@seams/wallet 0.26.0 → 0.28.0

package/dist/esm/sdk/{device-linking-BsUTtSF7.js → device-linking-DiCNt3iA.js}

@@ -1 +1 @@
-import{A as e,E as t,N as n,O as r,d as i,f as a,g as o,i as s,k as c,u as l}from"./domainIds-t1lp25yU.js";import{S as u,t as ee,y as te}from"./digests-BIaE0DMd.js";import{i as d,r as f}from"./base64-BmKR3UqU.js";import{C as p,D as ne,E as m,H as h,J as g,K as _,O as re,P as v,R as ie,S as y,T as ae,U as oe,W as b,_ as x,b as S,c as C,d as w,f as se,g as T,h as E,k as ce,l as D,m as O,n as le,o as ue,p as k,q as A,s as de,u as j,v as fe,w as pe,x as M,y as N}from"./activeWalletSession-BJ4B-nJo.js";import{d as me,f as he,h as ge,m as _e,p as ve}from"./capabilityKinds-DVlGMspk.js";import{a as ye,o as P,r as F}from"./canonicalPrimitives-Jd3i_Ngz.js";import{$ as be,F as xe,I as Se,L as Ce,P as we,V as Te,_ as Ee,d as De,f as Oe,g as ke,x as Ae,y as je}from"./walletAuthority-DGdC9Glh.js";import{It as Me,Nt as Ne,a as I,i as Pe,n as L,o as Fe,r as Ie,s as R,t as z}from"./digestEncoding-n8Kr2kow.js";import{r as Le}from"./walletAuthMethodRecord-Bi78B6Ab.js";function Re(e){throw Error(`[LinkSessionStateV1] unsupported state: ${String(e)}`)}const ze=`x25519-hkdf-sha256-chacha20poly1305-v1`,Be=/^[A-Za-z0-9_-]+$/,Ve=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`registeredAtMs`],He=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`ephemeralPublicKeyB64u`,`nonceB64u`,`sealedExportRootB64u`,`bindingDigestB64u`,`ciphertextDigestB64u`,`sealedAtMs`];function Ue(e,t=`recipientPublicKeyB64u`){if(typeof e!=`string`||!Be.test(e))throw Error(`${t} must be unpadded base64url`);let n;try{n=f(e)}catch{throw Error(`${t} must be valid base64url`)}if(d(n)!==e)throw Error(`${t} must be canonical base64url`);if(n.length!==32)throw Error(`${t} must decode to a 32-byte X25519 public key`);return e}function We(e){return{linkSessionId:e.linkSessionId,walletId:e.walletId,walletKeyId:e.walletKeyId,targetFactor:e.targetFactor,enrollmentId:e.enrollmentId,deviceId:e.deviceId,revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:e.applicationBindingDigestB64u,registeredPublicKeyB64u:e.registeredPublicKeyB64u,recipientPublicKeyB64u:e.recipientPublicKeyB64u}}function Ge(e){return JSON.stringify({linkSessionId:String(e.linkSessionId),walletId:String(e.walletId),walletKeyId:String(e.walletKeyId),targetFactor:e.targetFactor,enrollmentId:String(e.enrollmentId),deviceId:String(e.deviceId),revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:String(e.applicationBindingDigestB64u),registeredPublicKeyB64u:String(e.registeredPublicKeyB64u),recipientPublicKeyB64u:String(e.recipientPublicKeyB64u)})}function Ke(t){let n=Ye(t,Ve,`LinkedDeviceEd25519ExportRootRecipientV1`);if(n.kind!==`linked_device_ed25519_export_root_recipient_v1`)throw Error(`LinkedDeviceEd25519ExportRootRecipientV1.kind is invalid`);return Xe(n.transferAlg,`LinkedDeviceEd25519ExportRootRecipientV1.transferAlg`),{kind:`linked_device_ed25519_export_root_recipient_v1`,linkSessionId:v(l(n.linkSessionId),`LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId`),walletId:v(c(n.walletId),`walletId`),walletKeyId:v(e(n.walletKeyId),`walletKeyId`),enrollmentId:v(i(n.enrollmentId),`enrollmentId`),deviceId:v(a(n.deviceId),`deviceId`),transferAlg:ze,applicationBindingDigestB64u:m(n.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:ne(n.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:Je(n.targetFactor),revocationEpoch:Ze(n.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:Ue(n.recipientPublicKeyB64u,`recipientPublicKeyB64u`),registeredAtMs:Qe(n.registeredAtMs,`registeredAtMs`)}}function qe(t){let n=Ye(t,He,`LinkedDeviceEd25519ExportRootPackageV1`);if(n.kind!==`linked_device_ed25519_export_root_package_v1`)throw Error(`LinkedDeviceEd25519ExportRootPackageV1.kind is invalid`);Xe(n.transferAlg,`LinkedDeviceEd25519ExportRootPackageV1.transferAlg`);let r=Ue(n.recipientPublicKeyB64u,`recipientPublicKeyB64u`),o=Ue(n.ephemeralPublicKeyB64u,`ephemeralPublicKeyB64u`);if(r===o)throw Error(`ephemeralPublicKeyB64u repeats the recipient key`);return{kind:`linked_device_ed25519_export_root_package_v1`,linkSessionId:v(l(n.linkSessionId),`linkSessionId`),walletId:v(c(n.walletId),`walletId`),walletKeyId:v(e(n.walletKeyId),`walletKeyId`),enrollmentId:v(i(n.enrollmentId),`enrollmentId`),deviceId:v(a(n.deviceId),`deviceId`),transferAlg:ze,applicationBindingDigestB64u:m(n.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:ne(n.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:Je(n.targetFactor),revocationEpoch:Ze(n.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:r,ephemeralPublicKeyB64u:o,nonceB64u:ce(n.nonceB64u,`nonceB64u`),sealedExportRootB64u:re(n.sealedExportRootB64u,`sealedExportRootB64u`),bindingDigestB64u:m(n.bindingDigestB64u,`bindingDigestB64u`),ciphertextDigestB64u:m(n.ciphertextDigestB64u,`ciphertextDigestB64u`),sealedAtMs:Qe(n.sealedAtMs,`sealedAtMs`)}}function Je(e){switch(Ye(e,[`kind`],`targetFactor`).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`targetFactor.kind is unsupported`)}}function Ye(e,t,n){let r=u(e,n);g(r,t,n);for(let e of t)if(r[e]===void 0)throw Error(`${n}.${e} is required`);return r}function Xe(e,t){if(e!==`x25519-hkdf-sha256-chacha20poly1305-v1`)throw Error(`${t} must be ${ze}`)}function Ze(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function Qe(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive unix-millisecond timestamp`);return e}function B(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);return e}function V(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} must not be empty`);if(n!==e)throw Error(`${t} must not be padded with whitespace`);return n}function $e(e,t){let r=n(V(e,t));if(!r.ok)throw Error(`${t} is invalid: ${r.error.message}`);return r.value}function H(e,t,n){if(e!==t)throw Error(`${n} must be ${String(t)}`);return t}function et(e){let t=`WalletAddAuthMethodRegistrationOptions`,n=B(e,t);H(n.kind,`webauthn_add_auth_method_registration_v1`,`${t}.kind`);let r=B(n.user,`${t}.user`),i=B(n.authenticatorSelection,`${t}.authenticatorSelection`),a=B(B(B(n.extensions,`${t}.extensions`).prf,`${t}.extensions.prf`).eval,`${t}.extensions.prf.eval`);if(!Array.isArray(n.pubKeyCredParams)||n.pubKeyCredParams.length!==2)throw Error(`${t}.pubKeyCredParams must list exactly two algorithms`);let[o,s]=n.pubKeyCredParams;if(H(B(o,`${t}.pubKeyCredParams[0]`).type,`public-key`,`${t}.pubKeyCredParams[0].type`),H(B(o,`${t}.pubKeyCredParams[0]`).alg,-7,`${t}.pubKeyCredParams[0].alg`),H(B(s,`${t}.pubKeyCredParams[1]`).type,`public-key`,`${t}.pubKeyCredParams[1].type`),H(B(s,`${t}.pubKeyCredParams[1]`).alg,-257,`${t}.pubKeyCredParams[1].alg`),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);let c=n.excludeCredentials.map((e,n)=>{let r=B(e,`${t}.excludeCredentials[${n}]`);return{type:H(r.type,`public-key`,`${t}.excludeCredentials[${n}].type`),id:V(r.id,`${t}.excludeCredentials[${n}].id`)}}),l=n.timeoutMs;if(typeof l!=`number`||!Number.isSafeInteger(l)||l<=0)throw Error(`${t}.timeoutMs must be a positive safe integer`);return{kind:`webauthn_add_auth_method_registration_v1`,challengeId:V(n.challengeId,`${t}.challengeId`),challengeB64u:V(n.challengeB64u,`${t}.challengeB64u`),rpId:$e(n.rpId,`${t}.rpId`),user:{idB64u:V(r.idB64u,`${t}.user.idB64u`),name:V(r.name,`${t}.user.name`),displayName:V(r.displayName,`${t}.user.displayName`)},pubKeyCredParams:[{type:`public-key`,alg:-7},{type:`public-key`,alg:-257}],authenticatorSelection:{residentKey:H(i.residentKey,`required`,`${t}.authenticatorSelection.residentKey`),userVerification:H(i.userVerification,`preferred`,`${t}.authenticatorSelection.userVerification`)},timeoutMs:l,attestation:H(n.attestation,`none`,`${t}.attestation`),extensions:{prf:{eval:{firstB64u:V(a.firstB64u,`${t}.extensions.prf.eval.firstB64u`),secondB64u:V(a.secondB64u,`${t}.extensions.prf.eval.secondB64u`)}}},excludeCredentials:c}}function tt(e){let t=ut(e);if(t.kind!==`committed_authority_packages_v1`)throw Error(`CommittedAuthorityPackagesV1.kind is invalid`);let n=De(t.authority);if(!n.ok||n.value.state!==`pending_local_install`)throw Error(`CommittedAuthorityPackagesV1.authority is not pending`);let r=Le(t.authMethod);if(!r||r.status!==`pending_local_install`||r.kind===`voiceid`)throw Error(`CommittedAuthorityPackagesV1.authMethod is not pending`);if(r.walletId!==n.value.walletId||r.walletAuthorityId!==n.value.authorityId)throw Error(`CommittedAuthorityPackagesV1 authority and auth method identities differ`);let i=rt(t.signerPackages);nt(i,n.value.signerActivations);let a=t.ed25519ExportRootPackage===null?null:qe(t.ed25519ExportRootPackage);if(a&&(a.walletId!==n.value.walletId||a.revocationEpoch!==n.value.revocationEpoch||n.value.provenance.kind!==`device_link`||a.enrollmentId!==n.value.provenance.enrollmentId||a.linkSessionId!==n.value.provenance.linkSessionId||String(a.deviceId)!==String(n.value.principal.deviceId)))throw Error(`CommittedAuthorityPackagesV1 export root identity does not match authority`);return{kind:`committed_authority_packages_v1`,authority:n.value,authMethod:r,signerPackages:i,ed25519ExportRootPackage:a,packageSetDigestB64u:it(t.packageSetDigestB64u)}}function nt(e,t){if(e.keyFamilies.length!==t.keyFamilies.length)throw Error(`CommittedAuthorityPackagesV1 signer families do not match authority`);for(let n=0;n<e.keyFamilies.length;n+=1)if(e.keyFamilies[n]!==t.keyFamilies[n])throw Error(`CommittedAuthorityPackagesV1 signer family order does not match authority`);if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`){if(!t.ed25519||!e.ed25519)throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation is missing`);if(!s(e.ed25519.materialActivation,t.ed25519.materialActivation))throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation does not match authority`);return}if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`){if(!t.ecdsa||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 ECDSA activation is missing`);if(!s(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 ECDSA activation does not match authority`);return}if(!t.ed25519||!t.ecdsa||!e.ed25519||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 combined activations are incomplete`);if(!s(e.ed25519.materialActivation,t.ed25519.materialActivation)||!s(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 activation references do not match authority`)}function rt(e){let t=dt(e);if(t.kind!==`committed_signer_package_set_v1`)throw Error(`CommittedSignerPackageSetV1.kind is invalid`);let n=lt(t.keyFamilies);if(n.length===1&&n[0]===`ed25519`){if(!(`ed25519`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:at(t.ed25519)}}if(n.length===1&&n[0]===`ecdsa_secp256k1`){if(!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ecdsa:ot(t.ecdsa)}}if(!(`ed25519`in t)||!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);let r=at(t.ed25519),i=ot(t.ecdsa);if(r.materialActivation.activationId===i.materialActivation.activationId)throw Error(`CommittedSignerPackageSetV1 activation references must be distinct`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:r,ecdsa:i}}function it(e){return F(e)}function at(e){let t=ft(e);if(t.kind!==`committed_ed25519_signer_package_v1`)throw Error(`CommittedEd25519SignerPackageV1.kind is invalid`);let n=ct(t.materialActivation,`materialActivation`),r=Se(t.targetBinding),i=xe(t.applicationBinding),a=we(t.activationReceipt);if(!s(n,Ne(a.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 activation receipt does not match material`);if(!s(n,Ne(r.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 target binding does not match material`);let o=st(t.deriver_a_client_package,`deriver_a_client_package`,`deriver_a`),c=st(t.deriver_b_client_package,`deriver_b_client_package`,`deriver_b`);if(!be(a.transcript,o.transcript)||!be(a.transcript,c.transcript))throw Error(`CommittedEd25519SignerPackageV1 receipt transcript does not match packages`);return{kind:`committed_ed25519_signer_package_v1`,materialActivation:n,targetBinding:r,applicationBinding:i,participantIds:Te(t.participantIds),activationReceipt:a,deriver_a_client_package:o,deriver_b_client_package:c}}function ot(e){let t=pt(e);if(t.kind!==`committed_ecdsa_signer_package_v1`)throw Error(`CommittedEcdsaSignerPackageV1.kind is invalid`);let n=ct(t.materialActivation,`materialActivation`),r=Ee(t.activationReceipt),i=r.binding.target.activation;if(!s(n,i))throw Error(`CommittedEcdsaSignerPackageV1 receipt activation does not match material`);let a=ke(t.encryptedTargetClientShare,`encryptedTargetClientShare`);if(a.recipientPublicKeyB64u!==r.binding.target.clientRecipientPublicKeyB64u)throw Error(`CommittedEcdsaSignerPackageV1 client share recipient does not match receipt`);return{kind:`committed_ecdsa_signer_package_v1`,materialActivation:n,encryptedTargetClientShare:a,activationReceipt:r}}function st(e,t,n){let r=Ce(e);if(!r.ok)throw Error(`${t} ${r.message}`);if(r.value.kind!==`activation_client`||r.value.deriver!==n)throw Error(`${t} must be an activation_client for ${n}`);return{kind:`activation_client`,deriver:n,session:r.value.session,transcript:r.value.transcript,encapsulated_key:r.value.encapsulated_key,ciphertext:r.value.ciphertext}}function ct(e,t){let n=o(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function lt(e){if(!Array.isArray(e))throw Error(`CommittedSignerPackageSetV1.keyFamilies must be an array`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`CommittedSignerPackageSetV1.keyFamilies must use canonical family order`)}function ut(e){let t=mt(e);if(t===null)throw Error(`CommittedAuthorityPackagesV1 must be an object`);return U(t,[`kind`,`authority`,`authMethod`,`signerPackages`,`ed25519ExportRootPackage`,`packageSetDigestB64u`],`CommittedAuthorityPackagesV1`),{kind:Reflect.get(t,`kind`),authority:Reflect.get(t,`authority`),authMethod:Reflect.get(t,`authMethod`),signerPackages:Reflect.get(t,`signerPackages`),ed25519ExportRootPackage:Reflect.get(t,`ed25519ExportRootPackage`),packageSetDigestB64u:Reflect.get(t,`packageSetDigestB64u`)}}function dt(e){let t=mt(e);if(t===null)throw Error(`CommittedSignerPackageSetV1 must be an object`);let n=Object.keys(t),r=n.includes(`ed25519`),i=n.includes(`ecdsa`);return r&&i?(U(t,[`kind`,`keyFamilies`,`ed25519`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`),ecdsa:Reflect.get(t,`ecdsa`)}):r?(U(t,[`kind`,`keyFamilies`,`ed25519`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`)}):i?(U(t,[`kind`,`keyFamilies`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ecdsa:Reflect.get(t,`ecdsa`)}):(U(t,[`kind`,`keyFamilies`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`)})}function ft(e){let t=mt(e);if(t===null)throw Error(`CommittedEd25519SignerPackageV1 must be an object`);return U(t,[`kind`,`materialActivation`,`targetBinding`,`applicationBinding`,`participantIds`,`activationReceipt`,`deriver_a_client_package`,`deriver_b_client_package`],`CommittedEd25519SignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),targetBinding:Reflect.get(t,`targetBinding`),applicationBinding:Reflect.get(t,`applicationBinding`),participantIds:Reflect.get(t,`participantIds`),activationReceipt:Reflect.get(t,`activationReceipt`),deriver_a_client_package:Reflect.get(t,`deriver_a_client_package`),deriver_b_client_package:Reflect.get(t,`deriver_b_client_package`)}}function pt(e){let t=mt(e);if(t===null)throw Error(`CommittedEcdsaSignerPackageV1 must be an object`);return U(t,[`kind`,`materialActivation`,`encryptedTargetClientShare`,`activationReceipt`],`CommittedEcdsaSignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),encryptedTargetClientShare:Reflect.get(t,`encryptedTargetClientShare`),activationReceipt:Reflect.get(t,`activationReceipt`)}}function mt(e){return typeof e==`object`&&e&&!Array.isArray(e)?e:null}function U(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length)throw Error(`${n} contains unexpected fields`);for(let e of i)if(!r.has(e))throw Error(`${n} contains unexpected fields`);for(let r of t)if(!Object.prototype.hasOwnProperty.call(e,r))throw Error(`${n}.${r} is required`)}const ht=[`version`,`purpose`,`linkSessionId`,`linkPublicKeyB64u`,`devicePublicKeyB64u`,`requestedPermission`,`targetFactor`,`issuedAtMs`,`expiresAtMs`];function gt(...e){return(t,n)=>{if(!e.includes(t))throw Error(`${n} is unsupported`);return t}}function _t(e,t){if(typeof e!=`string`||!/^[0-9a-f]{64}$/.test(e))throw Error(`${t} must be 32 canonical lowercase hex bytes`);return e}function W(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=f(e);if(t.length!==32||d(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be a canonical 32-byte unpadded base64url key`)}return e}function G(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=f(e);if(t.length===0||d(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be canonical unpadded base64url`)}return e}function vt(e,t,n){let r=G(e,n),i=f(r);try{if(i.length!==t)throw Error(`${n} must encode ${t} bytes`);return r}finally{i.fill(0)}}const K=BigInt(`0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff`),yt=K-3n,bt=BigInt(`0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b`);function xt(e){let t=0n;for(let n of e)t=t<<8n|BigInt(n);return t}function St(e){let t=xt(e.subarray(1,33)),n=xt(e.subarray(33,65));return t>=K||n>=K?!1:n*n%K===(t*t*t%K+yt*t%K+bt)%K}function q(e,t){let n=vt(e,65,t),r=f(n);try{if(r[0]!==4)throw Error(`${t} must be an uncompressed SEC1 P-256 point`);if(!St(r))throw Error(`${t} must be an on-curve P-256 point`);return n}finally{r.fill(0)}}function Ct(e){return W(e,`LinkDevicePublicKeyB64u`)}function wt(e,t){return de(G(e,t),t)}function Tt(e,t){if(e!==`ed25519`&&e!==`ecdsa_secp256k1`)throw Error(`${t} must identify a supported key family`);return e}function J(e,t,n){if(t<=e)throw Error(`${n}.expiresAtMs must be after issuedAtMs`)}function Et(e){return{kind:e.kind,permissions:[...ie(e)]}}function Dt(e){let t={version:e.version,purpose:e.purpose,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:Et(e.requestedPermission),targetFactor:e.targetFactor,issuedAtMs:e.issuedAtMs,expiresAtMs:e.expiresAtMs};return e.targetFactor.kind===`email_otp`?{...t,targetEmail:e.targetEmail}:t}function Y(e,t){switch(A(e,[`kind`],t).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`${t}.kind is unsupported`)}}function Ot(){return b({kind:h(`passkey_prf`)})}function kt(){return b({kind:h(`email_otp`)})}function At(){return b({kind:h(`existing_enrollment`)})}function jt(){return b({kind:h(`new_enrollment`)})}function Mt(){return _(`kind`,[At(),jt()])}function Nt(e,t){return Mt()(e,t)}function Pt(){return b({enrollmentSealKeyVersion:O,clientUnlockPublicKeyB64u:O,unlockKeyVersion:O,serverSealedFactorCiphertextB64u:O})}function Ft(e,t){let n=u(e,t);if(n.kind===`passkey_prf`)return A(n,[`kind`],t),{kind:`passkey_prf`};if(n.kind===`email_otp`){let e=Nt(n.enrollment,`${t}.enrollment`),r=T(n.targetEmail,`${t}.targetEmail`);return e.kind===`existing_enrollment`?{kind:`email_otp`,targetEmail:r,enrollment:e,baseWalletAuthMethodId:S(A(n,[`kind`,`targetEmail`,`enrollment`,`baseWalletAuthMethodId`],t).baseWalletAuthMethodId,`${t}.baseWalletAuthMethodId`)}:(A(n,[`kind`,`targetEmail`,`enrollment`],t),{kind:`email_otp`,targetEmail:r,enrollment:e})}throw Error(`${t}.kind is unsupported`)}function It(e){if(e.version!==`v5`)throw Error(`QrLinkedDeviceSessionPayloadV5.version is invalid`);if(e.purpose!==`linked_device_lane_creation`)throw Error(`QrLinkedDeviceSessionPayloadV5.purpose is invalid`);let t=x(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=x(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);J(t,n,`QrLinkedDeviceSessionPayloadV5`);let r={version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:N(e.linkSessionId,`QrLinkedDeviceSessionPayloadV5.linkSessionId`),linkPublicKeyB64u:W(e.linkPublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.linkPublicKeyB64u`),devicePublicKeyB64u:W(e.devicePublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.devicePublicKeyB64u`),requestedPermission:k(e.requestedPermission,`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:Y(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`),issuedAtMs:t,expiresAtMs:n};return r.targetFactor.kind===`email_otp`?{...r,targetFactor:{kind:`email_otp`},targetEmail:T(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`)}:{...r,targetFactor:{kind:`passkey_prf`}}}function Lt(e){let t=u(e,`QrLinkedDeviceSessionPayloadV5`);return It(A(t,Y(t.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`).kind===`email_otp`?[...ht,`targetEmail`]:ht,`QrLinkedDeviceSessionPayloadV5`))}function Rt(e){let t=It(Dt(e)),n={v:5,s:t.linkSessionId,l:t.linkPublicKeyB64u,d:t.devicePublicKeyB64u,a:Et(t.requestedPermission),f:t.targetFactor.kind===`passkey_prf`?`p`:`e`,i:t.issuedAtMs,e:t.expiresAtMs};return t.targetFactor.kind===`email_otp`?JSON.stringify({...n,t:t.targetEmail}):JSON.stringify(n)}function zt(){return b({payload:Lt,requestedAtMs:x})}function Bt(e){return zt()(e,`LinkedDeviceOwnerAuthorizationRequestV1`)}function Vt(){let e=e=>b({state:h(e),deviceId:ue});return[b({state:h(`displaying_qr`)}),e(`claimed`),e(`awaiting_target_factor`),e(`awaiting_source_contribution`),e(`provisioning`),b({state:h(`authority_pending_local_install`),deviceId:ue,authorityId:M,packageSetDigestB64u:C}),b({state:h(`active`),deviceId:ue,authorityId:M,activatedAtMs:x}),b({state:h(`failed_before_commit`),error:Ut}),b({state:h(`cancelled`),cancelledAtMs:x}),b({state:h(`expired`),expiredAtMs:x})]}function Ht(e){let t=u(e,`LinkSessionStateV1`).state;if(typeof t!=`string`)throw Error(`LinkSessionStateV1.state is invalid`);let n=Vt().find(e=>e.shape.state.literals.includes(t));if(!n)throw Error(`LinkSessionStateV1.state ${t} is unsupported`);return n(e,`LinkSessionStateV1.${t}`)}function Ut(e){let t=A(e,[`kind`,`reason`],`LinkPrecommitFailureV1`);if(t.kind!==`invalid_input`&&t.kind!==`unauthorized_source`&&t.kind!==`revoked_source`&&t.kind!==`permission_attenuation_failed`&&t.kind!==`target_factor_failed`&&t.kind!==`expired_session`&&t.kind!==`cancelled_session`&&t.kind!==`claim_conflict`&&t.kind!==`package_preparation_failed`)throw Error(`LinkPrecommitFailureV1.kind is invalid`);return{kind:t.kind,reason:O(t.reason,`LinkPrecommitFailureV1.reason`)}}function Wt(){return b({kind:h(`linked_device_session_projection_v1`),linkSessionId:N,qrPayload:Lt,revision:E,createdAtMs:x,updatedAtMs:x,state:Ht})}function Gt(e){return Wt()(e,`LinkSessionProjectionV1`)}function Kt(){return b({kind:h(`linked_device_session_event_v1`),linkSessionId:N,state:Ht,emittedAtMs:x})}function qt(e){return Kt()(e,`LinkSessionTransportEventV1`)}function Jt(){return _(`outcome`,[b({outcome:h(`pending`),state:Xt}),b({outcome:h(`replayed`),replay:b({state:()=>`pending`,session:Xt})})])}function Yt(e){return Jt()(e,`LinkedDeviceApprovalResultV1`)}function Xt(e){let t=Ht(e);switch(t.state){case`awaiting_target_factor`:case`awaiting_source_contribution`:case`provisioning`:case`authority_pending_local_install`:return t;default:throw Error(`LinkedDeviceApprovalResultV1 state is not pending`)}}function Zt(){return b({kind:h(`linked_device_session_claim_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,devicePublicKeyB64u:W,targetFactor:Y,sessionRevision:x,claimedAtMs:x,claimExpiresAtMs:x},(e,t)=>J(e.claimedAtMs,e.claimExpiresAtMs,t))}function Qt(e){return Zt()(e,`LinkedDeviceSessionClaimV1`)}function $t(){return b({kind:h(`wallet_session`),walletSessionId:ae,authorizationId:pe})}function en(e,t=`ownerAuthorization`){if(u(e,t).kind!==`wallet_session`)throw Error(`${t}.kind is unsupported`);return $t()(e,t)}function tn(){return{kind:h(`linked_device_approval_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,linkPublicKeyB64u:W,devicePublicKeyB64u:W,permission:k,targetFactor:Ft,ownerAuthorization:en,approvedAtMs:x,expiresAtMs:x}}function nn(e,t){J(e.approvedAtMs,e.expiresAtMs,t)}function rn(){return b(tn(),nn)}function an(){return b({...tn(),sourceContribution:Ae},nn)}function on(e){let t=u(e,`LinkedDeviceApprovalV1`);return(t.sourceContribution===void 0?rn():an())(t,`LinkedDeviceApprovalV1`)}function sn(){return b({kind:h(`linked_device_approval_delivery_v1`),approval:on})}function cn(e){return sn()(e,`LinkedDeviceApprovalDeliveryV1`)}function ln(){return{kind:h(`linked_device_target_preparation_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,deliveryRecipientPublicKey65B64u:q,walletAuthMethodId:S,ed25519ExportRoot:oe(Cn()),ordinarySignerMaterialRecipientRequirements:En,issuedAtMs:x,expiresAtMs:x}}function un(e,t){if(e.expiresAtMs<=e.issuedAtMs)throw Error(`${t}.expiresAtMs must follow issuedAtMs`)}function dn(){return b({...ln(),targetFactor:Ot(),passkeyCreationOptions:Sn,passkeyConfigurationDigestB64u:C},(e,t)=>{if(un(e,t),e.passkeyCreationOptions.walletAuthMethodId!==e.walletAuthMethodId)throw Error(`${t}.passkeyCreationOptions.walletAuthMethodId must match the preparation`)})}function fn(){return b({...ln(),targetFactor:kt(),targetEmail:T,enrollment:At(),baseWalletAuthMethodId:S},un)}function pn(){return b({...ln(),targetFactor:kt(),targetEmail:T,enrollment:jt()},un)}function mn(e){let t=`LinkedDeviceTargetPreparationV1`,n=u(e,t);return Y(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?dn()(n,t):(Nt(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?pn():fn())(n,t)}function hn(){return b({kind:h(`linked_device_target_preparation_request_v1`),linkSessionId:N,deliveryRecipientPublicKey65B64u:q})}function gn(e){return hn()(e,`LinkedDeviceTargetPreparationRequestV1`)}function _n(){return b({baseWalletAuthMethodId:S,maskedEmailHint:(e,t)=>{if(typeof e!=`string`||e.length===0)throw Error(`${t} is invalid`);return e}})}function vn(){let e=_n(),t=t=>e(t,`LinkedDeviceEmailOtpBaseFactorChoiceV1`);return{selected:b({kind:h(`selected`),choice:t}),selection_required:b({kind:h(`selection_required`),choices:(e,n)=>{if(!Array.isArray(e)||e.length===0)throw Error(`${n} must not be empty`);let r=e.map(t);return[r[0],...r.slice(1)]}}),unavailable:b({kind:h(`unavailable`),reason:gt(`no_active_email_otp_base_factor`)})}}function yn(e){let t=`LinkedDeviceEmailOtpBaseFactorResolutionV1`,n=u(e,t),r=vn();switch(n.kind){case`selected`:case`selection_required`:case`unavailable`:return r[n.kind](n,t);default:throw Error(`${t}.kind is unsupported`)}}function bn(){return b({revision:x,resolution:yn})}function xn(e){return bn()(e,`LinkedDeviceEmailOtpBaseFactorResolutionResultV1`)}function Sn(e,t){let n=A(e,[`kind`,`walletAuthMethodId`,`challengeId`,`challengeB64u`,`rpId`,`user`,`pubKeyCredParams`,`authenticatorSelection`,`timeoutMs`,`attestation`,`extensions`,`excludeCredentials`],t),r=S(n.walletAuthMethodId,`${t}.walletAuthMethodId`);if(A(n.user,[`idB64u`,`name`,`displayName`],`${t}.user`),A(n.authenticatorSelection,[`residentKey`,`userVerification`],`${t}.authenticatorSelection`),A(A(A(n.extensions,[`prf`],`${t}.extensions`).prf,[`eval`],`${t}.extensions.prf`).eval,[`firstB64u`,`secondB64u`],`${t}.extensions.prf.eval`),!Array.isArray(n.pubKeyCredParams))throw Error(`${t}.pubKeyCredParams must be an array`);if(n.pubKeyCredParams.forEach((e,n)=>{A(e,[`type`,`alg`],`${t}.pubKeyCredParams[${n}]`)}),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);n.excludeCredentials.forEach((e,n)=>{A(e,[`type`,`id`],`${t}.excludeCredentials[${n}]`)});let i=et(n);return{kind:i.kind,walletAuthMethodId:r,challengeId:i.challengeId,challengeB64u:i.challengeB64u,rpId:i.rpId,user:i.user,pubKeyCredParams:i.pubKeyCredParams,authenticatorSelection:i.authenticatorSelection,timeoutMs:i.timeoutMs,attestation:i.attestation,extensions:i.extensions,excludeCredentials:i.excludeCredentials}}function Cn(){return b({kind:h(`linked_device_ed25519_export_root_preparation_v1`),walletKeyId:p,applicationBindingDigestB64u:C,registeredPublicKeyB64u:ne,revocationEpoch:E})}function wn(e,t,n){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`${n} must contain one or two entries`);let r=e.map((e,r)=>t(e,`${n}[${r}]`));if(new Set(r.map(e=>e.keyFamily)).size!==r.length)throw Error(`${n} repeats a key family`);if(new Set(r.map(e=>String(e.walletKeyId))).size!==r.length)throw Error(`${n} repeats a wallet key`);if(r.length===2&&(r[0]?.keyFamily!==`ed25519`||r[1]?.keyFamily!==`ecdsa_secp256k1`))throw Error(`${n} must be ordered Ed25519 then ECDSA`);return r}function Tn(){return b({kind:h(`ordinary_signer_material_recipient_requirement_v1`),keyFamily:Tt,walletKeyId:p})}function En(e){let t=wn(e,Tn(),`LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requirements are empty`);return[n,...t.slice(1)]}const Dn=h(`ble`,`cable`,`hybrid`,`internal`,`nfc`,`smart-card`,`usb`);function On(e,t){let n=te(e,t).map((e,n)=>Dn(e,`${t}[${n}]`));if(new Set(n).size!==n.length)throw Error(`${t} contains duplicates`);return n}function kn(){return b({kind:h(`linked_device_webauthn_registration_v1`),credentialIdB64u:wt,authenticatorAttachment:oe(h(`platform`,`cross-platform`)),clientDataJsonB64u:G,attestationObjectB64u:G,transports:On})}function An(){let e=e=>(t,n)=>{if(t!==e)throw Error(`${n} does not match its kind`);return e};return _(`kind`,[b({kind:h(`ordinary_ed25519_signer_material_recipient_request_v1`),keyFamily:e(`ed25519`),walletKeyId:p,recipientPublicKeyB64u:(e,t)=>vt(e,32,t)}),b({kind:h(`ordinary_ecdsa_signer_material_recipient_request_v1`),keyFamily:e(`ecdsa_secp256k1`),walletKeyId:p,clientEphemeralPublicKey:Me})])}function X(e){let t=wn(e,An(),`LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requests are empty`);return[n,...t.slice(1)]}function jn(){return{kind:h(`linked_device_target_credential_registration_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,walletAuthMethodId:S}}function Mn(){return b({...jn(),targetFactor:Ot(),targetPreparationDigestB64u:C,ordinarySignerMaterialRecipientRequests:X,webauthnRegistration:kn(),registeredAtMs:x})}function Nn(){return b({...jn(),targetFactor:kt(),targetEmail:T,targetPreparationDigestB64u:C,ordinarySignerMaterialRecipientRequests:X,emailOtpVerificationGrant:Z,registeredAtMs:x})}function Pn(){return b({...jn(),targetFactor:kt(),targetEmail:T,targetPreparationDigestB64u:C,ordinarySignerMaterialRecipientRequests:X,emailOtpVerificationGrant:Z,emailOtpEnrollment:Pt(),registeredAtMs:x})}function Fn(e){let t=`LinkedDeviceTargetCredentialRegistrationV1`,n=u(e,t);return Y(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?Mn()(n,t):(Z(n.emailOtpVerificationGrant).enrollment.kind===`new_enrollment`?Pn():Nn())(n,t)}function In(){return b({kind:h(`linked_device_target_credential_registration_result_v1`),outcome:h(`applied`,`replayed`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,walletAuthMethodId:S,targetPreparationDigestB64u:C,targetFactor:Hn,ordinarySignerMaterialPreparations:je,ordinarySignerMaterialRecipientRequests:X,keyManifestDigestB64u:C},(e,t)=>{let{authMethod:n}=e.targetFactor;if(n.walletAuthMethodId!==e.walletAuthMethodId||n.walletId!==e.walletId)throw Error(`${t} target identity differs`)})}function Ln(e){return In()(e,`LinkedDeviceTargetCredentialRegistrationResultV1`)}function Rn(e,t){if(e.verifiedAtMs<e.authMethod.createdAtMs)throw Error(`${t}.verifiedAtMs precedes authMethod.createdAtMs`)}function zn(){return b({kind:h(`verified_passkey_target_v1`),authMethod:Wn,verificationDigestB64u:C,verifiedAtMs:x},Rn)}function Bn(){return b({kind:h(`verified_email_otp_target_v1`),authMethod:Kn,targetEmail:T,enrollment:At(),baseWalletAuthMethodId:S,providerUserId:O,verificationDigestB64u:C,verifiedAtMs:x},Rn)}function Vn(){return b({kind:h(`verified_email_otp_target_v1`),authMethod:Kn,targetEmail:T,enrollment:jt(),providerUserId:O,verificationDigestB64u:C,verifiedAtMs:x},Rn)}function Hn(e,t){let n=u(e,t);if(n.kind===`verified_passkey_target_v1`)return zn()(n,t);if(n.kind!==`verified_email_otp_target_v1`)throw Error(`${t}.kind is invalid`);return(Nt(n.enrollment,`${t}.enrollment`).kind===`existing_enrollment`?Bn():Vn())(n,t)}function Un(){return b({walletAuthMethodId:S,walletId:y,createdAtMs:x,kind:h(`passkey`),rpId:fe,credentialIdB64u:de,credentialPublicKeyB64u:G,counter:E})}function Wn(e,t){return Un()(e,t)}function Gn(){return b({walletAuthMethodId:S,walletId:y,createdAtMs:x,kind:h(`email_otp`),emailHashHex:_t,registrationAuthorityId:O})}function Kn(e,t){return Gn()(e,t)}function qn(e){return{kind:h(`linked_device_email_otp_verification_grant_v1`),grantId:O,grantToken:O,challengeId:O,linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,targetPreparationDigestB64u:C,targetEmail:T,enrollment:e,emailHashHex:_t,registrationAuthorityId:O,providerUserId:O,authorityDigestB64u:C,issuedAtMs:x,expiresAtMs:x}}function Jn(e,t){J(e.issuedAtMs,e.expiresAtMs,t)}function Yn(){return b({...qn(At()),baseWalletAuthMethodId:S},Jn)}function Xn(){return b(qn(jt()),Jn)}function Z(e){let t=`LinkedDeviceEmailOtpVerificationGrantV1`,n=u(e,t);return(Nt(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?Xn():Yn())(n,t)}function Zn(){return b({kind:h(`email_otp_factor_release_v1`),challengeId:O,enrollmentId:O,enrollmentSealKeyVersion:O,serverEphemeralPublicKey65B64u:q,nonce12B64u:(e,t)=>vt(e,12,t),ciphertextB64u:G})}function Qn(e){return Zn()(e,`LinkedDeviceEmailOtpFactorReleaseEnvelopeV1`)}function $n(){return b({kind:h(`linked_device_email_otp_challenge_start_request_v1`),linkSessionId:N,workerEphemeralPublicKey65B64u:q})}function er(e){return $n()(e,`LinkedDeviceEmailOtpChallengeStartRequestV1`)}function tr(){return b({kind:h(`linked_device_email_otp_challenge_resend_request_v1`),linkSessionId:N,challengeId:O})}function nr(e){return tr()(e,`LinkedDeviceEmailOtpChallengeResendRequestV1`)}function rr(){return b({kind:h(`linked_device_email_otp_challenge_verify_request_v1`),linkSessionId:N,challengeId:O,otpCode:(e,t)=>{if(typeof e!=`string`||!/^[0-9]{6,10}$/.test(e))throw Error(`${t} is invalid`);return e}})}function ir(e){return rr()(e,`LinkedDeviceEmailOtpChallengeVerifyRequestV1`)}function ar(){return b({kind:h(`linked_device_email_otp_challenge_result_v1`),challengeId:O,maskedEmailHint:O,expiresAtMs:x,resendAvailableAtMs:x})}function or(e){return ar()(e,`LinkedDeviceEmailOtpChallengeResultV1`)}function sr(e){let t=A(e,[`kind`,`verificationGrant`,`factorRelease`],`LinkedDeviceEmailOtpVerificationResultV1`);if(t.kind!==`linked_device_email_otp_verification_result_v1`)throw Error(`LinkedDeviceEmailOtpVerificationResultV1.kind is invalid`);let n=Z(t.verificationGrant);if(cr(n)){if(t.factorRelease!==null)throw Error(`new linked-device Email OTP enrollment cannot carry a factor release`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:null}}let r=Qn(t.factorRelease);if(r.challengeId!==n.challengeId)throw Error(`LinkedDeviceEmailOtpVerificationResultV1 challenge binding changed`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:r}}function cr(e){return e.enrollment.kind===`new_enrollment`}function lr(e){let t=x(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=x(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);J(t,n,`QrLinkedDeviceSessionPayloadV5`);let r=Y(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`);if(r.kind===`passkey_prf`)return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:k(Et(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,issuedAtMs:t,expiresAtMs:n};if(e.targetEmail===void 0)throw Error(`QrLinkedDeviceSessionPayloadV5.targetEmail is required for Email OTP`);return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:k(Et(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,targetEmail:T(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`),issuedAtMs:t,expiresAtMs:n}}function ur(e){return{kind:`linked_device_session_claim_request_v1`,payload:e}}function dr(e,t,n){let r=x(e,`${n}.approvedAtMs`),i=x(t,`${n}.expiresAtMs`);return J(r,i,n),{approvedAtMs:r,expiresAtMs:i}}function fr(e){let t=dr(e.approvedAtMs,e.expiresAtMs,`LinkedDeviceApprovalV1`);return on({kind:`linked_device_approval_v1`,...e,...t})}function pr(e){return Fn({kind:`linked_device_target_credential_registration_v1`,...e})}function mr(e){return{kind:`linked_device_session_cancel_unclaimed_request_v1`,linkSessionId:e.linkSessionId,reason:`user_cancelled`,requestedAtMs:x(e.requestedAtMs,`LinkedDeviceSessionCancelUnclaimedRequestV1.requestedAtMs`)}}function hr(e){return{kind:`linked_device_session_cancel_claimed_request_v1`,...e,requestedAtMs:x(e.requestedAtMs,`LinkedDeviceSessionCancelClaimedRequestV1.requestedAtMs`)}}const gr=[`chrome`,`safari`,`firefox`,`edge`,`other`],_r=[`macos`,`ios`,`windows`,`android`,`linux`,`other`];function vr(e){return typeof e==`string`&&gr.some(t=>t===e)}function yr(e){return typeof e==`string`&&_r.some(t=>t===e)}function br(e){if(!e||typeof e!=`object`||Array.isArray(e))return null;let t=e,n=typeof t.label==`string`?t.label.trim():``;if(!n||!vr(t.browser)||!yr(t.os)||typeof t.synced!=`boolean`||!Array.isArray(t.transports))return null;let r=t.transports.map(e=>typeof e==`string`?e.trim():``).filter(e=>e.length>0),i=typeof t.provider==`string`?t.provider.trim():``,a=typeof t.providerLabel==`string`?t.providerLabel.trim():``;return{label:n,browser:t.browser,os:t.os,synced:t.synced,transports:r,...i?{provider:i}:{},...a?{providerLabel:a}:{}}}function xr(e){return(t,n)=>{if(!Array.isArray(t))throw Error(`${n} is invalid`);return t.map((t,r)=>e(t,`${n}[${r}]`))}}function Sr(e,t){let n=S(e,t);if(n.startsWith(`wallet-authority:`)||n.startsWith(`authority:`))throw Error(`${t} must identify a WalletAuthMethodId`);return n}function Cr(e,t){let n=E(e,t);if(n<1)throw Error(`${t} must be a positive safe integer`);return n}function wr(e,t){let n=br(e);if(!n)throw Error(`${t} is invalid`);return n}function Tr(){return _(`kind`,[b({kind:h(`passkey`),walletAuthMethodId:S,credentialIdB64u:de,device:wr}),b({kind:h(`email_otp`),walletAuthMethodId:S}),b({kind:h(`voiceid`),walletAuthMethodId:S,deviceKeyId:C})])}function Er(e,t){return Tr()(e,t)}function Dr(){return b({deviceId:w,enrollmentId:D,walletId:y,credential:Er,permission:k,keyManifestDigestB64u:C,coveredWalletKeys:xr(p),state:h(`provisioning`,`active`,`suspended`,`expired`,`revoked`),createdAtMs:x,lastActivityAtMs:x,revocationEpoch:E})}function Or(e){return Dr()(e,`LinkedDeviceSummaryV1`)}function kr(){return b({kind:h(`linked_device_list_request_v1`),walletId:y,limit:Cr,cursor:se})}function Ar(e){return kr()(e,`LinkedDeviceListRequestV1`)}function jr(){return b({walletId:y,walletAuthorityId:M,credential:Er,createdAtMs:x,lastActivityAtMs:x})}function Mr(){let e=jr();return b({devices:xr(Or),ownerDevices:xr(t=>e(t,`OwnerDeviceSummaryV1`)),nextCursor:se})}function Nr(e){return Mr()(e,`LinkedDeviceListResultV1`)}function Pr(){return b({kind:h(`linked_device_revoke_request_v1`),walletId:y,walletAuthMethodId:Sr,requestedAtMs:x})}function Fr(e){return Pr()(e,`LinkedDeviceRevokeRequestV1`)}function Ir(){return b({kind:h(`not_found`,`conflict`,`unauthorized`)})}function Lr(){return b({kind:h(`revoked`),walletAuthMethodId:Sr,authorityId:M,revocationEpoch:E})}function Rr(e){let t=u(e,`LinkedDeviceRevokeResultV1`);return(t.kind===`not_found`||t.kind===`conflict`||t.kind===`unauthorized`?Ir():Lr())(t,`LinkedDeviceRevokeResultV1`)}function zr(e){return ee({domain:`seams/linked-device/wallet-session-credential-delivery-aad/v1`,aad:e})}function Br(e){let t=qr(e,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`],`LinkedDeviceWalletSessionCredentialDeliveryBindingV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_binding_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryBindingV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_binding_v1`,namespace:Q(t.namespace,`namespace`),orgId:Q(t.orgId,`orgId`),projectId:Q(t.projectId,`projectId`),envId:Q(t.envId,`envId`),tenantId:$(ve(t.tenantId)),principalId:$(he(t.principalId))}}async function Vr(e){return P(zr(e))}async function Hr(e){return P(ee({domain:`seams/linked-device/wallet-session-credential-delivery-envelope/v1`,envelope:e}))}async function Ur(e){if(await Vr(e.aad)!==e.aadDigestB64u)throw Error(`linked-device Wallet Session credential delivery AAD digest is invalid`);if(await Hr(e.envelope)!==e.envelopeDigestB64u)throw Error(`linked-device Wallet Session credential delivery envelope digest is invalid`);if(await P(ee({domain:`seams/linked-device/delivery-recipient/v1`,recipientPublicKey65B64u:e.aad.recipientPublicKey65B64u}))!==e.recipientBindingDigestB64u)throw Error(`linked-device Wallet Session credential delivery recipient binding is invalid`)}function Wr(e){let t=qr(e,[`kind`,`aad`,`aadDigestB64u`,`recipientBindingDigestB64u`,`envelope`,`envelopeDigestB64u`,`installationReceiptDigestB64u`],`LinkedDeviceWalletSessionCredentialDeliveryV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_v1`,aad:Gr(t.aad),aadDigestB64u:F(t.aadDigestB64u),recipientBindingDigestB64u:F(t.recipientBindingDigestB64u),envelope:Kr(t.envelope),envelopeDigestB64u:F(t.envelopeDigestB64u),installationReceiptDigestB64u:F(t.installationReceiptDigestB64u)}}function Gr(e){let n=qr(e,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`,`linkSessionId`,`walletId`,`authorityId`,`walletAuthMethodId`,`authorizationId`,`walletSessionId`,`quotaId`,`credentialDigestB64u`,`recipientPublicKey65B64u`,`issuedAtMs`,`expiresAtMs`],`LinkedDeviceWalletSessionCredentialDeliveryAadV1`);if(n.kind!==`linked_device_wallet_session_credential_delivery_aad_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryAadV1.kind is invalid`);let i=Jr(n.issuedAtMs,`issuedAtMs`),a=Jr(n.expiresAtMs,`expiresAtMs`);if(a<=i)throw Error(`expiresAtMs must be after issuedAtMs`);return{kind:`linked_device_wallet_session_credential_delivery_aad_v1`,namespace:Q(n.namespace,`namespace`),orgId:Q(n.orgId,`orgId`),projectId:Q(n.projectId,`projectId`),envId:Q(n.envId,`envId`),tenantId:$(ve(n.tenantId)),principalId:$(he(n.principalId)),linkSessionId:$(l(n.linkSessionId)),walletId:$(c(n.walletId)),authorityId:$(r(n.authorityId)),walletAuthMethodId:$(t(n.walletAuthMethodId)),authorizationId:$(_e(n.authorizationId)),walletSessionId:$(ge(n.walletSessionId)),quotaId:$(me(n.quotaId)),credentialDigestB64u:F(n.credentialDigestB64u),recipientPublicKey65B64u:Xr(n.recipientPublicKey65B64u,65),issuedAtMs:i,expiresAtMs:a}}function Kr(e){let t=qr(e,[`kind`,`algorithm`,`serverEphemeralPublicKey65B64u`,`nonce12B64u`,`ciphertextB64u`],`LinkedDeviceWalletSessionCredentialEnvelopeV1`);if(t.kind!==`linked_device_wallet_session_credential_envelope_v1`||t.algorithm!==`p256-ecdh-aes256gcm-v1`)throw Error(`LinkedDeviceWalletSessionCredentialEnvelopeV1 identity is invalid`);return{kind:`linked_device_wallet_session_credential_envelope_v1`,algorithm:`p256-ecdh-aes256gcm-v1`,serverEphemeralPublicKey65B64u:Xr(t.serverEphemeralPublicKey65B64u,65),nonce12B64u:Xr(t.nonce12B64u,12),ciphertextB64u:Yr(t.ciphertextB64u)}}function qr(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be an object`);let r=e,i=new Set(t);for(let e of Object.keys(r))if(!i.has(e))throw Error(`${n}.${e} is not supported`);for(let e of t)if(!(e in r))throw Error(`${n}.${e} is required`);return r}function Q(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} is required`);return e}function Jr(e,t){if(!Number.isSafeInteger(e)||Number(e)<=0)throw Error(`${t} is invalid`);return Number(e)}function Yr(e){let t=Q(e,`base64url`);if(d(f(t))!==t)throw Error(`base64url is not canonical`);return t}function Xr(e,t){let n=Yr(e),r=f(n);if(r.length!==t)throw Error(`base64url must contain ${t} bytes`);if(t===65&&r[0]!==4)throw Error(`P-256 public key is invalid`);return n}function $(e){if(!e.ok)throw Error(e.error.message);return e.value}function Zr(e,t){let n=Oe(e);if(!n.ok)throw Error(`${t} ${n.error}`);return n.value}function Qr(){return b({kind:h(`local_authority_installation_receipt_v1`),authorityId:j(M),walletId:j(y),authMethodId:j(S),deviceId:j(ue),packageSetDigestB64u:j(C),installedActivationRefs:Zr,installedRecordSetDigestB64u:j(C),targetFactorVerificationDigestB64u:j(C),installedAtMs:j(x)})}function $r(e){return Qr()(e,`LocalAuthorityInstallationReceiptV1`)}function ei(){return b({kind:h(`local_authority_activation_final_ack_v1`),linkSessionId:j(N),authorityId:j(M),packageSetDigestB64u:j(C),authorizationId:j(pe),walletSessionId:j(ae),credentialDigestB64u:j(C),installationReceiptDigestB64u:j(C),acknowledgedAtMs:j(x)})}function ti(e){return ei()(e,`LocalAuthorityActivationFinalAckV1`)}function ni(e){let t=u(e,`ActivateInstalledAuthorityResultV1`);switch(t.kind){case`active`:{g(t,[`kind`,`authority`,`authMethod`,`walletSession`,`deliveryBinding`,`sealedDelivery`],`ActivateInstalledAuthorityResultV1`);let e=De(t.authority);if(!e.ok||e.value.state!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authority must be active`);let n=Le(t.authMethod);if(!n||n.status!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authMethod must be active`);let r=le(t.walletSession),i=Br(t.deliveryBinding),a=Wr(t.sealedDelivery);if(e.value.walletId!==n.walletId||e.value.authorityId!==n.walletAuthorityId||r.walletId!==e.value.walletId||r.authorityId!==e.value.authorityId||r.authMethodId!==n.walletAuthMethodId||r.authorityDigestB64u!==e.value.authorityDigestB64u||r.authorityRevocationEpoch!==e.value.revocationEpoch||i.namespace!==a.aad.namespace||i.orgId!==a.aad.orgId||i.projectId!==a.aad.projectId||i.envId!==a.aad.envId||i.tenantId!==a.aad.tenantId||i.principalId!==a.aad.principalId||a.aad.walletId!==r.walletId||a.aad.authorityId!==r.authorityId||a.aad.walletAuthMethodId!==r.authMethodId||a.aad.authorizationId!==r.authorizationId||a.aad.quotaId!==r.quotaId||a.aad.issuedAtMs!==r.issuedAtMs||a.aad.expiresAtMs!==r.expiresAtMs)throw Error(`ActivateInstalledAuthorityResultV1 identities do not match`);return{kind:`active`,authority:e.value,authMethod:n,walletSession:r,deliveryBinding:i,sealedDelivery:a}}case`pending_local_install`:return g(t,[`kind`,`authorityId`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`pending_local_install`,authorityId:M(t.authorityId,`authorityId`),reason:ri()(t.reason,`ActivationRetryReasonV1`)};case`integrity_error`:return g(t,[`kind`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`integrity_error`,reason:ii(t.reason)};default:throw Error(`ActivateInstalledAuthorityResultV1.kind is invalid`)}}function ri(){return _(`kind`,[b({kind:h(`installation_receipt_not_found`)}),b({kind:h(`server_worker_activation_pending`)}),b({kind:h(`wallet_session_issuance_pending`)})])}function ii(e){let t=u(e,`LinkIntegrityFailureV1`);switch(t.kind){case`authority_id_mismatch`:return g(t,[`kind`,`expectedAuthorityId`,`actualAuthorityId`],`LinkIntegrityFailureV1`),{kind:`authority_id_mismatch`,expectedAuthorityId:M(t.expectedAuthorityId,`expectedAuthorityId`),actualAuthorityId:M(t.actualAuthorityId,`actualAuthorityId`)};case`package_set_digest_mismatch`:return g(t,[`kind`,`expectedPackageSetDigestB64u`,`actualPackageSetDigestB64u`],`LinkIntegrityFailureV1`),{kind:`package_set_digest_mismatch`,expectedPackageSetDigestB64u:C(t.expectedPackageSetDigestB64u,`expectedPackageSetDigestB64u`),actualPackageSetDigestB64u:C(t.actualPackageSetDigestB64u,`actualPackageSetDigestB64u`)};case`installation_receipt_mismatch`:if(g(t,[`kind`,`field`],`LinkIntegrityFailureV1`),t.field!==`walletId`&&t.field!==`authMethodId`&&t.field!==`deviceId`&&t.field!==`targetFactorVerificationDigestB64u`&&t.field!==`installedActivationRefs`)throw Error(`LinkIntegrityFailureV1.field is invalid`);return{kind:`installation_receipt_mismatch`,field:t.field};default:throw Error(`LinkIntegrityFailureV1.kind is invalid`)}}new TextEncoder;async function ai(e){return P(e.token)}function oi(e){return ee({domain:`seams/linked-device/local-authority-installation-receipt/v1`,receipt:e})}async function si(e){return P(oi(e))}function ci(e,t){if(e===void 0)throw Error(`${t} is required`);return e}function li(e){return I(e.kind,`targetFactor.kind`)}function ui(e){let t=e.pubKeyCredParams.map(e=>z([I(e.type,`passkeyCreationOptions.pubKeyCredParams.type`),I(String(e.alg),`passkeyCreationOptions.pubKeyCredParams.alg`)])),n=e.excludeCredentials.map(e=>z([I(e.type,`passkeyCreationOptions.excludeCredentials.type`),I(e.id,`passkeyCreationOptions.excludeCredentials.id`)]));return z([I(e.kind,`passkeyCreationOptions.kind`),I(e.walletAuthMethodId,`passkeyCreationOptions.walletAuthMethodId`),I(e.challengeId,`passkeyCreationOptions.challengeId`),I(e.challengeB64u,`passkeyCreationOptions.challengeB64u`),I(e.rpId,`passkeyCreationOptions.rpId`),I(e.user.idB64u,`passkeyCreationOptions.user.idB64u`),I(e.user.name,`passkeyCreationOptions.user.name`),I(e.user.displayName,`passkeyCreationOptions.user.displayName`),Fe(t.length,`passkeyCreationOptions.pubKeyCredParams`),...t.map(e=>L(e,`passkeyCreationOptions.pubKeyCredParams.item`)),I(e.authenticatorSelection.residentKey,`passkeyCreationOptions.authenticatorSelection.residentKey`),I(e.authenticatorSelection.userVerification,`passkeyCreationOptions.authenticatorSelection.userVerification`),R(e.timeoutMs,`passkeyCreationOptions.timeoutMs`),I(e.attestation,`passkeyCreationOptions.attestation`),I(e.extensions.prf.eval.firstB64u,`passkeyCreationOptions.extensions.prf.eval.firstB64u`),I(e.extensions.prf.eval.secondB64u,`passkeyCreationOptions.extensions.prf.eval.secondB64u`),Fe(n.length,`passkeyCreationOptions.excludeCredentials`),...n.map(e=>L(e,`passkeyCreationOptions.excludeCredentials.item`))])}function di(e){return z([I(e.kind,`recipientRequirement.kind`),I(e.keyFamily,`recipientRequirement.keyFamily`),I(e.walletKeyId,`recipientRequirement.walletKeyId`)])}function fi(e){return e===null?I(`none`,`ed25519ExportRoot.kind`):z([I(e.kind,`ed25519ExportRoot.kind`),I(e.walletKeyId,`ed25519ExportRoot.walletKeyId`),Ie(e.applicationBindingDigestB64u,`ed25519ExportRoot.applicationBindingDigestB64u`),Pe(e.registeredPublicKeyB64u,`ed25519ExportRoot.registeredPublicKeyB64u`),R(e.revocationEpoch,`ed25519ExportRoot.revocationEpoch`)])}function pi(e){let t=e.ordinarySignerMaterialRecipientRequirements.map(di),n=hi(e)?e:void 0,r=n?.passkeyCreationOptions;if(e.targetFactor.kind===`passkey_prf`&&!r)throw Error(`passkey target preparation is missing creation options`);return z([I(`seams/linked-device/target-preparation/v1`,`domain`),I(e.kind,`kind`),I(e.linkSessionId,`linkSessionId`),I(e.walletId,`walletId`),I(e.enrollmentId,`enrollmentId`),I(e.deviceId,`deviceId`),L(Pe(e.deliveryRecipientPublicKey65B64u,`deliveryRecipientPublicKey65B64u`),`deliveryRecipientPublicKey65B64u`),I(e.walletAuthMethodId,`walletAuthMethodId`),L(fi(e.ed25519ExportRoot),`ed25519ExportRoot`),L(li(e.targetFactor),`targetFactor`),...r?[L(ui(r),`passkeyCreationOptions`),Ie(n.passkeyConfigurationDigestB64u,`passkeyConfigurationDigestB64u`)]:[],...mi(e),Fe(t.length,`ordinarySignerMaterialRecipientRequirements`),...t.map(e=>L(e,`ordinarySignerMaterialRecipientRequirements.item`)),R(e.issuedAtMs,`issuedAtMs`),R(e.expiresAtMs,`expiresAtMs`)])}function mi(e){return hi(e)?[]:[I(e.targetEmail,`targetEmail`),I(e.enrollment.kind,`enrollment.kind`),...e.enrollment.kind===`existing_enrollment`?[I(ci(e.baseWalletAuthMethodId,`baseWalletAuthMethodId`),`baseWalletAuthMethodId`)]:[]]}function hi(e){return e.targetFactor.kind===`passkey_prf`}async function gi(e){return ye(pi(e))}const _i=`x-seams-linked-device-proof-v1`,vi=6e4,yi=6e4;async function bi(e){return ye(xi(e,32,`devicePublicKeyB64u`))}function xi(e,t,n){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} is invalid`);let r;try{r=f(e)}catch{throw Error(`${n} is invalid`)}if(r.length!==t||d(r)!==e)throw Error(`${n} is invalid`);return r}export{Ge as $,xn as A,Qt as B,pr as C,qt as D,Gt as E,Qn as F,Rt as G,gn as H,Z as I,ze as J,tt as K,sr as L,or as M,er as N,cn as O,ir as P,Ke as Q,Bt as R,ur as S,Ct as T,mn as U,Ln as V,Lt as W,qe as X,We as Y,Ue as Z,Rr as _,gi as a,hr as b,ni as c,Ur as d,Re as et,Br as f,Fr as g,Nr as h,bi as i,nr as j,Yt as k,ti as l,Ar as m,_i as n,si as o,Wr as p,et as q,vi as r,ai as s,yi as t,$r as u,br as v,lr as w,mr as x,fr as y,en as z};
+import{A as e,E as t,N as n,O as r,d as i,f as a,g as o,i as s,k as c,u as l}from"./domainIds-t1lp25yU.js";import{S as u,t as ee,y as te}from"./digests-BIaE0DMd.js";import{i as d,r as f}from"./base64-BmKR3UqU.js";import{C as p,D as ne,E as m,H as h,J as g,K as _,O as re,P as v,R as ie,S as y,T as ae,U as oe,W as b,_ as x,b as S,c as C,d as w,f as se,g as T,h as E,k as ce,l as D,m as O,n as le,o as ue,p as k,q as A,s as de,u as j,v as fe,w as pe,x as M,y as N}from"./activeWalletSession-BJ4B-nJo.js";import{d as me,f as he,h as ge,m as _e,p as ve}from"./capabilityKinds-DVlGMspk.js";import{a as ye,o as P,r as F}from"./canonicalPrimitives-Jd3i_Ngz.js";import{$ as be,F as xe,I as Se,L as Ce,P as we,V as Te,_ as Ee,d as De,f as Oe,g as ke,x as Ae,y as je}from"./walletAuthority-BTGAuOi8.js";import{It as Me,Nt as Ne,a as I,i as Pe,n as L,o as Fe,r as Ie,s as R,t as z}from"./digestEncoding-CqNXPZY9.js";import{r as Le}from"./walletAuthMethodRecord-DLBB5fez.js";function Re(e){throw Error(`[LinkSessionStateV1] unsupported state: ${String(e)}`)}const ze=`x25519-hkdf-sha256-chacha20poly1305-v1`,Be=/^[A-Za-z0-9_-]+$/,Ve=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`registeredAtMs`],He=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`ephemeralPublicKeyB64u`,`nonceB64u`,`sealedExportRootB64u`,`bindingDigestB64u`,`ciphertextDigestB64u`,`sealedAtMs`];function Ue(e,t=`recipientPublicKeyB64u`){if(typeof e!=`string`||!Be.test(e))throw Error(`${t} must be unpadded base64url`);let n;try{n=f(e)}catch{throw Error(`${t} must be valid base64url`)}if(d(n)!==e)throw Error(`${t} must be canonical base64url`);if(n.length!==32)throw Error(`${t} must decode to a 32-byte X25519 public key`);return e}function We(e){return{linkSessionId:e.linkSessionId,walletId:e.walletId,walletKeyId:e.walletKeyId,targetFactor:e.targetFactor,enrollmentId:e.enrollmentId,deviceId:e.deviceId,revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:e.applicationBindingDigestB64u,registeredPublicKeyB64u:e.registeredPublicKeyB64u,recipientPublicKeyB64u:e.recipientPublicKeyB64u}}function Ge(e){return JSON.stringify({linkSessionId:String(e.linkSessionId),walletId:String(e.walletId),walletKeyId:String(e.walletKeyId),targetFactor:e.targetFactor,enrollmentId:String(e.enrollmentId),deviceId:String(e.deviceId),revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:String(e.applicationBindingDigestB64u),registeredPublicKeyB64u:String(e.registeredPublicKeyB64u),recipientPublicKeyB64u:String(e.recipientPublicKeyB64u)})}function Ke(t){let n=Ye(t,Ve,`LinkedDeviceEd25519ExportRootRecipientV1`);if(n.kind!==`linked_device_ed25519_export_root_recipient_v1`)throw Error(`LinkedDeviceEd25519ExportRootRecipientV1.kind is invalid`);return Xe(n.transferAlg,`LinkedDeviceEd25519ExportRootRecipientV1.transferAlg`),{kind:`linked_device_ed25519_export_root_recipient_v1`,linkSessionId:v(l(n.linkSessionId),`LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId`),walletId:v(c(n.walletId),`walletId`),walletKeyId:v(e(n.walletKeyId),`walletKeyId`),enrollmentId:v(i(n.enrollmentId),`enrollmentId`),deviceId:v(a(n.deviceId),`deviceId`),transferAlg:ze,applicationBindingDigestB64u:m(n.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:ne(n.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:Je(n.targetFactor),revocationEpoch:Ze(n.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:Ue(n.recipientPublicKeyB64u,`recipientPublicKeyB64u`),registeredAtMs:Qe(n.registeredAtMs,`registeredAtMs`)}}function qe(t){let n=Ye(t,He,`LinkedDeviceEd25519ExportRootPackageV1`);if(n.kind!==`linked_device_ed25519_export_root_package_v1`)throw Error(`LinkedDeviceEd25519ExportRootPackageV1.kind is invalid`);Xe(n.transferAlg,`LinkedDeviceEd25519ExportRootPackageV1.transferAlg`);let r=Ue(n.recipientPublicKeyB64u,`recipientPublicKeyB64u`),o=Ue(n.ephemeralPublicKeyB64u,`ephemeralPublicKeyB64u`);if(r===o)throw Error(`ephemeralPublicKeyB64u repeats the recipient key`);return{kind:`linked_device_ed25519_export_root_package_v1`,linkSessionId:v(l(n.linkSessionId),`linkSessionId`),walletId:v(c(n.walletId),`walletId`),walletKeyId:v(e(n.walletKeyId),`walletKeyId`),enrollmentId:v(i(n.enrollmentId),`enrollmentId`),deviceId:v(a(n.deviceId),`deviceId`),transferAlg:ze,applicationBindingDigestB64u:m(n.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:ne(n.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:Je(n.targetFactor),revocationEpoch:Ze(n.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:r,ephemeralPublicKeyB64u:o,nonceB64u:ce(n.nonceB64u,`nonceB64u`),sealedExportRootB64u:re(n.sealedExportRootB64u,`sealedExportRootB64u`),bindingDigestB64u:m(n.bindingDigestB64u,`bindingDigestB64u`),ciphertextDigestB64u:m(n.ciphertextDigestB64u,`ciphertextDigestB64u`),sealedAtMs:Qe(n.sealedAtMs,`sealedAtMs`)}}function Je(e){switch(Ye(e,[`kind`],`targetFactor`).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`targetFactor.kind is unsupported`)}}function Ye(e,t,n){let r=u(e,n);g(r,t,n);for(let e of t)if(r[e]===void 0)throw Error(`${n}.${e} is required`);return r}function Xe(e,t){if(e!==`x25519-hkdf-sha256-chacha20poly1305-v1`)throw Error(`${t} must be ${ze}`)}function Ze(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function Qe(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive unix-millisecond timestamp`);return e}function B(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);return e}function V(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} must not be empty`);if(n!==e)throw Error(`${t} must not be padded with whitespace`);return n}function $e(e,t){let r=n(V(e,t));if(!r.ok)throw Error(`${t} is invalid: ${r.error.message}`);return r.value}function H(e,t,n){if(e!==t)throw Error(`${n} must be ${String(t)}`);return t}function et(e){let t=`WalletAddAuthMethodRegistrationOptions`,n=B(e,t);H(n.kind,`webauthn_add_auth_method_registration_v1`,`${t}.kind`);let r=B(n.user,`${t}.user`),i=B(n.authenticatorSelection,`${t}.authenticatorSelection`),a=B(B(B(n.extensions,`${t}.extensions`).prf,`${t}.extensions.prf`).eval,`${t}.extensions.prf.eval`);if(!Array.isArray(n.pubKeyCredParams)||n.pubKeyCredParams.length!==2)throw Error(`${t}.pubKeyCredParams must list exactly two algorithms`);let[o,s]=n.pubKeyCredParams;if(H(B(o,`${t}.pubKeyCredParams[0]`).type,`public-key`,`${t}.pubKeyCredParams[0].type`),H(B(o,`${t}.pubKeyCredParams[0]`).alg,-7,`${t}.pubKeyCredParams[0].alg`),H(B(s,`${t}.pubKeyCredParams[1]`).type,`public-key`,`${t}.pubKeyCredParams[1].type`),H(B(s,`${t}.pubKeyCredParams[1]`).alg,-257,`${t}.pubKeyCredParams[1].alg`),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);let c=n.excludeCredentials.map((e,n)=>{let r=B(e,`${t}.excludeCredentials[${n}]`);return{type:H(r.type,`public-key`,`${t}.excludeCredentials[${n}].type`),id:V(r.id,`${t}.excludeCredentials[${n}].id`)}}),l=n.timeoutMs;if(typeof l!=`number`||!Number.isSafeInteger(l)||l<=0)throw Error(`${t}.timeoutMs must be a positive safe integer`);return{kind:`webauthn_add_auth_method_registration_v1`,challengeId:V(n.challengeId,`${t}.challengeId`),challengeB64u:V(n.challengeB64u,`${t}.challengeB64u`),rpId:$e(n.rpId,`${t}.rpId`),user:{idB64u:V(r.idB64u,`${t}.user.idB64u`),name:V(r.name,`${t}.user.name`),displayName:V(r.displayName,`${t}.user.displayName`)},pubKeyCredParams:[{type:`public-key`,alg:-7},{type:`public-key`,alg:-257}],authenticatorSelection:{residentKey:H(i.residentKey,`required`,`${t}.authenticatorSelection.residentKey`),userVerification:H(i.userVerification,`preferred`,`${t}.authenticatorSelection.userVerification`)},timeoutMs:l,attestation:H(n.attestation,`none`,`${t}.attestation`),extensions:{prf:{eval:{firstB64u:V(a.firstB64u,`${t}.extensions.prf.eval.firstB64u`),secondB64u:V(a.secondB64u,`${t}.extensions.prf.eval.secondB64u`)}}},excludeCredentials:c}}function tt(e){let t=ut(e);if(t.kind!==`committed_authority_packages_v1`)throw Error(`CommittedAuthorityPackagesV1.kind is invalid`);let n=De(t.authority);if(!n.ok||n.value.state!==`pending_local_install`)throw Error(`CommittedAuthorityPackagesV1.authority is not pending`);let r=Le(t.authMethod);if(!r||r.status!==`pending_local_install`||r.kind===`voiceid`)throw Error(`CommittedAuthorityPackagesV1.authMethod is not pending`);if(r.walletId!==n.value.walletId||r.walletAuthorityId!==n.value.authorityId)throw Error(`CommittedAuthorityPackagesV1 authority and auth method identities differ`);let i=rt(t.signerPackages);nt(i,n.value.signerActivations);let a=t.ed25519ExportRootPackage===null?null:qe(t.ed25519ExportRootPackage);if(a&&(a.walletId!==n.value.walletId||a.revocationEpoch!==n.value.revocationEpoch||n.value.provenance.kind!==`device_link`||a.enrollmentId!==n.value.provenance.enrollmentId||a.linkSessionId!==n.value.provenance.linkSessionId||String(a.deviceId)!==String(n.value.principal.deviceId)))throw Error(`CommittedAuthorityPackagesV1 export root identity does not match authority`);return{kind:`committed_authority_packages_v1`,authority:n.value,authMethod:r,signerPackages:i,ed25519ExportRootPackage:a,packageSetDigestB64u:it(t.packageSetDigestB64u)}}function nt(e,t){if(e.keyFamilies.length!==t.keyFamilies.length)throw Error(`CommittedAuthorityPackagesV1 signer families do not match authority`);for(let n=0;n<e.keyFamilies.length;n+=1)if(e.keyFamilies[n]!==t.keyFamilies[n])throw Error(`CommittedAuthorityPackagesV1 signer family order does not match authority`);if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`){if(!t.ed25519||!e.ed25519)throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation is missing`);if(!s(e.ed25519.materialActivation,t.ed25519.materialActivation))throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation does not match authority`);return}if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`){if(!t.ecdsa||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 ECDSA activation is missing`);if(!s(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 ECDSA activation does not match authority`);return}if(!t.ed25519||!t.ecdsa||!e.ed25519||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 combined activations are incomplete`);if(!s(e.ed25519.materialActivation,t.ed25519.materialActivation)||!s(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 activation references do not match authority`)}function rt(e){let t=dt(e);if(t.kind!==`committed_signer_package_set_v1`)throw Error(`CommittedSignerPackageSetV1.kind is invalid`);let n=lt(t.keyFamilies);if(n.length===1&&n[0]===`ed25519`){if(!(`ed25519`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:at(t.ed25519)}}if(n.length===1&&n[0]===`ecdsa_secp256k1`){if(!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ecdsa:ot(t.ecdsa)}}if(!(`ed25519`in t)||!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);let r=at(t.ed25519),i=ot(t.ecdsa);if(r.materialActivation.activationId===i.materialActivation.activationId)throw Error(`CommittedSignerPackageSetV1 activation references must be distinct`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:r,ecdsa:i}}function it(e){return F(e)}function at(e){let t=ft(e);if(t.kind!==`committed_ed25519_signer_package_v1`)throw Error(`CommittedEd25519SignerPackageV1.kind is invalid`);let n=ct(t.materialActivation,`materialActivation`),r=Se(t.targetBinding),i=xe(t.applicationBinding),a=we(t.activationReceipt);if(!s(n,Ne(a.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 activation receipt does not match material`);if(!s(n,Ne(r.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 target binding does not match material`);let o=st(t.deriver_a_client_package,`deriver_a_client_package`,`deriver_a`),c=st(t.deriver_b_client_package,`deriver_b_client_package`,`deriver_b`);if(!be(a.transcript,o.transcript)||!be(a.transcript,c.transcript))throw Error(`CommittedEd25519SignerPackageV1 receipt transcript does not match packages`);return{kind:`committed_ed25519_signer_package_v1`,materialActivation:n,targetBinding:r,applicationBinding:i,participantIds:Te(t.participantIds),activationReceipt:a,deriver_a_client_package:o,deriver_b_client_package:c}}function ot(e){let t=pt(e);if(t.kind!==`committed_ecdsa_signer_package_v1`)throw Error(`CommittedEcdsaSignerPackageV1.kind is invalid`);let n=ct(t.materialActivation,`materialActivation`),r=Ee(t.activationReceipt),i=r.binding.target.activation;if(!s(n,i))throw Error(`CommittedEcdsaSignerPackageV1 receipt activation does not match material`);let a=ke(t.encryptedTargetClientShare,`encryptedTargetClientShare`);if(a.recipientPublicKeyB64u!==r.binding.target.clientRecipientPublicKeyB64u)throw Error(`CommittedEcdsaSignerPackageV1 client share recipient does not match receipt`);return{kind:`committed_ecdsa_signer_package_v1`,materialActivation:n,encryptedTargetClientShare:a,activationReceipt:r}}function st(e,t,n){let r=Ce(e);if(!r.ok)throw Error(`${t} ${r.message}`);if(r.value.kind!==`activation_client`||r.value.deriver!==n)throw Error(`${t} must be an activation_client for ${n}`);return{kind:`activation_client`,deriver:n,session:r.value.session,transcript:r.value.transcript,encapsulated_key:r.value.encapsulated_key,ciphertext:r.value.ciphertext}}function ct(e,t){let n=o(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function lt(e){if(!Array.isArray(e))throw Error(`CommittedSignerPackageSetV1.keyFamilies must be an array`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`CommittedSignerPackageSetV1.keyFamilies must use canonical family order`)}function ut(e){let t=mt(e);if(t===null)throw Error(`CommittedAuthorityPackagesV1 must be an object`);return U(t,[`kind`,`authority`,`authMethod`,`signerPackages`,`ed25519ExportRootPackage`,`packageSetDigestB64u`],`CommittedAuthorityPackagesV1`),{kind:Reflect.get(t,`kind`),authority:Reflect.get(t,`authority`),authMethod:Reflect.get(t,`authMethod`),signerPackages:Reflect.get(t,`signerPackages`),ed25519ExportRootPackage:Reflect.get(t,`ed25519ExportRootPackage`),packageSetDigestB64u:Reflect.get(t,`packageSetDigestB64u`)}}function dt(e){let t=mt(e);if(t===null)throw Error(`CommittedSignerPackageSetV1 must be an object`);let n=Object.keys(t),r=n.includes(`ed25519`),i=n.includes(`ecdsa`);return r&&i?(U(t,[`kind`,`keyFamilies`,`ed25519`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`),ecdsa:Reflect.get(t,`ecdsa`)}):r?(U(t,[`kind`,`keyFamilies`,`ed25519`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`)}):i?(U(t,[`kind`,`keyFamilies`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ecdsa:Reflect.get(t,`ecdsa`)}):(U(t,[`kind`,`keyFamilies`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`)})}function ft(e){let t=mt(e);if(t===null)throw Error(`CommittedEd25519SignerPackageV1 must be an object`);return U(t,[`kind`,`materialActivation`,`targetBinding`,`applicationBinding`,`participantIds`,`activationReceipt`,`deriver_a_client_package`,`deriver_b_client_package`],`CommittedEd25519SignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),targetBinding:Reflect.get(t,`targetBinding`),applicationBinding:Reflect.get(t,`applicationBinding`),participantIds:Reflect.get(t,`participantIds`),activationReceipt:Reflect.get(t,`activationReceipt`),deriver_a_client_package:Reflect.get(t,`deriver_a_client_package`),deriver_b_client_package:Reflect.get(t,`deriver_b_client_package`)}}function pt(e){let t=mt(e);if(t===null)throw Error(`CommittedEcdsaSignerPackageV1 must be an object`);return U(t,[`kind`,`materialActivation`,`encryptedTargetClientShare`,`activationReceipt`],`CommittedEcdsaSignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),encryptedTargetClientShare:Reflect.get(t,`encryptedTargetClientShare`),activationReceipt:Reflect.get(t,`activationReceipt`)}}function mt(e){return typeof e==`object`&&e&&!Array.isArray(e)?e:null}function U(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length)throw Error(`${n} contains unexpected fields`);for(let e of i)if(!r.has(e))throw Error(`${n} contains unexpected fields`);for(let r of t)if(!Object.prototype.hasOwnProperty.call(e,r))throw Error(`${n}.${r} is required`)}const ht=[`version`,`purpose`,`linkSessionId`,`linkPublicKeyB64u`,`devicePublicKeyB64u`,`requestedPermission`,`targetFactor`,`issuedAtMs`,`expiresAtMs`];function gt(...e){return(t,n)=>{if(!e.includes(t))throw Error(`${n} is unsupported`);return t}}function _t(e,t){if(typeof e!=`string`||!/^[0-9a-f]{64}$/.test(e))throw Error(`${t} must be 32 canonical lowercase hex bytes`);return e}function W(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=f(e);if(t.length!==32||d(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be a canonical 32-byte unpadded base64url key`)}return e}function G(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=f(e);if(t.length===0||d(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be canonical unpadded base64url`)}return e}function vt(e,t,n){let r=G(e,n),i=f(r);try{if(i.length!==t)throw Error(`${n} must encode ${t} bytes`);return r}finally{i.fill(0)}}const K=BigInt(`0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff`),yt=K-3n,bt=BigInt(`0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b`);function xt(e){let t=0n;for(let n of e)t=t<<8n|BigInt(n);return t}function St(e){let t=xt(e.subarray(1,33)),n=xt(e.subarray(33,65));return t>=K||n>=K?!1:n*n%K===(t*t*t%K+yt*t%K+bt)%K}function q(e,t){let n=vt(e,65,t),r=f(n);try{if(r[0]!==4)throw Error(`${t} must be an uncompressed SEC1 P-256 point`);if(!St(r))throw Error(`${t} must be an on-curve P-256 point`);return n}finally{r.fill(0)}}function Ct(e){return W(e,`LinkDevicePublicKeyB64u`)}function wt(e,t){return de(G(e,t),t)}function Tt(e,t){if(e!==`ed25519`&&e!==`ecdsa_secp256k1`)throw Error(`${t} must identify a supported key family`);return e}function J(e,t,n){if(t<=e)throw Error(`${n}.expiresAtMs must be after issuedAtMs`)}function Et(e){return{kind:e.kind,permissions:[...ie(e)]}}function Dt(e){let t={version:e.version,purpose:e.purpose,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:Et(e.requestedPermission),targetFactor:e.targetFactor,issuedAtMs:e.issuedAtMs,expiresAtMs:e.expiresAtMs};return e.targetFactor.kind===`email_otp`?{...t,targetEmail:e.targetEmail}:t}function Y(e,t){switch(A(e,[`kind`],t).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`${t}.kind is unsupported`)}}function Ot(){return b({kind:h(`passkey_prf`)})}function kt(){return b({kind:h(`email_otp`)})}function At(){return b({kind:h(`existing_enrollment`)})}function jt(){return b({kind:h(`new_enrollment`)})}function Mt(){return _(`kind`,[At(),jt()])}function Nt(e,t){return Mt()(e,t)}function Pt(){return b({enrollmentSealKeyVersion:O,clientUnlockPublicKeyB64u:O,unlockKeyVersion:O,serverSealedFactorCiphertextB64u:O})}function Ft(e,t){let n=u(e,t);if(n.kind===`passkey_prf`)return A(n,[`kind`],t),{kind:`passkey_prf`};if(n.kind===`email_otp`){let e=Nt(n.enrollment,`${t}.enrollment`),r=T(n.targetEmail,`${t}.targetEmail`);return e.kind===`existing_enrollment`?{kind:`email_otp`,targetEmail:r,enrollment:e,baseWalletAuthMethodId:S(A(n,[`kind`,`targetEmail`,`enrollment`,`baseWalletAuthMethodId`],t).baseWalletAuthMethodId,`${t}.baseWalletAuthMethodId`)}:(A(n,[`kind`,`targetEmail`,`enrollment`],t),{kind:`email_otp`,targetEmail:r,enrollment:e})}throw Error(`${t}.kind is unsupported`)}function It(e){if(e.version!==`v5`)throw Error(`QrLinkedDeviceSessionPayloadV5.version is invalid`);if(e.purpose!==`linked_device_lane_creation`)throw Error(`QrLinkedDeviceSessionPayloadV5.purpose is invalid`);let t=x(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=x(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);J(t,n,`QrLinkedDeviceSessionPayloadV5`);let r={version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:N(e.linkSessionId,`QrLinkedDeviceSessionPayloadV5.linkSessionId`),linkPublicKeyB64u:W(e.linkPublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.linkPublicKeyB64u`),devicePublicKeyB64u:W(e.devicePublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.devicePublicKeyB64u`),requestedPermission:k(e.requestedPermission,`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:Y(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`),issuedAtMs:t,expiresAtMs:n};return r.targetFactor.kind===`email_otp`?{...r,targetFactor:{kind:`email_otp`},targetEmail:T(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`)}:{...r,targetFactor:{kind:`passkey_prf`}}}function Lt(e){let t=u(e,`QrLinkedDeviceSessionPayloadV5`);return It(A(t,Y(t.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`).kind===`email_otp`?[...ht,`targetEmail`]:ht,`QrLinkedDeviceSessionPayloadV5`))}function Rt(e){let t=It(Dt(e)),n={v:5,s:t.linkSessionId,l:t.linkPublicKeyB64u,d:t.devicePublicKeyB64u,a:Et(t.requestedPermission),f:t.targetFactor.kind===`passkey_prf`?`p`:`e`,i:t.issuedAtMs,e:t.expiresAtMs};return t.targetFactor.kind===`email_otp`?JSON.stringify({...n,t:t.targetEmail}):JSON.stringify(n)}function zt(){return b({payload:Lt,requestedAtMs:x})}function Bt(e){return zt()(e,`LinkedDeviceOwnerAuthorizationRequestV1`)}function Vt(){let e=e=>b({state:h(e),deviceId:ue});return[b({state:h(`displaying_qr`)}),e(`claimed`),e(`awaiting_target_factor`),e(`awaiting_source_contribution`),e(`provisioning`),b({state:h(`authority_pending_local_install`),deviceId:ue,authorityId:M,packageSetDigestB64u:C}),b({state:h(`active`),deviceId:ue,authorityId:M,activatedAtMs:x}),b({state:h(`failed_before_commit`),error:Ut}),b({state:h(`cancelled`),cancelledAtMs:x}),b({state:h(`expired`),expiredAtMs:x})]}function Ht(e){let t=u(e,`LinkSessionStateV1`).state;if(typeof t!=`string`)throw Error(`LinkSessionStateV1.state is invalid`);let n=Vt().find(e=>e.shape.state.literals.includes(t));if(!n)throw Error(`LinkSessionStateV1.state ${t} is unsupported`);return n(e,`LinkSessionStateV1.${t}`)}function Ut(e){let t=A(e,[`kind`,`reason`],`LinkPrecommitFailureV1`);if(t.kind!==`invalid_input`&&t.kind!==`unauthorized_source`&&t.kind!==`revoked_source`&&t.kind!==`permission_attenuation_failed`&&t.kind!==`target_factor_failed`&&t.kind!==`expired_session`&&t.kind!==`cancelled_session`&&t.kind!==`claim_conflict`&&t.kind!==`package_preparation_failed`)throw Error(`LinkPrecommitFailureV1.kind is invalid`);return{kind:t.kind,reason:O(t.reason,`LinkPrecommitFailureV1.reason`)}}function Wt(){return b({kind:h(`linked_device_session_projection_v1`),linkSessionId:N,qrPayload:Lt,revision:E,createdAtMs:x,updatedAtMs:x,state:Ht})}function Gt(e){return Wt()(e,`LinkSessionProjectionV1`)}function Kt(){return b({kind:h(`linked_device_session_event_v1`),linkSessionId:N,state:Ht,emittedAtMs:x})}function qt(e){return Kt()(e,`LinkSessionTransportEventV1`)}function Jt(){return _(`outcome`,[b({outcome:h(`pending`),state:Xt}),b({outcome:h(`replayed`),replay:b({state:()=>`pending`,session:Xt})})])}function Yt(e){return Jt()(e,`LinkedDeviceApprovalResultV1`)}function Xt(e){let t=Ht(e);switch(t.state){case`awaiting_target_factor`:case`awaiting_source_contribution`:case`provisioning`:case`authority_pending_local_install`:return t;default:throw Error(`LinkedDeviceApprovalResultV1 state is not pending`)}}function Zt(){return b({kind:h(`linked_device_session_claim_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,devicePublicKeyB64u:W,targetFactor:Y,sessionRevision:x,claimedAtMs:x,claimExpiresAtMs:x},(e,t)=>J(e.claimedAtMs,e.claimExpiresAtMs,t))}function Qt(e){return Zt()(e,`LinkedDeviceSessionClaimV1`)}function $t(){return b({kind:h(`wallet_session`),walletSessionId:ae,authorizationId:pe})}function en(e,t=`ownerAuthorization`){if(u(e,t).kind!==`wallet_session`)throw Error(`${t}.kind is unsupported`);return $t()(e,t)}function tn(){return{kind:h(`linked_device_approval_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,linkPublicKeyB64u:W,devicePublicKeyB64u:W,permission:k,targetFactor:Ft,ownerAuthorization:en,approvedAtMs:x,expiresAtMs:x}}function nn(e,t){J(e.approvedAtMs,e.expiresAtMs,t)}function rn(){return b(tn(),nn)}function an(){return b({...tn(),sourceContribution:Ae},nn)}function on(e){let t=u(e,`LinkedDeviceApprovalV1`);return(t.sourceContribution===void 0?rn():an())(t,`LinkedDeviceApprovalV1`)}function sn(){return b({kind:h(`linked_device_approval_delivery_v1`),approval:on})}function cn(e){return sn()(e,`LinkedDeviceApprovalDeliveryV1`)}function ln(){return{kind:h(`linked_device_target_preparation_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,deliveryRecipientPublicKey65B64u:q,walletAuthMethodId:S,ed25519ExportRoot:oe(Cn()),ordinarySignerMaterialRecipientRequirements:En,issuedAtMs:x,expiresAtMs:x}}function un(e,t){if(e.expiresAtMs<=e.issuedAtMs)throw Error(`${t}.expiresAtMs must follow issuedAtMs`)}function dn(){return b({...ln(),targetFactor:Ot(),passkeyCreationOptions:Sn,passkeyConfigurationDigestB64u:C},(e,t)=>{if(un(e,t),e.passkeyCreationOptions.walletAuthMethodId!==e.walletAuthMethodId)throw Error(`${t}.passkeyCreationOptions.walletAuthMethodId must match the preparation`)})}function fn(){return b({...ln(),targetFactor:kt(),targetEmail:T,enrollment:At(),baseWalletAuthMethodId:S},un)}function pn(){return b({...ln(),targetFactor:kt(),targetEmail:T,enrollment:jt()},un)}function mn(e){let t=`LinkedDeviceTargetPreparationV1`,n=u(e,t);return Y(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?dn()(n,t):(Nt(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?pn():fn())(n,t)}function hn(){return b({kind:h(`linked_device_target_preparation_request_v1`),linkSessionId:N,deliveryRecipientPublicKey65B64u:q})}function gn(e){return hn()(e,`LinkedDeviceTargetPreparationRequestV1`)}function _n(){return b({baseWalletAuthMethodId:S,maskedEmailHint:(e,t)=>{if(typeof e!=`string`||e.length===0)throw Error(`${t} is invalid`);return e}})}function vn(){let e=_n(),t=t=>e(t,`LinkedDeviceEmailOtpBaseFactorChoiceV1`);return{selected:b({kind:h(`selected`),choice:t}),selection_required:b({kind:h(`selection_required`),choices:(e,n)=>{if(!Array.isArray(e)||e.length===0)throw Error(`${n} must not be empty`);let r=e.map(t);return[r[0],...r.slice(1)]}}),unavailable:b({kind:h(`unavailable`),reason:gt(`no_active_email_otp_base_factor`)})}}function yn(e){let t=`LinkedDeviceEmailOtpBaseFactorResolutionV1`,n=u(e,t),r=vn();switch(n.kind){case`selected`:case`selection_required`:case`unavailable`:return r[n.kind](n,t);default:throw Error(`${t}.kind is unsupported`)}}function bn(){return b({revision:x,resolution:yn})}function xn(e){return bn()(e,`LinkedDeviceEmailOtpBaseFactorResolutionResultV1`)}function Sn(e,t){let n=A(e,[`kind`,`walletAuthMethodId`,`challengeId`,`challengeB64u`,`rpId`,`user`,`pubKeyCredParams`,`authenticatorSelection`,`timeoutMs`,`attestation`,`extensions`,`excludeCredentials`],t),r=S(n.walletAuthMethodId,`${t}.walletAuthMethodId`);if(A(n.user,[`idB64u`,`name`,`displayName`],`${t}.user`),A(n.authenticatorSelection,[`residentKey`,`userVerification`],`${t}.authenticatorSelection`),A(A(A(n.extensions,[`prf`],`${t}.extensions`).prf,[`eval`],`${t}.extensions.prf`).eval,[`firstB64u`,`secondB64u`],`${t}.extensions.prf.eval`),!Array.isArray(n.pubKeyCredParams))throw Error(`${t}.pubKeyCredParams must be an array`);if(n.pubKeyCredParams.forEach((e,n)=>{A(e,[`type`,`alg`],`${t}.pubKeyCredParams[${n}]`)}),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);n.excludeCredentials.forEach((e,n)=>{A(e,[`type`,`id`],`${t}.excludeCredentials[${n}]`)});let i=et(n);return{kind:i.kind,walletAuthMethodId:r,challengeId:i.challengeId,challengeB64u:i.challengeB64u,rpId:i.rpId,user:i.user,pubKeyCredParams:i.pubKeyCredParams,authenticatorSelection:i.authenticatorSelection,timeoutMs:i.timeoutMs,attestation:i.attestation,extensions:i.extensions,excludeCredentials:i.excludeCredentials}}function Cn(){return b({kind:h(`linked_device_ed25519_export_root_preparation_v1`),walletKeyId:p,applicationBindingDigestB64u:C,registeredPublicKeyB64u:ne,revocationEpoch:E})}function wn(e,t,n){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`${n} must contain one or two entries`);let r=e.map((e,r)=>t(e,`${n}[${r}]`));if(new Set(r.map(e=>e.keyFamily)).size!==r.length)throw Error(`${n} repeats a key family`);if(new Set(r.map(e=>String(e.walletKeyId))).size!==r.length)throw Error(`${n} repeats a wallet key`);if(r.length===2&&(r[0]?.keyFamily!==`ed25519`||r[1]?.keyFamily!==`ecdsa_secp256k1`))throw Error(`${n} must be ordered Ed25519 then ECDSA`);return r}function Tn(){return b({kind:h(`ordinary_signer_material_recipient_requirement_v1`),keyFamily:Tt,walletKeyId:p})}function En(e){let t=wn(e,Tn(),`LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requirements are empty`);return[n,...t.slice(1)]}const Dn=h(`ble`,`cable`,`hybrid`,`internal`,`nfc`,`smart-card`,`usb`);function On(e,t){let n=te(e,t).map((e,n)=>Dn(e,`${t}[${n}]`));if(new Set(n).size!==n.length)throw Error(`${t} contains duplicates`);return n}function kn(){return b({kind:h(`linked_device_webauthn_registration_v1`),credentialIdB64u:wt,authenticatorAttachment:oe(h(`platform`,`cross-platform`)),clientDataJsonB64u:G,attestationObjectB64u:G,transports:On})}function An(){let e=e=>(t,n)=>{if(t!==e)throw Error(`${n} does not match its kind`);return e};return _(`kind`,[b({kind:h(`ordinary_ed25519_signer_material_recipient_request_v1`),keyFamily:e(`ed25519`),walletKeyId:p,recipientPublicKeyB64u:(e,t)=>vt(e,32,t)}),b({kind:h(`ordinary_ecdsa_signer_material_recipient_request_v1`),keyFamily:e(`ecdsa_secp256k1`),walletKeyId:p,clientEphemeralPublicKey:Me})])}function X(e){let t=wn(e,An(),`LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requests are empty`);return[n,...t.slice(1)]}function jn(){return{kind:h(`linked_device_target_credential_registration_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,walletAuthMethodId:S}}function Mn(){return b({...jn(),targetFactor:Ot(),targetPreparationDigestB64u:C,ordinarySignerMaterialRecipientRequests:X,webauthnRegistration:kn(),registeredAtMs:x})}function Nn(){return b({...jn(),targetFactor:kt(),targetEmail:T,targetPreparationDigestB64u:C,ordinarySignerMaterialRecipientRequests:X,emailOtpVerificationGrant:Z,registeredAtMs:x})}function Pn(){return b({...jn(),targetFactor:kt(),targetEmail:T,targetPreparationDigestB64u:C,ordinarySignerMaterialRecipientRequests:X,emailOtpVerificationGrant:Z,emailOtpEnrollment:Pt(),registeredAtMs:x})}function Fn(e){let t=`LinkedDeviceTargetCredentialRegistrationV1`,n=u(e,t);return Y(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?Mn()(n,t):(Z(n.emailOtpVerificationGrant).enrollment.kind===`new_enrollment`?Pn():Nn())(n,t)}function In(){return b({kind:h(`linked_device_target_credential_registration_result_v1`),outcome:h(`applied`,`replayed`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,walletAuthMethodId:S,targetPreparationDigestB64u:C,targetFactor:Hn,ordinarySignerMaterialPreparations:je,ordinarySignerMaterialRecipientRequests:X,keyManifestDigestB64u:C},(e,t)=>{let{authMethod:n}=e.targetFactor;if(n.walletAuthMethodId!==e.walletAuthMethodId||n.walletId!==e.walletId)throw Error(`${t} target identity differs`)})}function Ln(e){return In()(e,`LinkedDeviceTargetCredentialRegistrationResultV1`)}function Rn(e,t){if(e.verifiedAtMs<e.authMethod.createdAtMs)throw Error(`${t}.verifiedAtMs precedes authMethod.createdAtMs`)}function zn(){return b({kind:h(`verified_passkey_target_v1`),authMethod:Wn,verificationDigestB64u:C,verifiedAtMs:x},Rn)}function Bn(){return b({kind:h(`verified_email_otp_target_v1`),authMethod:Kn,targetEmail:T,enrollment:At(),baseWalletAuthMethodId:S,providerUserId:O,verificationDigestB64u:C,verifiedAtMs:x},Rn)}function Vn(){return b({kind:h(`verified_email_otp_target_v1`),authMethod:Kn,targetEmail:T,enrollment:jt(),providerUserId:O,verificationDigestB64u:C,verifiedAtMs:x},Rn)}function Hn(e,t){let n=u(e,t);if(n.kind===`verified_passkey_target_v1`)return zn()(n,t);if(n.kind!==`verified_email_otp_target_v1`)throw Error(`${t}.kind is invalid`);return(Nt(n.enrollment,`${t}.enrollment`).kind===`existing_enrollment`?Bn():Vn())(n,t)}function Un(){return b({walletAuthMethodId:S,walletId:y,createdAtMs:x,kind:h(`passkey`),rpId:fe,credentialIdB64u:de,credentialPublicKeyB64u:G,counter:E})}function Wn(e,t){return Un()(e,t)}function Gn(){return b({walletAuthMethodId:S,walletId:y,createdAtMs:x,kind:h(`email_otp`),emailHashHex:_t,registrationAuthorityId:O})}function Kn(e,t){return Gn()(e,t)}function qn(e){return{kind:h(`linked_device_email_otp_verification_grant_v1`),grantId:O,grantToken:O,challengeId:O,linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,targetPreparationDigestB64u:C,targetEmail:T,enrollment:e,emailHashHex:_t,registrationAuthorityId:O,providerUserId:O,authorityDigestB64u:C,issuedAtMs:x,expiresAtMs:x}}function Jn(e,t){J(e.issuedAtMs,e.expiresAtMs,t)}function Yn(){return b({...qn(At()),baseWalletAuthMethodId:S},Jn)}function Xn(){return b(qn(jt()),Jn)}function Z(e){let t=`LinkedDeviceEmailOtpVerificationGrantV1`,n=u(e,t);return(Nt(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?Xn():Yn())(n,t)}function Zn(){return b({kind:h(`email_otp_factor_release_v1`),challengeId:O,enrollmentId:O,enrollmentSealKeyVersion:O,serverEphemeralPublicKey65B64u:q,nonce12B64u:(e,t)=>vt(e,12,t),ciphertextB64u:G})}function Qn(e){return Zn()(e,`LinkedDeviceEmailOtpFactorReleaseEnvelopeV1`)}function $n(){return b({kind:h(`linked_device_email_otp_challenge_start_request_v1`),linkSessionId:N,workerEphemeralPublicKey65B64u:q})}function er(e){return $n()(e,`LinkedDeviceEmailOtpChallengeStartRequestV1`)}function tr(){return b({kind:h(`linked_device_email_otp_challenge_resend_request_v1`),linkSessionId:N,challengeId:O})}function nr(e){return tr()(e,`LinkedDeviceEmailOtpChallengeResendRequestV1`)}function rr(){return b({kind:h(`linked_device_email_otp_challenge_verify_request_v1`),linkSessionId:N,challengeId:O,otpCode:(e,t)=>{if(typeof e!=`string`||!/^[0-9]{6,10}$/.test(e))throw Error(`${t} is invalid`);return e}})}function ir(e){return rr()(e,`LinkedDeviceEmailOtpChallengeVerifyRequestV1`)}function ar(){return b({kind:h(`linked_device_email_otp_challenge_result_v1`),challengeId:O,maskedEmailHint:O,expiresAtMs:x,resendAvailableAtMs:x})}function or(e){return ar()(e,`LinkedDeviceEmailOtpChallengeResultV1`)}function sr(e){let t=A(e,[`kind`,`verificationGrant`,`factorRelease`],`LinkedDeviceEmailOtpVerificationResultV1`);if(t.kind!==`linked_device_email_otp_verification_result_v1`)throw Error(`LinkedDeviceEmailOtpVerificationResultV1.kind is invalid`);let n=Z(t.verificationGrant);if(cr(n)){if(t.factorRelease!==null)throw Error(`new linked-device Email OTP enrollment cannot carry a factor release`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:null}}let r=Qn(t.factorRelease);if(r.challengeId!==n.challengeId)throw Error(`LinkedDeviceEmailOtpVerificationResultV1 challenge binding changed`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:r}}function cr(e){return e.enrollment.kind===`new_enrollment`}function lr(e){let t=x(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=x(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);J(t,n,`QrLinkedDeviceSessionPayloadV5`);let r=Y(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`);if(r.kind===`passkey_prf`)return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:k(Et(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,issuedAtMs:t,expiresAtMs:n};if(e.targetEmail===void 0)throw Error(`QrLinkedDeviceSessionPayloadV5.targetEmail is required for Email OTP`);return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:k(Et(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,targetEmail:T(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`),issuedAtMs:t,expiresAtMs:n}}function ur(e){return{kind:`linked_device_session_claim_request_v1`,payload:e}}function dr(e,t,n){let r=x(e,`${n}.approvedAtMs`),i=x(t,`${n}.expiresAtMs`);return J(r,i,n),{approvedAtMs:r,expiresAtMs:i}}function fr(e){let t=dr(e.approvedAtMs,e.expiresAtMs,`LinkedDeviceApprovalV1`);return on({kind:`linked_device_approval_v1`,...e,...t})}function pr(e){return Fn({kind:`linked_device_target_credential_registration_v1`,...e})}function mr(e){return{kind:`linked_device_session_cancel_unclaimed_request_v1`,linkSessionId:e.linkSessionId,reason:`user_cancelled`,requestedAtMs:x(e.requestedAtMs,`LinkedDeviceSessionCancelUnclaimedRequestV1.requestedAtMs`)}}function hr(e){return{kind:`linked_device_session_cancel_claimed_request_v1`,...e,requestedAtMs:x(e.requestedAtMs,`LinkedDeviceSessionCancelClaimedRequestV1.requestedAtMs`)}}const gr=[`chrome`,`safari`,`firefox`,`edge`,`other`],_r=[`macos`,`ios`,`windows`,`android`,`linux`,`other`];function vr(e){return typeof e==`string`&&gr.some(t=>t===e)}function yr(e){return typeof e==`string`&&_r.some(t=>t===e)}function br(e){if(!e||typeof e!=`object`||Array.isArray(e))return null;let t=e,n=typeof t.label==`string`?t.label.trim():``;if(!n||!vr(t.browser)||!yr(t.os)||typeof t.synced!=`boolean`||!Array.isArray(t.transports))return null;let r=t.transports.map(e=>typeof e==`string`?e.trim():``).filter(e=>e.length>0),i=typeof t.provider==`string`?t.provider.trim():``,a=typeof t.providerLabel==`string`?t.providerLabel.trim():``;return{label:n,browser:t.browser,os:t.os,synced:t.synced,transports:r,...i?{provider:i}:{},...a?{providerLabel:a}:{}}}function xr(e){return(t,n)=>{if(!Array.isArray(t))throw Error(`${n} is invalid`);return t.map((t,r)=>e(t,`${n}[${r}]`))}}function Sr(e,t){let n=S(e,t);if(n.startsWith(`wallet-authority:`)||n.startsWith(`authority:`))throw Error(`${t} must identify a WalletAuthMethodId`);return n}function Cr(e,t){let n=E(e,t);if(n<1)throw Error(`${t} must be a positive safe integer`);return n}function wr(e,t){let n=br(e);if(!n)throw Error(`${t} is invalid`);return n}function Tr(){return _(`kind`,[b({kind:h(`passkey`),walletAuthMethodId:S,credentialIdB64u:de,device:wr}),b({kind:h(`email_otp`),walletAuthMethodId:S}),b({kind:h(`voiceid`),walletAuthMethodId:S,deviceKeyId:C})])}function Er(e,t){return Tr()(e,t)}function Dr(){return b({deviceId:w,enrollmentId:D,walletId:y,credential:Er,permission:k,keyManifestDigestB64u:C,coveredWalletKeys:xr(p),state:h(`provisioning`,`active`,`suspended`,`expired`,`revoked`),createdAtMs:x,lastActivityAtMs:x,revocationEpoch:E})}function Or(e){return Dr()(e,`LinkedDeviceSummaryV1`)}function kr(){return b({kind:h(`linked_device_list_request_v1`),walletId:y,limit:Cr,cursor:se})}function Ar(e){return kr()(e,`LinkedDeviceListRequestV1`)}function jr(){return b({walletId:y,walletAuthorityId:M,credential:Er,createdAtMs:x,lastActivityAtMs:x})}function Mr(){let e=jr();return b({devices:xr(Or),ownerDevices:xr(t=>e(t,`OwnerDeviceSummaryV1`)),nextCursor:se})}function Nr(e){return Mr()(e,`LinkedDeviceListResultV1`)}function Pr(){return b({kind:h(`linked_device_revoke_request_v1`),walletId:y,walletAuthMethodId:Sr,requestedAtMs:x})}function Fr(e){return Pr()(e,`LinkedDeviceRevokeRequestV1`)}function Ir(){return b({kind:h(`not_found`,`conflict`,`unauthorized`)})}function Lr(){return b({kind:h(`revoked`),walletAuthMethodId:Sr,authorityId:M,revocationEpoch:E})}function Rr(e){let t=u(e,`LinkedDeviceRevokeResultV1`);return(t.kind===`not_found`||t.kind===`conflict`||t.kind===`unauthorized`?Ir():Lr())(t,`LinkedDeviceRevokeResultV1`)}function zr(e){return ee({domain:`seams/linked-device/wallet-session-credential-delivery-aad/v1`,aad:e})}function Br(e){let t=qr(e,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`],`LinkedDeviceWalletSessionCredentialDeliveryBindingV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_binding_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryBindingV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_binding_v1`,namespace:Q(t.namespace,`namespace`),orgId:Q(t.orgId,`orgId`),projectId:Q(t.projectId,`projectId`),envId:Q(t.envId,`envId`),tenantId:$(ve(t.tenantId)),principalId:$(he(t.principalId))}}async function Vr(e){return P(zr(e))}async function Hr(e){return P(ee({domain:`seams/linked-device/wallet-session-credential-delivery-envelope/v1`,envelope:e}))}async function Ur(e){if(await Vr(e.aad)!==e.aadDigestB64u)throw Error(`linked-device Wallet Session credential delivery AAD digest is invalid`);if(await Hr(e.envelope)!==e.envelopeDigestB64u)throw Error(`linked-device Wallet Session credential delivery envelope digest is invalid`);if(await P(ee({domain:`seams/linked-device/delivery-recipient/v1`,recipientPublicKey65B64u:e.aad.recipientPublicKey65B64u}))!==e.recipientBindingDigestB64u)throw Error(`linked-device Wallet Session credential delivery recipient binding is invalid`)}function Wr(e){let t=qr(e,[`kind`,`aad`,`aadDigestB64u`,`recipientBindingDigestB64u`,`envelope`,`envelopeDigestB64u`,`installationReceiptDigestB64u`],`LinkedDeviceWalletSessionCredentialDeliveryV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_v1`,aad:Gr(t.aad),aadDigestB64u:F(t.aadDigestB64u),recipientBindingDigestB64u:F(t.recipientBindingDigestB64u),envelope:Kr(t.envelope),envelopeDigestB64u:F(t.envelopeDigestB64u),installationReceiptDigestB64u:F(t.installationReceiptDigestB64u)}}function Gr(e){let n=qr(e,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`,`linkSessionId`,`walletId`,`authorityId`,`walletAuthMethodId`,`authorizationId`,`walletSessionId`,`quotaId`,`credentialDigestB64u`,`recipientPublicKey65B64u`,`issuedAtMs`,`expiresAtMs`],`LinkedDeviceWalletSessionCredentialDeliveryAadV1`);if(n.kind!==`linked_device_wallet_session_credential_delivery_aad_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryAadV1.kind is invalid`);let i=Jr(n.issuedAtMs,`issuedAtMs`),a=Jr(n.expiresAtMs,`expiresAtMs`);if(a<=i)throw Error(`expiresAtMs must be after issuedAtMs`);return{kind:`linked_device_wallet_session_credential_delivery_aad_v1`,namespace:Q(n.namespace,`namespace`),orgId:Q(n.orgId,`orgId`),projectId:Q(n.projectId,`projectId`),envId:Q(n.envId,`envId`),tenantId:$(ve(n.tenantId)),principalId:$(he(n.principalId)),linkSessionId:$(l(n.linkSessionId)),walletId:$(c(n.walletId)),authorityId:$(r(n.authorityId)),walletAuthMethodId:$(t(n.walletAuthMethodId)),authorizationId:$(_e(n.authorizationId)),walletSessionId:$(ge(n.walletSessionId)),quotaId:$(me(n.quotaId)),credentialDigestB64u:F(n.credentialDigestB64u),recipientPublicKey65B64u:Xr(n.recipientPublicKey65B64u,65),issuedAtMs:i,expiresAtMs:a}}function Kr(e){let t=qr(e,[`kind`,`algorithm`,`serverEphemeralPublicKey65B64u`,`nonce12B64u`,`ciphertextB64u`],`LinkedDeviceWalletSessionCredentialEnvelopeV1`);if(t.kind!==`linked_device_wallet_session_credential_envelope_v1`||t.algorithm!==`p256-ecdh-aes256gcm-v1`)throw Error(`LinkedDeviceWalletSessionCredentialEnvelopeV1 identity is invalid`);return{kind:`linked_device_wallet_session_credential_envelope_v1`,algorithm:`p256-ecdh-aes256gcm-v1`,serverEphemeralPublicKey65B64u:Xr(t.serverEphemeralPublicKey65B64u,65),nonce12B64u:Xr(t.nonce12B64u,12),ciphertextB64u:Yr(t.ciphertextB64u)}}function qr(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be an object`);let r=e,i=new Set(t);for(let e of Object.keys(r))if(!i.has(e))throw Error(`${n}.${e} is not supported`);for(let e of t)if(!(e in r))throw Error(`${n}.${e} is required`);return r}function Q(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} is required`);return e}function Jr(e,t){if(!Number.isSafeInteger(e)||Number(e)<=0)throw Error(`${t} is invalid`);return Number(e)}function Yr(e){let t=Q(e,`base64url`);if(d(f(t))!==t)throw Error(`base64url is not canonical`);return t}function Xr(e,t){let n=Yr(e),r=f(n);if(r.length!==t)throw Error(`base64url must contain ${t} bytes`);if(t===65&&r[0]!==4)throw Error(`P-256 public key is invalid`);return n}function $(e){if(!e.ok)throw Error(e.error.message);return e.value}function Zr(e,t){let n=Oe(e);if(!n.ok)throw Error(`${t} ${n.error}`);return n.value}function Qr(){return b({kind:h(`local_authority_installation_receipt_v1`),authorityId:j(M),walletId:j(y),authMethodId:j(S),deviceId:j(ue),packageSetDigestB64u:j(C),installedActivationRefs:Zr,installedRecordSetDigestB64u:j(C),targetFactorVerificationDigestB64u:j(C),installedAtMs:j(x)})}function $r(e){return Qr()(e,`LocalAuthorityInstallationReceiptV1`)}function ei(){return b({kind:h(`local_authority_activation_final_ack_v1`),linkSessionId:j(N),authorityId:j(M),packageSetDigestB64u:j(C),authorizationId:j(pe),walletSessionId:j(ae),credentialDigestB64u:j(C),installationReceiptDigestB64u:j(C),acknowledgedAtMs:j(x)})}function ti(e){return ei()(e,`LocalAuthorityActivationFinalAckV1`)}function ni(e){let t=u(e,`ActivateInstalledAuthorityResultV1`);switch(t.kind){case`active`:{g(t,[`kind`,`authority`,`authMethod`,`walletSession`,`deliveryBinding`,`sealedDelivery`],`ActivateInstalledAuthorityResultV1`);let e=De(t.authority);if(!e.ok||e.value.state!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authority must be active`);let n=Le(t.authMethod);if(!n||n.status!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authMethod must be active`);let r=le(t.walletSession),i=Br(t.deliveryBinding),a=Wr(t.sealedDelivery);if(e.value.walletId!==n.walletId||e.value.authorityId!==n.walletAuthorityId||r.walletId!==e.value.walletId||r.authorityId!==e.value.authorityId||r.authMethodId!==n.walletAuthMethodId||r.authorityDigestB64u!==e.value.authorityDigestB64u||r.authorityRevocationEpoch!==e.value.revocationEpoch||i.namespace!==a.aad.namespace||i.orgId!==a.aad.orgId||i.projectId!==a.aad.projectId||i.envId!==a.aad.envId||i.tenantId!==a.aad.tenantId||i.principalId!==a.aad.principalId||a.aad.walletId!==r.walletId||a.aad.authorityId!==r.authorityId||a.aad.walletAuthMethodId!==r.authMethodId||a.aad.authorizationId!==r.authorizationId||a.aad.quotaId!==r.quotaId||a.aad.issuedAtMs!==r.issuedAtMs||a.aad.expiresAtMs!==r.expiresAtMs)throw Error(`ActivateInstalledAuthorityResultV1 identities do not match`);return{kind:`active`,authority:e.value,authMethod:n,walletSession:r,deliveryBinding:i,sealedDelivery:a}}case`pending_local_install`:return g(t,[`kind`,`authorityId`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`pending_local_install`,authorityId:M(t.authorityId,`authorityId`),reason:ri()(t.reason,`ActivationRetryReasonV1`)};case`integrity_error`:return g(t,[`kind`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`integrity_error`,reason:ii(t.reason)};default:throw Error(`ActivateInstalledAuthorityResultV1.kind is invalid`)}}function ri(){return _(`kind`,[b({kind:h(`installation_receipt_not_found`)}),b({kind:h(`server_worker_activation_pending`)}),b({kind:h(`wallet_session_issuance_pending`)})])}function ii(e){let t=u(e,`LinkIntegrityFailureV1`);switch(t.kind){case`authority_id_mismatch`:return g(t,[`kind`,`expectedAuthorityId`,`actualAuthorityId`],`LinkIntegrityFailureV1`),{kind:`authority_id_mismatch`,expectedAuthorityId:M(t.expectedAuthorityId,`expectedAuthorityId`),actualAuthorityId:M(t.actualAuthorityId,`actualAuthorityId`)};case`package_set_digest_mismatch`:return g(t,[`kind`,`expectedPackageSetDigestB64u`,`actualPackageSetDigestB64u`],`LinkIntegrityFailureV1`),{kind:`package_set_digest_mismatch`,expectedPackageSetDigestB64u:C(t.expectedPackageSetDigestB64u,`expectedPackageSetDigestB64u`),actualPackageSetDigestB64u:C(t.actualPackageSetDigestB64u,`actualPackageSetDigestB64u`)};case`installation_receipt_mismatch`:if(g(t,[`kind`,`field`],`LinkIntegrityFailureV1`),t.field!==`walletId`&&t.field!==`authMethodId`&&t.field!==`deviceId`&&t.field!==`targetFactorVerificationDigestB64u`&&t.field!==`installedActivationRefs`)throw Error(`LinkIntegrityFailureV1.field is invalid`);return{kind:`installation_receipt_mismatch`,field:t.field};default:throw Error(`LinkIntegrityFailureV1.kind is invalid`)}}new TextEncoder;async function ai(e){return P(e.token)}function oi(e){return ee({domain:`seams/linked-device/local-authority-installation-receipt/v1`,receipt:e})}async function si(e){return P(oi(e))}function ci(e,t){if(e===void 0)throw Error(`${t} is required`);return e}function li(e){return I(e.kind,`targetFactor.kind`)}function ui(e){let t=e.pubKeyCredParams.map(e=>z([I(e.type,`passkeyCreationOptions.pubKeyCredParams.type`),I(String(e.alg),`passkeyCreationOptions.pubKeyCredParams.alg`)])),n=e.excludeCredentials.map(e=>z([I(e.type,`passkeyCreationOptions.excludeCredentials.type`),I(e.id,`passkeyCreationOptions.excludeCredentials.id`)]));return z([I(e.kind,`passkeyCreationOptions.kind`),I(e.walletAuthMethodId,`passkeyCreationOptions.walletAuthMethodId`),I(e.challengeId,`passkeyCreationOptions.challengeId`),I(e.challengeB64u,`passkeyCreationOptions.challengeB64u`),I(e.rpId,`passkeyCreationOptions.rpId`),I(e.user.idB64u,`passkeyCreationOptions.user.idB64u`),I(e.user.name,`passkeyCreationOptions.user.name`),I(e.user.displayName,`passkeyCreationOptions.user.displayName`),Fe(t.length,`passkeyCreationOptions.pubKeyCredParams`),...t.map(e=>L(e,`passkeyCreationOptions.pubKeyCredParams.item`)),I(e.authenticatorSelection.residentKey,`passkeyCreationOptions.authenticatorSelection.residentKey`),I(e.authenticatorSelection.userVerification,`passkeyCreationOptions.authenticatorSelection.userVerification`),R(e.timeoutMs,`passkeyCreationOptions.timeoutMs`),I(e.attestation,`passkeyCreationOptions.attestation`),I(e.extensions.prf.eval.firstB64u,`passkeyCreationOptions.extensions.prf.eval.firstB64u`),I(e.extensions.prf.eval.secondB64u,`passkeyCreationOptions.extensions.prf.eval.secondB64u`),Fe(n.length,`passkeyCreationOptions.excludeCredentials`),...n.map(e=>L(e,`passkeyCreationOptions.excludeCredentials.item`))])}function di(e){return z([I(e.kind,`recipientRequirement.kind`),I(e.keyFamily,`recipientRequirement.keyFamily`),I(e.walletKeyId,`recipientRequirement.walletKeyId`)])}function fi(e){return e===null?I(`none`,`ed25519ExportRoot.kind`):z([I(e.kind,`ed25519ExportRoot.kind`),I(e.walletKeyId,`ed25519ExportRoot.walletKeyId`),Ie(e.applicationBindingDigestB64u,`ed25519ExportRoot.applicationBindingDigestB64u`),Pe(e.registeredPublicKeyB64u,`ed25519ExportRoot.registeredPublicKeyB64u`),R(e.revocationEpoch,`ed25519ExportRoot.revocationEpoch`)])}function pi(e){let t=e.ordinarySignerMaterialRecipientRequirements.map(di),n=hi(e)?e:void 0,r=n?.passkeyCreationOptions;if(e.targetFactor.kind===`passkey_prf`&&!r)throw Error(`passkey target preparation is missing creation options`);return z([I(`seams/linked-device/target-preparation/v1`,`domain`),I(e.kind,`kind`),I(e.linkSessionId,`linkSessionId`),I(e.walletId,`walletId`),I(e.enrollmentId,`enrollmentId`),I(e.deviceId,`deviceId`),L(Pe(e.deliveryRecipientPublicKey65B64u,`deliveryRecipientPublicKey65B64u`),`deliveryRecipientPublicKey65B64u`),I(e.walletAuthMethodId,`walletAuthMethodId`),L(fi(e.ed25519ExportRoot),`ed25519ExportRoot`),L(li(e.targetFactor),`targetFactor`),...r?[L(ui(r),`passkeyCreationOptions`),Ie(n.passkeyConfigurationDigestB64u,`passkeyConfigurationDigestB64u`)]:[],...mi(e),Fe(t.length,`ordinarySignerMaterialRecipientRequirements`),...t.map(e=>L(e,`ordinarySignerMaterialRecipientRequirements.item`)),R(e.issuedAtMs,`issuedAtMs`),R(e.expiresAtMs,`expiresAtMs`)])}function mi(e){return hi(e)?[]:[I(e.targetEmail,`targetEmail`),I(e.enrollment.kind,`enrollment.kind`),...e.enrollment.kind===`existing_enrollment`?[I(ci(e.baseWalletAuthMethodId,`baseWalletAuthMethodId`),`baseWalletAuthMethodId`)]:[]]}function hi(e){return e.targetFactor.kind===`passkey_prf`}async function gi(e){return ye(pi(e))}const _i=`x-seams-linked-device-proof-v1`,vi=6e4,yi=6e4;async function bi(e){return ye(xi(e,32,`devicePublicKeyB64u`))}function xi(e,t,n){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} is invalid`);let r;try{r=f(e)}catch{throw Error(`${n} is invalid`)}if(r.length!==t||d(r)!==e)throw Error(`${n} is invalid`);return r}export{Ge as $,xn as A,Qt as B,pr as C,qt as D,Gt as E,Qn as F,Rt as G,gn as H,Z as I,ze as J,tt as K,sr as L,or as M,er as N,cn as O,ir as P,Ke as Q,Bt as R,ur as S,Ct as T,mn as U,Ln as V,Lt as W,qe as X,We as Y,Ue as Z,Rr as _,gi as a,hr as b,ni as c,Ur as d,Re as et,Br as f,Fr as g,Nr as h,bi as i,nr as j,Yt as k,ti as l,Ar as m,_i as n,si as o,Wr as p,et as q,vi as r,ai as s,yi as t,$r as u,br as v,lr as w,mr as x,fr as y,en as z};

package/dist/esm/sdk/{deviceLinkApproval-DAZTjrud.js → deviceLinkApproval-x3WkiYrd.js}

@@ -1,2 +1,2 @@
-import{n as e}from"./chunk-dVx5-UGu.js";import{o as t}from"./canonicalPrimitives-Jd3i_Ngz.js";import{G as n,W as r}from"./device-linking-BsUTtSF7.js";var i=e({approveDeviceLinkWithConsent:()=>d,cancelDeviceLinkApproval:()=>f,confirmDeviceLinkApproval:()=>u});const a=`Device linking was cancelled`;let o=null;function s(e){switch(e){case`sign`:return`Sign transactions`;case`export_keys`:return`Export signing keys`;case`link_devices`:return`Link other devices`;case`revoke_devices`:return`Remove devices`;default:throw Error(`Unsupported device permission`)}}var c=class{surface=null;state=`pending`;snapshot;constructor(e,t,r,i){this.requestId=e,this.target=t,this.appearance=r,this.measurement=i,Object.freeze(t.targetFactor),Object.freeze(t.requestedPermission),Object.freeze(t),this.snapshot=n(t)}cancel(){this.state=`cancelled`,this.surface?.close(!1)}assertCurrent(){if(o!==this||this.state===`cancelled`||this.target.expiresAtMs<=Date.now())throw this.cancel(),Error(a)}async confirm(e){if(this.assertCurrent(),this.state!==`pending`)throw Error(`Device approval was already requested`);this.state=`showing`;let n=setTimeout(this.cancel.bind(this),Math.max(0,this.target.expiresAtMs-Date.now()));try{let n=await t(this.snapshot),{mountConfirmUI:r}=await import(`./confirm-ui-BpqwuMSl.js`).then(e=>e.n);this.assertCurrent();let i=this.target.targetFactor.kind===`passkey_prf`?`Passkey`:`Email code: ${this.target.targetEmail}`;this.surface=await r({ctx:{surfaceMeasurementBinding:this.measurement},summary:{title:`Link a device?`,body:[`Wallet: ${String(e).slice(0,12)}…`,`Device request: ${n.slice(0,16)}`,`Sign-in method: ${i}`,``,`This device will be able to:`,...this.target.requestedPermission.permissions.map(l)].join(`
+import{n as e}from"./chunk-dVx5-UGu.js";import{o as t}from"./canonicalPrimitives-Jd3i_Ngz.js";import{G as n,W as r}from"./device-linking-DiCNt3iA.js";var i=e({approveDeviceLinkWithConsent:()=>d,cancelDeviceLinkApproval:()=>f,confirmDeviceLinkApproval:()=>u});const a=`Device linking was cancelled`;let o=null;function s(e){switch(e){case`sign`:return`Sign transactions`;case`export_keys`:return`Export signing keys`;case`link_devices`:return`Link other devices`;case`revoke_devices`:return`Remove devices`;default:throw Error(`Unsupported device permission`)}}var c=class{surface=null;state=`pending`;snapshot;constructor(e,t,r,i){this.requestId=e,this.target=t,this.appearance=r,this.measurement=i,Object.freeze(t.targetFactor),Object.freeze(t.requestedPermission),Object.freeze(t),this.snapshot=n(t)}cancel(){this.state=`cancelled`,this.surface?.close(!1)}assertCurrent(){if(o!==this||this.state===`cancelled`||this.target.expiresAtMs<=Date.now())throw this.cancel(),Error(a)}async confirm(e){if(this.assertCurrent(),this.state!==`pending`)throw Error(`Device approval was already requested`);this.state=`showing`;let n=setTimeout(this.cancel.bind(this),Math.max(0,this.target.expiresAtMs-Date.now()));try{let n=await t(this.snapshot),{mountConfirmUI:r}=await import(`./confirm-ui-em0vkd2m.js`).then(e=>e.n);this.assertCurrent();let i=this.target.targetFactor.kind===`passkey_prf`?`Passkey`:`Email code: ${this.target.targetEmail}`;this.surface=await r({ctx:{surfaceMeasurementBinding:this.measurement},summary:{title:`Link a device?`,body:[`Wallet: ${String(e).slice(0,12)}…`,`Device request: ${n.slice(0,16)}`,`Sign-in method: ${i}`,``,`This device will be able to:`,...this.target.requestedPermission.permissions.map(l)].join(`
 `)},securityContext:{rpId:window.location.hostname},appearance:this.appearance,uiMode:`modal`}),this.surface.element.dataset.seamsDeviceLinkApproval=n,this.surface.element.dataset.seamsDeviceLinkWallet=e,this.surface.update({confirmText:`Link device`,cancelText:`Cancel`}),this.assertCurrent();let o=await this.surface.takeDecision();if(this.assertCurrent(),o.kind!==`confirmed`)throw this.cancel(),Error(a);this.state=`approved`}finally{clearTimeout(n),this.surface?.close(!1),this.surface=null}}};function l(e){return`• ${s(e)}`}const u=async e=>{let t=o;if(!t||n(e.payload)!==t.snapshot)throw Error(`Device linking requires its exact Wallet-origin approval`);return await t.confirm(e.walletId),{assertCurrent:t.assertCurrent.bind(t)}};async function d(e,t,n){if(o)throw Error(`Another device-link request is active`);let i=e.readMeasurementBinding();if(i.kind!==`wallet_iframe`)throw Error(`Device approval requires the Wallet origin`);let a=r(t),s=new c(i.requestId,a,e.readAppearance(),i);o=s;try{return await e.execute(a,n)}finally{s.cancel(),o===s&&(o=null)}}function f(e){(e.kind===`all`||o?.requestId===e.requestId)&&o?.cancel()}export{i,f as n,u as r,d as t};

package/dist/esm/sdk/{display-BYzolrBs.js → display-D0EPmU4w.js}

@@ -1 +1 @@
-import{n as e}from"./normalization-dgJxtZKK.js";import{_ as t,g as n,h as r,m as i}from"./signingFlow-C7fwkxPx.js";function a(e){try{return JSON.stringify(e,(e,t)=>typeof t==`bigint`?t.toString():t,2)}catch{return String(e)}}function o(e,t,n){let r=String(t??``).trim();if(r)return{label:e,value:r,...typeof n==`string`&&n.trim()?{copyValue:n}:{}}}function s(t){let n=e(t.input);if(n!==`0x`&&!(!Array.isArray(t.abi)||t.abi.length===0))return{dataHex:n,abi:t.abi}}function c(a){let{rootId:c,call:l,tx:u}=a,d=String(l.to||``).trim(),f=e(String(l.input||`0x`));if(f===`0x`)return;let p=t(f),m=n(p,d)||`contract function`,h=i(u.gasLimit),g=o(`Data`,r(f),f);g&&(g.renderAs=`file-content`,g.hideLabel=!0,g.hideChevron=!0);let _=[g,o(`Value (wei)`,l.value.toString()),o(`Valid Before`,u.validBefore==null?void 0:u.validBefore.toString()),o(`Valid After`,u.validAfter==null?void 0:u.validAfter.toString())].filter(Boolean),v={id:`${c}.call`,kind:`generic.contractCall`,label:`Calling ${m} using ${h} gas`,to:d,value:l.value.toString(),selector:p,fields:_},y=s({input:f,abi:l.abi});return y&&(v.abiDecodeHint=y),v}function l(n){let{call:r,callIndex:i,callCount:a,tx:o}=n,s=`tempo.tx.${i}`,l=String(r.to||``).trim(),u=a>1?`Transaction ${i+1} to contract`:`Transaction to contract`,d=c({rootId:s,call:r,tx:o});return{id:s,kind:`tempo.eip2718`,label:u,txTypeHex:`0x76`,txTypeName:`TempoTransaction`,to:l,selector:t(e(String(r.input||`0x`))),...d?{children:[d]}:{}}}function u(e){if(e.kind!==`tempoTransaction`)return[{id:`tempo.raw`,kind:`raw.fallback`,label:`Unsupported Tempo Payload`,raw:a(e)}];let t=Array.isArray(e.tx.calls)?e.tx.calls:[];return t.length?t.map((n,r)=>l({call:n,callIndex:r,callCount:t.length,tx:e.tx})):[{id:`tempo.raw`,kind:`raw.fallback`,label:`Tempo Payload Missing Calls`,raw:a(e)}]}function d(e){let t=u(e.request),n=BigInt(0);if(e.request.kind===`tempoTransaction`)for(let t of e.request.tx.calls||[])n+=BigInt(t.value||0);return{chain:`tempo`,chainId:e.request.kind===`tempoTransaction`?e.request.tx.chainId:void 0,intentDigest:e.intentDigest,signerAccount:e.signerAccount,title:e.title||`Tempo Transaction`,subtitle:e.subtitle,operations:t,...n>0n?{totals:{nativeValue:n.toString(),nativeSymbol:`wei`}}:{}}}export{d as t};
+import{n as e}from"./normalization-B3i1-rPQ.js";import{_ as t,g as n,h as r,m as i}from"./signingFlow-BcetvUeS.js";function a(e){try{return JSON.stringify(e,(e,t)=>typeof t==`bigint`?t.toString():t,2)}catch{return String(e)}}function o(e,t,n){let r=String(t??``).trim();if(r)return{label:e,value:r,...typeof n==`string`&&n.trim()?{copyValue:n}:{}}}function s(t){let n=e(t.input);if(n!==`0x`&&!(!Array.isArray(t.abi)||t.abi.length===0))return{dataHex:n,abi:t.abi}}function c(a){let{rootId:c,call:l,tx:u}=a,d=String(l.to||``).trim(),f=e(String(l.input||`0x`));if(f===`0x`)return;let p=t(f),m=n(p,d)||`contract function`,h=i(u.gasLimit),g=o(`Data`,r(f),f);g&&(g.renderAs=`file-content`,g.hideLabel=!0,g.hideChevron=!0);let _=[g,o(`Value (wei)`,l.value.toString()),o(`Valid Before`,u.validBefore==null?void 0:u.validBefore.toString()),o(`Valid After`,u.validAfter==null?void 0:u.validAfter.toString())].filter(Boolean),v={id:`${c}.call`,kind:`generic.contractCall`,label:`Calling ${m} using ${h} gas`,to:d,value:l.value.toString(),selector:p,fields:_},y=s({input:f,abi:l.abi});return y&&(v.abiDecodeHint=y),v}function l(n){let{call:r,callIndex:i,callCount:a,tx:o}=n,s=`tempo.tx.${i}`,l=String(r.to||``).trim(),u=a>1?`Transaction ${i+1} to contract`:`Transaction to contract`,d=c({rootId:s,call:r,tx:o});return{id:s,kind:`tempo.eip2718`,label:u,txTypeHex:`0x76`,txTypeName:`TempoTransaction`,to:l,selector:t(e(String(r.input||`0x`))),...d?{children:[d]}:{}}}function u(e){if(e.kind!==`tempoTransaction`)return[{id:`tempo.raw`,kind:`raw.fallback`,label:`Unsupported Tempo Payload`,raw:a(e)}];let t=Array.isArray(e.tx.calls)?e.tx.calls:[];return t.length?t.map((n,r)=>l({call:n,callIndex:r,callCount:t.length,tx:e.tx})):[{id:`tempo.raw`,kind:`raw.fallback`,label:`Tempo Payload Missing Calls`,raw:a(e)}]}function d(e){let t=u(e.request),n=BigInt(0);if(e.request.kind===`tempoTransaction`)for(let t of e.request.tx.calls||[])n+=BigInt(t.value||0);return{chain:`tempo`,chainId:e.request.kind===`tempoTransaction`?e.request.tx.chainId:void 0,intentDigest:e.intentDigest,signerAccount:e.signerAccount,title:e.title||`Tempo Transaction`,subtitle:e.subtitle,operations:t,...n>0n?{totals:{nativeValue:n.toString(),nativeSymbol:`wei`}}:{}}}export{d as t};

package/dist/{public/sdk/ecdsaCapabilityManifest-CXVq8Qzb.js → esm/sdk/ecdsaCapabilityManifest-DAJEVjlP.js}

@@ -1 +1 @@
-import{g as e,i as t}from"./domainIds-t1lp25yU.js";import{i as n,r}from"./base64-BmKR3UqU.js";import{X as i,Y as a}from"./activeWalletSession-BJ4B-nJo.js";import{t as o}from"./canonicalPrimitives-Jd3i_Ngz.js";import{a as s,c,o as l,s as ee}from"./ecdsaChainTarget-Lh24LLyA.js";import{A as te,Dt as ne,Ft as u,H as d,K as f,Nt as p,Pt as m,S as h,V as g,Y as _,ft as re,vt as ie}from"./digestEncoding-n8Kr2kow.js";import{T as v,i as y,n as ae,r as oe,t as se}from"./emailOtpEcdsaDerivationIdentity-0DIuRNRi.js";function b(e,t){let n=String(e??``).trim();if(!n)throw Error(`${t} must be a non-empty string`);return n}function ce(e){return b(e,`signing-session seal key version`)}function le(e){return b(e,`ECDSA client verifying share`)}function ue(e){return b(e,`ECDSA relayer key id`)}function de(e){return b(e,`ECDSA key handle`)}function fe(e){return e}function pe(e){if(typeof e!=`string`)throw Error(`ECDSA client verifying public key must be a string`);let t=e.trim();if(!/^[A-Za-z0-9_-]+$/.test(t))throw Error(`ECDSA client verifying public key must be unpadded base64url`);let i;try{i=r(t)}catch{throw Error(`ECDSA client verifying public key must be valid base64url`)}if(i.length!==33||n(i)!==t)throw Error(`ECDSA client verifying public key must be canonical base64url for 33 bytes`);if(i[0]!==2&&i[0]!==3)throw Error(`ECDSA client verifying public key must be compressed secp256k1`);return t}function x(e){return ne(e)}function S(e){return b(e,`ECDSA role-local material handle`)}function C(e){return b(e,`ECDSA role-local binding digest`)}function w(e){return b(e,`ECDSA role-local durable material reference`)}function T(t){if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`ECDSA role-local persisted material reference must be an object`);let n=t,r=Object.keys(n).sort(),i=[`bindingDigest`,`durableMaterialRef`,`kind`,`materialActivation`];if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`ECDSA role-local persisted material reference has unexpected fields`);if(n.kind!==`ecdsa_role_local_persisted_material_ref_v1`)throw Error(`ECDSA role-local persisted material reference kind is invalid`);let a=e(n.materialActivation);if(!a.ok)throw Error(a.error.message);return{kind:`ecdsa_role_local_persisted_material_ref_v1`,durableMaterialRef:w(n.durableMaterialRef),bindingDigest:C(n.bindingDigest),materialActivation:a.value}}function E(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`ECDSA role-local worker handle must be an object`);let t=e,n=Object.keys(t).sort(),r=[`bindingDigest`,`durableMaterialRef`,`kind`,`materialHandle`];if(n.length!==r.length||n.some((e,t)=>e!==r[t]))throw Error(`ECDSA role-local worker handle has unexpected fields`);if(t.kind!==`ecdsa_role_local_worker_handle_v1`)throw Error(`ECDSA role-local worker handle kind is invalid`);return{kind:`ecdsa_role_local_worker_handle_v1`,materialHandle:S(t.materialHandle),bindingDigest:C(t.bindingDigest),durableMaterialRef:w(t.durableMaterialRef)}}function D(e){throw Error(`Unhandled ECDSA role-local branch: ${String(e)}`)}function O(e,t){if(typeof e!=`string`||!e.trim())throw Error(`[platform][ecdsa-role-local] ${t} is required`);return e.trim()}function k(e,t,n){let i=O(e,t);if(r(i).length!==n)throw Error(`[platform][ecdsa-role-local] ${t} must decode to ${n} bytes`);return i}function A(e,t){let n=O(e,t),i=r(n);if(i.length!==33)throw Error(`[platform][ecdsa-role-local] ${t} must decode to 33 bytes`);if(i[0]!==2&&i[0]!==3)throw Error(`[platform][ecdsa-role-local] ${t} must be a compressed SEC1 key`);return n}function j(e){return A(e,`derivationClientSharePublicKey33B64u`)}function M(e){return A(e,`relayerPublicKey33B64u`)}function N(e){return A(e,`groupPublicKey33B64u`)}function P(e){let t=O(e,`ethereumAddress`).toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(t))throw Error(`[platform][ecdsa-role-local] ethereumAddress must be an EVM address`);return t}function F(e){if(!Array.isArray(e)||e.length!==2||e[0]!==1||e[1]!==2)throw Error(`[platform][ecdsa-role-local] participantIds must be [1, 2]`);return[1,2]}function I(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[platform][ecdsa-role-local] stateBlob must be an object`);if(Object.keys(e).sort().join(`,`)!==`curve,encoding,kind,producer,stateBlobB64u`)throw Error(`[platform][ecdsa-role-local] stateBlob envelope is invalid`);let t=O(Reflect.get(e,`kind`),`stateBlob.kind`),n=O(Reflect.get(e,`curve`),`stateBlob.curve`),i=O(Reflect.get(e,`encoding`),`stateBlob.encoding`),a=O(Reflect.get(e,`producer`),`stateBlob.producer`),o=O(Reflect.get(e,`stateBlobB64u`),`stateBlob.stateBlobB64u`);if(t!==`ecdsa_role_local_state_blob_v1`||n!==`secp256k1`||i!==`base64url`||a!==`signer_core`)throw Error(`[platform][ecdsa-role-local] stateBlob envelope is invalid`);try{r(o)}catch(e){throw Error(`[platform][ecdsa-role-local] stateBlob payload is not base64url`,{cause:e})}return{kind:`ecdsa_role_local_state_blob_v1`,curve:`secp256k1`,encoding:`base64url`,producer:`signer_core`,stateBlobB64u:o}}function L(e,t=`credentialIdB64u`){return O(e,t)}function R(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[platform][ecdsa-role-local] authMethod must be an object`);switch(O(Reflect.get(e,`kind`),`authMethod.kind`)){case`passkey`:if(Object.keys(e).sort().join(`,`)!==`credentialIdB64u,kind,rpId`)throw Error(`[platform][ecdsa-role-local] passkey authMethod fields are invalid`);return{kind:`passkey`,credentialIdB64u:L(Reflect.get(e,`credentialIdB64u`)),rpId:v(Reflect.get(e,`rpId`))};case`email_otp`:if(Object.keys(e).sort().join(`,`)!==`authSubjectId,kind`)throw Error(`[platform][ecdsa-role-local] email OTP authMethod fields are invalid`);return{kind:`email_otp`,authSubjectId:y(Reflect.get(e,`authSubjectId`))};default:throw Error(`[platform][ecdsa-role-local] authMethod kind is invalid`)}}function z(e){return{kind:`passkey`,credentialIdB64u:L(e.credentialIdB64u),rpId:v(e.rpId)}}function B(e){return{kind:`email_otp`,authSubjectId:y(e.authSubjectId)}}function me(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`?String(e.rpId)===String(t.rpId)&&String(e.credentialIdB64u)===String(t.credentialIdB64u):!1;case`email_otp`:return t.kind===`email_otp`?String(e.authSubjectId)===String(t.authSubjectId):!1;default:return D(e)}}function he(e){switch(e.authMethod.kind){case`passkey`:return{kind:`ecdsa_role_local_ready_passkey_v1`,stateBlob:e.stateBlob,publicFacts:e.publicFacts,authMethod:e.authMethod};case`email_otp`:return{kind:`ecdsa_role_local_ready_email_otp_v1`,stateBlob:e.stateBlob,publicFacts:e.publicFacts,authMethod:e.authMethod};default:return D(e.authMethod)}}function ge(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[platform][ecdsa-role-local] chainTarget must be an object`);switch(O(Reflect.get(e,`kind`),`chainTarget.kind`).toLowerCase()){case`evm`:if(Object.keys(e).sort().join(`,`)!==`chainId,kind,namespace,networkSlug`)throw Error(`[platform][ecdsa-role-local] EVM chainTarget fields are invalid`);return s({kind:Reflect.get(e,`kind`),namespace:Reflect.get(e,`namespace`),chainId:Reflect.get(e,`chainId`),networkSlug:Reflect.get(e,`networkSlug`)});case`tempo`:if(Object.keys(e).sort().join(`,`)!==`chainId,kind,networkSlug`)throw Error(`[platform][ecdsa-role-local] Tempo chainTarget fields are invalid`);return s({kind:Reflect.get(e,`kind`),chainId:Reflect.get(e,`chainId`),networkSlug:Reflect.get(e,`networkSlug`)});default:throw Error(`[platform][ecdsa-role-local] chainTarget kind is invalid`)}}function V(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[platform][ecdsa-role-local] publicFacts must be an object`);if(Object.keys(e).sort().join(`,`)!==`applicationBindingDigestB64u,chainTarget,clientParticipantId,contextBinding32B64u,derivationClientSharePublicKey33B64u,ecdsaThresholdKeyId,ethereumAddress,groupPublicKey33B64u,keyHandle,participantIds,publicCapability,relayerParticipantId,relayerPublicKey33B64u,signingRootId,signingRootVersion,walletId`)throw Error(`[platform][ecdsa-role-local] publicFacts fields are invalid`);if(Reflect.get(e,`clientParticipantId`)!==1)throw Error(`[platform][ecdsa-role-local] clientParticipantId must be 1`);if(Reflect.get(e,`relayerParticipantId`)!==2)throw Error(`[platform][ecdsa-role-local] relayerParticipantId must be 2`);let t=j(Reflect.get(e,`derivationClientSharePublicKey33B64u`)),n=M(Reflect.get(e,`relayerPublicKey33B64u`));if(String(t)===String(n))throw Error(`[platform][ecdsa-role-local] relayerPublicKey33B64u must differ from derivationClientSharePublicKey33B64u`);return{walletId:c(Reflect.get(e,`walletId`)),chainTarget:ge(Reflect.get(e,`chainTarget`)),keyHandle:O(Reflect.get(e,`keyHandle`),`keyHandle`),ecdsaThresholdKeyId:oe(Reflect.get(e,`ecdsaThresholdKeyId`)),signingRootId:se(Reflect.get(e,`signingRootId`)),signingRootVersion:ae(Reflect.get(e,`signingRootVersion`)),applicationBindingDigestB64u:k(Reflect.get(e,`applicationBindingDigestB64u`),`applicationBindingDigestB64u`,32),clientParticipantId:1,relayerParticipantId:2,participantIds:F(Reflect.get(e,`participantIds`)),contextBinding32B64u:k(Reflect.get(e,`contextBinding32B64u`),`contextBinding32B64u`,32),derivationClientSharePublicKey33B64u:t,relayerPublicKey33B64u:n,groupPublicKey33B64u:N(Reflect.get(e,`groupPublicKey33B64u`)),ethereumAddress:P(Reflect.get(e,`ethereumAddress`)),publicCapability:h(Reflect.get(e,`publicCapability`))}}function H(e){return V(e)}function _e(e){let t=e.publicFacts;return H({walletId:t.walletId,chainTarget:e.chainTarget,keyHandle:t.keyHandle,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,applicationBindingDigestB64u:t.applicationBindingDigestB64u,clientParticipantId:t.clientParticipantId,relayerParticipantId:t.relayerParticipantId,participantIds:t.participantIds,contextBinding32B64u:t.contextBinding32B64u,derivationClientSharePublicKey33B64u:t.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:t.relayerPublicKey33B64u,groupPublicKey33B64u:t.groupPublicKey33B64u,ethereumAddress:t.ethereumAddress,publicCapability:t.publicCapability})}function U(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[platform][ecdsa-role-local] ready record must be an object`);if(Object.keys(e).sort().join(`,`)!==`authMethod,kind,publicFacts,stateBlob`)throw Error(`[platform][ecdsa-role-local] ready record fields are invalid`);let t=O(Reflect.get(e,`kind`),`readyRecord.kind`);if(t!==`ecdsa_role_local_ready_passkey_v1`&&t!==`ecdsa_role_local_ready_email_otp_v1`)throw Error(`[platform][ecdsa-role-local] ready record kind is invalid`);let n=V(Reflect.get(e,`publicFacts`)),r=he({stateBlob:I(Reflect.get(e,`stateBlob`)),publicFacts:n,authMethod:R(Reflect.get(e,`authMethod`))});if(t===`ecdsa_role_local_ready_passkey_v1`&&r.kind!==t||t===`ecdsa_role_local_ready_email_otp_v1`&&r.kind!==t)throw Error(`[platform][ecdsa-role-local] ready record authMethod branch mismatch`);return r}function ve(e){switch(e.kind){case`passkey`:return{kind:`passkey`,credentialIdB64u:e.credentialIdB64u,rpId:e.rpId};case`email_otp`:return{kind:`email_otp`,authSubjectId:e.authSubjectId};default:return D(e)}}function ye(e){return{walletId:e.walletId,chainTarget:e.chainTarget,keyHandle:e.keyHandle,ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,applicationBindingDigestB64u:e.applicationBindingDigestB64u,clientParticipantId:1,relayerParticipantId:2,participantIds:[1,2],contextBinding32B64u:e.contextBinding32B64u,derivationClientSharePublicKey33B64u:e.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:e.relayerPublicKey33B64u,groupPublicKey33B64u:e.groupPublicKey33B64u,ethereumAddress:e.ethereumAddress,publicCapability:e.publicCapability}}function be(e){let t=U(e);return{kind:t.kind,stateBlob:{kind:t.stateBlob.kind,curve:t.stateBlob.curve,encoding:t.stateBlob.encoding,producer:t.stateBlob.producer,stateBlobB64u:t.stateBlob.stateBlobB64u},publicFacts:ye(t.publicFacts),authMethod:ve(t.authMethod)}}function W(e){return encodeURIComponent(O(e,`storage key part`))}function xe(e){return[`ecdsa_role_local_ready_v1`,W(e.walletId),W(l(e.chainTarget)),W(e.keyHandle),W(e.ecdsaThresholdKeyId),W(e.signingRootId),W(e.signingRootVersion),W(e.participantIds.join(`,`)),W(Ce(e.authMethod))].join(`:`)}function Se(e){let t=U(e),n=t.publicFacts;return{walletId:n.walletId,chainTarget:n.chainTarget,keyHandle:n.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,participantIds:n.participantIds,authMethod:t.authMethod}}function Ce(e){switch(e.kind){case`passkey`:return[`passkey`,e.rpId,e.credentialIdB64u].join(`:`);case`email_otp`:return[`email_otp`,e.authSubjectId].join(`:`);default:return D(e)}}function we(e){let t=e.record.publicFacts,n=e.input;return String(t.walletId)===String(n.walletId)&&ee(t.chainTarget,n.chainTarget)&&String(t.keyHandle)===String(n.keyHandle)&&String(t.ecdsaThresholdKeyId)===String(n.ecdsaThresholdKeyId)&&String(t.signingRootId)===String(n.signingRootId)&&String(t.signingRootVersion)===String(n.signingRootVersion)&&t.participantIds[0]===n.participantIds[0]&&t.participantIds[1]===n.participantIds[1]&&me(e.record.authMethod,n.authMethod)}var G=class{retainProof(){return!0}constructor(){this.retainProof()}},Te=class extends G{kind=`evm_family`;targetMemberships;constructor(e){super(),this.targetMemberships=e}},K=class extends G{manifestId;manifestRevision;constructor(e){super(),this.manifestId=e.manifestId,this.manifestRevision=e.manifestRevision}},Ee=class extends G{kind=`no_current_manifest`},De=class extends G{kind=`exact_manifest`;manifestId;manifestRevision;constructor(e){super(),this.manifestId=e.manifestId,this.manifestRevision=e.manifestRevision}},Oe=class extends G{kind=`no_current_generation`},ke=class extends G{kind=`exact_generation`;serverGeneration;constructor(e){super(),this.serverGeneration=e}},Ae=class extends G{kind=`ecdsa_role_local_material_binding`;keyHandle;ecdsaThresholdKeyId;clientVerifyingPublicKey33B64u;participantIds;relayerKeyId;constructor(e){super(),this.keyHandle=e.keyHandle,this.ecdsaThresholdKeyId=e.ecdsaThresholdKeyId,this.clientVerifyingPublicKey33B64u=e.clientVerifyingPublicKey33B64u,this.participantIds=e.participantIds,this.relayerKeyId=e.relayerKeyId}},je=class extends G{kind=`prepared_evm_family_signer`;capability;signerId;walletId;authority;scope;materialOwner;signingRootId;signingRootVersion;constructor(e){super(),this.capability=e.capability,this.signerId=e.signerId,this.walletId=e.authority.walletId,this.authority=e.authority,this.scope=e.scope,this.materialOwner=e.materialOwner,this.signingRootId=e.signingRootId,this.signingRootVersion=e.signingRootVersion}},Me=class extends G{kind=`registered_evm_family_signer`;capability;signerId;walletId;authority;scope;materialOwner;signingRootId;signingRootVersion;registeredPublicFacts;constructor(e){super(),this.capability=e.preparedSigner.capability,this.signerId=e.preparedSigner.signerId,this.walletId=e.preparedSigner.walletId,this.authority=e.preparedSigner.authority,this.scope=e.preparedSigner.scope,this.materialOwner=e.preparedSigner.materialOwner,this.signingRootId=e.preparedSigner.signingRootId,this.signingRootVersion=e.preparedSigner.signingRootVersion,this.registeredPublicFacts=e.registeredPublicFacts}},Ne=class extends G{kind=`encrypted_ecdsa_pending_candidate`;sealingKeyId;iv12B64u;ciphertextB64u;ciphertextDigest;constructor(e){super(),this.sealingKeyId=e.sealingKeyId,this.iv12B64u=e.iv12B64u,this.ciphertextB64u=e.ciphertextB64u,this.ciphertextDigest=e.ciphertextDigest}},Pe=class extends G{kind=`ecdsa_activation_binding`;targetManifest;signer;roleLocalBinding;bindingDigest;durableMaterialRef;constructor(e){super(),this.targetManifest=e.targetManifest,this.signer=e.signer,this.roleLocalBinding=e.roleLocalBinding,this.bindingDigest=e.bindingDigest,this.durableMaterialRef=e.durableMaterialRef}},Fe=class extends G{kind=`prepared_ecdsa_activation_candidate`;activationBinding;encryptedPending;constructor(e){super(),this.activationBinding=e.activationBinding,this.encryptedPending=e.encryptedPending}},Ie=class extends G{kind=`ecdsa_server_activation_command`;correlationId;expectedGeneration;requestDigest;canonicalRequest;constructor(e){super(),this.correlationId=e.correlationId,this.expectedGeneration=e.expectedGeneration,this.requestDigest=e.requestDigest,this.canonicalRequest=e.canonicalRequest}},Le=class extends G{kind=`ecdsa_server_activation_receipt`;lifecycleId;activationDigest;activatedAt;protocolReceipt;constructor(e){super(),this.lifecycleId=e.lifecycleId,this.activationDigest=e.activationDigest,this.activatedAt=e.activatedAt,this.protocolReceipt=e.protocolReceipt}},Re=class extends G{kind=`ecdsa_server_activation_commit`;correlationId;activationRequestDigest;serverGeneration;serverActivationReceipt;constructor(e){super(),this.correlationId=e.correlationId,this.activationRequestDigest=e.activationRequestDigest,this.serverGeneration=e.serverGeneration,this.serverActivationReceipt=e.serverActivationReceipt}},ze=class extends G{kind=`activation_prepared`;journalId;expectedManifest;activationCommand;candidate;createdAt;constructor(e){super(),this.journalId=e.journalId,this.expectedManifest=e.expectedManifest,this.activationCommand=e.activationCommand,this.candidate=e.candidate,this.createdAt=e.createdAt}},Be=class extends G{kind=`server_activation_committed`;journalId;expectedManifest;activationCommand;candidate;createdAt;serverActivation;constructor(e){super(),this.journalId=e.journalId,this.expectedManifest=e.expectedManifest,this.activationCommand=e.activationCommand,this.candidate=e.candidate,this.createdAt=e.createdAt,this.serverActivation=e.serverActivation}},Ve=class extends G{kind=`durable_ecdsa_material`;materialActivation;routerAbEcdsaDerivationNormalSigning;roleLocalPublicFacts;roleLocalBinding;durableMaterialRef;bindingDigest;lifecycleId;ciphertextDigest;activationDigest;activatedAt;runtimePolicyScope;constructor(e){super(),this.materialActivation=e.materialActivation,this.routerAbEcdsaDerivationNormalSigning=e.routerAbEcdsaDerivationNormalSigning,this.roleLocalPublicFacts=e.roleLocalPublicFacts,this.roleLocalBinding=e.roleLocalBinding,this.durableMaterialRef=e.durableMaterialRef,this.bindingDigest=e.bindingDigest,this.lifecycleId=e.lifecycleId,this.ciphertextDigest=e.ciphertextDigest,this.activationDigest=e.activationDigest,this.activatedAt=e.activatedAt,this.runtimePolicyScope=e.runtimePolicyScope}},He=class extends G{kind=`encrypted_ecdsa_ready_material`;binding;sealingKeyId;iv12B64u;ciphertextB64u;constructor(e){super(),this.binding=e.binding,this.sealingKeyId=e.sealingKeyId,this.iv12B64u=e.iv12B64u,this.ciphertextB64u=e.ciphertextB64u}},Ue=class extends G{kind=`active_ecdsa_capability_manifest`;identity;signer;activation;durableMaterial;committedAt;constructor(e){super(),this.identity=e.identity,this.signer=e.signer,this.activation=e.activation,this.durableMaterial=e.durableMaterial,this.committedAt=e.committedAt}},We=class extends G{kind=`replaced_ecdsa_capability_manifest`;identity;signer;retirement;constructor(e){super(),this.identity=e.identity,this.signer=e.signer,this.retirement=e.retirement}};function Ge(e){if(!e.ok)throw Error(e.error.message);return e.value}function Ke(e){return lt(e.targetMemberships),new Te([...e.targetMemberships])}function qe(e){return new K(e)}function Je(){return new Ee}function Ye(e){return new De(e)}function Xe(){return new Oe}function Ze(e){return new ke(e)}function Qe(e){return ut(e.participantIds),new Ae({keyHandle:e.keyHandle,ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,clientVerifyingPublicKey33B64u:e.clientVerifyingPublicKey33B64u,participantIds:[...e.participantIds],relayerKeyId:e.relayerKeyId})}function $e(e){return new je(e)}function et(e){return new Ne(e)}function tt(e){return new Pe(e)}function nt(e){return new Fe(e)}function rt(e){dt(e.expectedManifest,e.candidate.activationBinding.targetManifest),ft(e.expectedManifest,e.expectedGeneration);let t=new Ie({correlationId:e.journalId,expectedGeneration:e.expectedGeneration,requestDigest:e.requestDigest,canonicalRequest:e.canonicalRequest});return new ze({journalId:e.journalId,expectedManifest:e.expectedManifest,activationCommand:t,candidate:e.candidate,createdAt:e.createdAt})}function q(e){let t=te(e.serverCommit.protocolReceipt);mt(t,e.serverCommit),Y(t,e.activationBinding);let n=new Le({lifecycleId:ht(t),activationDigest:gt(t),activatedAt:o(t.ecdsa_activation.activated_at_ms),protocolReceipt:t});return new Re({correlationId:e.serverCommit.correlationId,activationRequestDigest:e.serverCommit.activationRequestDigest,serverGeneration:e.serverCommit.serverGeneration,serverActivationReceipt:n})}function it(e){pt(e.serverCommit,e.preparedJournal);let t=q({activationBinding:e.preparedJournal.candidate.activationBinding,serverCommit:e.serverCommit});return new Be({journalId:e.preparedJournal.journalId,expectedManifest:e.preparedJournal.expectedManifest,activationCommand:e.preparedJournal.activationCommand,candidate:e.preparedJournal.candidate,createdAt:e.preparedJournal.createdAt,serverActivation:t})}function at(e){vt(e.serverActivation,e.activationBinding);let t=e.roleLocalPublicFacts,n=e.activationBinding,r=i(e.runtimePolicyScope);if(t.walletId!==n.signer.walletId||t.keyHandle!==n.roleLocalBinding.keyHandle||t.ecdsaThresholdKeyId!==n.roleLocalBinding.ecdsaThresholdKeyId||t.signingRootId!==n.signer.signingRootId||t.signingRootVersion!==n.signer.signingRootVersion||a(r)!==n.signer.signingRootId||r.signingRootVersion!==n.signer.signingRootVersion||t.contextBinding32B64u!==n.bindingDigest||!Z(t.participantIds,n.roleLocalBinding.participantIds)||!n.signer.scope.targetMemberships.some(e=>J(e)===J(t.chainTarget)))throw Error(`ECDSA role-local public facts do not match their activation`);let o=e.serverActivation.serverActivationReceipt;return Q({normalSigning:e.routerAbEcdsaDerivationNormalSigning,activationBinding:n,roleLocalPublicFacts:t,receipt:o.protocolReceipt}),new Ve({materialActivation:X(o.protocolReceipt),routerAbEcdsaDerivationNormalSigning:e.routerAbEcdsaDerivationNormalSigning,roleLocalPublicFacts:e.roleLocalPublicFacts,roleLocalBinding:e.activationBinding.roleLocalBinding,durableMaterialRef:e.activationBinding.durableMaterialRef,bindingDigest:e.activationBinding.bindingDigest,lifecycleId:o.lifecycleId,ciphertextDigest:e.ciphertextDigest,activationDigest:o.activationDigest,activatedAt:o.activatedAt,runtimePolicyScope:r})}function ot(e){return new He({binding:e.binding,sealingKeyId:e.sealingKeyId,iv12B64u:e.iv12B64u,ciphertextB64u:e.ciphertextB64u})}function st(e){_t(e.registeredPublicFacts,e.activationBinding.roleLocalBinding,e.serverActivation),yt(e.durableMaterial,e.activationBinding,e.serverActivation);let t=new Me({preparedSigner:e.activationBinding.signer,registeredPublicFacts:e.registeredPublicFacts}),n={kind:`active_ecdsa_material_activation`,materialActivation:e.durableMaterial.materialActivation,serverActivation:e.serverActivation,retention:`retained`};return new Ue({identity:e.activationBinding.targetManifest,signer:t,activation:n,durableMaterial:e.durableMaterial,committedAt:e.committedAt})}function ct(e){return xt(e.activeManifest,e.replacementManifest),new We({identity:e.activeManifest.identity,signer:e.activeManifest.signer,retirement:{kind:`replaced`,replacementManifest:e.replacementManifest.identity,replacementActivation:e.replacementManifest.activation.serverActivation}})}function lt(e){let t=e.map(J);if(new Set(t).size!==t.length)throw Error(`ECDSA capability target memberships must be unique`)}function J(e){switch(e.kind){case`evm`:return`evm:${e.namespace}:${e.chainId}:${e.networkSlug}`;case`tempo`:return`tempo:${e.chainId}:${e.networkSlug}`;default:return $(e)}}function ut(e){let t=e.map(Number);if(t.some(e=>!Number.isSafeInteger(e)||e<1)||new Set(t).size!==t.length)throw Error(`ECDSA participant ids must be unique positive integers`)}function dt(e,t){switch(e.kind){case`no_current_manifest`:if(Number(t.manifestRevision)!==1)throw Error(`Initial ECDSA manifest revision must be 1`);return;case`exact_manifest`:if(t.manifestId===e.manifestId||Number(t.manifestRevision)!==Number(e.manifestRevision)+1)throw Error(`Replacement ECDSA manifest must use a fresh id and next revision`);return;default:return $(e)}}function ft(e,t){switch(e.kind){case`no_current_manifest`:if(t.kind!==`no_current_generation`)throw Error(`Initial ECDSA activation cannot expect a server generation`);return;case`exact_manifest`:if(t.kind!==`exact_generation`)throw Error(`Replacement ECDSA activation requires an exact server generation`);return;default:return $(e)}}function pt(e,t){let n=JSON.parse(t.activationCommand.canonicalRequest).operation===`wallet_registration_activate_v2`;if(e.correlationId!==t.activationCommand.correlationId||!n&&e.activationRequestDigest!==t.activationCommand.requestDigest)throw Error(`ECDSA server activation commit does not match the prepared command`)}function Y(e,t){let n=e.ecdsa_activation.public_identity,r=e.ecdsa_activation.material_activation;if(X(e),n.context_binding_b64u!==String(t.bindingDigest)||n.derivation_client_share_public_key33_b64u!==String(t.roleLocalBinding.clientVerifyingPublicKey33B64u)||r.material_owner!==String(t.signer.materialOwner)||r.key_binding!==String(t.bindingDigest)||r.lifecycle_binding!==e.lifecycle_id||r.signing_worker!==e.ecdsa_activation.signing_worker.server_id)throw Error(`ECDSA activation receipt does not match the prepared material binding`)}function mt(e,t){let r=n(Uint8Array.from(e.activation_request_digest.bytes));if(e.activation_correlation_id!==t.correlationId||r!==t.activationRequestDigest||e.server_generation!==t.serverGeneration)throw Error(`ECDSA activation receipt does not match the server activation commit`)}function ht(e){return ie(e.lifecycle_id)}function gt(e){return re(e.ecdsa_activation.activation_digest_b64u)}function X(e){return p(e.ecdsa_activation.material_activation)}function _t(e,t,n){let r=n.serverActivationReceipt.protocolReceipt.ecdsa_activation.public_identity;if(String(e.keyHandle)!==String(t.keyHandle)||String(e.publicKeyB64u)!==r.threshold_public_key33_b64u||String(t.clientVerifyingPublicKey33B64u)!==r.derivation_client_share_public_key33_b64u||!Z(e.participantIds,t.participantIds))throw Error(`Registered ECDSA public facts do not match role-local material`)}function Z(e,t){return e.length===t.length?e.every((e,n)=>Number(e)===Number(t[n])):!1}function vt(e,t){Y(e.serverActivationReceipt.protocolReceipt,t)}function yt(e,n,r){let i=r.serverActivationReceipt,a=X(i.protocolReceipt);if(!t(e.materialActivation,a)||e.roleLocalBinding!==n.roleLocalBinding||e.durableMaterialRef!==n.durableMaterialRef||e.bindingDigest!==n.bindingDigest||e.lifecycleId!==i.lifecycleId||e.activationDigest!==i.activationDigest||e.activatedAt!==i.activatedAt)throw Error(`Durable ECDSA material does not match its activation`);Q({normalSigning:e.routerAbEcdsaDerivationNormalSigning,activationBinding:n,roleLocalPublicFacts:e.roleLocalPublicFacts,receipt:i.protocolReceipt})}function bt(e,t){return e.kind===t.kind&&e.context.application_binding_digest_b64u===t.context.application_binding_digest_b64u&&f(e.public_identity,t.public_identity)&&u(e.material_activation,t.material_activation)&&d(e.signer_set,t.signer_set)&&g(e.deriver_recipient_keys,t.deriver_recipient_keys)&&e.router_id===t.router_id&&e.client_id===t.client_id&&e.activation_epoch===t.activation_epoch&&e.registration_request_digest_b64u===t.registration_request_digest_b64u&&e.proof_transcript_digest_b64u===t.proof_transcript_digest_b64u}function Q(e){let t=e.normalSigning.scope,n=e.roleLocalPublicFacts,r=X(e.receipt),i=m({kind:r.kind,activationId:r.activationId,capability:r.capability,materialOwner:r.materialOwner,keyBinding:r.keyBinding,lifecycleBinding:r.lifecycleBinding,signingWorker:r.signingWorker});if(t.wallet_id!==String(e.activationBinding.signer.walletId)||t.ecdsa_threshold_key_id!==String(e.activationBinding.roleLocalBinding.ecdsaThresholdKeyId)||t.signing_root_id!==String(e.activationBinding.signer.signingRootId)||t.signing_root_version!==String(e.activationBinding.signer.signingRootVersion)||t.context.application_binding_digest_b64u!==e.receipt.ecdsa_activation.context.application_binding_digest_b64u||!f(t.public_identity,e.receipt.ecdsa_activation.public_identity)||!_(t.signing_worker,e.receipt.ecdsa_activation.signing_worker)||t.activation_epoch!==e.receipt.ecdsa_activation.activation_epoch||t.public_identity.context_binding_b64u!==n.contextBinding32B64u||t.public_identity.derivation_client_share_public_key33_b64u!==n.derivationClientSharePublicKey33B64u||t.public_identity.server_public_key33_b64u!==n.relayerPublicKey33B64u||t.public_identity.threshold_public_key33_b64u!==n.groupPublicKey33B64u||!u(t.material_activation,i))throw Error(`ECDSA normal-signing runtime does not match its activation`)}function xt(e,t){if(e.identity.manifestId===t.identity.manifestId||Number(t.identity.manifestRevision)!==Number(e.identity.manifestRevision)+1||e.signer.capability!==t.signer.capability||e.signer.signerId!==t.signer.signerId||e.signer.walletId!==t.signer.walletId||e.signer.authority.authorityDigest!==t.signer.authority.authorityDigest||e.signer.materialOwner!==t.signer.materialOwner||e.durableMaterial.durableMaterialRef===t.durableMaterial.durableMaterialRef||e.activation.serverActivation.serverGeneration===t.activation.serverActivation.serverGeneration)throw Error(`ECDSA replacement manifest does not exactly replace the active manifest`)}function $(e){throw Error(`Unexpected ECDSA capability branch: ${String(e)}`)}export{pe as A,ue as B,H as C,U as D,Se as E,E as F,x as I,fe as L,w as M,S as N,_e as O,T as P,le as R,z as S,xe as T,ce as V,it as _,qe as a,Ge as b,et as c,Je as d,Xe as f,ct as g,$e as h,Ke as i,C as j,be as k,Ye as l,rt as m,at as n,Qe as o,nt as p,tt as r,q as s,st as t,Ze as u,ot as v,we as w,B as x,bt as y,de as z};
+import{g as e,i as t}from"./domainIds-t1lp25yU.js";import{i as n,r}from"./base64-BmKR3UqU.js";import{X as i,Y as a}from"./activeWalletSession-BJ4B-nJo.js";import{t as o}from"./canonicalPrimitives-Jd3i_Ngz.js";import{a as s,c,o as l,s as ee}from"./ecdsaChainTarget-Bm5X4k-V.js";import{A as te,Dt as ne,Ft as u,H as d,K as f,Nt as p,Pt as m,S as h,V as g,Y as _,ft as re,vt as ie}from"./digestEncoding-CqNXPZY9.js";import{T as v,i as y,n as ae,r as oe,t as se}from"./emailOtpEcdsaDerivationIdentity-HFQXc1Yw.js";function b(e,t){let n=String(e??``).trim();if(!n)throw Error(`${t} must be a non-empty string`);return n}function ce(e){return b(e,`signing-session seal key version`)}function le(e){return b(e,`ECDSA client verifying share`)}function ue(e){return b(e,`ECDSA relayer key id`)}function de(e){return b(e,`ECDSA key handle`)}function fe(e){return e}function pe(e){if(typeof e!=`string`)throw Error(`ECDSA client verifying public key must be a string`);let t=e.trim();if(!/^[A-Za-z0-9_-]+$/.test(t))throw Error(`ECDSA client verifying public key must be unpadded base64url`);let i;try{i=r(t)}catch{throw Error(`ECDSA client verifying public key must be valid base64url`)}if(i.length!==33||n(i)!==t)throw Error(`ECDSA client verifying public key must be canonical base64url for 33 bytes`);if(i[0]!==2&&i[0]!==3)throw Error(`ECDSA client verifying public key must be compressed secp256k1`);return t}function x(e){return ne(e)}function S(e){return b(e,`ECDSA role-local material handle`)}function C(e){return b(e,`ECDSA role-local binding digest`)}function w(e){return b(e,`ECDSA role-local durable material reference`)}function T(t){if(!t||typeof t!=`object`||Array.isArray(t))throw Error(`ECDSA role-local persisted material reference must be an object`);let n=t,r=Object.keys(n).sort(),i=[`bindingDigest`,`durableMaterialRef`,`kind`,`materialActivation`];if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`ECDSA role-local persisted material reference has unexpected fields`);if(n.kind!==`ecdsa_role_local_persisted_material_ref_v1`)throw Error(`ECDSA role-local persisted material reference kind is invalid`);let a=e(n.materialActivation);if(!a.ok)throw Error(a.error.message);return{kind:`ecdsa_role_local_persisted_material_ref_v1`,durableMaterialRef:w(n.durableMaterialRef),bindingDigest:C(n.bindingDigest),materialActivation:a.value}}function E(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`ECDSA role-local worker handle must be an object`);let t=e,n=Object.keys(t).sort(),r=[`bindingDigest`,`durableMaterialRef`,`kind`,`materialHandle`];if(n.length!==r.length||n.some((e,t)=>e!==r[t]))throw Error(`ECDSA role-local worker handle has unexpected fields`);if(t.kind!==`ecdsa_role_local_worker_handle_v1`)throw Error(`ECDSA role-local worker handle kind is invalid`);return{kind:`ecdsa_role_local_worker_handle_v1`,materialHandle:S(t.materialHandle),bindingDigest:C(t.bindingDigest),durableMaterialRef:w(t.durableMaterialRef)}}function D(e){throw Error(`Unhandled ECDSA role-local branch: ${String(e)}`)}function O(e,t){if(typeof e!=`string`||!e.trim())throw Error(`[platform][ecdsa-role-local] ${t} is required`);return e.trim()}function k(e,t,n){let i=O(e,t);if(r(i).length!==n)throw Error(`[platform][ecdsa-role-local] ${t} must decode to ${n} bytes`);return i}function A(e,t){let n=O(e,t),i=r(n);if(i.length!==33)throw Error(`[platform][ecdsa-role-local] ${t} must decode to 33 bytes`);if(i[0]!==2&&i[0]!==3)throw Error(`[platform][ecdsa-role-local] ${t} must be a compressed SEC1 key`);return n}function j(e){return A(e,`derivationClientSharePublicKey33B64u`)}function M(e){return A(e,`relayerPublicKey33B64u`)}function N(e){return A(e,`groupPublicKey33B64u`)}function P(e){let t=O(e,`ethereumAddress`).toLowerCase();if(!/^0x[0-9a-f]{40}$/.test(t))throw Error(`[platform][ecdsa-role-local] ethereumAddress must be an EVM address`);return t}function F(e){if(!Array.isArray(e)||e.length!==2||e[0]!==1||e[1]!==2)throw Error(`[platform][ecdsa-role-local] participantIds must be [1, 2]`);return[1,2]}function I(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[platform][ecdsa-role-local] stateBlob must be an object`);if(Object.keys(e).sort().join(`,`)!==`curve,encoding,kind,producer,stateBlobB64u`)throw Error(`[platform][ecdsa-role-local] stateBlob envelope is invalid`);let t=O(Reflect.get(e,`kind`),`stateBlob.kind`),n=O(Reflect.get(e,`curve`),`stateBlob.curve`),i=O(Reflect.get(e,`encoding`),`stateBlob.encoding`),a=O(Reflect.get(e,`producer`),`stateBlob.producer`),o=O(Reflect.get(e,`stateBlobB64u`),`stateBlob.stateBlobB64u`);if(t!==`ecdsa_role_local_state_blob_v1`||n!==`secp256k1`||i!==`base64url`||a!==`signer_core`)throw Error(`[platform][ecdsa-role-local] stateBlob envelope is invalid`);try{r(o)}catch(e){throw Error(`[platform][ecdsa-role-local] stateBlob payload is not base64url`,{cause:e})}return{kind:`ecdsa_role_local_state_blob_v1`,curve:`secp256k1`,encoding:`base64url`,producer:`signer_core`,stateBlobB64u:o}}function L(e,t=`credentialIdB64u`){return O(e,t)}function R(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[platform][ecdsa-role-local] authMethod must be an object`);switch(O(Reflect.get(e,`kind`),`authMethod.kind`)){case`passkey`:if(Object.keys(e).sort().join(`,`)!==`credentialIdB64u,kind,rpId`)throw Error(`[platform][ecdsa-role-local] passkey authMethod fields are invalid`);return{kind:`passkey`,credentialIdB64u:L(Reflect.get(e,`credentialIdB64u`)),rpId:v(Reflect.get(e,`rpId`))};case`email_otp`:if(Object.keys(e).sort().join(`,`)!==`authSubjectId,kind`)throw Error(`[platform][ecdsa-role-local] email OTP authMethod fields are invalid`);return{kind:`email_otp`,authSubjectId:y(Reflect.get(e,`authSubjectId`))};default:throw Error(`[platform][ecdsa-role-local] authMethod kind is invalid`)}}function z(e){return{kind:`passkey`,credentialIdB64u:L(e.credentialIdB64u),rpId:v(e.rpId)}}function B(e){return{kind:`email_otp`,authSubjectId:y(e.authSubjectId)}}function me(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`?String(e.rpId)===String(t.rpId)&&String(e.credentialIdB64u)===String(t.credentialIdB64u):!1;case`email_otp`:return t.kind===`email_otp`?String(e.authSubjectId)===String(t.authSubjectId):!1;default:return D(e)}}function he(e){switch(e.authMethod.kind){case`passkey`:return{kind:`ecdsa_role_local_ready_passkey_v1`,stateBlob:e.stateBlob,publicFacts:e.publicFacts,authMethod:e.authMethod};case`email_otp`:return{kind:`ecdsa_role_local_ready_email_otp_v1`,stateBlob:e.stateBlob,publicFacts:e.publicFacts,authMethod:e.authMethod};default:return D(e.authMethod)}}function ge(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[platform][ecdsa-role-local] chainTarget must be an object`);switch(O(Reflect.get(e,`kind`),`chainTarget.kind`).toLowerCase()){case`evm`:if(Object.keys(e).sort().join(`,`)!==`chainId,kind,namespace,networkSlug`)throw Error(`[platform][ecdsa-role-local] EVM chainTarget fields are invalid`);return s({kind:Reflect.get(e,`kind`),namespace:Reflect.get(e,`namespace`),chainId:Reflect.get(e,`chainId`),networkSlug:Reflect.get(e,`networkSlug`)});case`tempo`:if(Object.keys(e).sort().join(`,`)!==`chainId,kind,networkSlug`)throw Error(`[platform][ecdsa-role-local] Tempo chainTarget fields are invalid`);return s({kind:Reflect.get(e,`kind`),chainId:Reflect.get(e,`chainId`),networkSlug:Reflect.get(e,`networkSlug`)});default:throw Error(`[platform][ecdsa-role-local] chainTarget kind is invalid`)}}function V(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[platform][ecdsa-role-local] publicFacts must be an object`);if(Object.keys(e).sort().join(`,`)!==`applicationBindingDigestB64u,chainTarget,clientParticipantId,contextBinding32B64u,derivationClientSharePublicKey33B64u,ecdsaThresholdKeyId,ethereumAddress,groupPublicKey33B64u,keyHandle,participantIds,publicCapability,relayerParticipantId,relayerPublicKey33B64u,signingRootId,signingRootVersion,walletId`)throw Error(`[platform][ecdsa-role-local] publicFacts fields are invalid`);if(Reflect.get(e,`clientParticipantId`)!==1)throw Error(`[platform][ecdsa-role-local] clientParticipantId must be 1`);if(Reflect.get(e,`relayerParticipantId`)!==2)throw Error(`[platform][ecdsa-role-local] relayerParticipantId must be 2`);let t=j(Reflect.get(e,`derivationClientSharePublicKey33B64u`)),n=M(Reflect.get(e,`relayerPublicKey33B64u`));if(String(t)===String(n))throw Error(`[platform][ecdsa-role-local] relayerPublicKey33B64u must differ from derivationClientSharePublicKey33B64u`);return{walletId:c(Reflect.get(e,`walletId`)),chainTarget:ge(Reflect.get(e,`chainTarget`)),keyHandle:O(Reflect.get(e,`keyHandle`),`keyHandle`),ecdsaThresholdKeyId:oe(Reflect.get(e,`ecdsaThresholdKeyId`)),signingRootId:se(Reflect.get(e,`signingRootId`)),signingRootVersion:ae(Reflect.get(e,`signingRootVersion`)),applicationBindingDigestB64u:k(Reflect.get(e,`applicationBindingDigestB64u`),`applicationBindingDigestB64u`,32),clientParticipantId:1,relayerParticipantId:2,participantIds:F(Reflect.get(e,`participantIds`)),contextBinding32B64u:k(Reflect.get(e,`contextBinding32B64u`),`contextBinding32B64u`,32),derivationClientSharePublicKey33B64u:t,relayerPublicKey33B64u:n,groupPublicKey33B64u:N(Reflect.get(e,`groupPublicKey33B64u`)),ethereumAddress:P(Reflect.get(e,`ethereumAddress`)),publicCapability:h(Reflect.get(e,`publicCapability`))}}function H(e){return V(e)}function _e(e){let t=e.publicFacts;return H({walletId:t.walletId,chainTarget:e.chainTarget,keyHandle:t.keyHandle,ecdsaThresholdKeyId:t.ecdsaThresholdKeyId,signingRootId:t.signingRootId,signingRootVersion:t.signingRootVersion,applicationBindingDigestB64u:t.applicationBindingDigestB64u,clientParticipantId:t.clientParticipantId,relayerParticipantId:t.relayerParticipantId,participantIds:t.participantIds,contextBinding32B64u:t.contextBinding32B64u,derivationClientSharePublicKey33B64u:t.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:t.relayerPublicKey33B64u,groupPublicKey33B64u:t.groupPublicKey33B64u,ethereumAddress:t.ethereumAddress,publicCapability:t.publicCapability})}function U(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`[platform][ecdsa-role-local] ready record must be an object`);if(Object.keys(e).sort().join(`,`)!==`authMethod,kind,publicFacts,stateBlob`)throw Error(`[platform][ecdsa-role-local] ready record fields are invalid`);let t=O(Reflect.get(e,`kind`),`readyRecord.kind`);if(t!==`ecdsa_role_local_ready_passkey_v1`&&t!==`ecdsa_role_local_ready_email_otp_v1`)throw Error(`[platform][ecdsa-role-local] ready record kind is invalid`);let n=V(Reflect.get(e,`publicFacts`)),r=he({stateBlob:I(Reflect.get(e,`stateBlob`)),publicFacts:n,authMethod:R(Reflect.get(e,`authMethod`))});if(t===`ecdsa_role_local_ready_passkey_v1`&&r.kind!==t||t===`ecdsa_role_local_ready_email_otp_v1`&&r.kind!==t)throw Error(`[platform][ecdsa-role-local] ready record authMethod branch mismatch`);return r}function ve(e){switch(e.kind){case`passkey`:return{kind:`passkey`,credentialIdB64u:e.credentialIdB64u,rpId:e.rpId};case`email_otp`:return{kind:`email_otp`,authSubjectId:e.authSubjectId};default:return D(e)}}function ye(e){return{walletId:e.walletId,chainTarget:e.chainTarget,keyHandle:e.keyHandle,ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,signingRootId:e.signingRootId,signingRootVersion:e.signingRootVersion,applicationBindingDigestB64u:e.applicationBindingDigestB64u,clientParticipantId:1,relayerParticipantId:2,participantIds:[1,2],contextBinding32B64u:e.contextBinding32B64u,derivationClientSharePublicKey33B64u:e.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:e.relayerPublicKey33B64u,groupPublicKey33B64u:e.groupPublicKey33B64u,ethereumAddress:e.ethereumAddress,publicCapability:e.publicCapability}}function be(e){let t=U(e);return{kind:t.kind,stateBlob:{kind:t.stateBlob.kind,curve:t.stateBlob.curve,encoding:t.stateBlob.encoding,producer:t.stateBlob.producer,stateBlobB64u:t.stateBlob.stateBlobB64u},publicFacts:ye(t.publicFacts),authMethod:ve(t.authMethod)}}function W(e){return encodeURIComponent(O(e,`storage key part`))}function xe(e){return[`ecdsa_role_local_ready_v1`,W(e.walletId),W(l(e.chainTarget)),W(e.keyHandle),W(e.ecdsaThresholdKeyId),W(e.signingRootId),W(e.signingRootVersion),W(e.participantIds.join(`,`)),W(Ce(e.authMethod))].join(`:`)}function Se(e){let t=U(e),n=t.publicFacts;return{walletId:n.walletId,chainTarget:n.chainTarget,keyHandle:n.keyHandle,ecdsaThresholdKeyId:n.ecdsaThresholdKeyId,signingRootId:n.signingRootId,signingRootVersion:n.signingRootVersion,participantIds:n.participantIds,authMethod:t.authMethod}}function Ce(e){switch(e.kind){case`passkey`:return[`passkey`,e.rpId,e.credentialIdB64u].join(`:`);case`email_otp`:return[`email_otp`,e.authSubjectId].join(`:`);default:return D(e)}}function we(e){let t=e.record.publicFacts,n=e.input;return String(t.walletId)===String(n.walletId)&&ee(t.chainTarget,n.chainTarget)&&String(t.keyHandle)===String(n.keyHandle)&&String(t.ecdsaThresholdKeyId)===String(n.ecdsaThresholdKeyId)&&String(t.signingRootId)===String(n.signingRootId)&&String(t.signingRootVersion)===String(n.signingRootVersion)&&t.participantIds[0]===n.participantIds[0]&&t.participantIds[1]===n.participantIds[1]&&me(e.record.authMethod,n.authMethod)}var G=class{retainProof(){return!0}constructor(){this.retainProof()}},Te=class extends G{kind=`evm_family`;targetMemberships;constructor(e){super(),this.targetMemberships=e}},K=class extends G{manifestId;manifestRevision;constructor(e){super(),this.manifestId=e.manifestId,this.manifestRevision=e.manifestRevision}},Ee=class extends G{kind=`no_current_manifest`},De=class extends G{kind=`exact_manifest`;manifestId;manifestRevision;constructor(e){super(),this.manifestId=e.manifestId,this.manifestRevision=e.manifestRevision}},Oe=class extends G{kind=`no_current_generation`},ke=class extends G{kind=`exact_generation`;serverGeneration;constructor(e){super(),this.serverGeneration=e}},Ae=class extends G{kind=`ecdsa_role_local_material_binding`;keyHandle;ecdsaThresholdKeyId;clientVerifyingPublicKey33B64u;participantIds;relayerKeyId;constructor(e){super(),this.keyHandle=e.keyHandle,this.ecdsaThresholdKeyId=e.ecdsaThresholdKeyId,this.clientVerifyingPublicKey33B64u=e.clientVerifyingPublicKey33B64u,this.participantIds=e.participantIds,this.relayerKeyId=e.relayerKeyId}},je=class extends G{kind=`prepared_evm_family_signer`;capability;signerId;walletId;authority;scope;materialOwner;signingRootId;signingRootVersion;constructor(e){super(),this.capability=e.capability,this.signerId=e.signerId,this.walletId=e.authority.walletId,this.authority=e.authority,this.scope=e.scope,this.materialOwner=e.materialOwner,this.signingRootId=e.signingRootId,this.signingRootVersion=e.signingRootVersion}},Me=class extends G{kind=`registered_evm_family_signer`;capability;signerId;walletId;authority;scope;materialOwner;signingRootId;signingRootVersion;registeredPublicFacts;constructor(e){super(),this.capability=e.preparedSigner.capability,this.signerId=e.preparedSigner.signerId,this.walletId=e.preparedSigner.walletId,this.authority=e.preparedSigner.authority,this.scope=e.preparedSigner.scope,this.materialOwner=e.preparedSigner.materialOwner,this.signingRootId=e.preparedSigner.signingRootId,this.signingRootVersion=e.preparedSigner.signingRootVersion,this.registeredPublicFacts=e.registeredPublicFacts}},Ne=class extends G{kind=`encrypted_ecdsa_pending_candidate`;sealingKeyId;iv12B64u;ciphertextB64u;ciphertextDigest;constructor(e){super(),this.sealingKeyId=e.sealingKeyId,this.iv12B64u=e.iv12B64u,this.ciphertextB64u=e.ciphertextB64u,this.ciphertextDigest=e.ciphertextDigest}},Pe=class extends G{kind=`ecdsa_activation_binding`;targetManifest;signer;roleLocalBinding;bindingDigest;durableMaterialRef;constructor(e){super(),this.targetManifest=e.targetManifest,this.signer=e.signer,this.roleLocalBinding=e.roleLocalBinding,this.bindingDigest=e.bindingDigest,this.durableMaterialRef=e.durableMaterialRef}},Fe=class extends G{kind=`prepared_ecdsa_activation_candidate`;activationBinding;encryptedPending;constructor(e){super(),this.activationBinding=e.activationBinding,this.encryptedPending=e.encryptedPending}},Ie=class extends G{kind=`ecdsa_server_activation_command`;correlationId;expectedGeneration;requestDigest;canonicalRequest;constructor(e){super(),this.correlationId=e.correlationId,this.expectedGeneration=e.expectedGeneration,this.requestDigest=e.requestDigest,this.canonicalRequest=e.canonicalRequest}},Le=class extends G{kind=`ecdsa_server_activation_receipt`;lifecycleId;activationDigest;activatedAt;protocolReceipt;constructor(e){super(),this.lifecycleId=e.lifecycleId,this.activationDigest=e.activationDigest,this.activatedAt=e.activatedAt,this.protocolReceipt=e.protocolReceipt}},Re=class extends G{kind=`ecdsa_server_activation_commit`;correlationId;activationRequestDigest;serverGeneration;serverActivationReceipt;constructor(e){super(),this.correlationId=e.correlationId,this.activationRequestDigest=e.activationRequestDigest,this.serverGeneration=e.serverGeneration,this.serverActivationReceipt=e.serverActivationReceipt}},ze=class extends G{kind=`activation_prepared`;journalId;expectedManifest;activationCommand;candidate;createdAt;constructor(e){super(),this.journalId=e.journalId,this.expectedManifest=e.expectedManifest,this.activationCommand=e.activationCommand,this.candidate=e.candidate,this.createdAt=e.createdAt}},Be=class extends G{kind=`server_activation_committed`;journalId;expectedManifest;activationCommand;candidate;createdAt;serverActivation;constructor(e){super(),this.journalId=e.journalId,this.expectedManifest=e.expectedManifest,this.activationCommand=e.activationCommand,this.candidate=e.candidate,this.createdAt=e.createdAt,this.serverActivation=e.serverActivation}},Ve=class extends G{kind=`durable_ecdsa_material`;materialActivation;routerAbEcdsaDerivationNormalSigning;roleLocalPublicFacts;roleLocalBinding;durableMaterialRef;bindingDigest;lifecycleId;ciphertextDigest;activationDigest;activatedAt;runtimePolicyScope;constructor(e){super(),this.materialActivation=e.materialActivation,this.routerAbEcdsaDerivationNormalSigning=e.routerAbEcdsaDerivationNormalSigning,this.roleLocalPublicFacts=e.roleLocalPublicFacts,this.roleLocalBinding=e.roleLocalBinding,this.durableMaterialRef=e.durableMaterialRef,this.bindingDigest=e.bindingDigest,this.lifecycleId=e.lifecycleId,this.ciphertextDigest=e.ciphertextDigest,this.activationDigest=e.activationDigest,this.activatedAt=e.activatedAt,this.runtimePolicyScope=e.runtimePolicyScope}},He=class extends G{kind=`encrypted_ecdsa_ready_material`;binding;sealingKeyId;iv12B64u;ciphertextB64u;constructor(e){super(),this.binding=e.binding,this.sealingKeyId=e.sealingKeyId,this.iv12B64u=e.iv12B64u,this.ciphertextB64u=e.ciphertextB64u}},Ue=class extends G{kind=`active_ecdsa_capability_manifest`;identity;signer;activation;durableMaterial;committedAt;constructor(e){super(),this.identity=e.identity,this.signer=e.signer,this.activation=e.activation,this.durableMaterial=e.durableMaterial,this.committedAt=e.committedAt}},We=class extends G{kind=`replaced_ecdsa_capability_manifest`;identity;signer;retirement;constructor(e){super(),this.identity=e.identity,this.signer=e.signer,this.retirement=e.retirement}};function Ge(e){if(!e.ok)throw Error(e.error.message);return e.value}function Ke(e){return lt(e.targetMemberships),new Te([...e.targetMemberships])}function qe(e){return new K(e)}function Je(){return new Ee}function Ye(e){return new De(e)}function Xe(){return new Oe}function Ze(e){return new ke(e)}function Qe(e){return ut(e.participantIds),new Ae({keyHandle:e.keyHandle,ecdsaThresholdKeyId:e.ecdsaThresholdKeyId,clientVerifyingPublicKey33B64u:e.clientVerifyingPublicKey33B64u,participantIds:[...e.participantIds],relayerKeyId:e.relayerKeyId})}function $e(e){return new je(e)}function et(e){return new Ne(e)}function tt(e){return new Pe(e)}function nt(e){return new Fe(e)}function rt(e){dt(e.expectedManifest,e.candidate.activationBinding.targetManifest),ft(e.expectedManifest,e.expectedGeneration);let t=new Ie({correlationId:e.journalId,expectedGeneration:e.expectedGeneration,requestDigest:e.requestDigest,canonicalRequest:e.canonicalRequest});return new ze({journalId:e.journalId,expectedManifest:e.expectedManifest,activationCommand:t,candidate:e.candidate,createdAt:e.createdAt})}function q(e){let t=te(e.serverCommit.protocolReceipt);mt(t,e.serverCommit),Y(t,e.activationBinding);let n=new Le({lifecycleId:ht(t),activationDigest:gt(t),activatedAt:o(t.ecdsa_activation.activated_at_ms),protocolReceipt:t});return new Re({correlationId:e.serverCommit.correlationId,activationRequestDigest:e.serverCommit.activationRequestDigest,serverGeneration:e.serverCommit.serverGeneration,serverActivationReceipt:n})}function it(e){pt(e.serverCommit,e.preparedJournal);let t=q({activationBinding:e.preparedJournal.candidate.activationBinding,serverCommit:e.serverCommit});return new Be({journalId:e.preparedJournal.journalId,expectedManifest:e.preparedJournal.expectedManifest,activationCommand:e.preparedJournal.activationCommand,candidate:e.preparedJournal.candidate,createdAt:e.preparedJournal.createdAt,serverActivation:t})}function at(e){vt(e.serverActivation,e.activationBinding);let t=e.roleLocalPublicFacts,n=e.activationBinding,r=i(e.runtimePolicyScope);if(t.walletId!==n.signer.walletId||t.keyHandle!==n.roleLocalBinding.keyHandle||t.ecdsaThresholdKeyId!==n.roleLocalBinding.ecdsaThresholdKeyId||t.signingRootId!==n.signer.signingRootId||t.signingRootVersion!==n.signer.signingRootVersion||a(r)!==n.signer.signingRootId||r.signingRootVersion!==n.signer.signingRootVersion||t.contextBinding32B64u!==n.bindingDigest||!Z(t.participantIds,n.roleLocalBinding.participantIds)||!n.signer.scope.targetMemberships.some(e=>J(e)===J(t.chainTarget)))throw Error(`ECDSA role-local public facts do not match their activation`);let o=e.serverActivation.serverActivationReceipt;return Q({normalSigning:e.routerAbEcdsaDerivationNormalSigning,activationBinding:n,roleLocalPublicFacts:t,receipt:o.protocolReceipt}),new Ve({materialActivation:X(o.protocolReceipt),routerAbEcdsaDerivationNormalSigning:e.routerAbEcdsaDerivationNormalSigning,roleLocalPublicFacts:e.roleLocalPublicFacts,roleLocalBinding:e.activationBinding.roleLocalBinding,durableMaterialRef:e.activationBinding.durableMaterialRef,bindingDigest:e.activationBinding.bindingDigest,lifecycleId:o.lifecycleId,ciphertextDigest:e.ciphertextDigest,activationDigest:o.activationDigest,activatedAt:o.activatedAt,runtimePolicyScope:r})}function ot(e){return new He({binding:e.binding,sealingKeyId:e.sealingKeyId,iv12B64u:e.iv12B64u,ciphertextB64u:e.ciphertextB64u})}function st(e){_t(e.registeredPublicFacts,e.activationBinding.roleLocalBinding,e.serverActivation),yt(e.durableMaterial,e.activationBinding,e.serverActivation);let t=new Me({preparedSigner:e.activationBinding.signer,registeredPublicFacts:e.registeredPublicFacts}),n={kind:`active_ecdsa_material_activation`,materialActivation:e.durableMaterial.materialActivation,serverActivation:e.serverActivation,retention:`retained`};return new Ue({identity:e.activationBinding.targetManifest,signer:t,activation:n,durableMaterial:e.durableMaterial,committedAt:e.committedAt})}function ct(e){return xt(e.activeManifest,e.replacementManifest),new We({identity:e.activeManifest.identity,signer:e.activeManifest.signer,retirement:{kind:`replaced`,replacementManifest:e.replacementManifest.identity,replacementActivation:e.replacementManifest.activation.serverActivation}})}function lt(e){let t=e.map(J);if(new Set(t).size!==t.length)throw Error(`ECDSA capability target memberships must be unique`)}function J(e){switch(e.kind){case`evm`:return`evm:${e.namespace}:${e.chainId}:${e.networkSlug}`;case`tempo`:return`tempo:${e.chainId}:${e.networkSlug}`;default:return $(e)}}function ut(e){let t=e.map(Number);if(t.some(e=>!Number.isSafeInteger(e)||e<1)||new Set(t).size!==t.length)throw Error(`ECDSA participant ids must be unique positive integers`)}function dt(e,t){switch(e.kind){case`no_current_manifest`:if(Number(t.manifestRevision)!==1)throw Error(`Initial ECDSA manifest revision must be 1`);return;case`exact_manifest`:if(t.manifestId===e.manifestId||Number(t.manifestRevision)!==Number(e.manifestRevision)+1)throw Error(`Replacement ECDSA manifest must use a fresh id and next revision`);return;default:return $(e)}}function ft(e,t){switch(e.kind){case`no_current_manifest`:if(t.kind!==`no_current_generation`)throw Error(`Initial ECDSA activation cannot expect a server generation`);return;case`exact_manifest`:if(t.kind!==`exact_generation`)throw Error(`Replacement ECDSA activation requires an exact server generation`);return;default:return $(e)}}function pt(e,t){let n=JSON.parse(t.activationCommand.canonicalRequest).operation===`wallet_registration_activate_v2`;if(e.correlationId!==t.activationCommand.correlationId||!n&&e.activationRequestDigest!==t.activationCommand.requestDigest)throw Error(`ECDSA server activation commit does not match the prepared command`)}function Y(e,t){let n=e.ecdsa_activation.public_identity,r=e.ecdsa_activation.material_activation;if(X(e),n.context_binding_b64u!==String(t.bindingDigest)||n.derivation_client_share_public_key33_b64u!==String(t.roleLocalBinding.clientVerifyingPublicKey33B64u)||r.material_owner!==String(t.signer.materialOwner)||r.key_binding!==String(t.bindingDigest)||r.lifecycle_binding!==e.lifecycle_id||r.signing_worker!==e.ecdsa_activation.signing_worker.server_id)throw Error(`ECDSA activation receipt does not match the prepared material binding`)}function mt(e,t){let r=n(Uint8Array.from(e.activation_request_digest.bytes));if(e.activation_correlation_id!==t.correlationId||r!==t.activationRequestDigest||e.server_generation!==t.serverGeneration)throw Error(`ECDSA activation receipt does not match the server activation commit`)}function ht(e){return ie(e.lifecycle_id)}function gt(e){return re(e.ecdsa_activation.activation_digest_b64u)}function X(e){return p(e.ecdsa_activation.material_activation)}function _t(e,t,n){let r=n.serverActivationReceipt.protocolReceipt.ecdsa_activation.public_identity;if(String(e.keyHandle)!==String(t.keyHandle)||String(e.publicKeyB64u)!==r.threshold_public_key33_b64u||String(t.clientVerifyingPublicKey33B64u)!==r.derivation_client_share_public_key33_b64u||!Z(e.participantIds,t.participantIds))throw Error(`Registered ECDSA public facts do not match role-local material`)}function Z(e,t){return e.length===t.length?e.every((e,n)=>Number(e)===Number(t[n])):!1}function vt(e,t){Y(e.serverActivationReceipt.protocolReceipt,t)}function yt(e,n,r){let i=r.serverActivationReceipt,a=X(i.protocolReceipt);if(!t(e.materialActivation,a)||e.roleLocalBinding!==n.roleLocalBinding||e.durableMaterialRef!==n.durableMaterialRef||e.bindingDigest!==n.bindingDigest||e.lifecycleId!==i.lifecycleId||e.activationDigest!==i.activationDigest||e.activatedAt!==i.activatedAt)throw Error(`Durable ECDSA material does not match its activation`);Q({normalSigning:e.routerAbEcdsaDerivationNormalSigning,activationBinding:n,roleLocalPublicFacts:e.roleLocalPublicFacts,receipt:i.protocolReceipt})}function bt(e,t){return e.kind===t.kind&&e.context.application_binding_digest_b64u===t.context.application_binding_digest_b64u&&f(e.public_identity,t.public_identity)&&u(e.material_activation,t.material_activation)&&d(e.signer_set,t.signer_set)&&g(e.deriver_recipient_keys,t.deriver_recipient_keys)&&e.router_id===t.router_id&&e.client_id===t.client_id&&e.activation_epoch===t.activation_epoch&&e.registration_request_digest_b64u===t.registration_request_digest_b64u&&e.proof_transcript_digest_b64u===t.proof_transcript_digest_b64u}function Q(e){let t=e.normalSigning.scope,n=e.roleLocalPublicFacts,r=X(e.receipt),i=m({kind:r.kind,activationId:r.activationId,capability:r.capability,materialOwner:r.materialOwner,keyBinding:r.keyBinding,lifecycleBinding:r.lifecycleBinding,signingWorker:r.signingWorker});if(t.wallet_id!==String(e.activationBinding.signer.walletId)||t.ecdsa_threshold_key_id!==String(e.activationBinding.roleLocalBinding.ecdsaThresholdKeyId)||t.signing_root_id!==String(e.activationBinding.signer.signingRootId)||t.signing_root_version!==String(e.activationBinding.signer.signingRootVersion)||t.context.application_binding_digest_b64u!==e.receipt.ecdsa_activation.context.application_binding_digest_b64u||!f(t.public_identity,e.receipt.ecdsa_activation.public_identity)||!_(t.signing_worker,e.receipt.ecdsa_activation.signing_worker)||t.activation_epoch!==e.receipt.ecdsa_activation.activation_epoch||t.public_identity.context_binding_b64u!==n.contextBinding32B64u||t.public_identity.derivation_client_share_public_key33_b64u!==n.derivationClientSharePublicKey33B64u||t.public_identity.server_public_key33_b64u!==n.relayerPublicKey33B64u||t.public_identity.threshold_public_key33_b64u!==n.groupPublicKey33B64u||!u(t.material_activation,i))throw Error(`ECDSA normal-signing runtime does not match its activation`)}function xt(e,t){if(e.identity.manifestId===t.identity.manifestId||Number(t.identity.manifestRevision)!==Number(e.identity.manifestRevision)+1||e.signer.capability!==t.signer.capability||e.signer.signerId!==t.signer.signerId||e.signer.walletId!==t.signer.walletId||e.signer.authority.authorityDigest!==t.signer.authority.authorityDigest||e.signer.materialOwner!==t.signer.materialOwner||e.durableMaterial.durableMaterialRef===t.durableMaterial.durableMaterialRef||e.activation.serverActivation.serverGeneration===t.activation.serverActivation.serverGeneration)throw Error(`ECDSA replacement manifest does not exactly replace the active manifest`)}function $(e){throw Error(`Unexpected ECDSA capability branch: ${String(e)}`)}export{pe as A,ue as B,H as C,U as D,Se as E,E as F,x as I,fe as L,w as M,S as N,_e as O,T as P,le as R,z as S,xe as T,ce as V,it as _,qe as a,Ge as b,et as c,Je as d,Xe as f,ct as g,$e as h,Ke as i,C as j,be as k,Ye as l,rt as m,at as n,Qe as o,nt as p,tt as r,q as s,st as t,Ze as u,ot as v,we as w,B as x,bt as y,de as z};

package/dist/esm/sdk/{ecdsaDerivationClientWasm-CVahDxLy.js → ecdsaDerivationClientWasm-AYOJgTJm.js}

@@ -1 +1 @@
-import{g as e,i as t}from"./domainIds-t1lp25yU.js";import{ct as n}from"./digestEncoding-n8Kr2kow.js";import{F as r,P as i}from"./ecdsaCapabilityManifest-CXVq8Qzb.js";import{t as a}from"./executeWorkerOperation-XmBNaxrV.js";const o={WORKER_READY:`WORKER_READY`},s={PrepareThresholdEcdsaDerivationRoleLocalClientBootstrap:7e4,FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrap:70001,CreateRouterAbEcdsaRegistrationCeremony:70005,VerifyRouterAbEcdsaRegistrationClientProofs:70006,CloseRouterAbEcdsaRegistrationCeremony:70007,FinalizeRouterAbEcdsaRegistrationActivation:70008,CreateRouterAbEcdsaPostRegistrationCeremony:70009,FinalizeRouterAbEcdsaExplicitExport:70010,CloseRouterAbEcdsaPostRegistrationCeremony:70011,StoreThresholdEcdsaRoleLocalSigningMaterial:70004,RehydrateEcdsaRoleLocalSigningMaterial:70015,PersistInitialCanonicalEcdsaActivation:70016,ReconcileCanonicalEcdsaActivation:70017,PrewarmEcdsaRegistrationCrypto:70018,VerifyRouterAbEcdsaPostRegistrationProofs:70019,SignWalletRecoveryEcdsaMaterialPossessionProof:70020,PrepareLinkedDeviceEcdsaSourceContribution:70022,StoreLinkedDeviceEcdsaHolderMaterial:70023,DisposeLinkedDeviceEcdsaHolderMaterials:70024,CreateEcdsaHolderOrdinaryExportRequest:70027,FinalizeEcdsaHolderOrdinaryExport:70028},c={PrepareThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess:70100,FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess:70101,CreateRouterAbEcdsaRegistrationCeremonySuccess:70105,VerifyRouterAbEcdsaRegistrationClientProofsSuccess:70106,CloseRouterAbEcdsaRegistrationCeremonySuccess:70107,FinalizeRouterAbEcdsaRegistrationActivationSuccess:70108,CreateRouterAbEcdsaPostRegistrationCeremonySuccess:70109,FinalizeRouterAbEcdsaExplicitExportSuccess:70110,CloseRouterAbEcdsaPostRegistrationCeremonySuccess:70111,StoreThresholdEcdsaRoleLocalSigningMaterialSuccess:70104,RehydrateEcdsaRoleLocalSigningMaterialSuccess:70115,PersistInitialCanonicalEcdsaActivationSuccess:70116,ReconcileCanonicalEcdsaActivationSuccess:70117,PrewarmEcdsaRegistrationCryptoSuccess:70118,VerifyRouterAbEcdsaPostRegistrationProofsSuccess:70119,SignWalletRecoveryEcdsaMaterialPossessionProofSuccess:70120,PrepareLinkedDeviceEcdsaSourceContributionSuccess:70122,StoreLinkedDeviceEcdsaHolderMaterialSuccess:70123,DisposeLinkedDeviceEcdsaHolderMaterialsSuccess:70124,CreateEcdsaHolderOrdinaryExportRequestSuccess:70127,FinalizeEcdsaHolderOrdinaryExportSuccess:70128},l={SessionInit:71e3,SessionStep:71001,SessionAbort:71002,Admit:71003,Destroy:71004,Reserve:71005,Commit:71006,ListAvailable:71007,ClearWallet:71008},u={SessionInitSuccess:71100,SessionStepSuccess:71101,SessionAbortSuccess:71102,AdmitSuccess:71103,DestroySuccess:71104,ReserveSuccess:71105,CommitSuccess:71106,ListAvailableSuccess:71107,ClearWalletSuccess:71108},d={ComputeSignatureShare:72e3},f={ComputeSignatureShareSuccess:72100};var p=class extends Error{code;coreCode;workerKind;constructor(e){super(e.message),this.name=`SignerWorkerOperationError`,this.code=(e.code||`SIGNER_INTERNAL`).trim(),this.coreCode=e.coreCode?.trim()||void 0,this.workerKind=e.workerKind}};function m(e){if(!e||typeof e!=`object`)return;let t=e.code;if(typeof t!=`string`)return;let n=t.trim();return n.length?n:void 0}function h(e){if(!e||typeof e!=`object`)return;let t=e.coreCode;if(typeof t!=`string`)return;let n=t.trim();return n.length?n:void 0}const g=2e4;function _(e){return{presignatureId:e.presignatureId,materialHandle:e.materialHandle,bigR33:new Uint8Array(e.bigR33),createdAtMs:e.createdAtMs,expiresAtMs:e.expiresAtMs}}async function v(e){return await a({ctx:e.workerCtx,kind:`ecdsaDerivationClient`,request:e.request})}async function y(e){return await a({ctx:e.workerCtx,kind:`ecdsaDerivationClient`,request:e.request})}async function b(e){return await a({ctx:e.workerCtx,kind:`ecdsaPresignClient`,request:e.request})}async function x(e){return await a({ctx:e.workerCtx,kind:`ecdsaOnlineClient`,request:e.request})}async function S(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.PrepareThresholdEcdsaDerivationRoleLocalClientBootstrap,timeoutMs:g,payload:e.command}});if(t.type!==c.PrepareThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess)throw Error(`PrepareThresholdEcdsaDerivationRoleLocalClientBootstrap failed`);return t.payload}async function C(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrap,timeoutMs:g,payload:e.command}});if(t.type!==c.FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess)throw Error(`FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrap failed`);return t.payload}async function w(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CreateRouterAbEcdsaRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CreateRouterAbEcdsaRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA registration ceremony creation failed`);return t.payload}async function T(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.VerifyRouterAbEcdsaRegistrationClientProofs,timeoutMs:g,payload:e.command}});if(t.type!==c.VerifyRouterAbEcdsaRegistrationClientProofsSuccess)throw Error(`Router A/B ECDSA registration client proof verification failed`);return t.payload}async function E(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.FinalizeRouterAbEcdsaRegistrationActivation,timeoutMs:g,payload:e.command}});if(t.type!==c.FinalizeRouterAbEcdsaRegistrationActivationSuccess)throw Error(`Router A/B ECDSA registration activation finalization failed`);return t.payload}async function D(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.PersistInitialCanonicalEcdsaActivation,timeoutMs:g,payload:e.command}});if(t.type!==c.PersistInitialCanonicalEcdsaActivationSuccess)throw Error(`Initial canonical ECDSA activation persistence failed`);return t.payload}async function O(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.ReconcileCanonicalEcdsaActivation,timeoutMs:g,payload:e.command}});if(t.type!==c.ReconcileCanonicalEcdsaActivationSuccess)throw Error(`Canonical ECDSA activation reconciliation failed`);let n=t.payload;return n.kind===`canonical_ecdsa_activation_committed_finalization_required_v1`?{kind:`canonical_ecdsa_activation_reconciliation_pending_v1`,journalId:n.journalId,reason:`wallet_custody_rejoin_required`,activationCommand:null}:n}async function k(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CloseRouterAbEcdsaRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CloseRouterAbEcdsaRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA registration ceremony close failed`);return t.payload}async function A(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CreateRouterAbEcdsaPostRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CreateRouterAbEcdsaPostRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA post-registration ceremony creation failed`);return t.payload}async function j(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.FinalizeRouterAbEcdsaExplicitExport,timeoutMs:g,payload:e.command}});if(t.type!==c.FinalizeRouterAbEcdsaExplicitExportSuccess)throw Error(`Router A/B ECDSA post-registration client proof finalization failed`);return t.payload}async function M(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CloseRouterAbEcdsaPostRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CloseRouterAbEcdsaPostRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA post-registration ceremony close failed`);return t.payload}async function N(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.StoreThresholdEcdsaRoleLocalSigningMaterial,timeoutMs:g,payload:{materialHandle:e.materialHandle,bindingDigest:e.bindingDigest,stateBlob:e.stateBlob}}});if(t.type!==c.StoreThresholdEcdsaRoleLocalSigningMaterialSuccess)throw Error(`StoreThresholdEcdsaRoleLocalSigningMaterial failed`);return t.payload}function P(e,t){return t.durableMaterialRef===e.durableMaterialRef&&t.bindingDigest===e.bindingDigest}async function F(a){let o=n(a.authority);if(!o)throw Error(`ECDSA role-local signing material authority is invalid`);let l=e(a.materialActivation);if(!l.ok)throw Error(l.error.message);let u=l.value,d=await v({workerCtx:a.workerCtx,request:{type:s.RehydrateEcdsaRoleLocalSigningMaterial,timeoutMs:g,payload:{kind:`open_ecdsa_role_local_signing_material_v1`,authority:o,materialActivation:u}}});if(d.type!==c.RehydrateEcdsaRoleLocalSigningMaterialSuccess)throw Error(`OpenEcdsaRoleLocalSigningMaterial failed`);let f=d.payload;switch(f.kind){case`ecdsa_role_local_signing_material_unavailable_v1`:return{ok:!1,reason:f.reason};case`ecdsa_role_local_signing_material_opened_v1`:{let e=i(f.materialRef);if(!t(u,e.materialActivation))throw Error(`ECDSA role-local signing material open changed its activation identity`);let n=r(f.liveHandle);if(!P(e,n))throw Error(`ECDSA role-local signing material hydration changed its identity`);return{ok:!0,liveHandle:n,materialRef:e}}default:{let e=f;throw Error(`ECDSA role-local signing material hydration response kind is invalid: ${String(e)}`)}}}async function I(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.SignWalletRecoveryEcdsaMaterialPossessionProof,timeoutMs:g,payload:{kind:`sign_wallet_recovery_ecdsa_material_possession_proof_v1`,challenge:e.challenge,stateBlob:e.stateBlob}}});if(t.type!==c.SignWalletRecoveryEcdsaMaterialPossessionProofSuccess)throw Error(`Wallet recovery ECDSA possession proof signing failed`);return t.payload}async function ee(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.PrepareLinkedDeviceEcdsaSourceContribution,timeoutMs:g,payload:{kind:`prepare_linked_device_ecdsa_source_contribution_v1`,preparation:e.preparation,...e.linkedHolderHandleId===void 0?{}:{linkedHolderHandleId:e.linkedHolderHandleId}}}});if(t.type!==c.PrepareLinkedDeviceEcdsaSourceContributionSuccess)throw Error(`Linked-device ECDSA source contribution preparation failed`);return t.payload}function L(e){let t=Array.isArray(e.outgoingMessages)?e.outgoingMessages.map(e=>new Uint8Array(e)):[];switch(e.event){case`final_batch_ready`:return{stage:`presign`,event:e.event,outgoingMessages:t,candidateBigR33:new Uint8Array(e.candidateBigR33)};case`presign_done`:return{stage:`done`,event:e.event,outgoingMessages:t,presignatureHandle:e.presignatureHandle,presignatureBigR33:new Uint8Array(e.presignatureBigR33)};case`none`:case`triples_done`:return{stage:e.stage,event:e.event,outgoingMessages:t}}}async function R(e){let t=e.groupPublicKey33.slice(),n=await b({workerCtx:e.workerCtx,request:{type:l.SessionInit,timeoutMs:g,payload:{authority:{kind:`role_local_derivation_handle`,materialHandle:e.materialHandle,material:e.material},sessionId:e.sessionId,groupPublicKey33:t.buffer,ceremonyExpiresAtMs:e.ceremonyExpiresAtMs,materialExpiresAtMs:e.materialExpiresAtMs,poolIdentity:e.poolIdentity},transfer:[t.buffer]}});if(n.type!==u.SessionInitSuccess)throw Error(`ThresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandle failed`);if(n.payload.authority.kind!==`role_local_derivation_handle`)throw Error(`ECDSA role-local presign returned a different authority`);return L(n.payload.progress)}async function z(e){let t=e.groupPublicKey33.slice(),n=await b({workerCtx:e.workerCtx,request:{type:l.SessionInit,timeoutMs:g,payload:{authority:{kind:`linked_holder_signing_material`,holderHandleId:e.holderHandleId},sessionId:e.sessionId,groupPublicKey33:t.buffer,ceremonyExpiresAtMs:e.ceremonyExpiresAtMs,materialExpiresAtMs:e.materialExpiresAtMs,poolIdentity:e.poolIdentity},transfer:[t.buffer]}});if(n.type!==u.SessionInitSuccess)throw Error(`Linked holder ECDSA presign initialization failed`);if(n.payload.authority.kind!==`linked_holder_signing_material`)throw Error(`Linked holder ECDSA presign returned a different authority`);return L(n.payload.progress)}async function B(e){if(e.holderHandleId.trim().length===0)throw Error(`ECDSA holder handle must be non-empty`);let t=await y({workerCtx:e.workerCtx,request:{type:s.CreateEcdsaHolderOrdinaryExportRequest,timeoutMs:g,payload:{kind:`create_ecdsa_holder_ordinary_export_request_v1`,holderHandleId:e.holderHandleId,request:e.request},transfer:[]}});if(t.type!==c.CreateEcdsaHolderOrdinaryExportRequestSuccess)throw Error(`ECDSA holder ordinary-export request preparation failed`);if(t.payload.holderHandleId!==e.holderHandleId)throw Error(`ECDSA holder ordinary-export request returned a different holder`);if(t.payload.requestDigestB64u.trim().length===0)throw Error(`ECDSA holder ordinary-export request digest is empty`);return t.payload}async function V(e){if(e.holderHandleId.trim().length===0)throw Error(`ECDSA holder handle must be non-empty`);if(e.requestDigestB64u!==e.expectedBinding.export_request_digest_b64u)throw Error(`ECDSA holder ordinary-export request digest differs from its binding`);let t=await y({workerCtx:e.workerCtx,request:{type:s.FinalizeEcdsaHolderOrdinaryExport,timeoutMs:g,payload:{kind:`finalize_ecdsa_holder_ordinary_export_v1`,holderHandleId:e.holderHandleId,requestDigestB64u:e.requestDigestB64u,expectedBinding:e.expectedBinding,forwardedResponse:e.forwardedResponse},transfer:[]}});if(t.type!==c.FinalizeEcdsaHolderOrdinaryExportSuccess)throw Error(`ECDSA holder ordinary-export finalization failed`);if(t.payload.holderHandleId!==e.holderHandleId)throw Error(`ECDSA holder ordinary-export finalization returned a different holder`);return t.payload}async function H(e){if(e.holderHandleId.trim().length===0)throw Error(`Linked holder ECDSA handle must be non-empty`);if(e.ownedSigningShare32.byteLength!==32)throw Error(`Linked holder ECDSA signing share must contain 32 bytes`);if(e.activationReceiptJson.trim().length===0)throw Error(`Linked holder ECDSA activation receipt must be non-empty`);let t=e.ownedSigningShare32.slice();try{let n=await a({kind:`ecdsaDerivationClient`,ctx:e.workerCtx,request:{type:s.StoreLinkedDeviceEcdsaHolderMaterial,timeoutMs:g,payload:{holderHandleId:e.holderHandleId,ownedSigningShare32:t.buffer,activationReceiptJson:e.activationReceiptJson},transfer:[t.buffer]}});if(n.type!==c.StoreLinkedDeviceEcdsaHolderMaterialSuccess)throw Error(`Linked holder ECDSA material import failed`);if(n.payload.holderHandleId!==e.holderHandleId)throw Error(`Linked holder ECDSA material import returned a different handle`);return n.payload}finally{t.byteLength>0&&t.fill(0)}}async function U(e){let t=await a({kind:`ecdsaDerivationClient`,ctx:e.workerCtx,request:{type:s.DisposeLinkedDeviceEcdsaHolderMaterials,timeoutMs:g,payload:e.disposal,transfer:[]}});if(t.type!==c.DisposeLinkedDeviceEcdsaHolderMaterialsSuccess)throw Error(`Linked holder ECDSA material disposal failed`);if(t.payload.kind!==e.disposal.kind)throw Error(`Linked holder ECDSA material disposal returned a different scope`);if(e.disposal.kind===`one`&&t.payload.kind===`one`&&t.payload.holderHandleId!==e.disposal.holderHandleId)throw Error(`Linked holder ECDSA material disposal returned a different handle`)}async function W(e){if(e.holderHandleId.trim().length===0)throw Error(`Linked holder ECDSA handle must be non-empty`);await U({disposal:{kind:`one`,holderHandleId:e.holderHandleId},workerCtx:e.workerCtx})}async function G(e){let t=!1,n;for(let r of e.holderHandleIds)try{await W({holderHandleId:r,workerCtx:e.workerCtx})}catch(e){t||(t=!0,n=e)}if(t)throw n}async function K(e){await U({disposal:{kind:`all`},workerCtx:e.workerCtx})}async function q(e){let t=e.incomingMessages.map(e=>e.slice()),n=t.map(e=>e.buffer),r=await b({workerCtx:e.workerCtx,request:{type:l.SessionStep,timeoutMs:g,payload:{sessionId:e.sessionId,stage:e.stage,incomingMessages:t.map(e=>e.buffer)},transfer:n}});if(r.type!==u.SessionStepSuccess)throw Error(`ThresholdEcdsaRoleLocalPresignSessionStep failed`);return L(r.payload)}async function J(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.SessionAbort,timeoutMs:g,payload:{sessionId:e.sessionId}}});if(t.type!==u.SessionAbortSuccess)throw Error(`ThresholdEcdsaRoleLocalPresignSessionAbort failed`);let n=t.payload;if(n.kind!==`threshold_ecdsa_presign_session_aborted`||n.sessionId!==e.sessionId)throw Error(`ThresholdEcdsaRoleLocalPresignSessionAbort returned invalid result`)}async function Y(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.Admit,timeoutMs:g,payload:{materialHandle:e.materialHandle,expectedPresignatureId:e.expectedPresignatureId,poolIdentity:e.poolIdentity,admissionMode:e.admissionMode}}});if(t.type!==u.AdmitSuccess)throw Error(`ThresholdEcdsaRoleLocalAdmitPresignature failed`);if(t.payload.kind!==`ecdsa_client_presignature_admitted_v1`||t.payload.materialHandle!==e.materialHandle||t.payload.presignatureId!==e.expectedPresignatureId)throw Error(`ThresholdEcdsaRoleLocalAdmitPresignature returned invalid binding`);return t.payload.storage}async function X(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.Destroy,timeoutMs:g,payload:{materialHandle:e.materialHandle,poolIdentity:e.poolIdentity}}});if(t.type!==u.DestroySuccess)throw Error(`ThresholdEcdsaRoleLocalDestroyPresignature failed`);if(t.payload.kind!==`ecdsa_client_presignature_destroyed_v1`||t.payload.materialHandle!==e.materialHandle)throw Error(`ThresholdEcdsaRoleLocalDestroyPresignature returned invalid handle`)}async function Z(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.Reserve,timeoutMs:g,payload:{materialHandle:e.materialHandle,expectedPresignatureId:e.expectedPresignatureId,poolIdentity:e.poolIdentity,requestBinding:e.requestBinding,reservationId:e.reservationId,leaseExpiresAtMs:e.leaseExpiresAtMs}}});if(t.type!==u.ReserveSuccess)throw Error(`ThresholdEcdsaRoleLocalReservePresignature failed`);return t.payload}async function Q(e){if((await b({workerCtx:e.workerCtx,request:{type:l.Commit,timeoutMs:g,payload:{materialHandle:e.materialHandle,poolIdentity:e.poolIdentity,requestBinding:e.requestBinding,reservationId:e.reservationId}}})).type!==u.CommitSuccess)throw Error(`ThresholdEcdsaRoleLocalCommitPresignature failed`)}async function $(e,t){let n=await b({workerCtx:t.workerCtx,request:{type:l.ListAvailable,timeoutMs:g,payload:{authority:{kind:e},poolIdentity:t.poolIdentity}}});if(n.type!==u.ListAvailableSuccess)throw Error(`ThresholdEcdsaListAvailablePresignatures failed`);return n.payload.map(_)}async function te(e){let t=e.groupPublicKey33.slice(),n=e.expectedPresignBigR33.slice(),r=e.digest32.slice(),i=e.clientRerandomizationContribution32.slice(),a=e.signingWorkerRerandomizationContribution32.slice(),o=await x({workerCtx:e.workerCtx,request:{type:d.ComputeSignatureShare,timeoutMs:g,payload:{materialHandle:e.materialHandle,poolIdentity:e.poolIdentity,requestBinding:e.requestBinding,reservationId:e.reservationId,groupPublicKey33:t.buffer,expectedPresignBigR33:n.buffer,digest32:r.buffer,clientRerandomizationContribution32:i.buffer,signingWorkerRerandomizationContribution32:a.buffer},transfer:[t.buffer,n.buffer,r.buffer,i.buffer,a.buffer]}});if(o.type!==f.ComputeSignatureShareSuccess)throw Error(`ThresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandle failed`);return new Uint8Array(o.payload)}export{Z as A,Y as C,J as D,X as E,p as F,o as I,h as L,s as M,c as N,R as O,l as P,m as R,$ as S,te as T,O as _,A as a,H as b,G as c,j as d,E as f,ee as g,S as h,B as i,T as j,q as k,C as l,D as m,M as n,w as o,F as p,k as r,W as s,K as t,V as u,I as v,Q as w,z as x,N as y};
+import{g as e,i as t}from"./domainIds-t1lp25yU.js";import{ct as n}from"./digestEncoding-CqNXPZY9.js";import{F as r,P as i}from"./ecdsaCapabilityManifest-DAJEVjlP.js";import{t as a}from"./executeWorkerOperation-C9FOCCR7.js";const o={WORKER_READY:`WORKER_READY`},s={PrepareThresholdEcdsaDerivationRoleLocalClientBootstrap:7e4,FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrap:70001,CreateRouterAbEcdsaRegistrationCeremony:70005,VerifyRouterAbEcdsaRegistrationClientProofs:70006,CloseRouterAbEcdsaRegistrationCeremony:70007,FinalizeRouterAbEcdsaRegistrationActivation:70008,CreateRouterAbEcdsaPostRegistrationCeremony:70009,FinalizeRouterAbEcdsaExplicitExport:70010,CloseRouterAbEcdsaPostRegistrationCeremony:70011,StoreThresholdEcdsaRoleLocalSigningMaterial:70004,RehydrateEcdsaRoleLocalSigningMaterial:70015,PersistInitialCanonicalEcdsaActivation:70016,ReconcileCanonicalEcdsaActivation:70017,PrewarmEcdsaRegistrationCrypto:70018,VerifyRouterAbEcdsaPostRegistrationProofs:70019,SignWalletRecoveryEcdsaMaterialPossessionProof:70020,PrepareLinkedDeviceEcdsaSourceContribution:70022,StoreLinkedDeviceEcdsaHolderMaterial:70023,DisposeLinkedDeviceEcdsaHolderMaterials:70024,CreateEcdsaHolderOrdinaryExportRequest:70027,FinalizeEcdsaHolderOrdinaryExport:70028},c={PrepareThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess:70100,FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess:70101,CreateRouterAbEcdsaRegistrationCeremonySuccess:70105,VerifyRouterAbEcdsaRegistrationClientProofsSuccess:70106,CloseRouterAbEcdsaRegistrationCeremonySuccess:70107,FinalizeRouterAbEcdsaRegistrationActivationSuccess:70108,CreateRouterAbEcdsaPostRegistrationCeremonySuccess:70109,FinalizeRouterAbEcdsaExplicitExportSuccess:70110,CloseRouterAbEcdsaPostRegistrationCeremonySuccess:70111,StoreThresholdEcdsaRoleLocalSigningMaterialSuccess:70104,RehydrateEcdsaRoleLocalSigningMaterialSuccess:70115,PersistInitialCanonicalEcdsaActivationSuccess:70116,ReconcileCanonicalEcdsaActivationSuccess:70117,PrewarmEcdsaRegistrationCryptoSuccess:70118,VerifyRouterAbEcdsaPostRegistrationProofsSuccess:70119,SignWalletRecoveryEcdsaMaterialPossessionProofSuccess:70120,PrepareLinkedDeviceEcdsaSourceContributionSuccess:70122,StoreLinkedDeviceEcdsaHolderMaterialSuccess:70123,DisposeLinkedDeviceEcdsaHolderMaterialsSuccess:70124,CreateEcdsaHolderOrdinaryExportRequestSuccess:70127,FinalizeEcdsaHolderOrdinaryExportSuccess:70128},l={SessionInit:71e3,SessionStep:71001,SessionAbort:71002,Admit:71003,Destroy:71004,Reserve:71005,Commit:71006,ListAvailable:71007,ClearWallet:71008},u={SessionInitSuccess:71100,SessionStepSuccess:71101,SessionAbortSuccess:71102,AdmitSuccess:71103,DestroySuccess:71104,ReserveSuccess:71105,CommitSuccess:71106,ListAvailableSuccess:71107,ClearWalletSuccess:71108},d={ComputeSignatureShare:72e3},f={ComputeSignatureShareSuccess:72100};var p=class extends Error{code;coreCode;workerKind;constructor(e){super(e.message),this.name=`SignerWorkerOperationError`,this.code=(e.code||`SIGNER_INTERNAL`).trim(),this.coreCode=e.coreCode?.trim()||void 0,this.workerKind=e.workerKind}};function m(e){if(!e||typeof e!=`object`)return;let t=e.code;if(typeof t!=`string`)return;let n=t.trim();return n.length?n:void 0}function h(e){if(!e||typeof e!=`object`)return;let t=e.coreCode;if(typeof t!=`string`)return;let n=t.trim();return n.length?n:void 0}const g=2e4;function _(e){return{presignatureId:e.presignatureId,materialHandle:e.materialHandle,bigR33:new Uint8Array(e.bigR33),createdAtMs:e.createdAtMs,expiresAtMs:e.expiresAtMs}}async function v(e){return await a({ctx:e.workerCtx,kind:`ecdsaDerivationClient`,request:e.request})}async function y(e){return await a({ctx:e.workerCtx,kind:`ecdsaDerivationClient`,request:e.request})}async function b(e){return await a({ctx:e.workerCtx,kind:`ecdsaPresignClient`,request:e.request})}async function x(e){return await a({ctx:e.workerCtx,kind:`ecdsaOnlineClient`,request:e.request})}async function S(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.PrepareThresholdEcdsaDerivationRoleLocalClientBootstrap,timeoutMs:g,payload:e.command}});if(t.type!==c.PrepareThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess)throw Error(`PrepareThresholdEcdsaDerivationRoleLocalClientBootstrap failed`);return t.payload}async function C(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrap,timeoutMs:g,payload:e.command}});if(t.type!==c.FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrapSuccess)throw Error(`FinalizeThresholdEcdsaDerivationRoleLocalClientBootstrap failed`);return t.payload}async function w(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CreateRouterAbEcdsaRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CreateRouterAbEcdsaRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA registration ceremony creation failed`);return t.payload}async function T(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.VerifyRouterAbEcdsaRegistrationClientProofs,timeoutMs:g,payload:e.command}});if(t.type!==c.VerifyRouterAbEcdsaRegistrationClientProofsSuccess)throw Error(`Router A/B ECDSA registration client proof verification failed`);return t.payload}async function E(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.FinalizeRouterAbEcdsaRegistrationActivation,timeoutMs:g,payload:e.command}});if(t.type!==c.FinalizeRouterAbEcdsaRegistrationActivationSuccess)throw Error(`Router A/B ECDSA registration activation finalization failed`);return t.payload}async function D(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.PersistInitialCanonicalEcdsaActivation,timeoutMs:g,payload:e.command}});if(t.type!==c.PersistInitialCanonicalEcdsaActivationSuccess)throw Error(`Initial canonical ECDSA activation persistence failed`);return t.payload}async function O(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.ReconcileCanonicalEcdsaActivation,timeoutMs:g,payload:e.command}});if(t.type!==c.ReconcileCanonicalEcdsaActivationSuccess)throw Error(`Canonical ECDSA activation reconciliation failed`);let n=t.payload;return n.kind===`canonical_ecdsa_activation_committed_finalization_required_v1`?{kind:`canonical_ecdsa_activation_reconciliation_pending_v1`,journalId:n.journalId,reason:`wallet_custody_rejoin_required`,activationCommand:null}:n}async function k(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CloseRouterAbEcdsaRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CloseRouterAbEcdsaRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA registration ceremony close failed`);return t.payload}async function A(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CreateRouterAbEcdsaPostRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CreateRouterAbEcdsaPostRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA post-registration ceremony creation failed`);return t.payload}async function j(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.FinalizeRouterAbEcdsaExplicitExport,timeoutMs:g,payload:e.command}});if(t.type!==c.FinalizeRouterAbEcdsaExplicitExportSuccess)throw Error(`Router A/B ECDSA post-registration client proof finalization failed`);return t.payload}async function M(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.CloseRouterAbEcdsaPostRegistrationCeremony,timeoutMs:g,payload:e.command}});if(t.type!==c.CloseRouterAbEcdsaPostRegistrationCeremonySuccess)throw Error(`Router A/B ECDSA post-registration ceremony close failed`);return t.payload}async function N(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.StoreThresholdEcdsaRoleLocalSigningMaterial,timeoutMs:g,payload:{materialHandle:e.materialHandle,bindingDigest:e.bindingDigest,stateBlob:e.stateBlob}}});if(t.type!==c.StoreThresholdEcdsaRoleLocalSigningMaterialSuccess)throw Error(`StoreThresholdEcdsaRoleLocalSigningMaterial failed`);return t.payload}function P(e,t){return t.durableMaterialRef===e.durableMaterialRef&&t.bindingDigest===e.bindingDigest}async function F(a){let o=n(a.authority);if(!o)throw Error(`ECDSA role-local signing material authority is invalid`);let l=e(a.materialActivation);if(!l.ok)throw Error(l.error.message);let u=l.value,d=await v({workerCtx:a.workerCtx,request:{type:s.RehydrateEcdsaRoleLocalSigningMaterial,timeoutMs:g,payload:{kind:`open_ecdsa_role_local_signing_material_v1`,authority:o,materialActivation:u}}});if(d.type!==c.RehydrateEcdsaRoleLocalSigningMaterialSuccess)throw Error(`OpenEcdsaRoleLocalSigningMaterial failed`);let f=d.payload;switch(f.kind){case`ecdsa_role_local_signing_material_unavailable_v1`:return{ok:!1,reason:f.reason};case`ecdsa_role_local_signing_material_opened_v1`:{let e=i(f.materialRef);if(!t(u,e.materialActivation))throw Error(`ECDSA role-local signing material open changed its activation identity`);let n=r(f.liveHandle);if(!P(e,n))throw Error(`ECDSA role-local signing material hydration changed its identity`);return{ok:!0,liveHandle:n,materialRef:e}}default:{let e=f;throw Error(`ECDSA role-local signing material hydration response kind is invalid: ${String(e)}`)}}}async function I(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.SignWalletRecoveryEcdsaMaterialPossessionProof,timeoutMs:g,payload:{kind:`sign_wallet_recovery_ecdsa_material_possession_proof_v1`,challenge:e.challenge,stateBlob:e.stateBlob}}});if(t.type!==c.SignWalletRecoveryEcdsaMaterialPossessionProofSuccess)throw Error(`Wallet recovery ECDSA possession proof signing failed`);return t.payload}async function ee(e){let t=await v({workerCtx:e.workerCtx,request:{type:s.PrepareLinkedDeviceEcdsaSourceContribution,timeoutMs:g,payload:{kind:`prepare_linked_device_ecdsa_source_contribution_v1`,preparation:e.preparation,...e.linkedHolderHandleId===void 0?{}:{linkedHolderHandleId:e.linkedHolderHandleId}}}});if(t.type!==c.PrepareLinkedDeviceEcdsaSourceContributionSuccess)throw Error(`Linked-device ECDSA source contribution preparation failed`);return t.payload}function L(e){let t=Array.isArray(e.outgoingMessages)?e.outgoingMessages.map(e=>new Uint8Array(e)):[];switch(e.event){case`final_batch_ready`:return{stage:`presign`,event:e.event,outgoingMessages:t,candidateBigR33:new Uint8Array(e.candidateBigR33)};case`presign_done`:return{stage:`done`,event:e.event,outgoingMessages:t,presignatureHandle:e.presignatureHandle,presignatureBigR33:new Uint8Array(e.presignatureBigR33)};case`none`:case`triples_done`:return{stage:e.stage,event:e.event,outgoingMessages:t}}}async function R(e){let t=e.groupPublicKey33.slice(),n=await b({workerCtx:e.workerCtx,request:{type:l.SessionInit,timeoutMs:g,payload:{authority:{kind:`role_local_derivation_handle`,materialHandle:e.materialHandle,material:e.material},sessionId:e.sessionId,groupPublicKey33:t.buffer,ceremonyExpiresAtMs:e.ceremonyExpiresAtMs,materialExpiresAtMs:e.materialExpiresAtMs,poolIdentity:e.poolIdentity},transfer:[t.buffer]}});if(n.type!==u.SessionInitSuccess)throw Error(`ThresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandle failed`);if(n.payload.authority.kind!==`role_local_derivation_handle`)throw Error(`ECDSA role-local presign returned a different authority`);return L(n.payload.progress)}async function z(e){let t=e.groupPublicKey33.slice(),n=await b({workerCtx:e.workerCtx,request:{type:l.SessionInit,timeoutMs:g,payload:{authority:{kind:`linked_holder_signing_material`,holderHandleId:e.holderHandleId},sessionId:e.sessionId,groupPublicKey33:t.buffer,ceremonyExpiresAtMs:e.ceremonyExpiresAtMs,materialExpiresAtMs:e.materialExpiresAtMs,poolIdentity:e.poolIdentity},transfer:[t.buffer]}});if(n.type!==u.SessionInitSuccess)throw Error(`Linked holder ECDSA presign initialization failed`);if(n.payload.authority.kind!==`linked_holder_signing_material`)throw Error(`Linked holder ECDSA presign returned a different authority`);return L(n.payload.progress)}async function B(e){if(e.holderHandleId.trim().length===0)throw Error(`ECDSA holder handle must be non-empty`);let t=await y({workerCtx:e.workerCtx,request:{type:s.CreateEcdsaHolderOrdinaryExportRequest,timeoutMs:g,payload:{kind:`create_ecdsa_holder_ordinary_export_request_v1`,holderHandleId:e.holderHandleId,request:e.request},transfer:[]}});if(t.type!==c.CreateEcdsaHolderOrdinaryExportRequestSuccess)throw Error(`ECDSA holder ordinary-export request preparation failed`);if(t.payload.holderHandleId!==e.holderHandleId)throw Error(`ECDSA holder ordinary-export request returned a different holder`);if(t.payload.requestDigestB64u.trim().length===0)throw Error(`ECDSA holder ordinary-export request digest is empty`);return t.payload}async function V(e){if(e.holderHandleId.trim().length===0)throw Error(`ECDSA holder handle must be non-empty`);if(e.requestDigestB64u!==e.expectedBinding.export_request_digest_b64u)throw Error(`ECDSA holder ordinary-export request digest differs from its binding`);let t=await y({workerCtx:e.workerCtx,request:{type:s.FinalizeEcdsaHolderOrdinaryExport,timeoutMs:g,payload:{kind:`finalize_ecdsa_holder_ordinary_export_v1`,holderHandleId:e.holderHandleId,requestDigestB64u:e.requestDigestB64u,expectedBinding:e.expectedBinding,forwardedResponse:e.forwardedResponse},transfer:[]}});if(t.type!==c.FinalizeEcdsaHolderOrdinaryExportSuccess)throw Error(`ECDSA holder ordinary-export finalization failed`);if(t.payload.holderHandleId!==e.holderHandleId)throw Error(`ECDSA holder ordinary-export finalization returned a different holder`);return t.payload}async function H(e){if(e.holderHandleId.trim().length===0)throw Error(`Linked holder ECDSA handle must be non-empty`);if(e.ownedSigningShare32.byteLength!==32)throw Error(`Linked holder ECDSA signing share must contain 32 bytes`);if(e.activationReceiptJson.trim().length===0)throw Error(`Linked holder ECDSA activation receipt must be non-empty`);let t=e.ownedSigningShare32.slice();try{let n=await a({kind:`ecdsaDerivationClient`,ctx:e.workerCtx,request:{type:s.StoreLinkedDeviceEcdsaHolderMaterial,timeoutMs:g,payload:{holderHandleId:e.holderHandleId,ownedSigningShare32:t.buffer,activationReceiptJson:e.activationReceiptJson},transfer:[t.buffer]}});if(n.type!==c.StoreLinkedDeviceEcdsaHolderMaterialSuccess)throw Error(`Linked holder ECDSA material import failed`);if(n.payload.holderHandleId!==e.holderHandleId)throw Error(`Linked holder ECDSA material import returned a different handle`);return n.payload}finally{t.byteLength>0&&t.fill(0)}}async function U(e){let t=await a({kind:`ecdsaDerivationClient`,ctx:e.workerCtx,request:{type:s.DisposeLinkedDeviceEcdsaHolderMaterials,timeoutMs:g,payload:e.disposal,transfer:[]}});if(t.type!==c.DisposeLinkedDeviceEcdsaHolderMaterialsSuccess)throw Error(`Linked holder ECDSA material disposal failed`);if(t.payload.kind!==e.disposal.kind)throw Error(`Linked holder ECDSA material disposal returned a different scope`);if(e.disposal.kind===`one`&&t.payload.kind===`one`&&t.payload.holderHandleId!==e.disposal.holderHandleId)throw Error(`Linked holder ECDSA material disposal returned a different handle`)}async function W(e){if(e.holderHandleId.trim().length===0)throw Error(`Linked holder ECDSA handle must be non-empty`);await U({disposal:{kind:`one`,holderHandleId:e.holderHandleId},workerCtx:e.workerCtx})}async function G(e){let t=!1,n;for(let r of e.holderHandleIds)try{await W({holderHandleId:r,workerCtx:e.workerCtx})}catch(e){t||(t=!0,n=e)}if(t)throw n}async function K(e){await U({disposal:{kind:`all`},workerCtx:e.workerCtx})}async function q(e){let t=e.incomingMessages.map(e=>e.slice()),n=t.map(e=>e.buffer),r=await b({workerCtx:e.workerCtx,request:{type:l.SessionStep,timeoutMs:g,payload:{sessionId:e.sessionId,stage:e.stage,incomingMessages:t.map(e=>e.buffer)},transfer:n}});if(r.type!==u.SessionStepSuccess)throw Error(`ThresholdEcdsaRoleLocalPresignSessionStep failed`);return L(r.payload)}async function J(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.SessionAbort,timeoutMs:g,payload:{sessionId:e.sessionId}}});if(t.type!==u.SessionAbortSuccess)throw Error(`ThresholdEcdsaRoleLocalPresignSessionAbort failed`);let n=t.payload;if(n.kind!==`threshold_ecdsa_presign_session_aborted`||n.sessionId!==e.sessionId)throw Error(`ThresholdEcdsaRoleLocalPresignSessionAbort returned invalid result`)}async function Y(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.Admit,timeoutMs:g,payload:{materialHandle:e.materialHandle,expectedPresignatureId:e.expectedPresignatureId,poolIdentity:e.poolIdentity,admissionMode:e.admissionMode}}});if(t.type!==u.AdmitSuccess)throw Error(`ThresholdEcdsaRoleLocalAdmitPresignature failed`);if(t.payload.kind!==`ecdsa_client_presignature_admitted_v1`||t.payload.materialHandle!==e.materialHandle||t.payload.presignatureId!==e.expectedPresignatureId)throw Error(`ThresholdEcdsaRoleLocalAdmitPresignature returned invalid binding`);return t.payload.storage}async function X(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.Destroy,timeoutMs:g,payload:{materialHandle:e.materialHandle,poolIdentity:e.poolIdentity}}});if(t.type!==u.DestroySuccess)throw Error(`ThresholdEcdsaRoleLocalDestroyPresignature failed`);if(t.payload.kind!==`ecdsa_client_presignature_destroyed_v1`||t.payload.materialHandle!==e.materialHandle)throw Error(`ThresholdEcdsaRoleLocalDestroyPresignature returned invalid handle`)}async function Z(e){let t=await b({workerCtx:e.workerCtx,request:{type:l.Reserve,timeoutMs:g,payload:{materialHandle:e.materialHandle,expectedPresignatureId:e.expectedPresignatureId,poolIdentity:e.poolIdentity,requestBinding:e.requestBinding,reservationId:e.reservationId,leaseExpiresAtMs:e.leaseExpiresAtMs}}});if(t.type!==u.ReserveSuccess)throw Error(`ThresholdEcdsaRoleLocalReservePresignature failed`);return t.payload}async function Q(e){if((await b({workerCtx:e.workerCtx,request:{type:l.Commit,timeoutMs:g,payload:{materialHandle:e.materialHandle,poolIdentity:e.poolIdentity,requestBinding:e.requestBinding,reservationId:e.reservationId}}})).type!==u.CommitSuccess)throw Error(`ThresholdEcdsaRoleLocalCommitPresignature failed`)}async function $(e,t){let n=await b({workerCtx:t.workerCtx,request:{type:l.ListAvailable,timeoutMs:g,payload:{authority:{kind:e},poolIdentity:t.poolIdentity}}});if(n.type!==u.ListAvailableSuccess)throw Error(`ThresholdEcdsaListAvailablePresignatures failed`);return n.payload.map(_)}async function te(e){let t=e.groupPublicKey33.slice(),n=e.expectedPresignBigR33.slice(),r=e.digest32.slice(),i=e.clientRerandomizationContribution32.slice(),a=e.signingWorkerRerandomizationContribution32.slice(),o=await x({workerCtx:e.workerCtx,request:{type:d.ComputeSignatureShare,timeoutMs:g,payload:{materialHandle:e.materialHandle,poolIdentity:e.poolIdentity,requestBinding:e.requestBinding,reservationId:e.reservationId,groupPublicKey33:t.buffer,expectedPresignBigR33:n.buffer,digest32:r.buffer,clientRerandomizationContribution32:i.buffer,signingWorkerRerandomizationContribution32:a.buffer},transfer:[t.buffer,n.buffer,r.buffer,i.buffer,a.buffer]}});if(o.type!==f.ComputeSignatureShareSuccess)throw Error(`ThresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandle failed`);return new Uint8Array(o.payload)}export{Z as A,Y as C,J as D,X as E,p as F,o as I,h as L,s as M,c as N,R as O,l as P,m as R,$ as S,te as T,O as _,A as a,H as b,G as c,j as d,E as f,ee as g,S as h,B as i,T as j,q as k,C as l,D as m,M as n,w as o,F as p,k as r,W as s,K as t,V as u,I as v,Q as w,z as x,N as y};