@seams/wallet 0.24.0 → 0.27.0

package/dist/esm/sdk/registrationIntent-DTs2SR9E.js

@@ -1 +0,0 @@
-import{A as e,E as t,M as n,N as r,O as i,S as a,d as o,f as s,g as c,i as l,k as u,l as ee,u as te,x as ne,y as re}from"./domainIds-t1lp25yU.js";import{C as ie,D as ae,E as oe,c as d,d as se,k as f,u as ce}from"./chains-gV2K9gA4.js";import{A as le,C as ue,D as de,E as p,H as m,J as h,K as fe,M as pe,N as g,O as me,P as _,R as he,S as v,T as ge,U as _e,W as y,_ as b,b as x,c as S,d as C,f as ve,g as w,h as T,k as ye,l as E,m as D,n as be,o as xe,p as Se,q as O,s as Ce,u as k,v as we,w as Te,x as A,y as j}from"./activeWalletSession-H9JBdHyQ.js";import{i as M,r as N}from"./base64-BmKR3UqU.js";import{n as Ee}from"./secureRandomId-8LSc91aN.js";import{d as De,f as Oe,h as ke,m as Ae,p as je}from"./capabilityKinds-BzrNeEyO.js";import{a as Me,o as Ne,r as P}from"./canonicalPrimitives-B6YMrI3W.js";import{a as Pe,n as Fe}from"./presignatures-B9GrGx0L.js";import{D as Ie,E as Le,G as Re,K as ze,S as Be,W as Ve,Z as He,j as Ue,k as We,lt as Ge,q as Ke,x as qe}from"./walletCapabilityBindings-CUPk3mVH.js";import{F as Je,I as Ye,L as F,N as I,P as L,R as Xe,dn as Ze,mn as Qe,sn as $e,z as et}from"./emailOtpEcdsaDerivationIdentity-CIh9IPai.js";import{r as tt}from"./walletAuthMethodRecord-yIqCeE-o.js";import{i as nt,n as rt,t as it}from"./registrationAuthMethodInput-BvbWl0y_.js";import{a as at}from"./signerSlot-D4ZOuK7e.js";import{a as ot}from"./registrationSignerPlan-CgbFVsAp.js";function st(e){return typeof e==`string`&&/^wreg_[A-Za-z0-9_-]{43}$/u.test(e)?e:null}function ct(){return`wreg_${Ee(32)}`}const lt=`wallet_registration_setup:`;function ut(e,t){return`${lt}${e}:${t}`}function dt(e){if(!ie(e)||!ie(e.value))throw Error(`Registration setup journal is invalid`);let t=e.value,n=ae(t.scopeDigest,`Registration setup scope digest`),r=ae(t.requestDigest,`Registration setup request digest`),i=st(t.operationId);if(!i||!/^[a-f0-9]{64}$/u.test(n)||!/^[a-f0-9]{64}$/u.test(r)||e.key!==ut(n,r))throw Error(`Registration setup journal scope is invalid`);if(t.state===`pending`&&!(`walletId`in t)&&!(`registrationCeremonyId`in t))return{state:`pending`,operationId:i,scopeDigest:n,requestDigest:r};if(t.state===`accepted`){let e=u(t.walletId);if(e.ok)return{state:`accepted`,operationId:i,scopeDigest:n,requestDigest:r,walletId:e.value,registrationCeremonyId:ae(t.registrationCeremonyId,`Registration setup ceremony`)}}throw Error(`Registration setup journal state is invalid`)}async function ft(e){return se(d({relayerUrl:e.relayerUrl.replace(/\/+$/u,``),publishableKey:e.publishableKey,environmentId:e.environmentId}))}function pt(){}var mt=class{constructor(e){this.manager=e}async begin(e,t){let n=await se(d(t)),r=ut(e,n),i={state:`pending`,operationId:ct(),scopeDigest:e,requestDigest:n},a=(await this.manager.getDB()).transaction(Pe.appState,`readwrite`),o=await a.store.get(r),s=o===void 0?i:dt(o);return o===void 0&&await a.store.put({key:r,value:s}),await a.done,s}async accept(e,t){let n=ut(e.scopeDigest,e.requestDigest),r=(await this.manager.getDB()).transaction(Pe.appState,`readwrite`),i=dt(await r.store.get(n));if(i.operationId!==e.operationId||i.state===`accepted`&&(i.walletId!==t.walletId||i.registrationCeremonyId!==t.registrationCeremonyId))throw r.abort(),await r.done.catch(pt),Error(`Registration setup response changed its operation, wallet or ceremony`);let a={state:`accepted`,operationId:i.operationId,scopeDigest:i.scopeDigest,requestDigest:i.requestDigest,walletId:t.walletId,registrationCeremonyId:t.registrationCeremonyId};await r.store.put({key:n,value:a}),await r.done}async complete(e){let t=(await this.manager.getDB()).transaction(Pe.appState,`readwrite`),n=(await t.store.getAll(IDBKeyRange.bound(lt,`${lt}\uffff`))).map(dt);for(let r of n)r.state===`accepted`&&r.walletId===e.walletId&&r.registrationCeremonyId===e.registrationCeremonyId&&await t.store.delete(ut(r.scopeDigest,r.requestDigest));await t.done}};const ht=new mt(Fe);function gt(e){throw Error(`[LinkSessionStateV1] unsupported state: ${String(e)}`)}const _t=`x25519-hkdf-sha256-chacha20poly1305-v1`,vt=/^[A-Za-z0-9_-]+$/,yt=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`registeredAtMs`],bt=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`ephemeralPublicKeyB64u`,`nonceB64u`,`sealedExportRootB64u`,`bindingDigestB64u`,`ciphertextDigestB64u`,`sealedAtMs`];function xt(e,t=`recipientPublicKeyB64u`){if(typeof e!=`string`||!vt.test(e))throw Error(`${t} must be unpadded base64url`);let n;try{n=N(e)}catch{throw Error(`${t} must be valid base64url`)}if(M(n)!==e)throw Error(`${t} must be canonical base64url`);if(n.length!==32)throw Error(`${t} must decode to a 32-byte X25519 public key`);return e}function St(e){return{linkSessionId:e.linkSessionId,walletId:e.walletId,walletKeyId:e.walletKeyId,targetFactor:e.targetFactor,enrollmentId:e.enrollmentId,deviceId:e.deviceId,revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:e.applicationBindingDigestB64u,registeredPublicKeyB64u:e.registeredPublicKeyB64u,recipientPublicKeyB64u:e.recipientPublicKeyB64u}}function Ct(e){return JSON.stringify({linkSessionId:String(e.linkSessionId),walletId:String(e.walletId),walletKeyId:String(e.walletKeyId),targetFactor:e.targetFactor,enrollmentId:String(e.enrollmentId),deviceId:String(e.deviceId),revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:String(e.applicationBindingDigestB64u),registeredPublicKeyB64u:String(e.registeredPublicKeyB64u),recipientPublicKeyB64u:String(e.recipientPublicKeyB64u)})}function wt(t){let n=Dt(t,yt,`LinkedDeviceEd25519ExportRootRecipientV1`);if(n.kind!==`linked_device_ed25519_export_root_recipient_v1`)throw Error(`LinkedDeviceEd25519ExportRootRecipientV1.kind is invalid`);return Ot(n.transferAlg,`LinkedDeviceEd25519ExportRootRecipientV1.transferAlg`),{kind:`linked_device_ed25519_export_root_recipient_v1`,linkSessionId:_(te(n.linkSessionId),`LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId`),walletId:_(u(n.walletId),`walletId`),walletKeyId:_(e(n.walletKeyId),`walletKeyId`),enrollmentId:_(o(n.enrollmentId),`enrollmentId`),deviceId:_(s(n.deviceId),`deviceId`),transferAlg:_t,applicationBindingDigestB64u:p(n.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:de(n.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:Et(n.targetFactor),revocationEpoch:kt(n.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:xt(n.recipientPublicKeyB64u,`recipientPublicKeyB64u`),registeredAtMs:At(n.registeredAtMs,`registeredAtMs`)}}function Tt(t){let n=Dt(t,bt,`LinkedDeviceEd25519ExportRootPackageV1`);if(n.kind!==`linked_device_ed25519_export_root_package_v1`)throw Error(`LinkedDeviceEd25519ExportRootPackageV1.kind is invalid`);Ot(n.transferAlg,`LinkedDeviceEd25519ExportRootPackageV1.transferAlg`);let r=xt(n.recipientPublicKeyB64u,`recipientPublicKeyB64u`),i=xt(n.ephemeralPublicKeyB64u,`ephemeralPublicKeyB64u`);if(r===i)throw Error(`ephemeralPublicKeyB64u repeats the recipient key`);return{kind:`linked_device_ed25519_export_root_package_v1`,linkSessionId:_(te(n.linkSessionId),`linkSessionId`),walletId:_(u(n.walletId),`walletId`),walletKeyId:_(e(n.walletKeyId),`walletKeyId`),enrollmentId:_(o(n.enrollmentId),`enrollmentId`),deviceId:_(s(n.deviceId),`deviceId`),transferAlg:_t,applicationBindingDigestB64u:p(n.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:de(n.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:Et(n.targetFactor),revocationEpoch:kt(n.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:r,ephemeralPublicKeyB64u:i,nonceB64u:ye(n.nonceB64u,`nonceB64u`),sealedExportRootB64u:me(n.sealedExportRootB64u,`sealedExportRootB64u`),bindingDigestB64u:p(n.bindingDigestB64u,`bindingDigestB64u`),ciphertextDigestB64u:p(n.ciphertextDigestB64u,`ciphertextDigestB64u`),sealedAtMs:At(n.sealedAtMs,`sealedAtMs`)}}function Et(e){switch(Dt(e,[`kind`],`targetFactor`).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`targetFactor.kind is unsupported`)}}function Dt(e,t,n){let r=f(e,n);h(r,t,n);for(let e of t)if(r[e]===void 0)throw Error(`${n}.${e} is required`);return r}function Ot(e,t){if(e!==`x25519-hkdf-sha256-chacha20poly1305-v1`)throw Error(`${t} must be ${_t}`)}function kt(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function At(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive unix-millisecond timestamp`);return e}function R(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);return e}function z(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} must not be empty`);if(n!==e)throw Error(`${t} must not be padded with whitespace`);return n}function jt(e,t){let n=r(z(e,t));if(!n.ok)throw Error(`${t} is invalid: ${n.error.message}`);return n.value}function B(e,t,n){if(e!==t)throw Error(`${n} must be ${String(t)}`);return t}function Mt(e){let t=`WalletAddAuthMethodRegistrationOptions`,n=R(e,t);B(n.kind,`webauthn_add_auth_method_registration_v1`,`${t}.kind`);let r=R(n.user,`${t}.user`),i=R(n.authenticatorSelection,`${t}.authenticatorSelection`),a=R(R(R(n.extensions,`${t}.extensions`).prf,`${t}.extensions.prf`).eval,`${t}.extensions.prf.eval`);if(!Array.isArray(n.pubKeyCredParams)||n.pubKeyCredParams.length!==2)throw Error(`${t}.pubKeyCredParams must list exactly two algorithms`);let[o,s]=n.pubKeyCredParams;if(B(R(o,`${t}.pubKeyCredParams[0]`).type,`public-key`,`${t}.pubKeyCredParams[0].type`),B(R(o,`${t}.pubKeyCredParams[0]`).alg,-7,`${t}.pubKeyCredParams[0].alg`),B(R(s,`${t}.pubKeyCredParams[1]`).type,`public-key`,`${t}.pubKeyCredParams[1].type`),B(R(s,`${t}.pubKeyCredParams[1]`).alg,-257,`${t}.pubKeyCredParams[1].alg`),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);let c=n.excludeCredentials.map((e,n)=>{let r=R(e,`${t}.excludeCredentials[${n}]`);return{type:B(r.type,`public-key`,`${t}.excludeCredentials[${n}].type`),id:z(r.id,`${t}.excludeCredentials[${n}].id`)}}),l=n.timeoutMs;if(typeof l!=`number`||!Number.isSafeInteger(l)||l<=0)throw Error(`${t}.timeoutMs must be a positive safe integer`);return{kind:`webauthn_add_auth_method_registration_v1`,challengeId:z(n.challengeId,`${t}.challengeId`),challengeB64u:z(n.challengeB64u,`${t}.challengeB64u`),rpId:jt(n.rpId,`${t}.rpId`),user:{idB64u:z(r.idB64u,`${t}.user.idB64u`),name:z(r.name,`${t}.user.name`),displayName:z(r.displayName,`${t}.user.displayName`)},pubKeyCredParams:[{type:`public-key`,alg:-7},{type:`public-key`,alg:-257}],authenticatorSelection:{residentKey:B(i.residentKey,`required`,`${t}.authenticatorSelection.residentKey`),userVerification:B(i.userVerification,`preferred`,`${t}.authenticatorSelection.userVerification`)},timeoutMs:l,attestation:B(n.attestation,`none`,`${t}.attestation`),extensions:{prf:{eval:{firstB64u:z(a.firstB64u,`${t}.extensions.prf.eval.firstB64u`),secondB64u:z(a.secondB64u,`${t}.extensions.prf.eval.secondB64u`)}}},excludeCredentials:c}}function Nt(e){let t=Ht(e);if(t.kind!==`committed_authority_packages_v1`)throw Error(`CommittedAuthorityPackagesV1.kind is invalid`);let n=qe(t.authority);if(!n.ok||n.value.state!==`pending_local_install`)throw Error(`CommittedAuthorityPackagesV1.authority is not pending`);let r=tt(t.authMethod);if(!r||r.status!==`pending_local_install`||r.kind===`voiceid`)throw Error(`CommittedAuthorityPackagesV1.authMethod is not pending`);if(r.walletId!==n.value.walletId||r.walletAuthorityId!==n.value.authorityId)throw Error(`CommittedAuthorityPackagesV1 authority and auth method identities differ`);let i=Ft(t.signerPackages);Pt(i,n.value.signerActivations);let a=t.ed25519ExportRootPackage===null?null:Tt(t.ed25519ExportRootPackage);if(a&&(a.walletId!==n.value.walletId||a.revocationEpoch!==n.value.revocationEpoch||n.value.provenance.kind!==`device_link`||a.enrollmentId!==n.value.provenance.enrollmentId||a.linkSessionId!==n.value.provenance.linkSessionId||String(a.deviceId)!==String(n.value.principal.deviceId)))throw Error(`CommittedAuthorityPackagesV1 export root identity does not match authority`);return{kind:`committed_authority_packages_v1`,authority:n.value,authMethod:r,signerPackages:i,ed25519ExportRootPackage:a,packageSetDigestB64u:It(t.packageSetDigestB64u)}}function Pt(e,t){if(e.keyFamilies.length!==t.keyFamilies.length)throw Error(`CommittedAuthorityPackagesV1 signer families do not match authority`);for(let n=0;n<e.keyFamilies.length;n+=1)if(e.keyFamilies[n]!==t.keyFamilies[n])throw Error(`CommittedAuthorityPackagesV1 signer family order does not match authority`);if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`){if(!t.ed25519||!e.ed25519)throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation is missing`);if(!l(e.ed25519.materialActivation,t.ed25519.materialActivation))throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation does not match authority`);return}if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`){if(!t.ecdsa||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 ECDSA activation is missing`);if(!l(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 ECDSA activation does not match authority`);return}if(!t.ed25519||!t.ecdsa||!e.ed25519||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 combined activations are incomplete`);if(!l(e.ed25519.materialActivation,t.ed25519.materialActivation)||!l(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 activation references do not match authority`)}function Ft(e){let t=Ut(e);if(t.kind!==`committed_signer_package_set_v1`)throw Error(`CommittedSignerPackageSetV1.kind is invalid`);let n=Vt(t.keyFamilies);if(n.length===1&&n[0]===`ed25519`){if(!(`ed25519`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:Lt(t.ed25519)}}if(n.length===1&&n[0]===`ecdsa_secp256k1`){if(!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ecdsa:Rt(t.ecdsa)}}if(!(`ed25519`in t)||!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);let r=Lt(t.ed25519),i=Rt(t.ecdsa);if(r.materialActivation.activationId===i.materialActivation.activationId)throw Error(`CommittedSignerPackageSetV1 activation references must be distinct`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:r,ecdsa:i}}function It(e){return P(e)}function Lt(e){let t=Wt(e);if(t.kind!==`committed_ed25519_signer_package_v1`)throw Error(`CommittedEd25519SignerPackageV1.kind is invalid`);let n=Bt(t.materialActivation,`materialActivation`),r=ze(t.targetBinding),i=Re(t.applicationBinding),a=Ve(t.activationReceipt);if(!l(n,Ze(a.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 activation receipt does not match material`);if(!l(n,Ze(r.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 target binding does not match material`);let o=zt(t.deriver_a_client_package,`deriver_a_client_package`,`deriver_a`),s=zt(t.deriver_b_client_package,`deriver_b_client_package`,`deriver_b`);if(!Ge(a.transcript,o.transcript)||!Ge(a.transcript,s.transcript))throw Error(`CommittedEd25519SignerPackageV1 receipt transcript does not match packages`);return{kind:`committed_ed25519_signer_package_v1`,materialActivation:n,targetBinding:r,applicationBinding:i,participantIds:He(t.participantIds),activationReceipt:a,deriver_a_client_package:o,deriver_b_client_package:s}}function Rt(e){let t=Gt(e);if(t.kind!==`committed_ecdsa_signer_package_v1`)throw Error(`CommittedEcdsaSignerPackageV1.kind is invalid`);let n=Bt(t.materialActivation,`materialActivation`),r=Ie(t.activationReceipt),i=r.binding.target.activation;if(!l(n,i))throw Error(`CommittedEcdsaSignerPackageV1 receipt activation does not match material`);let a=Le(t.encryptedTargetClientShare,`encryptedTargetClientShare`);if(a.recipientPublicKeyB64u!==r.binding.target.clientRecipientPublicKeyB64u)throw Error(`CommittedEcdsaSignerPackageV1 client share recipient does not match receipt`);return{kind:`committed_ecdsa_signer_package_v1`,materialActivation:n,encryptedTargetClientShare:a,activationReceipt:r}}function zt(e,t,n){let r=Ke(e);if(!r.ok)throw Error(`${t} ${r.message}`);if(r.value.kind!==`activation_client`||r.value.deriver!==n)throw Error(`${t} must be an activation_client for ${n}`);return{kind:`activation_client`,deriver:n,session:r.value.session,transcript:r.value.transcript,encapsulated_key:r.value.encapsulated_key,ciphertext:r.value.ciphertext}}function Bt(e,t){let n=c(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function Vt(e){if(!Array.isArray(e))throw Error(`CommittedSignerPackageSetV1.keyFamilies must be an array`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`CommittedSignerPackageSetV1.keyFamilies must use canonical family order`)}function Ht(e){let t=Kt(e);if(t===null)throw Error(`CommittedAuthorityPackagesV1 must be an object`);return V(t,[`kind`,`authority`,`authMethod`,`signerPackages`,`ed25519ExportRootPackage`,`packageSetDigestB64u`],`CommittedAuthorityPackagesV1`),{kind:Reflect.get(t,`kind`),authority:Reflect.get(t,`authority`),authMethod:Reflect.get(t,`authMethod`),signerPackages:Reflect.get(t,`signerPackages`),ed25519ExportRootPackage:Reflect.get(t,`ed25519ExportRootPackage`),packageSetDigestB64u:Reflect.get(t,`packageSetDigestB64u`)}}function Ut(e){let t=Kt(e);if(t===null)throw Error(`CommittedSignerPackageSetV1 must be an object`);let n=Object.keys(t),r=n.includes(`ed25519`),i=n.includes(`ecdsa`);return r&&i?(V(t,[`kind`,`keyFamilies`,`ed25519`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`),ecdsa:Reflect.get(t,`ecdsa`)}):r?(V(t,[`kind`,`keyFamilies`,`ed25519`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`)}):i?(V(t,[`kind`,`keyFamilies`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ecdsa:Reflect.get(t,`ecdsa`)}):(V(t,[`kind`,`keyFamilies`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`)})}function Wt(e){let t=Kt(e);if(t===null)throw Error(`CommittedEd25519SignerPackageV1 must be an object`);return V(t,[`kind`,`materialActivation`,`targetBinding`,`applicationBinding`,`participantIds`,`activationReceipt`,`deriver_a_client_package`,`deriver_b_client_package`],`CommittedEd25519SignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),targetBinding:Reflect.get(t,`targetBinding`),applicationBinding:Reflect.get(t,`applicationBinding`),participantIds:Reflect.get(t,`participantIds`),activationReceipt:Reflect.get(t,`activationReceipt`),deriver_a_client_package:Reflect.get(t,`deriver_a_client_package`),deriver_b_client_package:Reflect.get(t,`deriver_b_client_package`)}}function Gt(e){let t=Kt(e);if(t===null)throw Error(`CommittedEcdsaSignerPackageV1 must be an object`);return V(t,[`kind`,`materialActivation`,`encryptedTargetClientShare`,`activationReceipt`],`CommittedEcdsaSignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),encryptedTargetClientShare:Reflect.get(t,`encryptedTargetClientShare`),activationReceipt:Reflect.get(t,`activationReceipt`)}}function Kt(e){return typeof e==`object`&&e&&!Array.isArray(e)?e:null}function V(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length)throw Error(`${n} contains unexpected fields`);for(let e of i)if(!r.has(e))throw Error(`${n} contains unexpected fields`);for(let r of t)if(!Object.prototype.hasOwnProperty.call(e,r))throw Error(`${n}.${r} is required`)}const qt=[`version`,`purpose`,`linkSessionId`,`linkPublicKeyB64u`,`devicePublicKeyB64u`,`requestedPermission`,`targetFactor`,`issuedAtMs`,`expiresAtMs`];function Jt(...e){return(t,n)=>{if(!e.includes(t))throw Error(`${n} is unsupported`);return t}}function Yt(e,t){if(typeof e!=`string`||!/^[0-9a-f]{64}$/.test(e))throw Error(`${t} must be 32 canonical lowercase hex bytes`);return e}function H(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=N(e);if(t.length!==32||M(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be a canonical 32-byte unpadded base64url key`)}return e}function U(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=N(e);if(t.length===0||M(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be canonical unpadded base64url`)}return e}function Xt(e,t,n){let r=U(e,n),i=N(r);try{if(i.length!==t)throw Error(`${n} must encode ${t} bytes`);return r}finally{i.fill(0)}}const W=BigInt(`0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff`),Zt=W-3n,Qt=BigInt(`0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b`);function $t(e){let t=0n;for(let n of e)t=t<<8n|BigInt(n);return t}function en(e){let t=$t(e.subarray(1,33)),n=$t(e.subarray(33,65));return t>=W||n>=W?!1:n*n%W===(t*t*t%W+Zt*t%W+Qt)%W}function tn(e,t){let n=Xt(e,65,t),r=N(n);try{if(r[0]!==4)throw Error(`${t} must be an uncompressed SEC1 P-256 point`);if(!en(r))throw Error(`${t} must be an on-curve P-256 point`);return n}finally{r.fill(0)}}function nn(e){return H(e,`LinkDevicePublicKeyB64u`)}function rn(e,t){return Ce(U(e,t),t)}function an(e,t){if(e!==`ed25519`&&e!==`ecdsa_secp256k1`)throw Error(`${t} must identify a supported key family`);return e}function G(e,t,n){if(t<=e)throw Error(`${n}.expiresAtMs must be after issuedAtMs`)}function on(e){return{kind:e.kind,permissions:[...he(e)]}}function sn(e){let t={version:e.version,purpose:e.purpose,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:on(e.requestedPermission),targetFactor:e.targetFactor,issuedAtMs:e.issuedAtMs,expiresAtMs:e.expiresAtMs};return e.targetFactor.kind===`email_otp`?{...t,targetEmail:e.targetEmail}:t}function K(e,t){switch(O(e,[`kind`],t).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`${t}.kind is unsupported`)}}function cn(){return y({kind:m(`passkey_prf`)})}function ln(){return y({kind:m(`email_otp`)})}function un(){return y({kind:m(`existing_enrollment`)})}function dn(){return y({kind:m(`new_enrollment`)})}function fn(){return fe(`kind`,[un(),dn()])}function pn(e,t){return fn()(e,t)}function mn(){return y({enrollmentSealKeyVersion:D,clientUnlockPublicKeyB64u:D,unlockKeyVersion:D,serverSealedFactorCiphertextB64u:D})}function hn(e,t){let n=f(e,t);if(n.kind===`passkey_prf`)return O(n,[`kind`],t),{kind:`passkey_prf`};if(n.kind===`email_otp`){let e=pn(n.enrollment,`${t}.enrollment`),r=w(n.targetEmail,`${t}.targetEmail`);return e.kind===`existing_enrollment`?{kind:`email_otp`,targetEmail:r,enrollment:e,baseWalletAuthMethodId:x(O(n,[`kind`,`targetEmail`,`enrollment`,`baseWalletAuthMethodId`],t).baseWalletAuthMethodId,`${t}.baseWalletAuthMethodId`)}:(O(n,[`kind`,`targetEmail`,`enrollment`],t),{kind:`email_otp`,targetEmail:r,enrollment:e})}throw Error(`${t}.kind is unsupported`)}function gn(e){if(e.version!==`v5`)throw Error(`QrLinkedDeviceSessionPayloadV5.version is invalid`);if(e.purpose!==`linked_device_lane_creation`)throw Error(`QrLinkedDeviceSessionPayloadV5.purpose is invalid`);let t=b(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=b(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);G(t,n,`QrLinkedDeviceSessionPayloadV5`);let r={version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:j(e.linkSessionId,`QrLinkedDeviceSessionPayloadV5.linkSessionId`),linkPublicKeyB64u:H(e.linkPublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.linkPublicKeyB64u`),devicePublicKeyB64u:H(e.devicePublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.devicePublicKeyB64u`),requestedPermission:Se(e.requestedPermission,`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:K(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`),issuedAtMs:t,expiresAtMs:n};return r.targetFactor.kind===`email_otp`?{...r,targetFactor:{kind:`email_otp`},targetEmail:w(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`)}:{...r,targetFactor:{kind:`passkey_prf`}}}function _n(e){let t=f(e,`QrLinkedDeviceSessionPayloadV5`);return gn(O(t,K(t.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`).kind===`email_otp`?[...qt,`targetEmail`]:qt,`QrLinkedDeviceSessionPayloadV5`))}function vn(e){let t=gn(sn(e)),n={v:5,s:t.linkSessionId,l:t.linkPublicKeyB64u,d:t.devicePublicKeyB64u,a:on(t.requestedPermission),f:t.targetFactor.kind===`passkey_prf`?`p`:`e`,i:t.issuedAtMs,e:t.expiresAtMs};return t.targetFactor.kind===`email_otp`?JSON.stringify({...n,t:t.targetEmail}):JSON.stringify(n)}function yn(){return y({payload:_n,requestedAtMs:b})}function bn(e){return yn()(e,`LinkedDeviceOwnerAuthorizationRequestV1`)}function xn(){let e=e=>y({state:m(e),deviceId:xe});return[y({state:m(`displaying_qr`)}),e(`claimed`),e(`awaiting_target_factor`),e(`awaiting_source_contribution`),e(`provisioning`),y({state:m(`authority_pending_local_install`),deviceId:xe,authorityId:A,packageSetDigestB64u:S}),y({state:m(`active`),deviceId:xe,authorityId:A,activatedAtMs:b}),y({state:m(`failed_before_commit`),error:Cn}),y({state:m(`cancelled`),cancelledAtMs:b}),y({state:m(`expired`),expiredAtMs:b})]}function Sn(e){let t=f(e,`LinkSessionStateV1`).state;if(typeof t!=`string`)throw Error(`LinkSessionStateV1.state is invalid`);let n=xn().find(e=>e.shape.state.literals.includes(t));if(!n)throw Error(`LinkSessionStateV1.state ${t} is unsupported`);return n(e,`LinkSessionStateV1.${t}`)}function Cn(e){let t=O(e,[`kind`,`reason`],`LinkPrecommitFailureV1`);if(t.kind!==`invalid_input`&&t.kind!==`unauthorized_source`&&t.kind!==`revoked_source`&&t.kind!==`permission_attenuation_failed`&&t.kind!==`target_factor_failed`&&t.kind!==`expired_session`&&t.kind!==`cancelled_session`&&t.kind!==`claim_conflict`&&t.kind!==`package_preparation_failed`)throw Error(`LinkPrecommitFailureV1.kind is invalid`);return{kind:t.kind,reason:D(t.reason,`LinkPrecommitFailureV1.reason`)}}function wn(){return y({kind:m(`linked_device_session_projection_v1`),linkSessionId:j,qrPayload:_n,revision:T,createdAtMs:b,updatedAtMs:b,state:Sn})}function Tn(e){return wn()(e,`LinkSessionProjectionV1`)}function En(){return y({kind:m(`linked_device_session_event_v1`),linkSessionId:j,state:Sn,emittedAtMs:b})}function Dn(e){return En()(e,`LinkSessionTransportEventV1`)}function On(){return fe(`outcome`,[y({outcome:m(`pending`),state:An}),y({outcome:m(`replayed`),replay:y({state:()=>`pending`,session:An})})])}function kn(e){return On()(e,`LinkedDeviceApprovalResultV1`)}function An(e){let t=Sn(e);switch(t.state){case`awaiting_target_factor`:case`awaiting_source_contribution`:case`provisioning`:case`authority_pending_local_install`:return t;default:throw Error(`LinkedDeviceApprovalResultV1 state is not pending`)}}function jn(){return y({kind:m(`linked_device_session_claim_v1`),linkSessionId:j,walletId:v,enrollmentId:E,deviceId:C,devicePublicKeyB64u:H,targetFactor:K,sessionRevision:b,claimedAtMs:b,claimExpiresAtMs:b},(e,t)=>G(e.claimedAtMs,e.claimExpiresAtMs,t))}function Mn(e){return jn()(e,`LinkedDeviceSessionClaimV1`)}function Nn(){return y({kind:m(`wallet_session`),walletSessionId:ge,authorizationId:Te})}function Pn(e,t=`ownerAuthorization`){if(f(e,t).kind!==`wallet_session`)throw Error(`${t}.kind is unsupported`);return Nn()(e,t)}function Fn(){return{kind:m(`linked_device_approval_v1`),linkSessionId:j,walletId:v,enrollmentId:E,deviceId:C,linkPublicKeyB64u:H,devicePublicKeyB64u:H,permission:Se,targetFactor:hn,ownerAuthorization:Pn,approvedAtMs:b,expiresAtMs:b}}function In(e,t){G(e.approvedAtMs,e.expiresAtMs,t)}function Ln(){return y(Fn(),In)}function Rn(){return y({...Fn(),sourceContribution:Ue},In)}function zn(e){let t=f(e,`LinkedDeviceApprovalV1`);return(t.sourceContribution===void 0?Ln():Rn())(t,`LinkedDeviceApprovalV1`)}function Bn(){return y({kind:m(`linked_device_approval_delivery_v1`),approval:zn})}function Vn(e){return Bn()(e,`LinkedDeviceApprovalDeliveryV1`)}function Hn(){return{kind:m(`linked_device_target_preparation_v1`),linkSessionId:j,walletId:v,enrollmentId:E,deviceId:C,deliveryRecipientPublicKey65B64u:tn,walletAuthMethodId:x,ed25519ExportRoot:_e(nr()),ordinarySignerMaterialRecipientRequirements:ar,issuedAtMs:b,expiresAtMs:b}}function Un(e,t){if(e.expiresAtMs<=e.issuedAtMs)throw Error(`${t}.expiresAtMs must follow issuedAtMs`)}function Wn(){return y({...Hn(),targetFactor:cn(),passkeyCreationOptions:tr,passkeyConfigurationDigestB64u:S},(e,t)=>{if(Un(e,t),e.passkeyCreationOptions.walletAuthMethodId!==e.walletAuthMethodId)throw Error(`${t}.passkeyCreationOptions.walletAuthMethodId must match the preparation`)})}function Gn(){return y({...Hn(),targetFactor:ln(),targetEmail:w,enrollment:un(),baseWalletAuthMethodId:x},Un)}function Kn(){return y({...Hn(),targetFactor:ln(),targetEmail:w,enrollment:dn()},Un)}function qn(e){let t=`LinkedDeviceTargetPreparationV1`,n=f(e,t);return K(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?Wn()(n,t):(pn(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?Kn():Gn())(n,t)}function Jn(){return y({kind:m(`linked_device_target_preparation_request_v1`),linkSessionId:j,deliveryRecipientPublicKey65B64u:tn})}function Yn(e){return Jn()(e,`LinkedDeviceTargetPreparationRequestV1`)}function Xn(){return y({baseWalletAuthMethodId:x,maskedEmailHint:(e,t)=>{if(typeof e!=`string`||e.length===0)throw Error(`${t} is invalid`);return e}})}function Zn(){let e=Xn(),t=t=>e(t,`LinkedDeviceEmailOtpBaseFactorChoiceV1`);return{selected:y({kind:m(`selected`),choice:t}),selection_required:y({kind:m(`selection_required`),choices:(e,n)=>{if(!Array.isArray(e)||e.length===0)throw Error(`${n} must not be empty`);let r=e.map(t);return[r[0],...r.slice(1)]}}),unavailable:y({kind:m(`unavailable`),reason:Jt(`no_active_email_otp_base_factor`)})}}function Qn(e){let t=`LinkedDeviceEmailOtpBaseFactorResolutionV1`,n=f(e,t),r=Zn();switch(n.kind){case`selected`:case`selection_required`:case`unavailable`:return r[n.kind](n,t);default:throw Error(`${t}.kind is unsupported`)}}function $n(){return y({revision:b,resolution:Qn})}function er(e){return $n()(e,`LinkedDeviceEmailOtpBaseFactorResolutionResultV1`)}function tr(e,t){let n=O(e,[`kind`,`walletAuthMethodId`,`challengeId`,`challengeB64u`,`rpId`,`user`,`pubKeyCredParams`,`authenticatorSelection`,`timeoutMs`,`attestation`,`extensions`,`excludeCredentials`],t),r=x(n.walletAuthMethodId,`${t}.walletAuthMethodId`);if(O(n.user,[`idB64u`,`name`,`displayName`],`${t}.user`),O(n.authenticatorSelection,[`residentKey`,`userVerification`],`${t}.authenticatorSelection`),O(O(O(n.extensions,[`prf`],`${t}.extensions`).prf,[`eval`],`${t}.extensions.prf`).eval,[`firstB64u`,`secondB64u`],`${t}.extensions.prf.eval`),!Array.isArray(n.pubKeyCredParams))throw Error(`${t}.pubKeyCredParams must be an array`);if(n.pubKeyCredParams.forEach((e,n)=>{O(e,[`type`,`alg`],`${t}.pubKeyCredParams[${n}]`)}),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);n.excludeCredentials.forEach((e,n)=>{O(e,[`type`,`id`],`${t}.excludeCredentials[${n}]`)});let i=Mt(n);return{kind:i.kind,walletAuthMethodId:r,challengeId:i.challengeId,challengeB64u:i.challengeB64u,rpId:i.rpId,user:i.user,pubKeyCredParams:i.pubKeyCredParams,authenticatorSelection:i.authenticatorSelection,timeoutMs:i.timeoutMs,attestation:i.attestation,extensions:i.extensions,excludeCredentials:i.excludeCredentials}}function nr(){return y({kind:m(`linked_device_ed25519_export_root_preparation_v1`),walletKeyId:ue,applicationBindingDigestB64u:S,registeredPublicKeyB64u:de,revocationEpoch:T})}function rr(e,t,n){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`${n} must contain one or two entries`);let r=e.map((e,r)=>t(e,`${n}[${r}]`));if(new Set(r.map(e=>e.keyFamily)).size!==r.length)throw Error(`${n} repeats a key family`);if(new Set(r.map(e=>String(e.walletKeyId))).size!==r.length)throw Error(`${n} repeats a wallet key`);if(r.length===2&&(r[0]?.keyFamily!==`ed25519`||r[1]?.keyFamily!==`ecdsa_secp256k1`))throw Error(`${n} must be ordered Ed25519 then ECDSA`);return r}function ir(){return y({kind:m(`ordinary_signer_material_recipient_requirement_v1`),keyFamily:an,walletKeyId:ue})}function ar(e){let t=rr(e,ir(),`LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requirements are empty`);return[n,...t.slice(1)]}const or=m(`ble`,`cable`,`hybrid`,`internal`,`nfc`,`smart-card`,`usb`);function sr(e,t){let n=oe(e,t).map((e,n)=>or(e,`${t}[${n}]`));if(new Set(n).size!==n.length)throw Error(`${t} contains duplicates`);return n}function cr(){return y({kind:m(`linked_device_webauthn_registration_v1`),credentialIdB64u:rn,authenticatorAttachment:_e(m(`platform`,`cross-platform`)),clientDataJsonB64u:U,attestationObjectB64u:U,transports:sr})}function lr(){let e=e=>(t,n)=>{if(t!==e)throw Error(`${n} does not match its kind`);return e};return fe(`kind`,[y({kind:m(`ordinary_ed25519_signer_material_recipient_request_v1`),keyFamily:e(`ed25519`),walletKeyId:ue,recipientPublicKeyB64u:(e,t)=>Xt(e,32,t)}),y({kind:m(`ordinary_ecdsa_signer_material_recipient_request_v1`),keyFamily:e(`ecdsa_secp256k1`),walletKeyId:ue,clientEphemeralPublicKey:Qe})])}function ur(e){let t=rr(e,lr(),`LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requests are empty`);return[n,...t.slice(1)]}function dr(){return{kind:m(`linked_device_target_credential_registration_v1`),linkSessionId:j,walletId:v,enrollmentId:E,deviceId:C,walletAuthMethodId:x}}function fr(){return y({...dr(),targetFactor:cn(),targetPreparationDigestB64u:S,ordinarySignerMaterialRecipientRequests:ur,webauthnRegistration:cr(),registeredAtMs:b})}function pr(){return y({...dr(),targetFactor:ln(),targetEmail:w,targetPreparationDigestB64u:S,ordinarySignerMaterialRecipientRequests:ur,emailOtpVerificationGrant:jr,registeredAtMs:b})}function mr(){return y({...dr(),targetFactor:ln(),targetEmail:w,targetPreparationDigestB64u:S,ordinarySignerMaterialRecipientRequests:ur,emailOtpVerificationGrant:jr,emailOtpEnrollment:mn(),registeredAtMs:b})}function hr(e){let t=`LinkedDeviceTargetCredentialRegistrationV1`,n=f(e,t);return K(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?fr()(n,t):(jr(n.emailOtpVerificationGrant).enrollment.kind===`new_enrollment`?mr():pr())(n,t)}function gr(){return y({kind:m(`linked_device_target_credential_registration_result_v1`),outcome:m(`applied`,`replayed`),linkSessionId:j,walletId:v,enrollmentId:E,deviceId:C,walletAuthMethodId:x,targetPreparationDigestB64u:S,targetFactor:Sr,ordinarySignerMaterialPreparations:We,ordinarySignerMaterialRecipientRequests:ur,keyManifestDigestB64u:S},(e,t)=>{let{authMethod:n}=e.targetFactor;if(n.walletAuthMethodId!==e.walletAuthMethodId||n.walletId!==e.walletId)throw Error(`${t} target identity differs`)})}function _r(e){return gr()(e,`LinkedDeviceTargetCredentialRegistrationResultV1`)}function vr(e,t){if(e.verifiedAtMs<e.authMethod.createdAtMs)throw Error(`${t}.verifiedAtMs precedes authMethod.createdAtMs`)}function yr(){return y({kind:m(`verified_passkey_target_v1`),authMethod:wr,verificationDigestB64u:S,verifiedAtMs:b},vr)}function br(){return y({kind:m(`verified_email_otp_target_v1`),authMethod:Er,targetEmail:w,enrollment:un(),baseWalletAuthMethodId:x,providerUserId:D,verificationDigestB64u:S,verifiedAtMs:b},vr)}function xr(){return y({kind:m(`verified_email_otp_target_v1`),authMethod:Er,targetEmail:w,enrollment:dn(),providerUserId:D,verificationDigestB64u:S,verifiedAtMs:b},vr)}function Sr(e,t){let n=f(e,t);if(n.kind===`verified_passkey_target_v1`)return yr()(n,t);if(n.kind!==`verified_email_otp_target_v1`)throw Error(`${t}.kind is invalid`);return(pn(n.enrollment,`${t}.enrollment`).kind===`existing_enrollment`?br():xr())(n,t)}function Cr(){return y({walletAuthMethodId:x,walletId:v,createdAtMs:b,kind:m(`passkey`),rpId:we,credentialIdB64u:Ce,credentialPublicKeyB64u:U,counter:T})}function wr(e,t){return Cr()(e,t)}function Tr(){return y({walletAuthMethodId:x,walletId:v,createdAtMs:b,kind:m(`email_otp`),emailHashHex:Yt,registrationAuthorityId:D})}function Er(e,t){return Tr()(e,t)}function Dr(e){return{kind:m(`linked_device_email_otp_verification_grant_v1`),grantId:D,grantToken:D,challengeId:D,linkSessionId:j,walletId:v,enrollmentId:E,deviceId:C,targetPreparationDigestB64u:S,targetEmail:w,enrollment:e,emailHashHex:Yt,registrationAuthorityId:D,providerUserId:D,authorityDigestB64u:S,issuedAtMs:b,expiresAtMs:b}}function Or(e,t){G(e.issuedAtMs,e.expiresAtMs,t)}function kr(){return y({...Dr(un()),baseWalletAuthMethodId:x},Or)}function Ar(){return y(Dr(dn()),Or)}function jr(e){let t=`LinkedDeviceEmailOtpVerificationGrantV1`,n=f(e,t);return(pn(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?Ar():kr())(n,t)}function Mr(){return y({kind:m(`email_otp_factor_release_v1`),challengeId:D,enrollmentId:D,enrollmentSealKeyVersion:D,serverEphemeralPublicKey65B64u:tn,nonce12B64u:(e,t)=>Xt(e,12,t),ciphertextB64u:U})}function Nr(e){return Mr()(e,`LinkedDeviceEmailOtpFactorReleaseEnvelopeV1`)}function Pr(){return y({kind:m(`linked_device_email_otp_challenge_start_request_v1`),linkSessionId:j,workerEphemeralPublicKey65B64u:tn})}function Fr(e){return Pr()(e,`LinkedDeviceEmailOtpChallengeStartRequestV1`)}function Ir(){return y({kind:m(`linked_device_email_otp_challenge_resend_request_v1`),linkSessionId:j,challengeId:D})}function Lr(e){return Ir()(e,`LinkedDeviceEmailOtpChallengeResendRequestV1`)}function Rr(){return y({kind:m(`linked_device_email_otp_challenge_verify_request_v1`),linkSessionId:j,challengeId:D,otpCode:(e,t)=>{if(typeof e!=`string`||!/^[0-9]{6,10}$/.test(e))throw Error(`${t} is invalid`);return e}})}function zr(e){return Rr()(e,`LinkedDeviceEmailOtpChallengeVerifyRequestV1`)}function Br(){return y({kind:m(`linked_device_email_otp_challenge_result_v1`),challengeId:D,maskedEmailHint:D,expiresAtMs:b,resendAvailableAtMs:b})}function Vr(e){return Br()(e,`LinkedDeviceEmailOtpChallengeResultV1`)}function Hr(e){let t=O(e,[`kind`,`verificationGrant`,`factorRelease`],`LinkedDeviceEmailOtpVerificationResultV1`);if(t.kind!==`linked_device_email_otp_verification_result_v1`)throw Error(`LinkedDeviceEmailOtpVerificationResultV1.kind is invalid`);let n=jr(t.verificationGrant);if(Ur(n)){if(t.factorRelease!==null)throw Error(`new linked-device Email OTP enrollment cannot carry a factor release`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:null}}let r=Nr(t.factorRelease);if(r.challengeId!==n.challengeId)throw Error(`LinkedDeviceEmailOtpVerificationResultV1 challenge binding changed`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:r}}function Ur(e){return e.enrollment.kind===`new_enrollment`}function Wr(e){let t=b(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=b(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);G(t,n,`QrLinkedDeviceSessionPayloadV5`);let r=K(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`);if(r.kind===`passkey_prf`)return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:Se(on(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,issuedAtMs:t,expiresAtMs:n};if(e.targetEmail===void 0)throw Error(`QrLinkedDeviceSessionPayloadV5.targetEmail is required for Email OTP`);return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:Se(on(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,targetEmail:w(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`),issuedAtMs:t,expiresAtMs:n}}function Gr(e){return{kind:`linked_device_session_claim_request_v1`,payload:e}}function Kr(e,t,n){let r=b(e,`${n}.approvedAtMs`),i=b(t,`${n}.expiresAtMs`);return G(r,i,n),{approvedAtMs:r,expiresAtMs:i}}function qr(e){let t=Kr(e.approvedAtMs,e.expiresAtMs,`LinkedDeviceApprovalV1`);return zn({kind:`linked_device_approval_v1`,...e,...t})}function Jr(e){return hr({kind:`linked_device_target_credential_registration_v1`,...e})}function Yr(e){return{kind:`linked_device_session_cancel_unclaimed_request_v1`,linkSessionId:e.linkSessionId,reason:`user_cancelled`,requestedAtMs:b(e.requestedAtMs,`LinkedDeviceSessionCancelUnclaimedRequestV1.requestedAtMs`)}}function Xr(e){return{kind:`linked_device_session_cancel_claimed_request_v1`,...e,requestedAtMs:b(e.requestedAtMs,`LinkedDeviceSessionCancelClaimedRequestV1.requestedAtMs`)}}const Zr=[`chrome`,`safari`,`firefox`,`edge`,`other`],Qr=[`macos`,`ios`,`windows`,`android`,`linux`,`other`];function $r(e){return typeof e==`string`&&Zr.some(t=>t===e)}function ei(e){return typeof e==`string`&&Qr.some(t=>t===e)}function ti(e){if(!e||typeof e!=`object`||Array.isArray(e))return null;let t=e,n=typeof t.label==`string`?t.label.trim():``;if(!n||!$r(t.browser)||!ei(t.os)||typeof t.synced!=`boolean`||!Array.isArray(t.transports))return null;let r=t.transports.map(e=>typeof e==`string`?e.trim():``).filter(e=>e.length>0),i=typeof t.provider==`string`?t.provider.trim():``,a=typeof t.providerLabel==`string`?t.providerLabel.trim():``;return{label:n,browser:t.browser,os:t.os,synced:t.synced,transports:r,...i?{provider:i}:{},...a?{providerLabel:a}:{}}}function ni(e){return(t,n)=>{if(!Array.isArray(t))throw Error(`${n} is invalid`);return t.map((t,r)=>e(t,`${n}[${r}]`))}}function ri(e,t){let n=x(e,t);if(n.startsWith(`wallet-authority:`)||n.startsWith(`authority:`))throw Error(`${t} must identify a WalletAuthMethodId`);return n}function ii(e,t){let n=T(e,t);if(n<1)throw Error(`${t} must be a positive safe integer`);return n}function ai(e,t){let n=ti(e);if(!n)throw Error(`${t} is invalid`);return n}function oi(){return fe(`kind`,[y({kind:m(`passkey`),walletAuthMethodId:x,credentialIdB64u:Ce,device:ai}),y({kind:m(`email_otp`),walletAuthMethodId:x}),y({kind:m(`voiceid`),walletAuthMethodId:x,deviceKeyId:S})])}function si(e,t){return oi()(e,t)}function ci(){return y({deviceId:C,enrollmentId:E,walletId:v,credential:si,permission:Se,keyManifestDigestB64u:S,coveredWalletKeys:ni(ue),state:m(`provisioning`,`active`,`suspended`,`expired`,`revoked`),createdAtMs:b,lastActivityAtMs:b,revocationEpoch:T})}function li(e){return ci()(e,`LinkedDeviceSummaryV1`)}function ui(){return y({kind:m(`linked_device_list_request_v1`),walletId:v,limit:ii,cursor:ve})}function di(e){return ui()(e,`LinkedDeviceListRequestV1`)}function fi(){return y({walletId:v,walletAuthorityId:A,credential:si,createdAtMs:b,lastActivityAtMs:b})}function pi(){let e=fi();return y({devices:ni(li),ownerDevices:ni(t=>e(t,`OwnerDeviceSummaryV1`)),nextCursor:ve})}function mi(e){return pi()(e,`LinkedDeviceListResultV1`)}function hi(){return y({kind:m(`linked_device_revoke_request_v1`),walletId:v,walletAuthMethodId:ri,requestedAtMs:b})}function gi(e){return hi()(e,`LinkedDeviceRevokeRequestV1`)}function _i(){return y({kind:m(`not_found`,`conflict`,`unauthorized`)})}function vi(){return y({kind:m(`revoked`),walletAuthMethodId:ri,authorityId:A,revocationEpoch:T})}function yi(e){let t=f(e,`LinkedDeviceRevokeResultV1`);return(t.kind===`not_found`||t.kind===`conflict`||t.kind===`unauthorized`?_i():vi())(t,`LinkedDeviceRevokeResultV1`)}function bi(e){return d({domain:`seams/linked-device/wallet-session-credential-delivery-aad/v1`,aad:e})}function xi(e){let t=Oi(e,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`],`LinkedDeviceWalletSessionCredentialDeliveryBindingV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_binding_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryBindingV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_binding_v1`,namespace:q(t.namespace,`namespace`),orgId:q(t.orgId,`orgId`),projectId:q(t.projectId,`projectId`),envId:q(t.envId,`envId`),tenantId:J(je(t.tenantId)),principalId:J(Oe(t.principalId))}}async function Si(e){return Ne(bi(e))}async function Ci(e){return Ne(d({domain:`seams/linked-device/wallet-session-credential-delivery-envelope/v1`,envelope:e}))}async function wi(e){if(await Si(e.aad)!==e.aadDigestB64u)throw Error(`linked-device Wallet Session credential delivery AAD digest is invalid`);if(await Ci(e.envelope)!==e.envelopeDigestB64u)throw Error(`linked-device Wallet Session credential delivery envelope digest is invalid`);if(await Ne(d({domain:`seams/linked-device/delivery-recipient/v1`,recipientPublicKey65B64u:e.aad.recipientPublicKey65B64u}))!==e.recipientBindingDigestB64u)throw Error(`linked-device Wallet Session credential delivery recipient binding is invalid`)}function Ti(e){let t=Oi(e,[`kind`,`aad`,`aadDigestB64u`,`recipientBindingDigestB64u`,`envelope`,`envelopeDigestB64u`,`installationReceiptDigestB64u`],`LinkedDeviceWalletSessionCredentialDeliveryV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_v1`,aad:Ei(t.aad),aadDigestB64u:P(t.aadDigestB64u),recipientBindingDigestB64u:P(t.recipientBindingDigestB64u),envelope:Di(t.envelope),envelopeDigestB64u:P(t.envelopeDigestB64u),installationReceiptDigestB64u:P(t.installationReceiptDigestB64u)}}function Ei(e){let n=Oi(e,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`,`linkSessionId`,`walletId`,`authorityId`,`walletAuthMethodId`,`authorizationId`,`walletSessionId`,`quotaId`,`credentialDigestB64u`,`recipientPublicKey65B64u`,`issuedAtMs`,`expiresAtMs`],`LinkedDeviceWalletSessionCredentialDeliveryAadV1`);if(n.kind!==`linked_device_wallet_session_credential_delivery_aad_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryAadV1.kind is invalid`);let r=ki(n.issuedAtMs,`issuedAtMs`),a=ki(n.expiresAtMs,`expiresAtMs`);if(a<=r)throw Error(`expiresAtMs must be after issuedAtMs`);return{kind:`linked_device_wallet_session_credential_delivery_aad_v1`,namespace:q(n.namespace,`namespace`),orgId:q(n.orgId,`orgId`),projectId:q(n.projectId,`projectId`),envId:q(n.envId,`envId`),tenantId:J(je(n.tenantId)),principalId:J(Oe(n.principalId)),linkSessionId:J(te(n.linkSessionId)),walletId:J(u(n.walletId)),authorityId:J(i(n.authorityId)),walletAuthMethodId:J(t(n.walletAuthMethodId)),authorizationId:J(Ae(n.authorizationId)),walletSessionId:J(ke(n.walletSessionId)),quotaId:J(De(n.quotaId)),credentialDigestB64u:P(n.credentialDigestB64u),recipientPublicKey65B64u:ji(n.recipientPublicKey65B64u,65),issuedAtMs:r,expiresAtMs:a}}function Di(e){let t=Oi(e,[`kind`,`algorithm`,`serverEphemeralPublicKey65B64u`,`nonce12B64u`,`ciphertextB64u`],`LinkedDeviceWalletSessionCredentialEnvelopeV1`);if(t.kind!==`linked_device_wallet_session_credential_envelope_v1`||t.algorithm!==`p256-ecdh-aes256gcm-v1`)throw Error(`LinkedDeviceWalletSessionCredentialEnvelopeV1 identity is invalid`);return{kind:`linked_device_wallet_session_credential_envelope_v1`,algorithm:`p256-ecdh-aes256gcm-v1`,serverEphemeralPublicKey65B64u:ji(t.serverEphemeralPublicKey65B64u,65),nonce12B64u:ji(t.nonce12B64u,12),ciphertextB64u:Ai(t.ciphertextB64u)}}function Oi(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be an object`);let r=e,i=new Set(t);for(let e of Object.keys(r))if(!i.has(e))throw Error(`${n}.${e} is not supported`);for(let e of t)if(!(e in r))throw Error(`${n}.${e} is required`);return r}function q(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} is required`);return e}function ki(e,t){if(!Number.isSafeInteger(e)||Number(e)<=0)throw Error(`${t} is invalid`);return Number(e)}function Ai(e){let t=q(e,`base64url`);if(M(N(t))!==t)throw Error(`base64url is not canonical`);return t}function ji(e,t){let n=Ai(e),r=N(n);if(r.length!==t)throw Error(`base64url must contain ${t} bytes`);if(t===65&&r[0]!==4)throw Error(`P-256 public key is invalid`);return n}function J(e){if(!e.ok)throw Error(e.error.message);return e.value}function Mi(e,t){let n=Be(e);if(!n.ok)throw Error(`${t} ${n.error}`);return n.value}function Ni(){return y({kind:m(`local_authority_installation_receipt_v1`),authorityId:k(A),walletId:k(v),authMethodId:k(x),deviceId:k(xe),packageSetDigestB64u:k(S),installedActivationRefs:Mi,installedRecordSetDigestB64u:k(S),targetFactorVerificationDigestB64u:k(S),installedAtMs:k(b)})}function Pi(e){return Ni()(e,`LocalAuthorityInstallationReceiptV1`)}function Fi(){return y({kind:m(`local_authority_activation_final_ack_v1`),linkSessionId:k(j),authorityId:k(A),packageSetDigestB64u:k(S),authorizationId:k(Te),walletSessionId:k(ge),credentialDigestB64u:k(S),installationReceiptDigestB64u:k(S),acknowledgedAtMs:k(b)})}function Ii(e){return Fi()(e,`LocalAuthorityActivationFinalAckV1`)}function Li(e){let t=f(e,`ActivateInstalledAuthorityResultV1`);switch(t.kind){case`active`:{h(t,[`kind`,`authority`,`authMethod`,`walletSession`,`deliveryBinding`,`sealedDelivery`],`ActivateInstalledAuthorityResultV1`);let e=qe(t.authority);if(!e.ok||e.value.state!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authority must be active`);let n=tt(t.authMethod);if(!n||n.status!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authMethod must be active`);let r=be(t.walletSession),i=xi(t.deliveryBinding),a=Ti(t.sealedDelivery);if(e.value.walletId!==n.walletId||e.value.authorityId!==n.walletAuthorityId||r.walletId!==e.value.walletId||r.authorityId!==e.value.authorityId||r.authMethodId!==n.walletAuthMethodId||r.authorityDigestB64u!==e.value.authorityDigestB64u||r.authorityRevocationEpoch!==e.value.revocationEpoch||i.namespace!==a.aad.namespace||i.orgId!==a.aad.orgId||i.projectId!==a.aad.projectId||i.envId!==a.aad.envId||i.tenantId!==a.aad.tenantId||i.principalId!==a.aad.principalId||a.aad.walletId!==r.walletId||a.aad.authorityId!==r.authorityId||a.aad.walletAuthMethodId!==r.authMethodId||a.aad.authorizationId!==r.authorizationId||a.aad.quotaId!==r.quotaId||a.aad.issuedAtMs!==r.issuedAtMs||a.aad.expiresAtMs!==r.expiresAtMs)throw Error(`ActivateInstalledAuthorityResultV1 identities do not match`);return{kind:`active`,authority:e.value,authMethod:n,walletSession:r,deliveryBinding:i,sealedDelivery:a}}case`pending_local_install`:return h(t,[`kind`,`authorityId`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`pending_local_install`,authorityId:A(t.authorityId,`authorityId`),reason:Ri()(t.reason,`ActivationRetryReasonV1`)};case`integrity_error`:return h(t,[`kind`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`integrity_error`,reason:zi(t.reason)};default:throw Error(`ActivateInstalledAuthorityResultV1.kind is invalid`)}}function Ri(){return fe(`kind`,[y({kind:m(`installation_receipt_not_found`)}),y({kind:m(`server_worker_activation_pending`)}),y({kind:m(`wallet_session_issuance_pending`)})])}function zi(e){let t=f(e,`LinkIntegrityFailureV1`);switch(t.kind){case`authority_id_mismatch`:return h(t,[`kind`,`expectedAuthorityId`,`actualAuthorityId`],`LinkIntegrityFailureV1`),{kind:`authority_id_mismatch`,expectedAuthorityId:A(t.expectedAuthorityId,`expectedAuthorityId`),actualAuthorityId:A(t.actualAuthorityId,`actualAuthorityId`)};case`package_set_digest_mismatch`:return h(t,[`kind`,`expectedPackageSetDigestB64u`,`actualPackageSetDigestB64u`],`LinkIntegrityFailureV1`),{kind:`package_set_digest_mismatch`,expectedPackageSetDigestB64u:S(t.expectedPackageSetDigestB64u,`expectedPackageSetDigestB64u`),actualPackageSetDigestB64u:S(t.actualPackageSetDigestB64u,`actualPackageSetDigestB64u`)};case`installation_receipt_mismatch`:if(h(t,[`kind`,`field`],`LinkIntegrityFailureV1`),t.field!==`walletId`&&t.field!==`authMethodId`&&t.field!==`deviceId`&&t.field!==`targetFactorVerificationDigestB64u`&&t.field!==`installedActivationRefs`)throw Error(`LinkIntegrityFailureV1.field is invalid`);return{kind:`installation_receipt_mismatch`,field:t.field};default:throw Error(`LinkIntegrityFailureV1.kind is invalid`)}}new TextEncoder;async function Bi(e){return Ne(e.token)}function Vi(e){return d({domain:`seams/linked-device/local-authority-installation-receipt/v1`,receipt:e})}async function Hi(e){return Ne(Vi(e))}function Ui(e,t){if(e===void 0)throw Error(`${t} is required`);return e}function Wi(e){return F(e.kind,`targetFactor.kind`)}function Gi(e){let t=e.pubKeyCredParams.map(e=>I([F(e.type,`passkeyCreationOptions.pubKeyCredParams.type`),F(String(e.alg),`passkeyCreationOptions.pubKeyCredParams.alg`)])),n=e.excludeCredentials.map(e=>I([F(e.type,`passkeyCreationOptions.excludeCredentials.type`),F(e.id,`passkeyCreationOptions.excludeCredentials.id`)]));return I([F(e.kind,`passkeyCreationOptions.kind`),F(e.walletAuthMethodId,`passkeyCreationOptions.walletAuthMethodId`),F(e.challengeId,`passkeyCreationOptions.challengeId`),F(e.challengeB64u,`passkeyCreationOptions.challengeB64u`),F(e.rpId,`passkeyCreationOptions.rpId`),F(e.user.idB64u,`passkeyCreationOptions.user.idB64u`),F(e.user.name,`passkeyCreationOptions.user.name`),F(e.user.displayName,`passkeyCreationOptions.user.displayName`),Xe(t.length,`passkeyCreationOptions.pubKeyCredParams`),...t.map(e=>L(e,`passkeyCreationOptions.pubKeyCredParams.item`)),F(e.authenticatorSelection.residentKey,`passkeyCreationOptions.authenticatorSelection.residentKey`),F(e.authenticatorSelection.userVerification,`passkeyCreationOptions.authenticatorSelection.userVerification`),et(e.timeoutMs,`passkeyCreationOptions.timeoutMs`),F(e.attestation,`passkeyCreationOptions.attestation`),F(e.extensions.prf.eval.firstB64u,`passkeyCreationOptions.extensions.prf.eval.firstB64u`),F(e.extensions.prf.eval.secondB64u,`passkeyCreationOptions.extensions.prf.eval.secondB64u`),Xe(n.length,`passkeyCreationOptions.excludeCredentials`),...n.map(e=>L(e,`passkeyCreationOptions.excludeCredentials.item`))])}function Ki(e){return I([F(e.kind,`recipientRequirement.kind`),F(e.keyFamily,`recipientRequirement.keyFamily`),F(e.walletKeyId,`recipientRequirement.walletKeyId`)])}function qi(e){return e===null?F(`none`,`ed25519ExportRoot.kind`):I([F(e.kind,`ed25519ExportRoot.kind`),F(e.walletKeyId,`ed25519ExportRoot.walletKeyId`),Je(e.applicationBindingDigestB64u,`ed25519ExportRoot.applicationBindingDigestB64u`),Ye(e.registeredPublicKeyB64u,`ed25519ExportRoot.registeredPublicKeyB64u`),et(e.revocationEpoch,`ed25519ExportRoot.revocationEpoch`)])}function Ji(e){let t=e.ordinarySignerMaterialRecipientRequirements.map(Ki),n=Xi(e)?e:void 0,r=n?.passkeyCreationOptions;if(e.targetFactor.kind===`passkey_prf`&&!r)throw Error(`passkey target preparation is missing creation options`);return I([F(`seams/linked-device/target-preparation/v1`,`domain`),F(e.kind,`kind`),F(e.linkSessionId,`linkSessionId`),F(e.walletId,`walletId`),F(e.enrollmentId,`enrollmentId`),F(e.deviceId,`deviceId`),L(Ye(e.deliveryRecipientPublicKey65B64u,`deliveryRecipientPublicKey65B64u`),`deliveryRecipientPublicKey65B64u`),F(e.walletAuthMethodId,`walletAuthMethodId`),L(qi(e.ed25519ExportRoot),`ed25519ExportRoot`),L(Wi(e.targetFactor),`targetFactor`),...r?[L(Gi(r),`passkeyCreationOptions`),Je(n.passkeyConfigurationDigestB64u,`passkeyConfigurationDigestB64u`)]:[],...Yi(e),Xe(t.length,`ordinarySignerMaterialRecipientRequirements`),...t.map(e=>L(e,`ordinarySignerMaterialRecipientRequirements.item`)),et(e.issuedAtMs,`issuedAtMs`),et(e.expiresAtMs,`expiresAtMs`)])}function Yi(e){return Xi(e)?[]:[F(e.targetEmail,`targetEmail`),F(e.enrollment.kind,`enrollment.kind`),...e.enrollment.kind===`existing_enrollment`?[F(Ui(e.baseWalletAuthMethodId,`baseWalletAuthMethodId`),`baseWalletAuthMethodId`)]:[]]}function Xi(e){return e.targetFactor.kind===`passkey_prf`}async function Zi(e){return Me(Ji(e))}const Qi=`x-seams-linked-device-proof-v1`,$i=6e4,ea=6e4;async function ta(e){return Me(na(e,32,`devicePublicKeyB64u`))}function na(e,t,n){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} is invalid`);let r;try{r=N(e)}catch{throw Error(`${n} is invalid`)}if(r.length!==t||M(r)!==e)throw Error(`${n} is invalid`);return r}const ra=`wallet_seed_parallel_hkdf_sha256_v1`;function ia(e){return e.kind===`wallet_custody_seed_v1`}function aa(){return{kind:`wallet_custody_seed_v1`,derivationScheme:ra}}function oa(e){return{kind:`ed25519_yao_client_root_v1`,linkSessionId:e.linkSessionId,walletKeyId:e.walletKeyId,targetFactor:e.targetFactor,applicationBindingDigestB64u:e.applicationBindingDigestB64u,registeredPublicKeyB64u:e.registeredPublicKeyB64u,enrollmentId:e.enrollmentId,deviceId:e.deviceId,revocationEpoch:e.revocationEpoch}}function sa(e){return{kind:`ed25519_lane_holder_share_v1`,walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,registeredPublicKeyB64u:e.registeredPublicKeyB64u,participantBindingDigestB64u:e.participantBindingDigestB64u}}function ca(e){return{kind:`ecdsa_lane_holder_share_v1`,walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,thresholdSessionId:e.thresholdSessionId,thresholdPublicKey33B64u:e.thresholdPublicKey33B64u}}const la=[`kind`,`walletKeyId`,`laneId`,`laneShareEpoch`],ua={wallet_custody_seed_v1:[`kind`,`derivationScheme`],ed25519_yao_client_root_v1:[`kind`,`linkSessionId`,`walletKeyId`,`targetFactor`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`enrollmentId`,`deviceId`,`revocationEpoch`],ed25519_lane_holder_share_v1:[...la,`nearEd25519SigningKeyId`,`registeredPublicKeyB64u`,`participantBindingDigestB64u`],ecdsa_lane_holder_share_v1:[...la,`evmFamilySigningKeySlotId`,`thresholdSessionId`,`thresholdPublicKey33B64u`]},da=Array.from(new Set(Object.values(ua).flat()));function fa(e,t){if(e===`wallet_custody_seed_v1`||e===`ed25519_yao_client_root_v1`||e===`ed25519_lane_holder_share_v1`||e===`ecdsa_lane_holder_share_v1`)return e;throw Error(`${t}.kind must be a known passkey custody secret kind`)}function pa(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function ma(e,t){let n=f(e,t);if(h(n,[`kind`],t),n.kind===`passkey_prf`||n.kind===`email_otp`)return{kind:n.kind};throw Error(`${t}.kind must be passkey_prf or email_otp`)}function ha(t,n){let r=e(t.walletKeyId);if(!r.ok)throw Error(`${n}.walletKeyId ${r.error.message}`);let i=ne(t.laneId);if(!i.ok)throw Error(`${n}.laneId ${i.error.message}`);let a=ee(t.laneShareEpoch);if(!a.ok)throw Error(`${n}.laneShareEpoch ${a.error.message}`);return{walletKeyId:r.value,laneId:i.value,laneShareEpoch:a.value}}function ga(e,t){let n=a(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function _a(t,n=`passkeyCustodySecretBinding`){let r=f(t,n),i=fa(r.kind,n);switch(h(r,ua[i],n,da),i){case`wallet_custody_seed_v1`:if(r.derivationScheme!==ra)throw Error(`${n}.derivationScheme must be ${ra}`);return aa();case`ed25519_yao_client_root_v1`:{let t=te(r.linkSessionId);if(!t.ok)throw Error(`${n}.linkSessionId ${t.error.message}`);let i=e(r.walletKeyId);if(!i.ok)throw Error(`${n}.walletKeyId ${i.error.message}`);let a=o(r.enrollmentId);if(!a.ok)throw Error(`${n}.enrollmentId ${a.error.message}`);let c=s(r.deviceId);if(!c.ok)throw Error(`${n}.deviceId ${c.error.message}`);return oa({linkSessionId:t.value,walletKeyId:i.value,targetFactor:ma(r.targetFactor,`${n}.targetFactor`),applicationBindingDigestB64u:p(r.applicationBindingDigestB64u,`${n}.applicationBindingDigestB64u`),registeredPublicKeyB64u:de(r.registeredPublicKeyB64u,`${n}.registeredPublicKeyB64u`),enrollmentId:a.value,deviceId:c.value,revocationEpoch:pa(r.revocationEpoch,`${n}.revocationEpoch`)})}case`ed25519_lane_holder_share_v1`:{let e=ha(r,n);return sa({walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,nearEd25519SigningKeyId:at(r.nearEd25519SigningKeyId),registeredPublicKeyB64u:de(r.registeredPublicKeyB64u,`${n}.registeredPublicKeyB64u`),participantBindingDigestB64u:p(r.participantBindingDigestB64u,`${n}.participantBindingDigestB64u`)})}case`ecdsa_lane_holder_share_v1`:{let e=ha(r,n);return ca({walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,evmFamilySigningKeySlotId:$e(r.evmFamilySigningKeySlotId,`${n}.evmFamilySigningKeySlotId`),thresholdSessionId:ga(r.thresholdSessionId,`${n}.thresholdSessionId`),thresholdPublicKey33B64u:pe(r.thresholdPublicKey33B64u,`${n}.thresholdPublicKey33B64u`)})}}}const va=`wallet_custody_envelope_v2`,ya=`passkey_prf_kek_hkdf_sha256_v1`,ba=`email_otp_factor_kek_hkdf_sha256_v1`,xa=`voiceid_device_factor_kek_hkdf_sha256_v1`;function Sa(e){return e.ownership.kind===`method_bound`&&e.binding.kind===`wallet_custody_seed_v1`&&e.lifecycle.state===`active`}function Ca(e){return Sa(e)&&e.factor.kind===`voiceid`}const wa=[`kind`,`walletAuthMethodId`];function Ta(e,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be an object`);let r=e;switch(h(r,wa,n),r.kind){case`unbound`:if(r.walletAuthMethodId!==void 0)throw Error(`${n}.walletAuthMethodId belongs to the method_bound branch`);return{kind:`unbound`};case`method_bound`:{let e=t(r.walletAuthMethodId);if(!e.ok)throw Error(`${n}.walletAuthMethodId ${e.error.message}`);return{kind:`method_bound`,walletAuthMethodId:e.value}}default:throw Error(`${n}.kind must be unbound or method_bound`)}}function Ea(e){return JSON.stringify({walletId:e.walletId,envelopeId:e.envelopeId,factor:e.factor,envelopeRevision:e.envelopeRevision,binding:e.binding,ownership:Oa(e.ownership)})}function Da(e,n){if(e===`unbound`)return{kind:`unbound`};if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be "unbound" or a methodBound object`);let r=e;h(r,[`methodBound`],n);let i=r.methodBound;if(typeof i!=`object`||!i||Array.isArray(i))throw Error(`${n}.methodBound must be an object`);let a=i;h(a,[`walletAuthMethodId`],`${n}.methodBound`);let o=t(a.walletAuthMethodId);if(!o.ok)throw Error(`${n}.methodBound.walletAuthMethodId ${o.error.message}`);return{kind:`method_bound`,walletAuthMethodId:o.value}}function Oa(e){switch(e.kind){case`unbound`:return`unbound`;case`method_bound`:return{methodBound:{walletAuthMethodId:String(e.walletAuthMethodId)}};default:throw Error(`Unhandled custody envelope ownership: ${String(e)}`)}}function ka(e){return{kind:`method_bound`,walletAuthMethodId:e}}function Aa(e){return{kind:`passkey`,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,kekVersion:ya}}function ja(e){return{kind:`email_otp`,enrollmentId:e.enrollmentId,enrollmentSealKeyVersion:e.enrollmentSealKeyVersion,kekVersion:ba}}function Ma(e){return{kind:`voiceid`,deviceKeyId:e.deviceKeyId,kekVersion:xa}}function Na(e){return{state:`active`,activatedAtMs:e.activatedAtMs}}function Pa(e){return{state:`retired`,activatedAtMs:e.activatedAtMs,retiredAtMs:e.retiredAtMs}}function Fa(e){return{state:`revoked`,activatedAtMs:e.activatedAtMs,revokedAtMs:e.revokedAtMs}}function Ia(e){return{kind:`wallet_custody_envelope_v2`,envelopeId:e.envelopeId,walletId:e.walletId,ownership:e.ownership,binding:e.binding,factor:e.factor,envelopeVersion:va,envelopeRevision:e.envelopeRevision,nonceB64u:e.nonceB64u,sealedCustodySecretB64u:e.sealedCustodySecretB64u,ciphertextDigestB64u:e.ciphertextDigestB64u,aadHashB64u:e.aadHashB64u,lifecycle:e.lifecycle,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs}}const La=[`state`,`activatedAtMs`,`retiredAtMs`,`revokedAtMs`];function Ra(e,t=`lifecycle`){let n=f(e,t);h(n,La,t);let r=g(n.activatedAtMs,`${t}.activatedAtMs`);switch(n.state){case`active`:if(n.retiredAtMs!==void 0||n.revokedAtMs!==void 0)throw Error(`${t} cannot be active and carry a retired or revoked timestamp`);return Na({activatedAtMs:r});case`retired`:{if(n.revokedAtMs!==void 0)throw Error(`${t} cannot be retired and carry a revoked timestamp`);let e=g(n.retiredAtMs,`${t}.retiredAtMs`);if(e<r)throw Error(`${t}.retiredAtMs cannot precede activation`);return Pa({activatedAtMs:r,retiredAtMs:e})}case`revoked`:{if(n.retiredAtMs!==void 0)throw Error(`${t} cannot be revoked and carry a retired timestamp`);let e=g(n.revokedAtMs,`${t}.revokedAtMs`);if(e<r)throw Error(`${t}.revokedAtMs cannot precede activation`);return Fa({activatedAtMs:r,revokedAtMs:e})}default:throw Error(`${t}.state must be active, retired, or revoked`)}}const za=[`kind`,`rpId`,`credentialIdB64u`,`kekVersion`],Ba=[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`,`kekVersion`],Va=[`kind`,`deviceKeyId`,`kekVersion`],Ha=Array.from(new Set([...za,...Ba,...Va]));function Ua(e,t){if(typeof e!=`string`||!e.trim())throw Error(`${t} is required`);return e}function Wa(e,t=`factor`){let i=f(e,t);switch(i.kind){case`passkey`:{if(h(i,za,t,Ha),i.kekVersion!==ya)throw Error(`${t}.kekVersion must be ${ya}`);let e=r(i.rpId);if(!e.ok)throw Error(`${t}.rpId ${e.error.message}`);let a=n(i.credentialIdB64u);if(!a.ok)throw Error(`${t}.credentialIdB64u ${a.error.message}`);return Aa({rpId:e.value,credentialIdB64u:a.value})}case`email_otp`:if(h(i,Ba,t,Ha),i.kekVersion!==ba)throw Error(`${t}.kekVersion must be ${ba}`);return ja({enrollmentId:Ua(i.enrollmentId,`${t}.enrollmentId`),enrollmentSealKeyVersion:Ua(i.enrollmentSealKeyVersion,`${t}.enrollmentSealKeyVersion`)});case`voiceid`:if(h(i,Va,t,Ha),i.kekVersion!==xa)throw Error(`${t}.kekVersion must be ${xa}`);return Ma({deviceKeyId:p(i.deviceKeyId,`${t}.deviceKeyId`)});default:throw Error(`${t}.kind must be passkey, email_otp, or voiceid`)}}const Ga=[`kind`,`envelopeId`,`walletId`,`ownership`,`binding`,`factor`,`envelopeVersion`,`envelopeRevision`,`nonceB64u`,`sealedCustodySecretB64u`,`ciphertextDigestB64u`,`aadHashB64u`,`lifecycle`,`createdAtMs`,`updatedAtMs`];function Ka(e,t=`walletCustodyEnvelope`){let n=f(e,t);if(n.kind!==`wallet_custody_envelope_v2`)throw Error(`${t}.kind must be ${va}`);if(h(n,Ga,t),n.envelopeVersion!==`wallet_custody_envelope_v2`)throw Error(`${t}.envelopeVersion must be ${va}`);let r=re(n.envelopeId);if(!r.ok)throw Error(`${t}.envelopeId ${r.error.message}`);let i=u(n.walletId);if(!i.ok)throw Error(`${t}.walletId ${i.error.message}`);let a=Ta(n.ownership,`${t}.ownership`),o=g(n.createdAtMs,`${t}.createdAtMs`),s=g(n.updatedAtMs,`${t}.updatedAtMs`);if(s<o)throw Error(`${t}.updatedAtMs cannot precede createdAtMs`);return Ia({envelopeId:r.value,walletId:i.value,ownership:a,binding:_a(n.binding,`${t}.binding`),factor:Wa(n.factor,`${t}.factor`),envelopeRevision:le(n.envelopeRevision,`${t}.envelopeRevision`),nonceB64u:ye(n.nonceB64u,`${t}.nonceB64u`),sealedCustodySecretB64u:me(n.sealedCustodySecretB64u,`${t}.sealedCustodySecretB64u`),ciphertextDigestB64u:p(n.ciphertextDigestB64u,`${t}.ciphertextDigestB64u`),aadHashB64u:p(n.aadHashB64u,`${t}.aadHashB64u`),lifecycle:Ra(n.lifecycle,`${t}.lifecycle`),createdAtMs:o,updatedAtMs:s})}function qa(e,t){return e.kind===t.kind?e.kind===`unbound`?!0:t.kind===`method_bound`&&String(e.walletAuthMethodId)===String(t.walletAuthMethodId):!1}function Ja(e){if(!e.establishedCustody)throw Error(`only a custody-establishing commit issues recovery codes`);return{...e,recoveryBackupAcknowledged:!0}}function Ya(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} walletCustody must be an object`);let n=e;switch(n.status){case`not_requested`:case`custody_already_established`:return{status:n.status};case`committed`:return{status:`committed`,issuedAtMs:g(n.issuedAtMs,`${t}.issuedAtMs`)};case`joined`:{let e=n.keyManifestDigestB64u;if(typeof e!=`string`||!e)throw Error(`${t} joined custody carries no key manifest digest`);return{status:`joined`,keyManifestDigestB64u:e}}case`rejected`:{let e=n.reason;if(typeof e!=`string`||!e)throw Error(`${t} rejected custody carries no reason`);return{status:`rejected`,reason:e}}default:throw Error(`${t} walletCustody status is unrecognised`)}}var Xa=(e=>(e.Unknown=`Unknown`,e.Pending=`Pending`,e.Failure=`Failure`,e))(Xa||{}),Za=(e=>(e.NotStarted=`NotStarted`,e.Started=`Started`,e.Failure=`Failure`,e))(Za||{});function Y(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`Invalid ${t}: expected an object`);return e}function X(e,t){if(typeof e!=`string`)throw Error(`Invalid ${t}: expected a string`);return e}function Qa(e,t){if(!Array.isArray(e))throw Error(`Invalid ${t}: expected a string array`);let n=[];for(let r of e){if(typeof r!=`string`)throw Error(`Invalid ${t}: expected a string array`);n.push(r)}return n}function $a(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`Invalid ${t}: expected a non-negative safe integer`);return e}function eo(e,t){if(typeof e==`number`&&!Number.isSafeInteger(e))throw Error(`Invalid ${t}: expected a safe integer or decimal string`);if(typeof e!=`string`&&typeof e!=`number`||!/^\d+$/.test(String(e)))throw Error(`Invalid ${t}: expected an unsigned decimal integer`);return BigInt(e)}function to(e,t){return{block_height:$a(e.block_height,`${t}.block_height`),block_hash:X(e.block_hash,`${t}.block_hash`)}}function no(e){let t=Y(Y(e,`NEAR access key permission`).FunctionCall,`NEAR access key permission.FunctionCall`);return{FunctionCall:{allowance:X(t.allowance,`NEAR access key allowance`),receiver_id:X(t.receiver_id,`NEAR access key receiver_id`),method_names:Qa(t.method_names,`NEAR access key method_names`)}}}function ro(e){return e===`FullAccess`?e:no(e)}function io(e,t){return{...t,nonce:eo(e.nonce,`NEAR access key nonce`),permission:ro(e.permission)}}function ao(e){let t=Y(e,`NEAR access key response`);return io(t,to(t,`NEAR access key response`))}function oo(e){let t=Y(e,`NEAR access key list response`),n=to(t,`NEAR access key list response`);if(!Array.isArray(t.keys))throw Error(`Invalid NEAR access key list response.keys: expected an array`);let r=[];for(let e of t.keys){let t=Y(e,`NEAR access key list entry`),i=Y(t.access_key,`NEAR access key list entry.access_key`);r.push({public_key:X(t.public_key,`NEAR access key list entry.public_key`),access_key:io(i,n)})}return{...n,keys:r}}function so(e){let t=Y(e,`NEAR account response`);return{...to(t,`NEAR account response`),amount:eo(t.amount,`NEAR account response.amount`),locked:eo(t.locked,`NEAR account response.locked`),code_hash:X(t.code_hash,`NEAR account response.code_hash`),storage_usage:$a(t.storage_usage,`NEAR account response.storage_usage`),storage_paid_at:$a(t.storage_paid_at,`NEAR account response.storage_paid_at`)}}function co(e){let t=X(Y(e,`NEAR view code response`).code_base64,`NEAR view code response.code_base64`);if(!t)throw Error(`Invalid NEAR view code response.code_base64: empty string`);return t}function lo(e){let t=Y(Y(e,`NEAR block response`).header,`NEAR block response.header`);return{header:{hash:X(t.hash,`NEAR block response.header.hash`),height:$a(t.height,`NEAR block response.header.height`)}}}function uo(e){let t=Y(e,`NEAR contract call response`);if(!Array.isArray(t.result))throw Error(`Invalid NEAR contract call response.result: expected bytes`);let n=[];for(let e of t.result){if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`Invalid NEAR contract call response.result: expected bytes`);n.push(e)}return{...to(t,`NEAR contract call response`),logs:Qa(t.logs,`NEAR contract call response.logs`),result:n}}function fo(e){let t=new TextDecoder(`utf-8`,{fatal:!0}).decode(Uint8Array.from(e));if(!t.trim())return null;try{return JSON.parse(t)}catch{return t}}function po(e,t){let n=Y(e,t),r=typeof n.error_type==`string`?n.error_type:`InvalidTxError`in n?`InvalidTxError`:`ActionError`in n?`ActionError`:`TxExecutionError`;return{error_message:typeof n.error_message==`string`?n.error_message:`NEAR execution failed`,error_type:r,...`InvalidTxError`in n?{InvalidTxError:n.InvalidTxError}:{},...`ActionError`in n?{ActionError:n.ActionError}:{}}}function mo(e,t){let n=0;for(let r of t)Object.prototype.hasOwnProperty.call(e,r)&&n++;if(n!==1)throw Error(`Invalid NEAR status: expected exactly one variant`)}function ho(e){if(e===`Unknown`)return Xa.Unknown;if(e===`Pending`)return Xa.Pending;if(e===`Failure`)return Xa.Failure;let t=Y(e,`NEAR execution status`);if(mo(t,[`SuccessValue`,`SuccessReceiptId`,`Failure`]),typeof t.SuccessValue==`string`)return{SuccessValue:t.SuccessValue};if(typeof t.SuccessReceiptId==`string`)return{SuccessReceiptId:t.SuccessReceiptId};if(`Failure`in t)return{Failure:po(t.Failure,`NEAR execution failure`)};throw Error(`Invalid NEAR execution status`)}function go(e){if(e===`NotStarted`)return Za.NotStarted;if(e===`Started`)return Za.Started;if(e===`Failure`)return Za.Failure;let t=Y(e,`NEAR final execution status`);if(mo(t,[`SuccessValue`,`Failure`]),typeof t.SuccessValue==`string`)return{SuccessValue:t.SuccessValue};if(`Failure`in t)return{Failure:po(t.Failure,`NEAR final execution failure`)};throw Error(`Invalid NEAR final execution status`)}function _o(e){let t=Y(e,`NEAR execution outcome`);return{logs:Qa(t.logs,`NEAR execution outcome.logs`),receipt_ids:Qa(t.receipt_ids,`NEAR execution outcome.receipt_ids`),gas_burnt:$a(t.gas_burnt,`NEAR execution outcome.gas_burnt`),tokens_burnt:X(t.tokens_burnt,`NEAR execution outcome.tokens_burnt`),executor_id:X(t.executor_id,`NEAR execution outcome.executor_id`),status:ho(t.status)}}function vo(e){let t=Y(e,`NEAR execution outcome with id`);return{id:X(t.id,`NEAR execution outcome id`),outcome:_o(t.outcome)}}function yo(e){switch(e){case`NONE`:case`INCLUDED`:case`INCLUDED_FINAL`:case`EXECUTED`:case`FINAL`:case`EXECUTED_OPTIMISTIC`:return e;default:throw Error(`Invalid NEAR final_execution_status`)}}function bo(e){let t=Y(e,`NEAR final execution outcome`);if(!Array.isArray(t.receipts_outcome))throw Error(`Invalid NEAR final execution outcome.receipts_outcome: expected an array`);return{final_execution_status:yo(t.final_execution_status),status:go(t.status),transaction:{hash:X(Y(t.transaction,`NEAR final execution outcome.transaction`).hash,`NEAR final execution outcome.transaction.hash`)},transaction_outcome:vo(t.transaction_outcome),receipts_outcome:t.receipts_outcome.map(vo)}}function xo(e){return String(e||``).trim()}function So(e){return String(e||``).trim()}async function Co(e){return M(await ce(d(e)))}async function wo(e){return M(await ce(d(e)))}function To(e){let n=it(e);if(!n||!(`caller`in n))return null;let r=nt(n.caller);if(r===`linked_device_ceremony`)return Object.prototype.hasOwnProperty.call(n,`source`)?null:{caller:`linked_device_ceremony`};if(r!==`same_device_addition`)return null;let a=it(`source`in n?n.source:void 0);if(!a)return null;let o=i(`walletAuthorityId`in a?a.walletAuthorityId:void 0),s=t(`walletAuthMethodId`in a?a.walletAuthMethodId:void 0),c=nt(`authorityDigestB64u`in a?a.authorityDigestB64u:void 0),l=`revocationEpoch`in a?a.revocationEpoch:void 0;return!o.ok||!s.ok||!c||typeof l!=`number`||!Number.isSafeInteger(l)||l<0?null:{caller:`same_device_addition`,source:{walletAuthorityId:o.value,walletAuthMethodId:s.value,authorityDigestB64u:c,revocationEpoch:l}}}function Eo(e,t){return e.walletAuthorityId===t.walletAuthorityId&&e.walletAuthMethodId===t.walletAuthMethodId&&e.authorityDigestB64u===t.authorityDigestB64u&&e.revocationEpoch===t.revocationEpoch}function Z(e,t,n,r=[]){let i=it(e);if(!i)throw Error(t+` must be an object`);let a=new Set([...n,...r]),o=Object.keys(i);if(o.length<n.length||o.length>a.size)throw Error(t+` has invalid fields`);for(let e of n)if(!Object.prototype.hasOwnProperty.call(i,e))throw Error(t+`.`+e+` is required`);for(let e of o)if(!a.has(e))throw Error(t+` has invalid fields`);return i}function Q(e,t,n){if(!Object.prototype.hasOwnProperty.call(e,t))throw Error(n+`.`+t+` is required`);return Reflect.get(e,t)}function Do(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function $(e,t,n){let r=Q(e,t,n);if(typeof r!=`string`||r.length===0||r.trim()!==r)throw Error(n+`.`+t+` must be a non-empty canonical string`);return r}function Oo(e,t,n,r){let i=Q(e,t,n);if(typeof i!=`number`||!Number.isSafeInteger(i)||i<r)throw Error(n+`.`+t+` must be a safe integer`);return i}function ko(e,t){if(!Array.isArray(e))throw Error(t+` must be an array`);return e}function Ao(e,t,n){let r=ko(Q(e,t,n),n+`.`+t);if(r.length===0)throw Error(n+`.`+t+` must not be empty`);let i=[];for(let e=0;e<r.length;e+=1){let a=r[e];if(typeof a!=`number`||!Number.isSafeInteger(a)||a<1)throw Error(n+`.`+t+`[`+e+`] must be a positive safe integer`);i.push(a)}return i}function jo(e,t,n){return Do(e,t)?$(e,t,n):void 0}function Mo(e,t=`addSignerIntent.signerSelection.ecdsa.chainTarget`){try{let n=Z(e,t,[`kind`],[`namespace`,`chainId`,`networkSlug`]);switch($(n,`kind`,t)){case`evm`:{let e=Z(n,t,[`kind`,`namespace`,`chainId`],[`networkSlug`]);if($(e,`namespace`,t)!==`eip155`)return null;let r=Oo(e,`chainId`,t,1),i=jo(e,`networkSlug`,t);return i===void 0?{kind:`evm`,namespace:`eip155`,chainId:r}:{kind:`evm`,namespace:`eip155`,chainId:r,networkSlug:i}}case`tempo`:{let e=Z(n,t,[`kind`,`chainId`],[`networkSlug`]),r=Oo(e,`chainId`,t,1),i=jo(e,`networkSlug`,t);return i===void 0?{kind:`tempo`,chainId:r}:{kind:`tempo`,chainId:r,networkSlug:i}}default:return null}}catch{return null}}function No(e){let t=`addSignerIntent.signerSelection`,n=Z(e,t,[`mode`],[`ed25519`,`ecdsa`]);switch($(n,`mode`,t)){case`ed25519`:{let e=Z(Q(Z(n,t,[`mode`,`ed25519`]),`ed25519`,t),t+`.ed25519`,[`mode`,`signerSlot`,`participantIds`,`keyPurpose`,`keyVersion`,`derivationVersion`]);if($(e,`mode`,t+`.ed25519`)!==`create_implicit_near_account`)throw Error(t+`.ed25519.mode is unsupported`);Oo(e,`signerSlot`,t+`.ed25519`,1),Ao(e,`participantIds`,t+`.ed25519`),$(e,`keyPurpose`,t+`.ed25519`),$(e,`keyVersion`,t+`.ed25519`),Oo(e,`derivationVersion`,t+`.ed25519`,1);break}case`ecdsa`:{let e=Z(Q(Z(n,t,[`mode`,`ecdsa`]),`ecdsa`,t),t+`.ecdsa`,[`chainTargets`,`participantIds`]),r=ko(Q(e,`chainTargets`,t+`.ecdsa`),t+`.ecdsa.chainTargets`);if(r.length===0)throw Error(t+`.ecdsa.chainTargets must not be empty`);for(let e of r)if(!Mo(e))throw Error(t+`.ecdsa.chainTargets contains an invalid target`);Ao(e,`participantIds`,t+`.ecdsa`);break}default:throw Error(t+`.mode is unsupported`)}let r=ot(e,{normalizeEcdsaChainTarget:Mo});if(!r.ok)throw Error(r.message);return r.value}function Po(e){let t=`addAuthMethodIntent.authMethod`,n=Z(e,t,[`kind`],[`rpId`,`email`]);switch($(n,`kind`,t)){case`passkey`:{let e=r($(Z(n,t,[`kind`,`rpId`]),`rpId`,t));if(!e.ok)throw Error(e.error.message);break}case`email_otp`:$(Z(n,t,[`kind`,`email`]),`email`,t);break;default:throw Error(t+`.kind is unsupported`)}let i=rt(e);if(!i)throw Error(t+` is invalid`);return i}function Fo(e){let n=`addAuthMethodIntent.source`,r=Z(e,n,[`walletAuthorityId`,`walletAuthMethodId`,`authorityDigestB64u`,`revocationEpoch`]),a=i($(r,`walletAuthorityId`,n)),o=t($(r,`walletAuthMethodId`,n));if(!a.ok||!o.ok)throw Error(n+` has invalid identity`);$(r,`authorityDigestB64u`,n),Oo(r,`revocationEpoch`,n,0)}function Io(e,t){if(!Do(e,`runtimePolicyScope`))return;let n=t+`.runtimePolicyScope`,r=Z(Q(e,`runtimePolicyScope`,t),n,[`orgId`,`projectId`,`envId`],[`signingRootVersion`]),i=$(r,`orgId`,n),a=$(r,`projectId`,n),o=$(r,`envId`,n),s=jo(r,`signingRootVersion`,n);return s===void 0?{orgId:i,projectId:a,envId:o}:{orgId:i,projectId:a,envId:o,signingRootVersion:s}}function Lo(e,t){let n=u($(e,`walletId`,t));if(!n.ok)throw Error(n.error.message);return n.value}function Ro(e,n,r){let i=t($(e,n,r));if(!i.ok)throw Error(i.error.message);return i.value}function zo(e){let t=`addSignerIntent`,n=Z(e,t,[`version`,`walletId`,`signerSelection`,`nonceB64u`],[`runtimePolicyScope`]);if($(n,`version`,t)!==`add_signer_intent_v1`)throw Error(t+`.version is unsupported`);let r=Lo(n,t),i=Io(n,t),a=$(n,`nonceB64u`,t),o=No(Q(n,`signerSelection`,t));return i===void 0?{version:`add_signer_intent_v1`,walletId:r,signerSelection:o,nonceB64u:a}:{version:`add_signer_intent_v1`,walletId:r,signerSelection:o,runtimePolicyScope:i,nonceB64u:a}}function Bo(e){let t=`addAuthMethodIntent`,n=Z(e,t,[`version`,`walletId`,`authMethod`,`targetWalletAuthMethodId`,`caller`,`nonceB64u`],[`runtimePolicyScope`,`source`]);if($(n,`version`,t)!==`add_auth_method_intent_v1`)throw Error(t+`.version is unsupported`);let r=Lo(n,t),i=Ro(n,`targetWalletAuthMethodId`,t),a=Po(Q(n,`authMethod`,t)),o=Io(n,t),s=$(n,`nonceB64u`,t);switch($(n,`caller`,t)){case`same_device_addition`:Fo(Q(n,`source`,t));break;case`linked_device_ceremony`:if(Do(n,`source`))throw Error(t+`.source is not valid for linked_device_ceremony`);break;default:throw Error(t+`.caller is unsupported`)}let c=To(n);if(!c)throw Error(t+`.caller is invalid`);let l=o===void 0?{version:`add_auth_method_intent_v1`,walletId:r,authMethod:a,targetWalletAuthMethodId:i,nonceB64u:s}:{version:`add_auth_method_intent_v1`,walletId:r,authMethod:a,targetWalletAuthMethodId:i,runtimePolicyScope:o,nonceB64u:s};switch(c.caller){case`same_device_addition`:return{...l,caller:c.caller,source:c.source};case`linked_device_ceremony`:return{...l,caller:c.caller};default:return Vo(c)}}function Vo(e){throw Error(`Unsupported add-auth-method intent caller: ${String(e)}`)}function Ho(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(!Number.isSafeInteger(e[n])||e[n]!==t[n])return!1;return!0}function Uo(e,t){switch(e.kind){case`evm`:return t.kind===`evm`&&e.namespace===t.namespace&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;case`tempo`:return t.kind===`tempo`&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;default:return Wo(e)}}function Wo(e){throw Error(`Unsupported add-signer chain target: ${String(e)}`)}function Go(e,t){if(e.mode!==t.mode)return!1;switch(e.mode){case`ed25519`:return t.mode===`ed25519`&&e.ed25519.mode===t.ed25519.mode&&e.ed25519.signerSlot===t.ed25519.signerSlot&&Ho(e.ed25519.participantIds,t.ed25519.participantIds)&&e.ed25519.keyPurpose===t.ed25519.keyPurpose&&e.ed25519.keyVersion===t.ed25519.keyVersion&&e.ed25519.derivationVersion===t.ed25519.derivationVersion;case`ecdsa`:if(t.mode!==`ecdsa`||e.ecdsa.chainTargets.length!==t.ecdsa.chainTargets.length)return!1;for(let n=0;n<e.ecdsa.chainTargets.length;n+=1)if(!Uo(e.ecdsa.chainTargets[n],t.ecdsa.chainTargets[n]))return!1;return Ho(e.ecdsa.participantIds,t.ecdsa.participantIds);default:return Ko(e)}}function Ko(e){throw Error(`Unsupported add-signer selection: ${String(e)}`)}function qo(e,t){return e===void 0||t===void 0?e===t:e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function Jo(e,t){return e.version===t.version&&e.walletId===t.walletId&&Go(e.signerSelection,t.signerSelection)&&qo(e.runtimePolicyScope,t.runtimePolicyScope)&&e.nonceB64u===t.nonceB64u}function Yo(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId;case`email_otp`:return t.kind===`email_otp`&&e.email===t.email;default:return Xo(e)}}function Xo(e){throw Error(`Unsupported add-auth-method input: ${String(e)}`)}function Zo(e,t){if(e.version!==t.version||e.walletId!==t.walletId||!Yo(e.authMethod,t.authMethod)||e.targetWalletAuthMethodId!==t.targetWalletAuthMethodId||!qo(e.runtimePolicyScope,t.runtimePolicyScope)||e.nonceB64u!==t.nonceB64u)return!1;switch(e.caller){case`same_device_addition`:return t.caller===`same_device_addition`&&Eo(e.source,t.source);case`linked_device_ceremony`:return t.caller===`linked_device_ceremony`;default:return Qo(e)}}function Qo(e){throw Error(`Unsupported add-auth-method intent: ${String(e)}`)}export{qr as $,Da as A,Tt as At,Hi as B,Ia as C,qn as Ct,Oa as D,Mt as Dt,Ea as E,Nt as Et,ea as F,mt as Ft,wi as G,Li as H,Qi as I,ht as It,di as J,xi as K,$i as L,ft as Lt,oa as M,wt as Mt,aa as N,Ct as Nt,Ca as O,_t as Ot,ia as P,gt as Pt,ti as Q,ta as R,ka as S,Yn as St,Ma as T,vn as Tt,Ii as U,Bi as V,Pi as W,gi as X,mi as Y,yi as Z,Ya as _,Hr as _t,Bo as a,nn as at,Na as b,Mn as bt,Jo as c,Vn as ct,so as d,Lr as dt,Xr as et,lo as f,Vr as ft,fo as g,jr as gt,bo as h,Nr as ht,Co as i,Wr as it,qa as j,xt as jt,Ka as k,St as kt,oo as l,kn as lt,uo as m,zr as mt,So as n,Gr as nt,zo as o,Tn as ot,co as p,Fr as pt,Ti as q,wo as r,Jr as rt,Zo as s,Dn as st,xo as t,Yr as tt,ao as u,er as ut,Ja as v,bn as vt,Aa as w,_n as wt,ja as x,_r as xt,va as y,Pn as yt,Zi as z};

package/dist/esm/sdk/registrationSignerPlan-CgbFVsAp.js

@@ -1 +0,0 @@
-import{c as e}from"./chains-gV2K9gA4.js";import{c as t}from"./accountIds-D5NI31F2.js";import{i as n,t as r}from"./registrationAuthMethodInput-BvbWl0y_.js";function i(){return{kind:`implicit_account`,accountIdSource:`ed25519_public_key`}}function a(e){return{kind:`sponsored_named_account`,requestedAccountId:e,sponsor:`relayer`}}function o(e,t){let n=typeof e==`number`?e:Number(e);return Number.isFinite(n)&&n>=1?Math.floor(n):t}function s(e){if(!Array.isArray(e))return[];let t=[];for(let n of e){let e=Number(n);Number.isInteger(e)&&e>0&&t.push(e)}return t}function c(e){return Array.isArray(e)?e:[]}function l(e){let i=r(e);if(!i||!(`kind`in i))return null;switch(n(i.kind)){case`implicit_account`:return Object.prototype.hasOwnProperty.call(i,`requestedAccountId`)||Object.prototype.hasOwnProperty.call(i,`sponsor`)?null:{kind:`implicit_account`,accountIdSource:`ed25519_public_key`};case`sponsored_named_account`:{if(Object.prototype.hasOwnProperty.call(i,`accountIdSource`)||!(`requestedAccountId`in i))return null;let e=t(i.requestedAccountId);return e.ok?{kind:`sponsored_named_account`,requestedAccountId:e.value,sponsor:`relayer`}:null}default:return null}}function u(e){if(!e||!(`participantIds`in e)||!(`chainTargets`in e))return null;let t=s(e.participantIds),n=c(e.chainTargets);return t.length===0||n.length===0?null:{participantIds:t,chainTargets:n}}const d=`router-ab-ed25519-yao-v1`;function f(e){let t=n(e);if(!t)throw Error(`registration signer branch key is required`);return t}function p(e){return f(`near_ed25519:slot:${e}`)}function m(t){return f(`evm_family_ecdsa:${t.map(e).join(`|`)}`)}function h(e){return g(e.map(_))}function g(e){if(e.length===0)return{ok:!1,code:`invalid_body`,message:`signer set must include at least one signer`};let t=new Set,n=new Set,r=new Set;for(let i of e){let e=v({branch:i,nearSlots:t,ecdsaTargetKeys:n,branchKeys:r});if(e)return e}return{ok:!0,value:{kind:`signer_set`,branches:e}}}function _(e){switch(e.kind){case`near_ed25519`:return{kind:`near_ed25519`,branchKey:p(e.signerSlot),accountProvisioning:e.accountProvisioning,signerSlot:e.signerSlot,participantIds:e.participantIds,keyPurpose:`near_tx`,keyVersion:d,derivationVersion:e.derivationVersion};case`evm_family_ecdsa`:return{kind:`evm_family_ecdsa`,branchKey:m(e.chainTargets),participantIds:e.participantIds,chainTargets:e.chainTargets};default:return P(e)}}function v(e){switch(e.branch.kind){case`near_ed25519`:if(e.nearSlots.has(e.branch.signerSlot))return{ok:!1,code:`invalid_body`,message:`duplicate near_ed25519 signer slot is invalid`};e.nearSlots.add(e.branch.signerSlot);break;case`evm_family_ecdsa`:{let t=b(e.branch,e.ecdsaTargetKeys);if(t)return t}break;default:return F(e.branch)}return y(e.branch,e.branchKeys)}function y(e,t){let n=String(e.branchKey);return t.has(n)?{ok:!1,code:`invalid_body`,message:`duplicate signer branch is invalid`}:(t.add(n),null)}function b(t,n){for(let r of t.chainTargets){let t=e(r);if(n.has(t))return{ok:!1,code:`invalid_body`,message:`duplicate evm_family_ecdsa chain target is invalid`};n.add(t)}return null}function x(e){let t=r(e);if(!t)return{ok:!1,code:`invalid_body`,message:`signer set entry must be an object`};if(!(`kind`in t))return{ok:!1,code:`invalid_body`,message:`unsupported registration signer kind`};switch(n(t.kind)){case`near_ed25519`:return S(t);case`evm_family_ecdsa`:return C(t);default:return{ok:!1,code:`invalid_body`,message:`unsupported registration signer kind`}}}function S(e){if(Object.prototype.hasOwnProperty.call(e,`keyPurpose`)||Object.prototype.hasOwnProperty.call(e,`keyVersion`))return{ok:!1,code:`invalid_body`,message:`near_ed25519 signer spec cannot include protocol key fields`};if(Object.prototype.hasOwnProperty.call(e,`nearAccountId`)||Object.prototype.hasOwnProperty.call(e,`createNearAccount`))return{ok:!1,code:`invalid_body`,message:`near_ed25519 signer spec is invalid`};let t=l(`accountProvisioning`in e?e.accountProvisioning:void 0),n=o(`signerSlot`in e?e.signerSlot:void 0,0),r=Number(`derivationVersion`in e?e.derivationVersion:void 0),i=s(`participantIds`in e?e.participantIds:void 0);return!t||n<1||i.length===0||r!==1?{ok:!1,code:`invalid_body`,message:`near_ed25519 signer spec is invalid`}:{ok:!0,value:{kind:`near_ed25519`,accountProvisioning:t,signerSlot:n,participantIds:i,derivationVersion:r}}}function C(e){let t=u(e);return t?{ok:!0,value:{kind:`evm_family_ecdsa`,participantIds:t.participantIds,chainTargets:t.chainTargets}}:{ok:!1,code:`invalid_body`,message:`evm_family_ecdsa signer spec is invalid`}}function w(e){if(!(`signers`in e)||!Array.isArray(e.signers))return{ok:!1,code:`invalid_body`,message:`signerSelection.signers must be an array`};let t=[];for(let n of e.signers){let e=x(n);if(!e.ok)return e;t.push(e.value)}return h(t)}function T(e){let t=r(e);return t?`kind`in t&&n(t.kind)===`signer_set`?w(t):{ok:!1,code:`invalid_body`,message:`signerSelection.kind must be signer_set`}:{ok:!1,code:`invalid_body`,message:`signerSelection must be an object`}}function E(e){return h(e.signers)}function D(e){for(let t of e.branches)if(t.kind===`near_ed25519`)return t;return null}function O(e){for(let t of e.branches)if(t.kind===`evm_family_ecdsa`)return t;return null}function k(e,t={}){let n=[];for(let r of e.branches){let e=A(r,t);if(!e.ok)return e;n.push(e.value)}return{ok:!0,value:{kind:`signer_set`,signers:n}}}function A(e,t){switch(e.kind){case`near_ed25519`:return{ok:!0,value:j(e)};case`evm_family_ecdsa`:return M(e,t);default:return F(e)}}function j(e){return{kind:`near_ed25519`,accountProvisioning:e.accountProvisioning,signerSlot:e.signerSlot,participantIds:[...e.participantIds],derivationVersion:e.derivationVersion}}function M(e,t){let n=N(e,t);return n?{ok:!0,value:{kind:`evm_family_ecdsa`,participantIds:[...e.participantIds],chainTargets:n}}:{ok:!1,code:`invalid_body`,message:`registration ECDSA chainTargets are invalid`}}function N(e,t){if(!t.normalizeEcdsaChainTarget)return[...e.chainTargets];let n=[];for(let r of e.chainTargets){let e=t.normalizeEcdsaChainTarget(r);if(!e)return null;n.push(e)}return n}function P(e){throw Error(`Unsupported registration signer request: ${String(e)}`)}function F(e){throw Error(`Unsupported registration signer plan branch: ${String(e)}`)}function I(e,t){let i=r(e);if(!i)return{ok:!1,code:`invalid_body`,message:`signerSelection must be an object`};if(!(`mode`in i))return{ok:!1,code:`invalid_body`,message:`unsupported add-signer mode`};let a=n(i.mode);return a===`ecdsa`?L(`ecdsa`in i?i.ecdsa:void 0,t):a===`ed25519`?z(`ed25519`in i?i.ed25519:void 0):{ok:!1,code:`invalid_body`,message:`unsupported add-signer mode`}}function L(e,t){let n=r(e),i=s(n&&`participantIds`in n?n.participantIds:void 0),a=R(n&&`chainTargets`in n?n.chainTargets:void 0,t);return i.length===0||a.length===0?{ok:!1,code:`invalid_body`,message:`ecdsa add-signer spec is invalid`}:{ok:!0,value:{mode:`ecdsa`,ecdsa:{chainTargets:a,participantIds:i}}}}function R(e,t){if(!Array.isArray(e))return[];let n=[];for(let r of e){let e=t.normalizeEcdsaChainTarget(r);if(!e)return[];n.push(e)}return n}function z(e){let t=r(e),i=n(t&&`mode`in t?t.mode:void 0),a=o(t&&`signerSlot`in t?t.signerSlot:void 0,1),c=n(t&&`keyPurpose`in t?t.keyPurpose:void 0),l=n(t&&`keyVersion`in t?t.keyVersion:void 0),u=o(t&&`derivationVersion`in t?t.derivationVersion:void 0,0),d=s(t&&`participantIds`in t?t.participantIds:void 0);return!c||!l||!u||d.length===0?{ok:!1,code:`invalid_body`,message:`ed25519 add-signer spec is invalid`}:i===`create_implicit_near_account`?{ok:!0,value:{mode:`ed25519`,ed25519:{mode:i,signerSlot:a,participantIds:d,keyPurpose:c,keyVersion:l,derivationVersion:u}}}:{ok:!1,code:`invalid_body`,message:`unsupported add-signer mode`}}export{I as a,p as c,a as d,i,E as l,O as n,T as o,D as r,m as s,d as t,k as u};

package/dist/esm/sdk/requireStepUpAuth-B7tC4MrA.js

@@ -1 +0,0 @@
-import{c as e,u as t}from"./chains-gV2K9gA4.js";import{i as n}from"./base64-BmKR3UqU.js";import{r}from"./secureRandomId-8LSc91aN.js";import{i}from"./errors-ADOZT8oV.js";import{o as a}from"./sdkSentEvents-DUht3AOD.js";import{a as o,c as s,i as c,o as ee,r as te,t as ne}from"./types-DdzuHlAQ.js";import{t as l}from"./types-fJKfUgTi.js";import{t as u}from"./promptText-Bz3YRl9D.js";async function d(r){let i=await t(e({kind:String(r.kind||``).trim()||`unknown`,payload:f(r.payload)}));return te.signingOperationFingerprint(`sha256:${n(i)}`)}function f(e){if(typeof e==`bigint`)return e.toString(10);if(e instanceof Uint8Array)return{__bytesB64u:n(e)};if(ArrayBuffer.isView(e))return{__bytesB64u:n(new Uint8Array(e.buffer,e.byteOffset,e.byteLength))};if(e instanceof ArrayBuffer)return{__bytesB64u:n(new Uint8Array(e))};if(Array.isArray(e))return e.map(f);if(!e||typeof e!=`object`)return e;let t={};for(let n of Object.keys(e).sort()){let r=f(e[n]);r!==void 0&&(t[n]=r)}return t}const p={Created:`created`,Planned:`planned`,ConfirmationApproved:`confirmation_approved`,AuthenticationInProgress:`authentication_in_progress`,AuthReady:`auth_ready`,ThresholdConnected:`threshold_connected`,PayloadPrepared:`payload_prepared`,Signed:`signed`,CleanedUp:`cleaned_up`,Completed:`completed`,Failed:`failed`,Cancelled:`cancelled`},m={ShowConfirmation:`showConfirmation`,RequestOtp:`requestOtp`,RequestPasskey:`requestPasskey`,ConnectThreshold:`connectThreshold`,PreparePayload:`preparePayload`,Sign:`sign`,Cleanup:`cleanup`},h={Review:`review`,Authentication:`authentication`,Execution:`execution`},g={Pending:`pending`,Approved:`approved`},_={ReviewApproved:`review_approved`,AuthenticationStarted:`authentication_started`,AuthenticationCompleted:`authentication_completed`};function v(e){return{operationId:e.operationId,current:{kind:p.Created}}}function y(e,t){switch(e.current.kind){case p.Created:case p.Planned:{let n={kind:p.Planned,plan:t};return e.current=n,n}case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:{let n={kind:p.ConfirmationApproved,plan:t};return e.current=n,n}case p.AuthenticationInProgress:{let n={kind:e.current.reviewApproval===g.Approved?p.ConfirmationApproved:p.Planned,plan:t};return e.current=n,n}case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot be replanned`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be replanned`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot be replanned`);default:return I(e.current)}}function b(e){switch(e.current.kind){case p.Planned:e.current={kind:p.ConfirmationApproved,plan:e.current.plan};return;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.AuthenticationInProgress:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Approved};return;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before confirmation`);case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot be confirmed`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be confirmed`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot be confirmed`);default:return I(e.current)}}function x(e){switch(e.current.kind){case p.Planned:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Pending};return;case p.ConfirmationApproved:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Approved};return;case p.AuthenticationInProgress:return;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before authentication`);case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot authenticate`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot authenticate`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot authenticate`);default:return I(e.current)}}function S(e){switch(e.current.kind){case p.AuthenticationInProgress:if(e.current.reviewApproval!==g.Approved)throw Error(`[SigningOperationMachine] authentication cannot complete before transaction approval`);e.current={kind:p.AuthReady,plan:e.current.plan};return;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.Created:case p.Planned:throw Error(`[SigningOperationMachine] authentication cannot complete before transaction approval`);case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot authenticate`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot authenticate`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot authenticate`);default:return I(e.current)}}function C(e,t){switch(t.kind){case _.ReviewApproved:b(e);return;case _.AuthenticationStarted:x(e);return;case _.AuthenticationCompleted:S(e);return;default:return L(t)}}function w(e){let t;switch(e.current.kind){case p.Planned:t=h.Review;break;case p.AuthenticationInProgress:t=h.Authentication;break;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:t=h.Execution;break;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before cancellation`);case p.Signed:case p.CleanedUp:case p.Completed:throw Error(`[SigningOperationMachine] completed signing cannot be cancelled`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be cancelled`);case p.Cancelled:return e.current;default:return I(e.current)}let n={kind:p.Cancelled,plan:e.current.plan,phase:t};return e.current=n,n}function re(e){switch(e){case p.Planned:return!1;case p.ConfirmationApproved:return!0;default:return R(e)}}function ie(e){switch(e.kind){case p.Created:case p.Planned:case p.Failed:case p.Cancelled:return!1;case p.AuthenticationInProgress:return e.reviewApproval===g.Approved;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:case p.Completed:return!0;default:return I(e)}}function T(e){return{kind:`signing_operation_plan`,sessionPlan:e.sessionPlan,operation:e.operation,commands:e.commands}}async function E(e){let t=[];for(let n of e.steps){if(n.command)try{await e.executor.execute(n.command)}catch(r){let i=j({from:n.from,to:{kind:p.Failed,plan:n.command.plan,reason:F(r)},command:n.command,reason:F(r)});return await e.onTransition?.(i.traceEvent),t.push(i),{ok:!1,finalState:i.to,error:r}}if(await e.onTransition?.(n.traceEvent),t.push(n),n.to.kind===p.Failed)return{ok:!0,finalState:n.to}}let n=t.at(-1)?.to||e.steps.at(-1)?.from;if(!n)throw Error(`[SigningOperationMachine] command sequence produced no steps`);return{ok:!0,finalState:n}}async function ae(e){for(let t of e.commands)await e.execute(t)}function D(e){let t=k(e),n=-1;return t.forEach((e,t)=>{e.command&&(n=t)}),n>=0?t.slice(0,n+1):[]}async function O(e){let t,n=await E({steps:D(T({sessionPlan:e.signingSessionPlan,operation:e.signingOperation,commands:[e.commandKind]})),executor:{execute:async n=>{n.kind===e.commandKind&&(t=await e.execute())}}});if(!n.ok)throw n.error;if(n.finalState.kind===p.Failed)throw Error(n.finalState.reason);return t}function k(e,t={kind:p.Planned,plan:e.sessionPlan}){let n=e.sessionPlan;if(n.kind===c.NotReady)return[j({from:t,to:{kind:p.Failed,plan:n,reason:n.reason},reason:n.reason})];let r=[],i=t;return i=A(r,i,{to:{kind:p.ConfirmationApproved,plan:n},command:N(e,{kind:m.ShowConfirmation,plan:n,lane:n.lane})}),n.kind===c.EmailOtpReauth?(i=A(r,i,{to:{kind:p.AuthReady,plan:n},command:N(e,{kind:m.RequestOtp,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.ThresholdConnected,plan:n},command:N(e,{kind:m.ConnectThreshold,plan:n,lane:n.lane})})):n.kind===c.PasskeyReauth?(i=A(r,i,{to:{kind:p.AuthReady,plan:n},command:N(e,{kind:m.RequestPasskey,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.ThresholdConnected,plan:n},command:N(e,{kind:m.ConnectThreshold,plan:n,lane:n.lane})})):i=A(r,i,{to:{kind:p.AuthReady,plan:n}}),i=A(r,i,{to:{kind:p.PayloadPrepared,plan:n},command:N(e,{kind:m.PreparePayload,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.Signed,plan:n},command:N(e,{kind:m.Sign,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.CleanedUp,plan:n},command:N(e,{kind:m.Cleanup,plan:n,lane:n.lane})}),A(r,i,{to:{kind:p.Completed,plan:n}}),r}function A(e,t,n){let r=j({from:t,to:n.to,command:n.command,reason:n.reason});return e.push(r),r.to}function j(e){let t=M(e.from,e.to);return{from:e.from,to:e.to,command:e.command,traceEvent:{event:`signing_operation_transition`,from:e.from.kind,to:e.to.kind,...e.command?{command:e.command.kind}:{},...e.command?.operation?{operationId:e.command.operation.operationId}:{},plan:ee(t),lane:o(t.lane),...e.reason?{reason:e.reason}:{}}}}function M(e,t){if(`plan`in t)return t.plan;if(`plan`in e)return e.plan;throw Error(`[SigningOperationMachine] transition has no signing plan`)}function N(e,t){if(e.commands.includes(t.kind))return P(t,e.operation)}function P(e,t){return t?{...e,operation:t}:e}function F(e){return e instanceof Error&&e.message.trim()?e.message:`execution_command_failed`}function I(e){throw Error(`Unsupported signing operation state: ${String(e)}`)}function L(e){throw Error(`[SigningOperationMachine] unsupported interaction event: ${String(e)}`)}function R(e){throw Error(`Unsupported signing operation state kind: ${String(e)}`)}function z(e){switch(e.signingAuthPlan.kind){case l.WarmSession:return{signingAuthPlan:e.signingAuthPlan};case l.ActiveWalletAuthority:return{signingAuthPlan:e.signingAuthPlan};case l.PasskeyReauth:return{signingAuthPlan:e.signingAuthPlan,...e.webauthnChallenge?{webauthnChallenge:e.webauthnChallenge}:{}};case l.EmailOtpReauth:{let t=e.emailOtpPrompt??e.signingAuthPlan.emailOtpPrompt;if(!t)throw Error(`[SigningConfirmation] missing_email_otp_prompt`);return{signingAuthPlan:e.signingAuthPlan,emailOtpPrompt:t}}default:return B(e.signingAuthPlan)}}function B(e){throw Error(`Unsupported signing auth plan: ${String(e.kind)}`)}async function V(e){H(e.request);let t=e.runtime.orchestrateSigningConfirmation;return await t(e.request)}function H(e){let t=e;switch(e.signingAuthPlan.kind){case l.WarmSession:if(t.emailOtpPrompt!==void 0||t.webauthnChallenge!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.ActiveWalletAuthority:if(t.emailOtpPrompt!==void 0||t.webauthnChallenge!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.PasskeyReauth:if(t.emailOtpPrompt!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.EmailOtpReauth:if(t.webauthnChallenge!==void 0||!t.emailOtpPrompt)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;default:return B(e.signingAuthPlan)}}function U(e){switch(e){case`missing_capability`:case`missing_material`:case`authority_ambiguous`:case`binding_mismatch`:case`exact_record_conflict`:case`corrupt`:return{kind:`invalid_material`,reason:e};case`revoked`:case`replaced`:return{kind:`full_login_required`,reason:e};case`persistence_unavailable`:return{kind:`temporarily_unavailable`,reason:e};default:throw Error(`[SigningEngine] unsupported signing material block reason`)}}var W=class extends Error{name=`InvalidWalletSigningMaterialError`;code=`wallet_signing_material_invalid`;constructor(e){super(`Wallet signing material is invalid. Log in again or recover the wallet.`),this.reason=e}},G=class extends Error{name=`WalletFullLoginRequiredError`;code=`wallet_full_login_required`;constructor(e){super(`A full wallet login is required before signing.`),this.reason=e}},K=class extends Error{name=`WalletOperationStepUpCancelled`;code=`wallet_operation_step_up_cancelled`;constructor(){super(`Request cancelled.`)}},q=class extends Error{name=`WalletSigningMaterialTemporarilyUnavailableError`;code=`wallet_signing_material_temporarily_unavailable`;reason=`persistence_unavailable`;constructor(){super(`Wallet signing material storage is temporarily unavailable. Retry the operation.`)}};function J(e){return new W(e)}function Y(e){return new G(e)}function oe(e){let t=U(e);switch(t.kind){case`invalid_material`:return J(t.reason);case`full_login_required`:return Y(t.reason);case`temporarily_unavailable`:return new q;default:throw Error(`[SigningEngine] unsupported signing material disposition`)}}function se(){return new K}function ce(e){return e instanceof W||e instanceof G||e instanceof K}function le(e){return r(e,32,`signing confirmation request IDs`)}function ue(e){return e.override}function de(e){return e.kind===`digest`?e.digest32:e.challenge32}function X(e){let t=V;return async()=>await t({runtime:e.runtime,request:e.request})}async function fe(e){let t=y(e.signingOperationState,e.signingSessionPlan),n={...e.request,signingOperationStateKind:t.kind,onSigningOperationInteractionEvent:C.bind(void 0,e.signingOperationState)},r=X({runtime:e.runtime,request:n});try{return await O({signingSessionPlan:e.signingSessionPlan,signingOperation:e.signingOperation,commandKind:m.ShowConfirmation,execute:r})}catch(t){throw i(t)&&w(e.signingOperationState).phase===h.Authentication?se():t}}async function pe(e){let t=X({runtime:e.runtime,request:e.request});return await O({signingSessionPlan:e.signingSessionPlan,signingOperation:e.signingOperation,commandKind:m.ShowConfirmation,execute:t})}function me(e){let t=e.plan;if(t.kind===c.WarmSession){if(t.keyRef.kind!==ne.Cached)throw Error(`[SigningEngine] warm signing-session plan requires a cached key ref`);let n=Math.floor(Number(e.expiresAtMs)||0),r=Math.floor(Number(e.remainingUses)||0);if(n<=0||r<=0)throw Error(`[SigningEngine] warm signing-session auth plan requires positive expiresAtMs and remainingUses`);if(e.curve===`ed25519`){if(t.keyRef.curve!==`ed25519`)throw Error(`[SigningEngine] Ed25519 warm plan requires an Ed25519 key ref`);return{kind:l.WarmSession,method:s(t.lane.auth),accountId:e.accountId,intent:e.intent,curve:`ed25519`,thresholdSessionId:String(t.keyRef.thresholdSessionId),retention:t.lane.retention,expiresAtMs:n,remainingUses:r}}if(t.keyRef.curve!==`ecdsa`)throw Error(`[SigningEngine] ECDSA warm plan requires an ECDSA key ref`);return{kind:l.WarmSession,method:s(t.lane.auth),accountId:e.accountId,intent:e.intent,curve:`ecdsa`,materialActivation:t.keyRef.materialActivation,authorization:t.keyRef.authorization,retention:t.lane.retention,expiresAtMs:n,remainingUses:r}}return t.kind===c.EmailOtpReauth?{kind:l.EmailOtpReauth,method:`email_otp`,...e.emailOtpPrompt?{emailOtpPrompt:e.emailOtpPrompt}:{}}:{kind:l.PasskeyReauth,method:`passkey`}}function he(e){switch(e.kind){case l.EmailOtpReauth:return`email_otp`;case l.WarmSession:return`warm_session`;case l.ActiveWalletAuthority:return`warm_session`;case l.PasskeyReauth:return`passkey`;default:{let t=e.kind;throw Error(`Unsupported signing confirmation auth method: ${String(t)}`)}}}function Z(e,t){let n=String(e.phase||``),r=e.status===`failed`;if(n===`intent-confirmation-required`)return{phase:a.STEP_05_CONFIRMATION_DISPLAYED,status:`waiting_for_user`,interaction:{kind:`transaction_confirmation`,overlay:`show`},data:Q(e.data)};if(n===`confirmation.complete`)return r?{phase:a.STEP_05_CONFIRMATION_CANCELLED,status:`cancelled`,interaction:{kind:`transaction_confirmation`,overlay:`hide`},error:{message:e.message||`Transaction rejected`},data:Q(e.data)}:{phase:t===`email_otp`?a.STEP_06_AUTH_EMAIL_OTP_VERIFY_SUCCEEDED:a.STEP_05_CONFIRMATION_APPROVED,status:`succeeded`,interaction:{kind:t===`email_otp`?`otp_input`:`transaction_confirmation`,overlay:`hide`},data:Q(e.data)};if(n===`auth.passkey.prompt.started`)return{phase:a.STEP_06_AUTH_PASSKEY_PROMPT_STARTED,status:`waiting_for_user`,interaction:{kind:`passkey_assert`,overlay:`show`},data:Q(e.data)};if(n===`auth.passkey.prompt.succeeded`){let t=`passkey_assert`;return r?{phase:a.FAILED,status:`failed`,interaction:{kind:t,overlay:`hide`},error:{message:e.message||`Transaction signing failed`},data:Q(e.data)}:{phase:a.STEP_06_AUTH_PASSKEY_PROMPT_SUCCEEDED,status:`succeeded`,interaction:{kind:t,overlay:`hide`},data:Q(e.data)}}return null}function Q(e){if(e!=null)return typeof e==`object`&&!Array.isArray(e)?e:{value:e}}function ge(e){return{challengeId:e.challenge.challengeId,...e.challenge.emailHint?{emailHint:e.challenge.emailHint}:{},title:`Enter email code to sign`,helperText:u(e.challenge.emailHint),...e.resend?{onResend:e.resend}:{}}}var $=class extends Error{code;method;constructor(e,t,n){super(n),this.name=`StepUpMethodSelectionError`,this.code=e,this.method=t}};function _e(e,t){if(t.kind===`reuse_warm_session`)return`warm_session`;if(e.authMethod===`voiceid`)throw Error(`Unlock with VoiceID again before signing.`);return t.kind===`force_method`?t.method:e.authMethod}function ve(e){if(e.policy.kind===`reuse_warm_session`)return{method:`warm_session`,authorization:e.policy.authorization};let t=_e(e.selectedLane,e.policy);if(t===`passkey`){if(!e.methods.passkey)throw new $(`missing_step_up_runner`,t,`Passkey step-up runner is required for this operation`);return{method:`passkey`,runner:e.methods.passkey}}if(t===`email_otp`){if(!e.methods.emailOtp)throw new $(`missing_step_up_runner`,t,`Email OTP step-up runner is required for this operation`);return{method:`email_otp`,runner:e.methods.emailOtp}}let n=t;throw new $(`unsupported_step_up_method`,n,`Unsupported step-up method: ${n}`)}async function ye(e){let t=ve({selectedLane:e.selectedLane,policy:e.policy,methods:e.methods});if(t.method===`warm_session`)return{method:`warm_session`,authorization:t.authorization};if(t.method===`passkey`){let n=await t.runner.prepare();return{method:`passkey`,prompt:n,complete:async r=>await t.runner.complete({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,prompt:n,confirmation:r})}}let n=await t.runner.prepareChallenge({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy}),r={},i=ge({challenge:n,resend:t.runner.resendChallenge?async()=>await t.runner.resendChallenge({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,currentPrompt:r.prompt||i}):void 0});return r.prompt=i,{method:`email_otp`,prompt:i,complete:async n=>await t.runner.complete({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,prompt:i,confirmation:n})}}export{O as C,d as E,re as S,ae as T,_,le as a,v as b,pe as c,Y as d,J as f,m as g,z as h,de as i,fe as l,oe as m,ue as n,Z as o,ce as p,X as r,he as s,ye as t,me as u,D as v,E as w,ie as x,T as y};

package/dist/esm/sdk/resealedEnvelopeResult--iCVt_Bh.js

@@ -1 +0,0 @@
-import{k as e}from"./domainIds-t1lp25yU.js";import{k as t}from"./chains-gV2K9gA4.js";import{E as n,J as r,O as i,k as a}from"./activeWalletSession-H9JBdHyQ.js";import{a as o}from"./presignatures-B9GrGx0L.js";import{t as s}from"./indexedDB-C1odKEC6.js";import{n as c}from"./walletOwnershipGeneration-DI9ogcXF.js";import{o as l}from"./walletSessionAuthorizationStore-zkxcMdSp.js";async function u(e,t){let n=f(e,t);if(n===null)return;let r=await s.resolveSelectedWalletAuthority(n);if(r.kind!==`resolved`)return;let i=await l.readExactWithOperationCredential({walletId:n,authorityId:r.authority.authorityId,authMethodId:r.authMethod.walletAuthMethodId});i.kind===`found`&&await c(n,i.operationCredential.ownershipGeneration)}function d(t){let n=e(t);if(!n.ok)throw Error(`Wallet mutation identity is invalid`);return n.value}function f(e,t){switch(e.type){case`PM_ADD_WALLET_SIGNER`:case`PM_ADD_PASSKEY`:case`PM_ACTIVATE_AUTH_METHOD`:case`PM_SET_AUTH_METHOD_ENABLED`:case`PM_ADD_EMAIL_OTP`:case`PM_REVOKE_AUTH_METHOD`:case`PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP`:case`PM_ROTATE_WALLET_RECOVERY_CODES`:case`PM_REQUEST_WALLET_CUSTODY_EMAIL_OTP_CHALLENGE`:case`PM_SIGN_TX_WITH_ACTIONS`:case`PM_SIGN_AND_SEND_TX`:case`PM_SIGN_DELEGATE_ACTION`:case`PM_SIGN_NEP413`:case`PM_REVOKE_LINKED_DEVICE`:return d(e.payload?.walletId);case`PM_SIGN_TEMPO`:case`PM_RESOLVE_EXACT_KEY_EXPORT_LANE`:case`PM_EXPORT_KEYPAIR_UI`:return d(e.payload?.walletSession.walletId);case`PM_SYNC_ACCOUNT_FLOW`:{let n=e.payload?.walletId??t;return n===null?null:d(n)}case`PM_SCAN_AND_LINK_DEVICE`:return t===null?null:d(t);case`PM_SET_TRANSACTION_VIEW`:case`PM_TRANSACTION_BROADCAST_STARTED`:case`PING`:case`PM_GET_AUTH_METHOD_AVAILABILITY`:case`PM_PREPARE_WALLET_RUNTIME`:case`PM_SET_CONFIG`:case`PM_ACTIVATE_TRANSACTION_REVIEW`:case`PM_CANCEL`:case`PM_OPEN_AUTH_MENU`:case`PM_CANCEL_AUTH_MENU`:case`PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH`:case`PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION`:case`PM_REGISTER_WALLET`:case`PM_UNLOCK`:case`PM_UNLOCK_AUTH_METHOD`:case`PM_LOCK`:case`PM_LOCK_EXACT_WALLET_SESSION`:case`PM_GET_LAST_WALLET_MOVE_REQUEST`:case`PM_MOVE_WALLET`:case`PM_GET_WALLET_MOVE`:case`PM_GET_WALLET_PLACEMENT`:case`PM_GET_WALLET_SESSION`:case`PM_GET_EXACT_WALLET_SESSION_STATE`:case`PM_GET_NEAR_PROVISIONING_STATE`:case`PM_REQUEST_EMAIL_OTP_CHALLENGE`:case`PM_BEGIN_GOOGLE_EMAIL_OTP_WALLET_AUTH`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_RESEND`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_REROLL_WALLET_ID`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_SUBMIT`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_COMPLETE_REGISTRATION`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_CANCEL`:case`PM_GET_WALLET_RECOVERY_CODE_STATUS`:case`PM_SEND_TRANSACTION`:case`PM_REPORT_TEMPO_BROADCAST_ACCEPTED`:case`PM_REPORT_TEMPO_BROADCAST_REJECTED`:case`PM_REPORT_TEMPO_FINALIZED`:case`PM_REPORT_TEMPO_DROPPED_OR_REPLACED`:case`PM_RECONCILE_TEMPO_NONCE_LANE`:case`PM_GET_RECENT_UNLOCKS`:case`PM_SET_CONFIRM_BEHAVIOR`:case`PM_SET_CONFIRMATION_CONFIG`:case`PM_GET_CONFIRMATION_CONFIG`:case`PM_HAS_PASSKEY`:case`PM_LIST_LINKED_DEVICES`:case`PM_START_DEVICE2_LINKING_FLOW`:case`PM_DEVICE_LINK_TARGET_FACTOR_ACTION`:case`PM_DEVICE_LINK_EMAIL_OTP_BASE_FACTOR_ACTION`:case`PM_CANCEL_DEVICE_LINKING`:return null;default:throw Error(`Unsupported wallet mutation request`)}}function p(e,t){return`wallet-auth-method-availability:${encodeURIComponent(e)}:${encodeURIComponent(t)}`}async function m(e,t){return h(await s.getAppState(p(e,t))).enabled}function h(e){if(e==null)return{enabled:!0,revision:`initial`};let n=t(e,`authentication method availability`);if(r(n,[`kind`,`revision`],`authentication method availability`),n.kind!==`enabled`&&n.kind!==`disabled`)throw Error(`Authentication method availability is invalid.`);if(n.revision!==void 0&&(typeof n.revision!=`string`||!n.revision))throw Error(`Authentication method availability revision is invalid.`);return{enabled:n.kind===`enabled`,revision:n.revision??`initial`}}async function g(e,t,n){await s.setAppState(p(e,t),{kind:n?`enabled`:`disabled`,revision:crypto.randomUUID()})}async function _(e){let t=await s.resolveSelectedWalletAuthority(e);if(t.kind!==`resolved`)return{kind:`not_enrolled`};let n=(await s.listWalletAuthMethodsV2ForWallet(e)).filter(v.bind(null,t.authority.authorityId));if(n.length===0)return{kind:`not_enrolled`};if(n.length!==1)throw Error(`Select the device authority before managing VoiceID.`);let r=n[0];return await m(e,r.walletAuthMethodId)?{kind:`enabled`,walletAuthMethodId:r.walletAuthMethodId}:{kind:`disabled`,walletAuthMethodId:r.walletAuthMethodId}}function v(e,t){return t.walletAuthorityId===e&&t.kind===`voiceid`&&t.status===`active`}async function y(e,t){let n=await s.getWalletAuthMethodV2(t);if(!n||n.walletId!==e)return!1;let r=await s.listWalletAuthMethodsV2ForWallet(e);for(let e of r)if(e.walletAuthorityId===n.walletAuthorityId&&e.walletAuthMethodId!==t&&e.status===`active`&&e.kind!==`voiceid`)return!0;return!1}async function b(e,t){let n=(await s.seamsWalletDB.getDB()).transaction(o.appState,`readwrite`),r=n.objectStore(o.appState);for(let n of await r.getAllKeys()){if(typeof n!=`string`||!n.startsWith(`voiceid-browser-enrollment-v2:`))continue;let i=await r.get(n);i?.value?.scope?.walletId===e&&i.value.scope.walletAuthMethodId===t&&await r.delete(n)}await n.done}function x(e){let o=t(e,`wallet custody worker reseal`);return r(o,[`nonceB64u`,`sealedCustodySecretB64u`,`aadHashB64u`,`ciphertextDigestB64u`],`wallet custody worker reseal`),{nonceB64u:a(o.nonceB64u),sealedCustodySecretB64u:i(o.sealedCustodySecretB64u),aadHashB64u:n(o.aadHashB64u,`aadHashB64u`),ciphertextDigestB64u:n(o.ciphertextDigestB64u,`ciphertextDigestB64u`)}}export{m as a,g as c,h as i,u as l,p as n,_ as o,y as r,b as s,x as t,f as u};

package/dist/esm/sdk/routerAbNormalSigning-Div3lZWV.js

@@ -1 +0,0 @@
-import{c as e,h as t,k as n}from"./chains-gV2K9gA4.js";import{ct as r,it as i,ot as a,st as o}from"./activeWalletSession-H9JBdHyQ.js";import{i as s,r as c,t as l}from"./base64-BmKR3UqU.js";import{r as u}from"./walletDbName-DDJXrgA5.js";import{d,h as f}from"./capabilityKinds-BzrNeEyO.js";import{X as p,Z as m,gt as h,ht as g,it as _,ln as v,un as y}from"./emailOtpEcdsaDerivationIdentity-CIh9IPai.js";import{t as b}from"./authenticatorOptions-EF_Rps52.js";import{r as x,t as ee}from"./walletSessionAuthorizationStatus-98G3Qji8.js";import{t as S}from"./authorizationAdmission-DbhNiY3X.js";import{n as te}from"./walletSessionFailure-CLUIF3Eh.js";const C={enabled:!0,targetDepth:5,lowWatermark:4,maxRefillInFlight:1,refillAttemptTimeoutMs:3e4},ne={authMethods:[],network:{chains:[{network:`near-testnet`,rpcUrl:`https://rpc.testnet.fastnear.com`,explorerUrl:`https://testnet.nearblocks.io`},{network:`tempo-testnet`,rpcUrl:`https://rpc.moderato.tempo.xyz`,explorerUrl:`https://explore.tempo.xyz`,chainId:42431},{network:`arc-testnet`,rpcUrl:`https://rpc.testnet.arc.io`,explorerUrl:`https://testnet.arcscan.app`,chainId:5042002},{network:`ethereum-sepolia`,rpcUrl:`https://ethereum-sepolia-rpc.publicnode.com`,explorerUrl:`https://sepolia.etherscan.io`,chainId:11155111}],relayer:{accountId:``,url:``,routes:{delegateAction:`/signed-delegate`}}},registration:{mode:`managed`,projectEnvironmentId:``,publishableKey:``,paymentMode:`disabled`,nearAccountProvisioning:{kind:`implicit_account`}},signing:{sessionDefaults:{ttlMs:u,remainingUses:3},emailOtp:{authPolicy:`session`},sessionPersistenceMode:`none`,sessionSeal:{mode:`none`},routerAb:{normalSigning:{mode:`disabled`}},routerAbEcdsaDerivation:{presignaturePool:C},thresholdEcdsa:{provisioningDefaults:{tempo:{enabled:!0,signingSession:{kind:`jwt`,ttlMs:u,remainingUses:3}},evm:{enabled:!0,signingSession:{kind:`jwt`,ttlMs:u,remainingUses:3}}}}},wallet:{mode:`iframe`,iframe:{origin:`https://wallet.example.localhost`,servicePath:`/wallet-service`,sdkBasePath:`/sdk`,walletHostVariant:`runtime`,rpIdOverride:`example.localhost`}},webauthn:{authenticatorOptions:{userVerification:b.Preferred,originPolicy:{single:void 0,all_subdomains:!0,multiple:void 0}}},ui:{appearance:{theme:{id:`default`,mode:`dark`,colors:{}},palette:`default`}}};async function re(e,t){let r=n(t,`ECDSA prepare response`);if(r.kind!==e.authorization.kind)throw Error(`ECDSA prepare authorization kind does not match the request`);let i=await p(e,r.signing);if(e.authorization.kind===`operation_step_up`){if(Object.keys(r).some(w))throw Error(`Invalid step-up prepare response`);return{kind:`operation_step_up`,signing:i}}if(Object.keys(r).some(ie))throw Error(`Invalid Wallet Session prepare response`);let a=n(r.session_status,`ECDSA prepare session status`),o=d(a.quotaId),s=f(e.authorization.wallet_session_id);if(!o.ok||!s.ok)throw Error(`Invalid prepare session identity`);let c=x(a,{walletSessionId:s.value,quotaId:o.value});if(!c||c.status!==`active`||c.authorization.walletId!==e.scope.wallet_id)throw Error(`ECDSA prepare did not return the admitted Wallet Session`);return{kind:`reusable_wallet_session`,signing:i,sessionStatus:c}}function w(e){return e!==`kind`&&e!==`signing`}function ie(e){return w(e)&&e!==`session_status`}var T=class extends Error{code;path;status;constructor(e){super(`Router A/B signing ${e.path} returned HTTP ${e.status}: ${e.message||e.code}`),this.name=`RouterAbSigningRequestError`,this.code=e.code,this.path=e.path,this.status=e.status}};function ae(e){let t=String(e.code||``).trim(),n=`Router A/B signing ${e.path} returned HTTP ${e.status}: ${e.message||t||`unknown admission failure`}`;if(e.authorizationDecision?.kind===`step_up_required`)return new S({kind:`exhausted`,source:`server_prepare`,detail:n},e.authorizationDecision);switch(t){case`wallet_budget_exhausted`:return new S({kind:`exhausted`,source:`server_prepare`,detail:n},e.authorizationDecision);case`wallet_budget_in_flight`:case`wallet_budget_reserved`:return new S({kind:`in_flight`,source:`server_prepare`,detail:n,retryAfterMs:150});default:return null}}function E(e,t){let n=Math.floor(Number(e));if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} must be a positive integer`);return n}function D(e,t,n){if(!Array.isArray(e))throw Error(`${t} must be a byte array`);let r=e.map(e=>Number(e));if(!r.every(e=>Number.isInteger(e)&&e>=0&&e<=255))throw Error(`${t} must contain bytes`);if(n!==void 0&&r.length!==n)throw Error(`${t} must contain ${n} bytes`);return r}function O(e,n){let r=t(e,n);if(c(r).length!==32)throw Error(`${n} must decode to 32 bytes`);return r}function k(e,n){let r=t(e,n);if(c(r).length===0)throw Error(`${n} must decode to non-empty bytes`);return r}function A(e,n){let r=t(e,n),i;try{i=l(r)}catch{i=c(r)}if(i.length!==32)throw Error(`${n} must decode to 32 bytes`);return s(i)}function j(e){return{bytes:[...D([...e],`digest bytes`,32)]}}function M(e,t){return s(Uint8Array.from(D(e.bytes,t)))}async function oe(t){return s(await Q(new TextEncoder().encode(e(t))))}function se(e){let n=t(e.message,`nep413.message`),r=t(e.recipient,`nep413.recipient`),i=c(A(e.nonce,`nep413.nonce`)),a=e.callbackUrl==null?void 0:t(e.callbackUrl,`callbackUrl`),o=[];return Z(o,2147484061),q(o,n),Y(o,i),q(o,r),a?(o.push(1),q(o,a)):o.push(0),s(Uint8Array.from(o))}async function ce(e){let n={scope:I(e.scope,`scope`),expires_at_ms:E(e.expiresAtMs,`expiresAtMs`),display_digest:j(c(O(e.displayDigestB64u,`displayDigestB64u`))),intent:{kind:`near_transaction_v1`,operation_id:t(e.operationId,`operationId`),operation_fingerprint:t(e.operationFingerprint,`operationFingerprint`),near_account_id:t(e.nearAccountId,`nearAccountId`),near_network_id:e.nearNetworkId,transactions:e.transactions.map((e,n)=>({receiver_id:t(e.receiverId,`transactions[${n}].receiverId`),action_fingerprint:t(e.actionFingerprint,`transactions[${n}].actionFingerprint`)})),unsigned_transaction_borsh_b64u:k(e.unsignedTransactionBorshB64u,`unsignedTransactionBorshB64u`)},signing_payload:{kind:`near_unsigned_transaction_borsh_v1`,unsigned_transaction_borsh_b64u:k(e.unsignedTransactionBorshB64u,`unsignedTransactionBorshB64u`),expected_signing_digest_b64u:O(e.expectedSigningDigestB64u,`expectedSigningDigestB64u`)}};return{request:n,admissionMaterial:await P(n)}}async function le(e){let n=A(e.nonce,`nonce`),r=e.callbackUrl==null?void 0:t(e.callbackUrl,`callbackUrl`),i=se({message:e.message,recipient:e.recipient,nonce:n,...r?{callbackUrl:r}:{}}),a={scope:I(e.scope,`scope`),expires_at_ms:E(e.expiresAtMs,`expiresAtMs`),display_digest:j(c(O(e.displayDigestB64u,`displayDigestB64u`))),intent:{kind:`nep413_v1`,operation_id:t(e.operationId,`operationId`),operation_fingerprint:t(e.operationFingerprint,`operationFingerprint`),near_account_id:t(e.nearAccountId,`nearAccountId`),near_network_id:e.nearNetworkId,recipient:t(e.recipient,`recipient`),message:t(e.message,`message`),nonce_b64u:n,...r?{callback_url:r}:{}},signing_payload:{kind:`nep413_message_v1`,canonical_message_b64u:i,expected_signing_digest_b64u:O(e.expectedSigningDigestB64u,`expectedSigningDigestB64u`)}};return{request:a,admissionMaterial:await P(a)}}async function ue(e){let n=k(e.delegate.canonicalDelegateBorshB64u,`canonicalDelegateBorshB64u`),r={scope:I(e.scope,`scope`),expires_at_ms:E(e.expiresAtMs,`expiresAtMs`),display_digest:j(c(O(e.displayDigestB64u,`displayDigestB64u`))),intent:{kind:`near_delegate_action_v1`,operation_id:t(e.operationId,`operationId`),operation_fingerprint:t(e.operationFingerprint,`operationFingerprint`),near_account_id:t(e.nearAccountId,`nearAccountId`),near_network_id:e.nearNetworkId,delegate:{sender_id:t(e.delegate.senderId,`delegate.senderId`),receiver_id:t(e.delegate.receiverId,`delegate.receiverId`),public_key:t(e.delegate.publicKey,`delegate.publicKey`),nonce:t(e.delegate.nonce,`delegate.nonce`),max_block_height:t(e.delegate.maxBlockHeight,`delegate.maxBlockHeight`),action_fingerprint:t(e.delegate.actionFingerprint,`delegate.actionFingerprint`),canonical_delegate_borsh_b64u:n}},signing_payload:{kind:`near_delegate_action_v1`,canonical_delegate_borsh_b64u:n,expected_signing_digest_b64u:O(e.expectedSigningDigestB64u,`expectedSigningDigestB64u`)}};return{request:r,admissionMaterial:await P(r)}}function N(e){let n=I(e.scope,`scope`),r={scope:n,expires_at_ms:E(e.expiresAtMs,`expiresAtMs`),prepare_binding:{server_round1_handle:t(e.prepareResponse.server_round1_handle,`server_round1_handle`),round1_binding_digest:L(e.prepareResponse.round1_binding_digest,`round1_binding_digest`),intent_digest:L(e.admissionMaterial.intentDigest,`intent_digest`),signing_payload_digest:L(e.admissionMaterial.signingPayloadDigest,`signing_payload_digest`)},protocol:{kind:`ed25519_two_party_frost_finalize_v1`,client_commitments:z(e.clientCommitments,`clientCommitments`),server_commitments:z(e.prepareResponse.server_commitments,`serverCommitments`),client_verifying_share_b64u:t(e.clientVerifyingShareB64u,`clientVerifyingShareB64u`),server_verifying_share_b64u:t(e.prepareResponse.server_verifying_share_b64u,`serverVerifyingShareB64u`),client_signature_share_b64u:t(e.clientSignatureShareB64u,`clientSignatureShareB64u`)}};if(n.authorization.kind===`reusable_wallet_session`&&e.prepareResponse.scope.authorization.kind===`reusable_wallet_session`)return{...r,scope:{...n,authorization:n.authorization},authorized_operation:V(e.prepareResponse.authorized_operation,`authorized_operation`)};if(n.authorization.kind===`operation_step_up`&&e.prepareResponse.scope.authorization.kind===`operation_step_up`)return{...r,scope:{...n,authorization:n.authorization},authorized_operation:H(e.prepareResponse.authorized_operation,`authorized_operation`)};throw Error(`Router A/B normal-signing authorization changed after prepare`)}async function P(e){let t=j(await Q(Se(e.intent))),n=j(await Q(Ce(e.signing_payload))),r=j(await Q(we(e.signing_payload))),i=c(Te(e.signing_payload));if(!De(r.bytes,i))throw Error(`Router A/B normal-signing expected signing digest drift`);return{intentDigest:t,signingPayloadDigest:n,admittedSigningDigest:r}}function F(e,t,n){let r=Object.keys(e).sort(),i=[...t].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${n} has invalid fields`)}function I(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);F(r,[`request_id`,`account_id`,`authorization`,`material_activation`,`signing_worker_id`],n);let i={request_id:t(r.request_id,`${n}.request_id`),account_id:t(r.account_id,`${n}.account_id`),authorization:y(r.authorization),material_activation:v(r.material_activation),signing_worker_id:t(r.signing_worker_id,`${n}.signing_worker_id`)};if(i.material_activation.signing_worker!==i.signing_worker_id)throw Error(`${n} material activation SigningWorker mismatch`);return i}function L(e,t){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`${t} must be an object`);return{bytes:D(n.bytes,`${t}.bytes`,32)}}function R(e,t){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`${t} must be an object`);let r=D(n.bytes,`${t}.bytes`);if(r.length===0)throw Error(`${t}.bytes must be non-empty`);return{bytes:r}}function z(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);return{hiding:t(r.hiding,`${n}.hiding`),binding:t(r.binding,`${n}.binding`)}}function B(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);return{server_id:t(r.server_id,`${n}.server_id`),key_epoch:t(r.key_epoch,`${n}.key_epoch`),recipient_encryption_key:t(r.recipient_encryption_key,`${n}.recipient_encryption_key`)}}function V(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);F(r,[`kind`,`authorized_operation_id`,`operation_id`,`capability_kind`,`operation_kind`,`lane_digest_b64u`,`intent_digest_b64u`,`display_digest_b64u`,`operation_fingerprint_digest`],n);let i=t(r.kind,`${n}.kind`);if(i!==`reusable_wallet_session_authorized_operation_v1`)throw Error(`${n}.kind is invalid`);let a=t(r.capability_kind,`${n}.capability_kind`);if(a!==`near_ed25519_mpc_signing`)throw Error(`${n}.capability_kind is invalid`);let o=t(r.operation_kind,`${n}.operation_kind`);if(o!==`near.sign_transaction`&&o!==`near.sign_delegate_action`&&o!==`near.sign_nep413_message`)throw Error(`${n}.operation_kind is invalid`);return{kind:i,authorized_operation_id:t(r.authorized_operation_id,`${n}.authorized_operation_id`),operation_id:t(r.operation_id,`${n}.operation_id`),capability_kind:a,operation_kind:o,lane_digest_b64u:O(r.lane_digest_b64u,`${n}.lane_digest_b64u`),intent_digest_b64u:O(r.intent_digest_b64u,`${n}.intent_digest_b64u`),display_digest_b64u:O(r.display_digest_b64u,`${n}.display_digest_b64u`),operation_fingerprint_digest:O(r.operation_fingerprint_digest,`${n}.operation_fingerprint_digest`)}}function H(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);if(F(r,[`kind`,`authorization_session_id`,`evidence_set_digest`,`authorized_operation_id`,`operation_id`,`capability_kind`,`operation_kind`,`lane_digest_b64u`,`intent_digest_b64u`,`display_digest_b64u`,`operation_fingerprint_digest`],n),t(r.kind,`${n}.kind`)!==`verified_step_up_authorized_operation_v1`)throw Error(`${n}.kind is invalid`);if(t(r.capability_kind,`${n}.capability_kind`)!==`near_ed25519_mpc_signing`)throw Error(`${n}.capability_kind is invalid`);let i=t(r.operation_kind,`${n}.operation_kind`);if(i!==`near.sign_transaction`&&i!==`near.sign_delegate_action`&&i!==`near.sign_nep413_message`)throw Error(`${n}.operation_kind is invalid`);return{kind:`verified_step_up_authorized_operation_v1`,authorization_session_id:t(r.authorization_session_id,`${n}.authorization_session_id`),evidence_set_digest:O(r.evidence_set_digest,`${n}.evidence_set_digest`),authorized_operation_id:t(r.authorized_operation_id,`${n}.authorized_operation_id`),operation_id:t(r.operation_id,`${n}.operation_id`),capability_kind:`near_ed25519_mpc_signing`,operation_kind:i,lane_digest_b64u:O(r.lane_digest_b64u,`${n}.lane_digest_b64u`),intent_digest_b64u:O(r.intent_digest_b64u,`${n}.intent_digest_b64u`),display_digest_b64u:O(r.display_digest_b64u,`${n}.display_digest_b64u`),operation_fingerprint_digest:O(r.operation_fingerprint_digest,`${n}.operation_fingerprint_digest`)}}function U(e){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`Router A/B normal-signing prepare response must be an object`);let r=t(n.signature_scheme,`signature_scheme`);if(r!==`ed25519_v1`)throw Error(`Unsupported Router A/B normal-signing signature scheme: ${r}`);let i=I(n.scope,`scope`),a={scope:i,signing_payload_digest:L(n.signing_payload_digest,`signing_payload_digest`),round1_binding_digest:L(n.round1_binding_digest,`round1_binding_digest`),signing_worker:B(n.signing_worker,`signing_worker`),server_round1_handle:t(n.server_round1_handle,`server_round1_handle`),server_commitments:z(n.server_commitments,`server_commitments`),server_verifying_share_b64u:t(n.server_verifying_share_b64u,`server_verifying_share_b64u`),signature_scheme:`ed25519_v1`,prepared_at_ms:E(n.prepared_at_ms,`prepared_at_ms`),expires_at_ms:E(n.expires_at_ms,`expires_at_ms`)};switch(i.authorization.kind){case`reusable_wallet_session`:return F(n,[`scope`,`signing_payload_digest`,`round1_binding_digest`,`signing_worker`,`server_round1_handle`,`server_commitments`,`server_verifying_share_b64u`,`signature_scheme`,`prepared_at_ms`,`expires_at_ms`,`authorized_operation`],`Router A/B reusable Wallet Session prepare response`),{...a,scope:{...i,authorization:i.authorization},authorized_operation:V(n.authorized_operation,`authorized_operation`)};case`operation_step_up`:return F(n,[`scope`,`signing_payload_digest`,`round1_binding_digest`,`signing_worker`,`server_round1_handle`,`server_commitments`,`server_verifying_share_b64u`,`signature_scheme`,`prepared_at_ms`,`expires_at_ms`,`authorized_operation`],`Router A/B operation step-up prepare response`),{...a,scope:{...i,authorization:i.authorization},authorized_operation:H(n.authorized_operation,`authorized_operation`)}}}function de(e){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`Router A/B normal-signing response must be an object`);F(n,[`scope`,`signing_payload_digest`,`signing_worker`,`signature_scheme`,`signature`,`signed_at_ms`],`Router A/B normal-signing response`);let r=t(n.signature_scheme,`signature_scheme`);if(r!==`ed25519_v1`)throw Error(`Unsupported Router A/B normal-signing signature scheme: ${r}`);return{scope:I(n.scope,`scope`),signing_payload_digest:L(n.signing_payload_digest,`signing_payload_digest`),signing_worker:B(n.signing_worker,`signing_worker`),signature_scheme:`ed25519_v1`,signature:R(n.signature,`signature`),signed_at_ms:E(n.signed_at_ms,`signed_at_ms`)}}function fe(e){let t=e.credential.kind===`wallet_session_opaque`?{token:e.credential.walletSessionToken,home:e.credential.home}:null;return i({...t?{headers:a(t)}:{},body:e.body})}function pe(e){if(!e.trim())return null;try{let t=JSON.parse(e),n=t&&typeof t==`object`?t:null;if(!n)return null;let r=String(n.code||``).trim(),i=String(n.message||``).trim();if(!r)return null;let a=n.authorization_decision===void 0?void 0:me(n.authorization_decision);return{code:r,message:i,...a?{authorizationDecision:a}:{}}}catch{return null}}function me(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`Router A/B owner-operation authorization decision is invalid`);let t=e,n=t.kind;if(n===`step_up_required`){W(t,[`kind`,`reason`,`step_up`],`owner-operation step-up decision`);let e=t.reason;if(e!==`wallet_session_missing`&&e!==`wallet_session_expired`&&e!==`wallet_session_exhausted`&&e!==`wallet_session_ended`&&e!==`wallet_session_superseded`)throw Error(`owner-operation step-up decision reason is invalid`);let r=t.step_up;return r&&typeof r==`object`&&!Array.isArray(r)&&`operation_digests`in r?{kind:n,reason:e,step_up:_(r)}:{kind:n,reason:e,step_up:he(r)}}if(n===`denied`){if(W(t,[`kind`,`denial`],`owner-operation denial decision`),!t.denial||typeof t.denial!=`object`||Array.isArray(t.denial))throw Error(`owner-operation denial is invalid`);let e=t.denial;W(e,[`code`,`message`],`owner-operation denial`);let r=e.code;if(r!==`invalid_identity`&&r!==`invalid_authority`&&r!==`invalid_operation`&&r!==`inactive_material`&&r!==`replayed_step_up`&&r!==`authorization_unavailable`)throw Error(`owner-operation denial code is invalid`);if(typeof e.message!=`string`||e.message.trim()!==e.message)throw Error(`owner-operation denial message is invalid`);return{kind:n,denial:{code:r,message:e.message}}}if(n===`authorized`){if(W(t,[`kind`,`operation`,`source`],`owner-operation decision`),!t.operation||typeof t.operation!=`object`||Array.isArray(t.operation))throw Error(`owner-operation authorized operation is invalid`);let e=t.operation;if(W(e,[`kind`,`operation_id`,`authorized_operation_id`,`operation_fingerprint_digest`],`owner-operation authorized operation`),e.kind!==`authorized_operation`||typeof e.operation_id!=`string`||typeof e.authorized_operation_id!=`string`||typeof e.operation_fingerprint_digest!=`string`)throw Error(`owner-operation authorized operation is invalid`);if(!t.source||typeof t.source!=`object`||Array.isArray(t.source))throw Error(`owner-operation authorized source is invalid`);let r=t.source;if(W(r,[`kind`,`wallet_session_id`,`quota_id`],`owner-operation authorized source`),r.kind!==`reusable_wallet_session`||typeof r.wallet_session_id!=`string`||typeof r.quota_id!=`string`)throw Error(`owner-operation authorized source is invalid`);return{kind:n,operation:{kind:`authorized_operation`,operation_id:e.operation_id,authorized_operation_id:e.authorized_operation_id,operation_fingerprint_digest:e.operation_fingerprint_digest},source:{kind:`reusable_wallet_session`,wallet_session_id:r.wallet_session_id,quota_id:r.quota_id}}}throw Error(`owner-operation authorization decision kind is invalid`)}function he(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`Ed25519 operation step-up preparation is invalid`);let t=e;W(t,[`wallet_id`,`operation_kind`,`operation_id`,`request_id`,`account_id`,`material_activation`,`signing_worker_id`,`near_account_id`,`signer_slot`,`participant_ids`,`expires_at_ms`],`Ed25519 owner-operation step-up preparation`);let n=t.operation_kind;if(n!==`near.sign_transaction`&&n!==`near.sign_delegate_action`&&n!==`near.sign_nep413_message`)throw Error(`Ed25519 operation step-up kind is invalid`);if(typeof t.wallet_id!=`string`||typeof t.operation_id!=`string`||typeof t.request_id!=`string`||typeof t.account_id!=`string`||typeof t.signing_worker_id!=`string`||typeof t.near_account_id!=`string`||!Number.isSafeInteger(t.signer_slot)||!Number.isSafeInteger(t.expires_at_ms)||!Array.isArray(t.participant_ids)||t.participant_ids.length!==2||!t.participant_ids.every(e=>Number.isSafeInteger(e)&&Number(e)>0))throw Error(`Ed25519 operation step-up preparation fields are invalid`);let[r,i]=t.participant_ids,a=t.signer_slot,o=t.expires_at_ms;if(typeof r!=`number`||typeof i!=`number`||typeof a!=`number`||typeof o!=`number`)throw Error(`Ed25519 operation step-up participants are invalid`);return{wallet_id:t.wallet_id,operation_kind:n,operation_id:t.operation_id,request_id:t.request_id,account_id:t.account_id,material_activation:v(t.material_activation),signing_worker_id:t.signing_worker_id,near_account_id:t.near_account_id,signer_slot:a,participant_ids:[r,i],expires_at_ms:o}}function W(e,t,n){let r=new Set(t);for(let t of Object.keys(e))if(!r.has(t))throw Error(`${n} contains unsupported field ${t}`);for(let r of t)if(!Object.hasOwn(e,r))throw Error(`${n} is missing ${r}`)}function ge(e){let t=pe(e.bodyText);return t?ae({code:t.code,message:t.message,path:e.path,status:e.status,authorizationDecision:t.authorizationDecision})||te({code:t.code,message:`Router A/B signing ${e.path} returned HTTP ${e.status}: ${t.message}`})||new T({code:t.code,message:t.message,path:e.path,status:e.status}):Error(`Router A/B signing ${e.path} returned HTTP ${e.status}${e.bodyText?`: ${e.bodyText}`:``}`)}async function G(e){if(typeof fetch!=`function`)throw Error(`fetch is not available for Router A/B normal-signing request`);let n=r(t(e.relayServerUrl,`relayServerUrl`)),i=await o(new Request(`${n}${e.path}`,{...fe({credential:e.credential,body:e.body}),signal:e.signal}));try{e.onServerTiming?.(i.headers.get(`Server-Timing`))}catch{}if(!i.ok){let t=await i.text().catch(()=>``),n=ge({path:e.path,status:i.status,bodyText:t});throw e.credential.kind===`wallet_session_opaque`&&n instanceof S&&n.failure.kind===`exhausted`&&ee.forgetCredential(e.credential.walletSessionToken),n}return e.parse(await i.json())}function _e(e,t){let r=n(t,`Ed25519 prepare response`);if(r.kind!==e.scope.authorization.kind)throw Error(`Ed25519 prepare authorization kind does not match the request`);let i=U(r.signing);if(e.scope.authorization.kind===`operation_step_up`)return W(r,[`kind`,`signing`],`Ed25519 step-up prepare response`),{kind:`operation_step_up`,signing:i};W(r,[`kind`,`signing`,`session_status`],`Ed25519 session prepare response`);let a=n(r.session_status,`Ed25519 prepare session status`),o=f(e.scope.authorization.wallet_session_id),s=d(a.quotaId);if(!o.ok||!s.ok)throw Error(`Invalid Ed25519 prepare session identity`);let c=x(a,{walletSessionId:o.value,quotaId:s.value});if(!c||c.status!==`active`)throw Error(`Ed25519 prepare did not return an active Wallet Session`);return{kind:`reusable_wallet_session`,signing:i,sessionStatus:c}}async function ve(e){return G({relayServerUrl:e.relayServerUrl,path:`/router-ab/ed25519/sign/prepare`,credential:e.credential,body:e.request,parse:_e.bind(null,e.request)})}async function ye(e){return await h(e.request),G({relayServerUrl:e.relayServerUrl,path:`/router-ab/ecdsa-derivation/sign/prepare`,onServerTiming:e.onServerTiming,credential:e.credential,body:e.request,parse:re.bind(null,e.request)})}async function be(e){return G({relayServerUrl:e.relayServerUrl,path:`/router-ab/ed25519/sign`,credential:e.credential,body:e.request,parse:de})}async function xe(e){return await g(e.request),G({relayServerUrl:e.relayServerUrl,path:`/router-ab/ecdsa-derivation/sign`,onServerTiming:e.onServerTiming,credential:e.credential,body:e.request,parse:t=>m(e.request,t)})}function Se(e){let t=[];switch(J(t,$(`router-ab-protocol/ed25519-normal-signing/intent/v2`)),e.kind){case`near_transaction_v1`:J(t,$(`near_transaction_v1`)),K(t,e),X(t,e.transactions.length);for(let n of e.transactions)J(t,$(n.receiver_id)),J(t,$(n.action_fingerprint));return J(t,$(e.unsigned_transaction_borsh_b64u)),Uint8Array.from(t);case`nep413_v1`:return J(t,$(`nep413_v1`)),K(t,e),J(t,$(e.recipient)),J(t,$(e.message)),J(t,$(e.nonce_b64u)),Ee(t,e.callback_url),Uint8Array.from(t);case`near_delegate_action_v1`:return J(t,$(`near_delegate_action_v1`)),K(t,e),J(t,$(e.delegate.sender_id)),J(t,$(e.delegate.receiver_id)),J(t,$(e.delegate.public_key)),J(t,$(e.delegate.nonce)),J(t,$(e.delegate.max_block_height)),J(t,$(e.delegate.action_fingerprint)),J(t,$(e.delegate.canonical_delegate_borsh_b64u)),Uint8Array.from(t)}}function Ce(e){let t=[];switch(J(t,$(`router-ab-protocol/ed25519-normal-signing/payload/v2`)),e.kind){case`near_unsigned_transaction_borsh_v1`:return J(t,$(`near_unsigned_transaction_borsh_v1`)),J(t,$(e.unsigned_transaction_borsh_b64u)),J(t,$(e.expected_signing_digest_b64u)),Uint8Array.from(t);case`nep413_message_v1`:return J(t,$(`nep413_message_v1`)),J(t,$(e.canonical_message_b64u)),J(t,$(e.expected_signing_digest_b64u)),Uint8Array.from(t);case`near_delegate_action_v1`:return J(t,$(`near_delegate_action_v1`)),J(t,$(e.canonical_delegate_borsh_b64u)),J(t,$(e.expected_signing_digest_b64u)),Uint8Array.from(t)}}function we(e){switch(e.kind){case`near_unsigned_transaction_borsh_v1`:return c(e.unsigned_transaction_borsh_b64u);case`nep413_message_v1`:return c(e.canonical_message_b64u);case`near_delegate_action_v1`:return c(e.canonical_delegate_borsh_b64u)}}function Te(e){switch(e.kind){case`near_unsigned_transaction_borsh_v1`:case`nep413_message_v1`:case`near_delegate_action_v1`:return e.expected_signing_digest_b64u}}function K(e,t){J(e,$(t.operation_id)),J(e,$(t.operation_fingerprint)),J(e,$(t.near_account_id)),J(e,$(t.near_network_id))}function Ee(e,t){t?(e.push(1),J(e,$(t))):e.push(0)}function q(e,t){let n=$(t);Z(e,n.length),Y(e,n)}function J(e,t){X(e,t.length),Y(e,t)}function Y(e,t){for(let n of t)e.push(n)}function X(e,t){e.push(t>>>24&255,t>>>16&255,t>>>8&255,t&255)}function Z(e,t){e.push(t&255,t>>>8&255,t>>>16&255,t>>>24&255)}async function Q(e){let t=globalThis.crypto?.subtle;if(!t)throw Error(`Web Crypto SHA-256 is unavailable for Router A/B normal signing`);let n=new Uint8Array(e.length);return n.set(e),new Uint8Array(await t.digest(`SHA-256`,n.buffer))}function $(e){return new TextEncoder().encode(e)}function De(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}export{N as a,ye as c,oe as d,C as f,le as i,ve as l,ue as n,xe as o,ne as p,ce as r,be as s,T as t,M as u};