@seams/wallet 0.26.0 → 0.28.0

package/dist/{esm/sdk/nearEd25519YaoSigningPreparation-K6n4Sq8_.js → public/sdk/nearEd25519YaoSigningPreparation-DHNk0F8e.js}

@@ -1 +1 @@
-import{E as e,g as t,i as n}from"./domainIds-t1lp25yU.js";import{t as r}from"./digests-BIaE0DMd.js";import{t as i}from"./activeWalletSession-BJ4B-nJo.js";import{r as a}from"./canonicalPrimitives-Jd3i_Ngz.js";import{a as o,c as s,o as c}from"./ecdsaChainTarget-Lh24LLyA.js";import{l,o as ee}from"./accountIds-Dj_0GoY-.js";import{$ as te,X as ne,et as u,tt as d,ut as f}from"./digestEncoding-n8Kr2kow.js";import{t as p}from"./signerSlot-DgLzb3Ee.js";import{c as m,i as h,l as g,n as _,r as v}from"./walletCapabilityBindings-BRdFdh3l.js";import{C as y,T as b,o as x}from"./emailOtpEcdsaDerivationIdentity-0DIuRNRi.js";import{c as S,r as C}from"./types-DOToeB6g.js";function w(e){throw Error(`[SigningSession] unsupported exact signing lane branch: ${String(e)}`)}function T(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[SigningSession] ${t} must be an object`);return e}function E(e,t){let n=String(e??``).trim();if(!n)throw Error(`[SigningSession] ${t} is required`);return n}function D(e,t,n){for(let r of t)if(e[r]!==void 0)throw Error(`[SigningSession] ${n} exact lane cannot include ${r}`)}function O(t){let n=T(t,`exact lane auth`);switch(n.kind){case`voiceid`:{let t=e(n.walletAuthMethodId);if(!t.ok)throw Error(`VoiceID lane method ID is invalid`);return{kind:`voiceid`,walletAuthMethodId:t.value,deviceKeyId:a(n.deviceKeyId)}}case`passkey`:return{kind:`passkey`,rpId:b(n.rpId),credentialIdB64u:E(n.credentialIdB64u,`credentialIdB64u`)};case`email_otp`:return{kind:`email_otp`,providerSubjectId:E(n.providerSubjectId,`providerSubjectId`)};default:throw Error(`[SigningSession] exact lane auth kind is unsupported`)}}function k(e){let t=T(e,`ECDSA exact lane chainTarget`),n=o({kind:t.kind,namespace:t.namespace,chainId:t.chainId,networkSlug:t.networkSlug});if(t.key!=null&&String(t.key)!==c(n))throw Error(`[SigningSession] exact ECDSA lane chain target key mismatch`);return n}function A(e){let t=T(e,`ECDSA exact lane key identity`);if(t.keyScope!==`evm-family`)throw Error(`[SigningSession] exact ECDSA lane keyScope must be evm-family`);return x({walletId:t.walletId,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,participantIds:t.participantIds,thresholdOwnerAddress:t.thresholdOwnerAddress})}function j(e){let n=t(e);if(!n.ok)throw Error(n.error.message);return n.value}function M(e){let t=l(e.nearAccountId);if(!t.ok)throw Error(`[SigningSession] invalid exact Ed25519 NEAR account: ${t.message}`);let n=m({walletId:s(e.walletId)});return ee(t.value)?_({wallet:n,nearAccountId:t.value}):v({wallet:n,nearAccountId:t.value})}function N(e){let t=Number(e.signerSlot);if(!Number.isSafeInteger(t)||t<1)throw Error(`[SigningSession] exact Ed25519 signer requires signerSlot >= 1`);return h({account:M({walletId:e.walletId,nearAccountId:e.nearAccountId}),nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:t})}function P(e){if(String(e.key.walletId)!==String(e.walletId))throw Error(`[SigningSession] exact ECDSA lane identity wallet mismatch`);let t=j(e.materialActivation);if(String(t.materialOwner)!==String(e.walletId))throw Error(`[SigningSession] exact ECDSA lane material owner mismatch`);return{kind:`evm_family_ecdsa_signer`,walletId:s(e.walletId),chainTarget:e.chainTarget,keyHandle:e.keyHandle,key:e.key,materialActivation:t}}function F(e){let t=T(e,`ECDSA exact lane signer`);if(t.kind!==`evm_family_ecdsa_signer`)throw Error(`[SigningSession] expected EVM-family ECDSA signer`);let n=k(t.chainTarget),r=A(t.key);return P({walletId:s(t.walletId),chainTarget:n,keyHandle:y(t.keyHandle),key:r,materialActivation:j(t.materialActivation)})}function I(e){return e.kind===`evm`?{key:c(e),kind:`evm`,namespace:`eip155`,chainId:e.chainId}:{key:c(e),kind:`tempo`,chainId:e.chainId}}function L(e){return{walletId:String(e.walletId),keyScope:e.keyScope,ecdsaThresholdKeyId:String(e.ecdsaThresholdKeyId),signingRootId:String(e.signingRootId),signingRootVersion:String(e.signingRootVersion),participantIds:[...e.participantIds].map(e=>Number(e)),thresholdOwnerAddress:String(e.thresholdOwnerAddress).toLowerCase()}}function R(e){switch(e.kind){case`voiceid`:return{kind:`voiceid`,walletAuthMethodId:e.walletAuthMethodId,deviceKeyId:e.deviceKeyId};case`passkey`:return{kind:`passkey`,rpId:String(e.rpId),credentialIdB64u:String(e.credentialIdB64u)};case`email_otp`:return{kind:`email_otp`,providerSubjectId:String(e.providerSubjectId)};default:return w(e)}}function z(e){return{kind:`evm_family_ecdsa_signer`,walletId:String(e.walletId),keyHandle:String(e.keyHandle),chainTarget:I(e.chainTarget),key:L(e.key),materialActivation:{kind:e.materialActivation.kind,activationId:String(e.materialActivation.activationId),capability:String(e.materialActivation.capability),materialOwner:String(e.materialActivation.materialOwner),keyBinding:String(e.materialActivation.keyBinding),lifecycleBinding:String(e.materialActivation.lifecycleBinding),signingWorker:String(e.materialActivation.signingWorker)}}}function B(e){return Z(e)?{kind:`exact_signing_lane`,signer:z(e.signer),auth:R(e.auth)}:{kind:`exact_signing_lane`,signer:{kind:`near_ed25519_signer`,account:{kind:e.signer.account.kind,walletId:String(e.signer.account.wallet.walletId),nearAccountId:String(e.signer.account.nearAccountId)},nearEd25519SigningKeyId:String(e.signer.nearEd25519SigningKeyId),signerSlot:Number(e.signer.signerSlot)},auth:R(e.auth),walletSessionId:String(e.walletSessionId),quotaId:String(e.quotaId),thresholdSessionId:String(e.thresholdSessionId)}}function V(e){return r(B(e))}function H(e){return{kind:`exact_signing_lane`,signer:e.signer,auth:e.auth,walletSessionId:C.walletSession(e.walletSessionId),quotaId:C.walletSessionQuota(e.quotaId),thresholdSessionId:C.thresholdEd25519Session(e.thresholdSessionId)}}function U(e){return{kind:`exact_ed25519_export_material`,signer:e.signer,auth:e.auth,thresholdSessionId:C.thresholdEd25519Session(e.thresholdSessionId)}}function W(e){return{kind:`exact_signing_lane`,signer:e.signer,auth:e.auth}}function G(e){return e.identity}function K(e){return e.identity}function q(e){return e.identity}function J(e){let t=T(e,`exact Ed25519 export material identity`);if(t.kind!==`exact_ed25519_export_material`)throw Error(`[SigningSession] expected exact Ed25519 export material identity`);D(t,[`walletSessionId`,`quotaId`,`walletId`,`nearAccountId`,`nearEd25519SigningKeyId`,`chainTarget`,`keyHandle`,`key`,`curve`,`chainFamily`,`accountId`,`subjectId`,`authMethod`,`authorization`],`nested`);let n=g(T(t.signer,`exact Ed25519 export material signer`));if(!n.ok)throw Error(n.error.message);return U({signer:n.value,auth:O(t.auth),thresholdSessionId:t.thresholdSessionId})}function Y(e){let t=X(e);if(Z(t))return t;throw Error(`[SigningSession] expected exact ECDSA lane identity`)}function X(e){let t=T(e,`exact signing lane identity`);if(t.kind!==`exact_signing_lane`)throw Error(`[SigningSession] expected exact signing lane identity`);D(t,[`walletId`,`nearAccountId`,`nearEd25519SigningKeyId`,`chainTarget`,`keyHandle`,`key`,`curve`,`chainFamily`,`accountId`,`subjectId`,`authMethod`,`authorization`],`nested`);let n=T(t.signer,`exact lane signer`),r=O(t.auth);switch(n.kind){case`near_ed25519_signer`:{let e=g(n);if(!e.ok)throw Error(e.error.message);return H({signer:e.value,auth:r,walletSessionId:t.walletSessionId,quotaId:t.quotaId,thresholdSessionId:t.thresholdSessionId})}case`evm_family_ecdsa_signer`:return W({signer:F(n),auth:r});default:throw Error(`[SigningSession] exact signing lane signer kind is unsupported`)}}function Z(e){return e.signer.kind===`evm_family_ecdsa_signer`}function re(e){switch(e.signer.kind){case`near_ed25519_signer`:return e.signer.account.wallet.walletId;case`evm_family_ecdsa_signer`:return e.signer.walletId;default:return w(e.signer)}}function ie(e,t){if(e.signer.kind!==`evm_family_ecdsa_signer`)throw Error(`[SigningSession] ${t} requires an EVM-family ECDSA signer`);return e.signer}function ae(e,t){if(e.signer.kind!==`near_ed25519_signer`)throw Error(`[SigningSession] ${t} requires a NEAR Ed25519 signer`);return e.signer}function oe(e,t=`NEAR protocol projection`){let n=ae(e,t);return{walletId:n.account.wallet.walletId,nearAccountId:n.account.nearAccountId,nearEd25519SigningKeyId:n.nearEd25519SigningKeyId,signerSlot:n.signerSlot}}function se(e,t){return V(e)===V(t)}function ce(e){return String(d(e.authority))}function le(e){return u(e.authority)}function ue(e){return te(e.authority)}function de(e){switch(e.use.kind){case`session`:return`session`;case`single_use_pending`:case`single_use_consumed`:return`single_use`}throw e.use,Error(`[SigningSession] unsupported Email OTP auth use`)}function fe(e){return e.use.kind===`single_use_consumed`?e.use.consumedAtMs:null}function pe(e){return e.use.kind===`session`}function me(e){return e.use.kind===`single_use_pending`}function Q(e){if(e.policy===`per_operation`&&e.retention!==`single_use`)throw Error(`Invalid Email OTP auth context: per-operation sessions must be single-use`);if(e.retention===`single_use`&&Object.prototype.hasOwnProperty.call(e,`reason`))throw Error(`Invalid Email OTP auth context: single-use sessions must not carry reason`);let t=Math.floor(Number(e.consumedAtMs)||0),n=e.retention===`session`?{kind:`session`,reason:e.reason}:t>0?{kind:`single_use_consumed`,consumedAtMs:t}:{kind:`single_use_pending`};return{policy:e.policy,authMethod:`email_otp`,authority:e.authority,use:n}}function he(e){let t=e.authority;if(e.retention===`session`)return Q({policy:e.policy,reason:e.reason,retention:`session`,authority:t});if(Object.prototype.hasOwnProperty.call(e,`reason`))throw Error(`Invalid Email OTP auth context: single-use sessions must not carry reason`);let n=Math.floor(Number(e.consumedAtMs)||0);return Q(n>0?{policy:e.policy,retention:`single_use`,authority:t,consumedAtMs:n}:{policy:e.policy,retention:`single_use`,authority:t})}function ge(e){let t=ne({walletId:e.walletId,provider:e.provider,providerUserId:e.providerUserId,emailHashHex:e.emailHashHex});if(e.retention===`session`)return Q({policy:e.policy,reason:e.reason,retention:`session`,authority:t});if(Object.prototype.hasOwnProperty.call(e,`reason`))throw Error(`Invalid Email OTP auth context: single-use sessions must not carry reason`);let n=Math.floor(Number(e.consumedAtMs)||0);return Q(n>0?{policy:e.policy,retention:`single_use`,authority:t,consumedAtMs:n}:{policy:e.policy,retention:`single_use`,authority:t})}function _e(e){let t=p(e.signerSlot);if(t==null)throw Error(`[SigningSession] selected Ed25519 lane requires signerSlot >= 1`);let n=C.walletSession(e.walletSessionId),r=C.walletSessionQuota(e.quotaId),i=C.thresholdEd25519Session(e.thresholdSessionId);return{kind:`selected_lane`,identity:H({signer:N({walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:t}),auth:e.auth,walletSessionId:n,quotaId:r,thresholdSessionId:i}),auth:e.auth,curve:`ed25519`,chain:`near`,walletSessionId:n,quotaId:r,thresholdSessionId:i}}function ve(e){if(!e.key)throw Error(`[SigningSession] selected ECDSA lane requires shared key identity`);let t=y(e.keyHandle);if(String(e.key.walletId)!==String(e.walletId))throw Error(`[SigningSession] selected ECDSA lane wallet mismatch`);return{kind:`selected_lane`,identity:W({signer:P({walletId:e.walletId,chainTarget:e.chainTarget,keyHandle:t,key:e.key,materialActivation:e.materialActivation}),auth:e.auth}),auth:e.auth,curve:`ecdsa`,chain:e.chainTarget.kind,materialActivation:e.materialActivation,authorization:e.authorization}}function ye(e){let t=Math.floor(Number(e.nowMs)||Date.now());return e.expiresAtMs<=t?`expired`:e.remainingUses<=0?`exhausted`:`ready`}function be(e){return S(e.auth)}function xe(e){switch(e.kind){case`found`:return{kind:`authorized`,authorization:e.authorization};case`expired`:case`exhausted`:return{kind:`operation_step_up`,reason:e.kind};case`persistence_unavailable`:return{kind:`temporarily_unavailable`,reason:e.kind};case`missing`:case`corrupt`:case`upgrade_required`:case`superseded`:case`authority_unavailable`:case`method_unavailable`:case`capability_unavailable`:case`unavailable`:return{kind:`full_login_required`,reason:e.kind};default:throw Error(`[SigningEngine][near] unsupported Wallet Session authorization state`)}}function Se(e){switch(e.kind){case`use_live_runtime`:case`rehydrate_material_activation`:case`reauthorize_public_anchor`:return e.authority;case`blocked`:return null;default:throw Error(`[SigningEngine][near] unsupported MPC hydration plan`)}}function Ce(e){let{selectedAuthority:t,selectedAuthMethod:n,selectedFactorAuthority:r}=e;return t.state!==`active`||t.walletId!==n.walletId||t.authorityId!==n.walletAuthorityId||t.signerActivations.ed25519===void 0||r.walletId!==n.walletId||r.bindingId!==n.walletAuthMethodId?!1:n.kind===`voiceid`?r.factor.kind===`voiceid`&&r.factor.deviceKeyId===n.deviceKeyId&&r.verifier.kind===`device_signature`:n.kind===`passkey`?r.factor.kind===`passkey`&&r.factor.credentialIdB64u===n.credentialIdB64u&&r.verifier.kind===`webauthn`&&r.verifier.rpId===n.rpId:r.factor.kind===`email_otp`&&r.verifier.kind===`email_otp_wallet_auth_method`&&r.verifier.emailHashHex===n.emailHashHex&&r.factor.providerUserId.trim().length>0}function we(e){let{authorization:t,nowMs:n}=e,{selectedAuthority:r,selectedAuthMethod:a,session:o,operationCredential:s,status:c}=t;return!(!Ce({selectedAuthority:r,selectedAuthMethod:a,selectedFactorAuthority:t.selectedFactorAuthority})||o.kind!==`active_wallet_session_v1`||o.walletId!==r.walletId||o.authorityId!==r.authorityId||o.authMethodId!==a.walletAuthMethodId||o.authorityDigestB64u!==r.authorityDigestB64u||o.authorityRevocationEpoch!==r.revocationEpoch||s.kind!==`opaque_wallet_session_operation_credential_v1`||s.token.trim().length===0||s.walletSessionId.trim().length===0||o.authorizationId.trim().length===0||o.quotaId.trim().length===0||o.expiresAtMs<=n||c.status!==`active`||c.walletSessionId!==s.walletSessionId||c.quotaId!==o.quotaId||c.remainingUses<=0||c.expiresAtMs<=n||c.quotaLifecycle!==`active`||c.authorization.expiresAtMs!==o.expiresAtMs||!i(c.authorization,o))}function $(e){let t=0;for(let r of e.session.capabilitySubjects)r.kind===`sign`&&r.keyFamily===`ed25519`&&n(r.materialActivation,e.materialActivation)&&(t+=1);return t===1}async function Te(e){let t=Se(e.hydration);if(!t)return;let n=await f({authority:e.authorization.selectedFactorAuthority});if(t.walletId!==n.walletId||t.walletAuthMethodId!==n.walletAuthMethodId||t.authorityDigest!==n.authorityDigest)throw Error(`[SigningEngine][near] Wallet Session authorization does not match material authority`)}function Ee(e){let{requirement:t,authorization:n}=e;if(t.kind!==n.selectedAuthMethod.kind)throw Error(`[SigningEngine][near] Wallet Session authorization does not match material factor`);if(t.kind===`voiceid`){if(n.selectedAuthMethod.kind!==`voiceid`||t.walletAuthMethodId!==n.selectedAuthMethod.walletAuthMethodId||t.deviceKeyId!==n.selectedAuthMethod.deviceKeyId)throw Error(`[SigningEngine][near] Wallet Session authorization does not match VoiceID factor`);return}if(t.kind===`passkey`){if(n.selectedAuthMethod.kind!==`passkey`||String(t.rpId)!==String(n.selectedAuthMethod.rpId)||t.credentialIdB64u!==n.selectedAuthMethod.credentialIdB64u)throw Error(`[SigningEngine][near] Wallet Session authorization does not match Passkey factor`);return}if(n.selectedAuthMethod.kind!==`email_otp`||n.selectedFactorAuthority.factor.kind!==`email_otp`||t.providerSubjectId!==n.selectedFactorAuthority.factor.providerUserId)throw Error(`[SigningEngine][near] Wallet Session authorization does not match Email OTP factor`)}function De(e){if(!Number.isSafeInteger(e.nowMs)||e.nowMs<0)throw Error(`[SigningEngine][near] Wallet Session authorization requires a valid timestamp`);let t={kind:`exact_near_ed25519_wallet_session_authorization_v1`,selectedAuthority:e.selectedAuthority,selectedAuthMethod:e.selectedAuthMethod,selectedFactorAuthority:e.selectedFactorAuthority,session:e.session,operationCredential:e.operationCredential,status:e.status};if(!we({authorization:t,nowMs:e.nowMs}))throw Error(`[SigningEngine][near] Exact Wallet Session authorization identity is invalid`);return t}async function Oe(e){return Ee(e),await Te(e),{kind:`near_ed25519_yao_signing_preparation`,hydration:e.hydration,authorization:{kind:`authorized`,authorization:e.authorization}}}function ke(e){return{kind:`near_ed25519_yao_signing_preparation`,hydration:e.hydration,authorization:{kind:`authorization_required`,requirement:e.requirement}}}export{Z as A,U as C,V as D,G as E,ie as F,oe as M,Y as N,se as O,J as P,q as S,K as T,ye as _,$ as a,P as b,he as c,le as d,ce as f,be as g,pe as h,xe as i,N as j,re as k,fe as l,me as m,ke as n,Q as o,de as p,Oe as r,ge as s,De as t,ue as u,ve as v,H as w,W as x,_e as y};
+import{E as e,g as t,i as n}from"./domainIds-t1lp25yU.js";import{t as r}from"./digests-BIaE0DMd.js";import{t as i}from"./activeWalletSession-BJ4B-nJo.js";import{r as a}from"./canonicalPrimitives-Jd3i_Ngz.js";import{a as o,c as s,o as c}from"./ecdsaChainTarget-Bm5X4k-V.js";import{l,o as ee}from"./accountIds-CW2BP-d9.js";import{$ as te,X as ne,et as u,tt as d,ut as f}from"./digestEncoding-CqNXPZY9.js";import{t as p}from"./signerSlot-D2RZnb27.js";import{c as m,i as h,l as g,n as _,r as v}from"./walletCapabilityBindings-D5YYB7nN.js";import{C as y,T as b,o as x}from"./emailOtpEcdsaDerivationIdentity-HFQXc1Yw.js";import{c as S,r as C}from"./types-f7dyj5N6.js";function w(e){throw Error(`[SigningSession] unsupported exact signing lane branch: ${String(e)}`)}function T(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[SigningSession] ${t} must be an object`);return e}function E(e,t){let n=String(e??``).trim();if(!n)throw Error(`[SigningSession] ${t} is required`);return n}function D(e,t,n){for(let r of t)if(e[r]!==void 0)throw Error(`[SigningSession] ${n} exact lane cannot include ${r}`)}function O(t){let n=T(t,`exact lane auth`);switch(n.kind){case`voiceid`:{let t=e(n.walletAuthMethodId);if(!t.ok)throw Error(`VoiceID lane method ID is invalid`);return{kind:`voiceid`,walletAuthMethodId:t.value,deviceKeyId:a(n.deviceKeyId)}}case`passkey`:return{kind:`passkey`,rpId:b(n.rpId),credentialIdB64u:E(n.credentialIdB64u,`credentialIdB64u`)};case`email_otp`:return{kind:`email_otp`,providerSubjectId:E(n.providerSubjectId,`providerSubjectId`)};default:throw Error(`[SigningSession] exact lane auth kind is unsupported`)}}function k(e){let t=T(e,`ECDSA exact lane chainTarget`),n=o({kind:t.kind,namespace:t.namespace,chainId:t.chainId,networkSlug:t.networkSlug});if(t.key!=null&&String(t.key)!==c(n))throw Error(`[SigningSession] exact ECDSA lane chain target key mismatch`);return n}function A(e){let t=T(e,`ECDSA exact lane key identity`);if(t.keyScope!==`evm-family`)throw Error(`[SigningSession] exact ECDSA lane keyScope must be evm-family`);return x({walletId:t.walletId,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,participantIds:t.participantIds,thresholdOwnerAddress:t.thresholdOwnerAddress})}function j(e){let n=t(e);if(!n.ok)throw Error(n.error.message);return n.value}function M(e){let t=l(e.nearAccountId);if(!t.ok)throw Error(`[SigningSession] invalid exact Ed25519 NEAR account: ${t.message}`);let n=m({walletId:s(e.walletId)});return ee(t.value)?_({wallet:n,nearAccountId:t.value}):v({wallet:n,nearAccountId:t.value})}function N(e){let t=Number(e.signerSlot);if(!Number.isSafeInteger(t)||t<1)throw Error(`[SigningSession] exact Ed25519 signer requires signerSlot >= 1`);return h({account:M({walletId:e.walletId,nearAccountId:e.nearAccountId}),nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:t})}function P(e){if(String(e.key.walletId)!==String(e.walletId))throw Error(`[SigningSession] exact ECDSA lane identity wallet mismatch`);let t=j(e.materialActivation);if(String(t.materialOwner)!==String(e.walletId))throw Error(`[SigningSession] exact ECDSA lane material owner mismatch`);return{kind:`evm_family_ecdsa_signer`,walletId:s(e.walletId),chainTarget:e.chainTarget,keyHandle:e.keyHandle,key:e.key,materialActivation:t}}function F(e){let t=T(e,`ECDSA exact lane signer`);if(t.kind!==`evm_family_ecdsa_signer`)throw Error(`[SigningSession] expected EVM-family ECDSA signer`);let n=k(t.chainTarget),r=A(t.key);return P({walletId:s(t.walletId),chainTarget:n,keyHandle:y(t.keyHandle),key:r,materialActivation:j(t.materialActivation)})}function I(e){return e.kind===`evm`?{key:c(e),kind:`evm`,namespace:`eip155`,chainId:e.chainId}:{key:c(e),kind:`tempo`,chainId:e.chainId}}function L(e){return{walletId:String(e.walletId),keyScope:e.keyScope,ecdsaThresholdKeyId:String(e.ecdsaThresholdKeyId),signingRootId:String(e.signingRootId),signingRootVersion:String(e.signingRootVersion),participantIds:[...e.participantIds].map(e=>Number(e)),thresholdOwnerAddress:String(e.thresholdOwnerAddress).toLowerCase()}}function R(e){switch(e.kind){case`voiceid`:return{kind:`voiceid`,walletAuthMethodId:e.walletAuthMethodId,deviceKeyId:e.deviceKeyId};case`passkey`:return{kind:`passkey`,rpId:String(e.rpId),credentialIdB64u:String(e.credentialIdB64u)};case`email_otp`:return{kind:`email_otp`,providerSubjectId:String(e.providerSubjectId)};default:return w(e)}}function z(e){return{kind:`evm_family_ecdsa_signer`,walletId:String(e.walletId),keyHandle:String(e.keyHandle),chainTarget:I(e.chainTarget),key:L(e.key),materialActivation:{kind:e.materialActivation.kind,activationId:String(e.materialActivation.activationId),capability:String(e.materialActivation.capability),materialOwner:String(e.materialActivation.materialOwner),keyBinding:String(e.materialActivation.keyBinding),lifecycleBinding:String(e.materialActivation.lifecycleBinding),signingWorker:String(e.materialActivation.signingWorker)}}}function B(e){return Z(e)?{kind:`exact_signing_lane`,signer:z(e.signer),auth:R(e.auth)}:{kind:`exact_signing_lane`,signer:{kind:`near_ed25519_signer`,account:{kind:e.signer.account.kind,walletId:String(e.signer.account.wallet.walletId),nearAccountId:String(e.signer.account.nearAccountId)},nearEd25519SigningKeyId:String(e.signer.nearEd25519SigningKeyId),signerSlot:Number(e.signer.signerSlot)},auth:R(e.auth),walletSessionId:String(e.walletSessionId),quotaId:String(e.quotaId),thresholdSessionId:String(e.thresholdSessionId)}}function V(e){return r(B(e))}function H(e){return{kind:`exact_signing_lane`,signer:e.signer,auth:e.auth,walletSessionId:C.walletSession(e.walletSessionId),quotaId:C.walletSessionQuota(e.quotaId),thresholdSessionId:C.thresholdEd25519Session(e.thresholdSessionId)}}function U(e){return{kind:`exact_ed25519_export_material`,signer:e.signer,auth:e.auth,thresholdSessionId:C.thresholdEd25519Session(e.thresholdSessionId)}}function W(e){return{kind:`exact_signing_lane`,signer:e.signer,auth:e.auth}}function G(e){return e.identity}function K(e){return e.identity}function q(e){return e.identity}function J(e){let t=T(e,`exact Ed25519 export material identity`);if(t.kind!==`exact_ed25519_export_material`)throw Error(`[SigningSession] expected exact Ed25519 export material identity`);D(t,[`walletSessionId`,`quotaId`,`walletId`,`nearAccountId`,`nearEd25519SigningKeyId`,`chainTarget`,`keyHandle`,`key`,`curve`,`chainFamily`,`accountId`,`subjectId`,`authMethod`,`authorization`],`nested`);let n=g(T(t.signer,`exact Ed25519 export material signer`));if(!n.ok)throw Error(n.error.message);return U({signer:n.value,auth:O(t.auth),thresholdSessionId:t.thresholdSessionId})}function Y(e){let t=X(e);if(Z(t))return t;throw Error(`[SigningSession] expected exact ECDSA lane identity`)}function X(e){let t=T(e,`exact signing lane identity`);if(t.kind!==`exact_signing_lane`)throw Error(`[SigningSession] expected exact signing lane identity`);D(t,[`walletId`,`nearAccountId`,`nearEd25519SigningKeyId`,`chainTarget`,`keyHandle`,`key`,`curve`,`chainFamily`,`accountId`,`subjectId`,`authMethod`,`authorization`],`nested`);let n=T(t.signer,`exact lane signer`),r=O(t.auth);switch(n.kind){case`near_ed25519_signer`:{let e=g(n);if(!e.ok)throw Error(e.error.message);return H({signer:e.value,auth:r,walletSessionId:t.walletSessionId,quotaId:t.quotaId,thresholdSessionId:t.thresholdSessionId})}case`evm_family_ecdsa_signer`:return W({signer:F(n),auth:r});default:throw Error(`[SigningSession] exact signing lane signer kind is unsupported`)}}function Z(e){return e.signer.kind===`evm_family_ecdsa_signer`}function re(e){switch(e.signer.kind){case`near_ed25519_signer`:return e.signer.account.wallet.walletId;case`evm_family_ecdsa_signer`:return e.signer.walletId;default:return w(e.signer)}}function ie(e,t){if(e.signer.kind!==`evm_family_ecdsa_signer`)throw Error(`[SigningSession] ${t} requires an EVM-family ECDSA signer`);return e.signer}function ae(e,t){if(e.signer.kind!==`near_ed25519_signer`)throw Error(`[SigningSession] ${t} requires a NEAR Ed25519 signer`);return e.signer}function oe(e,t=`NEAR protocol projection`){let n=ae(e,t);return{walletId:n.account.wallet.walletId,nearAccountId:n.account.nearAccountId,nearEd25519SigningKeyId:n.nearEd25519SigningKeyId,signerSlot:n.signerSlot}}function se(e,t){return V(e)===V(t)}function ce(e){return String(d(e.authority))}function le(e){return u(e.authority)}function ue(e){return te(e.authority)}function de(e){switch(e.use.kind){case`session`:return`session`;case`single_use_pending`:case`single_use_consumed`:return`single_use`}throw e.use,Error(`[SigningSession] unsupported Email OTP auth use`)}function fe(e){return e.use.kind===`single_use_consumed`?e.use.consumedAtMs:null}function pe(e){return e.use.kind===`session`}function me(e){return e.use.kind===`single_use_pending`}function Q(e){if(e.policy===`per_operation`&&e.retention!==`single_use`)throw Error(`Invalid Email OTP auth context: per-operation sessions must be single-use`);if(e.retention===`single_use`&&Object.prototype.hasOwnProperty.call(e,`reason`))throw Error(`Invalid Email OTP auth context: single-use sessions must not carry reason`);let t=Math.floor(Number(e.consumedAtMs)||0),n=e.retention===`session`?{kind:`session`,reason:e.reason}:t>0?{kind:`single_use_consumed`,consumedAtMs:t}:{kind:`single_use_pending`};return{policy:e.policy,authMethod:`email_otp`,authority:e.authority,use:n}}function he(e){let t=e.authority;if(e.retention===`session`)return Q({policy:e.policy,reason:e.reason,retention:`session`,authority:t});if(Object.prototype.hasOwnProperty.call(e,`reason`))throw Error(`Invalid Email OTP auth context: single-use sessions must not carry reason`);let n=Math.floor(Number(e.consumedAtMs)||0);return Q(n>0?{policy:e.policy,retention:`single_use`,authority:t,consumedAtMs:n}:{policy:e.policy,retention:`single_use`,authority:t})}function ge(e){let t=ne({walletId:e.walletId,provider:e.provider,providerUserId:e.providerUserId,emailHashHex:e.emailHashHex});if(e.retention===`session`)return Q({policy:e.policy,reason:e.reason,retention:`session`,authority:t});if(Object.prototype.hasOwnProperty.call(e,`reason`))throw Error(`Invalid Email OTP auth context: single-use sessions must not carry reason`);let n=Math.floor(Number(e.consumedAtMs)||0);return Q(n>0?{policy:e.policy,retention:`single_use`,authority:t,consumedAtMs:n}:{policy:e.policy,retention:`single_use`,authority:t})}function _e(e){let t=p(e.signerSlot);if(t==null)throw Error(`[SigningSession] selected Ed25519 lane requires signerSlot >= 1`);let n=C.walletSession(e.walletSessionId),r=C.walletSessionQuota(e.quotaId),i=C.thresholdEd25519Session(e.thresholdSessionId);return{kind:`selected_lane`,identity:H({signer:N({walletId:e.walletId,nearAccountId:e.nearAccountId,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:t}),auth:e.auth,walletSessionId:n,quotaId:r,thresholdSessionId:i}),auth:e.auth,curve:`ed25519`,chain:`near`,walletSessionId:n,quotaId:r,thresholdSessionId:i}}function ve(e){if(!e.key)throw Error(`[SigningSession] selected ECDSA lane requires shared key identity`);let t=y(e.keyHandle);if(String(e.key.walletId)!==String(e.walletId))throw Error(`[SigningSession] selected ECDSA lane wallet mismatch`);return{kind:`selected_lane`,identity:W({signer:P({walletId:e.walletId,chainTarget:e.chainTarget,keyHandle:t,key:e.key,materialActivation:e.materialActivation}),auth:e.auth}),auth:e.auth,curve:`ecdsa`,chain:e.chainTarget.kind,materialActivation:e.materialActivation,authorization:e.authorization}}function ye(e){let t=Math.floor(Number(e.nowMs)||Date.now());return e.expiresAtMs<=t?`expired`:e.remainingUses<=0?`exhausted`:`ready`}function be(e){return S(e.auth)}function xe(e){switch(e.kind){case`found`:return{kind:`authorized`,authorization:e.authorization};case`expired`:case`exhausted`:return{kind:`operation_step_up`,reason:e.kind};case`persistence_unavailable`:return{kind:`temporarily_unavailable`,reason:e.kind};case`missing`:case`corrupt`:case`upgrade_required`:case`superseded`:case`authority_unavailable`:case`method_unavailable`:case`capability_unavailable`:case`unavailable`:return{kind:`full_login_required`,reason:e.kind};default:throw Error(`[SigningEngine][near] unsupported Wallet Session authorization state`)}}function Se(e){switch(e.kind){case`use_live_runtime`:case`rehydrate_material_activation`:case`reauthorize_public_anchor`:return e.authority;case`blocked`:return null;default:throw Error(`[SigningEngine][near] unsupported MPC hydration plan`)}}function Ce(e){let{selectedAuthority:t,selectedAuthMethod:n,selectedFactorAuthority:r}=e;return t.state!==`active`||t.walletId!==n.walletId||t.authorityId!==n.walletAuthorityId||t.signerActivations.ed25519===void 0||r.walletId!==n.walletId||r.bindingId!==n.walletAuthMethodId?!1:n.kind===`voiceid`?r.factor.kind===`voiceid`&&r.factor.deviceKeyId===n.deviceKeyId&&r.verifier.kind===`device_signature`:n.kind===`passkey`?r.factor.kind===`passkey`&&r.factor.credentialIdB64u===n.credentialIdB64u&&r.verifier.kind===`webauthn`&&r.verifier.rpId===n.rpId:r.factor.kind===`email_otp`&&r.verifier.kind===`email_otp_wallet_auth_method`&&r.verifier.emailHashHex===n.emailHashHex&&r.factor.providerUserId.trim().length>0}function we(e){let{authorization:t,nowMs:n}=e,{selectedAuthority:r,selectedAuthMethod:a,session:o,operationCredential:s,status:c}=t;return!(!Ce({selectedAuthority:r,selectedAuthMethod:a,selectedFactorAuthority:t.selectedFactorAuthority})||o.kind!==`active_wallet_session_v1`||o.walletId!==r.walletId||o.authorityId!==r.authorityId||o.authMethodId!==a.walletAuthMethodId||o.authorityDigestB64u!==r.authorityDigestB64u||o.authorityRevocationEpoch!==r.revocationEpoch||s.kind!==`opaque_wallet_session_operation_credential_v1`||s.token.trim().length===0||s.walletSessionId.trim().length===0||o.authorizationId.trim().length===0||o.quotaId.trim().length===0||o.expiresAtMs<=n||c.status!==`active`||c.walletSessionId!==s.walletSessionId||c.quotaId!==o.quotaId||c.remainingUses<=0||c.expiresAtMs<=n||c.quotaLifecycle!==`active`||c.authorization.expiresAtMs!==o.expiresAtMs||!i(c.authorization,o))}function $(e){let t=0;for(let r of e.session.capabilitySubjects)r.kind===`sign`&&r.keyFamily===`ed25519`&&n(r.materialActivation,e.materialActivation)&&(t+=1);return t===1}async function Te(e){let t=Se(e.hydration);if(!t)return;let n=await f({authority:e.authorization.selectedFactorAuthority});if(t.walletId!==n.walletId||t.walletAuthMethodId!==n.walletAuthMethodId||t.authorityDigest!==n.authorityDigest)throw Error(`[SigningEngine][near] Wallet Session authorization does not match material authority`)}function Ee(e){let{requirement:t,authorization:n}=e;if(t.kind!==n.selectedAuthMethod.kind)throw Error(`[SigningEngine][near] Wallet Session authorization does not match material factor`);if(t.kind===`voiceid`){if(n.selectedAuthMethod.kind!==`voiceid`||t.walletAuthMethodId!==n.selectedAuthMethod.walletAuthMethodId||t.deviceKeyId!==n.selectedAuthMethod.deviceKeyId)throw Error(`[SigningEngine][near] Wallet Session authorization does not match VoiceID factor`);return}if(t.kind===`passkey`){if(n.selectedAuthMethod.kind!==`passkey`||String(t.rpId)!==String(n.selectedAuthMethod.rpId)||t.credentialIdB64u!==n.selectedAuthMethod.credentialIdB64u)throw Error(`[SigningEngine][near] Wallet Session authorization does not match Passkey factor`);return}if(n.selectedAuthMethod.kind!==`email_otp`||n.selectedFactorAuthority.factor.kind!==`email_otp`||t.providerSubjectId!==n.selectedFactorAuthority.factor.providerUserId)throw Error(`[SigningEngine][near] Wallet Session authorization does not match Email OTP factor`)}function De(e){if(!Number.isSafeInteger(e.nowMs)||e.nowMs<0)throw Error(`[SigningEngine][near] Wallet Session authorization requires a valid timestamp`);let t={kind:`exact_near_ed25519_wallet_session_authorization_v1`,selectedAuthority:e.selectedAuthority,selectedAuthMethod:e.selectedAuthMethod,selectedFactorAuthority:e.selectedFactorAuthority,session:e.session,operationCredential:e.operationCredential,status:e.status};if(!we({authorization:t,nowMs:e.nowMs}))throw Error(`[SigningEngine][near] Exact Wallet Session authorization identity is invalid`);return t}async function Oe(e){return Ee(e),await Te(e),{kind:`near_ed25519_yao_signing_preparation`,hydration:e.hydration,authorization:{kind:`authorized`,authorization:e.authorization}}}function ke(e){return{kind:`near_ed25519_yao_signing_preparation`,hydration:e.hydration,authorization:{kind:`authorization_required`,requirement:e.requirement}}}export{Z as A,U as C,V as D,G as E,ie as F,oe as M,Y as N,se as O,J as P,q as S,K as T,ye as _,$ as a,P as b,he as c,le as d,ce as f,be as g,pe as h,xe as i,N as j,re as k,fe as l,me as m,ke as n,Q as o,de as p,Oe as r,ge as s,De as t,ue as u,ve as v,H as w,W as x,_e as y};

package/dist/public/sdk/nearRpcResults-CeHdqaS4.js

@@ -0,0 +1 @@
+var e=(e=>(e.Unknown=`Unknown`,e.Pending=`Pending`,e.Failure=`Failure`,e))(e||{}),t=(e=>(e.NotStarted=`NotStarted`,e.Started=`Started`,e.Failure=`Failure`,e))(t||{});function n(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`Invalid ${t}: expected an object`);return e}function r(e,t){if(typeof e!=`string`)throw Error(`Invalid ${t}: expected a string`);return e}function i(e,t){if(!Array.isArray(e))throw Error(`Invalid ${t}: expected a string array`);let n=[];for(let r of e){if(typeof r!=`string`)throw Error(`Invalid ${t}: expected a string array`);n.push(r)}return n}function a(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`Invalid ${t}: expected a non-negative safe integer`);return e}function o(e,t){if(typeof e==`number`&&!Number.isSafeInteger(e))throw Error(`Invalid ${t}: expected a safe integer or decimal string`);if(typeof e!=`string`&&typeof e!=`number`||!/^\d+$/.test(String(e)))throw Error(`Invalid ${t}: expected an unsigned decimal integer`);return BigInt(e)}function s(e,t){return{block_height:a(e.block_height,`${t}.block_height`),block_hash:r(e.block_hash,`${t}.block_hash`)}}function c(e){let t=n(n(e,`NEAR access key permission`).FunctionCall,`NEAR access key permission.FunctionCall`);return{FunctionCall:{allowance:r(t.allowance,`NEAR access key allowance`),receiver_id:r(t.receiver_id,`NEAR access key receiver_id`),method_names:i(t.method_names,`NEAR access key method_names`)}}}function l(e){return e===`FullAccess`?e:c(e)}function u(e,t){return{...t,nonce:o(e.nonce,`NEAR access key nonce`),permission:l(e.permission)}}function d(e){let t=n(e,`NEAR access key response`);return u(t,s(t,`NEAR access key response`))}function f(e){let t=n(e,`NEAR access key list response`),i=s(t,`NEAR access key list response`);if(!Array.isArray(t.keys))throw Error(`Invalid NEAR access key list response.keys: expected an array`);let a=[];for(let e of t.keys){let t=n(e,`NEAR access key list entry`),o=n(t.access_key,`NEAR access key list entry.access_key`);a.push({public_key:r(t.public_key,`NEAR access key list entry.public_key`),access_key:u(o,i)})}return{...i,keys:a}}function p(e){let t=n(e,`NEAR account response`);return{...s(t,`NEAR account response`),amount:o(t.amount,`NEAR account response.amount`),locked:o(t.locked,`NEAR account response.locked`),code_hash:r(t.code_hash,`NEAR account response.code_hash`),storage_usage:a(t.storage_usage,`NEAR account response.storage_usage`),storage_paid_at:a(t.storage_paid_at,`NEAR account response.storage_paid_at`)}}function m(e){let t=r(n(e,`NEAR view code response`).code_base64,`NEAR view code response.code_base64`);if(!t)throw Error(`Invalid NEAR view code response.code_base64: empty string`);return t}function h(e){let t=n(n(e,`NEAR block response`).header,`NEAR block response.header`);return{header:{hash:r(t.hash,`NEAR block response.header.hash`),height:a(t.height,`NEAR block response.header.height`)}}}function g(e){let t=n(e,`NEAR contract call response`);if(!Array.isArray(t.result))throw Error(`Invalid NEAR contract call response.result: expected bytes`);let r=[];for(let e of t.result){if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`Invalid NEAR contract call response.result: expected bytes`);r.push(e)}return{...s(t,`NEAR contract call response`),logs:i(t.logs,`NEAR contract call response.logs`),result:r}}function _(e){let t=new TextDecoder(`utf-8`,{fatal:!0}).decode(Uint8Array.from(e));if(!t.trim())return null;try{return JSON.parse(t)}catch{return t}}function v(e,t){let r=n(e,t),i=typeof r.error_type==`string`?r.error_type:`InvalidTxError`in r?`InvalidTxError`:`ActionError`in r?`ActionError`:`TxExecutionError`;return{error_message:typeof r.error_message==`string`?r.error_message:`NEAR execution failed`,error_type:i,...`InvalidTxError`in r?{InvalidTxError:r.InvalidTxError}:{},...`ActionError`in r?{ActionError:r.ActionError}:{}}}function y(e,t){let n=0;for(let r of t)Object.prototype.hasOwnProperty.call(e,r)&&n++;if(n!==1)throw Error(`Invalid NEAR status: expected exactly one variant`)}function b(t){if(t===`Unknown`)return e.Unknown;if(t===`Pending`)return e.Pending;if(t===`Failure`)return e.Failure;let r=n(t,`NEAR execution status`);if(y(r,[`SuccessValue`,`SuccessReceiptId`,`Failure`]),typeof r.SuccessValue==`string`)return{SuccessValue:r.SuccessValue};if(typeof r.SuccessReceiptId==`string`)return{SuccessReceiptId:r.SuccessReceiptId};if(`Failure`in r)return{Failure:v(r.Failure,`NEAR execution failure`)};throw Error(`Invalid NEAR execution status`)}function x(e){if(e===`NotStarted`)return t.NotStarted;if(e===`Started`)return t.Started;if(e===`Failure`)return t.Failure;let r=n(e,`NEAR final execution status`);if(y(r,[`SuccessValue`,`Failure`]),typeof r.SuccessValue==`string`)return{SuccessValue:r.SuccessValue};if(`Failure`in r)return{Failure:v(r.Failure,`NEAR final execution failure`)};throw Error(`Invalid NEAR final execution status`)}function S(e){let t=n(e,`NEAR execution outcome`);return{logs:i(t.logs,`NEAR execution outcome.logs`),receipt_ids:i(t.receipt_ids,`NEAR execution outcome.receipt_ids`),gas_burnt:a(t.gas_burnt,`NEAR execution outcome.gas_burnt`),tokens_burnt:r(t.tokens_burnt,`NEAR execution outcome.tokens_burnt`),executor_id:r(t.executor_id,`NEAR execution outcome.executor_id`),status:b(t.status)}}function C(e){let t=n(e,`NEAR execution outcome with id`);return{id:r(t.id,`NEAR execution outcome id`),outcome:S(t.outcome)}}function w(e){switch(e){case`NONE`:case`INCLUDED`:case`INCLUDED_FINAL`:case`EXECUTED`:case`FINAL`:case`EXECUTED_OPTIMISTIC`:return e;default:throw Error(`Invalid NEAR final_execution_status`)}}function T(e){let t=n(e,`NEAR final execution outcome`);if(!Array.isArray(t.receipts_outcome))throw Error(`Invalid NEAR final execution outcome.receipts_outcome: expected an array`);return{final_execution_status:w(t.final_execution_status),status:x(t.status),transaction:{hash:r(n(t.transaction,`NEAR final execution outcome.transaction`).hash,`NEAR final execution outcome.transaction.hash`)},transaction_outcome:C(t.transaction_outcome),receipts_outcome:t.receipts_outcome.map(C)}}export{m as a,_ as c,h as i,d as n,g as o,p as r,T as s,f as t};

package/dist/public/sdk/{nonceLaneKeys-CZjeiii7.js → nonceLaneKeys-BF_UpvIy.js}

@@ -1 +1 @@
-import{r as e}from"./secureRandomId-8LSc91aN.js";import{o as t}from"./ecdsaChainTarget-Lh24LLyA.js";const n={Reserved:`reserved`,Released:`released`,Expired:`expired`,Signed:`signed`,SignedLeaseExpired:`signed_lease_expired`,BroadcastAccepted:`broadcast_accepted`,BroadcastRejected:`broadcast_rejected`,Finalized:`finalized`,Dropped:`dropped`,Replaced:`replaced`,Reconciled:`reconciled`},r={Reserved:n.Reserved,Signed:n.Signed,BroadcastAccepted:n.BroadcastAccepted},i={LeaseReserved:`nonce_lease_reserved`,LeaseReleased:`nonce_lease_released`,LeaseExpired:`nonce_lease_expired`,LeaseSigned:`nonce_lease_signed`,LeaseBroadcastAccepted:`nonce_lease_broadcast_accepted`,LeaseBroadcastRejected:`nonce_lease_broadcast_rejected`,LeaseFinalized:`nonce_lease_finalized`,LeaseDropped:`nonce_lease_dropped`,LeaseReplaced:`nonce_lease_replaced`,Metrics:`nonce_coordinator_metrics`,LaneAlert:`nonce_lane_alert`,CoordinationDegraded:`nonce_coordination_degraded`,LanesCleared:`nonce_lanes_cleared`,LaneReconciled:`nonce_lane_reconciled`},a={Dropped:`dropped`,Replaced:`replaced`},o={WebLocksUnavailable:`web_locks_unavailable`,IndexedDBUnavailable:`indexeddb_unavailable`,DurableLockTimeout:`durable_lock_timeout`,DurableStoreError:`durable_store_error`,MalformedDurableRecord:`malformed_durable_record`},s={InRuntimeLock:`in_runtime_lock`,None:`none`},c={NonceAdvancedHashMissing:`near_nonce_advanced_hash_missing`,HashMissingNonceNotAdvanced:`near_hash_missing_nonce_not_advanced`},l=Object.values(n);function u(e){return{family:`evm`,chainTarget:e.chainTarget,subjectId:e.subjectId,sender:e.sender,...e.nonceKey==null?{}:{nonceKey:e.nonceKey}}}function d(e){return y(e),{...m(e.lane),nonce:e.nonce,leaseId:e.leaseId,operationId:String(e.operationId),operationFingerprint:String(e.operationFingerprint),reservedAtMs:e.reservedAtMs,expiresAtMs:e.expiresAtMs}}function f(e){return u(e)}function p(e){return{leaseId:e.leaseId,operationId:String(e.operationId),operationFingerprint:String(e.operationFingerprint),nonce:String(e.nonce),...e.batchId?{batchId:e.batchId}:{},...Number.isSafeInteger(e.txIndex)?{txIndex:e.txIndex}:{}}}function m(e){return{chainTarget:e.chainTarget,subjectId:e.subjectId,sender:e.sender,...e.nonceKey==null?{}:{nonceKey:e.nonceKey}}}function h(e){return e.family===`near`?e.networkKey:t(e.chainTarget)}function g(e){return e.family===`near`?e.walletId:e.subjectId}function _(e){return e.family===`near`?v(e):C([`evm`,t(e.chainTarget),e.subjectId,e.sender.toLowerCase(),e.nonceKey==null?``:String(e.nonceKey)])}function v(e){return C([`near`,e.networkKey,e.walletId,e.nearAccountId,e.publicKey])}function y(e){if(e.lane.family!==`evm`)throw Error(`[NonceCoordinator] expected an EVM-family nonce lease`)}function b(e,t,n){if(e.operationId!==t)throw Error(`[NonceCoordinator] nonce lease operation mismatch`);if(e.operationFingerprint!==n)throw Error(`[NonceCoordinator] nonce lease operation fingerprint mismatch`)}function x(t){let n=e(`nonce-lease`,32,`nonce lease IDs`);return`nonce-lease-v1:${C([t.chain,t.operationId,t.nonce,n])}`}function S(t){let n=e(`nonce-batch`,32,`nonce batch IDs`);return`nonce-batch-v1:${C([t.chain,t.operationId,t.firstNonce,t.count,n])}`}function C(e){return e.map(e=>{let t=String(e);return`${t.length}:${t}`}).join(`|`)}function w(){return e(`nonce-runtime`,32,`nonce runtime IDs`)}export{o as _,w as a,r as b,d as c,h as d,g as f,c as g,l as h,x as i,u as l,a as m,b as n,m as o,p,S as r,f as s,y as t,_ as u,s as v,n as x,i as y};
+import{r as e}from"./secureRandomId-8LSc91aN.js";import{o as t}from"./ecdsaChainTarget-Bm5X4k-V.js";const n={Reserved:`reserved`,Released:`released`,Expired:`expired`,Signed:`signed`,SignedLeaseExpired:`signed_lease_expired`,BroadcastAccepted:`broadcast_accepted`,BroadcastRejected:`broadcast_rejected`,Finalized:`finalized`,Dropped:`dropped`,Replaced:`replaced`,Reconciled:`reconciled`},r={Reserved:n.Reserved,Signed:n.Signed,BroadcastAccepted:n.BroadcastAccepted},i={LeaseReserved:`nonce_lease_reserved`,LeaseReleased:`nonce_lease_released`,LeaseExpired:`nonce_lease_expired`,LeaseSigned:`nonce_lease_signed`,LeaseBroadcastAccepted:`nonce_lease_broadcast_accepted`,LeaseBroadcastRejected:`nonce_lease_broadcast_rejected`,LeaseFinalized:`nonce_lease_finalized`,LeaseDropped:`nonce_lease_dropped`,LeaseReplaced:`nonce_lease_replaced`,Metrics:`nonce_coordinator_metrics`,LaneAlert:`nonce_lane_alert`,CoordinationDegraded:`nonce_coordination_degraded`,LanesCleared:`nonce_lanes_cleared`,LaneReconciled:`nonce_lane_reconciled`},a={Dropped:`dropped`,Replaced:`replaced`},o={WebLocksUnavailable:`web_locks_unavailable`,IndexedDBUnavailable:`indexeddb_unavailable`,DurableLockTimeout:`durable_lock_timeout`,DurableStoreError:`durable_store_error`,MalformedDurableRecord:`malformed_durable_record`},s={InRuntimeLock:`in_runtime_lock`,None:`none`},c={NonceAdvancedHashMissing:`near_nonce_advanced_hash_missing`,HashMissingNonceNotAdvanced:`near_hash_missing_nonce_not_advanced`},l=Object.values(n);function u(e){return{family:`evm`,chainTarget:e.chainTarget,subjectId:e.subjectId,sender:e.sender,...e.nonceKey==null?{}:{nonceKey:e.nonceKey}}}function d(e){return y(e),{...m(e.lane),nonce:e.nonce,leaseId:e.leaseId,operationId:String(e.operationId),operationFingerprint:String(e.operationFingerprint),reservedAtMs:e.reservedAtMs,expiresAtMs:e.expiresAtMs}}function f(e){return u(e)}function p(e){return{leaseId:e.leaseId,operationId:String(e.operationId),operationFingerprint:String(e.operationFingerprint),nonce:String(e.nonce),...e.batchId?{batchId:e.batchId}:{},...Number.isSafeInteger(e.txIndex)?{txIndex:e.txIndex}:{}}}function m(e){return{chainTarget:e.chainTarget,subjectId:e.subjectId,sender:e.sender,...e.nonceKey==null?{}:{nonceKey:e.nonceKey}}}function h(e){return e.family===`near`?e.networkKey:t(e.chainTarget)}function g(e){return e.family===`near`?e.walletId:e.subjectId}function _(e){return e.family===`near`?v(e):C([`evm`,t(e.chainTarget),e.subjectId,e.sender.toLowerCase(),e.nonceKey==null?``:String(e.nonceKey)])}function v(e){return C([`near`,e.networkKey,e.walletId,e.nearAccountId,e.publicKey])}function y(e){if(e.lane.family!==`evm`)throw Error(`[NonceCoordinator] expected an EVM-family nonce lease`)}function b(e,t,n){if(e.operationId!==t)throw Error(`[NonceCoordinator] nonce lease operation mismatch`);if(e.operationFingerprint!==n)throw Error(`[NonceCoordinator] nonce lease operation fingerprint mismatch`)}function x(t){let n=e(`nonce-lease`,32,`nonce lease IDs`);return`nonce-lease-v1:${C([t.chain,t.operationId,t.nonce,n])}`}function S(t){let n=e(`nonce-batch`,32,`nonce batch IDs`);return`nonce-batch-v1:${C([t.chain,t.operationId,t.firstNonce,t.count,n])}`}function C(e){return e.map(e=>{let t=String(e);return`${t.length}:${t}`}).join(`|`)}function w(){return e(`nonce-runtime`,32,`nonce runtime IDs`)}export{o as _,w as a,r as b,d as c,h as d,g as f,c as g,l as h,x as i,u as l,a as m,b as n,m as o,p,S as r,f as s,y as t,_ as u,s as v,n as x,i as y};

package/dist/public/sdk/{normalization-DA6o5MsH.js → normalization-Df9fZWJC.js}

@@ -1 +1 @@
-import{R as e,z as t}from"./domainIds-t1lp25yU.js";import{o as n}from"./ecdsaChainTarget-Lh24LLyA.js";function r(e){let n=t(e);return!n||n===`null`?null:n}function i(t){return e(t)}function a(t){return e(t)}function o(t){return e(t)}function s(e){return n(e)}function c(e){return typeof e==`string`&&e.length>0&&e.trim()===e?e:null}function l(e){return[e.chainIdKey,e.accountAddress].join(`\0`)}export{c as a,r as i,o as n,l as o,i as r,s,a as t};
+import{R as e,z as t}from"./domainIds-t1lp25yU.js";import{o as n}from"./ecdsaChainTarget-Bm5X4k-V.js";function r(e){let n=t(e);return!n||n===`null`?null:n}function i(t){return e(t)}function a(t){return e(t)}function o(t){return e(t)}function s(e){return n(e)}function c(e){return typeof e==`string`&&e.length>0&&e.trim()===e?e:null}function l(e){return[e.chainIdKey,e.accountAddress].join(`\0`)}export{c as a,r as i,o as n,l as o,i as r,s,a as t};

package/dist/{esm/sdk/pendingWalletRecoveryCodeBackup-B-n7vmBS.js → public/sdk/pendingWalletRecoveryCodeBackup-B-R_U34I.js}

@@ -1 +1 @@
-import{r as e}from"./secureRandomId-8LSc91aN.js";import{t}from"./surface-measurement-reporter-DvzNDnHy.js";import{a as n,n as r}from"./presignatures-CjcyX_-F.js";import{A as i}from"./indexedDB-CWFDCCbP.js";import{l as a}from"./helpers-dZehRP4i.js";function o(e){return String(a(e)||``).trim()}function s(e,t){let n=o(e);if(!n)throw Error(`${t} requires PRF.first output from the passkey credential`);return n}function c(e){return String(e?.rawId||e?.id||``).trim()}const l=`Recovery-code backup was cancelled before acknowledgement`;async function u(e,n={kind:`disabled`},r={}){if(typeof document>`u`)throw Error(`Wallet recovery-code backup requires a browser or a backup handler`);let i=document.activeElement instanceof HTMLElement?document.activeElement:null;if(r.shouldCancel?.())throw Error(l);let a=await import(`./mountRecoveryCodeBackupSurface-PutmFjf9.js`);if(r.shouldCancel?.())throw Error(l);let o=null,s=null,c=!1;return await new Promise((u,d)=>{let f=()=>{o?.disconnect(),o=null,s?.dispose(),s=null,i?.focus()},m=e=>{c||(c=!0,f(),e instanceof Error?d(e):u(e))},h=t=>{switch(t.kind){case`dismissed`:m(Error(l));return;case`recovery_codes`:if(t.acknowledged){if(e.kind===`account_menu`){if(t.request.continuation!==`pending_backup_must_finish`){m(Error(`Displayed recovery codes have no committed issuance`));return}m({kind:`account_menu_backed_up`,issuedAtMs:t.request.issuedAtMs});return}m({kind:`registration_backed_up`});return}if(e.kind===`direct_backup`&&e.request.continuation===`registration_may_defer`){m({kind:`deferred`});return}m(Error(l));return}};try{s=a.mountRecoveryCodeBackupSurface({parent:document.body,appearance:r.appearance,experience:e,surface:n.kind===`wallet_iframe`?`wallet-iframe`:`standalone`,onClose:h,onCancel:()=>m(Error(l)),onShown:e=>{c||n.kind!==`wallet_iframe`||(o=t({kind:`request_scroll_surface`,requestId:n.requestId,element:e,postMeasurement:p.bind(null,e,n.postMeasurement)}))}})}catch(e){m(e instanceof Error?e:Error(String(e)))}})}async function d(e,t={kind:`disabled`}){switch((await u({kind:`direct_backup`,request:e},t)).kind){case`registration_backed_up`:return{kind:`wallet_recovery_codes_backed_up_v1`};case`deferred`:return{kind:`wallet_recovery_code_backup_deferred_v1`};case`account_menu_backed_up`:throw Error(`Registration backup returned an account-menu issuance`)}}async function f(e,t={kind:`disabled`},n={}){let r=await u({kind:`account_menu`,...e},t,n);if(r.kind!==`account_menu_backed_up`)throw Error(`Account-menu backup did not acknowledge committed recovery codes`);return{kind:`wallet_recovery_codes_backed_up_v1`,issuedAtMs:r.issuedAtMs}}function p(e,t,n){if(n.kind!==`measured_v1`)throw Error(`Recovery codes require a request surface measurement`);t({kind:`measured_v1`,requestId:n.requestId,sequence:n.sequence,widthCssPx:e.dataset.seamsRecoveryStage===`recovery_codes`?688:480,heightCssPx:n.heightCssPx})}const m=`wallet_recovery_codes_v1`,h=[`record_version`,`wallet_id`,`enrollment_id`,`recovery_codes_issued_at_ms`,`status`,`key`,`iv`,`ciphertext`],g=[`record_version`,`wallet_id`,`enrollment_id`,`aad_issued_at_ms`,`pending_backup_id`,`status`,`key`,`iv`,`ciphertext`],_=[...g,`recovery_codes_issued_at_ms`];function v(e){return typeof CryptoKey<`u`&&e instanceof CryptoKey&&e.type===`secret`&&!e.extractable&&e.algorithm.name===`AES-GCM`&&e.usages.includes(`encrypt`)&&e.usages.includes(`decrypt`)}function y(e,t){if(e.size!==t.length)return!1;for(let n of t)if(!e.has(n))return!1;return!0}function b(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=new Map(Object.entries(e)),r=n.get(`record_version`)===1&&n.get(`status`)===`pending`&&y(n,h),i=n.get(`record_version`)===2&&n.get(`status`)===`awaiting_commit`&&y(n,g),a=n.get(`record_version`)===2&&n.get(`status`)===`ready`&&y(n,_);if(!r&&!i&&!a)return null;let o=n.get(r?`recovery_codes_issued_at_ms`:`aad_issued_at_ms`),s=r?Number(o):o,c=n.get(`key`),l=n.get(`iv`),u=n.get(`ciphertext`);if(n.get(`wallet_id`)!==t||n.get(`enrollment_id`)!==m||typeof s!=`number`||!Number.isSafeInteger(s)||s<=0||!v(c)||!(l instanceof Uint8Array)||l.byteLength!==12||!(u instanceof Uint8Array)||u.byteLength===0)return null;if(r)return{kind:`legacy_unbound`,aadIssuedAtMs:s,key:c,iv:l,ciphertext:u};let d=n.get(`pending_backup_id`);if(typeof d!=`string`||!d.trim())return null;if(a){let e=n.get(`recovery_codes_issued_at_ms`);return!Number.isSafeInteger(e)||typeof e!=`number`||e<=0?null:{kind:`ready`,aadIssuedAtMs:s,pendingBackupId:d,issuedAtMs:e,key:c,iv:l,ciphertext:u}}return{kind:`awaiting_commit`,aadIssuedAtMs:s,pendingBackupId:d,key:c,iv:l,ciphertext:u}}function x(e,t){return new TextEncoder().encode(JSON.stringify({kind:m,walletId:e,issuedAtMs:t}))}function S(e){return[e,m]}async function C(e,t){await t.store(n.pendingWalletRecoveryCodeBackups).put(e)}async function w(e,t,r){let i=r.store(n.pendingWalletRecoveryCodeBackups),a=b(await i.get(S(e.walletId)),e.walletId);if(a?.kind!==`awaiting_commit`||a.pendingBackupId!==e.pendingBackupId)throw Error(`Pending recovery-code backup reference does not match an unbound backup`);let o={record_version:2,wallet_id:e.walletId,enrollment_id:m,aad_issued_at_ms:a.aadIssuedAtMs,pending_backup_id:a.pendingBackupId,recovery_codes_issued_at_ms:t,status:`ready`,key:a.key,iv:a.iv,ciphertext:a.ciphertext};await i.put(o)}async function T(e,t,r){let i=r.store(n.pendingWalletRecoveryCodeBackups),a=b(await i.get(S(e)),e);a?.kind===`ready`&&a.issuedAtMs===t&&await i.delete(S(e))}const E=new class{async write(t){let a=t.walletId.trim();if(!a)throw Error(`Pending recovery-code backup requires a wallet`);let o=i(t.recoveryCodes.map(String)),s=e(`pending-recovery-backup`,32,`pending recovery-code backup references`),c=Date.now();if(!Number.isSafeInteger(c)||c<=0)throw Error(`Pending recovery-code backup encryption time is invalid`);let l=await crypto.subtle.generateKey({name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`]),u=crypto.getRandomValues(new Uint8Array(12)),d=x(a,c),f=new TextEncoder().encode(JSON.stringify(o)),p=null;try{let e=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:u,additionalData:d},l,f));p=e;let t={record_version:2,wallet_id:a,enrollment_id:m,aad_issued_at_ms:c,pending_backup_id:s,status:`awaiting_commit`,key:l,iv:u,ciphertext:e};return await r.runTransaction([n.pendingWalletRecoveryCodeBackups],`readwrite`,C.bind(null,t)),{walletId:a,pendingBackupId:s}}finally{d.fill(0),f.fill(0),p?.fill(0)}}async read(e){let t=e.trim();if(!t)return null;let a=b(await(await r.getDB()).get(n.pendingWalletRecoveryCodeBackups,S(t)),t);if(!a)return null;let o=x(t,a.aadIssuedAtMs),s=null;try{s=new Uint8Array(await crypto.subtle.decrypt({name:`AES-GCM`,iv:a.iv.slice(),additionalData:o},a.key,a.ciphertext.slice()));let e=JSON.parse(new TextDecoder().decode(s));if(!Array.isArray(e))throw Error(`Pending recovery-code backup is invalid`);let n=i(e.map(String));return a.kind===`ready`?{kind:`ready`,walletId:t,recoveryCodes:n,issuedAtMs:a.issuedAtMs}:{kind:`awaiting_commit`,walletId:t,recoveryCodes:n}}finally{o.fill(0),s?.fill(0)}}async has(e){let t=e.trim();return t?b(await(await r.getDB()).get(n.pendingWalletRecoveryCodeBackups,S(t)),t)!==null:!1}async bindIssuedAtMs(e,t){if(!e.walletId||e.walletId!==e.walletId.trim()||!e.pendingBackupId||e.pendingBackupId!==e.pendingBackupId.trim()||!Number.isSafeInteger(t)||t<=0)throw Error(`Pending recovery-code backup identity is invalid`);await r.runTransaction([n.pendingWalletRecoveryCodeBackups],`readwrite`,w.bind(null,e,t))}async deleteIssuedAtMs(e,t){let i=e.trim();if(!i||!Number.isSafeInteger(t)||t<=0)throw Error(`Pending recovery-code backup identity is invalid`);await r.runTransaction([n.pendingWalletRecoveryCodeBackups],`readwrite`,T.bind(null,i,t))}};export{o as a,c as i,d as n,s as o,f as r,E as t};
+import{r as e}from"./secureRandomId-8LSc91aN.js";import{t}from"./surface-measurement-reporter-DXsvq401.js";import{a as n,n as r}from"./presignatures-BCeq56DG.js";import{A as i}from"./indexedDB-C4SDsyOG.js";import{l as a}from"./helpers-Dubwo5uK.js";function o(e){return String(a(e)||``).trim()}function s(e,t){let n=o(e);if(!n)throw Error(`${t} requires PRF.first output from the passkey credential`);return n}function c(e){return String(e?.rawId||e?.id||``).trim()}const l=`Recovery-code backup was cancelled before acknowledgement`;async function u(e,n={kind:`disabled`},r={}){if(typeof document>`u`)throw Error(`Wallet recovery-code backup requires a browser or a backup handler`);let i=document.activeElement instanceof HTMLElement?document.activeElement:null;if(r.shouldCancel?.())throw Error(l);let a=await import(`./mountRecoveryCodeBackupSurface-kFLo5zLk.js`);if(r.shouldCancel?.())throw Error(l);let o=null,s=null,c=!1;return await new Promise((u,d)=>{let f=()=>{o?.disconnect(),o=null,s?.dispose(),s=null,i?.focus()},m=e=>{c||(c=!0,f(),e instanceof Error?d(e):u(e))},h=t=>{switch(t.kind){case`dismissed`:m(Error(l));return;case`recovery_codes`:if(t.acknowledged){if(e.kind===`account_menu`){if(t.request.continuation!==`pending_backup_must_finish`){m(Error(`Displayed recovery codes have no committed issuance`));return}m({kind:`account_menu_backed_up`,issuedAtMs:t.request.issuedAtMs});return}m({kind:`registration_backed_up`});return}if(e.kind===`direct_backup`&&e.request.continuation===`registration_may_defer`){m({kind:`deferred`});return}m(Error(l));return}};try{s=a.mountRecoveryCodeBackupSurface({parent:document.body,appearance:r.appearance,experience:e,surface:n.kind===`wallet_iframe`?`wallet-iframe`:`standalone`,onClose:h,onCancel:()=>m(Error(l)),onShown:e=>{c||n.kind!==`wallet_iframe`||(o=t({kind:`request_scroll_surface`,requestId:n.requestId,element:e,postMeasurement:p.bind(null,e,n.postMeasurement)}))}})}catch(e){m(e instanceof Error?e:Error(String(e)))}})}async function d(e,t={kind:`disabled`}){switch((await u({kind:`direct_backup`,request:e},t)).kind){case`registration_backed_up`:return{kind:`wallet_recovery_codes_backed_up_v1`};case`deferred`:return{kind:`wallet_recovery_code_backup_deferred_v1`};case`account_menu_backed_up`:throw Error(`Registration backup returned an account-menu issuance`)}}async function f(e,t={kind:`disabled`},n={}){let r=await u({kind:`account_menu`,...e},t,n);if(r.kind!==`account_menu_backed_up`)throw Error(`Account-menu backup did not acknowledge committed recovery codes`);return{kind:`wallet_recovery_codes_backed_up_v1`,issuedAtMs:r.issuedAtMs}}function p(e,t,n){if(n.kind!==`measured_v1`)throw Error(`Recovery codes require a request surface measurement`);t({kind:`measured_v1`,requestId:n.requestId,sequence:n.sequence,widthCssPx:e.dataset.seamsRecoveryStage===`recovery_codes`?688:480,heightCssPx:n.heightCssPx})}const m=`wallet_recovery_codes_v1`,h=[`record_version`,`wallet_id`,`enrollment_id`,`recovery_codes_issued_at_ms`,`status`,`key`,`iv`,`ciphertext`],g=[`record_version`,`wallet_id`,`enrollment_id`,`aad_issued_at_ms`,`pending_backup_id`,`status`,`key`,`iv`,`ciphertext`],_=[...g,`recovery_codes_issued_at_ms`];function v(e){return typeof CryptoKey<`u`&&e instanceof CryptoKey&&e.type===`secret`&&!e.extractable&&e.algorithm.name===`AES-GCM`&&e.usages.includes(`encrypt`)&&e.usages.includes(`decrypt`)}function y(e,t){if(e.size!==t.length)return!1;for(let n of t)if(!e.has(n))return!1;return!0}function b(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=new Map(Object.entries(e)),r=n.get(`record_version`)===1&&n.get(`status`)===`pending`&&y(n,h),i=n.get(`record_version`)===2&&n.get(`status`)===`awaiting_commit`&&y(n,g),a=n.get(`record_version`)===2&&n.get(`status`)===`ready`&&y(n,_);if(!r&&!i&&!a)return null;let o=n.get(r?`recovery_codes_issued_at_ms`:`aad_issued_at_ms`),s=r?Number(o):o,c=n.get(`key`),l=n.get(`iv`),u=n.get(`ciphertext`);if(n.get(`wallet_id`)!==t||n.get(`enrollment_id`)!==m||typeof s!=`number`||!Number.isSafeInteger(s)||s<=0||!v(c)||!(l instanceof Uint8Array)||l.byteLength!==12||!(u instanceof Uint8Array)||u.byteLength===0)return null;if(r)return{kind:`legacy_unbound`,aadIssuedAtMs:s,key:c,iv:l,ciphertext:u};let d=n.get(`pending_backup_id`);if(typeof d!=`string`||!d.trim())return null;if(a){let e=n.get(`recovery_codes_issued_at_ms`);return!Number.isSafeInteger(e)||typeof e!=`number`||e<=0?null:{kind:`ready`,aadIssuedAtMs:s,pendingBackupId:d,issuedAtMs:e,key:c,iv:l,ciphertext:u}}return{kind:`awaiting_commit`,aadIssuedAtMs:s,pendingBackupId:d,key:c,iv:l,ciphertext:u}}function x(e,t){return new TextEncoder().encode(JSON.stringify({kind:m,walletId:e,issuedAtMs:t}))}function S(e){return[e,m]}async function C(e,t){await t.store(n.pendingWalletRecoveryCodeBackups).put(e)}async function w(e,t,r){let i=r.store(n.pendingWalletRecoveryCodeBackups),a=b(await i.get(S(e.walletId)),e.walletId);if(a?.kind!==`awaiting_commit`||a.pendingBackupId!==e.pendingBackupId)throw Error(`Pending recovery-code backup reference does not match an unbound backup`);let o={record_version:2,wallet_id:e.walletId,enrollment_id:m,aad_issued_at_ms:a.aadIssuedAtMs,pending_backup_id:a.pendingBackupId,recovery_codes_issued_at_ms:t,status:`ready`,key:a.key,iv:a.iv,ciphertext:a.ciphertext};await i.put(o)}async function T(e,t,r){let i=r.store(n.pendingWalletRecoveryCodeBackups),a=b(await i.get(S(e)),e);a?.kind===`ready`&&a.issuedAtMs===t&&await i.delete(S(e))}const E=new class{async write(t){let a=t.walletId.trim();if(!a)throw Error(`Pending recovery-code backup requires a wallet`);let o=i(t.recoveryCodes.map(String)),s=e(`pending-recovery-backup`,32,`pending recovery-code backup references`),c=Date.now();if(!Number.isSafeInteger(c)||c<=0)throw Error(`Pending recovery-code backup encryption time is invalid`);let l=await crypto.subtle.generateKey({name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`]),u=crypto.getRandomValues(new Uint8Array(12)),d=x(a,c),f=new TextEncoder().encode(JSON.stringify(o)),p=null;try{let e=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:u,additionalData:d},l,f));p=e;let t={record_version:2,wallet_id:a,enrollment_id:m,aad_issued_at_ms:c,pending_backup_id:s,status:`awaiting_commit`,key:l,iv:u,ciphertext:e};return await r.runTransaction([n.pendingWalletRecoveryCodeBackups],`readwrite`,C.bind(null,t)),{walletId:a,pendingBackupId:s}}finally{d.fill(0),f.fill(0),p?.fill(0)}}async read(e){let t=e.trim();if(!t)return null;let a=b(await(await r.getDB()).get(n.pendingWalletRecoveryCodeBackups,S(t)),t);if(!a)return null;let o=x(t,a.aadIssuedAtMs),s=null;try{s=new Uint8Array(await crypto.subtle.decrypt({name:`AES-GCM`,iv:a.iv.slice(),additionalData:o},a.key,a.ciphertext.slice()));let e=JSON.parse(new TextDecoder().decode(s));if(!Array.isArray(e))throw Error(`Pending recovery-code backup is invalid`);let n=i(e.map(String));return a.kind===`ready`?{kind:`ready`,walletId:t,recoveryCodes:n,issuedAtMs:a.issuedAtMs}:{kind:`awaiting_commit`,walletId:t,recoveryCodes:n}}finally{o.fill(0),s?.fill(0)}}async has(e){let t=e.trim();return t?b(await(await r.getDB()).get(n.pendingWalletRecoveryCodeBackups,S(t)),t)!==null:!1}async bindIssuedAtMs(e,t){if(!e.walletId||e.walletId!==e.walletId.trim()||!e.pendingBackupId||e.pendingBackupId!==e.pendingBackupId.trim()||!Number.isSafeInteger(t)||t<=0)throw Error(`Pending recovery-code backup identity is invalid`);await r.runTransaction([n.pendingWalletRecoveryCodeBackups],`readwrite`,w.bind(null,e,t))}async deleteIssuedAtMs(e,t){let i=e.trim();if(!i||!Number.isSafeInteger(t)||t<=0)throw Error(`Pending recovery-code backup identity is invalid`);await r.runTransaction([n.pendingWalletRecoveryCodeBackups],`readwrite`,T.bind(null,i,t))}};export{o as a,c as i,d as n,s as o,f as r,E as t};

package/dist/public/sdk/{presignaturePool-DjTaB0nx.js → presignaturePool-BbvqRWYw.js}

@@ -1 +1 @@
-import{H as e,V as t}from"./domainIds-t1lp25yU.js";import{c as n,l as r}from"./participants-BXdREC5k.js";import{i,r as a}from"./base64-BmKR3UqU.js";import{r as o}from"./secureRandomId-8LSc91aN.js";import{t as s}from"./presignatures-CjcyX_-F.js";import{B as c,b as l,d as u,h as d,m as ee,p as f,u as p}from"./digestEncoding-n8Kr2kow.js";import{I as m,L as h,R as g}from"./ecdsaCapabilityManifest-CXVq8Qzb.js";import{ct as _,n as v,ut as y}from"./walletOwnershipGeneration-z9NXOk-b.js";import{o as b,s as te,t as ne}from"./evmCryptoWasm-B_p82tx9.js";import{i as x,n as S,r as re,u as C}from"./trace-BQv7E-bO.js";import{A as ie,C as ae,D as w,E as T,O as E,S as D,T as oe,k as O,w as se,x as k,y as A}from"./ecdsaDerivationClientWasm-CVahDxLy.js";import{t as ce}from"./authorizationAdmission-BYwaSZYV.js";import{t as j}from"./walletSessionFailure-ZfdbUAG-.js";import{c as le,f as M,o as ue,t as de}from"./routerAbNormalSigning-Da-uxxle.js";async function fe(e){let t=e.clientShare.material;if(t.kind===`worker_loaded`)return;let n=await A({materialHandle:e.clientShare.handle.materialHandle,bindingDigest:e.clientShare.handle.bindingDigest,stateBlob:t.stateBlob,workerCtx:e.workerCtx});if(n.materialHandle!==e.clientShare.handle.materialHandle||n.bindingDigest!==e.clientShare.handle.bindingDigest)throw Error(`[multichain] ECDSA role-local worker material handle mismatch`)}async function pe(e){let t=e.signerSession,n=t.clientShare;if(n.kind===`linked_holder_worker_share`){let e=n.holderHandleId;return{signerSession:t,clientSigningMaterial:me(e),cleanupAfterSign:async()=>void 0}}let r=n;return{signerSession:t,clientSigningMaterial:{kind:`router_ab_ecdsa_derivation_client_signing_material_source_v1`,initClientPresignSession:async t=>(await fe({workerCtx:e.workerCtx,clientShare:r}),await E({materialHandle:r.handle.materialHandle,material:r.material.kind===`worker_loaded`?{kind:`persisted`,materialRef:r.material.materialRef}:{kind:`runtime_loaded`,expectedBindingDigest:r.handle.bindingDigest},...t})),stepClientPresignSession:O,abortClientPresignSession:w,admitClientPresignature:ae,destroyClientPresignature:T,reserveClientPresignature:ie,commitClientPresignature:se,listAvailableClientPresignatures:D.bind(void 0,`role_local_derivation_handle`),computeSignatureShareFromPresignatureHandle:oe},cleanupAfterSign:async()=>void 0}}async function N(e,t){return await k({holderHandleId:e,...t})}function me(e){return{kind:`router_ab_ecdsa_derivation_client_signing_material_source_v1`,initClientPresignSession:N.bind(void 0,e),stepClientPresignSession:O,abortClientPresignSession:w,admitClientPresignature:ae,destroyClientPresignature:T,reserveClientPresignature:ie,commitClientPresignature:se,listAvailableClientPresignatures:D.bind(void 0,`linked_holder_signing_material`),computeSignatureShareFromPresignatureHandle:oe}}function P(e,t,n,r){let i=Math.floor(Number(e));return Number.isFinite(i)?i<n?n:i>r?r:i:t}function he(e,t){return P(e,t,1,5)}function ge(e,t,n){return P(e,t,0,n)}function _e(e){let t=e||M,n=he(t.targetDepth,M.targetDepth),r=ge(t.lowWatermark,M.lowWatermark,n);return{enabled:typeof t.enabled==`boolean`?t.enabled:M.enabled,targetDepth:n,lowWatermark:r,maxRefillInFlight:P(t.maxRefillInFlight,M.maxRefillInFlight,1,8),refillAttemptTimeoutMs:P(t.refillAttemptTimeoutMs,M.refillAttemptTimeoutMs,5e3,12e4)}}function ve(e){let t=Math.floor(Number(e));return Number.isFinite(t)&&t>0?t:2e4}function ye(e){return String(e&&typeof e==`object`&&`message`in e?e.message:e||``)}function be(e){return Error(`[router-ab-ecdsa-derivation] ${e.operation} request timed out after ${e.timeoutMs}ms`)}async function xe(e){let t=ve(e.timeoutMs),n=typeof AbortController==`function`?new AbortController:null,i={...e.init},a=null,o=null,s=!1;try{let c;if(n){let l=e.init.signal;if(l){if(l.aborted)n.abort();else if(typeof l.addEventListener==`function`){let e=()=>n.abort();l.addEventListener(`abort`,e,{once:!0}),o=()=>l.removeEventListener(`abort`,e)}}a=setTimeout(()=>{s=!0,n.abort()},t),c=await r(new Request(e.url,{...i,signal:n.signal}))}else c=await Promise.race([r(new Request(e.url,i)),new Promise((n,r)=>{a=setTimeout(()=>{s=!0,r(be({operation:e.operation,timeoutMs:t}))},t)})]);let l=await c.json().catch(()=>({}));if(s)throw be({operation:e.operation,timeoutMs:t});return{response:c,data:l}}catch(n){if(s)throw be({operation:e.operation,timeoutMs:t});let r=ye(n);throw Error(r||`[router-ab-ecdsa-derivation] ${e.operation} request failed`)}finally{a&&clearTimeout(a),o?.()}}const Se=5e3;function Ce(e,t){let n=Math.min(e-Date.now(),t??Se,Se);return Number.isFinite(n)&&n>0?n:null}function we(n){return e(t(n))||null}function Te(e){let t={"Content-Type":`application/json`};switch(e.credential.kind){case`operation_step_up`:return{ok:!0,headers:t,credentials:`omit`};case`wallet_session_opaque`:{let r=String(e.credential.walletSessionToken||``).trim();return r?(Object.assign(t,n({token:r,home:e.credential.home})),{ok:!0,headers:t,credentials:`omit`}):{ok:!1,code:`invalid_args`,message:`Missing opaque Wallet Session token for Router A/B ECDSA derivation presign pool fill`}}}}function Ee(e){switch(e.authorization.kind){case`reusable_wallet_session`:return{authorization:e.authorization};case`operation_step_up`:{let t=e.operation;if(!t)throw Error(`Operation step-up pool fill requires exact operation preparation`);return{authorization:e.authorization,operation:t}}}}function De(e){let t=String(e.keyHandle||``).trim();return t?{ok:!0,value:{keyHandle:t}}:{ok:!1,code:`invalid_args`,message:`Missing keyHandle for Router A/B ECDSA derivation pool-fill init`}}async function Oe(e){let t=we(e.relayerUrl);if(!t)return{ok:!1,code:`invalid_args`,message:`Missing relayerUrl for Router A/B ECDSA derivation pool-fill init`};if(typeof fetch!=`function`)return{ok:!1,code:`unsupported`,message:`fetch is not available for Router A/B ECDSA derivation pool-fill init`};let n=De(e);if(!n.ok)return n;let r=String(e.requestTag||``).trim(),i=Te(e);if(!i.ok)return i;let a=Ce(e.poolFill.ceremonyExpiresAtMs,e.requestTimeoutMs);if(a===null)return{ok:!1,code:`presign_timeout`,message:`Presign ceremony deadline has elapsed`};try{let{response:o,data:s}=await xe({url:`${t}${e.path}`,operation:`presign/init`,timeoutMs:a,init:{method:`POST`,headers:i.headers,credentials:i.credentials,body:JSON.stringify({...n.value,count:Number.isFinite(e.count)?Math.max(1,Math.floor(Number(e.count))):1,...r?{requestTag:r}:{},poolFill:e.poolFill,presignSessionId:e.presignSessionId,firstMessageB64u:e.firstMessageB64u,...Ee(e)})}});return typeof s.presignSessionId==`string`&&S(s.presignSessionId,`init`,o.headers.get(`Server-Timing`)),o.ok?{ok:s.ok===!0,presignSessionId:s.presignSessionId,...Number.isSafeInteger(s.ceremonyExpiresAtMs)?{ceremonyExpiresAtMs:s.ceremonyExpiresAtMs}:{},...Number.isSafeInteger(s.materialExpiresAtMs)?{materialExpiresAtMs:s.materialExpiresAtMs}:{},stage:s.stage,outgoingMessagesB64u:Array.isArray(s.outgoingMessagesB64u)?s.outgoingMessagesB64u:[],...s.code?{code:s.code}:{},...s.message?{message:s.message}:{}}:{ok:!1,code:s.code||`http_error`,message:s.message||`HTTP ${o.status}`}}catch(e){return{ok:!1,code:`network_error`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Failed Router A/B ECDSA derivation pool-fill init`)}}}async function ke(e){return Oe({...e,path:p})}async function Ae(e){let t=we(e.relayerUrl);if(!t)return{ok:!1,code:`invalid_args`,message:`Missing relayerUrl for Router A/B ECDSA derivation pool-fill step`};if(typeof fetch!=`function`)return{ok:!1,code:`unsupported`,message:`fetch is not available for Router A/B ECDSA derivation pool-fill step`};let n=String(e.presignSessionId||``).trim();if(!n)return{ok:!1,code:`invalid_args`,message:`Missing presignSessionId for Router A/B ECDSA derivation pool-fill step`};let r=String(e.requestTag||``).trim(),i=Te(e);if(!i.ok)return i;let a=Ce(e.ceremonyExpiresAtMs,e.requestTimeoutMs);if(a===null)return{ok:!1,code:`presign_timeout`,message:`Presign ceremony deadline has elapsed`};try{let{response:o,data:s}=await xe({url:`${t}${e.path}`,operation:`presign/step`,timeoutMs:a,init:{method:`POST`,headers:i.headers,credentials:i.credentials,body:JSON.stringify({presignSessionId:n,ceremonyExpiresAtMs:e.ceremonyExpiresAtMs,materialExpiresAtMs:e.materialExpiresAtMs,stage:e.stage,outgoingMessagesB64u:Array.isArray(e.outgoingMessagesB64u)?e.outgoingMessagesB64u:[],...r?{requestTag:r}:{},...Ee(e)})}});return S(n,`step`,o.headers.get(`Server-Timing`)),o.ok?{ok:s.ok===!0,stage:s.stage,event:s.event,outgoingMessagesB64u:Array.isArray(s.outgoingMessagesB64u)?s.outgoingMessagesB64u:[],...s.presignatureId?{presignatureId:s.presignatureId}:{},...s.bigRB64u?{bigRB64u:s.bigRB64u}:{},...s.code?{code:s.code}:{},...s.message?{message:s.message}:{}}:{ok:!1,code:s.code||`http_error`,message:s.message||`HTTP ${o.status}`}}catch(e){return{ok:!1,code:`network_error`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Failed Router A/B ECDSA derivation pool-fill step`)}}}async function je(e){return Ae({...e,path:u})}var Me=class{state={kind:`refilling`,revision:0};waiters=new Map;snapshot(){return this.state}hasForegroundWaiters(){for(let e of this.waiters.values())if(e===`foreground`)return!0;return!1}publishAvailable(){this.state.kind!==`settled`&&(this.state={kind:`refilling`,revision:this.state.revision+1},this.flushWaiters())}settle(){this.state.kind!==`settled`&&(this.state={kind:`settled`,revision:this.state.revision},this.flushWaiters())}waitForChange(e,t){return this.state.kind===`settled`||this.state.revision!==e.revision?Promise.resolve(this.state):new Promise(n=>{this.waiters.set(n,t),(this.state.kind===`settled`||this.state.revision!==e.revision)&&(this.waiters.delete(n),n(this.state))})}flushWaiters(){let e=this.state,t=[...this.waiters.keys()];this.waiters.clear();for(let n of t)n(e)}};function Ne(){let e=globalThis.crypto;if(!e||typeof e.getRandomValues!=`function`)throw Error(`WebCrypto getRandomValues is required for ECDSA rerandomization`);return e.getRandomValues(new Uint8Array(32))}function F(e){switch(e.authorization.kind){case`reusable_wallet_session`:return{authorization:e.authorization};case`operation_step_up`:{let t=e.operation;if(!t)throw Error(`Operation step-up pool fill requires exact operation preparation`);return{authorization:e.authorization,operation:t}}}}function Pe(e){return String(e&&typeof e==`object`&&`message`in e?e.message:e||`signature recovery failed`)}function I(e){e instanceof Uint8Array&&e.fill(0)}function Fe(e){if(e?.kind!==`router_ab_ecdsa_derivation_client_signing_material_source_v1`)throw Error(`Router A/B ECDSA derivation client signing material source is required`)}const Ie=6e4,L=new Map,R=new Map,z=new Map,B=new Map,V=new Map,H=new Map;function Le(e){return e===`triples_done`||e===`presign`||e===`done`}function Re(e){return Le(e.clientStage)&&Le(e.serverStage)?`presign`:`triples`}function ze(e){let t=L.get(e);if(!t?.length)return null;let n=t.shift()??null;return t.length?L.set(e,t):L.delete(e),n}async function U(e){return await Ue(e),ze(e.poolKey)}function Be(e,t,n){if(!K(n))return`invalid`;let r=L.get(e)||[];for(let e of r)if(e.materialHandle===n.materialHandle)return`duplicate`;return r.filter(e=>K(e)).length>=5?`capacity_full`:(r.push(n),L.set(e,r),R.set(e,t),`stored`)}function Ve(e,t=Date.now()){let n=L.get(e);if(!n?.length)return[];let r=[],i=[];for(let e of n)K(e,t)?r.push(e):i.push(e);return r.length>0?L.set(e,r):L.delete(e),i}async function He(e){for(let t of e.refs)await e.clientSigningMaterial.destroyClientPresignature({materialHandle:t.materialHandle,poolIdentity:e.poolIdentity,workerCtx:e.workerCtx}).catch(()=>{})}async function Ue(e){await He({refs:Ve(e.poolKey),poolIdentity:e.poolIdentity,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx})}async function W(e,t,n){try{await v(e.walletId,e.ownershipGeneration)}catch(r){throw await qe({poolIdentity:e,poolKey:_(e),clientSigningMaterial:t,workerCtx:n}),r}}async function We(e){await W(e.poolIdentity,e.clientSigningMaterial,e.workerCtx);let t=V.get(e.poolKey);if(t){await t;return}let n=Ge(e);V.set(e.poolKey,n);try{await n}finally{V.get(e.poolKey)===n&&V.delete(e.poolKey)}}async function Ge(e){await Ue(e);let t;t=await e.clientSigningMaterial.listAvailableClientPresignatures({poolIdentity:e.poolIdentity,workerCtx:e.workerCtx});try{await W(e.poolIdentity,e.clientSigningMaterial,e.workerCtx)}catch{}if(q(e.poolKey)!==e.generation){for(let n of t)I(n.bigR33),await e.clientSigningMaterial.destroyClientPresignature({materialHandle:n.materialHandle,poolIdentity:e.poolIdentity,workerCtx:e.workerCtx}).catch(()=>{});return}for(let n of t){let t=Be(e.poolKey,e.poolIdentity,{presignatureId:n.presignatureId,materialHandle:n.materialHandle,bigRB64u:i(n.bigR33),createdAtMs:n.createdAtMs,expiresAtMs:n.expiresAtMs});I(n.bigR33),(t===`invalid`||t===`capacity_full`)&&await e.clientSigningMaterial.destroyClientPresignature({materialHandle:n.materialHandle,poolIdentity:e.poolIdentity,workerCtx:e.workerCtx}).catch(()=>{})}}function G(e){let t=L.get(e);return t?t.reduce((e,t)=>e+(K(t)?1:0),0):0}function K(e,t=Date.now()){let n=Math.floor(Number(e.expiresAtMs));return!!(e.presignatureId&&e.bigRB64u&&e.materialHandle)&&Number.isSafeInteger(n)&&n>t+2e3}function q(e){let t=H.get(e);return t===void 0?(H.set(e,0),0):t}function Ke(e){Z(e);let t=q(e)+1;return H.set(e,t),t}async function qe(e){let t=L.get(e.poolKey)??[];$e(e.poolKey),await He({...e,refs:t})}function J(e){return B.get(e)||0}function Je(e){let t=J(e);B.set(e,t+1)}function Ye(e){let t=J(e);if(t<=1){B.delete(e),Q(e,0);return}B.set(e,t-1)}async function Xe(e,t){let n=z.get(e);if(!n)return;let r=n.snapshot();for(;G(e)===0&&r.kind===`refilling`;)r=await n.waitForChange(r,t)}async function Ze(e){let t=_(y({ownershipGeneration:e.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.scope,materialActivation:e.materialActivation}));return G(t)>0?!0:(await Xe(t,`background`),G(t)>0)}function Y(e,t,n){return{scheduled:!1,reason:e,depth:t,targetDepth:n}}function Qe(){let e=new Set([...X.keys(),...L.keys(),...z.keys(),...B.keys(),...H.keys()]);for(let t of e)Ke(t);L.clear(),R.clear();for(let e of z.values())e.settle();z.clear(),B.clear()}function $e(e){L.delete(e),R.delete(e),Ke(e),z.get(e)?.settle(),z.delete(e)}function et(e){let t=String(e).trim();if(!t)throw Error(`ECDSA presignature wallet id is required`);for(let[e,n]of[...R])n.walletId===t&&$e(e)}const X=new Map;function Z(e){let t=X.get(e);t&&t.timer!==null&&clearTimeout(t.timer),X.delete(e),X.size===0&&typeof window<`u`&&(window.removeEventListener(`online`,$),document.removeEventListener(`visibilitychange`,$))}function Q(e,t){let n=X.get(e);if(!n)return;n.timer!==null&&clearTimeout(n.timer);let r=n.input.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs-Date.now();if(r<=0||q(e)!==n.generation){Z(e);return}n.timer=setTimeout(tt,Math.min(t,r),e)}function $(){if(!(typeof document<`u`&&document.visibilityState===`hidden`))for(let e of X.keys())Q(e,0)}function tt(e){let t=X.get(e);if(!t)return;if(t.timer=null,Date.now()>=t.input.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs){Z(e);return}if(typeof navigator<`u`&&navigator.onLine===!1){Q(e,3e4);return}let n=at(t.input);n.scheduled||Q(e,n.depth>=n.targetDepth?3e4:5e3)}function nt(e,t){t.authorization.kind===`reusable_wallet_session`&&X.get(e)?.input!==t&&(Z(e),X.size===0&&typeof window<`u`&&(window.addEventListener(`online`,$),document.addEventListener(`visibilitychange`,$)),X.set(e,{input:t,generation:q(e),failures:0,timer:null}),Q(e,3e4))}function rt(e,t,n){let r=X.get(e);if(!(!r||r!==t)){switch(n){case`network_error`:case`internal`:case`presign_timeout`:case`temporarily_unavailable`:case`service_unavailable`:case`wallet_session_unavailable`:if(r.failures+=1,r.failures<=3)return}Z(e)}}async function it(e){let{args:t,refillInput:n,poolKey:r,poolIdentity:i,scheduledGeneration:a,targetDepth:o,refillAttemptTimeoutMs:s,progress:c}=e,l=X.get(r)??null;try{for(await We({poolKey:r,poolIdentity:i,clientSigningMaterial:t.clientSigningMaterial,workerCtx:t.workerCtx,generation:a}),G(r)>0&&c.publishAvailable();Date.now()<t.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs;){if(q(r)!==a||(X.get(r)??null)!==l||G(r)>=o||J(r)>0||typeof navigator<`u`&&navigator.onLine===!1)return;let e=Math.min(Date.now()+s,t.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs),i=await _t({...n,routerAbEcdsaDerivationPoolFill:{kind:`router_ab_ecdsa_derivation_signing_worker_pool`,scope:n.routerAbEcdsaDerivationPoolFill.scope,ceremonyExpiresAtMs:e,materialExpiresAtMs:n.routerAbEcdsaDerivationPoolFill.materialExpiresAtMs},trafficClass:`background`});if(C(`evm-family`,{event:`ecdsa_background_refill_result`,authorization:t.authorization.kind,outcome:i.ok?`available`:`failed`,code:i.ok?null:i.code,depth:G(r),targetDepth:o}),!i.ok){rt(r,l,i.code);return}let u=X.get(r);u&&u===l&&(u.failures=0),c.publishAvailable()}}catch{rt(r,l,`internal`)}finally{c.settle(),z.get(r)===c&&z.delete(r);let e=X.get(r);if(e){let t=e.failures>0?2e3*2**e.failures:1e3;G(r)>=o&&(t=3e4),e!==l&&(t=0),Q(r,t)}}}function at(e){try{let t=_e(e.poolPolicy),n=y({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.routerAbEcdsaDerivationPoolFill.scope,materialActivation:e.materialActivation}),r=_(n);R.set(r,n);let i=he(e.targetDepth,t.targetDepth),a=ge(e.triggerIfDepthAtOrBelow,t.lowWatermark,i),o=G(r),s=q(r);if(!t.enabled)return Y(`disabled`,o,i);if(e.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs<=Date.now())return Z(r),Y(`invalid_args`,o,i);if(nt(r,e),o>a)return Y(`depth_above_trigger`,o,i);if(o>=i)return Y(`depth_at_or_above_target`,o,i);if(z.has(r)||J(r)>0)return Y(`in_flight_for_pool_key`,o,i);if(z.size>=t.maxRefillInFlight)return Y(`global_in_flight_limit`,o,i);let c={relayerUrl:e.relayerUrl,keyHandle:e.keyHandle,ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,clientVerifyingShareB64u:e.clientVerifyingShareB64u,clientSigningMaterial:e.clientSigningMaterial,thresholdEcdsaPublicKeyB64u:e.thresholdEcdsaPublicKeyB64u,relayerVerifyingShareB64u:e.relayerVerifyingShareB64u,credential:e.credential,materialActivation:e.materialActivation,routerAbEcdsaDerivationPoolFill:e.routerAbEcdsaDerivationPoolFill,workerCtx:e.workerCtx,...F(e)},l=new Me;return z.set(r,l),it({args:e,refillInput:c,poolKey:r,poolIdentity:n,scheduledGeneration:s,targetDepth:i,refillAttemptTimeoutMs:t.refillAttemptTimeoutMs,progress:l}),{scheduled:!0,reason:`scheduled`,depth:o,targetDepth:i}}catch{return Y(`invalid_args`,0,0)}}function ot(e){return e.map(e=>i(e))}function st(e){return Array.isArray(e)?e.map(e=>String(e||``).trim()).filter(e=>!!e).map(e=>a(e)):[]}async function ct(e){let t=String(e.thresholdEcdsaPublicKeyB64u||``).trim();if(t){let n=a(t);if(n.length!==33)throw Error(`thresholdEcdsaPublicKeyB64u must decode to 33 bytes`);return await b({publicKey33:n,workerCtx:e.workerCtx})}let n=String(e.clientVerifyingShareB64u||``).trim(),r=String(e.relayerVerifyingShareB64u||``).trim();if(!n||!r)throw Error(`Missing thresholdEcdsaPublicKeyB64u (or relayerVerifyingShareB64u fallback) for Router A/B ECDSA derivation signing`);let i=a(n),o=a(r);if(i.length!==33)throw Error(`clientVerifyingShareB64u must decode to 33 bytes`);if(o.length!==33)throw Error(`relayerVerifyingShareB64u must decode to 33 bytes`);return await ne({left33:await b({publicKey33:i,workerCtx:e.workerCtx}),right33:await b({publicKey33:o,workerCtx:e.workerCtx}),workerCtx:e.workerCtx})}function lt(e){return e.trafficClass===`foreground`||z.get(e.poolKey)?.hasForegroundWaiters()?`foreground_presign_pool_refill`:`background_presign_pool_refill`}async function ut(e){for(let t=0;t<2;t+=1){let n=await dt(e);if(n.ok||!ft(n)||t===1)return n}return{ok:!1,code:`stale_session_state`,message:`Router A/B ECDSA derivation pool-fill session stayed stale after retry`}}async function dt(e){Fe(e.clientSigningMaterial);let t=performance.now(),n=e.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs,r=e.routerAbEcdsaDerivationPoolFill.materialExpiresAtMs,a=`ecdsa-presign-v2:${n}:${i(crypto.getRandomValues(new Uint8Array(32)))}`,o=a,s=y({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.routerAbEcdsaDerivationPoolFill.scope,materialActivation:e.materialActivation}),c=null,l=null,u=null,d=null,ee=!1,f=`triples`,p=[],m=!0,h=!1;try{let t=await e.clientSigningMaterial.initClientPresignSession({sessionId:o,groupPublicKey33:e.groupPublicKey33,ceremonyExpiresAtMs:n,materialExpiresAtMs:r,poolIdentity:s,workerCtx:e.workerCtx});if(t.stage!==`triples`||t.outgoingMessages.length!==1)return{ok:!1,code:`presign_init_failed`,message:`Client presign init must emit exactly one first message`};f=t.stage;let g=await ke({relayerUrl:e.relayerUrl,...e.poolFillInitKeySelector,count:1,presignSessionId:a,firstMessageB64u:i(t.outgoingMessages[0]),credential:e.credential,requestTag:lt(e),poolFill:e.routerAbEcdsaDerivationPoolFill,...F(e)});if(!g.ok)return{ok:!1,code:g.code||`presign_init_failed`,message:g.message||`Presign initialization failed`};if(g.presignSessionId!==a||g.ceremonyExpiresAtMs!==n||g.materialExpiresAtMs!==r||n<=Date.now())return{ok:!1,code:`invalid_pool_fill_expiry`,message:`Presign initialization changed the bound identity or deadlines`};let _=g.stage||`triples`,v=st(g.outgoingMessagesB64u);for(let t=0;t<64;t++){if(v.length>0&&!c){let t=await e.clientSigningMaterial.stepClientPresignSession({sessionId:o,stage:Re({clientStage:f,serverStage:_}),incomingMessages:v,workerCtx:e.workerCtx});f=t.stage,v=[],p.push(...t.outgoingMessages),t.presignatureHandle&&t.presignatureBigR33&&(c=t.presignatureHandle,l=t.presignatureBigR33)}if(!ee){let i=performance.now(),o=lt(e),s={relayerUrl:e.relayerUrl,presignSessionId:a,ceremonyExpiresAtMs:n,materialExpiresAtMs:r,stage:Re({clientStage:f,serverStage:_}),outgoingMessagesB64u:ot(p),credential:e.credential,requestTag:o,...F(e)},c=await je(s);if(C(`evm-family`,{event:`ecdsa_presignature_round`,requestTag:o,presignSessionId:a,authorization:e.authorization.kind,round:t,stage:s.stage,durationMs:performance.now()-i,outcome:c.ok?`succeeded`:`failed`}),p=[],!c.ok)return{ok:!1,code:c.code||`presign_step_failed`,message:c.message||`Router A/B ECDSA derivation pool-fill step failed`};v=st(c.outgoingMessagesB64u),_=c.stage||_,c.event===`presign_done`&&(u=String(c.presignatureId||``).trim()||null,d=String(c.bigRB64u||``).trim()||null,ee=!0)}if(c&&l&&u&&d)break}if(!c||!l)return{ok:!1,code:`presign_timeout`,message:`Client presign session did not reach done state`};if(!u||!d)return{ok:!1,code:`presign_timeout`,message:`Server presign session did not reach done state`};if(l.length!==33)return{ok:!1,code:`internal`,message:`Invalid local presignature bigR bytes (expected 33, got ${l.length})`};try{let t=Date.now(),n=i(l);if(n!==d)return{ok:!1,code:`presign_mismatch`,message:`Client/server presignature mismatch (bigR mismatch)`};let a=await e.clientSigningMaterial.admitClientPresignature({materialHandle:c,expectedPresignatureId:u,poolIdentity:s,admissionMode:e.authorization.kind===`operation_step_up`?`resident`:`durable`,workerCtx:e.workerCtx});return a.kind===`discarded_capacity`?{ok:!1,code:`pool_full`,message:`Router A/B ECDSA derivation client presignature pool is full`}:a.kind===`discarded_ambiguous`?{ok:!1,code:`presign_failed`,message:`Router A/B ECDSA derivation client presignature admission was ambiguous`}:(h=!0,m=!1,{ok:!0,kind:`available`,presignature:{presignatureId:u,bigRB64u:n,materialHandle:c,createdAtMs:t,expiresAtMs:r}})}finally{I(l)}}catch(e){return{ok:!1,code:`presign_failed`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Router A/B ECDSA derivation pool-fill handshake failed`)}}finally{C(`evm-family`,{event:`ecdsa_presignature_generation`,requestTag:lt(e),presignSessionId:a,authorization:e.authorization.kind,durationMs:performance.now()-t,outcome:h?`available`:`failed`}),I(l),!h&&c&&await e.clientSigningMaterial.destroyClientPresignature({materialHandle:c,poolIdentity:s,workerCtx:e.workerCtx}).catch(()=>{}),m&&await e.clientSigningMaterial.abortClientPresignSession({sessionId:o,workerCtx:e.workerCtx}).catch(()=>{})}}function ft(e){return e.code===`stale_session_state`||e.code===`stale_pool_fill_session`}function pt(e){let t=l(e);return{ecdsaThresholdKeyId:m(t.ecdsa_threshold_key_id),clientVerifyingShareB64u:g(t.public_identity.derivation_client_share_public_key33_b64u),thresholdEcdsaPublicKeyB64u:t.public_identity.threshold_public_key33_b64u}}function mt(e){let t=Math.floor(Number(e.materialExpiresAtMs)),n=Number.isSafeInteger(e.authorizationExpiresAtMs)?Math.floor(Number(e.authorizationExpiresAtMs)):e.nowMs+Ie,r=Math.min(t,n,e.nowMs+Ie);return Number.isSafeInteger(r)&&r>e.nowMs?r:null}async function ht(e,t,n){let r=null,s=null,l=null,u=null,f=null,p={kind:`unclaimed`},m=null,h={kind:`before_prepare`};try{let g=String(e.relayerUrl||``).trim().replace(/\/+$/g,``);if(!g)return{ok:!1,code:`invalid_args`,message:`Missing relayerUrl for Router A/B ECDSA derivation signing`};let v=pt(e.scope);if(!v.ecdsaThresholdKeyId)return{ok:!1,code:`invalid_args`,message:`Missing ecdsaThresholdKeyId for Router A/B ECDSA derivation signing`};let b=v.clientVerifyingShareB64u;if(!b)return{ok:!1,code:`invalid_args`,message:`Missing clientVerifyingShareB64u for Router A/B ECDSA derivation signing`};if(!(e.signingDigest32 instanceof Uint8Array)||e.signingDigest32.length!==32)return{ok:!1,code:`invalid_args`,message:`signingDigest32 must be 32 bytes for Router A/B ECDSA derivation signing`};let ne=performance.now(),S=await ct({clientVerifyingShareB64u:b,thresholdEcdsaPublicKeyB64u:v.thresholdEcdsaPublicKeyB64u,workerCtx:e.workerCtx});x(e.operationId,`public_key_validation`,ne),s=y({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:g,scope:e.scope,materialActivation:e.materialActivation}),await W(s,e.clientSigningMaterial,e.workerCtx),r=_(s),R.set(r,s),m=q(r);let ie=performance.now();if(l=await U({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx}),x(e.operationId,`pool_lookup`,ie),!l){let t=performance.now();await We({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx,generation:m}),x(e.operationId,`pool_restore`,t),m=q(r),l=await U({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx})}if(!l){let t=performance.now();await Xe(r,`foreground`),x(e.operationId,`refill_wait`,t),m=q(r),l=await U({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx})}if(!l){let t=performance.now();Je(r);try{let t=await _t({...n,trafficClass:`foreground`});if(!t.ok&&t.code===`invalidated`&&(t=await _t({...n,trafficClass:`foreground`})),!t.ok&&t.code!==`pool_full`)return t;!t.ok&&t.code===`pool_full`&&await We({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx,generation:q(r)})}finally{Ye(r)}m=q(r),l=await U({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx}),x(e.operationId,`foreground_refill`,t)}if(C(`evm-family`,{event:`ecdsa_presignature_selection`,operationId:e.operationId,authorization:e.authorization.kind,outcome:l?`available`:`empty`,remainingDepth:G(r),attempt:t}),!l)return{ok:!1,code:`pool_empty`,message:`Router A/B ECDSA derivation client presignature pool is empty`};let ae=Date.now(),w=mt({authorizationExpiresAtMs:e.expiresAtMs,materialExpiresAtMs:l.expiresAtMs,nowMs:ae});if(!w)return{ok:!1,code:`pool_entry_expired`,message:`Router A/B ECDSA derivation client presignature is expired`};if(await W(s,e.clientSigningMaterial,e.workerCtx),m!==q(r))return{ok:!1,code:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature pool was invalidated before prepare`};f=Ne();let T=await c(f),E=d({scope:e.scope,requestId:o(`router-ab-ecdsa-sign`,32,`Router A/B ECDSA derivation sign request`),operationId:e.operationId,operationDigests:e.operationDigests,authorization:e.authorization,materialActivation:e.materialActivation,clientPresignatureId:l.presignatureId,expiresAtMs:w,signingDigest32:e.signingDigest32,clientRerandomizationCommitment32:T});I(T);let D=o(`router-ab-ecdsa-reservation`,32,`Router A/B ECDSA Client presignature reservation`);p={kind:`destroy`};let oe=performance.now(),O=await e.clientSigningMaterial.reserveClientPresignature({materialHandle:l.materialHandle,expectedPresignatureId:l.presignatureId,poolIdentity:s,requestBinding:E.request_id,reservationId:D,leaseExpiresAtMs:E.expires_at_ms,workerCtx:e.workerCtx});if(x(e.operationId,`presignature_reserve`,oe),O.kind===`unavailable`)return O.reason===`claimed_elsewhere`&&(p={kind:`owned_elsewhere`}),t<4?await ht(e,t+1,n):{ok:!1,code:O.reason===`expired`?`pool_entry_expired`:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature is unavailable: ${O.reason}`};if(await W(s,e.clientSigningMaterial,e.workerCtx),m!==q(r))return{ok:!1,code:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature pool was invalidated before prepare`};Q(r,0),h={kind:`prepare_submitted`};let se=performance.now(),k=await le({relayServerUrl:g,credential:e.credential,request:E,onServerTiming:re.bind(void 0,e.operationId,`prepare`)});if(x(e.operationId,`prepare`,se),k.kind===`reusable_wallet_session`){if(!e.reconcileSession)throw Error(`Wallet Session reconciliation is required`);await e.reconcileSession(k.sessionStatus)}let A=k.signing;if(A.server_big_r33_b64u!==l.bigRB64u)return{ok:!1,code:`presign_mismatch`,message:`Router A/B ECDSA derivation SigningWorker returned a different presignature bigR`};let ce=performance.now();await e.clientSigningMaterial.commitClientPresignature({materialHandle:l.materialHandle,poolIdentity:s,requestBinding:E.request_id,reservationId:D,workerCtx:e.workerCtx}),x(e.operationId,`presignature_commit`,ce);let j=a(l.bigRB64u),M=a(A.signing_worker_rerandomization_contribution32_b64u);try{if(j.length!==33)return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation presign bigR must decode to 33 bytes`};if(M.length!==32)return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation SigningWorker rerandomization contribution must decode to 32 bytes`};let t=performance.now();u=await e.clientSigningMaterial.computeSignatureShareFromPresignatureHandle({materialHandle:l.materialHandle,poolIdentity:s,requestBinding:E.request_id,reservationId:D,groupPublicKey33:S,expectedPresignBigR33:j,digest32:e.signingDigest32,clientRerandomizationContribution32:f,signingWorkerRerandomizationContribution32:M,workerCtx:e.workerCtx}),x(e.operationId,`client_share`,t),p={kind:`consumed`}}finally{I(j),I(M)}if(u.length!==32)return{ok:!1,code:`internal`,message:`Invalid Router A/B ECDSA derivation client signature share length (expected 32, got ${u.length})`};let de=ee({scope:e.scope,requestId:E.request_id,operationId:E.operation_id,operationDigests:E.operation_digests,authorization:e.authorization,materialActivation:e.materialActivation,expiresAtMs:E.expires_at_ms,signingDigest32:e.signingDigest32,serverPresignatureId:A.server_presignature_id,clientSignatureShare32:u,clientRerandomizationContribution32:f}),fe=performance.now(),pe=await ue({relayServerUrl:g,credential:e.credential,request:de,onServerTiming:re.bind(void 0,e.operationId,`finalize`)});x(e.operationId,`finalize`,fe);let N=a(pe.signature65_b64u);if(N.length!==65)return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation returned invalid signature length (expected 65, got ${N.length})`};try{let t=performance.now();await te({digest32:e.signingDigest32,signature65:N,publicKey33:S,workerCtx:e.workerCtx}),x(e.operationId,`signature_verify`,t)}catch(e){return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation returned a signature that does not recover to the threshold group public key: ${Pe(e)}`}}return{ok:!0,signature65:N,signature65B64u:pe.signature65_b64u,rB64u:i(N.slice(0,32)),sB64u:i(N.slice(32,64)),recId:N[64]}}catch(t){if(t instanceof ce||t instanceof j)throw t;let n=String(t&&typeof t==`object`&&`message`in t?t.message:t||`Router A/B ECDSA derivation signing failed`);return t instanceof de&&t.code===`expired_local_request`?{ok:!1,code:`pool_entry_expired`,message:n}:r&&s&&m!==null&&h.kind===`before_prepare`&&q(r)!==m?(await qe({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx}),{ok:!1,code:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature pool was invalidated before prepare`}):{ok:!1,code:`router_ab_sign_failed`,message:n}}finally{if(I(u),I(f),l&&s&&p.kind!==`consumed`&&p.kind!==`owned_elsewhere`){let t=!1;if(p.kind===`unclaimed`&&r&&m!==null&&m===q(r)){let e=Be(r,s,l);t=e===`stored`||e===`duplicate`}t||await e.clientSigningMaterial.destroyClientPresignature({materialHandle:l.materialHandle,poolIdentity:s,workerCtx:e.workerCtx}).catch(()=>{})}r&&Q(r,0)}}async function gt(e){let t=pt(e.scope),n=Math.floor(Number(e.expiresAtMs));if(!Number.isSafeInteger(n)||n<=Date.now())return{ok:!1,code:`invalid_pool_fill_expiry`,message:`Router A/B ECDSA derivation pool fill expiry is unavailable or expired`};let r={relayerUrl:e.relayerUrl,keyHandle:e.keyHandle,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,clientVerifyingShareB64u:t.clientVerifyingShareB64u,clientSigningMaterial:e.clientSigningMaterial,thresholdEcdsaPublicKeyB64u:t.thresholdEcdsaPublicKeyB64u,credential:e.credential,materialActivation:e.materialActivation,routerAbEcdsaDerivationPoolFill:{kind:`router_ab_ecdsa_derivation_signing_worker_pool`,scope:e.scope,ceremonyExpiresAtMs:Math.min(n,Date.now()+f-3e4),materialExpiresAtMs:e.authorization.kind===`operation_step_up`?n:Date.now()+s},workerCtx:e.workerCtx,...F(e)},i=await ht(e,0,r);return!i.ok&&(i.code===`pool_entry_expired`||i.code===`pool_entry_unavailable`)?await ht(e,0,r):i}async function _t(e){try{let t=y({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.routerAbEcdsaDerivationPoolFill.scope,materialActivation:e.materialActivation});await W(t,e.clientSigningMaterial,e.workerCtx);let n=_(t);await Ue({poolKey:n,poolIdentity:t,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx});let r=q(n),i=await ct({clientVerifyingShareB64u:e.clientVerifyingShareB64u,thresholdEcdsaPublicKeyB64u:e.thresholdEcdsaPublicKeyB64u,relayerVerifyingShareB64u:e.relayerVerifyingShareB64u,workerCtx:e.workerCtx}),a=await ut({relayerUrl:e.relayerUrl,poolFillInitKeySelector:{keyHandle:h(e.keyHandle)},clientSigningMaterial:e.clientSigningMaterial,groupPublicKey33:i,materialActivation:e.materialActivation,credential:e.credential,poolKey:n,trafficClass:e.trafficClass,routerAbEcdsaDerivationPoolFill:e.routerAbEcdsaDerivationPoolFill,workerCtx:e.workerCtx,...F(e)});if(!a.ok)return a;try{await W(t,e.clientSigningMaterial,e.workerCtx)}catch{}if(q(n)!==r)return await e.clientSigningMaterial.destroyClientPresignature({materialHandle:a.presignature.materialHandle,poolIdentity:t,workerCtx:e.workerCtx}).catch(()=>{}),{ok:!1,code:`invalidated`,message:`Router A/B ECDSA derivation presignature pool invalidated`};let o=Be(n,t,a.presignature);return(o===`capacity_full`||o===`invalid`)&&await e.clientSigningMaterial.destroyClientPresignature({materialHandle:a.presignature.materialHandle,poolIdentity:t,workerCtx:e.workerCtx}).catch(()=>{}),{ok:!0,presignatureId:a.presignature.presignatureId}}catch(e){return{ok:!1,code:`internal`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Router A/B ECDSA derivation presignature refill failed`)}}}export{Ze as a,pe as c,gt as i,et as n,_e as o,at as r,me as s,Qe as t};
+import{H as e,V as t}from"./domainIds-t1lp25yU.js";import{c as n,l as r}from"./participants-BXdREC5k.js";import{i,r as a}from"./base64-BmKR3UqU.js";import{r as o}from"./secureRandomId-8LSc91aN.js";import{t as s}from"./presignatures-BCeq56DG.js";import{B as c,b as l,d as u,h as d,m as ee,p as f,u as p}from"./digestEncoding-CqNXPZY9.js";import{I as m,L as h,R as g}from"./ecdsaCapabilityManifest-DAJEVjlP.js";import{ct as _,n as v,ut as y}from"./walletOwnershipGeneration-CgjCtPrV.js";import{o as b,s as te,t as ne}from"./evmCryptoWasm-BUPb4hBH.js";import{i as x,n as S,r as re,u as C}from"./trace--mRP2OQc.js";import{A as ie,C as ae,D as w,E as T,O as E,S as D,T as oe,k as O,w as se,x as k,y as A}from"./ecdsaDerivationClientWasm-AYOJgTJm.js";import{t as ce}from"./authorizationAdmission-28jo_IVJ.js";import{t as j}from"./walletSessionFailure-CxsVtroW.js";import{c as le,f as M,o as ue,t as de}from"./routerAbNormalSigning-D-UZmCBS.js";async function fe(e){let t=e.clientShare.material;if(t.kind===`worker_loaded`)return;let n=await A({materialHandle:e.clientShare.handle.materialHandle,bindingDigest:e.clientShare.handle.bindingDigest,stateBlob:t.stateBlob,workerCtx:e.workerCtx});if(n.materialHandle!==e.clientShare.handle.materialHandle||n.bindingDigest!==e.clientShare.handle.bindingDigest)throw Error(`[multichain] ECDSA role-local worker material handle mismatch`)}async function pe(e){let t=e.signerSession,n=t.clientShare;if(n.kind===`linked_holder_worker_share`){let e=n.holderHandleId;return{signerSession:t,clientSigningMaterial:me(e),cleanupAfterSign:async()=>void 0}}let r=n;return{signerSession:t,clientSigningMaterial:{kind:`router_ab_ecdsa_derivation_client_signing_material_source_v1`,initClientPresignSession:async t=>(await fe({workerCtx:e.workerCtx,clientShare:r}),await E({materialHandle:r.handle.materialHandle,material:r.material.kind===`worker_loaded`?{kind:`persisted`,materialRef:r.material.materialRef}:{kind:`runtime_loaded`,expectedBindingDigest:r.handle.bindingDigest},...t})),stepClientPresignSession:O,abortClientPresignSession:w,admitClientPresignature:ae,destroyClientPresignature:T,reserveClientPresignature:ie,commitClientPresignature:se,listAvailableClientPresignatures:D.bind(void 0,`role_local_derivation_handle`),computeSignatureShareFromPresignatureHandle:oe},cleanupAfterSign:async()=>void 0}}async function N(e,t){return await k({holderHandleId:e,...t})}function me(e){return{kind:`router_ab_ecdsa_derivation_client_signing_material_source_v1`,initClientPresignSession:N.bind(void 0,e),stepClientPresignSession:O,abortClientPresignSession:w,admitClientPresignature:ae,destroyClientPresignature:T,reserveClientPresignature:ie,commitClientPresignature:se,listAvailableClientPresignatures:D.bind(void 0,`linked_holder_signing_material`),computeSignatureShareFromPresignatureHandle:oe}}function P(e,t,n,r){let i=Math.floor(Number(e));return Number.isFinite(i)?i<n?n:i>r?r:i:t}function he(e,t){return P(e,t,1,5)}function ge(e,t,n){return P(e,t,0,n)}function _e(e){let t=e||M,n=he(t.targetDepth,M.targetDepth),r=ge(t.lowWatermark,M.lowWatermark,n);return{enabled:typeof t.enabled==`boolean`?t.enabled:M.enabled,targetDepth:n,lowWatermark:r,maxRefillInFlight:P(t.maxRefillInFlight,M.maxRefillInFlight,1,8),refillAttemptTimeoutMs:P(t.refillAttemptTimeoutMs,M.refillAttemptTimeoutMs,5e3,12e4)}}function ve(e){let t=Math.floor(Number(e));return Number.isFinite(t)&&t>0?t:2e4}function ye(e){return String(e&&typeof e==`object`&&`message`in e?e.message:e||``)}function be(e){return Error(`[router-ab-ecdsa-derivation] ${e.operation} request timed out after ${e.timeoutMs}ms`)}async function xe(e){let t=ve(e.timeoutMs),n=typeof AbortController==`function`?new AbortController:null,i={...e.init},a=null,o=null,s=!1;try{let c;if(n){let l=e.init.signal;if(l){if(l.aborted)n.abort();else if(typeof l.addEventListener==`function`){let e=()=>n.abort();l.addEventListener(`abort`,e,{once:!0}),o=()=>l.removeEventListener(`abort`,e)}}a=setTimeout(()=>{s=!0,n.abort()},t),c=await r(new Request(e.url,{...i,signal:n.signal}))}else c=await Promise.race([r(new Request(e.url,i)),new Promise((n,r)=>{a=setTimeout(()=>{s=!0,r(be({operation:e.operation,timeoutMs:t}))},t)})]);let l=await c.json().catch(()=>({}));if(s)throw be({operation:e.operation,timeoutMs:t});return{response:c,data:l}}catch(n){if(s)throw be({operation:e.operation,timeoutMs:t});let r=ye(n);throw Error(r||`[router-ab-ecdsa-derivation] ${e.operation} request failed`)}finally{a&&clearTimeout(a),o?.()}}const Se=5e3;function Ce(e,t){let n=Math.min(e-Date.now(),t??Se,Se);return Number.isFinite(n)&&n>0?n:null}function we(n){return e(t(n))||null}function Te(e){let t={"Content-Type":`application/json`};switch(e.credential.kind){case`operation_step_up`:return{ok:!0,headers:t,credentials:`omit`};case`wallet_session_opaque`:{let r=String(e.credential.walletSessionToken||``).trim();return r?(Object.assign(t,n({token:r,home:e.credential.home})),{ok:!0,headers:t,credentials:`omit`}):{ok:!1,code:`invalid_args`,message:`Missing opaque Wallet Session token for Router A/B ECDSA derivation presign pool fill`}}}}function Ee(e){switch(e.authorization.kind){case`reusable_wallet_session`:return{authorization:e.authorization};case`operation_step_up`:{let t=e.operation;if(!t)throw Error(`Operation step-up pool fill requires exact operation preparation`);return{authorization:e.authorization,operation:t}}}}function De(e){let t=String(e.keyHandle||``).trim();return t?{ok:!0,value:{keyHandle:t}}:{ok:!1,code:`invalid_args`,message:`Missing keyHandle for Router A/B ECDSA derivation pool-fill init`}}async function Oe(e){let t=we(e.relayerUrl);if(!t)return{ok:!1,code:`invalid_args`,message:`Missing relayerUrl for Router A/B ECDSA derivation pool-fill init`};if(typeof fetch!=`function`)return{ok:!1,code:`unsupported`,message:`fetch is not available for Router A/B ECDSA derivation pool-fill init`};let n=De(e);if(!n.ok)return n;let r=String(e.requestTag||``).trim(),i=Te(e);if(!i.ok)return i;let a=Ce(e.poolFill.ceremonyExpiresAtMs,e.requestTimeoutMs);if(a===null)return{ok:!1,code:`presign_timeout`,message:`Presign ceremony deadline has elapsed`};try{let{response:o,data:s}=await xe({url:`${t}${e.path}`,operation:`presign/init`,timeoutMs:a,init:{method:`POST`,headers:i.headers,credentials:i.credentials,body:JSON.stringify({...n.value,count:Number.isFinite(e.count)?Math.max(1,Math.floor(Number(e.count))):1,...r?{requestTag:r}:{},poolFill:e.poolFill,presignSessionId:e.presignSessionId,firstMessageB64u:e.firstMessageB64u,...Ee(e)})}});return typeof s.presignSessionId==`string`&&S(s.presignSessionId,`init`,o.headers.get(`Server-Timing`)),o.ok?{ok:s.ok===!0,presignSessionId:s.presignSessionId,...Number.isSafeInteger(s.ceremonyExpiresAtMs)?{ceremonyExpiresAtMs:s.ceremonyExpiresAtMs}:{},...Number.isSafeInteger(s.materialExpiresAtMs)?{materialExpiresAtMs:s.materialExpiresAtMs}:{},stage:s.stage,outgoingMessagesB64u:Array.isArray(s.outgoingMessagesB64u)?s.outgoingMessagesB64u:[],...s.code?{code:s.code}:{},...s.message?{message:s.message}:{}}:{ok:!1,code:s.code||`http_error`,message:s.message||`HTTP ${o.status}`}}catch(e){return{ok:!1,code:`network_error`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Failed Router A/B ECDSA derivation pool-fill init`)}}}async function ke(e){return Oe({...e,path:p})}async function Ae(e){let t=we(e.relayerUrl);if(!t)return{ok:!1,code:`invalid_args`,message:`Missing relayerUrl for Router A/B ECDSA derivation pool-fill step`};if(typeof fetch!=`function`)return{ok:!1,code:`unsupported`,message:`fetch is not available for Router A/B ECDSA derivation pool-fill step`};let n=String(e.presignSessionId||``).trim();if(!n)return{ok:!1,code:`invalid_args`,message:`Missing presignSessionId for Router A/B ECDSA derivation pool-fill step`};let r=String(e.requestTag||``).trim(),i=Te(e);if(!i.ok)return i;let a=Ce(e.ceremonyExpiresAtMs,e.requestTimeoutMs);if(a===null)return{ok:!1,code:`presign_timeout`,message:`Presign ceremony deadline has elapsed`};try{let{response:o,data:s}=await xe({url:`${t}${e.path}`,operation:`presign/step`,timeoutMs:a,init:{method:`POST`,headers:i.headers,credentials:i.credentials,body:JSON.stringify({presignSessionId:n,ceremonyExpiresAtMs:e.ceremonyExpiresAtMs,materialExpiresAtMs:e.materialExpiresAtMs,stage:e.stage,outgoingMessagesB64u:Array.isArray(e.outgoingMessagesB64u)?e.outgoingMessagesB64u:[],...r?{requestTag:r}:{},...Ee(e)})}});return S(n,`step`,o.headers.get(`Server-Timing`)),o.ok?{ok:s.ok===!0,stage:s.stage,event:s.event,outgoingMessagesB64u:Array.isArray(s.outgoingMessagesB64u)?s.outgoingMessagesB64u:[],...s.presignatureId?{presignatureId:s.presignatureId}:{},...s.bigRB64u?{bigRB64u:s.bigRB64u}:{},...s.code?{code:s.code}:{},...s.message?{message:s.message}:{}}:{ok:!1,code:s.code||`http_error`,message:s.message||`HTTP ${o.status}`}}catch(e){return{ok:!1,code:`network_error`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Failed Router A/B ECDSA derivation pool-fill step`)}}}async function je(e){return Ae({...e,path:u})}var Me=class{state={kind:`refilling`,revision:0};waiters=new Map;snapshot(){return this.state}hasForegroundWaiters(){for(let e of this.waiters.values())if(e===`foreground`)return!0;return!1}publishAvailable(){this.state.kind!==`settled`&&(this.state={kind:`refilling`,revision:this.state.revision+1},this.flushWaiters())}settle(){this.state.kind!==`settled`&&(this.state={kind:`settled`,revision:this.state.revision},this.flushWaiters())}waitForChange(e,t){return this.state.kind===`settled`||this.state.revision!==e.revision?Promise.resolve(this.state):new Promise(n=>{this.waiters.set(n,t),(this.state.kind===`settled`||this.state.revision!==e.revision)&&(this.waiters.delete(n),n(this.state))})}flushWaiters(){let e=this.state,t=[...this.waiters.keys()];this.waiters.clear();for(let n of t)n(e)}};function Ne(){let e=globalThis.crypto;if(!e||typeof e.getRandomValues!=`function`)throw Error(`WebCrypto getRandomValues is required for ECDSA rerandomization`);return e.getRandomValues(new Uint8Array(32))}function F(e){switch(e.authorization.kind){case`reusable_wallet_session`:return{authorization:e.authorization};case`operation_step_up`:{let t=e.operation;if(!t)throw Error(`Operation step-up pool fill requires exact operation preparation`);return{authorization:e.authorization,operation:t}}}}function Pe(e){return String(e&&typeof e==`object`&&`message`in e?e.message:e||`signature recovery failed`)}function I(e){e instanceof Uint8Array&&e.fill(0)}function Fe(e){if(e?.kind!==`router_ab_ecdsa_derivation_client_signing_material_source_v1`)throw Error(`Router A/B ECDSA derivation client signing material source is required`)}const Ie=6e4,L=new Map,R=new Map,z=new Map,B=new Map,V=new Map,H=new Map;function Le(e){return e===`triples_done`||e===`presign`||e===`done`}function Re(e){return Le(e.clientStage)&&Le(e.serverStage)?`presign`:`triples`}function ze(e){let t=L.get(e);if(!t?.length)return null;let n=t.shift()??null;return t.length?L.set(e,t):L.delete(e),n}async function U(e){return await Ue(e),ze(e.poolKey)}function Be(e,t,n){if(!K(n))return`invalid`;let r=L.get(e)||[];for(let e of r)if(e.materialHandle===n.materialHandle)return`duplicate`;return r.filter(e=>K(e)).length>=5?`capacity_full`:(r.push(n),L.set(e,r),R.set(e,t),`stored`)}function Ve(e,t=Date.now()){let n=L.get(e);if(!n?.length)return[];let r=[],i=[];for(let e of n)K(e,t)?r.push(e):i.push(e);return r.length>0?L.set(e,r):L.delete(e),i}async function He(e){for(let t of e.refs)await e.clientSigningMaterial.destroyClientPresignature({materialHandle:t.materialHandle,poolIdentity:e.poolIdentity,workerCtx:e.workerCtx}).catch(()=>{})}async function Ue(e){await He({refs:Ve(e.poolKey),poolIdentity:e.poolIdentity,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx})}async function W(e,t,n){try{await v(e.walletId,e.ownershipGeneration)}catch(r){throw await qe({poolIdentity:e,poolKey:_(e),clientSigningMaterial:t,workerCtx:n}),r}}async function We(e){await W(e.poolIdentity,e.clientSigningMaterial,e.workerCtx);let t=V.get(e.poolKey);if(t){await t;return}let n=Ge(e);V.set(e.poolKey,n);try{await n}finally{V.get(e.poolKey)===n&&V.delete(e.poolKey)}}async function Ge(e){await Ue(e);let t;t=await e.clientSigningMaterial.listAvailableClientPresignatures({poolIdentity:e.poolIdentity,workerCtx:e.workerCtx});try{await W(e.poolIdentity,e.clientSigningMaterial,e.workerCtx)}catch{}if(q(e.poolKey)!==e.generation){for(let n of t)I(n.bigR33),await e.clientSigningMaterial.destroyClientPresignature({materialHandle:n.materialHandle,poolIdentity:e.poolIdentity,workerCtx:e.workerCtx}).catch(()=>{});return}for(let n of t){let t=Be(e.poolKey,e.poolIdentity,{presignatureId:n.presignatureId,materialHandle:n.materialHandle,bigRB64u:i(n.bigR33),createdAtMs:n.createdAtMs,expiresAtMs:n.expiresAtMs});I(n.bigR33),(t===`invalid`||t===`capacity_full`)&&await e.clientSigningMaterial.destroyClientPresignature({materialHandle:n.materialHandle,poolIdentity:e.poolIdentity,workerCtx:e.workerCtx}).catch(()=>{})}}function G(e){let t=L.get(e);return t?t.reduce((e,t)=>e+(K(t)?1:0),0):0}function K(e,t=Date.now()){let n=Math.floor(Number(e.expiresAtMs));return!!(e.presignatureId&&e.bigRB64u&&e.materialHandle)&&Number.isSafeInteger(n)&&n>t+2e3}function q(e){let t=H.get(e);return t===void 0?(H.set(e,0),0):t}function Ke(e){Z(e);let t=q(e)+1;return H.set(e,t),t}async function qe(e){let t=L.get(e.poolKey)??[];$e(e.poolKey),await He({...e,refs:t})}function J(e){return B.get(e)||0}function Je(e){let t=J(e);B.set(e,t+1)}function Ye(e){let t=J(e);if(t<=1){B.delete(e),Q(e,0);return}B.set(e,t-1)}async function Xe(e,t){let n=z.get(e);if(!n)return;let r=n.snapshot();for(;G(e)===0&&r.kind===`refilling`;)r=await n.waitForChange(r,t)}async function Ze(e){let t=_(y({ownershipGeneration:e.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.scope,materialActivation:e.materialActivation}));return G(t)>0?!0:(await Xe(t,`background`),G(t)>0)}function Y(e,t,n){return{scheduled:!1,reason:e,depth:t,targetDepth:n}}function Qe(){let e=new Set([...X.keys(),...L.keys(),...z.keys(),...B.keys(),...H.keys()]);for(let t of e)Ke(t);L.clear(),R.clear();for(let e of z.values())e.settle();z.clear(),B.clear()}function $e(e){L.delete(e),R.delete(e),Ke(e),z.get(e)?.settle(),z.delete(e)}function et(e){let t=String(e).trim();if(!t)throw Error(`ECDSA presignature wallet id is required`);for(let[e,n]of[...R])n.walletId===t&&$e(e)}const X=new Map;function Z(e){let t=X.get(e);t&&t.timer!==null&&clearTimeout(t.timer),X.delete(e),X.size===0&&typeof window<`u`&&(window.removeEventListener(`online`,$),document.removeEventListener(`visibilitychange`,$))}function Q(e,t){let n=X.get(e);if(!n)return;n.timer!==null&&clearTimeout(n.timer);let r=n.input.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs-Date.now();if(r<=0||q(e)!==n.generation){Z(e);return}n.timer=setTimeout(tt,Math.min(t,r),e)}function $(){if(!(typeof document<`u`&&document.visibilityState===`hidden`))for(let e of X.keys())Q(e,0)}function tt(e){let t=X.get(e);if(!t)return;if(t.timer=null,Date.now()>=t.input.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs){Z(e);return}if(typeof navigator<`u`&&navigator.onLine===!1){Q(e,3e4);return}let n=at(t.input);n.scheduled||Q(e,n.depth>=n.targetDepth?3e4:5e3)}function nt(e,t){t.authorization.kind===`reusable_wallet_session`&&X.get(e)?.input!==t&&(Z(e),X.size===0&&typeof window<`u`&&(window.addEventListener(`online`,$),document.addEventListener(`visibilitychange`,$)),X.set(e,{input:t,generation:q(e),failures:0,timer:null}),Q(e,3e4))}function rt(e,t,n){let r=X.get(e);if(!(!r||r!==t)){switch(n){case`network_error`:case`internal`:case`presign_timeout`:case`temporarily_unavailable`:case`service_unavailable`:case`wallet_session_unavailable`:if(r.failures+=1,r.failures<=3)return}Z(e)}}async function it(e){let{args:t,refillInput:n,poolKey:r,poolIdentity:i,scheduledGeneration:a,targetDepth:o,refillAttemptTimeoutMs:s,progress:c}=e,l=X.get(r)??null;try{for(await We({poolKey:r,poolIdentity:i,clientSigningMaterial:t.clientSigningMaterial,workerCtx:t.workerCtx,generation:a}),G(r)>0&&c.publishAvailable();Date.now()<t.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs;){if(q(r)!==a||(X.get(r)??null)!==l||G(r)>=o||J(r)>0||typeof navigator<`u`&&navigator.onLine===!1)return;let e=Math.min(Date.now()+s,t.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs),i=await _t({...n,routerAbEcdsaDerivationPoolFill:{kind:`router_ab_ecdsa_derivation_signing_worker_pool`,scope:n.routerAbEcdsaDerivationPoolFill.scope,ceremonyExpiresAtMs:e,materialExpiresAtMs:n.routerAbEcdsaDerivationPoolFill.materialExpiresAtMs},trafficClass:`background`});if(C(`evm-family`,{event:`ecdsa_background_refill_result`,authorization:t.authorization.kind,outcome:i.ok?`available`:`failed`,code:i.ok?null:i.code,depth:G(r),targetDepth:o}),!i.ok){rt(r,l,i.code);return}let u=X.get(r);u&&u===l&&(u.failures=0),c.publishAvailable()}}catch{rt(r,l,`internal`)}finally{c.settle(),z.get(r)===c&&z.delete(r);let e=X.get(r);if(e){let t=e.failures>0?2e3*2**e.failures:1e3;G(r)>=o&&(t=3e4),e!==l&&(t=0),Q(r,t)}}}function at(e){try{let t=_e(e.poolPolicy),n=y({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.routerAbEcdsaDerivationPoolFill.scope,materialActivation:e.materialActivation}),r=_(n);R.set(r,n);let i=he(e.targetDepth,t.targetDepth),a=ge(e.triggerIfDepthAtOrBelow,t.lowWatermark,i),o=G(r),s=q(r);if(!t.enabled)return Y(`disabled`,o,i);if(e.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs<=Date.now())return Z(r),Y(`invalid_args`,o,i);if(nt(r,e),o>a)return Y(`depth_above_trigger`,o,i);if(o>=i)return Y(`depth_at_or_above_target`,o,i);if(z.has(r)||J(r)>0)return Y(`in_flight_for_pool_key`,o,i);if(z.size>=t.maxRefillInFlight)return Y(`global_in_flight_limit`,o,i);let c={relayerUrl:e.relayerUrl,keyHandle:e.keyHandle,ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,clientVerifyingShareB64u:e.clientVerifyingShareB64u,clientSigningMaterial:e.clientSigningMaterial,thresholdEcdsaPublicKeyB64u:e.thresholdEcdsaPublicKeyB64u,relayerVerifyingShareB64u:e.relayerVerifyingShareB64u,credential:e.credential,materialActivation:e.materialActivation,routerAbEcdsaDerivationPoolFill:e.routerAbEcdsaDerivationPoolFill,workerCtx:e.workerCtx,...F(e)},l=new Me;return z.set(r,l),it({args:e,refillInput:c,poolKey:r,poolIdentity:n,scheduledGeneration:s,targetDepth:i,refillAttemptTimeoutMs:t.refillAttemptTimeoutMs,progress:l}),{scheduled:!0,reason:`scheduled`,depth:o,targetDepth:i}}catch{return Y(`invalid_args`,0,0)}}function ot(e){return e.map(e=>i(e))}function st(e){return Array.isArray(e)?e.map(e=>String(e||``).trim()).filter(e=>!!e).map(e=>a(e)):[]}async function ct(e){let t=String(e.thresholdEcdsaPublicKeyB64u||``).trim();if(t){let n=a(t);if(n.length!==33)throw Error(`thresholdEcdsaPublicKeyB64u must decode to 33 bytes`);return await b({publicKey33:n,workerCtx:e.workerCtx})}let n=String(e.clientVerifyingShareB64u||``).trim(),r=String(e.relayerVerifyingShareB64u||``).trim();if(!n||!r)throw Error(`Missing thresholdEcdsaPublicKeyB64u (or relayerVerifyingShareB64u fallback) for Router A/B ECDSA derivation signing`);let i=a(n),o=a(r);if(i.length!==33)throw Error(`clientVerifyingShareB64u must decode to 33 bytes`);if(o.length!==33)throw Error(`relayerVerifyingShareB64u must decode to 33 bytes`);return await ne({left33:await b({publicKey33:i,workerCtx:e.workerCtx}),right33:await b({publicKey33:o,workerCtx:e.workerCtx}),workerCtx:e.workerCtx})}function lt(e){return e.trafficClass===`foreground`||z.get(e.poolKey)?.hasForegroundWaiters()?`foreground_presign_pool_refill`:`background_presign_pool_refill`}async function ut(e){for(let t=0;t<2;t+=1){let n=await dt(e);if(n.ok||!ft(n)||t===1)return n}return{ok:!1,code:`stale_session_state`,message:`Router A/B ECDSA derivation pool-fill session stayed stale after retry`}}async function dt(e){Fe(e.clientSigningMaterial);let t=performance.now(),n=e.routerAbEcdsaDerivationPoolFill.ceremonyExpiresAtMs,r=e.routerAbEcdsaDerivationPoolFill.materialExpiresAtMs,a=`ecdsa-presign-v2:${n}:${i(crypto.getRandomValues(new Uint8Array(32)))}`,o=a,s=y({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.routerAbEcdsaDerivationPoolFill.scope,materialActivation:e.materialActivation}),c=null,l=null,u=null,d=null,ee=!1,f=`triples`,p=[],m=!0,h=!1;try{let t=await e.clientSigningMaterial.initClientPresignSession({sessionId:o,groupPublicKey33:e.groupPublicKey33,ceremonyExpiresAtMs:n,materialExpiresAtMs:r,poolIdentity:s,workerCtx:e.workerCtx});if(t.stage!==`triples`||t.outgoingMessages.length!==1)return{ok:!1,code:`presign_init_failed`,message:`Client presign init must emit exactly one first message`};f=t.stage;let g=await ke({relayerUrl:e.relayerUrl,...e.poolFillInitKeySelector,count:1,presignSessionId:a,firstMessageB64u:i(t.outgoingMessages[0]),credential:e.credential,requestTag:lt(e),poolFill:e.routerAbEcdsaDerivationPoolFill,...F(e)});if(!g.ok)return{ok:!1,code:g.code||`presign_init_failed`,message:g.message||`Presign initialization failed`};if(g.presignSessionId!==a||g.ceremonyExpiresAtMs!==n||g.materialExpiresAtMs!==r||n<=Date.now())return{ok:!1,code:`invalid_pool_fill_expiry`,message:`Presign initialization changed the bound identity or deadlines`};let _=g.stage||`triples`,v=st(g.outgoingMessagesB64u);for(let t=0;t<64;t++){if(v.length>0&&!c){let t=await e.clientSigningMaterial.stepClientPresignSession({sessionId:o,stage:Re({clientStage:f,serverStage:_}),incomingMessages:v,workerCtx:e.workerCtx});f=t.stage,v=[],p.push(...t.outgoingMessages),t.presignatureHandle&&t.presignatureBigR33&&(c=t.presignatureHandle,l=t.presignatureBigR33)}if(!ee){let i=performance.now(),o=lt(e),s={relayerUrl:e.relayerUrl,presignSessionId:a,ceremonyExpiresAtMs:n,materialExpiresAtMs:r,stage:Re({clientStage:f,serverStage:_}),outgoingMessagesB64u:ot(p),credential:e.credential,requestTag:o,...F(e)},c=await je(s);if(C(`evm-family`,{event:`ecdsa_presignature_round`,requestTag:o,presignSessionId:a,authorization:e.authorization.kind,round:t,stage:s.stage,durationMs:performance.now()-i,outcome:c.ok?`succeeded`:`failed`}),p=[],!c.ok)return{ok:!1,code:c.code||`presign_step_failed`,message:c.message||`Router A/B ECDSA derivation pool-fill step failed`};v=st(c.outgoingMessagesB64u),_=c.stage||_,c.event===`presign_done`&&(u=String(c.presignatureId||``).trim()||null,d=String(c.bigRB64u||``).trim()||null,ee=!0)}if(c&&l&&u&&d)break}if(!c||!l)return{ok:!1,code:`presign_timeout`,message:`Client presign session did not reach done state`};if(!u||!d)return{ok:!1,code:`presign_timeout`,message:`Server presign session did not reach done state`};if(l.length!==33)return{ok:!1,code:`internal`,message:`Invalid local presignature bigR bytes (expected 33, got ${l.length})`};try{let t=Date.now(),n=i(l);if(n!==d)return{ok:!1,code:`presign_mismatch`,message:`Client/server presignature mismatch (bigR mismatch)`};let a=await e.clientSigningMaterial.admitClientPresignature({materialHandle:c,expectedPresignatureId:u,poolIdentity:s,admissionMode:e.authorization.kind===`operation_step_up`?`resident`:`durable`,workerCtx:e.workerCtx});return a.kind===`discarded_capacity`?{ok:!1,code:`pool_full`,message:`Router A/B ECDSA derivation client presignature pool is full`}:a.kind===`discarded_ambiguous`?{ok:!1,code:`presign_failed`,message:`Router A/B ECDSA derivation client presignature admission was ambiguous`}:(h=!0,m=!1,{ok:!0,kind:`available`,presignature:{presignatureId:u,bigRB64u:n,materialHandle:c,createdAtMs:t,expiresAtMs:r}})}finally{I(l)}}catch(e){return{ok:!1,code:`presign_failed`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Router A/B ECDSA derivation pool-fill handshake failed`)}}finally{C(`evm-family`,{event:`ecdsa_presignature_generation`,requestTag:lt(e),presignSessionId:a,authorization:e.authorization.kind,durationMs:performance.now()-t,outcome:h?`available`:`failed`}),I(l),!h&&c&&await e.clientSigningMaterial.destroyClientPresignature({materialHandle:c,poolIdentity:s,workerCtx:e.workerCtx}).catch(()=>{}),m&&await e.clientSigningMaterial.abortClientPresignSession({sessionId:o,workerCtx:e.workerCtx}).catch(()=>{})}}function ft(e){return e.code===`stale_session_state`||e.code===`stale_pool_fill_session`}function pt(e){let t=l(e);return{ecdsaThresholdKeyId:m(t.ecdsa_threshold_key_id),clientVerifyingShareB64u:g(t.public_identity.derivation_client_share_public_key33_b64u),thresholdEcdsaPublicKeyB64u:t.public_identity.threshold_public_key33_b64u}}function mt(e){let t=Math.floor(Number(e.materialExpiresAtMs)),n=Number.isSafeInteger(e.authorizationExpiresAtMs)?Math.floor(Number(e.authorizationExpiresAtMs)):e.nowMs+Ie,r=Math.min(t,n,e.nowMs+Ie);return Number.isSafeInteger(r)&&r>e.nowMs?r:null}async function ht(e,t,n){let r=null,s=null,l=null,u=null,f=null,p={kind:`unclaimed`},m=null,h={kind:`before_prepare`};try{let g=String(e.relayerUrl||``).trim().replace(/\/+$/g,``);if(!g)return{ok:!1,code:`invalid_args`,message:`Missing relayerUrl for Router A/B ECDSA derivation signing`};let v=pt(e.scope);if(!v.ecdsaThresholdKeyId)return{ok:!1,code:`invalid_args`,message:`Missing ecdsaThresholdKeyId for Router A/B ECDSA derivation signing`};let b=v.clientVerifyingShareB64u;if(!b)return{ok:!1,code:`invalid_args`,message:`Missing clientVerifyingShareB64u for Router A/B ECDSA derivation signing`};if(!(e.signingDigest32 instanceof Uint8Array)||e.signingDigest32.length!==32)return{ok:!1,code:`invalid_args`,message:`signingDigest32 must be 32 bytes for Router A/B ECDSA derivation signing`};let ne=performance.now(),S=await ct({clientVerifyingShareB64u:b,thresholdEcdsaPublicKeyB64u:v.thresholdEcdsaPublicKeyB64u,workerCtx:e.workerCtx});x(e.operationId,`public_key_validation`,ne),s=y({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:g,scope:e.scope,materialActivation:e.materialActivation}),await W(s,e.clientSigningMaterial,e.workerCtx),r=_(s),R.set(r,s),m=q(r);let ie=performance.now();if(l=await U({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx}),x(e.operationId,`pool_lookup`,ie),!l){let t=performance.now();await We({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx,generation:m}),x(e.operationId,`pool_restore`,t),m=q(r),l=await U({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx})}if(!l){let t=performance.now();await Xe(r,`foreground`),x(e.operationId,`refill_wait`,t),m=q(r),l=await U({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx})}if(!l){let t=performance.now();Je(r);try{let t=await _t({...n,trafficClass:`foreground`});if(!t.ok&&t.code===`invalidated`&&(t=await _t({...n,trafficClass:`foreground`})),!t.ok&&t.code!==`pool_full`)return t;!t.ok&&t.code===`pool_full`&&await We({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx,generation:q(r)})}finally{Ye(r)}m=q(r),l=await U({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx}),x(e.operationId,`foreground_refill`,t)}if(C(`evm-family`,{event:`ecdsa_presignature_selection`,operationId:e.operationId,authorization:e.authorization.kind,outcome:l?`available`:`empty`,remainingDepth:G(r),attempt:t}),!l)return{ok:!1,code:`pool_empty`,message:`Router A/B ECDSA derivation client presignature pool is empty`};let ae=Date.now(),w=mt({authorizationExpiresAtMs:e.expiresAtMs,materialExpiresAtMs:l.expiresAtMs,nowMs:ae});if(!w)return{ok:!1,code:`pool_entry_expired`,message:`Router A/B ECDSA derivation client presignature is expired`};if(await W(s,e.clientSigningMaterial,e.workerCtx),m!==q(r))return{ok:!1,code:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature pool was invalidated before prepare`};f=Ne();let T=await c(f),E=d({scope:e.scope,requestId:o(`router-ab-ecdsa-sign`,32,`Router A/B ECDSA derivation sign request`),operationId:e.operationId,operationDigests:e.operationDigests,authorization:e.authorization,materialActivation:e.materialActivation,clientPresignatureId:l.presignatureId,expiresAtMs:w,signingDigest32:e.signingDigest32,clientRerandomizationCommitment32:T});I(T);let D=o(`router-ab-ecdsa-reservation`,32,`Router A/B ECDSA Client presignature reservation`);p={kind:`destroy`};let oe=performance.now(),O=await e.clientSigningMaterial.reserveClientPresignature({materialHandle:l.materialHandle,expectedPresignatureId:l.presignatureId,poolIdentity:s,requestBinding:E.request_id,reservationId:D,leaseExpiresAtMs:E.expires_at_ms,workerCtx:e.workerCtx});if(x(e.operationId,`presignature_reserve`,oe),O.kind===`unavailable`)return O.reason===`claimed_elsewhere`&&(p={kind:`owned_elsewhere`}),t<4?await ht(e,t+1,n):{ok:!1,code:O.reason===`expired`?`pool_entry_expired`:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature is unavailable: ${O.reason}`};if(await W(s,e.clientSigningMaterial,e.workerCtx),m!==q(r))return{ok:!1,code:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature pool was invalidated before prepare`};Q(r,0),h={kind:`prepare_submitted`};let se=performance.now(),k=await le({relayServerUrl:g,credential:e.credential,request:E,onServerTiming:re.bind(void 0,e.operationId,`prepare`)});if(x(e.operationId,`prepare`,se),k.kind===`reusable_wallet_session`){if(!e.reconcileSession)throw Error(`Wallet Session reconciliation is required`);await e.reconcileSession(k.sessionStatus)}let A=k.signing;if(A.server_big_r33_b64u!==l.bigRB64u)return{ok:!1,code:`presign_mismatch`,message:`Router A/B ECDSA derivation SigningWorker returned a different presignature bigR`};let ce=performance.now();await e.clientSigningMaterial.commitClientPresignature({materialHandle:l.materialHandle,poolIdentity:s,requestBinding:E.request_id,reservationId:D,workerCtx:e.workerCtx}),x(e.operationId,`presignature_commit`,ce);let j=a(l.bigRB64u),M=a(A.signing_worker_rerandomization_contribution32_b64u);try{if(j.length!==33)return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation presign bigR must decode to 33 bytes`};if(M.length!==32)return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation SigningWorker rerandomization contribution must decode to 32 bytes`};let t=performance.now();u=await e.clientSigningMaterial.computeSignatureShareFromPresignatureHandle({materialHandle:l.materialHandle,poolIdentity:s,requestBinding:E.request_id,reservationId:D,groupPublicKey33:S,expectedPresignBigR33:j,digest32:e.signingDigest32,clientRerandomizationContribution32:f,signingWorkerRerandomizationContribution32:M,workerCtx:e.workerCtx}),x(e.operationId,`client_share`,t),p={kind:`consumed`}}finally{I(j),I(M)}if(u.length!==32)return{ok:!1,code:`internal`,message:`Invalid Router A/B ECDSA derivation client signature share length (expected 32, got ${u.length})`};let de=ee({scope:e.scope,requestId:E.request_id,operationId:E.operation_id,operationDigests:E.operation_digests,authorization:e.authorization,materialActivation:e.materialActivation,expiresAtMs:E.expires_at_ms,signingDigest32:e.signingDigest32,serverPresignatureId:A.server_presignature_id,clientSignatureShare32:u,clientRerandomizationContribution32:f}),fe=performance.now(),pe=await ue({relayServerUrl:g,credential:e.credential,request:de,onServerTiming:re.bind(void 0,e.operationId,`finalize`)});x(e.operationId,`finalize`,fe);let N=a(pe.signature65_b64u);if(N.length!==65)return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation returned invalid signature length (expected 65, got ${N.length})`};try{let t=performance.now();await te({digest32:e.signingDigest32,signature65:N,publicKey33:S,workerCtx:e.workerCtx}),x(e.operationId,`signature_verify`,t)}catch(e){return{ok:!1,code:`internal`,message:`Router A/B ECDSA derivation returned a signature that does not recover to the threshold group public key: ${Pe(e)}`}}return{ok:!0,signature65:N,signature65B64u:pe.signature65_b64u,rB64u:i(N.slice(0,32)),sB64u:i(N.slice(32,64)),recId:N[64]}}catch(t){if(t instanceof ce||t instanceof j)throw t;let n=String(t&&typeof t==`object`&&`message`in t?t.message:t||`Router A/B ECDSA derivation signing failed`);return t instanceof de&&t.code===`expired_local_request`?{ok:!1,code:`pool_entry_expired`,message:n}:r&&s&&m!==null&&h.kind===`before_prepare`&&q(r)!==m?(await qe({poolKey:r,poolIdentity:s,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx}),{ok:!1,code:`pool_entry_unavailable`,message:`Router A/B ECDSA derivation client presignature pool was invalidated before prepare`}):{ok:!1,code:`router_ab_sign_failed`,message:n}}finally{if(I(u),I(f),l&&s&&p.kind!==`consumed`&&p.kind!==`owned_elsewhere`){let t=!1;if(p.kind===`unclaimed`&&r&&m!==null&&m===q(r)){let e=Be(r,s,l);t=e===`stored`||e===`duplicate`}t||await e.clientSigningMaterial.destroyClientPresignature({materialHandle:l.materialHandle,poolIdentity:s,workerCtx:e.workerCtx}).catch(()=>{})}r&&Q(r,0)}}async function gt(e){let t=pt(e.scope),n=Math.floor(Number(e.expiresAtMs));if(!Number.isSafeInteger(n)||n<=Date.now())return{ok:!1,code:`invalid_pool_fill_expiry`,message:`Router A/B ECDSA derivation pool fill expiry is unavailable or expired`};let r={relayerUrl:e.relayerUrl,keyHandle:e.keyHandle,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,clientVerifyingShareB64u:t.clientVerifyingShareB64u,clientSigningMaterial:e.clientSigningMaterial,thresholdEcdsaPublicKeyB64u:t.thresholdEcdsaPublicKeyB64u,credential:e.credential,materialActivation:e.materialActivation,routerAbEcdsaDerivationPoolFill:{kind:`router_ab_ecdsa_derivation_signing_worker_pool`,scope:e.scope,ceremonyExpiresAtMs:Math.min(n,Date.now()+f-3e4),materialExpiresAtMs:e.authorization.kind===`operation_step_up`?n:Date.now()+s},workerCtx:e.workerCtx,...F(e)},i=await ht(e,0,r);return!i.ok&&(i.code===`pool_entry_expired`||i.code===`pool_entry_unavailable`)?await ht(e,0,r):i}async function _t(e){try{let t=y({ownershipGeneration:e.credential.ownershipGeneration,relayerUrl:e.relayerUrl,scope:e.routerAbEcdsaDerivationPoolFill.scope,materialActivation:e.materialActivation});await W(t,e.clientSigningMaterial,e.workerCtx);let n=_(t);await Ue({poolKey:n,poolIdentity:t,clientSigningMaterial:e.clientSigningMaterial,workerCtx:e.workerCtx});let r=q(n),i=await ct({clientVerifyingShareB64u:e.clientVerifyingShareB64u,thresholdEcdsaPublicKeyB64u:e.thresholdEcdsaPublicKeyB64u,relayerVerifyingShareB64u:e.relayerVerifyingShareB64u,workerCtx:e.workerCtx}),a=await ut({relayerUrl:e.relayerUrl,poolFillInitKeySelector:{keyHandle:h(e.keyHandle)},clientSigningMaterial:e.clientSigningMaterial,groupPublicKey33:i,materialActivation:e.materialActivation,credential:e.credential,poolKey:n,trafficClass:e.trafficClass,routerAbEcdsaDerivationPoolFill:e.routerAbEcdsaDerivationPoolFill,workerCtx:e.workerCtx,...F(e)});if(!a.ok)return a;try{await W(t,e.clientSigningMaterial,e.workerCtx)}catch{}if(q(n)!==r)return await e.clientSigningMaterial.destroyClientPresignature({materialHandle:a.presignature.materialHandle,poolIdentity:t,workerCtx:e.workerCtx}).catch(()=>{}),{ok:!1,code:`invalidated`,message:`Router A/B ECDSA derivation presignature pool invalidated`};let o=Be(n,t,a.presignature);return(o===`capacity_full`||o===`invalid`)&&await e.clientSigningMaterial.destroyClientPresignature({materialHandle:a.presignature.materialHandle,poolIdentity:t,workerCtx:e.workerCtx}).catch(()=>{}),{ok:!0,presignatureId:a.presignature.presignatureId}}catch(e){return{ok:!1,code:`internal`,message:String(e&&typeof e==`object`&&`message`in e?e.message:e||`Router A/B ECDSA derivation presignature refill failed`)}}}export{Ze as a,pe as c,gt as i,et as n,_e as o,at as r,me as s,Qe as t};

package/dist/public/sdk/{recovery-entrypoint-9e3SXU3t.js → recovery-entrypoint-DJbMDC_m.js}

@@ -1 +1 @@
-import{N as e,s as t}from"./domainIds-t1lp25yU.js";import{i as n,n as r}from"./digests-BIaE0DMd.js";import{i}from"./base64-BmKR3UqU.js";import{r as a}from"./secureRandomId-8LSc91aN.js";import"./walletDbName-Ca0rCq5r.js";import"./activeWalletSession-BJ4B-nJo.js";import"./signingSessionSeal-BFOBKj-J.js";import"./capabilityKinds-DVlGMspk.js";import"./errors-DLUmUo9m.js";import"./signerDomain-BLnlQPAV.js";import{w as o,x as s}from"./registrationIntent-BVPp0k0k.js";import"./presignatures-CjcyX_-F.js";import"./accountIds-Dj_0GoY-.js";import"./device-linking-BsUTtSF7.js";import"./walletAuthority-DGdC9Glh.js";import"./digestEncoding-n8Kr2kow.js";import"./walletAuthMethodRecord-Bi78B6Ab.js";import"./signerSlot-DgLzb3Ee.js";import{j as c,t as l,y as u}from"./indexedDB-CWFDCCbP.js";import"./keccak-BArcwgbj.js";import"./registrationSignerPlan-_8gsSjC0.js";import"./walletCapabilityBindings-BRdFdh3l.js";import"./emailOtpEcdsaDerivationIdentity-0DIuRNRi.js";import"./wallet-recovery-jyfGoejZ.js";import{a as d,c as f,d as p,l as m,n as h,o as g,r as _,s as v,t as y,u as b}from"./walletRecoveryCommit-sr8-RYvn.js";function x(e){throw Error(`Unhandled wallet recovery branch: ${String(e)}`)}function S(e){return e.target.kind===`google_email_otp`}function C(e,t){if(!e||e.stage===`prepared`||e.stage===`google_verified`||e.walletId!==t.walletId||e.target.kind!==t.target.kind)return null;switch(e.target.kind){case`passkey`:return t.kind===`credential_created`&&t.target.kind===`passkey`&&e.target.rpId===t.target.rpId?e:null;case`google_email_otp`:return t.kind===`email_otp_verified`&&t.target.kind===`google_email_otp`&&e.target.googleProvider===t.target.googleProvider?e:null}}function w(){return u(a(`wallet-recovery-reservation`,32,`wallet recovery operation reservations`))}function T(e){return e}const E=`seams:recovery:consumed-code-digests`;function D(){try{let e=JSON.parse(sessionStorage.getItem(E)??`[]`);return Array.isArray(e)?new Set(e.filter(e=>typeof e==`string`)):new Set}catch{return new Set}}function O(e,t){e.add(t);try{sessionStorage.setItem(E,JSON.stringify([...e].slice(-32)))}catch{}}function k(e){e&&e.byteLength>0&&new Uint8Array(e).fill(0)}function A(e){switch(e.recoveryCodeBytes.fill(0),e.stage){case`prepared`:case`google_verified`:return;case`credential_created`:k(e.replacement.factorSecret);return;case`email_otp_verified`:case`manifest_recovered`:k(e.replacement.kind===`passkey`?e.replacement.factorSecret:e.replacement.factor.factorSecret);return}}function j(){return{kind:`refused`}}function M(e){if(typeof e!=`object`||!e)return!1;let t=Reflect.get(e,`name`);return t===`NotAllowedError`||t===`AbortError`}function N(e,t){if(e.target.kind!==`passkey`||!e.prepared.registration)throw Error(`passkey recovery registration is unavailable`);return{stage:`credential_created`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,relayUrl:e.relayUrl,target:e.target,prepared:e.prepared,custodyJson:e.custodyJson,recoveryCodeBytes:e.recoveryCodeBytes,replacement:{kind:`passkey`,registration:t.registration,credentialIdB64u:t.credentialIdB64u,factorSecret:t.factorSecret}}}function P(e,t){return{stage:`email_otp_verified`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,relayUrl:e.relayUrl,target:e.target,prepared:e.prepared,custodyJson:e.custodyJson,recoveryCodeBytes:e.recoveryCodeBytes,replacement:t}}function F(e){let t=e.prepared.registration;if(!t)throw Error(`passkey recovery registration is unavailable`);return{replacementId:t.replacementId,walletAuthMethodId:t.walletAuthMethodId,factor:o({rpId:t.rpId,credentialIdB64u:e.replacement.credentialIdB64u}),factorSecret:e.replacement.factorSecret}}function I(e){let t=e.prepared.registration;if(!t)throw Error(`passkey recovery registration is unavailable`);return t.challengeId}function L(e,t){return{stage:`manifest_recovered`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,relayUrl:e.relayUrl,target:e.target,prepared:e.prepared,custodyJson:e.custodyJson,recoveryCodeBytes:e.recoveryCodeBytes,replacement:e.replacement,recovered:t}}function R(e,t){return{stage:`manifest_recovered`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,relayUrl:e.relayUrl,target:e.target,prepared:e.prepared,custodyJson:e.custodyJson,recoveryCodeBytes:e.recoveryCodeBytes,replacement:e.replacement,recovered:t}}function z(e,t){switch(e.stage){case`credential_created`:return L(e,t);case`email_otp_verified`:return R(e,t);default:return x(e)}}function B(e){return e.authMethod.kind===`passkey`}function V(e){return e.target.kind===`passkey`&&e.replacement.kind===`passkey`}function H(e){return e.target.kind===`google_email_otp`&&e.replacement.kind===`email_otp`}async function U(e){return await e.context.signingEngine.getSignerWorkerContext().requestWorkerOperation({kind:`emailOtp`,request:{type:`releaseWalletRecoveryEmailOtpFactor`,payload:{relayUrl:e.relayUrl,walletId:String(e.walletId),recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId}}})}async function W(e){let t=e.prepared.registration;if(!t)throw Error(`passkey recovery registration is unavailable`);return await m({relayUrl:e.relayUrl,walletId:e.walletId,reservationId:e.prepared.reservationId,recoveryOperationId:e.prepared.recoveryOperationId,targetDeviceId:e.prepared.targetDeviceId,targetAuthorityId:e.prepared.targetAuthorityId,targetWalletAuthMethodId:e.prepared.targetWalletAuthMethodId,challengeId:t.challengeId,replacementId:t.replacementId,webauthnRegistration:e.replacement.registration,replacementEnvelope:e.recovered.replacementEnvelope,ecdsaMaterialPossessionProofs:e.recovered.ecdsaKeySets.map(e=>({keySetId:e.entry.keySetId,proof:e.activation.possessionProof}))})}var G=class{constructor(e=null){this.rpc=e}#e=new Map;#t=new Map;#n=new Map;#r=new Map;#i=new Map;#a=D();async prepareWithCode(t){if(this.#c(),t.signal.aborted)return j();if(t.target.kind===`passkey`){let n=e(t.context.signingEngine.getRpId());if(!n.ok||n.value!==t.target.rpId)return j()}let n=null;try{n=c(t.recoveryCode);let e=i(await r(n));if(this.#a.has(e))return{kind:`consumed`};let o=T(e),s=this.#r.get(o),l=s?.expiresAtMs&&s.expiresAtMs>Date.now()?s.reservationId:w(),u=await p({relayUrl:t.relayUrl,target:t.target,recoveryCodeB64u:i(n),reservationId:l});if(u.kind!==`prepared`)return u.kind===`retryable_conflict`||u.kind===`transport_uncertain`?this.#r.set(o,{reservationId:l,expiresAtMs:Date.now()+3e5}):this.#r.delete(o),u;if(this.#r.delete(o),t.signal.aborted)return this.#r.set(o,{reservationId:u.reservationId,expiresAtMs:u.reservationExpiresAtMs}),j();let d=a(`wallet-recovery-operation`,24,`wallet recovery client operation handles`);return this.#e.set(d,{stage:`prepared`,recoveryOperationId:d,walletId:u.walletId,relayUrl:t.relayUrl,target:t.target,prepared:u,custodyJson:b({walletId:u.walletId,prepared:u}),recoveryCodeBytes:n}),this.#i.set(d,o),n=null,{kind:`prepared`,recoveryOperationId:d,walletId:u.walletId,target:t.target}}catch{return j()}finally{n?.fill(0)}}createPasskey(e){this.#c();let t=this.#e.get(e.operation.recoveryOperationId);if(!t||t.stage!==`prepared`||t.walletId!==e.operation.walletId||t.target.kind!==`passkey`||e.operation.target.kind!==`passkey`||t.target.rpId!==e.operation.target.rpId||this.#n.has(t.recoveryOperationId)||!t.prepared.registration)return Promise.resolve({kind:`refused`});let n=new AbortController;this.#n.set(t.recoveryOperationId,n);let r;try{r=e.context.signingEngine.createWalletRecoveryReplacementCredential({walletId:t.walletId,registration:t.prepared.registration,cancellation:{kind:`abort_signal`,signal:n.signal}})}catch{return this.cancel(t.recoveryOperationId),Promise.resolve({kind:`refused`})}return this.#s({current:t,credentialPromise:r,promptController:n})}async verifyGoogle(e){this.#c();let t=this.#e.get(e.operation.recoveryOperationId);if(!this.rpc||!t||t.stage!==`prepared`||t.target.kind!==`google_email_otp`||e.operation.target.kind!==`google_email_otp`||t.walletId!==e.operation.walletId||t.target.googleProvider!==e.operation.target.googleProvider||t.relayUrl!==e.relayUrl)return j();let n=t.prepared;if(!S(n))return j();try{let r=await this.rpc.verifyGoogle({relayUrl:t.relayUrl,recoveryOperationId:n.recoveryOperationId,reservationId:n.reservationId,idToken:e.idToken});if(r.kind!==`verified`)return r;if(r.recoveryOperationId!==n.recoveryOperationId)return{kind:`transport_uncertain`};let i={kind:`google_verified`,recoveryOperationId:t.recoveryOperationId,walletId:t.walletId,target:t.target,challengeId:r.challengeId,delivery:r.delivery,expiresAtMs:r.expiresAtMs},a={stage:`google_verified`,recoveryOperationId:t.recoveryOperationId,walletId:t.walletId,relayUrl:t.relayUrl,target:t.target,prepared:n,custodyJson:t.custodyJson,recoveryCodeBytes:t.recoveryCodeBytes,verification:i};return this.#e.set(a.recoveryOperationId,a),i}catch{return{kind:`transport_uncertain`}}}async verifyEmailOtp(e){this.#c();let n=this.#e.get(e.operation.recoveryOperationId);if(!this.rpc||!n||n.stage!==`google_verified`||n.walletId!==e.operation.walletId||n.target.kind!==`google_email_otp`||e.operation.target.kind!==`google_email_otp`||n.verification.challengeId!==e.operation.challengeId||e.challengeId!==e.operation.challengeId)return j();let r=t(e.challengeId);if(!r.ok)return j();try{let t=await this.rpc.verifyEmailOtp({relayUrl:n.relayUrl,recoveryOperationId:n.prepared.recoveryOperationId,reservationId:n.prepared.reservationId,challengeId:r.value,otpCode:e.otpCode});if(t.kind!==`verified`)return t;if(t.recoveryOperationId!==n.prepared.recoveryOperationId||t.challengeId!==e.challengeId)return{kind:`transport_uncertain`};let i=await U({context:e.context,relayUrl:n.relayUrl,walletId:n.walletId,recoveryOperationId:n.prepared.recoveryOperationId,reservationId:String(n.prepared.reservationId)});if(i.kind===`existing`){if(i.recoveryOperationId!==String(n.prepared.recoveryOperationId)||i.reservationId!==String(n.prepared.reservationId)||i.factorSecret32.byteLength!==32)return k(i.factorSecret32),{kind:`transport_uncertain`};let t=P(n,{kind:`email_otp`,factor:{replacementId:String(n.prepared.recoveryOperationId),walletAuthMethodId:n.prepared.targetWalletAuthMethodId,factor:s({enrollmentId:i.enrollmentId,enrollmentSealKeyVersion:i.enrollmentSealKeyVersion}),factorSecret:i.factorSecret32},enrollment:{kind:`existing`,enrollmentId:i.enrollmentId,enrollmentSealKeyVersion:i.enrollmentSealKeyVersion},providerSubject:i.providerSubject,verifiedEmail:i.verifiedEmail,registrationAuthorityId:e.challengeId});return this.#e.set(t.recoveryOperationId,t),{kind:`email_otp_verified`,recoveryOperationId:t.recoveryOperationId,walletId:t.walletId,target:t.target,challengeId:e.challengeId}}if(i.kind!==`create`)return i;if(i.recoveryOperationId!==String(n.prepared.recoveryOperationId)||i.reservationId!==String(n.prepared.reservationId))return{kind:`transport_uncertain`};let a=crypto.getRandomValues(new Uint8Array(32)),o=null;try{let t=await e.context.signingEngine.prepareEmailOtpRegistrationEnrollmentMaterialInternal({relayUrl:n.relayUrl,walletId:n.walletId,userId:i.providerSubject,clientSecret32:a});o=a.slice().buffer;let r=P(n,{kind:`email_otp`,factor:{replacementId:String(n.prepared.recoveryOperationId),walletAuthMethodId:n.prepared.targetWalletAuthMethodId,factor:s({enrollmentId:t.enrollmentId,enrollmentSealKeyVersion:t.enrollmentSealKeyVersion}),factorSecret:o},enrollment:{kind:`create`,enrollmentId:t.enrollmentId,providerSubject:i.providerSubject,verifiedEmail:i.verifiedEmail,material:t.emailOtpEnrollment},providerSubject:i.providerSubject,verifiedEmail:i.verifiedEmail,registrationAuthorityId:e.challengeId});return this.#e.set(r.recoveryOperationId,r),o=null,{kind:`email_otp_verified`,recoveryOperationId:r.recoveryOperationId,walletId:r.walletId,target:r.target,challengeId:e.challengeId}}finally{a.fill(0),o&&k(o)}}catch{return{kind:`refused`}}}async finalize(e){let t=String(e.operation.recoveryOperationId),n=this.#t.get(t);if(n)return n;let r=this.#o(e).finally(()=>{this.#t.delete(t)});return this.#t.set(t,r),r}async#o(e){this.#c();let t=C(this.#e.get(e.operation.recoveryOperationId),e.operation);if(!t)return j();try{if(t.stage===`credential_created`||t.stage===`email_otp_verified`){let n=t.stage===`credential_created`?F(t):t.replacement.factor,r=await e.context.signingEngine.recoverWalletCustodyManifest({walletId:t.walletId,prepared:t.prepared,custodyJson:t.custodyJson,recoveryCodeBytes:t.recoveryCodeBytes,replacementFactor:n,recoveryChallengeId:t.stage===`credential_created`?I(t):String(t.prepared.recoveryOperationId),relayUrl:t.relayUrl});if(this.#e.get(t.recoveryOperationId)!==t)return A(t),j();if(t.prepared.reservationExpiresAtMs<=Date.now())return this.cancel(t.recoveryOperationId),j();t.recoveryCodeBytes.fill(0),k(t.stage===`credential_created`?t.replacement.factorSecret:t.replacement.factor.factorSecret),t=z(t,r),this.#e.set(t.recoveryOperationId,t)}if(t.stage===`manifest_recovered`){if(!V(t)&&!H(t))return{kind:`transport_uncertain`};if(t.target.kind===`google_email_otp`&&!this.rpc)return{kind:`refused`};let e=await y({operation:t});if(this.#e.get(t.recoveryOperationId)!==t)return{kind:`transport_uncertain`};await l.putPendingWalletRecoveryCommit(e.pending);let r=V(t)?await W(t):this.rpc?await this.rpc.finalizeEmailOtp({relayUrl:t.relayUrl,walletId:t.walletId,recoveryOperationId:t.prepared.recoveryOperationId,reservationId:t.prepared.reservationId,targetDeviceId:t.prepared.targetDeviceId,targetAuthorityId:t.prepared.targetAuthorityId,targetWalletAuthMethodId:t.prepared.targetWalletAuthMethodId,expectedProviderSubject:t.replacement.providerSubject,expectedEmailHashHex:await n(t.replacement.verifiedEmail),expectedRegistrationAuthorityId:t.replacement.registrationAuthorityId,replacementEnvelope:t.recovered.replacementEnvelope,ecdsaMaterialPossessionProofs:t.recovered.ecdsaKeySets.map(e=>({keySetId:e.entry.keySetId,proof:e.activation.possessionProof})),emailOtpEnrollment:t.replacement.enrollment.kind===`create`?{kind:`create`,material:t.replacement.enrollment.material}:null}):{kind:`refused`};if(r.kind===`refused`)return await l.deletePendingWalletRecoveryCommit(t.prepared.recoveryOperationId),this.#e.get(t.recoveryOperationId)===t&&this.cancel(t.recoveryOperationId),r;if(this.#e.get(t.recoveryOperationId)!==t)return r.kind===`promoted`?{kind:`transport_uncertain`}:r;if(r.kind!==`promoted`)return r;if(t.replacement.kind===`passkey`&&r.authMethod.credentialIdB64u!==t.replacement.credentialIdB64u)return{kind:`transport_uncertain`};let i;if(f(e.payload)){if(!B(r))return{kind:`transport_uncertain`};i={kind:`passkey`,payload:e.payload,promotion:r}}else{if(B(r))return{kind:`transport_uncertain`};i={kind:`google_email_otp`,payload:e.payload,promotion:r}}await _({pending:await h({awaiting:e.pending,promotion:i}),payload:i.payload})}let r=this.#i.get(t.recoveryOperationId);return r&&O(this.#a,r),this.#e.delete(t.recoveryOperationId),this.#i.delete(t.recoveryOperationId),A(t),{kind:`ready_for_sign_in`,walletId:t.walletId}}catch{return{kind:`transport_uncertain`}}}async#s(e){try{let t=await e.credentialPromise;if(this.#e.get(e.current.recoveryOperationId)!==e.current||e.promptController.signal.aborted)return k(t.factorSecret),{kind:`dismissed`};if(e.current.prepared.reservationExpiresAtMs<=Date.now())return k(t.factorSecret),this.cancel(e.current.recoveryOperationId),{kind:`refused`};let n=N(e.current,t);return this.#e.set(n.recoveryOperationId,n),{kind:`credential_created`,recoveryOperationId:n.recoveryOperationId,walletId:n.walletId,target:n.target}}catch(t){return e.promptController.signal.aborted||M(t)?{kind:`dismissed`}:{kind:`transport_uncertain`}}finally{this.#n.get(e.current.recoveryOperationId)===e.promptController&&this.#n.delete(e.current.recoveryOperationId)}}cancel(e){this.#n.get(e)?.abort(),this.#n.delete(e);let t=this.#e.get(e);if(!t)return;let n=this.#i.get(e);this.#i.delete(e),n&&t.prepared.reservationExpiresAtMs>Date.now()&&this.#r.set(n,{reservationId:t.prepared.reservationId,expiresAtMs:t.prepared.reservationExpiresAtMs}),this.#e.delete(e),A(t)}#c(){let e=Date.now();for(let[t,n]of this.#r)n.expiresAtMs<=e&&this.#r.delete(t);for(let[t,n]of this.#e)n.prepared.reservationExpiresAtMs>e||(this.#n.get(t)?.abort(),this.#n.delete(t),this.#e.delete(t),this.#i.delete(t),A(n))}},K=class{#e=new G({verifyGoogle:v,verifyEmailOtp:g,finalizeEmailOtp:d});constructor(t,n){this.context=t,this.relayUrl=n;let r=e(t.signingEngine.getRpId());if(!r.ok)throw Error(`wallet recovery RP ID ${r.error.message}`);this.#t=r.value}#t;targetFor(e){switch(e){case`passkey`:return{kind:e,rpId:this.#t};case`google_email_otp`:return{kind:e,googleProvider:`google`}}}async prepare(e){let t=await this.#e.prepareWithCode({context:this.context,relayUrl:this.relayUrl,recoveryCode:e.recoveryCode,target:e.target,signal:e.signal});return t.kind===`prepared`?(t.target.kind,{kind:`hosted_recovery_prepared`,recoveryOperationId:t.recoveryOperationId,walletId:t.walletId,target:t.target}):t}createPasskey(e){return this.#n({kind:`prepared`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target})}async verifyGoogle(e,t){let n=await this.#e.verifyGoogle({relayUrl:this.relayUrl,operation:{kind:`prepared`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target},idToken:t});return n.kind===`google_verified`?{kind:`hosted_recovery_google_verified`,recoveryOperationId:n.recoveryOperationId,walletId:n.walletId,target:n.target,challengeId:n.challengeId,delivery:n.delivery,expiresAtMs:n.expiresAtMs}:n}async verifyEmailOtp(e,t){let n=await this.#e.verifyEmailOtp({context:this.context,operation:{kind:`google_verified`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target,challengeId:e.challengeId,delivery:e.delivery,expiresAtMs:e.expiresAtMs},challengeId:t.challengeId,otpCode:t.otpCode});return n.kind===`email_otp_verified`?{kind:`hosted_recovery_email_otp_verified`,recoveryOperationId:n.recoveryOperationId,walletId:n.walletId,target:n.target,challengeId:n.challengeId}:n}async finalize(e){return e.kind===`hosted_recovery_credential_created`?await this.#e.finalize({context:this.context,operation:{kind:`credential_created`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target}}):await this.#e.finalize({context:this.context,operation:{kind:`email_otp_verified`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target,challengeId:e.challengeId}})}async cancel(e){this.#e.cancel(e.recoveryOperationId)}async#n(e){let t=await this.#e.createPasskey({context:this.context,operation:e});return t.kind===`credential_created`?this.#r(t):t}#r(e){return{kind:`hosted_recovery_credential_created`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target}}};function q(e){return new K(e.context,e.relayUrl)}export{q as createHostedRecoveryPort};
+import{N as e,s as t}from"./domainIds-t1lp25yU.js";import{i as n,n as r}from"./digests-BIaE0DMd.js";import{i}from"./base64-BmKR3UqU.js";import{r as a}from"./secureRandomId-8LSc91aN.js";import"./walletDbName-Ca0rCq5r.js";import"./activeWalletSession-BJ4B-nJo.js";import"./signingSessionSeal-BFOBKj-J.js";import"./capabilityKinds-DVlGMspk.js";import"./errors-BJBDbwHk.js";import"./signerDomain-BAsLT3XN.js";import{g as o,p as s}from"./registrationIntent-Do1tD1V7.js";import"./presignatures-BCeq56DG.js";import"./accountIds-CW2BP-d9.js";import"./device-linking-DiCNt3iA.js";import"./walletAuthority-BTGAuOi8.js";import"./digestEncoding-CqNXPZY9.js";import"./walletAuthMethodRecord-DLBB5fez.js";import"./signerSlot-D2RZnb27.js";import{j as c,t as l,y as u}from"./indexedDB-C4SDsyOG.js";import"./keccak-mS0Mejjx.js";import"./registrationSignerPlan-DK2b3N_p.js";import"./walletCapabilityBindings-D5YYB7nN.js";import"./emailOtpEcdsaDerivationIdentity-HFQXc1Yw.js";import"./wallet-recovery-BZB2Vu3X.js";import{a as d,c as f,d as p,l as m,n as h,o as g,r as _,s as v,t as y,u as b}from"./walletRecoveryCommit-Cc2LAkCS.js";function x(e){throw Error(`Unhandled wallet recovery branch: ${String(e)}`)}function S(e){return e.target.kind===`google_email_otp`}function C(e,t){if(!e||e.stage===`prepared`||e.stage===`google_verified`||e.walletId!==t.walletId||e.target.kind!==t.target.kind)return null;switch(e.target.kind){case`passkey`:return t.kind===`credential_created`&&t.target.kind===`passkey`&&e.target.rpId===t.target.rpId?e:null;case`google_email_otp`:return t.kind===`email_otp_verified`&&t.target.kind===`google_email_otp`&&e.target.googleProvider===t.target.googleProvider?e:null}}function w(){return u(a(`wallet-recovery-reservation`,32,`wallet recovery operation reservations`))}function T(e){return e}const E=`seams:recovery:consumed-code-digests`;function D(){try{let e=JSON.parse(sessionStorage.getItem(E)??`[]`);return Array.isArray(e)?new Set(e.filter(e=>typeof e==`string`)):new Set}catch{return new Set}}function O(e,t){e.add(t);try{sessionStorage.setItem(E,JSON.stringify([...e].slice(-32)))}catch{}}function k(e){e&&e.byteLength>0&&new Uint8Array(e).fill(0)}function A(e){switch(e.recoveryCodeBytes.fill(0),e.stage){case`prepared`:case`google_verified`:return;case`credential_created`:k(e.replacement.factorSecret);return;case`email_otp_verified`:case`manifest_recovered`:k(e.replacement.kind===`passkey`?e.replacement.factorSecret:e.replacement.factor.factorSecret);return}}function j(){return{kind:`refused`}}function M(e){if(typeof e!=`object`||!e)return!1;let t=Reflect.get(e,`name`);return t===`NotAllowedError`||t===`AbortError`}function N(e,t){if(e.target.kind!==`passkey`||!e.prepared.registration)throw Error(`passkey recovery registration is unavailable`);return{stage:`credential_created`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,relayUrl:e.relayUrl,target:e.target,prepared:e.prepared,custodyJson:e.custodyJson,recoveryCodeBytes:e.recoveryCodeBytes,replacement:{kind:`passkey`,registration:t.registration,credentialIdB64u:t.credentialIdB64u,factorSecret:t.factorSecret}}}function P(e,t){return{stage:`email_otp_verified`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,relayUrl:e.relayUrl,target:e.target,prepared:e.prepared,custodyJson:e.custodyJson,recoveryCodeBytes:e.recoveryCodeBytes,replacement:t}}function F(e){let t=e.prepared.registration;if(!t)throw Error(`passkey recovery registration is unavailable`);return{replacementId:t.replacementId,walletAuthMethodId:t.walletAuthMethodId,factor:o({rpId:t.rpId,credentialIdB64u:e.replacement.credentialIdB64u}),factorSecret:e.replacement.factorSecret}}function I(e){let t=e.prepared.registration;if(!t)throw Error(`passkey recovery registration is unavailable`);return t.challengeId}function L(e,t){return{stage:`manifest_recovered`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,relayUrl:e.relayUrl,target:e.target,prepared:e.prepared,custodyJson:e.custodyJson,recoveryCodeBytes:e.recoveryCodeBytes,replacement:e.replacement,recovered:t}}function R(e,t){return{stage:`manifest_recovered`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,relayUrl:e.relayUrl,target:e.target,prepared:e.prepared,custodyJson:e.custodyJson,recoveryCodeBytes:e.recoveryCodeBytes,replacement:e.replacement,recovered:t}}function z(e,t){switch(e.stage){case`credential_created`:return L(e,t);case`email_otp_verified`:return R(e,t);default:return x(e)}}function B(e){return e.authMethod.kind===`passkey`}function V(e){return e.target.kind===`passkey`&&e.replacement.kind===`passkey`}function H(e){return e.target.kind===`google_email_otp`&&e.replacement.kind===`email_otp`}async function U(e){return await e.context.signingEngine.getSignerWorkerContext().requestWorkerOperation({kind:`emailOtp`,request:{type:`releaseWalletRecoveryEmailOtpFactor`,payload:{relayUrl:e.relayUrl,walletId:String(e.walletId),recoveryOperationId:e.recoveryOperationId,reservationId:e.reservationId}}})}async function W(e){let t=e.prepared.registration;if(!t)throw Error(`passkey recovery registration is unavailable`);return await m({relayUrl:e.relayUrl,walletId:e.walletId,reservationId:e.prepared.reservationId,recoveryOperationId:e.prepared.recoveryOperationId,targetDeviceId:e.prepared.targetDeviceId,targetAuthorityId:e.prepared.targetAuthorityId,targetWalletAuthMethodId:e.prepared.targetWalletAuthMethodId,challengeId:t.challengeId,replacementId:t.replacementId,webauthnRegistration:e.replacement.registration,replacementEnvelope:e.recovered.replacementEnvelope,ecdsaMaterialPossessionProofs:e.recovered.ecdsaKeySets.map(e=>({keySetId:e.entry.keySetId,proof:e.activation.possessionProof}))})}var G=class{constructor(e=null){this.rpc=e}#e=new Map;#t=new Map;#n=new Map;#r=new Map;#i=new Map;#a=D();async prepareWithCode(t){if(this.#c(),t.signal.aborted)return j();if(t.target.kind===`passkey`){let n=e(t.context.signingEngine.getRpId());if(!n.ok||n.value!==t.target.rpId)return j()}let n=null;try{n=c(t.recoveryCode);let e=i(await r(n));if(this.#a.has(e))return{kind:`consumed`};let o=T(e),s=this.#r.get(o),l=s?.expiresAtMs&&s.expiresAtMs>Date.now()?s.reservationId:w(),u=await p({relayUrl:t.relayUrl,target:t.target,recoveryCodeB64u:i(n),reservationId:l});if(u.kind!==`prepared`)return u.kind===`retryable_conflict`||u.kind===`transport_uncertain`?this.#r.set(o,{reservationId:l,expiresAtMs:Date.now()+3e5}):this.#r.delete(o),u;if(this.#r.delete(o),t.signal.aborted)return this.#r.set(o,{reservationId:u.reservationId,expiresAtMs:u.reservationExpiresAtMs}),j();let d=a(`wallet-recovery-operation`,24,`wallet recovery client operation handles`);return this.#e.set(d,{stage:`prepared`,recoveryOperationId:d,walletId:u.walletId,relayUrl:t.relayUrl,target:t.target,prepared:u,custodyJson:b({walletId:u.walletId,prepared:u}),recoveryCodeBytes:n}),this.#i.set(d,o),n=null,{kind:`prepared`,recoveryOperationId:d,walletId:u.walletId,target:t.target}}catch{return j()}finally{n?.fill(0)}}createPasskey(e){this.#c();let t=this.#e.get(e.operation.recoveryOperationId);if(!t||t.stage!==`prepared`||t.walletId!==e.operation.walletId||t.target.kind!==`passkey`||e.operation.target.kind!==`passkey`||t.target.rpId!==e.operation.target.rpId||this.#n.has(t.recoveryOperationId)||!t.prepared.registration)return Promise.resolve({kind:`refused`});let n=new AbortController;this.#n.set(t.recoveryOperationId,n);let r;try{r=e.context.signingEngine.createWalletRecoveryReplacementCredential({walletId:t.walletId,registration:t.prepared.registration,cancellation:{kind:`abort_signal`,signal:n.signal}})}catch{return this.cancel(t.recoveryOperationId),Promise.resolve({kind:`refused`})}return this.#s({current:t,credentialPromise:r,promptController:n})}async verifyGoogle(e){this.#c();let t=this.#e.get(e.operation.recoveryOperationId);if(!this.rpc||!t||t.stage!==`prepared`||t.target.kind!==`google_email_otp`||e.operation.target.kind!==`google_email_otp`||t.walletId!==e.operation.walletId||t.target.googleProvider!==e.operation.target.googleProvider||t.relayUrl!==e.relayUrl)return j();let n=t.prepared;if(!S(n))return j();try{let r=await this.rpc.verifyGoogle({relayUrl:t.relayUrl,recoveryOperationId:n.recoveryOperationId,reservationId:n.reservationId,idToken:e.idToken});if(r.kind!==`verified`)return r;if(r.recoveryOperationId!==n.recoveryOperationId)return{kind:`transport_uncertain`};let i={kind:`google_verified`,recoveryOperationId:t.recoveryOperationId,walletId:t.walletId,target:t.target,challengeId:r.challengeId,delivery:r.delivery,expiresAtMs:r.expiresAtMs},a={stage:`google_verified`,recoveryOperationId:t.recoveryOperationId,walletId:t.walletId,relayUrl:t.relayUrl,target:t.target,prepared:n,custodyJson:t.custodyJson,recoveryCodeBytes:t.recoveryCodeBytes,verification:i};return this.#e.set(a.recoveryOperationId,a),i}catch{return{kind:`transport_uncertain`}}}async verifyEmailOtp(e){this.#c();let n=this.#e.get(e.operation.recoveryOperationId);if(!this.rpc||!n||n.stage!==`google_verified`||n.walletId!==e.operation.walletId||n.target.kind!==`google_email_otp`||e.operation.target.kind!==`google_email_otp`||n.verification.challengeId!==e.operation.challengeId||e.challengeId!==e.operation.challengeId)return j();let r=t(e.challengeId);if(!r.ok)return j();try{let t=await this.rpc.verifyEmailOtp({relayUrl:n.relayUrl,recoveryOperationId:n.prepared.recoveryOperationId,reservationId:n.prepared.reservationId,challengeId:r.value,otpCode:e.otpCode});if(t.kind!==`verified`)return t;if(t.recoveryOperationId!==n.prepared.recoveryOperationId||t.challengeId!==e.challengeId)return{kind:`transport_uncertain`};let i=await U({context:e.context,relayUrl:n.relayUrl,walletId:n.walletId,recoveryOperationId:n.prepared.recoveryOperationId,reservationId:String(n.prepared.reservationId)});if(i.kind===`existing`){if(i.recoveryOperationId!==String(n.prepared.recoveryOperationId)||i.reservationId!==String(n.prepared.reservationId)||i.factorSecret32.byteLength!==32)return k(i.factorSecret32),{kind:`transport_uncertain`};let t=P(n,{kind:`email_otp`,factor:{replacementId:String(n.prepared.recoveryOperationId),walletAuthMethodId:n.prepared.targetWalletAuthMethodId,factor:s({enrollmentId:i.enrollmentId,enrollmentSealKeyVersion:i.enrollmentSealKeyVersion}),factorSecret:i.factorSecret32},enrollment:{kind:`existing`,enrollmentId:i.enrollmentId,enrollmentSealKeyVersion:i.enrollmentSealKeyVersion},providerSubject:i.providerSubject,verifiedEmail:i.verifiedEmail,registrationAuthorityId:e.challengeId});return this.#e.set(t.recoveryOperationId,t),{kind:`email_otp_verified`,recoveryOperationId:t.recoveryOperationId,walletId:t.walletId,target:t.target,challengeId:e.challengeId}}if(i.kind!==`create`)return i;if(i.recoveryOperationId!==String(n.prepared.recoveryOperationId)||i.reservationId!==String(n.prepared.reservationId))return{kind:`transport_uncertain`};let a=crypto.getRandomValues(new Uint8Array(32)),o=null;try{let t=await e.context.signingEngine.prepareEmailOtpRegistrationEnrollmentMaterialInternal({relayUrl:n.relayUrl,walletId:n.walletId,userId:i.providerSubject,clientSecret32:a});o=a.slice().buffer;let r=P(n,{kind:`email_otp`,factor:{replacementId:String(n.prepared.recoveryOperationId),walletAuthMethodId:n.prepared.targetWalletAuthMethodId,factor:s({enrollmentId:t.enrollmentId,enrollmentSealKeyVersion:t.enrollmentSealKeyVersion}),factorSecret:o},enrollment:{kind:`create`,enrollmentId:t.enrollmentId,providerSubject:i.providerSubject,verifiedEmail:i.verifiedEmail,material:t.emailOtpEnrollment},providerSubject:i.providerSubject,verifiedEmail:i.verifiedEmail,registrationAuthorityId:e.challengeId});return this.#e.set(r.recoveryOperationId,r),o=null,{kind:`email_otp_verified`,recoveryOperationId:r.recoveryOperationId,walletId:r.walletId,target:r.target,challengeId:e.challengeId}}finally{a.fill(0),o&&k(o)}}catch{return{kind:`refused`}}}async finalize(e){let t=String(e.operation.recoveryOperationId),n=this.#t.get(t);if(n)return n;let r=this.#o(e).finally(()=>{this.#t.delete(t)});return this.#t.set(t,r),r}async#o(e){this.#c();let t=C(this.#e.get(e.operation.recoveryOperationId),e.operation);if(!t)return j();try{if(t.stage===`credential_created`||t.stage===`email_otp_verified`){let n=t.stage===`credential_created`?F(t):t.replacement.factor,r=await e.context.signingEngine.recoverWalletCustodyManifest({walletId:t.walletId,prepared:t.prepared,custodyJson:t.custodyJson,recoveryCodeBytes:t.recoveryCodeBytes,replacementFactor:n,recoveryChallengeId:t.stage===`credential_created`?I(t):String(t.prepared.recoveryOperationId),relayUrl:t.relayUrl});if(this.#e.get(t.recoveryOperationId)!==t)return A(t),j();if(t.prepared.reservationExpiresAtMs<=Date.now())return this.cancel(t.recoveryOperationId),j();t.recoveryCodeBytes.fill(0),k(t.stage===`credential_created`?t.replacement.factorSecret:t.replacement.factor.factorSecret),t=z(t,r),this.#e.set(t.recoveryOperationId,t)}if(t.stage===`manifest_recovered`){if(!V(t)&&!H(t))return{kind:`transport_uncertain`};if(t.target.kind===`google_email_otp`&&!this.rpc)return{kind:`refused`};let e=await y({operation:t});if(this.#e.get(t.recoveryOperationId)!==t)return{kind:`transport_uncertain`};await l.putPendingWalletRecoveryCommit(e.pending);let r=V(t)?await W(t):this.rpc?await this.rpc.finalizeEmailOtp({relayUrl:t.relayUrl,walletId:t.walletId,recoveryOperationId:t.prepared.recoveryOperationId,reservationId:t.prepared.reservationId,targetDeviceId:t.prepared.targetDeviceId,targetAuthorityId:t.prepared.targetAuthorityId,targetWalletAuthMethodId:t.prepared.targetWalletAuthMethodId,expectedProviderSubject:t.replacement.providerSubject,expectedEmailHashHex:await n(t.replacement.verifiedEmail),expectedRegistrationAuthorityId:t.replacement.registrationAuthorityId,replacementEnvelope:t.recovered.replacementEnvelope,ecdsaMaterialPossessionProofs:t.recovered.ecdsaKeySets.map(e=>({keySetId:e.entry.keySetId,proof:e.activation.possessionProof})),emailOtpEnrollment:t.replacement.enrollment.kind===`create`?{kind:`create`,material:t.replacement.enrollment.material}:null}):{kind:`refused`};if(r.kind===`refused`)return await l.deletePendingWalletRecoveryCommit(t.prepared.recoveryOperationId),this.#e.get(t.recoveryOperationId)===t&&this.cancel(t.recoveryOperationId),r;if(this.#e.get(t.recoveryOperationId)!==t)return r.kind===`promoted`?{kind:`transport_uncertain`}:r;if(r.kind!==`promoted`)return r;if(t.replacement.kind===`passkey`&&r.authMethod.credentialIdB64u!==t.replacement.credentialIdB64u)return{kind:`transport_uncertain`};let i;if(f(e.payload)){if(!B(r))return{kind:`transport_uncertain`};i={kind:`passkey`,payload:e.payload,promotion:r}}else{if(B(r))return{kind:`transport_uncertain`};i={kind:`google_email_otp`,payload:e.payload,promotion:r}}await _({pending:await h({awaiting:e.pending,promotion:i}),payload:i.payload})}let r=this.#i.get(t.recoveryOperationId);return r&&O(this.#a,r),this.#e.delete(t.recoveryOperationId),this.#i.delete(t.recoveryOperationId),A(t),{kind:`ready_for_sign_in`,walletId:t.walletId}}catch{return{kind:`transport_uncertain`}}}async#s(e){try{let t=await e.credentialPromise;if(this.#e.get(e.current.recoveryOperationId)!==e.current||e.promptController.signal.aborted)return k(t.factorSecret),{kind:`dismissed`};if(e.current.prepared.reservationExpiresAtMs<=Date.now())return k(t.factorSecret),this.cancel(e.current.recoveryOperationId),{kind:`refused`};let n=N(e.current,t);return this.#e.set(n.recoveryOperationId,n),{kind:`credential_created`,recoveryOperationId:n.recoveryOperationId,walletId:n.walletId,target:n.target}}catch(t){return e.promptController.signal.aborted||M(t)?{kind:`dismissed`}:{kind:`transport_uncertain`}}finally{this.#n.get(e.current.recoveryOperationId)===e.promptController&&this.#n.delete(e.current.recoveryOperationId)}}cancel(e){this.#n.get(e)?.abort(),this.#n.delete(e);let t=this.#e.get(e);if(!t)return;let n=this.#i.get(e);this.#i.delete(e),n&&t.prepared.reservationExpiresAtMs>Date.now()&&this.#r.set(n,{reservationId:t.prepared.reservationId,expiresAtMs:t.prepared.reservationExpiresAtMs}),this.#e.delete(e),A(t)}#c(){let e=Date.now();for(let[t,n]of this.#r)n.expiresAtMs<=e&&this.#r.delete(t);for(let[t,n]of this.#e)n.prepared.reservationExpiresAtMs>e||(this.#n.get(t)?.abort(),this.#n.delete(t),this.#e.delete(t),this.#i.delete(t),A(n))}},K=class{#e=new G({verifyGoogle:v,verifyEmailOtp:g,finalizeEmailOtp:d});constructor(t,n){this.context=t,this.relayUrl=n;let r=e(t.signingEngine.getRpId());if(!r.ok)throw Error(`wallet recovery RP ID ${r.error.message}`);this.#t=r.value}#t;targetFor(e){switch(e){case`passkey`:return{kind:e,rpId:this.#t};case`google_email_otp`:return{kind:e,googleProvider:`google`}}}async prepare(e){let t=await this.#e.prepareWithCode({context:this.context,relayUrl:this.relayUrl,recoveryCode:e.recoveryCode,target:e.target,signal:e.signal});return t.kind===`prepared`?(t.target.kind,{kind:`hosted_recovery_prepared`,recoveryOperationId:t.recoveryOperationId,walletId:t.walletId,target:t.target}):t}createPasskey(e){return this.#n({kind:`prepared`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target})}async verifyGoogle(e,t){let n=await this.#e.verifyGoogle({relayUrl:this.relayUrl,operation:{kind:`prepared`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target},idToken:t});return n.kind===`google_verified`?{kind:`hosted_recovery_google_verified`,recoveryOperationId:n.recoveryOperationId,walletId:n.walletId,target:n.target,challengeId:n.challengeId,delivery:n.delivery,expiresAtMs:n.expiresAtMs}:n}async verifyEmailOtp(e,t){let n=await this.#e.verifyEmailOtp({context:this.context,operation:{kind:`google_verified`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target,challengeId:e.challengeId,delivery:e.delivery,expiresAtMs:e.expiresAtMs},challengeId:t.challengeId,otpCode:t.otpCode});return n.kind===`email_otp_verified`?{kind:`hosted_recovery_email_otp_verified`,recoveryOperationId:n.recoveryOperationId,walletId:n.walletId,target:n.target,challengeId:n.challengeId}:n}async finalize(e){return e.kind===`hosted_recovery_credential_created`?await this.#e.finalize({context:this.context,operation:{kind:`credential_created`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target}}):await this.#e.finalize({context:this.context,operation:{kind:`email_otp_verified`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target,challengeId:e.challengeId}})}async cancel(e){this.#e.cancel(e.recoveryOperationId)}async#n(e){let t=await this.#e.createPasskey({context:this.context,operation:e});return t.kind===`credential_created`?this.#r(t):t}#r(e){return{kind:`hosted_recovery_credential_created`,recoveryOperationId:e.recoveryOperationId,walletId:e.walletId,target:e.target}}};function q(e){return new K(e.context,e.relayUrl)}export{q as createHostedRecoveryPort};