@seams/wallet 0.23.0 → 0.24.0

package/dist/esm/sdk/walletAuthMethodRecord-Cv_MYpxt.js

@@ -1 +0,0 @@
-import{D as e,M as t,O as n,T as r,j as i}from"./domainIds-C3fUa33Q.js";import{c as a}from"./chains-CPmd4s9f.js";import{o}from"./canonicalPrimitives-D_1HyEuJ.js";import{i as s,t as c}from"./registrationAuthMethodInput-DKz6Mgg4.js";async function l(e){return o(a({version:`wallet_auth_method_revoke_operation_v1`,walletId:String(e.walletId),targetWalletAuthMethodId:String(e.targetWalletAuthMethodId),requestedAtMs:e.requestedAtMs}))}function u(e,t){if(e.version!==t.version||e.walletAuthMethodId!==t.walletAuthMethodId||e.walletId!==t.walletId||e.walletAuthorityId!==t.walletAuthorityId||e.status!==t.status||e.createdAtMs!==t.createdAtMs||e.updatedAtMs!==t.updatedAtMs)return!1;switch(e.kind){case`passkey`:if(t.kind!==`passkey`)return!1;if(e.rpId===t.rpId&&e.credentialIdB64u===t.credentialIdB64u&&e.credentialPublicKeyB64u===t.credentialPublicKeyB64u&&e.counter===t.counter)break;return!1;case`email_otp`:if(t.kind!==`email_otp`)return!1;if(e.emailHashHex===t.emailHashHex&&e.registrationAuthorityId===t.registrationAuthorityId)break;return!1;default:return d(e,`wallet auth method kind`)}switch(e.status){case`pending_local_install`:return t.status===`pending_local_install`;case`active`:return t.status===`active`&&e.activatedAtMs===t.activatedAtMs;case`revoked`:return t.status===`revoked`&&e.activatedAtMs===t.activatedAtMs&&e.revokedAtMs===t.revokedAtMs;default:return d(e,`wallet auth method lifecycle`)}}function d(e,t){throw Error(`${t} branch is unsupported: ${String(e)}`)}function f(e){if(h(e),e.kind===`passkey`)switch(e.status){case`pending_local_install`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.walletAuthMethodId,walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,kind:`passkey`,status:`pending_local_install`,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,credentialPublicKeyB64u:e.credentialPublicKeyB64u,counter:e.counter,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs};case`active`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.walletAuthMethodId,walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,kind:`passkey`,status:`active`,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,credentialPublicKeyB64u:e.credentialPublicKeyB64u,counter:e.counter,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs,activatedAtMs:e.activatedAtMs};case`revoked`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.walletAuthMethodId,walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,kind:`passkey`,status:`revoked`,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,credentialPublicKeyB64u:e.credentialPublicKeyB64u,counter:e.counter,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs,activatedAtMs:e.activatedAtMs,revokedAtMs:e.revokedAtMs}}switch(e.status){case`pending_local_install`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.walletAuthMethodId,walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,kind:`email_otp`,status:`pending_local_install`,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs};case`active`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.walletAuthMethodId,walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,kind:`email_otp`,status:`active`,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs,activatedAtMs:e.activatedAtMs};case`revoked`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.walletAuthMethodId,walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,kind:`email_otp`,status:`revoked`,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs,activatedAtMs:e.activatedAtMs,revokedAtMs:e.revokedAtMs}}}function p(e){let n=c(e);if(!n||!(`version`in n)||!(`kind`in n)||!(`status`in n))return null;let r=s(n.version),a=s(n.kind),o=s(n.status);if(r!==`wallet_auth_method_v2`||a!==`passkey`&&a!==`email_otp`)return null;try{let e=m(n);if(a===`passkey`){if(!(`rpId`in n)||!(`credentialIdB64u`in n)||!(`credentialPublicKeyB64u`in n)||!(`counter`in n))return null;_(n,`passkey`,o);let r=t(n.rpId),a=i(n.credentialIdB64u);return!r.ok||!a.ok||typeof n.credentialPublicKeyB64u!=`string`||!n.credentialPublicKeyB64u.trim()||Object.prototype.hasOwnProperty.call(n,`emailHashHex`)||Object.prototype.hasOwnProperty.call(n,`registrationAuthorityId`)?null:v({common:e,lifecycle:g(n),rpId:r.value,credentialIdB64u:a.value,credentialPublicKeyB64u:n.credentialPublicKeyB64u,counter:C(n.counter)})}if(!(`emailHashHex`in n)||!(`registrationAuthorityId`in n))return null;_(n,`email_otp`,o);let r=s(n.emailHashHex),c=s(n.registrationAuthorityId);return!r||!c||Object.prototype.hasOwnProperty.call(n,`rpId`)||Object.prototype.hasOwnProperty.call(n,`credentialIdB64u`)||Object.prototype.hasOwnProperty.call(n,`credentialPublicKeyB64u`)||Object.prototype.hasOwnProperty.call(n,`counter`)?null:y({common:e,lifecycle:g(n),emailHashHex:r,registrationAuthorityId:c})}catch{return null}}function m(e){if(!(`walletAuthMethodId`in e)||!(`walletId`in e)||!(`walletAuthorityId`in e)||!(`createdAtMs`in e)||!(`updatedAtMs`in e))throw Error(`wallet auth method common fields are required`);return{version:`wallet_auth_method_v2`,walletAuthMethodId:b(e.walletAuthMethodId),walletId:x(e.walletId),walletAuthorityId:S(e.walletAuthorityId),createdAtMs:C(e.createdAtMs),updatedAtMs:C(e.updatedAtMs)}}function h(e){if(e.version!==`wallet_auth_method_v2`)throw Error(`wallet auth method record version is unsupported`);if(!e.walletAuthMethodId||!e.walletId||!e.walletAuthorityId)throw Error(`wallet auth method record identities are required`);if(!Number.isSafeInteger(e.createdAtMs)||e.createdAtMs<0)throw Error(`wallet auth method createdAtMs must be a non-negative safe integer`);if(!Number.isSafeInteger(e.updatedAtMs)||e.updatedAtMs<e.createdAtMs)throw Error(`wallet auth method updatedAtMs must follow createdAtMs`);if(e.kind===`passkey`){if(!e.rpId||!e.credentialIdB64u||!e.credentialPublicKeyB64u.trim())throw Error(`passkey wallet auth method fields are required`);if(!Number.isSafeInteger(e.counter)||e.counter<0)throw Error(`passkey authenticator counter must be non-negative`)}else if(!e.emailHashHex.trim()||!e.registrationAuthorityId.trim())throw Error(`email OTP wallet auth method fields are required`);switch(e.status){case`pending_local_install`:return;case`active`:w(e.activatedAtMs,`activatedAtMs`);return;case`revoked`:if(w(e.activatedAtMs,`activatedAtMs`),w(e.revokedAtMs,`revokedAtMs`),e.revokedAtMs<e.activatedAtMs)throw Error(`revokedAtMs cannot precede activatedAtMs`);return}}function g(e){if(!(`status`in e))throw Error(`wallet auth method status is required`);switch(e.status){case`pending_local_install`:return{status:`pending_local_install`};case`active`:if(!(`activatedAtMs`in e))throw Error(`wallet auth method activatedAtMs is required`);return{status:`active`,activatedAtMs:C(e.activatedAtMs)};case`revoked`:if(!(`activatedAtMs`in e)||!(`revokedAtMs`in e))throw Error(`wallet auth method revocation timestamps are required`);return{status:`revoked`,activatedAtMs:C(e.activatedAtMs),revokedAtMs:C(e.revokedAtMs)};default:throw Error(`wallet auth method status is unsupported`)}}function _(e,t,n){let r=[`version`,`walletAuthMethodId`,`walletId`,`walletAuthorityId`,`kind`,`status`,`createdAtMs`,`updatedAtMs`];if(t===`passkey`?r.push(`rpId`,`credentialIdB64u`,`credentialPublicKeyB64u`,`counter`):r.push(`emailHashHex`,`registrationAuthorityId`),n===`active`&&r.push(`activatedAtMs`),n===`revoked`&&r.push(`activatedAtMs`,`revokedAtMs`),n!==`pending_local_install`&&n!==`active`&&n!==`revoked`)throw Error(`wallet auth method status is unsupported`);let i=new Set(r),a=Object.keys(e);if(a.length!==r.length)throw Error(`wallet auth method record has invalid fields`);for(let e of a)if(!i.has(e))throw Error(`wallet auth method field ${e} is invalid`)}function v(e){switch(e.lifecycle.status){case`pending_local_install`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.common.walletAuthMethodId,walletId:e.common.walletId,walletAuthorityId:e.common.walletAuthorityId,kind:`passkey`,status:`pending_local_install`,createdAtMs:e.common.createdAtMs,updatedAtMs:e.common.updatedAtMs,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,credentialPublicKeyB64u:e.credentialPublicKeyB64u,counter:e.counter};case`active`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.common.walletAuthMethodId,walletId:e.common.walletId,walletAuthorityId:e.common.walletAuthorityId,kind:`passkey`,status:`active`,createdAtMs:e.common.createdAtMs,updatedAtMs:e.common.updatedAtMs,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,credentialPublicKeyB64u:e.credentialPublicKeyB64u,counter:e.counter,activatedAtMs:e.lifecycle.activatedAtMs};case`revoked`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.common.walletAuthMethodId,walletId:e.common.walletId,walletAuthorityId:e.common.walletAuthorityId,kind:`passkey`,status:`revoked`,createdAtMs:e.common.createdAtMs,updatedAtMs:e.common.updatedAtMs,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,credentialPublicKeyB64u:e.credentialPublicKeyB64u,counter:e.counter,activatedAtMs:e.lifecycle.activatedAtMs,revokedAtMs:e.lifecycle.revokedAtMs}}}function y(e){switch(e.lifecycle.status){case`pending_local_install`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.common.walletAuthMethodId,walletId:e.common.walletId,walletAuthorityId:e.common.walletAuthorityId,kind:`email_otp`,status:`pending_local_install`,createdAtMs:e.common.createdAtMs,updatedAtMs:e.common.updatedAtMs,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId};case`active`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.common.walletAuthMethodId,walletId:e.common.walletId,walletAuthorityId:e.common.walletAuthorityId,kind:`email_otp`,status:`active`,createdAtMs:e.common.createdAtMs,updatedAtMs:e.common.updatedAtMs,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,activatedAtMs:e.lifecycle.activatedAtMs};case`revoked`:return{version:`wallet_auth_method_v2`,walletAuthMethodId:e.common.walletAuthMethodId,walletId:e.common.walletId,walletAuthorityId:e.common.walletAuthorityId,kind:`email_otp`,status:`revoked`,createdAtMs:e.common.createdAtMs,updatedAtMs:e.common.updatedAtMs,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,activatedAtMs:e.lifecycle.activatedAtMs,revokedAtMs:e.lifecycle.revokedAtMs}}}function b(e){let t=r(e);if(!t.ok)throw Error(t.error.message);return t.value}function x(e){let t=n(e);if(!t.ok)throw Error(t.error.message);return t.value}function S(t){let n=e(t);if(!n.ok)throw Error(n.error.message);return n.value}function C(e){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`value must be a non-negative safe integer`);return e}function w(e,t){if(!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`)}export{u as i,l as n,p as r,f as t};

package/dist/esm/sdk/walletCapabilityBindings-CKOK39sP.js

@@ -1 +0,0 @@
-import{A as e,D as t,M as n,O as r,h as i,k as a,l as o,r as s,u as c}from"./domainIds-C3fUa33Q.js";import{A as l,k as u,l as d}from"./chains-CPmd4s9f.js";import{D as ee,K as f,M as p,O as m,P as h,R as te}from"./activeWalletSession-BtEHhe99.js";import{i as g,r as ne}from"./base64-BmKR3UqU.js";import{l as re}from"./capabilityKinds-CqHVzVsJ.js";import{r as ie}from"./canonicalPrimitives-D_1HyEuJ.js";import{c as ae,s as oe}from"./accountIds-BzZs7YoX.js";import{F as se,I as ce,L as _,N as v,P as y,R as le,dn as ue,ln as de,pt as fe,rn as pe,sn as b,z as me}from"./emailOtpEcdsaDerivationIdentity-DreNrM6n.js";import{i as he}from"./signerSlot-CpyIfl3J.js";const ge=[`kind`,`keyFamilies`,`signers`],_e=[`kind`,`keyFamily`,`walletId`,`walletKeyId`,`registeredPublicKeyB64u`],ve=[`kind`,`keyFamily`,`walletId`,`walletKeyId`,`thresholdPublicKey33B64u`,`evmAddress`];function x(e){if(e.length===0)throw Error(`exact administered signer manifest must contain at least one active family`);let t,n,r,i=new Set;for(let a of e){if(t!==void 0&&t!==a.walletId)throw Error(`exact administered signer manifest must use one wallet identity`);if(t=a.walletId,i.has(a.walletKeyId))throw Error(`exact administered signer manifest repeats wallet key ${a.walletKeyId}`);switch(i.add(a.walletKeyId),a.keyFamily){case`ed25519`:if(n!==void 0)throw Error(`exact administered signer manifest repeats the ed25519 family`);if(a.kind!==`exact_administered_ed25519_signer_v1`)throw Error(`exact administered signer manifest has an invalid Ed25519 signer`);n=a;break;case`ecdsa_secp256k1`:if(r!==void 0)throw Error(`exact administered signer manifest repeats the ecdsa family`);if(a.kind!==`exact_administered_ecdsa_signer_v1`)throw Error(`exact administered signer manifest has an invalid ECDSA signer`);r=a;break}}if(n!==void 0&&r!==void 0)return{kind:`exact_administered_signer_manifest_v1`,keyFamilies:[`ed25519`,`ecdsa_secp256k1`],signers:[n,r]};if(n!==void 0)return{kind:`exact_administered_signer_manifest_v1`,keyFamilies:[`ed25519`],signers:[n]};if(r!==void 0)return{kind:`exact_administered_signer_manifest_v1`,keyFamilies:[`ecdsa_secp256k1`],signers:[r]};throw Error(`exact administered signer manifest must contain a supported family`)}function ye(e){let t=we(e,ge,`ExactAdministeredSignerManifestV1`);if(t.kind!==`exact_administered_signer_manifest_v1`)throw Error(`ExactAdministeredSignerManifestV1.kind is invalid`);let n=xe(t.keyFamilies);if(!Array.isArray(t.signers))throw Error(`ExactAdministeredSignerManifestV1.signers must be an array`);let r=[];for(let e=0;e<t.signers.length;e+=1)r.push(be(t.signers[e],`signers[${e}]`));let i=x(r);if(!Se(n,i.keyFamilies))throw Error(`ExactAdministeredSignerManifestV1.keyFamilies do not match signers`);return i}function be(e,t){let n=u(e,t);switch(n.keyFamily){case`ed25519`:if(f(n,_e,t),n.kind!==`exact_administered_ed25519_signer_v1`)throw Error(`${t}.kind is invalid for Ed25519`);return{kind:`exact_administered_ed25519_signer_v1`,keyFamily:`ed25519`,walletId:h(r(n.walletId),`${t}.walletId`),walletKeyId:h(a(n.walletKeyId),`${t}.walletKeyId`),registeredPublicKeyB64u:ee(n.registeredPublicKeyB64u,`${t}.registeredPublicKeyB64u`)};case`ecdsa_secp256k1`:if(f(n,ve,t),n.kind!==`exact_administered_ecdsa_signer_v1`)throw Error(`${t}.kind is invalid for ECDSA`);return{kind:`exact_administered_ecdsa_signer_v1`,keyFamily:`ecdsa_secp256k1`,walletId:h(r(n.walletId),`${t}.walletId`),walletKeyId:h(a(n.walletKeyId),`${t}.walletKeyId`),thresholdPublicKey33B64u:p(n.thresholdPublicKey33B64u,`${t}.thresholdPublicKey33B64u`),evmAddress:Ce(n.evmAddress,`${t}.evmAddress`)};default:throw Error(`${t}.keyFamily is unsupported`)}}function xe(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`ExactAdministeredSignerManifestV1.keyFamilies must be non-empty`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`ExactAdministeredSignerManifestV1.keyFamilies must be canonical and duplicate-free`)}function Se(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function Ce(e,t){if(typeof e!=`string`||!/^0x[0-9a-fA-F]{40}$/.test(e))throw Error(`${t} must be a 20-byte hexadecimal EVM address`);return e}function we(e,t,n){let r=u(e,n);f(r,t,n);for(let e of t)if(!(e in r))throw Error(`${n}.${e} is required`);return r}const S=new TextEncoder;function C(e,t){if(typeof e!=`string`||e.length===0)throw Error(`${t} must be a non-empty visible ASCII string`);for(let n=0;n<e.length;n+=1){let r=e.charCodeAt(n);if(r<33||r>126)throw Error(`${t} must contain visible ASCII bytes`)}return e}function Te(e,t){if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`${t} must be a byte`);return e}function Ee(e,t,n,r){if(!Array.isArray(e))throw Error(`${t} must be a byte array`);if(e.length<n||e.length>r)throw Error(`${t} has an invalid length`);let i=[];for(let n=0;n<e.length;n+=1)i.push(Te(e[n],`${t}[${n}]`));return i}function w(e,t,n){let r=Ee(e,t,32,32);if(n&&De(r))throw Error(`${t} must be nonzero`);return r}function De(e){for(let t of e)if(t!==0)return!1;return!0}function T(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function Oe(e){let t=new Uint8Array(4);return new DataView(t.buffer).setUint32(0,e,!1),t}function ke(e){let t=0;for(let n of e)t+=n.length;let n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function Ae(e){return ke([Oe(e.length),e])}function je(e,t){return ke([Ae(S.encode(e)),Ae(t)])}async function Me(e){let t=await globalThis.crypto.subtle.digest(`SHA-256`,e);return new Uint8Array(t)}async function Ne(e){let t=ke([Ae(S.encode(`seams/router-ab/ed25519-yao/application-binding/v1`)),je(`walletId`,S.encode(e.wallet_id)),je(`nearEd25519SigningKeyId`,S.encode(e.near_ed25519_signing_key_id)),je(`signingRootId`,S.encode(e.signing_root_id)),je(`keyCreationSignerSlot`,Oe(e.key_creation_signer_slot))]);return Array.from(await Me(t))}const Pe=`/router-ab/ed25519/yao/registration/admit`,Fe=`/router-ab/ed25519/yao/registration/execute`,Ie=`/router-ab/ed25519/yao/recovery/admit`,Le=`/router-ab/ed25519/yao/recovery/execute`,Re=`/router-ab/ed25519/yao/recovery/activate`,ze=`x-seams-wallet-recovery-challenge-id`,Be=`/router-ab/ed25519/yao/recovery/bootstrap`,Ve=`router_ab_ed25519_yao_email_otp_recovery_v1`,He=`/router-ab/ed25519/yao/export/admit`,Ue=`/router-ab/ed25519/yao/export/execute`,We=64*1024;function Ge(e,t){return e.operation===t.operation&&E(e.session_id,t.session_id)&&E(e.stable_key_context_binding,t.stable_key_context_binding)&&ue(e.material_activation,t.material_activation)&&e.lifecycle.lifecycle_id===t.lifecycle.lifecycle_id&&e.lifecycle.work_kind===t.lifecycle.work_kind&&e.lifecycle.primitive_request_kind===t.lifecycle.primitive_request_kind&&e.lifecycle.root_share_epoch===t.lifecycle.root_share_epoch&&e.lifecycle.account_id===t.lifecycle.account_id&&e.lifecycle.session_id===t.lifecycle.session_id&&e.lifecycle.signer_set_id===t.lifecycle.signer_set_id&&e.lifecycle.selected_server_id===t.lifecycle.selected_server_id}function E(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function Ke(e,t){return e[0]===t[0]&&e[1]===t[1]}function qe(e,t){return e.lifecycle_id===t.lifecycle_id&&e.root_share_epoch===t.root_share_epoch&&e.account_id===t.account_id&&e.threshold_session_id===t.threshold_session_id&&e.signer_set_id===t.signer_set_id&&e.signing_worker_id===t.signing_worker_id&&ue(e.material_activation,t.material_activation)}function Je(e,t){return e.wallet_id===t.wallet_id&&e.near_ed25519_signing_key_id===t.near_ed25519_signing_key_id&&e.signing_root_id===t.signing_root_id&&e.key_creation_signer_slot===t.key_creation_signer_slot}function Ye(e,t){return qe(e.scope,t.scope)&&Je(e.application_binding,t.application_binding)&&Ke(e.participant_ids,t.participant_ids)}const D=`registration_prepare`,Xe=`registration`,O=`recovery`,Ze=`recovery`,k=`key_export`,Qe=`export`;function A(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`);for(let r of n)if(!Object.hasOwn(e,r))throw Error(`${t}.${r} is required`)}function $e(e,t){if(!Number.isInteger(e)||typeof e!=`number`||e<=0||e>4294967295)throw Error(`${t} must be a positive u32`);return e}function et(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe integer`);return e}function tt(e,t){switch(e){case`registration`:case`recovery`:case`refresh`:case`export`:case`lane_provisioning`:case`lane_refresh`:return e;default:throw Error(`${t} is invalid`)}}function nt(e,t){switch(e){case`deriver_a`:case`deriver_b`:return e;default:throw Error(`${t} is invalid`)}}function rt(e,t){switch(e){case`activation`:case`export`:return e;default:throw Error(`${t} is invalid`)}}function it(e,t){switch(e){case`activation_client`:case`activation_signing_worker`:case`export_client`:return e;default:throw Error(`${t} is invalid`)}}function at(e,t){switch(e){case`registration_prepare`:case`key_export`:case`recovery`:case`server_share_refresh`:return e;default:throw Error(`${t} is invalid`)}}function ot(e,t){switch(e){case`registration`:case`recovery`:case`export`:case`refresh`:return e;default:throw Error(`${t} is invalid`)}}function st(e){let t=u(e,`application_binding`);return A(t,`application_binding`,[`wallet_id`,`near_ed25519_signing_key_id`,`signing_root_id`,`key_creation_signer_slot`]),{wallet_id:C(t.wallet_id,`application_binding.wallet_id`),near_ed25519_signing_key_id:C(t.near_ed25519_signing_key_id,`application_binding.near_ed25519_signing_key_id`),signing_root_id:C(t.signing_root_id,`application_binding.signing_root_id`),key_creation_signer_slot:$e(t.key_creation_signer_slot,`application_binding.key_creation_signer_slot`)}}function ct(e){let t=u(e,`scope`);A(t,`scope`,[`lifecycle_id`,`root_share_epoch`,`account_id`,`threshold_session_id`,`signer_set_id`,`signing_worker_id`,`material_activation`]);let n=C(t.account_id,`scope.account_id`),r=C(t.signing_worker_id,`scope.signing_worker_id`),i=b(t.material_activation);if(i.material_owner!==n||i.signing_worker!==r)throw Error(`scope.material_activation does not match the lifecycle owner and worker`);return{lifecycle_id:C(t.lifecycle_id,`scope.lifecycle_id`),root_share_epoch:C(t.root_share_epoch,`scope.root_share_epoch`),account_id:n,threshold_session_id:C(t.threshold_session_id,`scope.threshold_session_id`),signer_set_id:C(t.signer_set_id,`scope.signer_set_id`),signing_worker_id:r,material_activation:i}}function lt(e){if(!Array.isArray(e)||e.length!==2)throw Error(`participant_ids must contain exactly two values`);let t=$e(e[0],`participant_ids[0]`),n=$e(e[1],`participant_ids[1]`);if(t>65535||n>65535||t>=n)throw Error(`participant_ids must be distinct, nonzero, ascending u16 values`);return[t,n]}function ut(e){return lt(e)}function dt(e){let t=u(e,`binding.lifecycle`);A(t,`binding.lifecycle`,[`lifecycle_id`,`work_kind`,`primitive_request_kind`,`root_share_epoch`,`account_id`,`session_id`,`signer_set_id`,`selected_server_id`]);let n={lifecycle_id:C(t.lifecycle_id,`binding.lifecycle.lifecycle_id`),work_kind:at(t.work_kind,`binding.lifecycle.work_kind`),primitive_request_kind:ot(t.primitive_request_kind,`binding.lifecycle.primitive_request_kind`),root_share_epoch:C(t.root_share_epoch,`binding.lifecycle.root_share_epoch`),account_id:C(t.account_id,`binding.lifecycle.account_id`),session_id:C(t.session_id,`binding.lifecycle.session_id`),signer_set_id:C(t.signer_set_id,`binding.lifecycle.signer_set_id`),selected_server_id:C(t.selected_server_id,`binding.lifecycle.selected_server_id`)};if(n.work_kind===D&&n.primitive_request_kind!==Xe||n.work_kind===O&&n.primitive_request_kind!==Ze||n.work_kind===k&&n.primitive_request_kind!==Qe)throw Error(`binding.lifecycle primitive request kind does not match its work kind`);return n}function ft(e){let t=u(e,`binding`);A(t,`binding`,[`lifecycle`,`operation`,`session_id`,`stable_key_context_binding`,`material_activation`]);let n={lifecycle:dt(t.lifecycle),operation:tt(t.operation,`binding.operation`),session_id:w(t.session_id,`binding.session_id`,!0),stable_key_context_binding:w(t.stable_key_context_binding,`binding.stable_key_context_binding`,!1),material_activation:b(t.material_activation)};if(n.operation===`registration`&&n.lifecycle.work_kind!==D||n.operation===`recovery`&&n.lifecycle.work_kind!==O||n.operation===`export`&&n.lifecycle.work_kind!==k)throw Error(`binding operation does not match its lifecycle work kind`);if(n.material_activation.material_owner!==n.lifecycle.account_id||n.material_activation.signing_worker!==n.lifecycle.selected_server_id)throw Error(`binding material activation does not match its lifecycle owner and worker`);return n}function pt(e){return ft(e)}function mt(e){let t=ft(e);if(t.operation!==`export`||t.lifecycle.work_kind!==k||t.lifecycle.primitive_request_kind!==Qe)throw Error(`export binding requires the exact export lifecycle`);return{lifecycle:{lifecycle_id:t.lifecycle.lifecycle_id,work_kind:k,primitive_request_kind:Qe,root_share_epoch:t.lifecycle.root_share_epoch,account_id:t.lifecycle.account_id,session_id:t.lifecycle.session_id,signer_set_id:t.lifecycle.signer_set_id,selected_server_id:t.lifecycle.selected_server_id},operation:`export`,session_id:t.session_id,stable_key_context_binding:t.stable_key_context_binding,material_activation:t.material_activation}}function ht(e){let t=u(e,`export binding`);return A(t,`export binding`,[`ceremony`,`registered_public_key`,`state_epoch`,`runtime_policy_binding`,`authorization_digest`]),{ceremony:mt(t.ceremony),registered_public_key:w(t.registered_public_key,`export binding.registered_public_key`,!0),state_epoch:et(t.state_epoch,`export binding.state_epoch`),runtime_policy_binding:w(t.runtime_policy_binding,`export binding.runtime_policy_binding`,!0),authorization_digest:w(t.authorization_digest,`export binding.authorization_digest`,!0)}}function j(e){let t=ft(e);switch(t.operation){case`registration`:if(t.lifecycle.work_kind!==D||t.lifecycle.primitive_request_kind!==Xe)throw Error(`activation binding has the wrong registration lifecycle kind`);return{lifecycle:{lifecycle_id:t.lifecycle.lifecycle_id,work_kind:D,primitive_request_kind:Xe,root_share_epoch:t.lifecycle.root_share_epoch,account_id:t.lifecycle.account_id,session_id:t.lifecycle.session_id,signer_set_id:t.lifecycle.signer_set_id,selected_server_id:t.lifecycle.selected_server_id},operation:`registration`,session_id:t.session_id,stable_key_context_binding:t.stable_key_context_binding,material_activation:t.material_activation};case`recovery`:if(t.lifecycle.work_kind!==O||t.lifecycle.primitive_request_kind!==Ze)throw Error(`activation binding has the wrong recovery lifecycle kind`);return{lifecycle:{lifecycle_id:t.lifecycle.lifecycle_id,work_kind:O,primitive_request_kind:Ze,root_share_epoch:t.lifecycle.root_share_epoch,account_id:t.lifecycle.account_id,session_id:t.lifecycle.session_id,signer_set_id:t.lifecycle.signer_set_id,selected_server_id:t.lifecycle.selected_server_id},operation:`recovery`,session_id:t.session_id,stable_key_context_binding:t.stable_key_context_binding,material_activation:t.material_activation};case`refresh`:case`export`:case`lane_provisioning`:case`lane_refresh`:throw Error(`activation binding has a non-activation operation`)}}function gt(e){let t=u(e,`keyset`);A(t,`keyset`,[`deriver_a_input_public_key`,`deriver_b_input_public_key`,`signing_worker_recipient_public_key`]);let n={deriver_a_input_public_key:w(t.deriver_a_input_public_key,`keyset.deriver_a_input_public_key`,!0),deriver_b_input_public_key:w(t.deriver_b_input_public_key,`keyset.deriver_b_input_public_key`,!0),signing_worker_recipient_public_key:w(t.signing_worker_recipient_public_key,`keyset.signing_worker_recipient_public_key`,!0)};if(T(n.deriver_a_input_public_key,n.deriver_b_input_public_key)||T(n.deriver_a_input_public_key,n.signing_worker_recipient_public_key)||T(n.deriver_b_input_public_key,n.signing_worker_recipient_public_key))throw Error(`keyset public keys must be distinct`);return n}function _t(e,t){let n=u(e,t);A(n,t,[`kind`,`deriver`,`operation`,`session`,`stable_context_binding`,`encapsulated_key`,`ciphertext`]);let r={kind:rt(n.kind,`${t}.kind`),deriver:nt(n.deriver,`${t}.deriver`),operation:tt(n.operation,`${t}.operation`),session:w(n.session,`${t}.session`,!0),stable_context_binding:w(n.stable_context_binding,`${t}.stable_context_binding`,!0),encapsulated_key:w(n.encapsulated_key,`${t}.encapsulated_key`,!0),ciphertext:Ee(n.ciphertext,`${t}.ciphertext`,16,We)};if(r.kind===`activation`&&r.operation===`export`||r.kind===`export`&&r.operation!==`export`)throw Error(`${t} operation does not match its circuit family`);return r}function vt(e,t,n,r){if(t.kind!==`activation`||t.deriver!==n||t.operation!==e.operation||!T(t.session,e.session_id)||!T(t.stable_context_binding,e.stable_key_context_binding))throw Error(`${r} does not match the admitted activation binding`);switch(e.operation){case`registration`:return{kind:`activation`,deriver:n,operation:`registration`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext};case`recovery`:return{kind:`activation`,deriver:n,operation:`recovery`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext}}}function yt(e,t,n,r){if(t.kind!==`export`||t.deriver!==n||t.operation!==`export`||!T(t.session,e.ceremony.session_id)||!T(t.stable_context_binding,e.ceremony.stable_key_context_binding))throw Error(`${r} does not match the admitted export binding`);return{kind:`export`,deriver:n,operation:`export`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext}}function M(e,t){let n=u(e,t);return A(n,t,[`kind`,`deriver`,`session`,`transcript`,`encapsulated_key`,`ciphertext`]),{kind:it(n.kind,`${t}.kind`),deriver:nt(n.deriver,`${t}.deriver`),session:w(n.session,`${t}.session`,!0),transcript:w(n.transcript,`${t}.transcript`,!0),encapsulated_key:w(n.encapsulated_key,`${t}.encapsulated_key`,!0),ciphertext:Ee(n.ciphertext,`${t}.ciphertext`,16,We)}}function N(e){let t=u(e,`public_receipt`);return A(t,`public_receipt`,[`transcript`,`registered_public_key`,`joined_client_commitment`,`joined_signing_worker_commitment`,`signing_worker_verifying_share`,`state_epoch`,`material_activation`]),{transcript:w(t.transcript,`public_receipt.transcript`,!0),registered_public_key:w(t.registered_public_key,`public_receipt.registered_public_key`,!0),joined_client_commitment:w(t.joined_client_commitment,`public_receipt.joined_client_commitment`,!0),joined_signing_worker_commitment:w(t.joined_signing_worker_commitment,`public_receipt.joined_signing_worker_commitment`,!0),signing_worker_verifying_share:w(t.signing_worker_verifying_share,`public_receipt.signing_worker_verifying_share`,!0),state_epoch:et(t.state_epoch,`public_receipt.state_epoch`),material_activation:b(t.material_activation)}}function bt(e,t,n,r,i){if(n.kind!==`activation_client`||n.deriver!==r||!T(n.session,e.session_id)||!T(n.transcript,t.transcript))throw Error(`${i} does not match the terminal activation receipt`);return{kind:`activation_client`,deriver:r,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function xt(e,t,n,r,i){if(n.kind!==`export_client`||n.deriver!==r||!T(n.session,e.ceremony.session_id)||!T(n.transcript,t))throw Error(`${i} does not match the terminal export result`);return{kind:`export_client`,deriver:r,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function P(e,t){try{return{ok:!0,value:e(t)}}catch(e){return{ok:!1,code:`invalid_body`,message:e instanceof Error?e.message:String(e)}}}function St(e){let t=u(e,`registration admission request`);return A(t,`registration admission request`,[`scope`,`application_binding`,`participant_ids`]),{scope:ct(t.scope),application_binding:st(t.application_binding),participant_ids:lt(t.participant_ids)}}function Ct(e){let t=u(e,`recovery admission request`);A(t,`recovery admission request`,[`scope`,`active_material_activation`,`application_binding`,`participant_ids`,`active_capability_binding`,`replacement_capability_binding`,`registered_public_key`]);let n=w(t.active_capability_binding,`recovery admission request.active_capability_binding`,!0),r=w(t.replacement_capability_binding,`recovery admission request.replacement_capability_binding`,!0);if(T(n,r))throw Error(`recovery replacement capability binding must be fresh`);let i=ct(t.scope),a=b(t.active_material_activation),o=i.material_activation;if(a.activation_id===o.activation_id||a.lifecycle_binding===o.lifecycle_binding)throw Error(`recovery replacement material activation identity must be fresh`);if(a.capability!==o.capability||a.material_owner!==o.material_owner||a.key_binding!==o.key_binding||a.signing_worker!==o.signing_worker)throw Error(`recovery replacement material activation changed stable identity facts`);return{scope:i,active_material_activation:a,application_binding:st(t.application_binding),participant_ids:lt(t.participant_ids),active_capability_binding:n,replacement_capability_binding:r,registered_public_key:w(t.registered_public_key,`recovery admission request.registered_public_key`,!0)}}function wt(e){let t=u(e,`warm recovery bootstrap request`);if(A(t,`warm recovery bootstrap request`,[`kind`,`walletId`,`nearAccountId`,`nearEd25519SigningKeyId`,`signerSlot`,`thresholdSessionId`,`signingWorkerId`,`participantIds`]),t.kind!==`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`)throw Error(`warm recovery bootstrap request.kind is invalid`);return{kind:`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`,walletId:C(t.walletId,`warm recovery bootstrap request.walletId`),nearAccountId:C(t.nearAccountId,`warm recovery bootstrap request.nearAccountId`),nearEd25519SigningKeyId:C(t.nearEd25519SigningKeyId,`warm recovery bootstrap request.nearEd25519SigningKeyId`),signerSlot:et(t.signerSlot,`warm recovery bootstrap request.signerSlot`),thresholdSessionId:C(t.thresholdSessionId,`warm recovery bootstrap request.thresholdSessionId`),signingWorkerId:C(t.signingWorkerId,`warm recovery bootstrap request.signingWorkerId`),participantIds:lt(t.participantIds)}}function Tt(e){let t=u(e,`export admission receipt`);return A(t,`export admission receipt`,[`binding`,`keyset`]),{binding:ht(t.binding),keyset:gt(t.keyset)}}function Et(e){let t=u(e,`export execute request`);A(t,`export execute request`,[`binding`,`deriver_a_input`,`deriver_b_input`]);let n=ht(t.binding);return{binding:n,deriver_a_input:yt(n,_t(t.deriver_a_input,`deriver_a_input`),`deriver_a`,`deriver_a_input`),deriver_b_input:yt(n,_t(t.deriver_b_input,`deriver_b_input`),`deriver_b`,`deriver_b_input`)}}function Dt(e){let t=u(e,`export result`);A(t,`export result`,[`binding`,`transcript`,`deriver_a_client_package`,`deriver_b_client_package`]);let n=ht(t.binding),r=w(t.transcript,`export result.transcript`,!0);return{binding:n,transcript:r,deriver_a_client_package:xt(n,r,M(t.deriver_a_client_package,`deriver_a_client_package`),`deriver_a`,`deriver_a_client_package`),deriver_b_client_package:xt(n,r,M(t.deriver_b_client_package,`deriver_b_client_package`),`deriver_b`,`deriver_b_client_package`)}}function Ot(e){let t=u(e,`activation admission receipt`);A(t,`activation admission receipt`,[`binding`,`keyset`]);let n=j(t.binding),r=gt(t.keyset);switch(n.operation){case`registration`:return{binding:n,keyset:r};case`recovery`:return{binding:n,keyset:r}}}function kt(e){let t=u(e,`activation execute request`);A(t,`activation execute request`,[`binding`,`deriver_a_input`,`deriver_b_input`]);let n=j(t.binding),r=vt(n,_t(t.deriver_a_input,`deriver_a_input`),`deriver_a`,`deriver_a_input`),i=vt(n,_t(t.deriver_b_input,`deriver_b_input`),`deriver_b`,`deriver_b_input`);if(n.operation===`registration`){if(r.operation!==`registration`||i.operation!==`registration`)throw Error(`activation inputs do not match registration binding`);return{binding:n,deriver_a_input:r,deriver_b_input:i}}if(r.operation!==`recovery`||i.operation!==`recovery`)throw Error(`activation inputs do not match recovery binding`);return{binding:n,deriver_a_input:r,deriver_b_input:i}}function At(e){let t=u(e,`activation result`);A(t,`activation result`,[`binding`,`deriver_a_client_package`,`deriver_b_client_package`,`public_receipt`]);let n=j(t.binding),r=N(t.public_receipt);if(!ue(n.material_activation,r.material_activation))throw Error(`activation result receipt material does not match the admitted binding`);let i=M(t.deriver_a_client_package,`deriver_a_client_package`),a=M(t.deriver_b_client_package,`deriver_b_client_package`),o=bt(n,r,i,`deriver_a`,`deriver_a_client_package`),s=bt(n,r,a,`deriver_b`,`deriver_b_client_package`);switch(n.operation){case`registration`:return{binding:n,deriver_a_client_package:o,deriver_b_client_package:s,public_receipt:r};case`recovery`:return{binding:n,deriver_a_client_package:o,deriver_b_client_package:s,public_receipt:r}}}function jt(e){let t=j(e);switch(t.operation){case`registration`:throw Error(`recovery activation requires a recovery binding`);case`recovery`:return t}}function Mt(e){let t=u(e,`recovery activation receipt`);A(t,`recovery activation receipt`,[`binding`,`public_receipt`,`active_capability_binding`,`retired_capability_binding`]);let n=w(t.active_capability_binding,`recovery activation receipt.active_capability_binding`,!0),r=w(t.retired_capability_binding,`recovery activation receipt.retired_capability_binding`,!0);if(T(n,r))throw Error(`recovery activation receipt capability bindings must be distinct`);return{binding:jt(t.binding),public_receipt:N(t.public_receipt),active_capability_binding:n,retired_capability_binding:r}}function Nt(e,t){return e.binding.operation===t}function Pt(e,t){return e.binding.operation===t}function Ft(e,t){return e.binding.operation===t}function F(e){return{ok:!1,code:`invalid_body`,message:`activation value must use the ${e} operation`}}function It(e){return P(St,e)}function Lt(e){return P(Ct,e)}function Rt(e){return P(wt,e)}function zt(e){return P(Tt,e)}function Bt(e){return P(Et,e)}function Vt(e){return P(Dt,e)}function Ht(e){return P(Ot,e)}function Ut(e){let t=Ht(e);return t.ok?Nt(t.value,`registration`)?{ok:!0,value:t.value}:F(`registration`):t}function Wt(e){let t=Ht(e);return t.ok?Nt(t.value,`recovery`)?{ok:!0,value:t.value}:F(`recovery`):t}function Gt(e){return P(kt,e)}function Kt(e){let t=Gt(e);return t.ok?Pt(t.value,`registration`)?{ok:!0,value:t.value}:F(`registration`):t}function qt(e){let t=Gt(e);return t.ok?Pt(t.value,`recovery`)?{ok:!0,value:t.value}:F(`recovery`):t}function Jt(e){return P(At,e)}function Yt(e){let t=Jt(e);return t.ok?Ft(t.value,`registration`)?{ok:!0,value:t.value}:F(`registration`):t}function Xt(e){let t=Jt(e);return t.ok?Ft(t.value,`recovery`)?{ok:!0,value:t.value}:F(`recovery`):t}function Zt(e){return P(Mt,e)}function Qt(e){return P($t,e)}function $t(e){return M(e,`encrypted_package`)}const en=`seams/linked-device/ecdsa-source-contribution-envelope/v1`;function tn(e){let t=l(e,`linked-device ordinary source contribution`);switch(t.kind){case`linked_device_ed25519_source_contribution_v1`:return ln(t);case`linked_device_ecdsa_source_contribution_v1`:return un(t);default:throw Error(`linked-device ordinary source contribution kind is invalid`)}}function nn(e){let t=G(e,[`state`,`reservation_id`,`participant_ids`,`activation_receipt`,`deriver_a_client_package`,`deriver_b_client_package`],`linked-device Ed25519 source-preserving reservation`);if(t.state!==`inactive`)throw Error(`linked-device Ed25519 source-preserving reservation is not inactive`);let n=N(t.activation_receipt),r=ut(t.participant_ids),i=I(t.deriver_a_client_package,`deriver_a`),a=I(t.deriver_b_client_package,`deriver_b`);if(!E(n.transcript,i.transcript)||!E(n.transcript,a.transcript))throw Error(`linked-device Ed25519 reservation packages have mismatched transcripts`);return{state:`inactive`,reservationId:W(t.reservation_id,`reservation_id`),participantIds:r,activationReceipt:n,deriver_a_client_package:i,deriver_b_client_package:a}}function rn(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`linked-device ordinary source contributions must contain one or two entries`);let t=e.map(tn),n=t.map(e=>e.keyFamily);if(new Set(n).size!==n.length)throw Error(`linked-device ordinary source contributions repeat a key family`);if(t.length===2&&(t[0]?.keyFamily!==`ed25519`||t[1]?.keyFamily!==`ecdsa_secp256k1`))throw Error(`linked-device ordinary source contributions must be Ed25519 then ECDSA`);let r=t[0];if(!r)throw Error(`linked-device ordinary source contributions are empty`);return[r,...t.slice(1)]}function an(e){let t=G(e,[`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`source`,`target`],`linked-device ECDSA source contribution preparation`),n=vn(t.source),r=yn(t.target);return En(n.activation,r.activation),{linkSessionId:R(t.linkSessionId),enrollmentId:z(t.enrollmentId),sourceAuthorityId:B(t.sourceAuthorityId),source:n,target:r}}function on(e){let t=l(e,`linked-device ordinary source contribution preparation`);if(t.kind===`linked_device_ed25519_source_contribution_preparation_v1`)return cn(t);if(Object.prototype.hasOwnProperty.call(t,`source`)&&Object.prototype.hasOwnProperty.call(t,`target`))return an(t);throw Error(`linked-device ordinary source contribution preparation family is invalid`)}function sn(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`linked-device ordinary source contribution preparations must contain one or two entries`);let t=e.map(on),n=t.map(e=>`kind`in e?`ed25519`:`ecdsa_secp256k1`);if(new Set(n).size!==n.length)throw Error(`linked-device ordinary source contribution preparations repeat a key family`);if(t.length===2&&(n[0]!==`ed25519`||n[1]!==`ecdsa_secp256k1`))throw Error(`linked-device ordinary source contribution preparations must be ordered Ed25519 then ECDSA`);let r=t[0];if(!r)throw Error(`linked-device ordinary source contribution preparation is empty`);return[r,...t.slice(1)]}function cn(e){if(G(e,[`kind`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`sourceBinding`,`targetAdmission`,`applicationBinding`,`sourceRevocationEpoch`,`participantIds`,`targetMaterialActivation`,`targetClientRecipientPublicKeyB64u`,`targetSigningWorkerRecipientPublicKeyB64u`,`sourceRegisteredPublicKeyB64u`],`linked-device Ed25519 source contribution preparation`),e.kind!==`linked_device_ed25519_source_contribution_preparation_v1`)throw Error(`linked-device Ed25519 source contribution preparation kind is invalid`);let t=j(e.sourceBinding),n=Ut(e.targetAdmission);if(!n.ok)throw Error(`targetAdmission ${n.message}`);let r=n.value,i=st(e.applicationBinding);if(typeof e.sourceRevocationEpoch!=`number`||!Number.isSafeInteger(e.sourceRevocationEpoch)||e.sourceRevocationEpoch<0)throw Error(`sourceRevocationEpoch must be a non-negative safe integer`);let a=L(e.targetMaterialActivation,`targetMaterialActivation`),o=R(e.linkSessionId),c=z(e.enrollmentId),l=B(e.sourceAuthorityId),u=On(e.walletKeyId),d=V(e.targetDeviceId),f=H(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),p=U(e.targetClientRecipientPublicKeyB64u,32,`targetClientRecipientPublicKeyB64u`),m=U(e.targetSigningWorkerRecipientPublicKeyB64u,32,`targetSigningWorkerRecipientPublicKeyB64u`);if(p===m)throw Error(`linked-device Ed25519 source contribution recipients must differ`);let h=ut(e.participantIds);if(Cn(t,o,`sourceBinding`),!s(a,de(r.binding.material_activation)))throw Error(`targetAdmission activation differs from targetMaterialActivation`);if(!wn(t,r.binding))throw Error(`source and target Ed25519 contribution bindings differ`);if(t.material_activation.activation_id===a.activationId)throw Error(`source and target Ed25519 contribution activations must differ`);return{kind:`linked_device_ed25519_source_contribution_preparation_v1`,linkSessionId:o,enrollmentId:c,sourceAuthorityId:l,walletKeyId:u,targetDeviceId:d,targetFactorVerificationDigestB64u:f,sourceBinding:t,targetAdmission:r,applicationBinding:i,sourceRevocationEpoch:e.sourceRevocationEpoch,participantIds:h,targetMaterialActivation:a,targetClientRecipientPublicKeyB64u:p,targetSigningWorkerRecipientPublicKeyB64u:m,sourceRegisteredPublicKeyB64u:ee(e.sourceRegisteredPublicKeyB64u,`sourceRegisteredPublicKeyB64u`)}}function ln(e){if(G(e,[`kind`,`keyFamily`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`targetMaterialActivation`,`targetClientRecipientPublicKeyB64u`,`targetSigningWorkerRecipientPublicKeyB64u`,`sourceBinding`,`reservationId`,`targetBinding`,`activationReceipt`,`participantIds`,`deriver_a_client_package`,`deriver_b_client_package`,`sourceRegisteredPublicKeyB64u`],`linked-device Ed25519 source contribution`),e.kind!==`linked_device_ed25519_source_contribution_v1`)throw Error(`linked-device Ed25519 source contribution kind is invalid`);if(e.keyFamily!==`ed25519`)throw Error(`linked-device Ed25519 source contribution family is invalid`);let t=j(e.sourceBinding),n=L(e.targetMaterialActivation,`source contribution targetMaterialActivation`),r=xn(e.targetBinding,`targetBinding`),i=N(e.activationReceipt),a=W(e.reservationId,`reservationId`),o=ut(e.participantIds),c=R(e.linkSessionId),l=z(e.enrollmentId),u=B(e.sourceAuthorityId),d=On(e.walletKeyId),f=V(e.targetDeviceId),p=H(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),m=U(e.targetClientRecipientPublicKeyB64u,32,`targetClientRecipientPublicKeyB64u`),h=U(e.targetSigningWorkerRecipientPublicKeyB64u,32,`targetSigningWorkerRecipientPublicKeyB64u`);if(m===h)throw Error(`linked-device Ed25519 source contribution recipients must differ`);if(Cn(t,c,`sourceBinding`),Sn(r,c,n,`targetBinding`),!wn(t,r))throw Error(`linked-device Ed25519 source contribution stable identity differs`);if(!s(de(i.material_activation),n))throw Error(`linked-device Ed25519 source contribution receipt activation differs`);let te=ee(e.sourceRegisteredPublicKeyB64u,`sourceRegisteredPublicKeyB64u`);if(!E(i.registered_public_key,Array.from(ne(te))))throw Error(`linked-device Ed25519 source contribution receipt public key differs`);let g=I(e.deriver_a_client_package,`deriver_a`),re=I(e.deriver_b_client_package,`deriver_b`);if(!E(i.transcript,g.transcript)||!E(i.transcript,re.transcript))throw Error(`linked-device Ed25519 source contribution package transcript differs`);if(t.material_activation.activation_id===n.activationId)throw Error(`linked-device Ed25519 source contribution reuses the source activation`);return{kind:`linked_device_ed25519_source_contribution_v1`,keyFamily:`ed25519`,linkSessionId:c,enrollmentId:l,sourceAuthorityId:u,walletKeyId:d,targetDeviceId:f,targetFactorVerificationDigestB64u:p,targetMaterialActivation:n,targetClientRecipientPublicKeyB64u:m,targetSigningWorkerRecipientPublicKeyB64u:h,sourceBinding:t,reservationId:a,targetBinding:r,activationReceipt:i,participantIds:o,deriver_a_client_package:g,deriver_b_client_package:re,sourceRegisteredPublicKeyB64u:te}}function un(e){if(G(e,[`kind`,`keyFamily`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`sourceSigner`,`sourceDerivation`,`target`,`package`],`linked-device ECDSA source contribution`),e.kind!==`linked_device_ecdsa_source_contribution_v1`)throw Error(`linked-device ECDSA source contribution kind is invalid`);if(e.keyFamily!==`ecdsa_secp256k1`)throw Error(`linked-device ECDSA source contribution family is invalid`);let t=R(e.linkSessionId),n=z(e.enrollmentId),r=B(e.sourceAuthorityId),i=On(e.walletKeyId),a=V(e.targetDeviceId),o=H(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),s=vn(e.sourceSigner),c=dn(e.sourceDerivation),l=yn(e.target);En(s.activation,l.activation);let u=gn(e.package);if(u.binding.linkSessionId!==t||u.binding.enrollmentId!==n||u.binding.sourceAuthorityId!==r||u.binding.target.targetDeviceId!==a||u.binding.target.targetFactorVerificationDigestB64u!==o)throw Error(`linked-device ECDSA source contribution package binding differs`);if(!Tn(u.binding.source,s))throw Error(`linked-device ECDSA source contribution signer differs from package binding`);if(!Dn(u.binding.target,l))throw Error(`linked-device ECDSA source contribution target differs from package binding`);return{kind:`linked_device_ecdsa_source_contribution_v1`,keyFamily:`ecdsa_secp256k1`,linkSessionId:t,enrollmentId:n,sourceAuthorityId:r,walletKeyId:i,targetDeviceId:a,targetFactorVerificationDigestB64u:o,sourceSigner:s,sourceDerivation:c,target:l,package:u}}function dn(e){let t=G(e,[`applicationBindingDigestB64u`,`clientShareRetryCounter`,`ecdsaThresholdKeyId`,`sourceNormalSigning`],`linked-device ECDSA source derivation`),n=t.clientShareRetryCounter;if(typeof n!=`number`||!Number.isSafeInteger(n)||n<0)throw Error(`linked-device ECDSA source derivation retry counter is invalid`);let r=H(t.applicationBindingDigestB64u,`sourceDerivation.applicationBindingDigestB64u`),i=fe(t.sourceNormalSigning),a=pe(t.ecdsaThresholdKeyId);if(i.scope.context.application_binding_digest_b64u!==r||i.scope.public_identity.client_share_retry_counter!==n||i.scope.ecdsa_threshold_key_id!==a)throw Error(`linked-device ECDSA source derivation differs from normal signing`);return{applicationBindingDigestB64u:r,clientShareRetryCounter:n,ecdsaThresholdKeyId:a,sourceNormalSigning:i}}function fn(e){let t=G(e,[`state`,`binding`,`sourceDerivation`,`targetRelayerPublicKey33B64u`,`thresholdPublicKey33B64u`,`thresholdEthereumAddress20B64u`,`normalSigning`],`linked-device ECDSA source-preserving activation receipt`);if(t.state!==`inactive`)throw Error(`linked-device ECDSA source-preserving activation receipt is not inactive`);let n=_n(t.binding),r=dn(t.sourceDerivation),i=p(t.targetRelayerPublicKey33B64u,`targetRelayerPublicKey33B64u`),a=p(t.thresholdPublicKey33B64u,`thresholdPublicKey33B64u`),o=U(t.thresholdEthereumAddress20B64u,20,`thresholdEthereumAddress20B64u`),s=fe(t.normalSigning);return pn({binding:n,sourceDerivation:r,targetRelayerPublicKey33B64u:i,thresholdPublicKey33B64u:a,thresholdEthereumAddress20B64u:o,normalSigning:s}),{state:`inactive`,binding:n,sourceDerivation:r,targetRelayerPublicKey33B64u:i,thresholdPublicKey33B64u:a,thresholdEthereumAddress20B64u:o,normalSigning:s}}function pn(e){let t=e.sourceDerivation.sourceNormalSigning.scope,n=e.normalSigning.scope;if(!s(de(t.material_activation),e.binding.source.activation)||!s(de(n.material_activation),e.binding.target.activation)||t.wallet_id!==n.wallet_id||t.wallet_id!==e.binding.source.activation.materialOwner||n.wallet_id!==e.binding.target.activation.materialOwner||t.ecdsa_threshold_key_id!==n.ecdsa_threshold_key_id||t.signing_root_id!==n.signing_root_id||t.signing_root_version!==n.signing_root_version||t.context.application_binding_digest_b64u!==n.context.application_binding_digest_b64u||t.activation_epoch!==n.activation_epoch||t.public_identity.derivation_client_share_public_key33_b64u!==e.binding.source.clientPublicKey33B64u||t.public_identity.server_public_key33_b64u!==e.binding.source.relayerPublicKey33B64u||t.public_identity.threshold_public_key33_b64u!==e.binding.source.thresholdPublicKey33B64u||t.public_identity.ethereum_address20_b64u!==e.binding.source.thresholdEthereumAddress20B64u||n.public_identity.context_binding_b64u!==t.public_identity.context_binding_b64u||n.public_identity.derivation_client_share_public_key33_b64u!==e.binding.targetClientPublicKey33B64u||n.public_identity.server_public_key33_b64u!==e.targetRelayerPublicKey33B64u||n.public_identity.threshold_public_key33_b64u!==e.thresholdPublicKey33B64u||n.public_identity.ethereum_address20_b64u!==e.thresholdEthereumAddress20B64u||n.public_identity.client_share_retry_counter!==t.public_identity.client_share_retry_counter||n.public_identity.server_share_retry_counter!==t.public_identity.server_share_retry_counter||n.signing_worker.server_id!==e.binding.target.activation.signingWorker||n.signing_worker.key_epoch!==t.signing_worker.key_epoch||n.signing_worker.recipient_encryption_key!==mn(e.binding.target.signingWorkerRecipientPublicKeyB64u))throw Error(`linked-device ECDSA normal signing state differs from its activation receipt`)}function mn(e){let t=ne(e);if(t.length!==32||g(t)!==e)throw Error(`linked-device signing-worker recipient key is invalid`);let n=``;for(let e of t)n+=e.toString(16).padStart(2,`0`);return`x25519:${n}`}function I(e,t){let n=hn(e,`${t} client package`);if(n.kind!==`activation_client`||n.deriver!==t)throw Error(`${t} client package is not an activation client package`);return t===`deriver_a`?{kind:`activation_client`,deriver:`deriver_a`,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}:{kind:`activation_client`,deriver:`deriver_b`,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function hn(e,t){let n=Qt(e);if(!n.ok)throw Error(`${t} ${n.message}`);return n.value}function gn(e){let t=G(e,[`binding`,`encryptedDelta`,`encryptedTargetClientShare`],`linked-device ECDSA source contribution package`),n=_n(t.binding),r=bn(t.encryptedDelta,`encryptedDelta`),i=bn(t.encryptedTargetClientShare,`encryptedTargetClientShare`),a=r.bindingDigestB64u;if(i.bindingDigestB64u!==a)throw Error(`linked-device ECDSA source contribution envelope bindings differ`);if(r.recipientPublicKeyB64u!==n.target.signingWorkerRecipientPublicKeyB64u||i.recipientPublicKeyB64u!==n.target.clientRecipientPublicKeyB64u)throw Error(`linked-device ECDSA source contribution envelope recipients differ`);return{binding:n,encryptedDelta:r,encryptedTargetClientShare:i}}function _n(e){let t=G(e,[`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`source`,`target`,`targetClientPublicKey33B64u`],`linked-device ECDSA source contribution binding`),n=vn(t.source),r=yn(t.target);return En(n.activation,r.activation),{linkSessionId:W(t.linkSessionId,`binding.linkSessionId`),enrollmentId:W(t.enrollmentId,`binding.enrollmentId`),sourceAuthorityId:W(t.sourceAuthorityId,`binding.sourceAuthorityId`),source:n,target:r,targetClientPublicKey33B64u:p(t.targetClientPublicKey33B64u,`binding.targetClientPublicKey33B64u`)}}function vn(e){let t=G(e,[`activation`,`clientPublicKey33B64u`,`relayerPublicKey33B64u`,`thresholdPublicKey33B64u`,`thresholdEthereumAddress20B64u`],`linked-device ECDSA source signer`);return{activation:L(t.activation,`source.activation`),clientPublicKey33B64u:p(t.clientPublicKey33B64u,`source.clientPublicKey33B64u`),relayerPublicKey33B64u:p(t.relayerPublicKey33B64u,`source.relayerPublicKey33B64u`),thresholdPublicKey33B64u:p(t.thresholdPublicKey33B64u,`source.thresholdPublicKey33B64u`),thresholdEthereumAddress20B64u:U(t.thresholdEthereumAddress20B64u,20,`source.thresholdEthereumAddress20B64u`)}}function yn(e){let t=G(e,[`activation`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`clientRecipientPublicKeyB64u`,`signingWorkerRecipientPublicKeyB64u`],`linked-device ECDSA target recipient`),n=U(t.clientRecipientPublicKeyB64u,32,`target.clientRecipientPublicKeyB64u`),r=U(t.signingWorkerRecipientPublicKeyB64u,32,`target.signingWorkerRecipientPublicKeyB64u`);if(n===r)throw Error(`linked-device ECDSA target recipients must differ`);return{activation:L(t.activation,`target.activation`),targetDeviceId:V(t.targetDeviceId),targetFactorVerificationDigestB64u:H(t.targetFactorVerificationDigestB64u,`target.targetFactorVerificationDigestB64u`),clientRecipientPublicKeyB64u:n,signingWorkerRecipientPublicKeyB64u:r}}function bn(e,t){let n=G(e,[`kind`,`recipientPublicKeyB64u`,`bindingDigestB64u`,`encappedKeyB64u`,`ciphertextB64u`],`linked-device ECDSA ${t}`);if(n.kind!==en)throw Error(`${t}.kind is invalid`);return{kind:en,recipientPublicKeyB64u:U(n.recipientPublicKeyB64u,32,`${t}.recipientPublicKeyB64u`),bindingDigestB64u:H(n.bindingDigestB64u,`${t}.bindingDigestB64u`),encappedKeyB64u:U(n.encappedKeyB64u,32,`${t}.encappedKeyB64u`),ciphertextB64u:m(n.ciphertextB64u,`${t}.ciphertextB64u`)}}function xn(e,t){let n=j(e);if(n.operation!==`registration`)throw Error(`${t} must use the registration operation`);return n}function Sn(e,t,n,r){if(e.material_activation.activation_id!==n.activationId)throw Error(`${r} activation does not match the target activation`);if(e.material_activation.material_owner!==n.materialOwner)throw Error(`${r} material owner does not match the target activation`);if(e.material_activation.signing_worker!==n.signingWorker)throw Error(`${r} signing worker does not match the target activation`);if(e.session_id.length!==32||String(t).length===0)throw Error(`${r} link binding is invalid`)}function Cn(e,t,n){if(e.session_id.length!==32||String(t).length===0)throw Error(`${n} link binding is invalid`)}function wn(e,t){return e.stable_key_context_binding.every((e,n)=>e===t.stable_key_context_binding[n])&&e.material_activation.capability===t.material_activation.capability&&e.material_activation.material_owner===t.material_activation.material_owner&&e.material_activation.key_binding===t.material_activation.key_binding&&e.material_activation.lifecycle_binding===t.material_activation.lifecycle_binding&&e.material_activation.signing_worker===t.material_activation.signing_worker&&e.lifecycle.root_share_epoch===t.lifecycle.root_share_epoch&&e.lifecycle.account_id===t.lifecycle.account_id&&e.lifecycle.signer_set_id===t.lifecycle.signer_set_id&&e.lifecycle.selected_server_id===t.lifecycle.selected_server_id}function Tn(e,t){return s(e.activation,t.activation)&&e.clientPublicKey33B64u===t.clientPublicKey33B64u&&e.relayerPublicKey33B64u===t.relayerPublicKey33B64u&&e.thresholdPublicKey33B64u===t.thresholdPublicKey33B64u&&e.thresholdEthereumAddress20B64u===t.thresholdEthereumAddress20B64u}function En(e,t){if(s(e,t)||e.materialOwner!==t.materialOwner||e.signingWorker!==t.signingWorker)throw Error(`linked-device ECDSA source and target activations are invalid`)}function Dn(e,t){return s(e.activation,t.activation)&&e.targetDeviceId===t.targetDeviceId&&e.targetFactorVerificationDigestB64u===t.targetFactorVerificationDigestB64u&&e.clientRecipientPublicKeyB64u===t.clientRecipientPublicKeyB64u&&e.signingWorkerRecipientPublicKeyB64u===t.signingWorkerRecipientPublicKeyB64u}function L(e,t){let n=i(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function R(e){let t=o(W(e,`linkSessionId`));if(!t.ok)throw Error(`linkSessionId ${t.error.message}`);return t.value}function z(e){let t=c(W(e,`enrollmentId`));if(!t.ok)throw Error(`enrollmentId ${t.error.message}`);return t.value}function B(e){let n=t(W(e,`sourceAuthorityId`));if(!n.ok)throw Error(`sourceAuthorityId ${n.error.message}`);return n.value}function On(e){let t=a(W(e,`walletKeyId`));if(!t.ok)throw Error(`walletKeyId ${t.error.message}`);return t.value}function V(e){let t=re(W(e,`targetDeviceId`));if(!t.ok)throw Error(`targetDeviceId ${t.error.message}`);return t.value}function H(e,t){try{return ie(e)}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}function U(e,t,n){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} must be canonical base64url`);let r;try{r=ne(e)}catch{throw Error(`${n} must be canonical base64url`)}if(r.length!==t||g(r)!==e)throw Error(`${n} must decode to ${t} bytes`);return e}function W(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e||[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127}))throw Error(`${t} must be a non-empty visible string`);return e}function G(e,t,n){let r=l(e,n),i=new Set(t),a=Object.keys(r);if(a.length!==t.length||a.some(e=>!i.has(e))||t.some(e=>!Object.prototype.hasOwnProperty.call(r,e)))throw Error(`${n} contains unknown or missing fields`);return r}function kn(e){return q(e)}function An(e){return Tr(e.signerActivations)}function jn(e){return wr(e.signerActivations)}function Mn(e){return e.provenance.kind===`wallet_recovery`}function Nn(e){return{kind:`wallet_ed25519_signer_activation_v1`,signer:e.signer,materialActivation:e.materialActivation}}function Pn(e){return{kind:`wallet_ecdsa_signer_activation_v1`,signer:e.signer,materialActivation:e.materialActivation}}function Fn(e){let t=ye(e.manifest),n=Cr(e.materialActivations);if(!gr(t.keyFamilies,n.keyFamilies))throw Error(`wallet signer activation materials must match the signer manifest families`);if(_r(t)){if(!br(n))throw Error(`Ed25519 signer activation requires one Ed25519 material activation`);return{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`],ed25519:Nn({signer:t.signers[0],materialActivation:n.ed25519})}}if(vr(t)){if(!xr(n))throw Error(`ECDSA signer activation requires one ECDSA material activation`);return{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ecdsa_secp256k1`],ecdsa:Pn({signer:t.signers[0],materialActivation:n.ecdsa})}}if(!yr(t)||!Sr(n))throw Error(`wallet signer activation set has unsupported families`);if(n.ed25519.activationId===n.ecdsa.activationId)throw Error(`wallet signer activation references must be distinct`);return{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:Nn({signer:t.signers[0],materialActivation:n.ed25519}),ecdsa:Pn({signer:t.signers[1],materialActivation:n.ecdsa})}}function In(e){try{let t=u(e,`WalletSignerActivationSetV1`);if(t.kind!==`wallet_signer_activation_set_v1`)return Q(`wallet signer activation set kind is unsupported`);if(!Object.prototype.hasOwnProperty.call(t,`keyFamilies`))return Q(`WalletSignerActivationSetV1.keyFamilies is required`);let n=hr(t.keyFamilies,`WalletSignerActivationSetV1.keyFamilies`);if(n.length===1&&n[0]===`ed25519`)return K(t,[`kind`,`keyFamilies`,`ed25519`],`WalletSignerActivationSetV1`),{ok:!0,value:{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`],ed25519:rr(t.ed25519,`ed25519`)}};if(n.length===1&&n[0]===`ecdsa_secp256k1`)return K(t,[`kind`,`keyFamilies`,`ecdsa`],`WalletSignerActivationSetV1`),{ok:!0,value:{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ecdsa_secp256k1`],ecdsa:ir(t.ecdsa,`ecdsa`)}};K(t,[`kind`,`keyFamilies`,`ed25519`,`ecdsa`],`WalletSignerActivationSetV1`);let r=rr(t.ed25519,`ed25519`),i=ir(t.ecdsa,`ecdsa`);return r.materialActivation.activationId===i.materialActivation.activationId?Q(`wallet signer activation references must be distinct`):{ok:!0,value:{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:r,ecdsa:i}}}catch(e){return Q(Er(e,`wallet signer activation set is invalid`))}}function Ln(e){let t=[_(`seams/wallet-signer-activation-set/v1`,`domain`),_(e.kind,`kind`),le(e.keyFamilies.length,`keyFamilies`)];for(let n of e.keyFamilies)t.push(_(n,`keyFamilies.item`));return(wr(e)||q(e))&&t.push(y(or(e.ed25519),`ed25519`)),(Tr(e)||q(e))&&t.push(y(sr(e.ecdsa),`ecdsa`)),v(t)}async function Rn(e){return ie(g(await d(Ln(e))))}function zn(e){return{kind:`wallet_authority_v1`,authorityId:e.authorityId,walletId:e.walletId,principal:e.principal,provenance:e.provenance,permissions:e.permissions,signerActivations:e.signerActivations,signerActivationSetDigestB64u:e.signerActivationSetDigestB64u,authorityDigestB64u:e.authorityDigestB64u,revocationEpoch:e.revocationEpoch,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs}}function Bn(e){return Qn(e),{...zn(e),state:`pending_local_install`,localInstallPackageSetDigestB64u:e.localInstallPackageSetDigestB64u}}function Vn(e){return Qn(e),{...zn(e),state:`active`,activatedAtMs:e.activatedAtMs}}async function Hn(e){let t=e.authority.signerActivations;if(!t.ed25519)throw Error(`active Wallet Authority has no Ed25519 material activation to replace`);let n=t.ecdsa?Fn({manifest:x([t.ed25519.signer,t.ecdsa.signer]),materialActivations:{keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:e.materialActivation,ecdsa:t.ecdsa.materialActivation}}):Fn({manifest:x([t.ed25519.signer]),materialActivations:{keyFamilies:[`ed25519`],ed25519:e.materialActivation}}),r=await Rn(n),i={kind:e.authority.kind,authorityId:e.authority.authorityId,walletId:e.authority.walletId,principal:e.authority.principal,provenance:e.authority.provenance,permissions:e.authority.permissions,signerActivations:n,signerActivationSetDigestB64u:r,authorityDigestB64u:e.authority.authorityDigestB64u,revocationEpoch:e.authority.revocationEpoch,createdAtMs:e.authority.createdAtMs,updatedAtMs:Math.max(e.authority.updatedAtMs,e.updatedAtMs),state:`active`,activatedAtMs:e.authority.activatedAtMs};return Vn({...i,authorityDigestB64u:await Jn(i)})}function Un(e){return Qn(e),{...zn(e),state:`active`,activatedAtMs:e.activatedAtMs}}function Wn(e){return Qn(e),{...zn(e),state:`revoked`,activatedAtMs:e.activatedAtMs,revokedAtMs:e.revokedAtMs}}const Gn=[`kind`,`authorityId`,`walletId`,`principal`,`provenance`,`permissions`,`signerActivations`,`signerActivationSetDigestB64u`,`authorityDigestB64u`,`revocationEpoch`,`createdAtMs`,`updatedAtMs`,`state`];function Kn(e){try{let t=u(e,`WalletAuthorityV1`),n=Zn(t);switch(t.state){case`pending_local_install`:return K(t,[...Gn,`localInstallPackageSetDigestB64u`],`WalletAuthorityV1`),{ok:!0,value:Bn({kind:`wallet_authority_v1`,...n,state:`pending_local_install`,localInstallPackageSetDigestB64u:J(t.localInstallPackageSetDigestB64u,`localInstallPackageSetDigestB64u`)})};case`active`:return K(t,[...Gn,`activatedAtMs`],`WalletAuthorityV1`),{ok:!0,value:Vn({kind:`wallet_authority_v1`,...n,state:`active`,activatedAtMs:Y(t.activatedAtMs,`activatedAtMs`)})};case`revoked`:return K(t,[...Gn,`activatedAtMs`,`revokedAtMs`],`WalletAuthorityV1`),{ok:!0,value:Wn({kind:`wallet_authority_v1`,...n,state:`revoked`,activatedAtMs:Y(t.activatedAtMs,`activatedAtMs`),revokedAtMs:Y(t.revokedAtMs,`revokedAtMs`)})};default:return Q(`WalletAuthorityV1.state is unsupported`)}}catch(e){return Q(Er(e,`wallet authority is invalid`))}}function qn(e){return v([_(`seams/wallet-authority/v1`,`domain`),_(e.kind,`kind`),_(e.authorityId,`authorityId`),_(e.walletId,`walletId`),y(dr(e.principal),`principal`),y(fr(e.provenance),`provenance`),y(pr(e.permissions),`permissions`),se(e.signerActivationSetDigestB64u,`signerActivationSetDigestB64u`),_(e.state,`state`),me(e.revocationEpoch,`revocationEpoch`)])}async function Jn(e){return ie(g(await d(qn(e))))}async function Yn(e){return await Rn(e.signerActivations)===e.signerActivationSetDigestB64u?await Jn(e)===e.authorityDigestB64u:!1}async function Xn(e,t){let[n,r]=await Promise.all([Yn(e),Yn(t)]);return n&&r&&e.authorityDigestB64u===t.authorityDigestB64u&&e.signerActivationSetDigestB64u===t.signerActivationSetDigestB64u&&e.createdAtMs===t.createdAtMs&&e.updatedAtMs===t.updatedAtMs&&e.activatedAtMs===t.activatedAtMs}function Zn(e){if(e.kind!==`wallet_authority_v1`)throw Error(`WalletAuthorityV1.kind is unsupported`);let n=Z(t(e.authorityId),`authorityId`),i=Z(r(e.walletId),`walletId`),a=$n(e.principal),o=er(e.provenance),s=Z(te(e.permissions),`permissions`),c=Z(In(e.signerActivations),`signerActivations`),l=J(e.signerActivationSetDigestB64u,`signerActivationSetDigestB64u`),u=J(e.authorityDigestB64u,`authorityDigestB64u`),d=Y(e.revocationEpoch,`revocationEpoch`),ee=Y(e.createdAtMs,`createdAtMs`),f=Y(e.updatedAtMs,`updatedAtMs`);return nr(c,i),{authorityId:n,walletId:i,principal:a,provenance:o,permissions:s,signerActivations:c,signerActivationSetDigestB64u:l,authorityDigestB64u:u,revocationEpoch:d,createdAtMs:ee,updatedAtMs:f}}function Qn(e){if(e.kind!==`wallet_authority_v1`)throw Error(`wallet authority kind is unsupported`);if(!Number.isSafeInteger(e.revocationEpoch)||e.revocationEpoch<0)throw Error(`wallet authority revocationEpoch must be a non-negative safe integer`);if(X(e.createdAtMs,`createdAtMs`),X(e.updatedAtMs,`updatedAtMs`),e.updatedAtMs<e.createdAtMs)throw Error(`wallet authority updatedAtMs cannot precede createdAtMs`);switch(J(e.signerActivationSetDigestB64u,`signerActivationSetDigestB64u`),J(e.authorityDigestB64u,`authorityDigestB64u`),nr(e.signerActivations,e.walletId),tr(e.provenance),e.state){case`pending_local_install`:J(e.localInstallPackageSetDigestB64u,`localInstallPackageSetDigestB64u`);break;case`active`:X(e.activatedAtMs,`activatedAtMs`);break;case`revoked`:if(X(e.activatedAtMs,`activatedAtMs`),X(e.revokedAtMs,`revokedAtMs`),e.revokedAtMs<e.activatedAtMs)throw Error(`revokedAtMs cannot precede activatedAtMs`);break}}function $n(e){let t=mr(e,[`kind`,`deviceId`],`WalletAuthorityPrincipalV1`);if(t.kind!==`owner_device`)throw Error(`wallet authority principal kind is unsupported`);return{kind:`owner_device`,deviceId:Z(re(t.deviceId),`deviceId`)}}function er(n){let r=u(n,`WalletAuthorityProvenanceV1`);switch(r.kind){case`wallet_registration`:return K(r,[`kind`],`WalletAuthorityProvenanceV1`),{kind:`wallet_registration`};case`device_link`:return K(r,[`kind`,`enrollmentId`,`sourceAuthorityId`,`linkSessionId`],`WalletAuthorityProvenanceV1`),{kind:`device_link`,enrollmentId:Z(c(r.enrollmentId),`enrollmentId`),sourceAuthorityId:Z(t(r.sourceAuthorityId),`sourceAuthorityId`),linkSessionId:Z(o(r.linkSessionId),`linkSessionId`)};case`wallet_recovery`:return K(r,[`kind`,`recoveryOperationId`,`continuityAuthorityId`],`WalletAuthorityProvenanceV1`),{kind:`wallet_recovery`,recoveryOperationId:Z(e(r.recoveryOperationId),`recoveryOperationId`),continuityAuthorityId:Z(t(r.continuityAuthorityId),`continuityAuthorityId`)};default:throw Error(`wallet authority provenance kind is unsupported`)}}function tr(e){switch(e.kind){case`wallet_registration`:return;case`device_link`:if(!e.enrollmentId||!e.sourceAuthorityId||!e.linkSessionId)throw Error(`device-link provenance requires every audit identity`);return;case`wallet_recovery`:if(!e.recoveryOperationId||!e.continuityAuthorityId)throw Error(`wallet-recovery provenance requires every audit identity`);return}Dr(e,`wallet authority provenance`)}function nr(e,t){if(wr(e)){if(e.ed25519.signer.walletId!==t)throw Error(`Ed25519 signer activation uses a different wallet id`);return}if(Tr(e)){if(e.ecdsa.signer.walletId!==t)throw Error(`ECDSA signer activation uses a different wallet id`);return}if(q(e)){if(e.ed25519.signer.walletId!==t||e.ecdsa.signer.walletId!==t)throw Error(`signer activations must use the authority wallet id`);return}throw Error(`wallet signer activation families are unsupported`)}function rr(e,t){let n=mr(e,[`kind`,`signer`,`materialActivation`],t);if(n.kind!==`wallet_ed25519_signer_activation_v1`)throw Error(`${t}.kind is invalid`);let r=ar(n.signer,`ed25519`,`${t}.signer`);if(!_r(r))throw Error(`${t}.signer is not Ed25519`);return Nn({signer:r.signers[0],materialActivation:Z(i(n.materialActivation),`${t}.materialActivation`)})}function ir(e,t){let n=mr(e,[`kind`,`signer`,`materialActivation`],t);if(n.kind!==`wallet_ecdsa_signer_activation_v1`)throw Error(`${t}.kind is invalid`);let r=ar(n.signer,`ecdsa_secp256k1`,`${t}.signer`);if(!vr(r))throw Error(`${t}.signer is not ECDSA`);return Pn({signer:r.signers[0],materialActivation:Z(i(n.materialActivation),`${t}.materialActivation`)})}function ar(e,t,n){return ye({kind:`exact_administered_signer_manifest_v1`,keyFamilies:[t],signers:[e]})}function or(e){return v([_(e.kind,`ed25519.kind`),y(cr(e.signer),`ed25519.signer`),y(ur(e.materialActivation),`ed25519.materialActivation`)])}function sr(e){return v([_(e.kind,`ecdsa.kind`),y(lr(e.signer),`ecdsa.signer`),y(ur(e.materialActivation),`ecdsa.materialActivation`)])}function cr(e){return v([_(e.kind,`ed25519.signer.kind`),_(e.keyFamily,`ed25519.signer.keyFamily`),_(e.walletId,`ed25519.signer.walletId`),_(e.walletKeyId,`ed25519.signer.walletKeyId`),y(ce(e.registeredPublicKeyB64u,`ed25519.signer.registeredPublicKeyB64u`),`ed25519.signer.registeredPublicKeyB64u`)])}function lr(e){return v([_(e.kind,`ecdsa.signer.kind`),_(e.keyFamily,`ecdsa.signer.keyFamily`),_(e.walletId,`ecdsa.signer.walletId`),_(e.walletKeyId,`ecdsa.signer.walletKeyId`),y(ce(e.thresholdPublicKey33B64u,`ecdsa.signer.thresholdPublicKey33B64u`),`ecdsa.signer.thresholdPublicKey33B64u`),_(e.evmAddress,`ecdsa.signer.evmAddress`)])}function ur(e){return v([_(e.kind,`materialActivation.kind`),_(e.activationId,`materialActivation.activationId`),_(e.capability,`materialActivation.capability`),_(e.materialOwner,`materialActivation.materialOwner`),_(e.keyBinding,`materialActivation.keyBinding`),_(e.lifecycleBinding,`materialActivation.lifecycleBinding`),_(e.signingWorker,`materialActivation.signingWorker`)])}function dr(e){return v([_(e.kind,`principal.kind`),_(e.deviceId,`principal.deviceId`)])}function fr(e){switch(e.kind){case`wallet_registration`:return _(e.kind,`provenance.kind`);case`device_link`:return v([_(e.kind,`provenance.kind`),_(e.enrollmentId,`provenance.enrollmentId`),_(e.sourceAuthorityId,`provenance.sourceAuthorityId`),_(e.linkSessionId,`provenance.linkSessionId`)]);case`wallet_recovery`:return v([_(e.kind,`provenance.kind`),_(e.recoveryOperationId,`provenance.recoveryOperationId`),_(e.continuityAuthorityId,`provenance.continuityAuthorityId`)])}return Dr(e,`wallet authority provenance`)}function pr(e){let t=[le(e.length,`permissions`)];for(let n of e)t.push(y(_(n,`permissions.item`),`permissions.item`));return v(t)}function mr(e,t,n){let r=u(e,n);return K(r,t,n),r}function K(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length)throw Error(`${n} contains unexpected fields`);for(let e of i)if(!r.has(e))throw Error(`${n}.${e} is not allowed`);for(let r of t)if(!Object.prototype.hasOwnProperty.call(e,r))throw Error(`${n}.${r} is required`)}function hr(e,t){if(!Array.isArray(e))throw Error(`${t} must be an array`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`${t} must use canonical family order`)}function gr(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function _r(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`}function vr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`}function yr(e){return e.keyFamilies.length===2}function br(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`}function xr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`}function Sr(e){return e.keyFamilies.length===2}function Cr(e){if(br(e))return{keyFamilies:[`ed25519`],ed25519:Z(i(e.ed25519),`materialActivations.ed25519`)};if(xr(e))return{keyFamilies:[`ecdsa_secp256k1`],ecdsa:Z(i(e.ecdsa),`materialActivations.ecdsa`)};if(Sr(e))return{keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:Z(i(e.ed25519),`materialActivations.ed25519`),ecdsa:Z(i(e.ecdsa),`materialActivations.ecdsa`)};throw Error(`wallet signer activation materials are unsupported`)}function wr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`}function Tr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`}function q(e){return e.keyFamilies.length===2}function J(e,t){try{return ie(e)}catch(e){throw Error(`${t} ${Er(e,`is invalid`)}`)}}function Y(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function X(e,t){if(!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`)}function Z(e,t){if(e.ok)return e.value;throw Error(`${t} ${e.error.message}`)}function Q(e){return{ok:!1,error:{code:`invalid`,message:e}}}function Er(e,t){return e instanceof Error?e.message:t}function Dr(e,t){throw Error(`${t} branch is unsupported: ${String(e)}`)}async function Or(e,t,n){let r=await Rn(t),i={kind:`wallet_authority_v1`,authorityId:e.authorityId,walletId:e.walletId,principal:e.principal,provenance:e.provenance,permissions:e.permissions,signerActivations:t,signerActivationSetDigestB64u:r,authorityDigestB64u:e.authorityDigestB64u,revocationEpoch:e.revocationEpoch,createdAtMs:e.createdAtMs,updatedAtMs:Math.max(e.updatedAtMs,n),state:`active`,activatedAtMs:e.activatedAtMs};return Un({...i,authorityDigestB64u:await Jn(i)})}async function kr(e){if(e.ed25519.signer.walletId!==e.authority.walletId)throw Error(`NEAR signer belongs to a different wallet authority`);let t=e.authority.signerActivations.ecdsa,n=e.ed25519.signer,r=Fn({manifest:x([n,t.signer]),materialActivations:{keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:e.ed25519.materialActivation,ecdsa:t.materialActivation}});if(!kn(r))throw Error(`Deferred Ed25519 activation did not produce a combined signer activation set`);return Or(e.authority,r,e.now)}function Ar(e,t){return e.authorityId===t.authorityId&&e.walletId===t.walletId&&e.revocationEpoch===t.revocationEpoch&&e.createdAtMs===t.createdAtMs&&e.activatedAtMs===t.activatedAtMs&&g(dr(e.principal))===g(dr(t.principal))&&g(fr(e.provenance))===g(fr(t.provenance))&&g(pr(e.permissions))===g(pr(t.permissions))}function jr(e,t){return jn(e)&&kn(t.signerActivations)&&Ar(e,t)&&g(or(e.signerActivations.ed25519))===g(or(t.signerActivations.ed25519))}function Mr(e,t){return An(e)&&kn(t.signerActivations)&&e.provenance.kind===`wallet_registration`&&Ar(e,t)&&g(sr(e.signerActivations.ecdsa))===g(sr(t.signerActivations.ecdsa))}function Nr(e){return!e||typeof e!=`object`||Array.isArray(e)?null:e}function $(e){return typeof e==`string`?e.trim():``}function Pr(e,t){let n=$(e);return n?{ok:!0,value:n}:{ok:!1,error:{code:`missing`,message:`${t} is required`}}}function Fr(e){let t=typeof e==`number`?e:Number(e);return!Number.isSafeInteger(t)||t<1?{ok:!1,error:{code:`invalid`,message:`signerSlot must be an integer >= 1`}}:{ok:!0,value:t}}function Ir(e){return{ok:!1,error:{code:`invalid`,message:`${e} must be an object`}}}function Lr(e){let t=n(e);return t.ok?{ok:!0,value:t.value}:{ok:!1,error:t.error}}function Rr(e){let t=Nr(e);if(!t)return Ir(`WalletIdentity`);let n=r(t.walletId);return n.ok?{ok:!0,value:{walletId:n.value}}:{ok:!1,error:n.error}}function zr(e){return{walletId:e.walletId}}function Br(e){return{wallet:e.wallet,rpId:e.rpId}}function Vr(e){let t=$(e.credentialIdB64u);if(!t)throw Error(`credentialIdB64u is required`);return{kind:`passkey`,walletAuthMethodId:e.walletAuthMethodId,scope:e.scope,credentialIdB64u:t}}function Hr(e){let t=$(e.emailHashHex),n=$(e.registrationAuthorityId);if(!t)throw Error(`emailHashHex is required`);if(!n)throw Error(`registrationAuthorityId is required`);return{kind:`email_otp`,walletAuthMethodId:e.walletAuthMethodId,wallet:e.wallet,emailHashHex:t,registrationAuthorityId:n}}function Ur(e){return{kind:`implicit_near_account`,wallet:e.wallet,nearAccountId:e.nearAccountId}}function Wr(e){return{kind:`named_near_account`,wallet:e.wallet,nearAccountId:e.nearAccountId}}function Gr(e){let t=Nr(e);if(!t)return Ir(`NearAccountBinding`);let n=Rr(t.wallet);if(!n.ok)return n;let r=$(t.kind);if(r===`implicit_near_account`){let e=oe(t.nearAccountId);return e.ok?{ok:!0,value:Ur({wallet:n.value,nearAccountId:e.value})}:{ok:!1,error:{code:e.code,message:e.message}}}if(r===`named_near_account`){let e=ae(t.nearAccountId);return e.ok?{ok:!0,value:Wr({wallet:n.value,nearAccountId:e.value})}:{ok:!1,error:{code:e.code,message:e.message}}}return{ok:!1,error:{code:`invalid`,message:`NearAccountBinding kind is invalid`}}}function Kr(e){let t=Fr(e.signerSlot);if(!t.ok)throw Error(t.error.message);return{kind:`near_ed25519_signer`,account:e.account,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:t.value}}function qr(e){let t=Nr(e);if(!t)return Ir(`NearEd25519SignerBinding`);let n=Gr(t.account);if(!n.ok)return n;let r=Pr(t.nearEd25519SigningKeyId,`nearEd25519SigningKeyId`);if(!r.ok)return r;let i=Fr(t.signerSlot);return i.ok?{ok:!0,value:Kr({account:n.value,nearEd25519SigningKeyId:he(r.value),signerSlot:i.value})}:i}export{Zt as $,rn as A,Pe as B,Xn as C,nn as D,fn as E,Ue as F,pt as G,Be as H,Re as I,Bt as J,Qt as K,Ie as L,Dn as M,Ve as N,sn as O,He as P,qt as Q,ze as R,Hn as S,bn as T,N as U,Fe as V,st as W,ut as X,Vt as Y,Wt as Z,kn as _,Br as a,It as at,Kn as b,qr as c,E as ct,Rn as d,ye as dt,Xt as et,Ln as f,Mn as g,jn as h,Kr as i,Yt as it,Tn as j,on as k,Lr as l,Ye as lt,An as m,Ur as n,Ut as nt,Vr as o,Rt as ot,kr as p,zt as q,Wr as r,Kt as rt,zr as s,Ge as st,Hr as t,Lt as tt,Jn as u,Ne as ut,jr as v,Yn as w,In as x,Mr as y,Le as z};

package/dist/esm/sdk/walletCustodyEcdsaContinuity-5XsLsT8D.js

@@ -1 +0,0 @@
-import{B as e,r as t}from"./domainIds-C3fUa33Q.js";import{J as n}from"./activeWalletSession-BtEHhe99.js";import{i as r}from"./base64-BmKR3UqU.js";import{r as i}from"./secureRandomId-8LSc91aN.js";import{i as a,r as o}from"./canonicalPrimitives-D_1HyEuJ.js";import{n as s}from"./presignatures-DGLNs29C.js";import{C as c,Qt as l,Rt as u,Ut as d,Wt as f,ct as p,et as m,ln as h,nn as g,p as _,tn as v,w as y}from"./emailOtpEcdsaDerivationIdentity-DreNrM6n.js";import{A as b,B as x,C as S,I as C,M as w,a as T,h as E,i as D,j as O,o as k,r as A,z as j}from"./ecdsaCapabilityManifest-B3u6J5gn.js";import{_ as M,f as N,g as P,v as F}from"./wallet-recovery-BEui57xM.js";import{F as I,N as L,P as R}from"./walletOwnershipGeneration-CQzaodhB.js";import{i as z,n as B}from"./profileAccountProjection-C1z9sKHa.js";import{M as V,N as H,P as U}from"./accountLifecycle-CXTlwnAS.js";async function W(t,n){let r=e(n.explicitProfileId||``),i=e(n.explicitChainIdKey||``).toLowerCase(),a=e(n.explicitAccountAddress||``).toLowerCase();if(r||i||a){if(!r||!i||!a)throw Error(`IndexedDBManager: profileId, chainIdKey, and accountAddress are required for explicit key target writes`);let o=n.accountRefs.find(t=>e(t.chainIdKey||``).toLowerCase()===i);if(o){let e=await t.resolveProfileAccountContext(o).catch(()=>null);if(e?.profileId&&String(e.profileId).trim()!==r)throw Error(`IndexedDBManager: Explicit key target (${r}, ${i}, ${o.accountAddress}) mismatches mapped profile ${String(e.profileId).trim()}`)}return{profileId:r,chainIdKey:i,accountAddress:a}}let o=await B(t,n.accountRefs);return o?.profileId?{profileId:o.profileId,chainIdKey:o.accountRef.chainIdKey,accountAddress:o.accountRef.accountAddress}:null}async function G(e){let t=await W(e.deps.clientDB,{accountRefs:e.accountRefs});return!t?.profileId||!t.chainIdKey?null:e.deps.keyMaterialStore.getKeyMaterial(t.profileId,e.signerSlot,t.chainIdKey,e.keyKind)}async function K(t,n){if(!Number.isSafeInteger(n.signerSlot)||n.signerSlot<1)throw Error(`IndexedDBManager: Invalid signerSlot for key write`);let r=e(n.keyKind||``);if(!r)throw Error(`IndexedDBManager: Missing keyKind for key write`);let i=e(n.algorithm||``).toLowerCase();if(!i)throw Error(`IndexedDBManager: Missing algorithm for key write`);let a=e(n.publicKey||``);if(!a)throw Error(`IndexedDBManager: Missing publicKey for key write`);let o=e(n.signerId||``);if(!o)throw Error(`IndexedDBManager: Missing signerId for key write`);let s=await W(t.clientDB,n);if(!s?.profileId||!s.chainIdKey||!s.accountAddress)throw Error(`IndexedDBManager: Missing profile/account mapping for key write. Persist profile/account first or pass explicit profileId + chainIdKey.`);let c=Number.isSafeInteger(n.schemaVersion)&&typeof n.schemaVersion==`number`&&n.schemaVersion>=1?n.schemaVersion:1,l={profileId:s.profileId,signerSlot:n.signerSlot,chainIdKey:s.chainIdKey,accountAddress:s.accountAddress,keyKind:r,algorithm:i,publicKey:a,signerId:o,timestamp:typeof n.timestamp==`number`?n.timestamp:Date.now(),schemaVersion:c},u=e(n.wrapKeySalt||``);u&&(l.wrapKeySalt=u),n.payload&&(l.payload=n.payload),await t.keyMaterialStore.storeKeyMaterial(l)}async function q(e){let t=await W(e.store,{accountRefs:z(e.binding.nearAccountId)});if(!t)throw Error(`Wallet custody Ed25519 material requires a persisted wallet profile`);await e.store.storeKeyMaterial(U({target:t,...e}))}async function J(e){let t=await W(e.store,{accountRefs:z(e.nearAccountId)});t&&await e.store.deleteKeyMaterial(t.profileId,e.signerSlot,t.chainIdKey,V)}async function Y(e){let t=await G({deps:{clientDB:e.store,keyMaterialStore:e.store},accountRefs:z(e.nearAccountId),signerSlot:e.signerSlot,keyKind:V});if(!t)return{kind:`absent`};let n=t.payloadEnvelope;if(!n?.ciphertext||!n.nonce)return{kind:`unusable`,reason:`cached custody material has no sealed payload`};if(n.alg!==`chacha20poly1305-hkdf-sha256-wallet-custody-seed-v1`)return{kind:`unusable`,reason:`cached custody material was sealed under another key`};let r=t.payload?.binding;if(!r||typeof r!=`object`)return{kind:`unusable`,reason:`cached custody material has no binding`};let i=r;if(i.kind!==`wallet_custody_ed25519_active_client_v1`)return{kind:`unusable`,reason:`cached custody material is not a wallet custody record`};try{H(i)}catch(e){return{kind:`unusable`,reason:e instanceof Error?e.message:`cached custody binding is incomplete`}}let a=String(e.expectedRegisteredPublicKeyB64u||``).trim();return a&&a!==String(i.registeredPublicKeyB64u||``).trim()?{kind:`unusable`,reason:`cached custody material is for another key set`}:{kind:`found`,material:{binding:i,sealed:{ciphertextB64u:n.ciphertext,nonceB64u:n.nonce}}}}function X(e){let s=u(e.authority);if(!s||String(s.walletId)!==String(e.walletId))throw Error(`ECDSA custody import authority is invalid`);let M=m(e.publicCapability),N=p(e.activationReceipt),P=h(N.ecdsa_activation.material_activation);if(!t(P,h(M.material_activation)))throw Error(`ECDSA custody continuity changed the material activation`);let F=[y(e.participantIds[0]),y(e.participantIds[1])],I=k({keyHandle:j(e.keyHandle),ecdsaThresholdKeyId:C(e.ecdsaThresholdKeyId),clientVerifyingPublicKey33B64u:b(e.publicFacts.derivationClientSharePublicKey33B64u),participantIds:F,relayerKeyId:x(e.relayerKeyId)}),L=E({capability:P.capability,signerId:l(i(`ecdsa-signer`,32,`ECDSA custody signer identities`)),authority:s,scope:D({targetMemberships:e.chainTargets}),materialOwner:P.materialOwner,signingRootId:v(e.signingRootId),signingRootVersion:g(e.signingRootVersion)}),R=A({targetManifest:T({manifestId:d(i(`ecdsa-manifest`,32,`ECDSA custody manifest identities`)),manifestRevision:f(1)}),signer:L,roleLocalBinding:I,bindingDigest:O(e.publicFacts.contextBinding32B64u),durableMaterialRef:w(i(`ecdsa-role-local-material`,32,`ECDSA custody material identities`))}),z=e.publicFacts.ethereumAddress,B=_({keyHandle:c(e.keyHandle),publicKeyB64u:e.publicFacts.groupPublicKey33B64u,participantIds:F,thresholdOwnerAddress:z}),V=S({walletId:s.walletId,chainTarget:e.chainTargets[0],keyHandle:I.keyHandle,ecdsaThresholdKeyId:I.ecdsaThresholdKeyId,signingRootId:L.signingRootId,signingRootVersion:L.signingRootVersion,applicationBindingDigestB64u:M.context.application_binding_digest_b64u,clientParticipantId:F[0],relayerParticipantId:F[1],participantIds:F,contextBinding32B64u:e.publicFacts.contextBinding32B64u,derivationClientSharePublicKey33B64u:e.publicFacts.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:e.publicFacts.relayerPublicKey33B64u,groupPublicKey33B64u:e.publicFacts.groupPublicKey33B64u,ethereumAddress:z,publicCapability:M}),H={kind:`router_ab_ecdsa_derivation_normal_signing_v1`,scope:{wallet_id:String(s.walletId),ecdsa_threshold_key_id:String(I.ecdsaThresholdKeyId),signing_root_id:String(L.signingRootId),signing_root_version:String(L.signingRootVersion),context:N.ecdsa_activation.context,public_identity:N.ecdsa_activation.public_identity,material_activation:N.ecdsa_activation.material_activation,signing_worker:N.ecdsa_activation.signing_worker,activation_epoch:N.ecdsa_activation.activation_epoch}};return{activationBinding:R,serverCommit:{correlationId:N.activation_correlation_id,activationRequestDigest:o(r(Uint8Array.from(N.activation_request_digest.bytes))),serverGeneration:N.server_generation,protocolReceipt:N},readyStateBlobB64u:e.readyStateBlobB64u,registeredPublicFacts:B,roleLocalPublicFacts:V,routerAbEcdsaDerivationNormalSigning:H,runtimePolicyScope:n(e.runtimePolicyScope),committedAt:a(new Date(N.ecdsa_activation.activated_at_ms).toISOString())}}async function Z(e){return F(X(e))}async function Q(e){return await M(e.store,X(e),t=>e.store.persistPreparedWalletCustodyEcdsaContinuity(t))}async function $(e){let t=new N(s);for(let n of e.walletAuthMethodIds){let r=await t.getWalletAuthMethodV2(String(n));if(!r||r.status!==`active`||r.walletId!==e.walletId||r.walletAuthorityId!==e.walletAuthorityId)throw Error(`ECDSA custody continuity method ${String(n)} is not an active member of the wallet authority`)}}async function ee(e){if(e.targetAuthority.walletId!==e.walletId||e.targetAuthority.walletAuthMethodId===e.sourceWalletAuthMethodId)throw Error(`ECDSA custody continuity target is invalid`);await $({walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,walletAuthMethodIds:[e.sourceWalletAuthMethodId,e.targetAuthority.walletAuthMethodId]});let t=new P,n=await t.listActiveWalletCapabilitySubjects(e.walletId);if(n.kind!==`resolved`)throw Error(`ECDSA custody continuity inventory is ${n.kind}`);if(n.subjects.length===0)return;let r=n.subjects.filter(t=>t.authority.walletAuthMethodId===e.sourceWalletAuthMethodId);if(r.length===0)throw Error(`ECDSA custody continuity found no active capability for source method ${String(e.sourceWalletAuthMethodId)} among [${n.subjects.map(e=>String(e.authority.walletAuthMethodId)).join(`, `)}]`);for(let n of r){let r=await t.lookup(n);if(r.kind!==`active`)throw Error(`ECDSA custody continuity source is ${r.kind}`);let i={capability:n.capability,authority:e.targetAuthority},a=await t.lookup(i);if(a.kind===`active`){let e=a.manifest.durableMaterial,t=r.manifest.durableMaterial;if(e.activationDigest!==t.activationDigest||e.bindingDigest!==t.bindingDigest||e.roleLocalBinding.ecdsaThresholdKeyId!==t.roleLocalBinding.ecdsaThresholdKeyId||!R(e.roleLocalBinding,t.roleLocalBinding)||!I(e.roleLocalPublicFacts,t.roleLocalPublicFacts)||!L(a.manifest.signer.registeredPublicFacts,r.manifest.signer.registeredPublicFacts))throw Error(`ECDSA custody continuity target conflicts with source material`);continue}if(a.kind!==`missing`)throw Error(`ECDSA custody continuity target is ${a.kind}`);let o=await t.openActiveMaterialLookup(r);if(o.kind!==`active`)throw Error(`ECDSA custody continuity material is ${o.kind}`);let s=o.manifest,c=s.durableMaterial.roleLocalPublicFacts,l=await Q({store:t,authority:e.targetAuthority,chainTargets:s.signer.scope.targetMemberships,walletId:String(e.walletId),keyHandle:c.keyHandle,ecdsaThresholdKeyId:String(c.ecdsaThresholdKeyId),signingRootId:String(c.signingRootId),signingRootVersion:String(c.signingRootVersion),relayerKeyId:String(s.durableMaterial.roleLocalBinding.relayerKeyId),participantIds:c.participantIds,publicCapability:c.publicCapability,activationReceipt:s.activation.serverActivation.serverActivationReceipt.protocolReceipt,runtimePolicyScope:s.durableMaterial.runtimePolicyScope,readyStateBlobB64u:o.readyStateBlobB64u,publicFacts:{contextBinding32B64u:c.contextBinding32B64u,derivationClientSharePublicKey33B64u:c.derivationClientSharePublicKey33B64u,clientVerifyingShare33B64u:c.publicCapability.public_identity.derivation_client_share_public_key33_b64u,relayerPublicKey33B64u:c.relayerPublicKey33B64u,groupPublicKey33B64u:c.groupPublicKey33B64u,ethereumAddress:c.ethereumAddress,clientShareRetryCounter:c.publicCapability.public_identity.client_share_retry_counter,relayerShareRetryCounter:c.publicCapability.public_identity.server_share_retry_counter}});if(l.kind!==`committed`)throw Error(`ECDSA custody continuity import is ${l.kind}`)}}export{Y as a,W as c,J as i,K as l,Q as n,q as o,Z as r,G as s,ee as t};

package/dist/esm/sdk/walletCustodyOperation-BO_tSfGY.js

@@ -1 +0,0 @@
-import{c as e}from"./chains-CPmd4s9f.js";import{o as t}from"./canonicalPrimitives-D_1HyEuJ.js";async function n(n){return t(`seams:wallet-custody:challenge:v1|${e({walletId:n.walletId,operation:n.operation,payload:n.payload,requestOrigin:n.requestOrigin})}`)}export{n as t};

package/dist/esm/sdk/walletDbName-BVZhb4xF.js

@@ -1 +0,0 @@
-import{c as e,u as t}from"./chains-CPmd4s9f.js";import{$ as n,J as r}from"./activeWalletSession-BtEHhe99.js";import{i}from"./base64-BmKR3UqU.js";import{r as a}from"./secureRandomId-8LSc91aN.js";function o(e){try{return r(e)}catch{return}}const s=864e5,c={ttlMs:s,remainingUses:3},l=3;function u(e){let t=Math.floor(Number(e.requestedRemainingUses)||0);return!Number.isFinite(t)||t<=0?null:Math.min(t,3)}function d(e){let t=Math.max(0,Math.floor(Number(e.ttlMs)||0)),n=Math.max(0,Math.floor(Number(e.remainingUses)||0));return{ttlMs:Math.min(t,2592e6),remainingUses:Math.min(n,1e6)}}function f(){return a(`tsess`,32,`threshold session IDs`)}async function p(n){return i(await t(e(n)))}async function m(e){return h({nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,authority:e.authority.authority,relayerKeyId:e.relayerKeyId,runtimePolicyScope:e.runtimePolicyScope,routerAbNormalSigning:e.routerAbNormalSigning,participantIds:e.participantIds,thresholdSessionId:e.thresholdSessionId,ttlMs:e.ttlMs,remainingUses:e.remainingUses})}async function h(e){let t=e.thresholdSessionId||f(),{ttlMs:r,remainingUses:i}=d({ttlMs:e.ttlMs??c.ttlMs,remainingUses:e.remainingUses??c.remainingUses}),a=n(e.participantIds),s=o(e.runtimePolicyScope),l={version:`threshold_session_v1`,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,authority:e.authority,relayerKeyId:e.relayerKeyId,thresholdSessionId:t,...s?{runtimePolicyScope:s}:{},routerAbNormalSigning:e.routerAbNormalSigning,...a?{participantIds:a}:{},ttlMs:r,remainingUses:i},u=await p(l);return{policy:l,policyJson:JSON.stringify(l),sessionPolicyDigest32:u}}const g=`seams_wallet`;export{m as a,u as c,l as i,c as n,d as o,s as r,o as s,g as t};

package/dist/esm/sdk/walletOwnershipGeneration-CQzaodhB.js

@@ -1 +0,0 @@
-import{g as e,i as t,r as n,y as r}from"./domainIds-C3fUa33Q.js";import{E as i,c as a,k as o,l as s}from"./chains-CPmd4s9f.js";import{J as c}from"./activeWalletSession-BtEHhe99.js";import{i as l,r as u}from"./base64-BmKR3UqU.js";import{i as d,n as f,r as p}from"./canonicalPrimitives-D_1HyEuJ.js";import{a as m}from"./ecdsaChainTarget-svSlzhze.js";import{a as h,i as g,n as _}from"./presignatures-DGLNs29C.js";import{C as ee,Ct as te,Gt as v,Kt as y,Q as ne,Qt as re,Rt as b,St as ie,Tt as x,Ut as S,Vt as ae,Wt as C,Xt as oe,Yt as w,Zt as T,_t as se,ct as ce,nn as le,on as ue,p as de,pt as fe,qt as E,tn as pe,un as me,w as he}from"./emailOtpEcdsaDerivationIdentity-DreNrM6n.js";import{A as D,B as ge,C as _e,I as ve,M as ye,P as be,_ as xe,a as O,b as k,c as Se,d as Ce,f as we,g as Te,h as Ee,i as De,j as A,l as Oe,m as j,n as ke,o as Ae,p as M,r as je,s as Me,t as Ne,u as Pe,v as Fe,z as Ie}from"./ecdsaCapabilityManifest-B3u6J5gn.js";const N=`seams/router-ab-ecdsa-presign/fixed-2of2/v1`;function P(e,t){if(typeof e!=`string`||!e)throw Error(`${t} is required`);if(e.trim()!==e)throw Error(`${t} must be canonical`);return e}function Le(e){if(typeof e!=`object`||!e)throw Error(`poolIdentity is required`);let t=e;if(!Number.isSafeInteger(t.ownershipGeneration)||Number(t.ownershipGeneration)<1)throw Error(`poolIdentity.ownershipGeneration must be a positive safe integer`);if(t.pairRole!==`client`)throw Error(`poolIdentity.pairRole must be client`);if(t.protocolId!==`seams/router-ab-ecdsa-presign/fixed-2of2/v1`)throw Error(`poolIdentity.protocolId is unsupported`);let n=P(t.relayerUrl,`poolIdentity.relayerUrl`);if(n.replace(/\/+$/g,``)!==n)throw Error(`poolIdentity.relayerUrl must be canonical`);return{ownershipGeneration:Number(t.ownershipGeneration),relayerUrl:n,materialActivationB64u:P(t.materialActivationB64u,`poolIdentity.materialActivationB64u`),materialActivationId:P(t.materialActivationId,`poolIdentity.materialActivationId`),capability:P(t.capability,`poolIdentity.capability`),keyBinding:P(t.keyBinding,`poolIdentity.keyBinding`),walletId:P(t.walletId,`poolIdentity.walletId`),signingScopeB64u:P(t.signingScopeB64u,`poolIdentity.signingScopeB64u`),pairRole:`client`,keyEpoch:P(t.keyEpoch,`poolIdentity.keyEpoch`),activationEpoch:Re(t.activationEpoch),protocolId:N}}function Re(e){let t=r(e);if(!t.ok)throw Error(`poolIdentity.activationEpoch is invalid`);return t.value}function ze(e,t){return e.ownershipGeneration===t.ownershipGeneration&&e.relayerUrl===t.relayerUrl&&e.materialActivationB64u===t.materialActivationB64u&&e.materialActivationId===t.materialActivationId&&e.capability===t.capability&&e.keyBinding===t.keyBinding&&e.walletId===t.walletId&&e.signingScopeB64u===t.signingScopeB64u&&e.pairRole===t.pairRole&&e.keyEpoch===t.keyEpoch&&e.activationEpoch===t.activationEpoch&&e.protocolId===t.protocolId}function F(e){return[e.protocolId,e.relayerUrl,e.signingScopeB64u,e.materialActivationB64u,e.ownershipGeneration].join(`|`)}function Be(e){let t=ne(e.scope),n=e.materialActivation,r=String(e.relayerUrl||``).trim().replace(/\/+$/g,``);return{ownershipGeneration:e.ownershipGeneration,relayerUrl:r,materialActivationB64u:l(ue(n)),materialActivationId:n.activation_id,capability:n.capability,keyBinding:n.key_binding,walletId:t.wallet_id,signingScopeB64u:l(se(t)),pairRole:`client`,keyEpoch:t.signing_worker.key_epoch,activationEpoch:t.activation_epoch,protocolId:N}}const Ve=`ecdsa_capability_manifest_v3`,He=`ecdsa_current_capability_manifest_v2`,Ue=`ecdsa_role_local_material_v2`,We=`ecdsa_activation_commit_journal_v1`,Ge=`ecdsa_material_sealing_key_v1`,Ke=h.ecdsaCapabilityManifests,qe=h.ecdsaCurrentCapabilityManifests,Je=h.ecdsaRoleLocalMaterial,Ye=h.ecdsaActivationCommitJournals,Xe=h.ecdsaMaterialSealingKeys,I=h.ecdsaClientPresignatures;function L(e,t,n){let r=Object.keys(e).sort(),i=[...n].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${t} has unexpected fields`)}function Ze(e){let n=b(e.authority);if(!n)throw Error(`ECDSA capability selector authority is invalid`);return{capability:k(t(e.capability)),authority:n}}function R(e){return{capability:e.capability,authority:e.authority}}function z(e){return R(e.candidate.activationBinding.signer)}function B(e){return R(e.signer)}function V(e){return[String(e.capability),String(e.authority.walletId),String(e.authority.authorityDigest)]}function H(e){return{capability_ref:e.capability,wallet_id:e.authority.walletId,authority_digest:e.authority.authorityDigest,wallet_auth_method_id:e.authority.walletAuthMethodId}}function Qe(e){return b({kind:`wallet_auth_authority_ref`,walletId:e.wallet_id,authorityDigest:e.authority_digest,walletAuthMethodId:e.wallet_auth_method_id})}function $e(e,t){return e.kind===t.kind&&e.walletId===t.walletId&&e.authorityDigest===t.authorityDigest&&e.walletAuthMethodId===t.walletAuthMethodId}function et(e,t){let n=V(e),r=V(t);return n[0]===r[0]&&n[1]===r[1]&&n[2]===r[2]}function U(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function tt(e,t){return e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function W(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`evm`:return t.kind===`evm`&&e.namespace===t.namespace&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;case`tempo`:return t.kind===`tempo`&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;default:return Y(e)}}function nt(e,t){return e.kind===t.kind&&e.targetMemberships.length===t.targetMemberships.length&&e.targetMemberships.every((e,n)=>W(e,t.targetMemberships[n]))}function G(e,t){return e.kind===t.kind&&e.keyHandle===t.keyHandle&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.clientVerifyingPublicKey33B64u===t.clientVerifyingPublicKey33B64u&&U(e.participantIds,t.participantIds)&&e.relayerKeyId===t.relayerKeyId}function rt(e,t){return e.walletId===t.walletId&&W(e.chainTarget,t.chainTarget)&&e.keyHandle===t.keyHandle&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.signingRootId===t.signingRootId&&e.signingRootVersion===t.signingRootVersion&&e.applicationBindingDigestB64u===t.applicationBindingDigestB64u&&e.clientParticipantId===t.clientParticipantId&&e.relayerParticipantId===t.relayerParticipantId&&U(e.participantIds,t.participantIds)&&e.contextBinding32B64u===t.contextBinding32B64u&&e.derivationClientSharePublicKey33B64u===t.derivationClientSharePublicKey33B64u&&e.relayerPublicKey33B64u===t.relayerPublicKey33B64u&&e.groupPublicKey33B64u===t.groupPublicKey33B64u&&e.ethereumAddress===t.ethereumAddress&&te(e.publicCapability,t.publicCapability)}function it(e,t){return e.kind===t.kind&&e.keyHandle===t.keyHandle&&e.publicKeyB64u===t.publicKeyB64u&&U(e.participantIds,t.participantIds)&&e.thresholdOwnerAddress===t.thresholdOwnerAddress}function at(e,t){return e.manifestId===t.manifestId&&e.manifestRevision===t.manifestRevision}function ot(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`no_current_manifest`:return!0;case`exact_manifest`:return t.kind===`exact_manifest`&&e.manifestId===t.manifestId&&e.manifestRevision===t.manifestRevision;default:return Y(e)}}function st(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`no_current_generation`:return!0;case`exact_generation`:return t.kind===`exact_generation`&&e.serverGeneration===t.serverGeneration;default:return Y(e)}}function ct(e,t){return e.kind===t.kind&&e.capability===t.capability&&e.signerId===t.signerId&&e.walletId===t.walletId&&$e(e.authority,t.authority)&&nt(e.scope,t.scope)&&e.materialOwner===t.materialOwner&&e.signingRootId===t.signingRootId&&e.signingRootVersion===t.signingRootVersion}function lt(e,t){return ct(e,t)&&it(e.registeredPublicFacts,t.registeredPublicFacts)}function ut(e,t){return e.kind===t.kind&&e.sealingKeyId===t.sealingKeyId&&e.iv12B64u===t.iv12B64u&&e.ciphertextB64u===t.ciphertextB64u&&e.ciphertextDigest===t.ciphertextDigest}function dt(e,t){return e.kind===t.kind&&at(e.targetManifest,t.targetManifest)&&ct(e.signer,t.signer)&&G(e.roleLocalBinding,t.roleLocalBinding)&&e.bindingDigest===t.bindingDigest&&e.durableMaterialRef===t.durableMaterialRef}function K(e,t){return e.kind===t.kind&&e.correlationId===t.correlationId&&e.activationRequestDigest===t.activationRequestDigest&&e.serverGeneration===t.serverGeneration&&ft(e.serverActivationReceipt,t.serverActivationReceipt)}function ft(e,t){return e.kind===t.kind&&e.lifecycleId===t.lifecycleId&&e.activationDigest===t.activationDigest&&e.activatedAt===t.activatedAt&&x(e.protocolReceipt,t.protocolReceipt)}function pt(e,t){return e.kind===t.kind&&e.correlationId===t.correlationId&&st(e.expectedGeneration,t.expectedGeneration)&&e.requestDigest===t.requestDigest&&e.canonicalRequest===t.canonicalRequest}function mt(e,t){return e.kind===t.kind&&dt(e.activationBinding,t.activationBinding)&&ut(e.encryptedPending,t.encryptedPending)}function ht(e,t){if(e.kind!==t.kind||!(e.journalId===t.journalId&&ot(e.expectedManifest,t.expectedManifest)&&pt(e.activationCommand,t.activationCommand)&&mt(e.candidate,t.candidate)&&e.createdAt===t.createdAt))return!1;switch(e.kind){case`activation_prepared`:return!0;case`server_activation_committed`:return t.kind===`server_activation_committed`&&K(e.serverActivation,t.serverActivation);default:return Y(e)}}function gt(e,t){return e.kind===t.kind&&n(e.materialActivation,t.materialActivation)&&ie(e.routerAbEcdsaDerivationNormalSigning,t.routerAbEcdsaDerivationNormalSigning)&&rt(e.roleLocalPublicFacts,t.roleLocalPublicFacts)&&G(e.roleLocalBinding,t.roleLocalBinding)&&e.durableMaterialRef===t.durableMaterialRef&&e.bindingDigest===t.bindingDigest&&e.lifecycleId===t.lifecycleId&&e.ciphertextDigest===t.ciphertextDigest&&e.activationDigest===t.activationDigest&&e.activatedAt===t.activatedAt&&tt(e.runtimePolicyScope,t.runtimePolicyScope)}function _t(e,t){return e.kind===t.kind&&n(e.materialActivation,t.materialActivation)&&K(e.serverActivation,t.serverActivation)&&e.retention===t.retention}function vt(e,t){return e.kind===t.kind&&at(e.identity,t.identity)&&lt(e.signer,t.signer)&&_t(e.activation,t.activation)&&gt(e.durableMaterial,t.durableMaterial)&&e.committedAt===t.committedAt}function yt(e,t){try{let n=o(t.serverActivationReceipt,`ECDSA server activation receipt`);return t.kind===e.kind&&f(t.correlationId)===e.correlationId&&p(t.activationRequestDigest)===e.activationRequestDigest&&T(t.serverGeneration)===e.serverGeneration&&n.kind===e.serverActivationReceipt.kind&&n.lifecycleId===String(e.serverActivationReceipt.lifecycleId)&&n.activationDigest===String(e.serverActivationReceipt.activationDigest)&&d(n.activatedAt)===e.serverActivationReceipt.activatedAt&&x(ce(n.protocolReceipt),e.serverActivationReceipt.protocolReceipt)}catch{return!1}}function bt(e){let t=M({activationBinding:e.preparation.activationBinding,encryptedPending:e.encryptedPending});return xt({...e.preparation,candidate:t})}function xt(e){let t={journalId:e.journalId,candidate:e.candidate,requestDigest:e.requestDigest,canonicalRequest:e.canonicalRequest,createdAt:e.createdAt};switch(e.expectedManifest.kind){case`no_current_manifest`:if(e.expectedGeneration.kind!==`no_current_generation`)throw Error(`Initial ECDSA activation cannot expect a server generation`);return j({...t,expectedManifest:e.expectedManifest,expectedGeneration:e.expectedGeneration});case`exact_manifest`:if(e.expectedGeneration.kind!==`exact_generation`)throw Error(`Replacement ECDSA activation requires an exact server generation`);return j({...t,expectedManifest:e.expectedManifest,expectedGeneration:e.expectedGeneration});default:return Y(e.expectedManifest)}}function St(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be non-empty unpadded base64url`);let n=u(e);if(n.length===0||l(n)!==e)throw n.fill(0),Error(`${t} must be canonical base64url`);return n}function q(e){return new TextEncoder().encode(a(e))}async function Ct(){return await crypto.subtle.generateKey({name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}async function wt(e){let t=St(e.stateBlobB64u,`ECDSA state blob`),n=crypto.getRandomValues(new Uint8Array(12)),r=q(e.aadProjection);try{let i=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n,additionalData:r},e.key,t));try{return{iv12B64u:E(l(n)),ciphertextB64u:v(l(i)),digestB64u:l(await s(i))}}finally{i.fill(0)}}finally{t.fill(0),r.fill(0)}}async function Tt(e){let t=u(e);try{return l(await s(t))}finally{t.fill(0)}}async function Et(e){let t=u(e.iv12B64u),n=u(e.ciphertextB64u),r=q(e.aadProjection),i=null;try{if(i=new Uint8Array(await crypto.subtle.decrypt({name:`AES-GCM`,iv:t,additionalData:r},e.key,n)),i.length===0)throw Error(`decrypted ECDSA state blob must not be empty`);return l(i)}finally{t.fill(0),n.fill(0),r.fill(0),i?.fill(0)}}function Dt(e){let t=o(e,`ECDSA manifest identity`);return L(t,`ECDSA manifest identity`,[`manifestId`,`manifestRevision`]),O({manifestId:S(t.manifestId),manifestRevision:C(t.manifestRevision)})}function Ot(e){let t=o(e,`ECDSA manifest expectation`);switch(t.kind){case`no_current_manifest`:return L(t,`ECDSA no-current manifest expectation`,[`kind`]),Ce();case`exact_manifest`:return L(t,`ECDSA exact manifest expectation`,[`kind`,`manifestId`,`manifestRevision`]),Oe(O({manifestId:S(t.manifestId),manifestRevision:C(t.manifestRevision)}));default:throw Error(`ECDSA manifest expectation kind is invalid`)}}function kt(e){let t=o(e,`ECDSA capability target`);switch(t.kind){case`evm`:return L(t,`ECDSA EVM capability target`,[`kind`,`namespace`,`chainId`,`networkSlug`]),m({kind:t.kind,namespace:t.namespace,chainId:t.chainId,networkSlug:t.networkSlug});case`tempo`:return L(t,`ECDSA Tempo capability target`,[`kind`,`chainId`,`networkSlug`]),m({kind:t.kind,chainId:t.chainId,networkSlug:t.networkSlug});default:throw Error(`ECDSA capability target kind is invalid`)}}function At(e){let t=o(e,`ECDSA capability scope`);if(L(t,`ECDSA capability scope`,[`kind`,`targetMemberships`]),t.kind!==`evm_family`)throw Error(`ECDSA capability scope kind is invalid`);let n=i(t.targetMemberships,`ECDSA capability target memberships`),r=[];for(let e of n)r.push(kt(e));let[a,...s]=r;if(!a)throw Error(`ECDSA capability scope requires at least one target`);return De({targetMemberships:[a,...s]})}function jt(e){let t=o(e,`ECDSA role-local material binding`);if(L(t,`ECDSA role-local material binding`,[`kind`,`keyHandle`,`ecdsaThresholdKeyId`,`clientVerifyingPublicKey33B64u`,`participantIds`,`relayerKeyId`]),t.kind!==`ecdsa_role_local_material_binding`)throw Error(`ECDSA role-local material binding kind is invalid`);let n=i(t.participantIds,`ECDSA role-local participant ids`),r=[];for(let e of n)r.push(he(e));let[a,...s]=r;if(!a)throw Error(`ECDSA role-local material requires at least one participant`);return Ae({keyHandle:Ie(t.keyHandle),ecdsaThresholdKeyId:ve(t.ecdsaThresholdKeyId),clientVerifyingPublicKey33B64u:D(t.clientVerifyingPublicKey33B64u),participantIds:[a,...s],relayerKeyId:ge(t.relayerKeyId)})}function Mt(n){let r=o(n,`prepared ECDSA signer`);if(L(r,`prepared ECDSA signer`,[`kind`,`capability`,`signerId`,`walletId`,`authority`,`scope`,`materialOwner`,`signingRootId`,`signingRootVersion`]),r.kind!==`prepared_evm_family_signer`)throw Error(`prepared ECDSA signer kind is invalid`);let i=b(r.authority);if(!i)throw Error(`prepared ECDSA signer authority is invalid`);if(String(r.walletId)!==String(i.walletId))throw Error(`prepared ECDSA signer wallet does not match its authority`);return Ee({capability:k(t(r.capability)),signerId:re(r.signerId),authority:i,scope:At(r.scope),materialOwner:k(e(r.materialOwner)),signingRootId:pe(r.signingRootId),signingRootVersion:le(r.signingRootVersion)})}function Nt(e){let t=o(e,`encrypted ECDSA pending candidate`);if(L(t,`encrypted ECDSA pending candidate`,[`kind`,`sealingKeyId`,`iv12B64u`,`ciphertextB64u`,`ciphertextDigest`]),t.kind!==`encrypted_ecdsa_pending_candidate`)throw Error(`encrypted ECDSA pending candidate kind is invalid`);return Se({sealingKeyId:w(t.sealingKeyId),iv12B64u:E(t.iv12B64u),ciphertextB64u:v(t.ciphertextB64u),ciphertextDigest:oe(t.ciphertextDigest)})}function Pt(e){let t=o(e,`ECDSA activation binding`);if(L(t,`ECDSA activation binding`,[`kind`,`targetManifest`,`signer`,`roleLocalBinding`,`bindingDigest`,`durableMaterialRef`]),t.kind!==`ecdsa_activation_binding`)throw Error(`ECDSA activation binding kind is invalid`);return je({targetManifest:Dt(t.targetManifest),signer:Mt(t.signer),roleLocalBinding:jt(t.roleLocalBinding),bindingDigest:A(t.bindingDigest),durableMaterialRef:ye(t.durableMaterialRef)})}function Ft(e){let t=o(e,`prepared ECDSA activation candidate`);if(L(t,`prepared ECDSA activation candidate`,[`kind`,`activationBinding`,`encryptedPending`]),t.kind!==`prepared_ecdsa_activation_candidate`)throw Error(`prepared ECDSA activation candidate kind is invalid`);return M({activationBinding:Pt(t.activationBinding),encryptedPending:Nt(t.encryptedPending)})}function It(e){let t=o(e,`ECDSA server generation expectation`);switch(t.kind){case`no_current_generation`:return L(t,`ECDSA no-current server generation expectation`,[`kind`]),we();case`exact_generation`:return L(t,`ECDSA exact server generation expectation`,[`kind`,`serverGeneration`]),Pe(T(t.serverGeneration));default:throw Error(`ECDSA server generation expectation kind is invalid`)}}function Lt(e){let t=o(e,`prepared ECDSA activation journal`);if(L(t,`prepared ECDSA activation journal`,[`kind`,`journalId`,`expectedManifest`,`activationCommand`,`candidate`,`createdAt`]),t.kind!==`activation_prepared`)throw Error(`prepared ECDSA activation journal kind is invalid`);let n=o(t.activationCommand,`ECDSA activation command`);if(L(n,`ECDSA activation command`,[`kind`,`correlationId`,`expectedGeneration`,`requestDigest`,`canonicalRequest`]),n.kind!==`ecdsa_server_activation_command`)throw Error(`ECDSA activation command kind is invalid`);let r=f(t.journalId);if(f(n.correlationId)!==r)throw Error(`ECDSA activation command correlation does not match its journal`);let i=Ot(t.expectedManifest),a=It(n.expectedGeneration),s={journalId:r,candidate:Ft(t.candidate),requestDigest:p(n.requestDigest),canonicalRequest:ae(n.canonicalRequest),createdAt:d(t.createdAt)};switch(i.kind){case`no_current_manifest`:if(a.kind!==`no_current_generation`)throw Error(`initial ECDSA journal has an exact server generation`);return j({...s,expectedManifest:i,expectedGeneration:a});case`exact_manifest`:if(a.kind!==`exact_generation`)throw Error(`replacement ECDSA journal is missing its exact server generation`);return j({...s,expectedManifest:i,expectedGeneration:a})}return Y(i)}function Rt(e){return{kind:`activation_prepared`,journalId:e.journalId,expectedManifest:e.expectedManifest,activationCommand:e.activationCommand,candidate:e.candidate,createdAt:e.createdAt}}function zt(e){return e.kind===`activation_prepared`?e:xt({journalId:e.journalId,expectedManifest:e.expectedManifest,expectedGeneration:e.activationCommand.expectedGeneration,candidate:e.candidate,requestDigest:e.activationCommand.requestDigest,canonicalRequest:e.activationCommand.canonicalRequest,createdAt:e.createdAt})}function Bt(e){let t=o(e,`server-committed ECDSA activation journal`);if(L(t,`server-committed ECDSA activation journal`,[`kind`,`journalId`,`expectedManifest`,`activationCommand`,`candidate`,`createdAt`,`serverActivation`]),t.kind!==`server_activation_committed`)throw Error(`server-committed ECDSA activation journal kind is invalid`);let n=Lt(Rt(t)),r=Vt(t.serverActivation),i=xe({preparedJournal:n,serverCommit:r.serverCommit});if(!yt(i.serverActivation,r.record))throw Error(`ECDSA server activation commit fields are inconsistent`);return i}function Vt(e){let t=o(e,`ECDSA server activation commit`);if(L(t,`ECDSA server activation commit`,[`kind`,`correlationId`,`activationRequestDigest`,`serverGeneration`,`serverActivationReceipt`]),t.kind!==`ecdsa_server_activation_commit`)throw Error(`ECDSA server activation commit kind is invalid`);let n=o(t.serverActivationReceipt,`ECDSA server activation receipt`);if(L(n,`ECDSA server activation receipt`,[`kind`,`lifecycleId`,`activationDigest`,`activatedAt`,`protocolReceipt`]),n.kind!==`ecdsa_server_activation_receipt`)throw Error(`ECDSA server activation receipt kind is invalid`);return{record:t,serverCommit:{correlationId:f(t.correlationId),activationRequestDigest:p(t.activationRequestDigest),serverGeneration:T(t.serverGeneration),protocolReceipt:n.protocolReceipt}}}function Ht(e){let t=o(e,`ECDSA activation journal`);switch(t.kind){case`activation_prepared`:return Lt(t);case`server_activation_committed`:return Bt(t);default:throw Error(`ECDSA activation journal kind is invalid`)}}function Ut(e){let t=o(e,`registered ECDSA public facts`);if(L(t,`registered ECDSA public facts`,[`kind`,`keyHandle`,`publicKeyB64u`,`participantIds`,`thresholdOwnerAddress`]),t.kind!==`verified_ecdsa_public_facts`)throw Error(`registered ECDSA public facts kind is invalid`);return de({keyHandle:ee(t.keyHandle),publicKeyB64u:t.publicKeyB64u,participantIds:i(t.participantIds,`registered ECDSA participant ids`),thresholdOwnerAddress:t.thresholdOwnerAddress})}function J(e){let t=o(e,`active ECDSA manifest proof`);L(t,`active ECDSA manifest proof`,[`activation_binding`,`server_activation`,`registered_public_facts`,`role_local_public_facts`,`router_ab_ecdsa_derivation_normal_signing`,`runtime_policy_scope`,`ciphertext_digest`,`committed_at`]);let n=Pt(t.activation_binding),r=Vt(t.server_activation),i=Me({activationBinding:n,serverCommit:r.serverCommit});if(!yt(i,r.record))throw Error(`ECDSA server activation commit fields are inconsistent`);let a=ke({activationBinding:n,serverActivation:i,routerAbEcdsaDerivationNormalSigning:fe(t.router_ab_ecdsa_derivation_normal_signing),roleLocalPublicFacts:_e(t.role_local_public_facts),ciphertextDigest:y(t.ciphertext_digest),runtimePolicyScope:c(t.runtime_policy_scope)}),s=d(t.committed_at);return{activationBinding:n,serverActivation:i,durableMaterial:a,activeManifest:Ne({activationBinding:n,serverActivation:i,registeredPublicFacts:Ut(t.registered_public_facts),durableMaterial:a,committedAt:s}),committedAt:s}}function Wt(e){let t=o(e,`ECDSA capability manifest row`),n=[`record_version`,`manifest_id`,`manifest_revision`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`manifest_state`,`active_proof`];switch(t.manifest_state){case`active`:{L(t,`active ECDSA capability manifest row`,n);let e=J(t.active_proof),r=B(e.activeManifest);return Gt(t,e.activeManifest,r),{state:`active`,selector:r,manifest:e.activeManifest,activeProof:e}}case`replaced`:{L(t,`replaced ECDSA capability manifest row`,[...n,`replacement_proof`]);let e=J(t.active_proof),r=J(t.replacement_proof),i=Te({activeManifest:e.activeManifest,replacementManifest:r.activeManifest}),a=B(e.activeManifest);return Gt(t,e.activeManifest,a),{state:`replaced`,selector:a,manifest:i,activeProof:e,replacementProof:r}}default:throw Error(`ECDSA capability manifest row state is invalid`)}}function Gt(e,t,n){if(e.record_version!==`ecdsa_capability_manifest_v3`||S(e.manifest_id)!==t.identity.manifestId||C(e.manifest_revision)!==t.identity.manifestRevision||String(e.capability_ref)!==String(n.capability)||String(e.wallet_id)!==String(n.authority.walletId)||String(e.authority_digest)!==String(n.authority.authorityDigest))throw Error(`ECDSA capability manifest row identity is inconsistent`)}function Kt(e){return{record_version:He,...H(B(e)),manifest_id:e.identity.manifestId,manifest_revision:e.identity.manifestRevision}}function qt(e){let n=o(e,`current ECDSA capability pointer`);if(L(n,`current ECDSA capability pointer`,[`record_version`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`manifest_id`,`manifest_revision`]),n.record_version!==He)throw Error(`current ECDSA capability pointer version is invalid`);let r=Qe(n);if(!r)throw Error(`current ECDSA capability pointer authority is invalid`);return{selector:{capability:k(t(n.capability_ref)),authority:r},manifestId:S(n.manifest_id),manifestRevision:C(n.manifest_revision)}}function Jt(e,t){return{record_version:Ue,durable_material_ref:e.binding.durableMaterialRef,binding_digest:e.binding.bindingDigest,...H(B(t)),sealing_key_id:e.sealingKeyId,iv:e.iv12B64u,ciphertext:e.ciphertextB64u}}function Yt(e){let n=o(e,`ECDSA role-local material row`);if(L(n,`ECDSA role-local material row`,[`record_version`,`durable_material_ref`,`binding_digest`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`sealing_key_id`,`iv`,`ciphertext`]),n.record_version!==Ue)throw Error(`ECDSA role-local material row version is invalid`);let r=Qe(n);if(!r)throw Error(`ECDSA role-local material authority is invalid`);return{durableMaterialRef:ye(n.durable_material_ref),bindingDigest:A(n.binding_digest),selector:{capability:k(t(n.capability_ref)),authority:r}}}function Xt(e,t){let n=o(e,`ECDSA role-local material row`),r=Yt(n),i=Fe({binding:t.durableMaterial,sealingKeyId:w(n.sealing_key_id),iv12B64u:E(n.iv),ciphertextB64u:v(n.ciphertext)});if(r.durableMaterialRef!==i.binding.durableMaterialRef||r.bindingDigest!==i.binding.bindingDigest||!et(r.selector,B(t.activeManifest)))throw Error(`ECDSA role-local material row binding is inconsistent`);return i}function Zt(e,t){return e.binding.durableMaterialRef===t.durableMaterial.durableMaterialRef&&e.binding.bindingDigest===t.durableMaterial.bindingDigest&&e.binding.lifecycleId===t.durableMaterial.lifecycleId&&e.binding.ciphertextDigest===t.durableMaterial.ciphertextDigest&&e.binding.activationDigest===t.durableMaterial.activationDigest&&e.binding.activatedAt===t.durableMaterial.activatedAt&&n(e.binding.materialActivation,t.durableMaterial.materialActivation)&&G(e.binding.roleLocalBinding,t.durableMaterial.roleLocalBinding)}function Qt(e){return{record_version:We,journal_id:e.journalId,...H(z(e)),journal:e}}function $t(e){let t=o(e,`ECDSA activation commit journal row`);if(L(t,`ECDSA activation commit journal row`,[`record_version`,`journal_id`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`journal`]),t.record_version!==We)throw Error(`ECDSA activation commit journal row version is invalid`);let n=Ht(t.journal),r=z(n);if(f(t.journal_id)!==n.journalId||String(t.capability_ref)!==String(r.capability)||String(t.wallet_id)!==String(r.authority.walletId)||String(t.authority_digest)!==String(r.authority.authorityDigest))throw Error(`ECDSA activation commit journal row identity is inconsistent`);return{journal:n,selector:r}}function en(e){return typeof CryptoKey>`u`||!(e instanceof CryptoKey)||e.type!==`secret`||e.extractable||e.algorithm.name!==`AES-GCM`?!1:e.usages.includes(`encrypt`)&&e.usages.includes(`decrypt`)}function tn(e,t){return{record_version:Ge,key_id:e,key:t}}function nn(e){let t=o(e,`ECDSA material sealing key row`);if(L(t,`ECDSA material sealing key row`,[`record_version`,`key_id`,`key`]),t.record_version!==Ge)throw Error(`ECDSA material sealing key row version is invalid`);if(!en(t.key))throw Error(`ECDSA material sealing key must be a non-extractable AES-GCM key`);return{keyId:w(t.key_id),key:t.key}}function Y(e){throw Error(`Unexpected ECDSA persistence branch: ${String(e)}`)}const rn=5*6e4;function an(e,t,r){let i=e.binding.routerAbEcdsaDerivationNormalSigning.scope,a=me(e.binding.materialActivation);return i.wallet_id===t.walletId&&l(se(i))===t.signingScopeB64u&&l(ue(a))===t.materialActivationB64u&&i.signing_worker.key_epoch===t.keyEpoch&&i.activation_epoch===t.activationEpoch&&a.activation_id===t.materialActivationId&&a.capability===t.capability&&a.key_binding===t.keyBinding&&a.material_owner===t.walletId&&e.binding.durableMaterialRef===r.durableMaterialRef&&e.binding.bindingDigest===r.bindingDigest&&n(e.binding.materialActivation,r.materialActivation)}function on(e,t){return e.materialActivation.activationId===t.materialActivationId&&e.materialActivation.capability===t.capability&&e.materialActivation.keyBinding===t.keyBinding&&e.materialActivation.materialOwner===t.walletId}function sn(e){if(typeof e!=`string`||!/^ecdsa-client-presignature-[A-Za-z0-9_-]+$/.test(e))throw Error(`ECDSA durable presignature record id is invalid`);return e}function X(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} is invalid`);return e}function Z(e){if(!e||typeof e!=`object`||!(`record_id`in e))return null;let t=e.record_id;return typeof t==`string`?t:null}function cn(){return typeof IDBTransaction<`u`&&`durability`in IDBTransaction.prototype}async function ln(e,t=1/0){let n=0;for(;e&&n<t;)await e.delete(),n+=1,e=await e.continue();return n}async function un(e,t,n){return await ln(await e.store(I).index(g.walletExpiresAt).openCursor(IDBKeyRange.bound([t,0],[t,n])),32)}async function dn(e,t,n){await un(e,t.walletId,n);let r=e.store(I),i=await r.index(g.poolIdentityKey).getAll(F(t));t.ownershipGeneration===1&&i.push(...await r.index(g.poolIdentityKey).getAll(pn(t)));let a=[];for(let e of i)try{let t=Q(e);t.expires_at_ms<=n?await r.delete(t.record_id):(e.pool_identity_key!==t.pool_identity_key&&await r.put(t),a.push(t))}catch{let t=Z(e);t&&await r.delete(t)}return a}function fn(e){let{ownershipGeneration:t,...n}=e.poolIdentity;return{domain:`seams/ecdsa-client-presignature/v1`,version:1,pool_identity:t===1?n:e.poolIdentity,durable_material_ref:e.durableMaterialRef,presignature_id:e.presignatureId,group_public_key33_b64u:e.groupPublicKey33B64u,big_r33_b64u:e.bigR33B64u,created_at_ms:e.createdAtMs,expires_at_ms:e.expiresAtMs,sealing_key_id:e.sealingKeyId}}function pn(e){return[e.protocolId,e.relayerUrl,e.signingScopeB64u,e.materialActivationB64u].join(`|`)}function Q(e){let t=o(e,`ECDSA durable presignature row`);if(L(t,`ECDSA durable presignature row`,[`kind`,`record_id`,`pool_identity`,`pool_identity_key`,`wallet_id`,`material_activation_id`,`durable_material_ref`,`presignature_id`,`group_public_key33_b64u`,`big_r33_b64u`,`created_at_ms`,`expires_at_ms`,`sealed`]),t.kind!==`sealed_available_client_presignature_v1`)throw Error(`ECDSA durable presignature row kind is invalid`);let n=o(t.pool_identity,`ECDSA durable presignature pool identity`),r=!Object.hasOwn(n,`ownershipGeneration`);L(n,`ECDSA durable presignature pool identity`,[...r?[]:[`ownershipGeneration`],`activationEpoch`,`capability`,`keyBinding`,`keyEpoch`,`materialActivationB64u`,`materialActivationId`,`pairRole`,`protocolId`,`relayerUrl`,`signingScopeB64u`,`walletId`]);let i=Le(r?{...n,ownershipGeneration:1}:n),a=sn(t.record_id),s=String(t.pool_identity_key??``);if(s!==F(i)&&!(r&&s===pn(i)))throw Error(`ECDSA durable presignature pool identity index is inconsistent`);let c=String(t.wallet_id??``).trim(),l=String(t.material_activation_id??``).trim();if(!c||c!==i.walletId)throw Error(`ECDSA durable presignature wallet binding is inconsistent`);if(!l||l!==i.materialActivationId)throw Error(`ECDSA durable presignature activation binding is inconsistent`);let u=be(t.durable_material_ref);if(!on(u,i))throw Error(`ECDSA durable presignature material binding is inconsistent`);let d=String(t.presignature_id??``).trim();if(!d)throw Error(`ECDSA durable presignature id is invalid`);let f=D(t.group_public_key33_b64u),p=D(t.big_r33_b64u),m=X(t.created_at_ms,`created_at_ms`),h=X(t.expires_at_ms,`expires_at_ms`);if(m>Date.now()+3e5)throw Error(`ECDSA durable presignature creation timestamp is in the future`);if(h<=m)throw Error(`ECDSA durable presignature expiry must follow creation`);if(h-m>7776e6)throw Error(`ECDSA durable presignature lifetime exceeds the maximum`);let g=o(t.sealed,`ECDSA durable presignature sealed payload`);if(L(g,`ECDSA durable presignature sealed payload`,[`kind`,`sealing_key_id`,`iv12_b64u`,`ciphertext_b64u`,`ciphertext_digest_b64u`]),g.kind!==`ecdsa_activation_aes_gcm_v1`)throw Error(`ECDSA durable presignature sealing kind is invalid`);return{kind:`sealed_available_client_presignature_v1`,record_id:a,pool_identity:i,pool_identity_key:F(i),wallet_id:c,material_activation_id:l,durable_material_ref:u,presignature_id:d,group_public_key33_b64u:f,big_r33_b64u:p,created_at_ms:m,expires_at_ms:h,sealed:{kind:`ecdsa_activation_aes_gcm_v1`,sealing_key_id:w(g.sealing_key_id),iv12_b64u:E(g.iv12_b64u),ciphertext_b64u:v(g.ciphertext_b64u),ciphertext_digest_b64u:y(g.ciphertext_digest_b64u)}}}function mn(e){return{kind:`sealed_available_client_presignature_v1`,recordId:e.record_id,poolIdentity:e.pool_identity,durableMaterialRef:e.durable_material_ref,presignatureId:e.presignature_id,groupPublicKey33B64u:e.group_public_key33_b64u,bigR33B64u:e.big_r33_b64u,createdAtMs:e.created_at_ms,expiresAtMs:e.expires_at_ms,sealingKeyId:e.sealed.sealing_key_id}}async function hn(e){let t=crypto.getRandomValues(new Uint8Array(12)),n=q(fn(e.metadata));try{let r=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:t,additionalData:n},e.key,e.plaintext97));try{let e=l(r);return{iv12B64u:E(l(t)),ciphertextB64u:v(e),ciphertextDigestB64u:y(l(await s(r)))}}finally{r.fill(0)}}finally{t.fill(0),n.fill(0),e.plaintext97.fill(0)}}async function gn(e){let t=u(e.sealed.iv12_b64u),n=u(e.sealed.ciphertext_b64u),r=q(fn(e.metadata)),i=null;try{if(l(await s(n))!==e.sealed.ciphertext_digest_b64u)throw Error(`ECDSA durable presignature ciphertext digest mismatch`);if(i=new Uint8Array(await crypto.subtle.decrypt({name:`AES-GCM`,iv:t,additionalData:r},e.key,n)),i.length!==97)throw Error(`ECDSA durable presignature plaintext length is invalid`);return i.slice()}finally{t.fill(0),n.fill(0),r.fill(0),i?.fill(0)}}async function _n(e,t,n){let r=e.store(I),i=await r.index(g.walletMaterialActivationId).getAll([t,n]);for(let e of i){let t=Z(e);t&&await r.delete(t)}}async function $(e,t){let n=await e.store(h.appState).get(`wallet_ownership_generation:${t}`);if(n===void 0)return 1;let r=o(n,`Wallet ownership generation`).value;if(typeof r!=`number`||!Number.isSafeInteger(r)||r<1)throw Error(`Stored wallet ownership generation is invalid`);return r}async function vn(e,t,n){if(await $(e,t)!==n)throw Error(`Wallet ownership generation requires fresh authentication`)}async function yn(e,t,n){let r=await $(e,t);if(n<r)throw Error(`Wallet session belongs to an obsolete ownership generation`);if(n===r)return;await e.store(h.appState).put({key:`wallet_ownership_generation:${t}`,value:n});let i=await e.store(h.ecdsaClientPresignatures).index(g.walletId).openCursor(t);for(;i;){let e=!0;try{e=Q(i.value).pool_identity.ownershipGeneration<n}catch{}e&&await i.delete(),i=await i.continue()}}async function bn(e,t){await _.runTransaction([h.appState],`readonly`,xn.bind(null,e,t))}function xn(e,t,n){return vn(n,e,t)}async function Sn(e,t){await _.runTransaction([h.appState,h.ecdsaClientPresignatures],`readwrite`,Cn.bind(null,e,t))}async function Cn(e,t,n){t<=await $(n,e)||await yn(n,e,t)}export{B as $,vt as A,Ze as B,I as C,Tt as D,bt as E,rt as F,Yt as G,Bt as H,K as I,nn as J,Xt as K,wt as L,gt as M,it as N,Et as O,G as P,z as Q,Ct as R,qe as S,Y as T,$t as U,J as V,Wt as W,tt as X,zt as Y,H as Z,cn as _,rn as a,Kt as at,Ke as b,hn as c,F as ct,sn as d,Le as dt,R as et,X as f,_n as g,dn as h,Sn as i,Jt as it,nt as j,ht as k,on as l,ze as lt,Z as m,bn as n,et as nt,an as o,tn as ot,Q as p,qt as q,vn as r,Qt as rt,gn as s,$e as st,yn as t,V as tt,mn as u,Be as ut,Ye as v,Xe as w,Je as x,Ve as y,Zt as z};

package/dist/esm/sdk/walletRecoveryAdminProof-CtH8_lph.js

@@ -1 +0,0 @@
-import{nt as e,ot as t}from"./activeWalletSession-BtEHhe99.js";import{r as n}from"./base64-BmKR3UqU.js";import{r,t as i}from"./secureRandomId-8LSc91aN.js";import{o as a}from"./signerSlot-CpyIfl3J.js";import{l as o}from"./wallet-recovery-BEui57xM.js";import{n as s,s as c,t as l,u}from"./helpers-BXezXx19.js";import{i as ee}from"./pendingWalletRecoveryCodeBackup-LbstFwcY.js";import{t as d}from"./walletCustodyOperation-BO_tSfGY.js";import{t as f}from"./webauthnPromptCoordinator-CBkTiMP0.js";import{i as p}from"./collectAuthenticationCredentialForChallengeB64u-CSwy9csE.js";function m(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===5&&n.every(e=>[`ok`,`challengeId`,`challenge_digest`,`expiresAtMs`,`otpChannel`].includes(e))&&t.get(`ok`)===!0)return{kind:`success`,challengeId:t.get(`challengeId`),challengeDigest:t.get(`challenge_digest`),expiresAtMs:t.get(`expiresAtMs`),otpChannel:t.get(`otpChannel`)};let r=[`ok`,`code`,`message`,`retryAfterMs`];if((t.size===3||t.size===4)&&n.every(e=>r.includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`&&typeof t.get(`message`)==`string`&&(t.size===3||typeof t.get(`retryAfterMs`)==`number`)){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function h(e){let t;try{t=await S({relayUrl:e.relayUrl,path:`/wallets/custody/email-otp/challenge`,body:{walletId:e.walletId,providerSubjectId:e.providerSubjectId,operation:e.operation,payload:e.payload,...e.requestOrigin?{requestOrigin:e.requestOrigin}:{}},fetchImpl:e.fetchImpl})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`Email OTP challenge request failed`}}let n=m(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status!==200||n.kind!==`success`)return{kind:t.status>=400&&t.status<500?`rejected`:`transport_failed`,message:r||`Email OTP challenge failed (HTTP ${t.status})`};let i=typeof n.challengeId==`string`?n.challengeId.trim():``,a=typeof n.challengeDigest==`string`?n.challengeDigest.trim():``,o=Number(n.expiresAtMs),s=typeof n.otpChannel==`string`?n.otpChannel.trim():``;return!i||!a||!Number.isSafeInteger(o)||o<=0||!s?{kind:`transport_failed`,message:`Email OTP challenge returned an unusable payload`}:{kind:`ready`,challengeId:i,challenge_digest:a,expiresAtMs:o,otpChannel:s}}function g(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[`ok`,`activeCodeCount`,`totalCodeCount`,`issuedAtMs`,`storeVersion`,`backupOutstanding`],r=[...t.keys()];if(t.size===n.length&&r.every(e=>n.includes(e))&&t.get(`ok`)===!0)return{kind:`success`,activeCodeCount:t.get(`activeCodeCount`),totalCodeCount:t.get(`totalCodeCount`),issuedAtMs:t.get(`issuedAtMs`),storeVersion:t.get(`storeVersion`),backupOutstanding:t.get(`backupOutstanding`)};let i=[`ok`,`code`,`message`];if(t.size===i.length&&r.every(e=>i.includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function _(e){let t;try{t=await S({relayUrl:e.relayUrl,path:`/wallets/${encodeURIComponent(e.walletId)}/recovery/status`,body:{requestId:e.requestId,factorProof:e.factorProof},fetchImpl:e.fetchImpl})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`recovery status request failed`}}let n=g(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status===401||t.status===403)return{kind:`unauthorized`,message:r||`recovery status is unauthorized`};if(t.status===404)return{kind:`no_recovery_set`,message:r||`this wallet has no recovery set`};if(t.status!==200)return{kind:`transport_failed`,message:r||`recovery status failed (HTTP ${t.status})`};if(n.kind!==`success`)return{kind:`transport_failed`,message:`recovery status returned an unusable payload`};let i=Number(n.activeCodeCount),a=Number(n.totalCodeCount),o=Number(n.issuedAtMs),s=typeof n.storeVersion==`string`?n.storeVersion.trim():``;return!Number.isSafeInteger(i)||i<0||!Number.isSafeInteger(a)||a<i||!Number.isSafeInteger(o)||o<=0||!s||typeof n.backupOutstanding!=`boolean`?{kind:`transport_failed`,message:`recovery status returned an unusable payload`}:{kind:`ready`,walletId:e.walletId,activeCodeCount:i,totalCodeCount:a,issuedAtMs:o,storeVersion:s,backupOutstanding:n.backupOutstanding,pendingLocalBackup:!1}}function v(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===2&&n.includes(`ok`)&&n.includes(`issuedAtMs`)&&t.get(`ok`)===!0)return{kind:`success`,issuedAtMs:t.get(`issuedAtMs`)};if(t.size===3&&n.includes(`ok`)&&n.includes(`code`)&&n.includes(`message`)&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function y(e){let t;try{t=await S({relayUrl:e.relayUrl,path:`/wallets/recovery/acknowledge-backup`,body:{walletId:e.walletId,requestId:e.requestId,expectedIssuedAtMs:e.expectedIssuedAtMs,factorProof:e.factorProof},fetchImpl:e.fetchImpl})}catch(e){return{kind:`transport_failed`,message:e instanceof Error?e.message:`recovery backup acknowledgement failed`}}let n=v(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status===401||t.status===403)return{kind:`unauthorized`,message:r||`recovery backup acknowledgement is unauthorized`};if(t.status===404)return{kind:`no_recovery_set`,message:r||`this wallet has no recovery set`};if(t.status===409)return{kind:`conflict`,message:r||`Recovery codes changed. Check status and review the current set.`};if(t.status!==200)return{kind:`transport_failed`,message:r||`recovery backup acknowledgement failed (HTTP ${t.status})`};if(n.kind!==`success`)return{kind:`transport_failed`,message:`recovery backup acknowledgement returned an unusable payload`};let i=Number(n.issuedAtMs);return!Number.isSafeInteger(i)||i<=0?{kind:`transport_failed`,message:`recovery backup acknowledgement returned an unusable payload`}:{kind:`acknowledged`,walletId:e.walletId,issuedAtMs:i}}function b(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===3&&n.every(e=>[`ok`,`issuedAtMs`,`storeVersion`].includes(e))&&t.get(`ok`)===!0)return{kind:`success`,issuedAtMs:t.get(`issuedAtMs`),storeVersion:t.get(`storeVersion`)};if(t.size===3&&n.every(e=>[`ok`,`code`,`message`].includes(e))&&t.get(`ok`)===!1&&typeof t.get(`code`)==`string`){let e=t.get(`message`);return{kind:`failure`,message:typeof e==`string`&&e.trim()?e.trim():null}}return{kind:`invalid`}}async function x(e){let t=await S({relayUrl:e.relayUrl,path:`/wallets/recovery/rotate`,body:{walletId:e.walletId,expectedStoreVersion:e.expectedStoreVersion,manifestKekWraps:e.replacement.manifestKekWraps,entries:[e.replacement.entry],recoveryCodeLocators:e.recoveryCodeLocators,factorProof:e.factorProof},fetchImpl:e.fetchImpl}),n=b(await t.json().catch(()=>null)),r=n.kind===`failure`&&n.message?n.message:``;if(t.status===200&&n.kind===`success`){let e=Number(n.issuedAtMs),t=typeof n.storeVersion==`string`?n.storeVersion.trim():``;return!Number.isSafeInteger(e)||e<=0||!t?{kind:`transport_failed`,message:`rotation returned an unusable response`}:{kind:`rotated`,issuedAtMs:e,storeVersion:t}}return t.status===404?{kind:`no_recovery_set`,message:r||`no recovery set`}:t.status===409?{kind:`conflict`,message:r||`recovery set changed`}:t.status===400?{kind:`rejected`,message:r||`rotation rejected`}:{kind:`transport_failed`,message:r||`rotation failed (HTTP ${t.status})`}}async function S(n){let r=`${t(n.relayUrl)}${n.path}`;return await(n.fetchImpl||fetch)(r,e({headers:{Accept:`application/json`},body:n.body}))}var C=class extends Error{code=`wallet_origin_webauthn_unavailable`;constructor(e){super(e),this.name=`WalletOriginWebAuthnUnavailableError`}};async function w(e,t,n){let r=T(e,t);try{return e===`create`?await navigator.credentials.create({publicKey:r,...n.abortSignal?{signal:n.abortSignal}:{}}):await navigator.credentials.get({publicKey:r,...n.abortSignal?{signal:n.abortSignal}:{}})}catch(t){throw e===`create`&&(N(t)||P(t))?new C(`Wallet-origin WebAuthn registration is unavailable: ${F(t)}`):t}}function T(e,t){return e===`create`?E(t):D(t)}function E(e){return{...e,challenge:M(e.challenge),user:{...e.user,id:M(e.user.id)},excludeCredentials:e.excludeCredentials?.map(O),extensions:k(e.extensions)}}function D(e){return{...e,challenge:M(e.challenge),allowCredentials:e.allowCredentials?.map(O),extensions:k(e.extensions)}}function O(e){return{...e,id:M(e.id)}}function k(e){if(!e)return e;let t={...e},n=t.prf;if(n&&typeof n==`object`){let e={...n};if(e.eval&&typeof e.eval==`object`&&(e.eval=A(e.eval)),e.evalByCredential&&typeof e.evalByCredential==`object`){let t={};for(let[n,r]of Object.entries(e.evalByCredential))t[n]=r&&typeof r==`object`?A(r):r;e.evalByCredential=t}t.prf=e}return t}function A(e){return{...e,...j(e.first)?{first:M(e.first)}:{},...j(e.second)?{second:M(e.second)}:{}}}function j(e){return e instanceof ArrayBuffer||ArrayBuffer.isView(e)}function M(e){if(e instanceof ArrayBuffer)return e.slice(0);let t=e,n=new Uint8Array(t.buffer,t.byteOffset,t.byteLength).slice();if(e instanceof DataView)return new DataView(n.buffer);let r=Object.getPrototypeOf(e).constructor;return new r(n.buffer)}function N(e){let t=F(e);return/origin of the document is not the same as its ancestors/i.test(t)}function P(e){let t=I(e),n=F(e),r=t===`NotAllowedError`,i=/document is not focused|not focused|focus/i.test(n);return!!(r&&i)}function F(e){return String(e?.message||``)}function I(e){let t=e?.name;return typeof t==`string`?t:``}function L(e,t){return(e||t||``).toLowerCase()}function R(e){let t=n(String(e||``));if(t.length!==32)throw Error(`Invalid WebAuthn challenge: expected 32 bytes, got ${t.length}`);return t}function z(e){if(e.kind!==`wallet_registration`)throw Error(`Wallet registration challenge is unavailable`);return e.challengeB64u}function B(e){let t=a(String(e.walletId||``).trim());if(String(e.intendedUserName||``).trim()!==String(t))throw Error(`WebAuthn registration user.name must match walletId`);return{walletId:t}}var V=class{rpIdOverride;abortController;removePageAbortHandlers;removeExternalAbortListener;constructor(e){this.rpIdOverride=e}getRpId(){try{return L(this.rpIdOverride,window?.location?.hostname)}catch{return this.rpIdOverride||``}}getAuthenticationCredentialsSerializedForChallengeB64u(e){let t=`webauthn-get-${i(12,`WebAuthn get request IDs`)}`;return f.runImmediate({owner:{kind:`wallet_request`,requestId:t,operation:`authentication`},operation:this.executeAuthenticationCredential.bind(this,e)})}async executeAuthenticationCredential({subjectId:e,challengeB64u:t,allowCredentials:r=[],includeSecondPrfOutput:i=!1,cancellation:a={kind:`none`}}){this.abortController=new AbortController,this.removePageAbortHandlers=q(this.abortController),this.removeExternalAbortListener=H(this.abortController,a);let o=this.getRpId(),u={challenge:R(t),rpId:o,userVerification:`preferred`,timeout:6e4,extensions:{prf:{eval:{first:l(),second:s()}}}};r.length>0&&(u.allowCredentials=r.map(e=>({id:n(e.id),type:`public-key`,transports:e.transports})));try{let e=c({credential:await w(`get`,u,{abortSignal:this.abortController.signal}),firstPrfOutput:!0,secondPrfOutput:i});return G(e,t),e}finally{this.removePageAbortHandlers?.(),this.removePageAbortHandlers=void 0,this.removeExternalAbortListener?.(),this.removeExternalAbortListener=void 0,this.abortController=void 0}}generateRegistrationCredentialsInternal(e){switch(e.prompt.kind){case`reserved`:return f.runReserved({reservation:e.prompt.reservation,owner:e.prompt.owner,operation:this.executeRegistrationCredential.bind(this,e)});case`immediate`:return f.runImmediate({owner:{kind:`wallet_request`,requestId:e.prompt.requestId,operation:`registration`},operation:this.executeRegistrationCredential.bind(this,e)})}}async executeRegistrationCredential(e){this.abortController=new AbortController,this.removePageAbortHandlers=q(this.abortController),this.removeExternalAbortListener=H(this.abortController,e.prompt.cancellation);let t=this.getRpId(),r=B({walletId:e.walletId,intendedUserName:e.intendedUserName}),i=e.kind===`wallet_recovery`?e.recoveryRegistration:null,a=e.kind===`wallet_add_auth_method`?e.registration:null,o=i??a,c=o?.rpId??t;if(o&&c!==t)throw Error(`Wallet recovery RP ID does not match the wallet origin`);let u=o?{challenge:R(o.challengeB64u),rp:{name:`Seams Wallet`,id:c},user:{id:n(o.user.idB64u),name:o.user.name,displayName:o.user.displayName},pubKeyCredParams:o.pubKeyCredParams.map(e=>({...e})),authenticatorSelection:{...o.authenticatorSelection},timeout:o.timeoutMs,attestation:o.attestation,extensions:{prf:{eval:{first:n(o.extensions.prf.eval.firstB64u),second:n(o.extensions.prf.eval.secondB64u)}}},excludeCredentials:o.excludeCredentials.map(e=>({type:e.type,id:n(e.id)}))}:{challenge:R(z(e)),rp:{name:`WebAuthn Passkey`,id:c},user:{id:new TextEncoder().encode(K(e.walletId,e.signerSlot)),name:r.walletId,displayName:r.walletId},pubKeyCredParams:[{alg:-7,type:`public-key`},{alg:-257,type:`public-key`}],authenticatorSelection:{residentKey:`required`,userVerification:`preferred`},timeout:6e4,attestation:`none`,extensions:{prf:{eval:{first:l(),second:s()}}}};try{return await w(`create`,u,{abortSignal:this.abortController.signal})}finally{this.removePageAbortHandlers?.(),this.removePageAbortHandlers=void 0,this.removeExternalAbortListener?.(),this.removeExternalAbortListener=void 0,this.abortController=void 0}}};function H(e,t){if(t.kind===`none`)return;let n=t.signal,r=e.abort.bind(e);if(n.aborted){r();return}return n.addEventListener(`abort`,r,{once:!0}),n.removeEventListener.bind(n,`abort`,r)}function U(e){return String(e||``).trim().replace(/=+$/g,``)}function W(e){let t=String(e.response?.clientDataJSON||``).trim();if(!t)throw Error(`WebAuthn authentication response missing clientDataJSON`);let r=``;try{r=new TextDecoder().decode(n(t))}catch(e){throw Error(`WebAuthn authentication response has invalid clientDataJSON encoding: ${e instanceof Error?e.message:String(e)}`)}let i;try{i=JSON.parse(r)}catch(e){throw Error(`WebAuthn authentication response has invalid clientDataJSON JSON: ${e instanceof Error?e.message:String(e)}`)}let a=i&&typeof i==`object`?i.challenge:void 0;if(typeof a!=`string`||!a.trim())throw Error(`WebAuthn authentication response clientDataJSON missing challenge`);return a}function G(e,t){let n=U(W(e)),r=U(t);if(n!==r)throw Error(`Unexpected authentication response challenge "${n}", expected "${r}"`)}function K(e,t){return t===void 0||t===1?e:`${e} (${t})`}function q(e){let t=()=>{document.hidden&&e.abort()},n=()=>{e.abort()},r=()=>{e.abort()};return document.addEventListener(`visibilitychange`,t,{passive:!0}),window.addEventListener(`pagehide`,n,{passive:!0}),window.addEventListener(`beforeunload`,r,{passive:!0}),()=>{document.removeEventListener(`visibilitychange`,t),window.removeEventListener(`pagehide`,n),window.removeEventListener(`beforeunload`,r)}}async function J(e){let t=e.request.payload.walletId,n=window.location.origin,r=await d({walletId:t,operation:e.request.operation,payload:e.request.payload,requestOrigin:n}),i=await p({credentialStore:o,touchIdPrompt:new V(e.rpId),walletId:t,challengeB64u:r,includeSecondPrfOutput:!1}),a=ee(i);if(!a)throw Error(`Wallet recovery proof did not receive a passkey credential`);return{kind:`passkey`,walletId:t,rpId:e.rpId,credentialIdB64u:a,challenge_digest:r,webauthn_authentication:u(i)}}function Y(){return r(`wallet-recovery-admin`,16,`wallet recovery administration request IDs`)}async function X(e){let t=Y(),n={walletId:e.walletId,requestId:t},r=await J({rpId:e.rpId,request:{operation:`recovery_status`,payload:n}});return await _({relayUrl:e.relayUrl,walletId:e.walletId,requestId:t,factorProof:r})}async function Z(e){let t=Y(),n={walletId:e.walletId,requestId:t,expectedIssuedAtMs:e.expectedIssuedAtMs},r=await J({rpId:e.rpId,request:{operation:`recovery_backup_acknowledge`,payload:n}});return await y({relayUrl:e.relayUrl,walletId:e.walletId,requestId:t,expectedIssuedAtMs:e.expectedIssuedAtMs,factorProof:r})}async function Q(e){let t=await o.resolveSelectedWalletAuthority(e);if(t.kind!==`resolved`||t.selection.lockState!==`unlocked`||String(t.selection.walletId)!==e||t.selection.walletAuthMethodId!==t.authMethod.walletAuthMethodId||t.authMethod.kind!==`email_otp`||t.authMethod.status!==`active`||t.authority.state!==`active`||String(t.authMethod.walletId)!==e||String(t.authority.walletId)!==e)throw Error(`Unlock this wallet with its active Email OTP method`);let n=await o.listWalletAuthMethodsForWallet(e),r=null;for(let e of n)if(!(e.kind!==`email_otp`||e.status!==`active`||e.localStatus!==`synced`||String(e.authority.bindingId)!==String(t.authMethod.walletAuthMethodId))){if(r!==null)throw Error(`The selected Email OTP owner method is duplicated`);r=String(e.authority.factor.providerUserId||``).trim()}if(!r)throw Error(`The selected Email OTP owner method is unavailable on this wallet`);return{walletAuthMethodId:String(t.authMethod.walletAuthMethodId),providerSubjectId:r}}async function $(e){let t=e.request.payload.walletId,{providerSubjectId:n}=await Q(t),r=window.location.origin,i=await d({walletId:t,operation:e.request.operation,payload:e.request.payload,requestOrigin:r}),a=await h({relayUrl:e.relayUrl,walletId:t,providerSubjectId:n,operation:e.request.operation,payload:e.request.payload,requestOrigin:r});if(a.kind!==`ready`)throw Error(a.message);if(a.challenge_digest!==i)throw Error(`Recovery Email OTP challenge does not match this operation`);let o=await e.context.signingEngine.requestEmailOtpOwnerConfirmation({purpose:e.request.operation,walletId:t,emailAddress:`your email`,challengeId:a.challengeId});if(o.challengeId!==a.challengeId)throw Error(`Recovery Email OTP confirmation changed its challenge`);return{kind:`email_otp`,provider_subject_id:n,challenge_id:o.challengeId,otp_code:o.otpCode,challenge_digest:i}}async function te(e){let t=Y(),n={walletId:e.walletId,requestId:t},r=await $({context:e.context,relayUrl:e.relayUrl,request:{operation:`recovery_status`,payload:n}});return await _({relayUrl:e.relayUrl,walletId:e.walletId,requestId:t,factorProof:r})}async function ne(e){let t=Y(),n={walletId:e.walletId,requestId:t,expectedIssuedAtMs:e.expectedIssuedAtMs},r=await $({context:e.context,relayUrl:e.relayUrl,request:{operation:`recovery_backup_acknowledge`,payload:n}});return await y({relayUrl:e.relayUrl,walletId:e.walletId,requestId:t,expectedIssuedAtMs:e.expectedIssuedAtMs,factorProof:r})}export{X as a,_ as c,te as i,h as l,Z as n,Q as o,$ as r,V as s,ne as t,x as u};

package/dist/esm/sdk/walletRecoveryCommit-B_e4k5Pa.js

@@ -1 +0,0 @@
-import{A as e,D as t,M as n,O as r,S as i,T as a,j as o,o as s,s as c}from"./domainIds-C3fUa33Q.js";import{E as l,c as u,d,k as f}from"./chains-CPmd4s9f.js";import{B as p,D as m,E as h,H as g,J as _,K as v,M as y,N as b,O as x,U as S,j as C,k as ee,nt as w,ot as T}from"./activeWalletSession-BtEHhe99.js";import{i as E,r as D}from"./base64-BmKR3UqU.js";import{s as te}from"./walletDbName-BVZhb4xF.js";import{n as ne,t as re}from"./signingSessionSeal-DqbjG8c8.js";import{l as O}from"./capabilityKinds-CqHVzVsJ.js";import{d as ie,t as k}from"./accountIds-BzZs7YoX.js";import{D as A}from"./registrationIntent-DW_kKWlx.js";import{C as ae}from"./walletCapabilityBindings-CKOK39sP.js";import{$t as oe,Bt as se,Ot as ce,Zt as le,an as ue,ct as de,en as fe,et as pe,ln as me,nn as he,rn as ge,sn as _e,tn as ve,un as ye}from"./emailOtpEcdsaDerivationIdentity-DreNrM6n.js";import{i as be}from"./walletAuthMethodRecord-Cv_MYpxt.js";import{C as xe}from"./ecdsaCapabilityManifest-B3u6J5gn.js";import{C as j,M as Se,a as Ce,b as we,l as M,n as N,t as Te,x as P,y as F}from"./wallet-recovery-BEui57xM.js";import{o as Ee}from"./helpers-BXezXx19.js";import{M as De,h as Oe,m as ke}from"./accountLifecycle-CXTlwnAS.js";import{r as Ae}from"./walletCustodyEcdsaContinuity-5XsLsT8D.js";import{n as je}from"./challengeDelivery-C88JNwKf.js";function Me(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`wallet recovery target must be an object`);let t=e,r=Object.keys(t);switch(t.kind){case`passkey`:{if(r.length!==2||!r.includes(`rpId`))throw Error(`Passkey recovery target fields are invalid`);let e=n(t.rpId);if(!e.ok)throw Error(`Passkey recovery target RP ID is invalid`);return{kind:`passkey`,rpId:e.value}}case`google_email_otp`:if(r.length!==2||!r.includes(`googleProvider`)||t.googleProvider!==`google`)throw Error(`Google Email OTP recovery target fields are invalid`);return{kind:`google_email_otp`,googleProvider:`google`};default:throw Error(`wallet recovery target kind is unsupported`)}}const Ne=[`ok`,`walletId`,`target`,`recoveryOperationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`wrap`,`entries`,`keyManifest`,`reservationId`,`reservationExpiresAtMs`,`storeVersion`],Pe=[...Ne,`registration`];function I(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);return e}function Fe(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==r.size||i.some(e=>!r.has(e)))throw Error(`${n} contains unexpected fields`)}function L(e,t,n){let r=I(e,n);return Fe(r,t,n),r}function R(e,t){return Object.prototype.hasOwnProperty.call(e,t)?Reflect.get(e,t):void 0}function Ie(e){try{return I(e,`walletRecoveryPrepare response`)}catch{return null}}function Le(e){let t=r(e.walletId);if(!t.ok)throw Error(`wallet recovery ${t.error.message}`);return JSON.stringify({walletId:String(t.value),wrap:e.prepared.wrap,entry:e.prepared.entries[0]})}async function Re(e){let t=await ze(e);return t.ok?await Be({response:t.response,target:e.target,reservationId:e.reservationId}):{kind:t.kind}}async function ze(e){let t=`${T(e.relayUrl)}/wallets/recovery/prepare`,n=e.fetchImpl||fetch;try{return{ok:!0,response:await n(t,w({body:{recoveryCodeB64u:e.recoveryCodeB64u,reservationId:e.reservationId,target:e.target}}))}}catch{return{ok:!1,kind:`transport_uncertain`}}}async function Be(n){let i=n.response,o=Ie(await i.json().catch(()=>({})));if(i.status===200&&o&&R(o,`ok`)===!0)try{let i=L(o,n.target.kind===`passkey`?Pe:Ne,`walletRecoveryPrepare`),s=Ke()(R(i,`wrap`),`walletRecoveryPrepare.wrap`),c=qe(R(i,`entries`)),l=r(R(i,`walletId`));if(!l.ok)throw Error(`walletRecoveryPrepare.walletId is invalid`);let u=l.value,d=Me(R(i,`target`));if(!We(d,n.target))throw Error(`wallet recovery preparation changed the recovery target`);let f=e(R(i,`recoveryOperationId`)),p=O(R(i,`targetDeviceId`)),m=t(R(i,`targetAuthorityId`)),h=a(R(i,`targetWalletAuthMethodId`));if(!f.ok||!p.ok||!m.ok||!h.ok)throw Error(`wallet recovery preparation target identity is invalid`);let g=Je(R(i,`keyManifest`),u),_=j(R(i,`reservationId`)),v=b(R(i,`reservationExpiresAtMs`),`walletRecoveryPrepare.reservationExpiresAtMs`),y=z(R(i,`storeVersion`),`storeVersion`);if(_!==n.reservationId)throw Error(`wallet recovery preparation changed the reservation identity`);let x={kind:`prepared`,walletId:u,recoveryOperationId:f.value,targetDeviceId:p.value,targetAuthorityId:m.value,targetWalletAuthMethodId:h.value,wrap:s,entries:c,keyManifest:g,reservationId:_,reservationExpiresAtMs:v,storeVersion:y};switch(d.kind){case`passkey`:{let e=Ve(String(u),d.rpId)(R(i,`registration`),`registration`);if(e.walletAuthMethodId!==h.value)throw Error(`wallet recovery registration changed the target auth method`);return{...x,target:d,registration:e}}case`google_email_otp`:if(Object.prototype.hasOwnProperty.call(i,`registration`))throw Error(`Google Email OTP recovery cannot carry passkey registration`);return{...x,target:d};default:return Ge(d)}}catch{return{kind:`transport_uncertain`}}return i.status===409?{kind:`retryable_conflict`}:i.status===401&&o&&R(o,`code`)===`recovery_code_used`?{kind:`consumed`}:i.status===401||i.status===400?{kind:`refused`}:{kind:`transport_uncertain`}}function Ve(e,t){let r=E(new TextEncoder().encode(e)),i=g({type:p(`public-key`),id:(e,t)=>{let n=S(o)(e,t);return ot(n,t),n}});return g({kind:p(`webauthn_recovery_registration_v1`),challengeId:z,challengeB64u:(e,t)=>at(e,32,t),replacementId:z,walletAuthMethodId:S(a),rpId:S(n),user:g({idB64u:ot,name:z,displayName:z},(t,n)=>{if(t.idB64u!==r||t.name!==e||t.displayName!==e)throw Error(`${n} is bound to another wallet`)}),pubKeyCredParams:(e,t)=>{if(!Array.isArray(e)||e.length!==2)throw Error(`${t} is invalid`);return[He(-7)(e[0],`${t}[0]`),He(-257)(e[1],`${t}[1]`)]},authenticatorSelection:g({residentKey:p(`required`),userVerification:p(`preferred`)}),timeoutMs:(e,t)=>{let n=Number(e);if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} is invalid`);return n},attestation:p(`none`),extensions:g({prf:g({eval:g({firstB64u:Ue(re),secondB64u:Ue(ne)})})}),excludeCredentials:(e,t)=>l(e,t).map((e,n)=>i(e,`${t}[${n}]`))},(e,n)=>{if(e.rpId!==t)throw Error(`${n} changed the relying party`)})}function He(e){return g({type:p(`public-key`),alg:(t,n)=>{if(t!==e)throw Error(`${n} is invalid`);return e}})}function Ue(e){return(t,n)=>{let r=at(t,e.length,n);if(r!==E(e))throw Error(`${n} is unsupported`);return r}}function We(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId;case`google_email_otp`:return t.kind===`google_email_otp`&&e.googleProvider===t.googleProvider;default:return Ge(e)}}function Ge(e){throw Error(`unsupported wallet recovery target: ${String(e)}`)}function Ke(){return g({nonceB64u:ee,wrappedManifestKekB64u:x,aadHashB64u:h})}function qe(e){if(!Array.isArray(e)||e.length!==1)throw Error(`walletRecoveryPrepare.entries must contain exactly one custody seed`);return[Ce(e[0],`walletRecoveryPrepare.entries[0]`)]}function z(e,t){if(typeof e!=`string`||!e.trim())throw Error(`walletRecoveryPrepare.${t} must be a non-empty string`);return e.trim()}function Je(e,t){let n=L(e,[`version`,`walletId`,`entries`],`walletRecoveryPrepare.keyManifest`);if(R(n,`version`)!==`wallet_recovery_preparation_key_manifest_v1`)throw Error(`walletRecoveryPrepare.keyManifest version is invalid`);let r=z(R(n,`walletId`),`keyManifest.walletId`);if(r!==t)throw Error(`walletRecoveryPrepare.keyManifest changed the wallet identity`);let i=R(n,`entries`);if(!Array.isArray(i)||i.length===0)throw Error(`walletRecoveryPrepare.keyManifest must contain a key set`);let a=i.map(e=>Ye(e,r));if(new Set(a.map(e=>e.keySetId)).size!==a.length)throw Error(`walletRecoveryPrepare.keyManifest contains duplicate key sets`);return{version:`wallet_recovery_preparation_key_manifest_v1`,walletId:r,entries:a}}function Ye(e,t){switch(R(I(e,`walletRecoveryPrepare.keyManifest.entries[]`),`kind`)){case`near_ed25519`:{let n=L(e,[`kind`,`keySetId`,`signerId`,`nearAccountId`,`recordedKeyManifestDigestB64u`,`recoveryBasis`],`walletRecoveryPrepare.keyManifest.entries[].near_ed25519`),r=z(R(n,`signerId`),`keyManifest.entries[].signerId`),i=z(R(n,`keySetId`),`keyManifest.entries[].keySetId`),a=`near_ed25519:${r}`;if(i!==a)throw Error(`walletRecoveryPrepare NEAR key-set identity is inconsistent`);let o=z(R(n,`nearAccountId`),`keyManifest.entries[].nearAccountId`),s=Xe(R(n,`recoveryBasis`),t);return{kind:`near_ed25519`,keySetId:a,signerId:r,nearAccountId:o,recordedKeyManifestDigestB64u:h(R(n,`recordedKeyManifestDigestB64u`),`walletRecoveryPrepare.keyManifest.entries[].recordedKeyManifestDigestB64u`),recoveryBasis:s}}case`evm_family_ecdsa`:{let n=L(e,[`kind`,`keySetId`,`keyHandle`,`evmFamilySigningKeySlotId`,`recordedKeyManifestDigestB64u`,`recoveryBasis`],`walletRecoveryPrepare.keyManifest.entries[].evm_family_ecdsa`),r=z(R(n,`keyHandle`),`keyManifest.entries[].keyHandle`),i=z(R(n,`keySetId`),`keyManifest.entries[].keySetId`),a=`evm_family_ecdsa:${r}`;if(i!==a)throw Error(`walletRecoveryPrepare ECDSA key-set identity is inconsistent`);let o=Ze(R(n,`recoveryBasis`),t);return{kind:`evm_family_ecdsa`,keySetId:a,keyHandle:r,evmFamilySigningKeySlotId:ue(R(n,`evmFamilySigningKeySlotId`)),recordedKeyManifestDigestB64u:h(R(n,`recordedKeyManifestDigestB64u`),`walletRecoveryPrepare.keyManifest.entries[].recordedKeyManifestDigestB64u`),recoveryBasis:o}}default:throw Error(`walletRecoveryPrepare key-manifest entry kind is invalid`)}}function Xe(e,t){let n=L(e,[`capabilityKind`,`activeCapabilityBinding`,`scope`,`applicationBinding`,`participantIds`,`registeredPublicKey`,`runtimePolicyScope`,`activationTranscript`,`activationStateEpoch`,`signingWorkerVerifyingShare`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis`),r=R(n,`capabilityKind`);if(r!==`registration`&&r!==`recovery`)throw Error(`walletRecoveryPrepare NEAR recovery capability kind is invalid`);let i=B(R(n,`activeCapabilityBinding`),32,`NEAR recovery active capability binding`),a=tt(R(n,`scope`)),o=nt(R(n,`applicationBinding`)),s=it(R(n,`participantIds`),`NEAR recovery participant IDs`),c=B(R(n,`registeredPublicKey`),32,`NEAR recovery registered public key`),l=rt(R(n,`runtimePolicyScope`)),u=B(R(n,`activationTranscript`),32,`NEAR recovery activation transcript`),d=Number(R(n,`activationStateEpoch`));if(!Number.isSafeInteger(d)||d<=0)throw Error(`walletRecoveryPrepare NEAR recovery activation state epoch is invalid`);let f=B(R(n,`signingWorkerVerifyingShare`),32,`NEAR recovery signing-worker verifying share`);if(o.wallet_id!==t||a.account_id!==t||a.root_share_epoch!==l.signingRootVersion)throw Error(`walletRecoveryPrepare NEAR recovery basis changed its wallet scope`);return{capabilityKind:r,activeCapabilityBinding:i,scope:a,applicationBinding:o,participantIds:s,registeredPublicKey:c,runtimePolicyScope:l,activationTranscript:u,activationStateEpoch:d,signingWorkerVerifyingShare:f}}function Ze(e,t){let n=L(e,[`publicCapability`,`activationReceipt`,`serverGeneration`,`clientRootPublicKey33B64u`,`chainTargets`,`ecdsaThresholdKeyId`,`signingRootId`,`signingRootVersion`,`runtimePolicyScope`,`participantIds`,`possessionChallenge`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis`),r=pe(R(n,`publicCapability`)),i=de(R(n,`activationReceipt`));if(r.client_id!==t)throw Error(`walletRecoveryPrepare ECDSA recovery capability changed the wallet scope`);let a=ve(R(n,`signingRootId`)),o=he(R(n,`signingRootVersion`)),s=rt(R(n,`runtimePolicyScope`));if(s.signingRootVersion!==o)throw Error(`walletRecoveryPrepare ECDSA recovery scope changed the signing root`);let c=le(R(n,`serverGeneration`));if(String(i.server_generation)!==String(c))throw Error(`walletRecoveryPrepare ECDSA activation receipt changed server generation`);let l=Te(R(n,`possessionChallenge`));if(l.walletId!==t||l.expectedServerGeneration!==String(c)||l.derivationClientSharePublicKey33B64u!==r.public_identity.derivation_client_share_public_key33_b64u)throw Error(`walletRecoveryPrepare ECDSA possession challenge changed its capability`);return{publicCapability:r,activationReceipt:i,serverGeneration:c,clientRootPublicKey33B64u:fe(z(R(n,`clientRootPublicKey33B64u`),`keyManifest.entries[].recoveryBasis.clientRootPublicKey33B64u`)),chainTargets:Qe(R(n,`chainTargets`)),ecdsaThresholdKeyId:ge(R(n,`ecdsaThresholdKeyId`)),signingRootId:a,signingRootVersion:o,runtimePolicyScope:s,participantIds:et(R(n,`participantIds`)),possessionChallenge:l}}function Qe(e){if(!Array.isArray(e)||e.length===0)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are invalid`);let t=e.map((e,t)=>$e(e,t));if(new Set(t.map(Se)).size!==t.length)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are duplicated`);let n=t[0];if(!n)throw Error(`walletRecoveryPrepare ECDSA recovery chain targets are invalid`);return[n,...t.slice(1)]}function $e(e,t){let n=`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.chainTargets[${t}]`,r=I(e,n),i=R(r,`kind`);Fe(r,i===`evm`?[`kind`,`namespace`,`chainId`,`networkSlug`]:[`kind`,`chainId`,`networkSlug`],n);let a=R(r,`namespace`),o=Number(R(r,`chainId`));if(!Number.isSafeInteger(o)||o<=0)throw Error(`walletRecoveryPrepare ECDSA recovery chain id is invalid`);let s=R(r,`networkSlug`),c=typeof s==`string`&&s.trim()?s.trim():null;if(i===`evm`){if(a!==`eip155`)throw Error(`walletRecoveryPrepare ECDSA recovery EVM namespace is invalid`);return{kind:`evm`,namespace:`eip155`,chainId:o,networkSlug:c??`evm-${o}`}}if(i===`tempo`)return{kind:`tempo`,chainId:o,networkSlug:c??`tempo-${o}`};throw Error(`walletRecoveryPrepare ECDSA recovery chain family is invalid`)}function et(e){if(!Array.isArray(e)||e.length!==2||e[0]!==1||e[1]!==2)throw Error(`walletRecoveryPrepare ECDSA recovery participant IDs are invalid`);return[1,2]}function tt(e){let t=L(e,[`lifecycle_id`,`root_share_epoch`,`account_id`,`threshold_session_id`,`signer_set_id`,`signing_worker_id`,`material_activation`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.scope`);return{lifecycle_id:z(R(t,`lifecycle_id`),`keyManifest.entries[].recoveryBasis.scope.lifecycle_id`),root_share_epoch:z(R(t,`root_share_epoch`),`keyManifest.entries[].recoveryBasis.scope.root_share_epoch`),account_id:z(R(t,`account_id`),`keyManifest.entries[].recoveryBasis.scope.account_id`),threshold_session_id:z(R(t,`threshold_session_id`),`keyManifest.entries[].recoveryBasis.scope.threshold_session_id`),signer_set_id:z(R(t,`signer_set_id`),`keyManifest.entries[].recoveryBasis.scope.signer_set_id`),signing_worker_id:z(R(t,`signing_worker_id`),`keyManifest.entries[].recoveryBasis.scope.signing_worker_id`),material_activation:_e(R(t,`material_activation`))}}function nt(e){let t=L(e,[`wallet_id`,`near_ed25519_signing_key_id`,`signing_root_id`,`key_creation_signer_slot`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.applicationBinding`),n=Number(R(t,`key_creation_signer_slot`));if(!Number.isSafeInteger(n)||n<=0)throw Error(`walletRecoveryPrepare NEAR recovery key-creation signer slot is invalid`);return{wallet_id:z(R(t,`wallet_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.wallet_id`),near_ed25519_signing_key_id:z(R(t,`near_ed25519_signing_key_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.near_ed25519_signing_key_id`),signing_root_id:z(R(t,`signing_root_id`),`keyManifest.entries[].recoveryBasis.applicationBinding.signing_root_id`),key_creation_signer_slot:n}}function rt(e){let t=L(e,[`orgId`,`projectId`,`envId`,`signingRootVersion`],`walletRecoveryPrepare.keyManifest.entries[].recoveryBasis.runtimePolicyScope`);try{return _(t)}catch{throw Error(`walletRecoveryPrepare NEAR recovery runtime policy scope is invalid`)}}function it(e,t){if(!Array.isArray(e)||e.length!==2||!Number.isSafeInteger(e[0])||!Number.isSafeInteger(e[1])||Number(e[0])<=0||Number(e[1])<=0||Number(e[0])===Number(e[1]))throw Error(`walletRecoveryPrepare ${t} is invalid`);return[Number(e[0]),Number(e[1])]}function at(e,t,n){let r=z(e,n),i=D(r);if(i.length!==t||E(i)!==r)throw Error(`walletRecoveryPrepare ${n} is invalid`);return r}function ot(e,t){let n=z(e,t),r=D(n);if(r.length===0||E(r)!==n)throw Error(`walletRecoveryPrepare ${t} is invalid`);return n}function B(e,t,n){if(!Array.isArray(e)||e.length!==t||e.some(e=>!Number.isInteger(e)||e<0||e>255))throw Error(`walletRecoveryPrepare ${n} is invalid`);return e.map(Number)}const st=`/wallets/recovery/finalize`;async function ct(e){let t=`${T(e.relayUrl)}${st}`,n=e.fetchImpl||fetch,r;try{r=Ee(e.webauthnRegistration)}catch{return{kind:`refused`}}let i;try{let t=new Set;i=e.ecdsaMaterialPossessionProofs.map(e=>{if(typeof e.keySetId!=`string`||!e.keySetId.startsWith(`evm_family_ecdsa:`)||e.keySetId.length<=17)throw Error(`ECDSA possession proof key-set id is invalid`);if(t.has(e.keySetId))throw Error(`ECDSA possession proof key-set ids are duplicated`);return t.add(e.keySetId),{keySetId:e.keySetId,proof:N(e.proof)}})}catch{return{kind:`refused`}}let a;try{if(a=A(e.replacementEnvelope,`walletRecoveryFinalize.replacementEnvelope`),String(a.walletId)!==String(e.walletId))throw Error(`replacement envelope changed the wallet identity`);if(String(a.envelopeId)!==String(e.replacementId))throw Error(`replacement envelope changed the replacement identity`);if(a.factor.kind!==`passkey`)throw Error(`replacement envelope is not bound to a passkey`)}catch{return{kind:`refused`}}let o;try{o=await n(t,w({body:{kind:`finalize`,walletId:e.walletId,reservationId:e.reservationId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,challengeId:e.challengeId,replacementId:e.replacementId,webauthnRegistration:r,replacementEnvelope:a,ecdsaMaterialPossessionProofs:i}}))}catch{return{kind:`transport_uncertain`}}let s=ut(await o.json().catch(()=>({})));if(o.status===200&&s.kind===`success`)try{let t=await P(s.projection,dt(e,a));if(t.kind!==`passkey`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:t.storeVersion,authority:t.authority,authMethod:t.authMethod}}catch{return{kind:`transport_uncertain`}}return o.status===409?{kind:`retryable_conflict`}:o.status===400||o.status===401?{kind:`refused`}:{kind:`transport_uncertain`}}async function lt(e){let t;try{if(t=A(e.replacementEnvelope,`walletRecoveryReplay.replacementEnvelope`),String(t.walletId)!==String(e.walletId)||String(t.envelopeId)!==String(e.replacementId)||t.factor.kind!==`passkey`)throw Error(`recovery replay envelope identity is invalid`)}catch{return{kind:`refused`}}let n;try{n=await(e.fetchImpl??fetch)(`${T(e.relayUrl)}${st}`,w({body:{kind:`replay`,walletId:e.walletId,reservationId:e.reservationId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,replacementId:e.replacementId,replacementEnvelope:t}}))}catch{return{kind:`transport_uncertain`}}let r=ut(await n.json().catch(()=>({})));if(n.status===200&&r.kind===`success`)try{let n=await P(r.projection,dt(e,t));if(n.kind!==`passkey`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:n.storeVersion,authority:n.authority,authMethod:n.authMethod}}catch{return{kind:`transport_uncertain`}}return n.status===409?{kind:`retryable_conflict`}:n.status===400||n.status===401?{kind:`refused`}:{kind:`transport_uncertain`}}function ut(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`invalid`};let t=new Map(Object.entries(e)),n=[...t.keys()];if(t.size===2&&n.includes(`ok`)&&n.includes(`projection`)&&t.get(`ok`)===!0)return{kind:`success`,projection:t.get(`projection`)};let r=t.get(`code`),i=t.get(`message`);return t.size===3&&n.includes(`ok`)&&n.includes(`code`)&&n.includes(`message`)&&t.get(`ok`)===!1&&typeof r==`string`&&typeof i==`string`?{kind:`failure`,code:r,message:i}:{kind:`invalid`}}function dt(n,i){if(i.factor.kind!==`passkey`)throw Error(`replacement envelope is not a passkey envelope`);return{kind:`passkey`,walletId:V(r(n.walletId)),recoveryOperationId:V(e(n.recoveryOperationId)),targetDeviceId:V(O(n.targetDeviceId)),targetAuthorityId:V(t(n.targetAuthorityId)),targetWalletAuthMethodId:V(a(n.targetWalletAuthMethodId)),rpId:i.factor.rpId,credentialIdB64u:i.factor.credentialIdB64u}}function V(e){if(!e.ok)throw Error(`invalid recovery identity`);return e.value}function H(e){return e.target.kind===`passkey`}function ft(e){return{kind:`email_otp_enrollment_reference_v1`,enrollmentId:e.enrollment.enrollmentId,enrollmentSealKeyVersion:e.enrollment.kind===`existing`?e.enrollment.enrollmentSealKeyVersion:e.enrollment.material.enrollmentSealKeyVersion}}const pt=[`kind`,`keySetId`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`participantIds`,`stateEpoch`,`signingWorkerVerifyingShareB64u`,`materialActivation`,`sealed`],mt=[`kind`,`keySetId`,`possessionProof`,`readyStateBlobB64u`,`publicFacts`],ht=[`contextBinding32B64u`,`derivationClientSharePublicKey33B64u`,`clientVerifyingShare33B64u`,`relayerPublicKey33B64u`,`groupPublicKey33B64u`,`ethereumAddress`,`clientShareRetryCounter`,`relayerShareRetryCounter`],gt=[`kind`,`version`,`recoveryOperationId`,`walletId`,`reservationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`replacementEnvelope`,`keyManifest`,`nearKeySets`,`ecdsaKeySets`,`target`];function U(e,t,n){if(v(e,t,n),Object.keys(e).length!==t.length)throw Error(n+` fields are invalid`)}function W(e,t){if(typeof e!=`string`||!e||e.trim()!==e)throw Error(t+` must be a non-empty canonical string`);return e}function G(e,t,n){let r=W(e,t),i=D(r);if(n!==void 0&&i.byteLength!==n)throw Error(t+` must decode to `+n+` bytes`);return r}function _t(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(t+` must be a non-negative safe integer`);return e}function vt(e,t){if(!Array.isArray(e)||e.length!==2||e.some(yt))throw Error(t+` must contain two positive participant IDs`);return[e[0],e[1]]}function yt(e){return typeof e!=`number`||!Number.isSafeInteger(e)||e<1}function bt(e,t){let n=W(f(t,`recovery durable NEAR key set`).keySetId,`recovery durable NEAR keySetId`),r=e.entries.find(e=>e.keySetId===n);if(!r||r.kind!==`near_ed25519`)throw Error(`recovery durable NEAR key-set manifest entry is invalid`);return r}function xt(e,t){let n=W(f(t,`recovery durable ECDSA key set`).keySetId,`recovery durable ECDSA keySetId`),r=e.entries.find(e=>e.keySetId===n);if(!r||r.kind!==`evm_family_ecdsa`)throw Error(`recovery durable ECDSA key-set manifest entry is invalid`);return r}function St(e){let t=te(e);if(!t)throw Error(`recovery runtime policy scope is invalid`);return t}function Ct(e,t){let n=f(e,`recovery durable NEAR key set`);if(U(n,pt,`recovery durable NEAR key set`),n.kind!==`near_ed25519`||n.keySetId!==t.keySetId)throw Error(`recovery durable NEAR key-set identity is invalid`);let r=t.recoveryBasis,a=r.scope.threshold_session_id;if(!i(a).ok)throw Error(`recovery durable NEAR thresholdSessionId is invalid`);let o={kind:De,applicationBindingDigestB64u:h(n.applicationBindingDigestB64u,`recovery durable NEAR application binding digest`),registeredPublicKeyB64u:m(n.registeredPublicKeyB64u,`recovery durable NEAR registered public key`),participantIds:vt(n.participantIds,`recovery durable NEAR participantIds`),stateEpoch:W(n.stateEpoch,`recovery durable NEAR stateEpoch`),walletId:r.applicationBinding.wallet_id,nearAccountId:t.nearAccountId,nearEd25519SigningKeyId:r.applicationBinding.near_ed25519_signing_key_id,signerSlot:C(r.applicationBinding.key_creation_signer_slot,`recovery durable NEAR signerSlot`),signingWorkerId:r.scope.signing_worker_id,signingWorkerVerifyingShareB64u:m(n.signingWorkerVerifyingShareB64u,`recovery durable NEAR signing-worker verifying share`)},s=f(n.sealed,`recovery durable NEAR sealed material`);return U(s,[`ciphertextB64u`,`nonceB64u`],`recovery durable NEAR sealed material`),{kind:`near_ed25519`,keySetId:t.keySetId,binding:o,thresholdSessionId:a,runtimePolicyScope:St(r.runtimePolicyScope),materialActivation:_e(n.materialActivation),sealed:{ciphertextB64u:x(s.ciphertextB64u,`recovery durable NEAR ciphertext`),nonceB64u:ee(s.nonceB64u,`recovery durable NEAR nonce`)}}}function wt(e){let t=f(e,`recovery durable ECDSA public facts`);U(t,ht,`recovery durable ECDSA public facts`);let n=W(t.ethereumAddress,`recovery durable ECDSA ethereumAddress`).toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(n))throw Error(`recovery durable ECDSA ethereumAddress is invalid`);return{contextBinding32B64u:h(t.contextBinding32B64u,`recovery durable ECDSA context binding`),derivationClientSharePublicKey33B64u:y(t.derivationClientSharePublicKey33B64u,`recovery durable ECDSA client share`),clientVerifyingShare33B64u:y(t.clientVerifyingShare33B64u,`recovery durable ECDSA client verifying share`),relayerPublicKey33B64u:y(t.relayerPublicKey33B64u,`recovery durable ECDSA relayer public key`),groupPublicKey33B64u:y(t.groupPublicKey33B64u,`recovery durable ECDSA group public key`),ethereumAddress:n,clientShareRetryCounter:_t(t.clientShareRetryCounter,`recovery durable ECDSA client-share retry counter`),relayerShareRetryCounter:_t(t.relayerShareRetryCounter,`recovery durable ECDSA relayer-share retry counter`)}}function Tt(e,t){let n=f(e,`recovery durable ECDSA key set`);if(U(n,mt,`recovery durable ECDSA key set`),n.kind!==`evm_family_ecdsa`||n.keySetId!==t.keySetId)throw Error(`recovery durable ECDSA key-set identity is invalid`);return{kind:`evm_family_ecdsa`,entry:t,possessionProof:N(n.possessionProof),readyStateBlobB64u:G(n.readyStateBlobB64u,`recovery durable ECDSA ready-state blob`),publicFacts:wt(n.publicFacts)}}function Et(e){let t=f(e,`recovery durable registration`);if(U(t,[`kind`,`id`,`rawId`,`type`,`authenticatorAttachment`,`response`],`recovery durable registration`),t.kind!==`wallet_recovery_redacted_registration_v1`)throw Error(`recovery durable registration kind is invalid`);if(t.authenticatorAttachment!==null&&typeof t.authenticatorAttachment!=`string`)throw Error(`recovery durable registration authenticatorAttachment is invalid`);let n=f(t.response,`recovery durable registration response`);if(U(n,[`clientDataJSON`,`attestationObject`,`transports`],`recovery durable registration response`),!Array.isArray(n.transports))throw Error(`recovery durable registration transports are invalid`);return{kind:`wallet_recovery_redacted_registration_v1`,id:W(t.id,`recovery durable registration id`),rawId:G(t.rawId,`recovery durable registration rawId`),type:W(t.type,`recovery durable registration type`),authenticatorAttachment:t.authenticatorAttachment,response:{clientDataJSON:G(n.clientDataJSON,`recovery durable registration clientDataJSON`),attestationObject:G(n.attestationObject,`recovery durable registration attestationObject`),transports:n.transports.map((e,t)=>W(e,`recovery durable registration transports[`+t+`]`))}}}function Dt(e){let t=f(e,`recovery durable Email OTP enrollment`);if(t.kind===`existing`)return U(t,[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`],`recovery durable existing Email OTP enrollment`),{kind:`existing`,enrollmentId:W(t.enrollmentId,`recovery enrollmentId`),enrollmentSealKeyVersion:W(t.enrollmentSealKeyVersion,`recovery enrollment seal-key version`)};if(t.kind!==`create`)throw Error(`recovery durable Email OTP enrollment kind is invalid`);U(t,[`kind`,`enrollmentId`,`providerSubject`,`verifiedEmail`,`material`],`recovery durable create Email OTP enrollment`);let n=f(t.material,`recovery durable enrollment material`);return U(n,[`enrollmentSealKeyVersion`,`clientUnlockPublicKeyB64u`,`unlockKeyVersion`,`serverSealedFactorCiphertextB64u`],`recovery durable enrollment material`),{kind:`create`,enrollmentId:W(t.enrollmentId,`recovery enrollmentId`),providerSubject:W(t.providerSubject,`recovery enrollment providerSubject`),verifiedEmail:W(t.verifiedEmail,`recovery enrollment verifiedEmail`),material:{enrollmentSealKeyVersion:W(n.enrollmentSealKeyVersion,`recovery enrollment material seal-key version`),clientUnlockPublicKeyB64u:G(n.clientUnlockPublicKeyB64u,`recovery enrollment client unlock public key`),unlockKeyVersion:W(n.unlockKeyVersion,`recovery enrollment unlock-key version`),serverSealedFactorCiphertextB64u:G(n.serverSealedFactorCiphertextB64u,`recovery enrollment sealed factor ciphertext`)}}}function K(i){let o=f(i,`wallet recovery durable payload`);if(o.kind!==`wallet_recovery_durable_payload_v1`||o.version!==1)throw Error(`wallet recovery durable payload version is invalid`);U(o,[...gt,...f(o.target,`wallet recovery durable target`).kind===`passkey`?[`replacementId`,`challengeId`,`registration`]:[`providerSubject`,`verifiedEmail`,`emailHashHex`,`registrationAuthorityId`,`replacementId`,`enrollment`]],`wallet recovery durable payload`);let s=e(o.recoveryOperationId),l=r(o.walletId),u;try{u=j(o.reservationId)}catch(e){throw Error(`wallet recovery durable reservationId is invalid`,{cause:e})}let d=O(o.targetDeviceId),p=t(o.targetAuthorityId),m=a(o.targetWalletAuthMethodId);if(!s.ok||!l.ok||!d.ok||!p.ok||!m.ok)throw Error(`wallet recovery durable payload identity is invalid`);if(!Array.isArray(o.nearKeySets)||!Array.isArray(o.ecdsaKeySets))throw Error(`wallet recovery durable key-set arrays are invalid`);let h=Je(o.keyManifest,String(l.value)),g=o.nearKeySets.map(e=>Ct(e,bt(h,e))),_=o.ecdsaKeySets.map(e=>Tt(e,xt(h,e))),v=[...g.map(e=>e.keySetId),..._.map(e=>e.entry.keySetId)];if(new Set(v).size!==v.length)throw Error(`wallet recovery durable key-set ids are duplicated`);if(h.entries.length!==v.length||h.entries.some(e=>!v.includes(e.keySetId)))throw Error(`wallet recovery durable key-set manifest coverage is invalid`);let y={kind:`wallet_recovery_durable_payload_v1`,version:1,recoveryOperationId:s.value,walletId:l.value,reservationId:u,targetDeviceId:d.value,targetAuthorityId:p.value,targetWalletAuthMethodId:m.value,replacementEnvelope:A(o.replacementEnvelope,`wallet recovery durable replacementEnvelope`),keyManifest:h,nearKeySets:g,ecdsaKeySets:_};if(String(y.replacementEnvelope.walletId)!==String(l.value))throw Error(`wallet recovery durable replacement envelope wallet changed`);if(y.replacementEnvelope.ownership.kind!==`method_bound`||y.replacementEnvelope.ownership.walletAuthMethodId!==m.value)throw Error(`wallet recovery durable replacement envelope method changed`);for(let e of g)if(e.binding.walletId!==String(l.value))throw Error(`wallet recovery durable NEAR binding wallet changed`);let b=f(o.target,`wallet recovery durable target`);if(b.kind===`passkey`){U(b,[`kind`,`rpId`],`wallet recovery durable passkey target`);let e=n(b.rpId);if(!e.ok)throw Error(`wallet recovery durable passkey RP ID is invalid`);let t=Et(o.registration);if(t.rawId!==y.replacementEnvelope.factor.credentialIdB64u)throw Error(`wallet recovery durable passkey registration identity changed`);if(y.replacementEnvelope.factor.kind!==`passkey`)throw Error(`wallet recovery durable passkey envelope factor is invalid`);if(y.replacementEnvelope.factor.rpId!==e.value||y.replacementEnvelope.factor.credentialIdB64u!==t.rawId)throw Error(`wallet recovery durable passkey envelope identity changed`);let r=W(o.replacementId,`wallet recovery durable replacementId`);if(String(y.replacementEnvelope.envelopeId)!==r)throw Error(`wallet recovery durable passkey envelope id changed`);return{...y,target:{kind:`passkey`,rpId:e.value},replacementId:r,challengeId:W(o.challengeId,`wallet recovery durable challengeId`),registration:t}}if(b.kind!==`google_email_otp`)throw Error(`wallet recovery durable target kind is invalid`);U(b,[`kind`],`wallet recovery durable Email OTP target`);let x=W(o.providerSubject,`wallet recovery providerSubject`);if(!c(x).ok)throw Error(`wallet recovery durable providerSubject is invalid`);let S=W(o.verifiedEmail,`wallet recovery durable verifiedEmail`),C=W(o.emailHashHex,`wallet recovery durable emailHashHex`);if(!/^[0-9a-f]{64}$/.test(C))throw Error(`wallet recovery durable emailHashHex is invalid`);let ee=W(o.registrationAuthorityId,`wallet recovery durable registrationAuthorityId`),w=Dt(o.enrollment);if(y.replacementEnvelope.factor.kind!==`email_otp`)throw Error(`wallet recovery durable Email OTP envelope factor is invalid`);let T=w.kind===`existing`?{enrollmentId:w.enrollmentId,enrollmentSealKeyVersion:w.enrollmentSealKeyVersion}:{enrollmentId:w.enrollmentId,enrollmentSealKeyVersion:w.material.enrollmentSealKeyVersion};if(y.replacementEnvelope.factor.enrollmentId!==T.enrollmentId||y.replacementEnvelope.factor.enrollmentSealKeyVersion!==T.enrollmentSealKeyVersion)throw Error(`wallet recovery durable Email OTP envelope identity changed`);if(w.kind===`create`&&(w.providerSubject!==x||w.verifiedEmail!==S))throw Error(`wallet recovery durable Email OTP enrollment identity changed`);let E=W(o.replacementId,`wallet recovery durable replacementId`);if(String(y.replacementEnvelope.envelopeId)!==E)throw Error(`wallet recovery durable Email OTP envelope id changed`);return{...y,target:{kind:`google_email_otp`},providerSubject:x,verifiedEmail:S,emailHashHex:C,registrationAuthorityId:ee,replacementId:E,enrollment:w}}function Ot(e){let t=e.nearKeySets.map(e=>({kind:e.kind,keySetId:e.keySetId,applicationBindingDigestB64u:e.binding.applicationBindingDigestB64u,registeredPublicKeyB64u:e.binding.registeredPublicKeyB64u,participantIds:e.binding.participantIds,stateEpoch:e.binding.stateEpoch,signingWorkerVerifyingShareB64u:e.binding.signingWorkerVerifyingShareB64u,materialActivation:e.materialActivation,sealed:e.sealed})),n=e.ecdsaKeySets.map(e=>({kind:e.kind,keySetId:e.entry.keySetId,possessionProof:e.possessionProof,readyStateBlobB64u:e.readyStateBlobB64u,publicFacts:e.publicFacts})),r={kind:e.kind,version:e.version,recoveryOperationId:String(e.recoveryOperationId),walletId:String(e.walletId),reservationId:String(e.reservationId),targetDeviceId:String(e.targetDeviceId),targetAuthorityId:String(e.targetAuthorityId),targetWalletAuthMethodId:String(e.targetWalletAuthMethodId),replacementEnvelope:e.replacementEnvelope,keyManifest:e.keyManifest,nearKeySets:t,ecdsaKeySets:n},i=H(e)?{...r,target:e.target,replacementId:e.replacementId,challengeId:e.challengeId,registration:e.registration}:{...r,target:e.target,providerSubject:e.providerSubject,verifiedEmail:e.verifiedEmail,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,replacementId:e.replacementId,enrollment:e.enrollment};return K(i),i}async function q(e){if(H(e))return;let t=await d(e.verifiedEmail);if(e.emailHashHex!==t)throw Error(`wallet recovery durable email hash does not match verified email`);if(e.enrollment.kind===`create`&&(e.enrollment.providerSubject!==e.providerSubject||e.enrollment.verifiedEmail!==e.verifiedEmail))throw Error(`wallet recovery durable enrollment does not match Email OTP identity`)}function J(e){if(H(e)){let t=o(e.registration.rawId);if(!t.ok)throw Error(`wallet recovery durable passkey credential id is invalid`);return{kind:`passkey`,rpId:e.target.rpId,credentialIdB64u:t.value}}let t=c(e.providerSubject);if(!t.ok)throw Error(`wallet recovery durable providerSubject is invalid`);return{kind:`google_email_otp`,providerSubject:t.value,emailHashHex:e.emailHashHex,registrationAuthorityId:e.registrationAuthorityId,enrollment:ft(e)}}function kt(e){return{kind:`near_ed25519`,keySetId:e.entry.keySetId,applicationBindingDigestB64u:e.localMaterial.applicationBindingDigestB64u,registeredPublicKeyB64u:E(e.metadata.registeredPublicKey),participantIds:e.metadata.participantIds,stateEpoch:String(e.metadata.stateEpoch),signingWorkerVerifyingShareB64u:E(e.metadata.signingWorkerVerifyingShare),materialActivation:ye(e.metadata.materialActivation),sealed:{ciphertextB64u:e.localMaterial.b64u,nonceB64u:e.localMaterial.nonceB64u}}}function At(e){return{kind:`evm_family_ecdsa`,keySetId:e.entry.keySetId,possessionProof:N(e.activation.possessionProof),readyStateBlobB64u:e.readyStateBlobB64u,publicFacts:e.publicFacts}}function jt(e){return{kind:`wallet_recovery_redacted_registration_v1`,id:e.id,rawId:e.rawId,type:e.type,authenticatorAttachment:e.authenticatorAttachment??null,response:{clientDataJSON:e.response.clientDataJSON,attestationObject:e.response.attestationObject,transports:[...e.response.transports]}}}async function Mt(e){let t={kind:`wallet_recovery_durable_payload_v1`,version:1,recoveryOperationId:String(e.prepared.recoveryOperationId),walletId:e.walletId,reservationId:e.prepared.reservationId,targetDeviceId:e.prepared.targetDeviceId,targetAuthorityId:e.prepared.targetAuthorityId,targetWalletAuthMethodId:e.prepared.targetWalletAuthMethodId,replacementEnvelope:A(e.recovered.replacementEnvelope,`wallet recovery durable replacement envelope`),keyManifest:{version:`wallet_recovery_preparation_key_manifest_v1`,walletId:String(e.walletId),entries:[...e.recovered.nearKeySets.map(e=>e.entry),...e.recovered.ecdsaKeySets.map(e=>e.entry)]},nearKeySets:e.recovered.nearKeySets.map(kt),ecdsaKeySets:e.recovered.ecdsaKeySets.map(At)};if(e.replacement.kind===`passkey`){if(e.target.kind!==`passkey`)throw Error(`wallet recovery durable payload branch is invalid`);let n=e.prepared.registration;if(!n)throw Error(`wallet recovery registration options are unavailable`);let r=jt(e.replacement.registration);if(r.rawId!==e.replacement.credentialIdB64u)throw Error(`wallet recovery passkey registration rawId changed its credential identity`);let i=K({...t,target:{kind:`passkey`,rpId:e.target.rpId},replacementId:n.replacementId,challengeId:n.challengeId,registration:r});return await q(i),i}if(e.target.kind!==`google_email_otp`)throw Error(`wallet recovery durable payload branch is invalid`);let n=e.replacement.enrollment;if(e.replacement.factor.walletAuthMethodId!==t.targetWalletAuthMethodId)throw Error(`wallet recovery Email OTP factor method changed its target identity`);let r=await d(e.replacement.verifiedEmail),i=K({...t,target:{kind:`google_email_otp`},enrollment:n,providerSubject:e.replacement.providerSubject,verifiedEmail:e.replacement.verifiedEmail,emailHashHex:r,registrationAuthorityId:e.replacement.registrationAuthorityId,replacementId:e.replacement.factor.replacementId});return await q(i),i}function Nt(e){return new TextEncoder().encode(u({kind:`pending_wallet_recovery_commit_v1`,version:1,...e}))}function Pt(e){return Nt({recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:J(e)})}async function Ft(e){let t=await crypto.subtle.generateKey({name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`]);if(!(t instanceof CryptoKey))throw Error(`wallet recovery durable key generation failed`);let n=crypto.getRandomValues(new Uint8Array(12)),r=new TextEncoder().encode(JSON.stringify(Ot(e)));return{kind:`wallet_recovery_encrypted_material_v1`,key:t,iv:n,ciphertext:new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n,additionalData:Pt(e)},t,r))}}async function It(e){let t=await crypto.subtle.decrypt({name:`AES-GCM`,iv:e.localMaterial.iv.slice(),additionalData:Lt(e)},e.localMaterial.key,e.localMaterial.ciphertext.slice()),n=K(JSON.parse(new TextDecoder().decode(t)));if(await q(n),!Rt(e,n))throw Error(`wallet recovery durable payload identity does not match its journal`);return n}function Lt(e){return Nt({recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:e.target})}function Y(t){let n=e(t);if(!n.ok)throw Error(`wallet recovery operation id is invalid`);return n.value}function Rt(e,t){let n={kind:`pending_wallet_recovery_commit_v1`,version:1,recoveryOperationId:Y(t.recoveryOperationId),walletId:t.walletId,reservationId:t.reservationId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,localMaterial:e.localMaterial,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs},r=J(t);if(e.stage===`awaiting_server_promotion`)return F(e,{...n,stage:`awaiting_server_promotion`,target:r});switch(r.kind){case`passkey`:return e.projection.kind===`passkey`?F(e,{...n,stage:`server_promoted`,target:r,projection:e.projection}):!1;case`google_email_otp`:return e.projection.kind===`google_email_otp`?F(e,{...n,stage:`server_promoted`,target:r,projection:e.projection}):!1}}function zt(e,t,n,r){return{kind:`pending_wallet_recovery_commit_v1`,version:1,recoveryOperationId:Y(e.recoveryOperationId),walletId:e.walletId,reservationId:e.reservationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,target:J(e),localMaterial:t,createdAtMs:n,updatedAtMs:r}}function Bt(e,t,n=Date.now()){return{...zt(e,t,n,n),stage:`awaiting_server_promotion`}}function Vt(e,t,n,r=Date.now()){let i=zt(t,e.localMaterial,e.createdAtMs,Math.max(r,e.createdAtMs+1));if(H(t)){if(n.kind!==`passkey`)throw Error(`wallet recovery promotion projection branch changed`);return{...i,stage:`server_promoted`,target:J(t),projection:n}}if(n.kind!==`google_email_otp`)throw Error(`wallet recovery promotion projection branch changed`);return{...i,stage:`server_promoted`,target:J(t),projection:n}}const Ht=`/wallets/recovery/google-email-otp/finalize`;async function Ut(e){let t=await X(e,`/wallets/recovery/google/verify`,{recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,idToken:e.idToken});if(!t.ok)return t.failure;try{let n=Jt(t.body),r=qt(n,e),i=Q(s(n.challengeId)),a=Number(n.expiresAtMs);if(!Number.isSafeInteger(a)||a<=0)throw Error(`invalid expiry`);return{kind:`verified`,...r,challengeId:i,delivery:je(n.delivery,`walletRecoveryGoogleVerify.delivery`),expiresAtMs:a}}catch{return{kind:`transport_uncertain`}}}async function Wt(e){let t=await X(e,`/wallets/recovery/email-otp/verify`,{recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,challengeId:e.challengeId,otpCode:e.otpCode});if(!t.ok)return t.failure;try{let n=Yt(t.body),r=qt(n,e),i=Q(s(n.challengeId));if(i!==e.challengeId)throw Error(`challenge changed`);return{kind:`verified`,...r,challengeId:i}}catch{return{kind:`transport_uncertain`}}}async function Gt(e){let t,n;try{if(t=A(e.replacementEnvelope,`walletRecoveryGoogleEmailOtpFinalize.replacementEnvelope`),t.factor.kind!==`email_otp`)throw Error(`wrong factor`);n=e.ecdsaMaterialPossessionProofs.map(e=>({keySetId:e.keySetId,proof:N(e.proof)}))}catch{return{kind:`refused`}}let r=await X(e,Ht,{kind:`finalize`,recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,replacementEnvelope:t,ecdsaMaterialPossessionProofs:n,...e.emailOtpEnrollment?{emailOtpEnrollment:e.emailOtpEnrollment}:{}});if(!r.ok)return r.failure;try{let n=await P(Xt(r.body,`walletRecoveryGoogleEmailOtpFinalize`).projection,en(e,t));if(n.kind!==`google_email_otp`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:n.storeVersion,authority:n.authority,authMethod:n.authMethod}}catch{return{kind:`transport_uncertain`}}}async function Kt(e){let t;try{if(t=A(e.replacementEnvelope,`walletRecoveryGoogleEmailOtpReplay.replacementEnvelope`),t.factor.kind!==`email_otp`||String(t.walletId)!==String(e.walletId))throw Error(`recovery replay envelope identity is invalid`)}catch{return{kind:`refused`}}let n=await X(e,Ht,{kind:`replay`,recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId,replacementEnvelope:t});if(!n.ok)return n.failure;try{let r=await P(Xt(n.body,`walletRecoveryGoogleEmailOtpReplay`).projection,en(e,t));if(r.kind!==`google_email_otp`)throw Error(`recovery projection branch changed`);return{kind:`promoted`,storeVersion:r.storeVersion,authority:r.authority,authMethod:r.authMethod}}catch{return{kind:`transport_uncertain`}}}async function X(e,t,n){let r;try{r=await(e.fetchImpl??fetch)(`${T(e.relayUrl)}${t}`,w({body:n}))}catch{return{ok:!1,failure:{kind:`transport_uncertain`}}}let i=await r.json().catch(()=>void 0);return r.status===200?{ok:!0,body:i}:r.status===409||r.status===429?{ok:!1,failure:{kind:`retryable_conflict`}}:r.status===400||r.status===401?{ok:!1,failure:{kind:`refused`}}:{ok:!1,failure:{kind:`transport_uncertain`}}}function qt(t,n){let r=Q(e(t.recoveryOperationId)),i=j(t.reservationId);if(r!==n.recoveryOperationId||i!==n.reservationId)throw Error(`recovery operation identity changed`);return{recoveryOperationId:r,reservationId:i}}function Jt(e){let t=Zt(e,[`ok`,`recoveryOperationId`,`reservationId`,`challengeId`,`delivery`,`expiresAtMs`],`walletRecoveryGoogleVerify`);return $t(t,`walletRecoveryGoogleVerify`),{recoveryOperationId:Z(t,`recoveryOperationId`),reservationId:Z(t,`reservationId`),challengeId:Z(t,`challengeId`),delivery:Z(t,`delivery`),expiresAtMs:Z(t,`expiresAtMs`)}}function Yt(e){let t=Zt(e,[`ok`,`recoveryOperationId`,`reservationId`,`challengeId`],`walletRecoveryEmailOtpVerify`);return $t(t,`walletRecoveryEmailOtpVerify`),{recoveryOperationId:Z(t,`recoveryOperationId`),reservationId:Z(t,`reservationId`),challengeId:Z(t,`challengeId`)}}function Xt(e,t){let n=Zt(e,[`ok`,`projection`],t);return $t(n,t),{projection:Z(n,`projection`)}}function Zt(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be a JSON object`);let r=Object.getPrototypeOf(e);if(r!==Object.prototype&&r!==null)throw Error(`${n} must be a plain JSON object`);let i=Object.keys(e);if(i.length!==t.length||!Qt(i,t))throw Error(`${n} has an unexpected response shape`);return e}function Qt(e,t){for(let n of t)if(!e.includes(n))return!1;return!0}function $t(e,t){if(Z(e,`ok`)!==!0)throw Error(`${t} did not succeed`)}function Z(e,t){let n=Object.getOwnPropertyDescriptor(e,t);if(!n||!(`value`in n))throw Error(`response field ${t} is missing`);return n.value}function Q(e){if(!e.ok)throw Error(`invalid domain identity`);return e.value}function $(e){if(typeof e!=`string`||!e.trim())throw Error(`value must be a string`);return e.trim()}function en(e,t){if(t.factor.kind!==`email_otp`)throw Error(`replacement envelope is not an Email OTP envelope`);return{kind:`google_email_otp`,walletId:e.walletId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,providerSubject:Q(c(e.expectedProviderSubject)),emailHashHex:tn(e.expectedEmailHashHex),registrationAuthorityId:$(e.expectedRegistrationAuthorityId),enrollment:{kind:`email_otp_enrollment_reference_v1`,enrollmentId:$(t.factor.enrollmentId),enrollmentSealKeyVersion:$(t.factor.enrollmentSealKeyVersion)}}}function tn(e){let t=$(e);if(!/^[0-9a-f]{64}$/.test(t))throw Error(`email hash is invalid`);return t}async function nn(e,t){if(e.version!==t.version||e.storeVersion!==t.storeVersion||e.walletId!==t.walletId||e.recoveryOperationId!==t.recoveryOperationId||e.targetDeviceId!==t.targetDeviceId||e.targetAuthorityId!==t.targetAuthorityId||e.targetWalletAuthMethodId!==t.targetWalletAuthMethodId||!await ae(e.authority,t.authority)||!be(e.authMethod,t.authMethod)||e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`?e.target.kind===t.target.kind&&e.target.rpId===t.target.rpId&&e.target.credentialIdB64u===t.target.credentialIdB64u:!1;case`google_email_otp`:return t.kind===`google_email_otp`?e.target.kind===t.target.kind&&e.target.provider===t.target.provider&&e.target.providerSubject===t.target.providerSubject&&e.target.emailHashHex===t.target.emailHashHex&&e.target.registrationAuthorityId===t.target.registrationAuthorityId&&e.target.enrollment.kind===t.target.enrollment.kind&&e.target.enrollment.enrollmentId===t.target.enrollment.enrollmentId&&e.target.enrollment.enrollmentSealKeyVersion===t.target.enrollment.enrollmentSealKeyVersion:!1;default:return rn(e)}}function rn(e){throw Error(`unsupported wallet recovery projection: ${String(e)}`)}function an(e){let t=Y(e.payload.recoveryOperationId);switch(e.kind){case`passkey`:return we({kind:`passkey`,storeVersion:e.promotion.storeVersion,walletId:e.payload.walletId,recoveryOperationId:t,targetDeviceId:e.payload.targetDeviceId,targetAuthorityId:e.payload.targetAuthorityId,targetWalletAuthMethodId:e.payload.targetWalletAuthMethodId,authority:e.promotion.authority,authMethod:e.promotion.authMethod});case`google_email_otp`:{let n=c(e.payload.providerSubject);if(!n.ok)throw Error(`wallet recovery provider subject is invalid`);return we({kind:`google_email_otp`,storeVersion:e.promotion.storeVersion,walletId:e.payload.walletId,recoveryOperationId:t,targetDeviceId:e.payload.targetDeviceId,targetAuthorityId:e.payload.targetAuthorityId,targetWalletAuthMethodId:e.payload.targetWalletAuthMethodId,authority:e.promotion.authority,authMethod:e.promotion.authMethod,providerSubject:n.value,emailHashHex:e.payload.emailHashHex,registrationAuthorityId:e.payload.registrationAuthorityId,enrollment:ft(e.payload)})}}}function on(e){return e.ecdsaKeySets.map(e=>({keySetId:e.entry.keySetId,proof:e.possessionProof}))}function sn(e){return{id:e.registration.id,rawId:e.registration.rawId,type:e.registration.type,authenticatorAttachment:e.registration.authenticatorAttachment??void 0,response:{clientDataJSON:e.registration.response.clientDataJSON,attestationObject:e.registration.response.attestationObject,transports:[...e.registration.response.transports]},clientExtensionResults:{prf:{results:{first:void 0,second:void 0}}}}}async function cn(e){let{payload:t}=e;if(H(t)){let n=await ct({relayUrl:e.relayUrl,walletId:String(t.walletId),reservationId:String(t.reservationId),recoveryOperationId:Y(t.recoveryOperationId),targetDeviceId:String(t.targetDeviceId),targetAuthorityId:String(t.targetAuthorityId),targetWalletAuthMethodId:String(t.targetWalletAuthMethodId),challengeId:t.challengeId,replacementId:t.replacementId,webauthnRegistration:sn(t),replacementEnvelope:t.replacementEnvelope,ecdsaMaterialPossessionProofs:on(t),fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`passkey`,payload:t,promotion:n}:n}let n=await Gt({relayUrl:e.relayUrl,recoveryOperationId:Y(t.recoveryOperationId),reservationId:t.reservationId,walletId:t.walletId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,expectedProviderSubject:t.providerSubject,expectedEmailHashHex:t.emailHashHex,expectedRegistrationAuthorityId:t.registrationAuthorityId,replacementEnvelope:t.replacementEnvelope,ecdsaMaterialPossessionProofs:on(t),emailOtpEnrollment:ln(t.enrollment),fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`google_email_otp`,payload:t,promotion:n}:n}function ln(e){return e.kind===`create`?{kind:`create`,material:e.material}:null}async function un(e){let{payload:t}=e;if(H(t)){let n=await lt({relayUrl:e.relayUrl,walletId:String(t.walletId),reservationId:String(t.reservationId),recoveryOperationId:Y(t.recoveryOperationId),targetDeviceId:String(t.targetDeviceId),targetAuthorityId:String(t.targetAuthorityId),targetWalletAuthMethodId:String(t.targetWalletAuthMethodId),replacementId:t.replacementId,replacementEnvelope:t.replacementEnvelope,fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`passkey`,payload:t,promotion:n}:n}let n=await Kt({relayUrl:e.relayUrl,recoveryOperationId:Y(t.recoveryOperationId),reservationId:t.reservationId,walletId:t.walletId,targetDeviceId:t.targetDeviceId,targetAuthorityId:t.targetAuthorityId,targetWalletAuthMethodId:t.targetWalletAuthMethodId,expectedProviderSubject:t.providerSubject,expectedEmailHashHex:t.emailHashHex,expectedRegistrationAuthorityId:t.registrationAuthorityId,replacementEnvelope:t.replacementEnvelope,fetchImpl:e.fetchImpl});return n.kind===`promoted`?{kind:`google_email_otp`,payload:t,promotion:n}:n}function dn(e){return e.kind===`passkey`||e.kind===`google_email_otp`}async function fn(e){let t=await un(e);return dn(t)||t.kind!==`refused`?t:await cn(e)}function pn(e,t){return{walletId:e.walletId,factor:{kind:`passkey`,credentialIdB64u:t.target.credentialIdB64u},verifier:{kind:`webauthn`,rpId:t.target.rpId},bindingId:t.authMethod.walletAuthMethodId}}function mn(e,t){let n=ce({walletId:e.walletId,provider:`google`,providerUserId:e.providerSubject,emailHashHex:e.emailHashHex});return{walletId:n.walletId,factor:n.factor,verifier:n.verifier,bindingId:t.authMethod.walletAuthMethodId}}async function hn(e,t){if(H(e)){if(t.kind!==`passkey`)throw Error(`wallet recovery projection branch changed`);return se({authority:pn(e,t)})}if(t.kind!==`google_email_otp`)throw Error(`wallet recovery projection branch changed`);return se({authority:mn(e,t)})}async function gn(e){let t=[],n=[];for(let r of e.payload.ecdsaKeySets){let i=r.entry,a=i.recoveryBasis,o=await oe({walletId:e.payload.walletId,signingRootId:a.signingRootId,signingRootVersion:a.signingRootVersion}),s=await Ae({authority:e.authority,chainTargets:a.chainTargets,walletId:String(e.payload.walletId),keyHandle:i.keyHandle,ecdsaThresholdKeyId:a.ecdsaThresholdKeyId,signingRootId:a.signingRootId,signingRootVersion:a.signingRootVersion,relayerKeyId:o,participantIds:a.participantIds,publicCapability:a.publicCapability,activationReceipt:a.activationReceipt,runtimePolicyScope:a.runtimePolicyScope,readyStateBlobB64u:r.readyStateBlobB64u,publicFacts:r.publicFacts});n.push(s);for(let n of a.chainTargets)t.push(_n({payload:e.payload,keySet:r,chainTarget:n,materialRef:s.roleLocalMaterialRef,relayerKeyId:o}))}return{walletKeys:t,ecdsaContinuity:n}}function _n(e){let t=e.keySet.entry,n=t.recoveryBasis,r=e.keySet.publicFacts,i=xe({walletId:e.payload.walletId,chainTarget:e.chainTarget,keyHandle:t.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,applicationBindingDigestB64u:n.publicCapability.context.application_binding_digest_b64u,clientParticipantId:1,relayerParticipantId:2,participantIds:n.participantIds,contextBinding32B64u:r.contextBinding32B64u,derivationClientSharePublicKey33B64u:r.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:r.relayerPublicKey33B64u,groupPublicKey33B64u:r.groupPublicKey33B64u,ethereumAddress:r.ethereumAddress,publicCapability:n.publicCapability});return{keyScope:`evm-family`,chainTarget:e.chainTarget,walletId:String(e.payload.walletId),evmFamilySigningKeySlotId:t.evmFamilySigningKeySlotId,keyHandle:t.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,thresholdEcdsaPublicKeyB64u:r.groupPublicKey33B64u,thresholdOwnerAddress:r.ethereumAddress,relayerKeyId:e.relayerKeyId,relayerVerifyingShareB64u:r.relayerPublicKey33B64u,participantIds:n.participantIds,publicCapability:n.publicCapability,roleLocalMaterialRef:e.materialRef,ecdsaRoleLocalPublicFacts:i}}function vn(e){if(e.nearKeySets.length!==1)throw Error(`wallet recovery requires exactly one NEAR key set`);return e.nearKeySets[0]}function yn(e){return[...e.registration.response.transports]}function bn(e){return`ed25519:${ie(D(vn(e).binding.registeredPublicKeyB64u))}`}function xn(e,t){let n=i(t.thresholdSessionId);if(!n.ok)throw Error(`recovery NEAR threshold session id is invalid`);return{walletId:e.walletId,nearAccountId:k(t.binding.nearAccountId),thresholdSessionId:n.value,runtimePolicyScope:t.runtimePolicyScope,materialActivation:me(t.materialActivation)}}async function Sn(e){if(H(e.payload)){if(e.projection.kind!==`passkey`)throw Error(`wallet recovery projection branch changed`);let t={walletId:e.payload.walletId,rpId:e.projection.target.rpId,credentialIdB64u:e.projection.target.credentialIdB64u,credentialPublicKeyB64u:e.projection.authMethod.credentialPublicKeyB64u,transports:yn(e.payload),walletKeys:e.walletKeys};if(e.payload.nearKeySets.length===0)return Oe({kind:`evm_family_ecdsa`,...t});let n=vn(e.payload);return Oe({kind:`near_ed25519`,...t,nearAccountId:k(n.binding.nearAccountId),nearEd25519SigningKeyId:n.binding.nearEd25519SigningKeyId,signerSlot:n.binding.signerSlot,operationalPublicKey:bn(e.payload),relayerKeyId:n.binding.signingWorkerId,participantIds:n.binding.participantIds,custodyMaterials:e.payload.nearKeySets.map(e=>({binding:e.binding,sealed:e.sealed}))})}if(e.projection.kind!==`google_email_otp`)throw Error(`wallet recovery projection branch changed`);let t=mn(e.payload,e.projection),n={walletId:e.payload.walletId,email:e.payload.verifiedEmail,registrationAuthorityId:e.payload.registrationAuthorityId,authority:t,walletKeys:e.walletKeys};if(e.payload.nearKeySets.length===0)return ke({kind:`evm_family_ecdsa`,...n});let r=vn(e.payload);return ke({kind:`near_ed25519`,...n,nearAccountId:k(r.binding.nearAccountId),nearEd25519SigningKeyId:r.binding.nearEd25519SigningKeyId,signerSlot:r.binding.signerSlot,operationalPublicKey:bn(e.payload),relayerKeyId:r.binding.signingWorkerId,participantIds:r.binding.participantIds,custodyMaterials:e.payload.nearKeySets.map(e=>({binding:e.binding,sealed:e.sealed}))})}async function Cn(e){let t=e.pending.projection,n=await hn(e.payload,t),r=await gn({payload:e.payload,authority:n}),i=await Sn({payload:e.payload,projection:t,walletKeys:r.walletKeys});await M.publishPendingWalletRecoveryCommit({pending:e.pending,authority:t.authority,authMethod:t.authMethod,registration:i,ecdsaContinuity:r.ecdsaContinuity,ed25519PublicCapabilityReferences:e.payload.nearKeySets.map(t=>xn(e.payload,t))})}async function wn(e){let t=await M.listPendingWalletRecoveryCommits(),n=[];for(let r of t)try{let t=await It(r),i=r.stage===`awaiting_server_promotion`?await fn({relayUrl:e.relayUrl,payload:t,fetchImpl:e.fetchImpl}):await un({relayUrl:e.relayUrl,payload:t,fetchImpl:e.fetchImpl});if(!dn(i)){if(i.kind===`refused`){await M.deletePendingWalletRecoveryCommit(r.recoveryOperationId),n.push({kind:`discarded`,recoveryOperationId:String(r.recoveryOperationId)});continue}n.push({kind:`pending`,recoveryOperationId:String(r.recoveryOperationId),failure:i});continue}let a=i,o=an(a),s=r.stage===`awaiting_server_promotion`?await M.advancePendingWalletRecoveryCommit({awaiting:r,promoted:Vt(r,a.payload,o,r.updatedAtMs+1)}):r;if(r.stage===`server_promoted`&&!await nn(r.projection,o))throw Error(`wallet recovery replay projection changed`);await Cn({pending:s,payload:a.payload}),n.push({kind:`completed`,recoveryOperationId:String(r.recoveryOperationId)})}catch(e){console.warn(`[SeamsWeb] pending wallet recovery replay failed before classification:`,String(r.recoveryOperationId),e instanceof Error?e.message:String(e||`unknown error`)),n.push({kind:`corrupt`,recoveryOperationId:String(r.recoveryOperationId)})}return n}async function Tn(e){let t=await Mt(e.operation);return{payload:t,pending:Bt(t,await Ft(t),e.nowMs)}}async function En(e){let t=an(e.promotion);return M.advancePendingWalletRecoveryCommit({awaiting:e.awaiting,promoted:Vt(e.awaiting,e.promotion.payload,t,e.awaiting.updatedAtMs+1)})}export{Gt as a,H as c,Re as d,wn as i,ct as l,En as n,Wt as o,Cn as r,Ut as s,Tn as t,Le as u};

package/dist/esm/sdk/walletRegistrationSetupPrewarm-CQow9u8m.js

@@ -1 +0,0 @@
-import{st as e}from"./activeWalletSession-BtEHhe99.js";const t=`/wallets/register/setup`;function n(n){e(n,[t])}export{n,t};

package/dist/esm/sdk/walletSessionAuthorizationStatus-_KtCVFYW.js

@@ -1 +0,0 @@
-import{i as e,it as t,n,nt as r,ot as i}from"./activeWalletSession-BtEHhe99.js";import{d as a,h as o}from"./capabilityKinds-CqHVzVsJ.js";const s=(e,t)=>globalThis.fetch(e,t),c=new WeakMap;let l=0;const u=new Map;function d(e){return JSON.stringify([e])}function f(e,t){return d(e.operationCredential.token)+JSON.stringify([i(e.relayerUrl),t.walletSessionId,t.quotaId])}function p(e,t,n,r){let i=c.get(e);i||(i=new Map,c.set(e,i));let a=i.get(t);if(a&&a.sequence>n)return r;if(u.delete(t),i.delete(t),i.set(t,{kind:`local_wallet_session_observation`,sequence:n,status:r}),i.size>32){let e=i.keys().next();e.done||i.delete(e.value)}return r}function m(e){let t=e.remainingUses-1;return t>0?{...e,remainingUses:t}:{...e,status:`exhausted`,remainingUses:0,quotaLifecycle:`exhausted`}}var h=class e{readsByFetch=new Map;suppliedStatus={kind:`remote`};static fromPrepare(t,n){let r=new e;return r.suppliedStatus={kind:`server_response`,key:f(t,n),status:n,observation:m(n)},r}static fromRegistration(t,n){let r=g(n),i=new e;return i.suppliedStatus={kind:`server_response`,key:f({relayerUrl:t,operationCredential:n.operationCredential},r),status:r,observation:r},i}static acceptRegistrationSession(e,t){let n=g(t);if(u.set(f({relayerUrl:e,operationCredential:t.operationCredential},n),n),u.size>8){let e=u.keys().next();e.done||u.delete(e.value)}}static forHostObservation(){let t=new e;return t.suppliedStatus={kind:`host_observation`},t}static forgetCredential(e){let t=d(e);for(let e of[c.get(s),u])if(e)for(let n of[...e.keys()])n.startsWith(t)&&e.delete(n)}static observationForConfirmation(e,t){return c.get(e.fetchImpl??s)?.get(f(e,t))??null}read(e,t){if(this.suppliedStatus.kind===`server_response`){if(this.suppliedStatus.key!==f(e,t))throw Error(`Wallet Session response identity changed before reconciliation`);return p(e.fetchImpl??s,this.suppliedStatus.key,++l,this.suppliedStatus.observation),Promise.resolve(this.suppliedStatus.status)}let n=e.fetchImpl??s,r=this.readsByFetch.get(n);r||(r=new Map,this.readsByFetch.set(n,r));let i=f(e,t),a=r.get(i);if(a)return a;let o=++l,c=this.suppliedStatus.kind===`host_observation`?u.get(i):void 0,d=c?Promise.resolve(p(n,i,o,c)):D(e).read(t).then(p.bind(null,n,i,o));return r.set(i,d),d}};function g(e){return{status:`active`,walletSessionId:e.walletSessionId,quotaId:e.quotaId,remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs,quotaLifecycle:`active`,authorization:e.walletSession}}const _=[`ok`,`status`,`walletSessionId`,`quotaId`,`remainingUses`,`expiresAtMs`,`quotaLifecycle`,`authorization`],v=[`ok`,`status`,`walletSessionId`,`quotaId`];function y(e){if(typeof e!=`object`||!e||Array.isArray(e)||Object.getPrototypeOf(e)!==Object.prototype&&Object.getPrototypeOf(e)!==null)return{kind:`error`,message:null};let t=new Map(Object.entries(e)),n=[...t.keys()],r=t.get(`status`),i=t.get(`walletSessionId`),a=t.get(`quotaId`);if(t.get(`ok`)===!0&&typeof r==`string`){let e=r===`active`||r===`exhausted`||r===`expired`||r===`superseded`||r===`authority_unavailable`||r===`method_unavailable`||r===`capability_unavailable`?r:null;if(e&&n.length===_.length){let r=new Set(_);if(n.every(e=>r.has(e)))return{kind:`observed`,status:e,walletSessionId:i,quotaId:a,remainingUses:t.get(`remainingUses`),expiresAtMs:t.get(`expiresAtMs`),quotaLifecycle:t.get(`quotaLifecycle`),authorization:t.get(`authorization`)}}if((r===`missing`||r===`invalid`)&&n.length===v.length){let e=new Set(v);if(n.every(t=>e.has(t)))return{kind:`terminal`,status:r,walletSessionId:i,quotaId:a}}}if(n.every(e=>e===`code`||e===`message`)){let e=t.get(`message`);return{kind:`error`,message:typeof e==`string`?e:null}}return{kind:`error`,message:null}}function b(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>0}function x(e,t){let n=o(e.walletSessionId),r=a(e.quotaId);return!n.ok||!r.ok||n.value!==t.walletSessionId||r.value!==t.quotaId?null:{walletSessionId:n.value,quotaId:r.value}}function S(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0}function C(e,t){if(e.quotaLifecycle!==`active`&&e.quotaLifecycle!==`exhausted`||!S(e.remainingUses)||e.quotaLifecycle===`exhausted`!=(e.remainingUses===0)||!b(e.expiresAtMs))return null;let r;try{r=n(e.authorization)}catch{return null}return r.quotaId!==t.quotaId||r.expiresAtMs!==e.expiresAtMs?null:{remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs,quotaLifecycle:e.quotaLifecycle,authorization:r}}function w(e,t){return T(y(e),t)}function T(e,t){if(e.kind===`error`)return null;let n=x(e,t);if(!n)return null;if(e.kind===`terminal`)return{status:e.status,...n};switch(e.status){case`active`:{let t=C(e,n);return!t||t.quotaLifecycle!==`active`?null:{status:`active`,...n,...t}}case`exhausted`:{let t=C(e,n);return!t||t.remainingUses!==0?null:{status:`exhausted`,...n,...t,remainingUses:0}}case`expired`:case`superseded`:case`authority_unavailable`:case`method_unavailable`:case`capability_unavailable`:{let t=C(e,n);return t?{status:e.status,...n,...t}:null}default:return null}}var E=class{relayerUrl;operationCredential;fetchImpl;constructor(t){if(this.relayerUrl=i(t.relayerUrl),!this.relayerUrl)throw Error(`Relayer URL is required`);this.operationCredential=e(t.operationCredential),this.fetchImpl=t.fetchImpl??s}async read(e){let n=await this.fetchImpl(`${this.relayerUrl}/wallet/session/status`,{...r({body:{walletSessionId:e.walletSessionId,quotaId:e.quotaId},headers:t(this.operationCredential)}),credentials:`omit`}),i=y(await n.json().catch(()=>null));if(!n.ok){let e=i.kind===`error`&&i.message?i.message:`Wallet Session status request failed with HTTP ${n.status}`;throw Error(e)}let a=T(i,e);if(!a)throw Error(`Wallet Session status response is invalid`);return a}};function D(e){return new E(e)}export{D as n,w as r,h as t};

package/dist/esm/sdk/warmSessionHydration-CY9ofEGr.js

@@ -1 +0,0 @@
-import{t as e}from"./prfCache-D25ZCg5n.js";function t(t){return{hydrateSigningSession:n=>e(t.getWarmSessionMaterialWriter(),n)}}export{t as createWarmSessionHydrationService};

package/dist/public/sdk/ConfirmationDrawer-Ck33ZmU-.js

@@ -1 +0,0 @@
-import{a as e,d as t,f as n,l as r,o as i,p as a,u as o}from"./appearance-token-vars-BA3KQyEE.js";async function s(e,t,n){if(!e.isConnected||n?.aborted)return!1;let r=e.ownerDocument,i=r.defaultView?.navigator.clipboard;if(i?.writeText)try{return await i.writeText(t),!0}catch{}if(!e.isConnected||n?.aborted)return!1;let a=r.createElement(`textarea`);a.value=t,a.readOnly=!0,a.className=`seams-offscreen`,e.appendChild(a),a.select();try{return r.execCommand(`copy`)}finally{a.remove()}}function c(){return r(`span`,{class:`copy-icon`,"aria-hidden":`true`,children:[r(`span`,{class:`copy-icon-check`,children:r(`svg`,{width:`16`,height:`16`,viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,children:r(`path`,{d:`M20 6 9 17l-5-5`})})}),r(`span`,{class:`copy-icon-copy`,children:r(`svg`,{width:`16`,height:`16`,viewBox:`0 0 24 24`,fill:`none`,stroke:`currentColor`,children:[r(`rect`,{width:`14`,height:`14`,x:`8`,y:`8`,rx:`2`,ry:`2`}),r(`path`,{d:`M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2`})]})})]})}let l=0;function u(e){return r(d,{...e},e.context)}var d=class extends n{static contextType=e;dialog=a();hosted=a();containerId=`seams-confirmation-modal-${++l}`;componentDidMount(){this.props.context===`standalone`?this.dialog.current?.showModal():this.hosted.current?.focus({preventScroll:!0})}componentWillUnmount(){this.dialog.current?.close()}cancel=e=>{e.preventDefault(),e.stopPropagation(),this.props.onCancel()};backdropClick=e=>{let t=this.dialog.current;if(!t||e.target!==t)return;let n=t.getBoundingClientRect();(e.clientX<n.left||e.clientX>n.right||e.clientY<n.top||e.clientY>n.bottom)&&this.cancel(e)};hostedKeyDown=e=>{!e.defaultPrevented&&e.key===`Escape`&&this.cancel(e)};render(){return this.props.context===`standalone`?r(`dialog`,{ref:this.dialog,class:`seams-confirmation-modal`,"aria-label":o(this.context,this.props.label),onCancel:this.cancel,onClick:this.backdropClick,children:r(`div`,{id:this.containerId,class:`modal-container-root`,tabIndex:-1,children:this.props.children})}):r(`div`,{ref:this.hosted,class:`seams-confirmation-modal seams-confirmation-modal--hosted`,tabIndex:-1,onKeyDown:this.hostedKeyDown,children:r(`div`,{id:this.containerId,class:`modal-container-root`,children:this.props.children})})}};function f(e){let t=e.startTranslatePx+e.deltaPx;if(t>=e.restTranslatePx)return t;let n=Math.max(e.sheetHeightPx*.5,e.viewportHeightPx*.5,e.minimumOverpullPx),r=e.restTranslatePx-t;return e.restTranslatePx-n*(1-1/(r/n+1))}function p(e){let t=e.totalDeltaPx/Math.max(1,e.durationMs);return Math.min(e.velocityPxPerMs,t)<=-.6||Math.max(e.velocityPxPerMs,t)>=.7||e.translatePx>=e.sheetHeightPx-50}let m=0;function h(e){return r(g,{...e},e.context)}var g=class extends n{static contextType=e;state={settled:!1};id=`seams-confirmation-drawer-${++m}`;dialog=a();sheet=a();body=a();content=a();observer=null;frame=null;closeTimer=null;gesture={kind:`idle`};lifetime=`active`;closeReported=!1;suppressPointerClick=!1;componentDidMount(){let e=this.sheet.current,t=e.ownerDocument.defaultView;this.dialog.current?.showModal(),this.dialog.current||e.focus({preventScroll:!0}),this.observer=new ResizeObserver(this.measureContent),this.observer.observe(this.content.current),this.observer.observe(e),t.addEventListener(`resize`,this.scheduleMeasure),t.visualViewport?.addEventListener(`resize`,this.scheduleMeasure),this.measure(),this.frame=t.requestAnimationFrame(this.openAfterLayout),this.props.state.kind===`closing`&&this.startClose()}openAfterLayout=()=>{this.frame=null,this.setState({settled:!0})};componentDidUpdate(e){e.styles!==this.props.styles&&(e.styles.deleteDynamicRule(this.id),e.styles.deleteDynamicRule(`${this.id}-drag`),this.resetGesture(),this.measure()),e.state.kind!==this.props.state.kind&&(this.props.state.kind===`closing`?this.startClose():(this.clearCloseTimer(),this.closeReported=!1)),this.props.state.kind===`open`&&this.props.state.interaction===`busy`&&this.resetGesture()}componentWillUnmount(){this.lifetime=`disposed`,this.resetGesture();let e=this.sheet.current.ownerDocument.defaultView;this.frame!==null&&e.cancelAnimationFrame(this.frame),this.clearCloseTimer(),this.observer?.disconnect(),e.removeEventListener(`resize`,this.scheduleMeasure),e.visualViewport?.removeEventListener(`resize`,this.scheduleMeasure),this.props.styles.deleteDynamicRule(this.id),this.dialog.current?.close()}scheduleMeasure=()=>{this.lifetime===`disposed`||this.frame!==null||(this.frame=this.sheet.current.ownerDocument.defaultView.requestAnimationFrame(this.measureFrame))};measureFrame=()=>{this.frame=null,this.measure()};measureContent=()=>{this.lifetime===`active`&&this.measure()};measure(){if(this.gesture.kind!==`idle`)return;let e=this.sheet.current,t=this.content.current,n=Math.round(t.getBoundingClientRect().bottom-e.getBoundingClientRect().top),r=this.props.context===`standalone`?Math.max(0,e.offsetHeight-n):0;this.props.styles.setDynamicDeclarations(this.id,`#${this.id}`,{"--seams-drawer-rest":`${r}px`})}startClose(){this.resetGesture(),this.clearCloseTimer();let e=this.sheet.current.ownerDocument.defaultView,t=e.matchMedia(`(prefers-reduced-motion: reduce)`).matches?0:150;this.closeTimer=e.setTimeout(this.reportClosed,t)}clearCloseTimer(){this.closeTimer!==null&&(this.sheet.current.ownerDocument.defaultView.clearTimeout(this.closeTimer),this.closeTimer=null)}reportClosed=()=>{this.clearCloseTimer(),!(this.lifetime===`disposed`||this.closeReported||this.props.state.kind!==`closing`)&&(this.closeReported=!0,this.props.state.onClosed())};transitionEnd=e=>{e.target===this.sheet.current&&e.propertyName===`transform`&&this.reportClosed()};cancel=e=>{e.preventDefault(),e.stopPropagation(),this.props.state.kind===`open`&&this.props.onCancel()};backdropClick=e=>{this.props.dismissOnBackdrop!==!1&&e.target===this.dialog.current&&this.canDrag()&&this.cancel(e)};keyDown=e=>{!e.defaultPrevented&&e.key===`Escape`&&this.cancel(e)};canDrag(){return this.props.state.kind===`open`&&this.props.state.interaction===`ready`}pointerDown=e=>{if(this.clearClickSuppression(),!this.canDrag()||this.gesture.kind!==`idle`||!e.isPrimary||e.button!==0)return;let t=e.target;if(t instanceof Element&&t.closest(`a, input, textarea, select, summary, button:not(.seams-drawer-handle), [data-seams-drawer-no-drag]`))return;this.gesture={kind:`pending`,pointerId:e.pointerId,startY:e.clientY};let n=this.sheet.current.ownerDocument;n.addEventListener(`pointermove`,this.pointerMove,{passive:!1}),n.addEventListener(`pointerup`,this.pointerUp),n.addEventListener(`pointercancel`,this.pointerCancel)};pointerMove=e=>{let t=this.gesture;if(t.kind===`idle`||t.pointerId!==e.pointerId)return;let n=this.sheet.current;if(t.kind===`pending`){if(Math.abs(e.clientY-t.startY)<8||this.body.current.scrollTop>0)return;let r=n.ownerDocument.defaultView,i=new DOMMatrixReadOnly(r.getComputedStyle(n).transform).m42;t={kind:`dragging`,pointerId:t.pointerId,startY:t.startY,lastY:t.startY,startedAt:e.timeStamp,lastTime:e.timeStamp,velocity:0,rest:i,translate:i,height:n.offsetHeight},this.gesture=t,n.setPointerCapture(e.pointerId),n.classList.add(`is-dragging`)}let r=e.timeStamp-t.lastTime;r>0&&(t.velocity=(e.clientY-t.lastY)/r),t.lastY=e.clientY,t.lastTime=e.timeStamp,t.translate=f({startTranslatePx:t.rest,deltaPx:e.clientY-t.startY,restTranslatePx:t.rest,sheetHeightPx:t.height,viewportHeightPx:n.ownerDocument.defaultView.innerHeight,minimumOverpullPx:160}),this.props.styles.setDynamicDeclarations(`${this.id}-drag`,`#${this.id}`,{"--seams-drawer-drag":`${t.translate}px`}),e.preventDefault()};pointerUp=e=>{let t=this.gesture;if(t.kind===`idle`||t.pointerId!==e.pointerId)return;let n=t.kind===`dragging`&&p({velocityPxPerMs:t.velocity,totalDeltaPx:t.lastY-t.startY,durationMs:e.timeStamp-t.startedAt,translatePx:t.translate,sheetHeightPx:t.height});t.kind===`dragging`&&(this.suppressPointerClick=!0,e.preventDefault()),this.resetGesture(),n&&this.props.state.kind===`open`&&this.props.onCancel()};pointerCancel=e=>{this.gesture.kind!==`idle`&&this.gesture.pointerId===e.pointerId&&(this.gesture.kind===`dragging`&&(this.suppressPointerClick=!0),this.resetGesture())};clearClickSuppression=()=>{this.suppressPointerClick=!1};suppressDragClick=e=>{!this.suppressPointerClick||e.detail===0||(this.suppressPointerClick=!1,e.preventDefault(),e.stopPropagation())};resetGesture(){let e=this.sheet.current,t=this.gesture;this.gesture={kind:`idle`},t.kind!==`idle`&&e.hasPointerCapture(t.pointerId)&&e.releasePointerCapture(t.pointerId),e.classList.remove(`is-dragging`);let n=e.ownerDocument;n.removeEventListener(`pointermove`,this.pointerMove),n.removeEventListener(`pointerup`,this.pointerUp),n.removeEventListener(`pointercancel`,this.pointerCancel),this.props.styles.deleteDynamicRule(`${this.id}-drag`),this.lifetime===`active`&&this.scheduleMeasure()}render(){let e=this.state.settled&&this.props.state.kind===`open`,n=[`seams-confirmation-drawer`];e&&n.push(`is-open`),this.gesture.kind===`dragging`&&n.push(`is-dragging`);let a=r(`section`,{ref:this.sheet,id:this.id,class:n.join(` `),"data-context":this.props.context,tabIndex:-1,onPointerDownCapture:this.pointerDown,onClickCapture:this.suppressDragClick,onLostPointerCapture:this.pointerCancel,onTransitionEnd:this.transitionEnd,onKeyDown:this.keyDown,children:[r(`div`,{class:`seams-drawer-controls`,children:[this.props.origin&&r(`div`,{class:`seams-drawer-origin`,children:this.props.origin}),r(`button`,{type:`button`,class:`seams-drawer-handle`,"aria-label":t(this.context,`Dismiss confirmation`),disabled:!this.canDrag(),onClick:this.cancel,children:r(`span`,{})}),r(`button`,{type:`button`,class:`seams-drawer-close`,"aria-label":t(this.context,`Close`),disabled:!this.canDrag(),onClick:this.cancel,children:`×`})]}),r(`div`,{class:`seams-drawer-body`,ref:this.body,children:[this.props.errorMessage&&r(`div`,{class:`error`,children:r(i,{copy:this.props.errorMessage})}),r(`div`,{class:`seams-drawer-content`,ref:this.content,children:this.props.children})]})]});return this.props.context===`wallet-iframe`?a:r(`dialog`,{class:`seams-drawer-dialog`,ref:this.dialog,"aria-label":o(this.context,this.props.label),onCancel:this.cancel,onClick:this.backdropClick,onClickCapture:this.suppressDragClick,onPointerDownCapture:this.clearClickSuppression,children:a})}};export{s as i,u as n,c as r,h as t};

package/dist/public/sdk/activeWalletSession-BtEHhe99.js

@@ -1 +0,0 @@
-import{D as e,M as t,O as n,T as r,V as i,d as a,h as o,j as s,k as c,l,r as ee,u,w as d,z as f}from"./domainIds-C3fUa33Q.js";import{C as te,k as p}from"./chains-CPmd4s9f.js";import{i as ne,r as re}from"./base64-BmKR3UqU.js";import{d as ie,h as ae,l as oe,m}from"./capabilityKinds-CqHVzVsJ.js";import{r as h}from"./canonicalPrimitives-D_1HyEuJ.js";function g(e,t={trim:!0}){let n=String(e??``);return i(t.trim?n.trim():n)}function _(e){let t=String(e.token??``).trim();if(!t)throw Error(e.missingMessage);return{Authorization:`Bearer ${t}`}}function se(e){return{method:`POST`,headers:{"Content-Type":`application/json`,...e.headers||{}},credentials:`omit`,body:e.bodyJson??JSON.stringify(e.body)}}function ce(e,t){let n=g(e),r=globalThis.location?.origin,i;try{i=new URL(n).origin}catch{return}if(!(!r||i===r))for(let e of t)fetch(`${n}${e}`,{method:`OPTIONS`,credentials:`omit`}).catch(()=>{})}function le(e){return{..._({token:e.token,missingMessage:`Wallet Session token is required`}),...v(e.home)}}function v(e){switch(e.kind){case`direct`:return{};case`regional`:return{"X-Seams-Wallet-Region":e.region}}}async function ue(e){let t=await fetch(e.clone());if(t.status!==409||!e.headers.has(`X-Seams-Wallet-Region`))return t;let n;try{n=await t.clone().json()}catch{return t}if(!te(n)||n.code!==`wallet_home_discovery_required`)return t;let r=new Headers(e.headers);return r.delete(`X-Seams-Wallet-Region`),fetch(new Request(e,{headers:r}))}const de=[1,2];function y(e){let t=Number(e);return!Number.isSafeInteger(t)||t<1||t>65535?null:t}function fe(e){if(!Array.isArray(e)||e.length===0)return null;let t=[],n=new Set;for(let r of e){let e=y(r);if(!e)return null;n.has(e)||(n.add(e),t.push(e))}return t.sort((e,t)=>e-t),t.length?t:null}function pe(e){if(!Array.isArray(e)||e.length===0)return null;let t=[];for(let n of e){if(!n||typeof n!=`object`||Array.isArray(n))return null;let e=n,r=y(e.id),i=f(e.role);if(!r||i!==`client`&&i!==`relayer`)return null;let a={id:r,role:i},o=f(e.relayerUrl);o&&(a.relayerUrl=o);let s=f(e.relayerKeyId);s&&(a.relayerKeyId=s);let c=f(e.shareDerivation);(c===`prf_first_v1`||c===`derived_master_secret_v1`||c===`kv_random_v1`||c===`unknown`)&&(a.shareDerivation=c),t.push(a)}return t.length?t:null}function me(e){let t=f(e.relayerKeyId),n=f(e.relayerUrl),r=y(e.clientParticipantId)??1,i=y(e.relayerParticipantId)??2;return[{id:r,role:`client`,shareDerivation:e.clientShareDerivation||`prf_first_v1`},{id:i,role:`relayer`,...n?{relayerUrl:n}:{},...t?{relayerKeyId:t}:{},...e.relayerShareDerivation?{shareDerivation:e.relayerShareDerivation}:{}}]}function b(e,t){let n=f(t);if(!n)throw Error(`${e} is required`);return n}function x(e){return`${b(`projectId`,e.projectId)}:${b(`envId`,e.envId)}`}function he(e){let t=ge(e);return{...t,signingRootVersion:b(`signingRootVersion`,t.signingRootVersion)}}function ge(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`runtimePolicyScope must be an object`);let t=e;if(Object.prototype.hasOwnProperty.call(t,`environmentId`))throw Error(`runtimePolicyScope.environmentId is stale; use envId`);if(Object.prototype.hasOwnProperty.call(t,`runtimeSnapshotScope`))throw Error(`runtimePolicyScope.runtimeSnapshotScope is stale; use runtimePolicyScope`);return{orgId:b(`orgId`,t.orgId),projectId:b(`projectId`,t.projectId),envId:b(`envId`,t.envId),...f(t.signingRootVersion)?{signingRootVersion:f(t.signingRootVersion)}:{}}}function _e(e,t){return e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function ve(e){return{signingRootId:x(e),signingRootVersion:b(`signingRootVersion`,e.signingRootVersion)}}const ye=[`prf`,`kek`,`seed`,`scalar`,`secretkey`,`privatekey`,`plaintext`,`recoverycode`,`clientroot`,`holdershare`];function S(e,t,n,r=[]){let i=new Set(t),a=new Set(r);for(let t of Object.keys(e)){if(i.has(t))continue;if(a.has(t))throw Error(`${n}.${t} is not part of ${n}`);let e=t.toLowerCase().replace(/_/g,``);throw!e.includes(`publickey`)&&ye.some(t=>e.includes(t))?Error(`${n}.${t} must never carry plaintext custody material`):Error(`${n}.${t} is not part of ${n}`)}}function C(e,t,n){let r=p(e,n);S(r,t,n);for(let e of t)if(!Object.prototype.hasOwnProperty.call(r,e)||r[e]===void 0)throw Error(`${n}.${e} is required`);return r}function w(...e){return Object.assign((t,n)=>{if(!e.includes(t))throw Error(`${n} is invalid`);return t},{literals:e})}function T(e,t){let n=Object.keys(e),r=[...n.filter(t=>`literals`in e[t]),...n.filter(t=>!(`literals`in e[t]))];return Object.assign((i,a)=>{let o=C(i,n,a),s=new Map;for(let t of r)s.set(t,e[t](o[t],`${a}.${t}`));let c=Object.fromEntries(n.map(e=>[e,s.get(e)]));return t?.(c,a),c},{shape:e})}function E(e,t){let n=new Map;for(let r of t)for(let t of r.shape[e].literals)n.set(t,r);return(t,r)=>{let i=p(t,r),a=n.get(i[e]);if(!a)throw Error(`${r}.${e} is invalid`);return a(i,r)}}function D(e){return(t,n)=>t===null?null:e(t,n)}function O(e){return(t,n)=>{let r=e(t);if(r.ok)return r.value;throw Error(`${n} ${r.error.message}`)}}function k(e){return(t,n)=>{try{return e(t)}catch(e){throw Error(`${n} ${e instanceof Error?e.message:`is invalid`}`)}}}const A=Object.freeze([`export_keys`,`link_devices`,`revoke_devices`,`sign`]);Object.freeze([`sign`]);const j=new Set([`export_keys`,`link_devices`,`revoke_devices`,`sign`]),M=Symbol(`canonicalPermissionSetBrand`);var N=class e extends Array{[M]=!0;constructor(e){super(...e),Object.freeze(this)}static create(t){return new e(t)}static get[Symbol.species](){return Array}};function P(e){return typeof e==`string`&&j.has(e)}function F(e){if(!Array.isArray(e))return L(e==null?`delegated wallet permissions are required`:`delegated wallet permissions must be an array`);if(e.length===0)return L(`delegated wallet permissions must be non-empty`);let t=[],n=new Set;for(let r of e){if(!P(r))return L(`delegated wallet permission is unsupported`);if(n.has(r))return L(`delegated wallet permission ${r} is duplicated`);n.add(r),t.push(r)}return t.sort(De),{ok:!0,value:N.create(Oe(t))}}function I(e){return{kind:`delegated_wallet_authority_v1`,permissions:e.permissions}}function be(e){if(!ke(e))return R(`delegated wallet authority must contain exactly kind and permissions`);if(e.kind!==`delegated_wallet_authority_v1`)return R(`delegated wallet authority kind is unsupported`);let t=F(e.permissions);return t.ok?{ok:!0,value:I({permissions:t.value})}:t}function xe(){return Ee(A)}function Se(){return I({permissions:xe()})}function Ce(e,t){return e.permissions.includes(t)}function we(e){return Object.freeze([...e.permissions])}function Te(e,t){if(e.kind!==t.kind||e.permissions.length!==t.permissions.length)return!1;for(let n=0;n<e.permissions.length;n+=1)if(e.permissions[n]!==t.permissions[n])return!1;return!0}function Ee(e){let t=F(e);if(!t.ok)throw Error(t.error.message);return t.value}function De(e,t){return e<t?-1:e>t?1:0}function Oe(e){let[t,...n]=e;if(!t)throw Error(`delegated wallet permissions must be non-empty`);return[t,...n]}function ke(e){if(typeof e!=`object`||!e||Array.isArray(e))return!1;let t=Object.keys(e);return t.length===2&&t.includes(`kind`)&&t.includes(`permissions`)}function L(e){return{ok:!1,error:{code:`invalid`,message:e}}}function R(e){return{ok:!1,error:{code:`invalid`,message:e}}}const Ae=/^[A-Za-z0-9_-]+$/;function z(e,t){if(typeof e!=`string`||!Ae.test(e))throw Error(`${t} must be unpadded base64url`);let n;try{n=re(e)}catch{throw Error(`${t} must be valid base64url`)}if(ne(n)!==e)throw Error(`${t} must be canonical base64url`);return n}function je(e,t){if(e.ok)return e.value;throw Error(`${t} ${e.error.message}`)}function Me(e,t){try{return h(e)}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is not a digest`}`)}}function Ne(e,t=`nonceB64u`){if(z(e,t).length!==12)throw Error(`${t} must decode to a 12-byte ChaCha20Poly1305 nonce`);return e}function Pe(e,t=`ciphertextB64u`){if(z(e,t).length<17)throw Error(`${t} must decode to sealed ciphertext with an authentication tag`);return e}function Fe(e,t=`registeredPublicKeyB64u`){if(z(e,t).length!==32)throw Error(`${t} must decode to a 32-byte Ed25519 public key`);return e}function Ie(e,t=`publicKey33B64u`){let n=z(e,t);if(n.length!==33)throw Error(`${t} must decode to a 33-byte compressed secp256k1 point`);if(n[0]!==2&&n[0]!==3)throw Error(`${t} must be a compressed secp256k1 public key`);return e}function Le(e,t=`keyCreationSignerSlot`){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0||e>4294967295)throw Error(`${t} must be a positive u32`);return e}function Re(e,t=`envelopeRevision`){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive integer revision`);return e}function B(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive unix-millisecond timestamp`);return e}const ze=O(l),V=O(n),Be=O(u),Ve=O(a),He=O(oe),Ue=O(c),H=O(ae),U=O(m),W=O(r),G=O(e),We=O(s),Ge=O(t),Ke=O(ie),qe=O(o),K=k(h),Je=D(Y);function q(e){return(t,n)=>e(t,n.slice(n.lastIndexOf(`.`)+1))}function J(e,t){try{return B(e,t)}catch(e){throw Error(e instanceof Error?e.message:`${t} is invalid`)}}function Y(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} must be a non-empty canonical string`);for(let n of e){let e=n.charCodeAt(0);if(/\s/.test(n)||e<=31||e===127)throw Error(`${t} must not contain whitespace or control characters`)}return e}function X(e,t){if(!Number.isSafeInteger(e)||Number(e)<0)throw Error(`${t} must be a non-negative safe integer`);return Number(e)}function Ye(e,t){let n=be(e);if(!n.ok)throw Error(`${t}: ${n.error.message}`);return n.value}function Xe(e,t){let n=d(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function Ze(e,t){if(e.kind!==t.kind||e.walletId!==t.walletId||e.authorityId!==t.authorityId||e.authMethodId!==t.authMethodId||e.authorizationId!==t.authorizationId||e.quotaId!==t.quotaId||e.authorityDigestB64u!==t.authorityDigestB64u||e.authorityRevocationEpoch!==t.authorityRevocationEpoch||e.issuedAtMs!==t.issuedAtMs||e.expiresAtMs!==t.expiresAtMs||e.capabilitySubjects.length!==t.capabilitySubjects.length)return!1;for(let n=0;n<e.capabilitySubjects.length;n+=1){let r=e.capabilitySubjects[n],i=t.capabilitySubjects[n];if(!r||!i||!Z(r,i))return!1}return!0}function Z(e,t){switch(e.kind){case`link_devices`:case`revoke_devices`:return t.kind===e.kind;case`sign`:case`export_keys`:return t.kind===e.kind&&t.keyFamily===e.keyFamily&&ee(e.materialActivation,t.materialActivation);default:return!1}}function Qe(e,t){for(let n of e.capabilitySubjects){let e=!1;for(let r of t.capabilitySubjects)if(Z(n,r)){e=!0;break}if(!e)return!1}return!0}const Q=E(`kind`,[T({kind:w(`direct`)}),T({kind:w(`regional`),region:w(`US`,`WEUR`,`APAC`,`OC`)})]);function $(e){return Q(e,`Wallet Session home`)}function $e(){return T({kind:w(`opaque_wallet_session_operation_credential_v1`),ownershipGeneration:X,home:$,token:(e,t)=>{if(typeof e!=`string`||e.length>8192)throw Error(`${t} is invalid`);return e},walletSessionId:q(H)},(e,t)=>{if(e.ownershipGeneration===0)throw Error(`${t} ownership generation must be positive`);if(!/^wst_[A-Za-z0-9_-]{43}$/.test(e.token))throw Error(`${t} opaque token is invalid`)})}function et(e){return $e()(e,`WalletSessionOperationCredentialV1`)}function tt(e){return e.kind===`sign`||e.kind===`export_keys`?`${e.kind}:${e.keyFamily}:${e.materialActivation.activationId}`:e.kind}function nt(){return T({kind:w(`active_wallet_session_v1`),walletId:q(V),authorityId:q(G),authMethodId:q(W),authorizationId:q(U),quotaId:q(Ke),authorityDigestB64u:q(K),authorityRevocationEpoch:q(X),capabilitySubjects:(e,t)=>{if(!Array.isArray(e)||e.length===0)throw Error(`${t} must be non-empty`);let n=[];for(let[t,r]of e.entries())n.push(it(r,`capabilitySubjects[${t}]`));let r=n[0];if(!r)throw Error(`${t} must be non-empty`);return[r,...n.slice(1)]},issuedAtMs:q(J),expiresAtMs:q(J)},(e,t)=>{let n=e.capabilitySubjects.map(tt);if(new Set(n).size!==n.length)throw Error(`${t} capability subjects repeat`)})}function rt(e){return nt()(e,`ActiveWalletSessionV1`)}function it(e,t){let n=p(e,t);if(n.kind===`link_devices`||n.kind===`revoke_devices`)return S(n,[`kind`],t),{kind:n.kind};if(n.kind!==`sign`&&n.kind!==`export_keys`)throw Error(`${t}.kind is invalid`);if(S(n,[`kind`,`keyFamily`,`materialActivation`],t),n.keyFamily!==`ed25519`&&n.keyFamily!==`ecdsa_secp256k1`)throw Error(`${t}.keyFamily is invalid`);return{kind:n.kind,keyFamily:n.keyFamily,materialActivation:qe(n.materialActivation,`${t}.materialActivation`)}}export{fe as $,Re as A,w as B,Ue as C,Fe as D,Me as E,Se as F,C as G,T as H,we as I,he as J,S as K,Ce as L,Ie as M,B as N,Pe as O,je as P,me as Q,F as R,V as S,H as T,O as U,D as V,E as W,ve as X,_e as Y,de as Z,J as _,Qe as a,ue as at,W as b,K as c,Ve as d,pe as et,Je as f,Xe as g,X as h,et as i,le as it,Le as j,Ne as k,Be as l,Y as m,rt as n,se as nt,He as o,g as ot,Ye as p,x as q,$ as r,v as rt,We as s,ce as st,Ze as t,_ as tt,q as u,Ge as v,U as w,G as x,ze as y,Te as z};