{r&&Hp(r)}}async function $h(e){if(e.started.authorizationKind!==`webauthn_assertion`)throw Error(`Wallet custody ECDSA add-signer requires WebAuthn authorization`);let t=await Od({walletId:e.walletId,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u}),n=Uint8Array.from(R(e.passkeyPrfFirstB64u)).buffer,r;try{r=await Gc({context:e.context,relayerUrl:e.relayerUrl,walletId:e.walletId,addSignerCeremonyId:e.started.addSignerCeremonyId,started:e.started.ecdsa,custodyEnvelope:e.started.ecdsa.custodyEnvelope,factorSecret:n,authority:t,registrationTiming:null})}finally{Hp(n)}let i={relayerUrl:e.relayerUrl,walletId:e.walletId,addSignerCeremonyId:e.started.addSignerCeremonyId,idempotencyKey:km(`wallet-add-signer-finalize`),kind:`evm_family_ecdsa`,ecdsa:{expectedKeyHandles:[r.bootstrap.keyHandle]},custodyKeySet:r.custodyKeySet},a;try{a=await $n(i)}catch(e){if(!(e instanceof TypeError))throw e;a=await $n(i)}if(a.kind!==`evm_family_ecdsa`||a.walletId!==e.walletId||a.rpId!==e.rpId)throw Error(`Wallet add-signer finalize returned a different ECDSA identity`);let o=a.ecdsa.walletKeys,s=o[0];if(!s)throw Error(`Wallet add-signer finalize did not return ECDSA wallet keys`);let c=await Kc({context:e.context,pending:r});Uh(e.onEvent,e.eventAccountId,{authMethod:`passkey`,phase:B.STEP_08_STORAGE_PERSIST_STARTED,status:`running`});let l=await e.context.signingEngine.finalizeWalletRegistrationEcdsaSessions({walletId:Ie(e.walletId),session:c,walletKeys:[s,...o.slice(1)]});return await e.context.signingEngine.storeWalletEcdsaSignerRecords({walletId:e.walletId,walletKeys:l}),await V.adoptAddedEcdsaSignerAuthority({authority:a.authority,materialActivation:c.materialActivation}),Uh(e.onEvent,e.eventAccountId,{authMethod:`passkey`,phase:B.STEP_08_STORAGE_PERSIST_SUCCEEDED,status:`succeeded`}),{success:!0,kind:`wallet_signer_added`,walletId:e.walletId,capabilities:[{kind:`evm_family_ecdsa`,thresholdEcdsaEthereumAddress:s.thresholdOwnerAddress,thresholdEcdsaPublicKeyB64u:s.thresholdEcdsaPublicKeyB64u}]}}async function eg(e){switch(e.signerSelection.mode){case`ed25519`:if(e.started.kind!==`near_ed25519`)throw Error(`Wallet add-signer start returned a different signer branch`);return await Qh({context:e.input.context,walletId:e.input.walletId,rpId:e.input.rpId,relayerUrl:e.input.relayerUrl,intentResponse:e.input.intentResponse,credential:e.input.credential,credentialIdB64u:e.input.credentialIdB64u,passkeyPrfFirstB64u:e.input.passkeyPrfFirstB64u,eventAccountId:e.input.eventAccountId,onEvent:e.input.onEvent,started:e.started});case`ecdsa`:if(e.started.kind!==`evm_family_ecdsa`)throw Error(`Wallet add-signer start returned a different signer branch`);return await $h({context:e.input.context,walletId:e.input.walletId,rpId:e.input.rpId,relayerUrl:e.input.relayerUrl,intentResponse:e.input.intentResponse,credential:e.input.credential,credentialIdB64u:e.input.credentialIdB64u,passkeyPrfFirstB64u:e.input.passkeyPrfFirstB64u,eventAccountId:e.input.eventAccountId,onEvent:e.input.onEvent,started:e.started});default:return q(e.signerSelection)}}async function tg(e){let{context:t,signerSelection:n}=e,r=e.options||{},i=$t(String(e.walletId||``).trim()),a=Pm(String(i)),o=Sp(String(e.rpId||``).trim());Uh(r.onEvent,a,{authMethod:`passkey`,phase:B.STEP_01_STARTED,status:`started`});try{let e=String(t.configs.network.relayer.url||``).trim();if(!e)throw Error(`addSigner requires relayer.url`);let s=Ed(t.configs);if(!s)throw Error(`addSigner requires registration.publishableKey and registration.projectEnvironmentId`);let c=await qn({relayerUrl:e,walletId:i,request:{walletId:i,rpId:o,signerSelection:n},auth:{publishableKey:s.publishableKey,environmentId:s.projectEnvironmentId}});if(await vr(c.intent)!==c.addSignerIntentDigestB64u)throw Error(`Add-signer intent digest mismatch`);Uh(r.onEvent,a,{authMethod:`passkey`,phase:B.STEP_04_PASSKEY_CREATE_STARTED,status:`waiting_for_user`,interaction:{kind:`passkey_assert`,overlay:`show`}});let l=Kh(await V.listProfileAuthenticators(String(i))),u=await t.signingEngine.getAuthenticationCredentialsSerialized({subjectId:String(i),challengeB64u:c.addSignerIntentDigestB64u,allowCredentials:l,includeSecondPrfOutput:!1}),d=qh(u,l),f=fr(u,`Wallet add-signer authorization`);Uh(r.onEvent,a,{authMethod:`passkey`,phase:B.STEP_04_PASSKEY_CREATE_SUCCEEDED,status:`succeeded`,interaction:{kind:`passkey_assert`,overlay:`hide`}});let p=await Kn({relayerUrl:e,walletId:i,addSignerIntentGrant:c.addSignerIntentGrant,addSignerIntentDigestB64u:c.addSignerIntentDigestB64u,intent:c.intent,auth:{kind:`webauthn_assertion`,rpId:o,credential:An(u),expectedChallengeDigestB64u:c.addSignerIntentDigestB64u}});await Jh({started:p,walletId:i,expectedDigestB64u:c.addSignerIntentDigestB64u});let m=await eg({input:{context:t,walletId:i,rpId:o,relayerUrl:e,intentResponse:c,credential:u,credentialIdB64u:d,passkeyPrfFirstB64u:f,eventAccountId:a,onEvent:r.onEvent},signerSelection:n,started:p});return Uh(r.onEvent,a,{authMethod:`passkey`,phase:B.STEP_11_COMPLETED,status:`succeeded`}),Gh(r.afterCall,!0,m),m}catch(e){let t=Fm(e),n=Se(e,`registration`,a);Wh(r.onError,Im(n,t)),Uh(r.onEvent,a,{authMethod:`passkey`,phase:B.FAILED,status:`failed`,message:n,interaction:{kind:`passkey_assert`,overlay:`hide`},error:{...t?{code:t}:{},message:n}});let i={success:!1,error:n,...t?{errorCode:t}:{}};return Gh(r.afterCall,!1),i}}export{ou as $,Fr as $t,Od as A,Ls as At,Pu as B,lo as Bt,gf as C,fc as Ct,Gd as D,Js as Dt,Rd as E,Xs as Et,wd as F,Bs as Ft,fu as G,pa as Gt,yu as H,ya as Ht,gd as I,cs as It,lu as J,da as Jt,su as K,ma as Kt,md as L,Do as Lt,Ed as M,Zs as Mt,Sd as N,Ws as Nt,Wd as O,zs as Ot,xd as P,Us as Pt,nu as Q,Ir as Qt,hd as R,go as Rt,Cf as S,ic as St,uf as T,vc as Tt,Su as U,_a as Ut,Nu as V,va as Vt,xu as W,ga as Wt,ru as X,Yr as Xt,du as Y,ia as Yt,iu as Z,Lr as Zt,Mf as _,wc as _t,Hh as a,Yl as at,Qf as b,sc as bt,xp as c,Bl as ct,yp as d,Ml as dt,Hr as en,tu as et,vp as f,jl as ft,ip as g,Sc as gt,np as h,xc as ht,Dm as i,Il as it,Dd as j,Fs as jt,Ad as k,Rs as kt,bp as l,Xl as lt,dp as m,jc as mt,Tm as n,Pr as nn,Fl as nt,Rp as o,zl as ot,lp as p,Yc as pt,uu as q,Pi as qt,wm as r,Nl as rt,Em as s,Jl as st,tg as t,Nr as tn,Ql as tt,_p as u,Al as ut,$f as v,Cc as vt,pf as w,gc as wt,Gf as x,ac as xt,Wf as y,Oc as yt,fd as z,co as zt};