@seams/wallet 0.27.0 → 0.29.0

package/dist/esm/sdk/{walletAuthority-BTGAuOi8.js → walletAuthority-DbGaSw7D.js}

@@ -1 +1 @@
-import{A as e,O as t,d as n,g as r,i,j as a,k as o,u as s}from"./domainIds-t1lp25yU.js";import{C as c,S as l,n as u}from"./digests-BIaE0DMd.js";import{i as d,r as f}from"./base64-BmKR3UqU.js";import{B as ee,D as p,J as m,M as h,O as te,P as g}from"./activeWalletSession-BJ4B-nJo.js";import{l as ne}from"./capabilityKinds-DVlGMspk.js";import{r as _}from"./canonicalPrimitives-Jd3i_Ngz.js";import{Dt as re,F as ie,Ft as ae,Nt as v,a as y,i as oe,jt as b,n as x,o as se,r as ce,s as le,t as S}from"./digestEncoding-CqNXPZY9.js";const ue=[`kind`,`keyFamilies`,`signers`],de=[`kind`,`keyFamily`,`walletId`,`walletKeyId`,`registeredPublicKeyB64u`],fe=[`kind`,`keyFamily`,`walletId`,`walletKeyId`,`thresholdPublicKey33B64u`,`evmAddress`];function C(e){if(e.length===0)throw Error(`exact administered signer manifest must contain at least one active family`);let t,n,r,i=new Set;for(let a of e){if(t!==void 0&&t!==a.walletId)throw Error(`exact administered signer manifest must use one wallet identity`);if(t=a.walletId,i.has(a.walletKeyId))throw Error(`exact administered signer manifest repeats wallet key ${a.walletKeyId}`);switch(i.add(a.walletKeyId),a.keyFamily){case`ed25519`:if(n!==void 0)throw Error(`exact administered signer manifest repeats the ed25519 family`);if(a.kind!==`exact_administered_ed25519_signer_v1`)throw Error(`exact administered signer manifest has an invalid Ed25519 signer`);n=a;break;case`ecdsa_secp256k1`:if(r!==void 0)throw Error(`exact administered signer manifest repeats the ecdsa family`);if(a.kind!==`exact_administered_ecdsa_signer_v1`)throw Error(`exact administered signer manifest has an invalid ECDSA signer`);r=a;break}}if(n!==void 0&&r!==void 0)return{kind:`exact_administered_signer_manifest_v1`,keyFamilies:[`ed25519`,`ecdsa_secp256k1`],signers:[n,r]};if(n!==void 0)return{kind:`exact_administered_signer_manifest_v1`,keyFamilies:[`ed25519`],signers:[n]};if(r!==void 0)return{kind:`exact_administered_signer_manifest_v1`,keyFamilies:[`ecdsa_secp256k1`],signers:[r]};throw Error(`exact administered signer manifest must contain a supported family`)}function pe(e){let t=ve(e,ue,`ExactAdministeredSignerManifestV1`);if(t.kind!==`exact_administered_signer_manifest_v1`)throw Error(`ExactAdministeredSignerManifestV1.kind is invalid`);let n=he(t.keyFamilies);if(!Array.isArray(t.signers))throw Error(`ExactAdministeredSignerManifestV1.signers must be an array`);let r=[];for(let e=0;e<t.signers.length;e+=1)r.push(me(t.signers[e],`signers[${e}]`));let i=C(r);if(!ge(n,i.keyFamilies))throw Error(`ExactAdministeredSignerManifestV1.keyFamilies do not match signers`);return i}function me(t,n){let r=l(t,n);switch(r.keyFamily){case`ed25519`:if(m(r,de,n),r.kind!==`exact_administered_ed25519_signer_v1`)throw Error(`${n}.kind is invalid for Ed25519`);return{kind:`exact_administered_ed25519_signer_v1`,keyFamily:`ed25519`,walletId:g(o(r.walletId),`${n}.walletId`),walletKeyId:g(e(r.walletKeyId),`${n}.walletKeyId`),registeredPublicKeyB64u:p(r.registeredPublicKeyB64u,`${n}.registeredPublicKeyB64u`)};case`ecdsa_secp256k1`:if(m(r,fe,n),r.kind!==`exact_administered_ecdsa_signer_v1`)throw Error(`${n}.kind is invalid for ECDSA`);return{kind:`exact_administered_ecdsa_signer_v1`,keyFamily:`ecdsa_secp256k1`,walletId:g(o(r.walletId),`${n}.walletId`),walletKeyId:g(e(r.walletKeyId),`${n}.walletKeyId`),thresholdPublicKey33B64u:h(r.thresholdPublicKey33B64u,`${n}.thresholdPublicKey33B64u`),evmAddress:_e(r.evmAddress,`${n}.evmAddress`)};default:throw Error(`${n}.keyFamily is unsupported`)}}function he(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`ExactAdministeredSignerManifestV1.keyFamilies must be non-empty`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`ExactAdministeredSignerManifestV1.keyFamilies must be canonical and duplicate-free`)}function ge(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function _e(e,t){if(typeof e!=`string`||!/^0x[0-9a-fA-F]{40}$/.test(e))throw Error(`${t} must be a 20-byte hexadecimal EVM address`);return e}function ve(e,t,n){let r=l(e,n);m(r,t,n);for(let e of t)if(!(e in r))throw Error(`${n}.${e} is required`);return r}const w=new TextEncoder;function T(e,t){if(typeof e!=`string`||e.length===0)throw Error(`${t} must be a non-empty visible ASCII string`);for(let n=0;n<e.length;n+=1){let r=e.charCodeAt(n);if(r<33||r>126)throw Error(`${t} must contain visible ASCII bytes`)}return e}function ye(e,t){if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`${t} must be a byte`);return e}function be(e,t,n,r){if(!Array.isArray(e))throw Error(`${t} must be a byte array`);if(e.length<n||e.length>r)throw Error(`${t} has an invalid length`);let i=[];for(let n=0;n<e.length;n+=1)i.push(ye(e[n],`${t}[${n}]`));return i}function E(e,t,n){let r=be(e,t,32,32);if(n&&xe(r))throw Error(`${t} must be nonzero`);return r}function xe(e){for(let t of e)if(t!==0)return!1;return!0}function D(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function Se(e){let t=new Uint8Array(4);return new DataView(t.buffer).setUint32(0,e,!1),t}function Ce(e){let t=0;for(let n of e)t+=n.length;let n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function we(e){return Ce([Se(e.length),e])}function O(e,t){return Ce([we(w.encode(e)),we(t)])}async function Te(e){let t=await globalThis.crypto.subtle.digest(`SHA-256`,e);return new Uint8Array(t)}async function Ee(e){let t=Ce([we(w.encode(`seams/router-ab/ed25519-yao/application-binding/v1`)),O(`walletId`,w.encode(e.wallet_id)),O(`nearEd25519SigningKeyId`,w.encode(e.near_ed25519_signing_key_id)),O(`signingRootId`,w.encode(e.signing_root_id)),O(`keyCreationSignerSlot`,Se(e.key_creation_signer_slot))]);return Array.from(await Te(t))}const De=`/router-ab/ed25519/yao/registration/admit`,Oe=`/router-ab/ed25519/yao/registration/execute`,ke=`/router-ab/ed25519/yao/recovery/admit`,Ae=`/router-ab/ed25519/yao/recovery/execute`,je=`/router-ab/ed25519/yao/recovery/activate`,Me=`x-seams-wallet-recovery-challenge-id`,Ne=`/router-ab/ed25519/yao/recovery/bootstrap`,Pe=`router_ab_ed25519_yao_email_otp_recovery_v1`,Fe=`/router-ab/ed25519/yao/export/admit`,Ie=`/router-ab/ed25519/yao/export/execute`,Le=64*1024;function Re(e,t){return e.operation===t.operation&&k(e.session_id,t.session_id)&&k(e.stable_key_context_binding,t.stable_key_context_binding)&&ae(e.material_activation,t.material_activation)&&e.lifecycle.lifecycle_id===t.lifecycle.lifecycle_id&&e.lifecycle.work_kind===t.lifecycle.work_kind&&e.lifecycle.primitive_request_kind===t.lifecycle.primitive_request_kind&&e.lifecycle.root_share_epoch===t.lifecycle.root_share_epoch&&e.lifecycle.account_id===t.lifecycle.account_id&&e.lifecycle.session_id===t.lifecycle.session_id&&e.lifecycle.signer_set_id===t.lifecycle.signer_set_id&&e.lifecycle.selected_server_id===t.lifecycle.selected_server_id}function k(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function ze(e,t){return e[0]===t[0]&&e[1]===t[1]}function Be(e,t){return e.lifecycle_id===t.lifecycle_id&&e.root_share_epoch===t.root_share_epoch&&e.account_id===t.account_id&&e.threshold_session_id===t.threshold_session_id&&e.signer_set_id===t.signer_set_id&&e.signing_worker_id===t.signing_worker_id&&ae(e.material_activation,t.material_activation)}function Ve(e,t){return e.wallet_id===t.wallet_id&&e.near_ed25519_signing_key_id===t.near_ed25519_signing_key_id&&e.signing_root_id===t.signing_root_id&&e.key_creation_signer_slot===t.key_creation_signer_slot}function He(e,t){return Be(e.scope,t.scope)&&Ve(e.application_binding,t.application_binding)&&ze(e.participant_ids,t.participant_ids)}const Ue=`registration_prepare`,We=`registration`,Ge=`recovery`,Ke=`recovery`,A=`key_export`,qe=`export`;function j(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`);for(let r of n)if(!Object.hasOwn(e,r))throw Error(`${t}.${r} is required`)}function Je(e,t){if(!Number.isInteger(e)||typeof e!=`number`||e<=0||e>4294967295)throw Error(`${t} must be a positive u32`);return e}function Ye(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe integer`);return e}function Xe(e,t){switch(e){case`registration`:case`recovery`:case`refresh`:case`export`:case`lane_provisioning`:case`lane_refresh`:return e;default:throw Error(`${t} is invalid`)}}function Ze(e,t){switch(e){case`deriver_a`:case`deriver_b`:return e;default:throw Error(`${t} is invalid`)}}function Qe(e,t){switch(e){case`activation`:case`export`:return e;default:throw Error(`${t} is invalid`)}}function $e(e,t){switch(e){case`activation_client`:case`activation_signing_worker`:case`export_client`:return e;default:throw Error(`${t} is invalid`)}}function et(e,t){switch(e){case`registration_prepare`:case`key_export`:case`recovery`:case`server_share_refresh`:return e;default:throw Error(`${t} is invalid`)}}function tt(e,t){switch(e){case`registration`:case`recovery`:case`export`:case`refresh`:return e;default:throw Error(`${t} is invalid`)}}function M(e){let t=l(e,`application_binding`);return j(t,`application_binding`,[`wallet_id`,`near_ed25519_signing_key_id`,`signing_root_id`,`key_creation_signer_slot`]),{wallet_id:T(t.wallet_id,`application_binding.wallet_id`),near_ed25519_signing_key_id:T(t.near_ed25519_signing_key_id,`application_binding.near_ed25519_signing_key_id`),signing_root_id:T(t.signing_root_id,`application_binding.signing_root_id`),key_creation_signer_slot:Je(t.key_creation_signer_slot,`application_binding.key_creation_signer_slot`)}}function nt(e){let t=l(e,`scope`);j(t,`scope`,[`lifecycle_id`,`root_share_epoch`,`account_id`,`threshold_session_id`,`signer_set_id`,`signing_worker_id`,`material_activation`]);let n=T(t.account_id,`scope.account_id`),r=T(t.signing_worker_id,`scope.signing_worker_id`),i=b(t.material_activation);if(i.material_owner!==n||i.signing_worker!==r)throw Error(`scope.material_activation does not match the lifecycle owner and worker`);return{lifecycle_id:T(t.lifecycle_id,`scope.lifecycle_id`),root_share_epoch:T(t.root_share_epoch,`scope.root_share_epoch`),account_id:n,threshold_session_id:T(t.threshold_session_id,`scope.threshold_session_id`),signer_set_id:T(t.signer_set_id,`scope.signer_set_id`),signing_worker_id:r,material_activation:i}}function rt(e){if(!Array.isArray(e)||e.length!==2)throw Error(`participant_ids must contain exactly two values`);let t=Je(e[0],`participant_ids[0]`),n=Je(e[1],`participant_ids[1]`);if(t>65535||n>65535||t>=n)throw Error(`participant_ids must be distinct, nonzero, ascending u16 values`);return[t,n]}function it(e){return rt(e)}function at(e){let t=l(e,`binding.lifecycle`);j(t,`binding.lifecycle`,[`lifecycle_id`,`work_kind`,`primitive_request_kind`,`root_share_epoch`,`account_id`,`session_id`,`signer_set_id`,`selected_server_id`]);let n={lifecycle_id:T(t.lifecycle_id,`binding.lifecycle.lifecycle_id`),work_kind:et(t.work_kind,`binding.lifecycle.work_kind`),primitive_request_kind:tt(t.primitive_request_kind,`binding.lifecycle.primitive_request_kind`),root_share_epoch:T(t.root_share_epoch,`binding.lifecycle.root_share_epoch`),account_id:T(t.account_id,`binding.lifecycle.account_id`),session_id:T(t.session_id,`binding.lifecycle.session_id`),signer_set_id:T(t.signer_set_id,`binding.lifecycle.signer_set_id`),selected_server_id:T(t.selected_server_id,`binding.lifecycle.selected_server_id`)};if(n.work_kind===Ue&&n.primitive_request_kind!==We||n.work_kind===Ge&&n.primitive_request_kind!==Ke||n.work_kind===A&&n.primitive_request_kind!==qe)throw Error(`binding.lifecycle primitive request kind does not match its work kind`);return n}function ot(e){let t=l(e,`binding`);j(t,`binding`,[`lifecycle`,`operation`,`session_id`,`stable_key_context_binding`,`material_activation`]);let n={lifecycle:at(t.lifecycle),operation:Xe(t.operation,`binding.operation`),session_id:E(t.session_id,`binding.session_id`,!0),stable_key_context_binding:E(t.stable_key_context_binding,`binding.stable_key_context_binding`,!1),material_activation:b(t.material_activation)};if(n.operation===`registration`&&n.lifecycle.work_kind!==Ue||n.operation===`recovery`&&n.lifecycle.work_kind!==Ge||n.operation===`export`&&n.lifecycle.work_kind!==A)throw Error(`binding operation does not match its lifecycle work kind`);if(n.material_activation.material_owner!==n.lifecycle.account_id||n.material_activation.signing_worker!==n.lifecycle.selected_server_id)throw Error(`binding material activation does not match its lifecycle owner and worker`);return n}function st(e){return ot(e)}function ct(e){let t=ot(e);if(t.operation!==`export`||t.lifecycle.work_kind!==A||t.lifecycle.primitive_request_kind!==qe)throw Error(`export binding requires the exact export lifecycle`);return{lifecycle:{lifecycle_id:t.lifecycle.lifecycle_id,work_kind:A,primitive_request_kind:qe,root_share_epoch:t.lifecycle.root_share_epoch,account_id:t.lifecycle.account_id,session_id:t.lifecycle.session_id,signer_set_id:t.lifecycle.signer_set_id,selected_server_id:t.lifecycle.selected_server_id},operation:`export`,session_id:t.session_id,stable_key_context_binding:t.stable_key_context_binding,material_activation:t.material_activation}}function lt(e){let t=l(e,`export binding`);return j(t,`export binding`,[`ceremony`,`registered_public_key`,`state_epoch`,`runtime_policy_binding`,`authorization_digest`]),{ceremony:ct(t.ceremony),registered_public_key:E(t.registered_public_key,`export binding.registered_public_key`,!0),state_epoch:Ye(t.state_epoch,`export binding.state_epoch`),runtime_policy_binding:E(t.runtime_policy_binding,`export binding.runtime_policy_binding`,!0),authorization_digest:E(t.authorization_digest,`export binding.authorization_digest`,!0)}}function N(e){let t=ot(e);switch(t.operation){case`registration`:if(t.lifecycle.work_kind!==Ue||t.lifecycle.primitive_request_kind!==We)throw Error(`activation binding has the wrong registration lifecycle kind`);return{lifecycle:{lifecycle_id:t.lifecycle.lifecycle_id,work_kind:Ue,primitive_request_kind:We,root_share_epoch:t.lifecycle.root_share_epoch,account_id:t.lifecycle.account_id,session_id:t.lifecycle.session_id,signer_set_id:t.lifecycle.signer_set_id,selected_server_id:t.lifecycle.selected_server_id},operation:`registration`,session_id:t.session_id,stable_key_context_binding:t.stable_key_context_binding,material_activation:t.material_activation};case`recovery`:if(t.lifecycle.work_kind!==Ge||t.lifecycle.primitive_request_kind!==Ke)throw Error(`activation binding has the wrong recovery lifecycle kind`);return{lifecycle:{lifecycle_id:t.lifecycle.lifecycle_id,work_kind:Ge,primitive_request_kind:Ke,root_share_epoch:t.lifecycle.root_share_epoch,account_id:t.lifecycle.account_id,session_id:t.lifecycle.session_id,signer_set_id:t.lifecycle.signer_set_id,selected_server_id:t.lifecycle.selected_server_id},operation:`recovery`,session_id:t.session_id,stable_key_context_binding:t.stable_key_context_binding,material_activation:t.material_activation};case`refresh`:case`export`:case`lane_provisioning`:case`lane_refresh`:throw Error(`activation binding has a non-activation operation`)}}function ut(e){let t=l(e,`keyset`);j(t,`keyset`,[`deriver_a_input_public_key`,`deriver_b_input_public_key`,`signing_worker_recipient_public_key`]);let n={deriver_a_input_public_key:E(t.deriver_a_input_public_key,`keyset.deriver_a_input_public_key`,!0),deriver_b_input_public_key:E(t.deriver_b_input_public_key,`keyset.deriver_b_input_public_key`,!0),signing_worker_recipient_public_key:E(t.signing_worker_recipient_public_key,`keyset.signing_worker_recipient_public_key`,!0)};if(D(n.deriver_a_input_public_key,n.deriver_b_input_public_key)||D(n.deriver_a_input_public_key,n.signing_worker_recipient_public_key)||D(n.deriver_b_input_public_key,n.signing_worker_recipient_public_key))throw Error(`keyset public keys must be distinct`);return n}function dt(e,t){let n=l(e,t);j(n,t,[`kind`,`deriver`,`operation`,`session`,`stable_context_binding`,`encapsulated_key`,`ciphertext`]);let r={kind:Qe(n.kind,`${t}.kind`),deriver:Ze(n.deriver,`${t}.deriver`),operation:Xe(n.operation,`${t}.operation`),session:E(n.session,`${t}.session`,!0),stable_context_binding:E(n.stable_context_binding,`${t}.stable_context_binding`,!0),encapsulated_key:E(n.encapsulated_key,`${t}.encapsulated_key`,!0),ciphertext:be(n.ciphertext,`${t}.ciphertext`,16,Le)};if(r.kind===`activation`&&r.operation===`export`||r.kind===`export`&&r.operation!==`export`)throw Error(`${t} operation does not match its circuit family`);return r}function ft(e,t,n,r){if(t.kind!==`activation`||t.deriver!==n||t.operation!==e.operation||!D(t.session,e.session_id)||!D(t.stable_context_binding,e.stable_key_context_binding))throw Error(`${r} does not match the admitted activation binding`);switch(e.operation){case`registration`:return{kind:`activation`,deriver:n,operation:`registration`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext};case`recovery`:return{kind:`activation`,deriver:n,operation:`recovery`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext}}}function pt(e,t,n,r){if(t.kind!==`export`||t.deriver!==n||t.operation!==`export`||!D(t.session,e.ceremony.session_id)||!D(t.stable_context_binding,e.ceremony.stable_key_context_binding))throw Error(`${r} does not match the admitted export binding`);return{kind:`export`,deriver:n,operation:`export`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext}}function P(e,t){let n=l(e,t);return j(n,t,[`kind`,`deriver`,`session`,`transcript`,`encapsulated_key`,`ciphertext`]),{kind:$e(n.kind,`${t}.kind`),deriver:Ze(n.deriver,`${t}.deriver`),session:E(n.session,`${t}.session`,!0),transcript:E(n.transcript,`${t}.transcript`,!0),encapsulated_key:E(n.encapsulated_key,`${t}.encapsulated_key`,!0),ciphertext:be(n.ciphertext,`${t}.ciphertext`,16,Le)}}function F(e){let t=l(e,`public_receipt`);return j(t,`public_receipt`,[`transcript`,`registered_public_key`,`joined_client_commitment`,`joined_signing_worker_commitment`,`signing_worker_verifying_share`,`state_epoch`,`material_activation`]),{transcript:E(t.transcript,`public_receipt.transcript`,!0),registered_public_key:E(t.registered_public_key,`public_receipt.registered_public_key`,!0),joined_client_commitment:E(t.joined_client_commitment,`public_receipt.joined_client_commitment`,!0),joined_signing_worker_commitment:E(t.joined_signing_worker_commitment,`public_receipt.joined_signing_worker_commitment`,!0),signing_worker_verifying_share:E(t.signing_worker_verifying_share,`public_receipt.signing_worker_verifying_share`,!0),state_epoch:Ye(t.state_epoch,`public_receipt.state_epoch`),material_activation:b(t.material_activation)}}function mt(e,t,n,r,i){if(n.kind!==`activation_client`||n.deriver!==r||!D(n.session,e.session_id)||!D(n.transcript,t.transcript))throw Error(`${i} does not match the terminal activation receipt`);return{kind:`activation_client`,deriver:r,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function ht(e,t,n,r,i){if(n.kind!==`export_client`||n.deriver!==r||!D(n.session,e.ceremony.session_id)||!D(n.transcript,t))throw Error(`${i} does not match the terminal export result`);return{kind:`export_client`,deriver:r,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function I(e,t){try{return{ok:!0,value:e(t)}}catch(e){return{ok:!1,code:`invalid_body`,message:e instanceof Error?e.message:String(e)}}}function gt(e){let t=l(e,`registration admission request`);return j(t,`registration admission request`,[`scope`,`application_binding`,`participant_ids`]),{scope:nt(t.scope),application_binding:M(t.application_binding),participant_ids:rt(t.participant_ids)}}function _t(e){let t=l(e,`recovery admission request`);j(t,`recovery admission request`,[`scope`,`active_material_activation`,`application_binding`,`participant_ids`,`active_capability_binding`,`replacement_capability_binding`,`registered_public_key`]);let n=E(t.active_capability_binding,`recovery admission request.active_capability_binding`,!0),r=E(t.replacement_capability_binding,`recovery admission request.replacement_capability_binding`,!0);if(D(n,r))throw Error(`recovery replacement capability binding must be fresh`);let i=nt(t.scope),a=b(t.active_material_activation),o=i.material_activation;if(a.activation_id===o.activation_id||a.lifecycle_binding===o.lifecycle_binding)throw Error(`recovery replacement material activation identity must be fresh`);if(a.capability!==o.capability||a.material_owner!==o.material_owner||a.key_binding!==o.key_binding||a.signing_worker!==o.signing_worker)throw Error(`recovery replacement material activation changed stable identity facts`);return{scope:i,active_material_activation:a,application_binding:M(t.application_binding),participant_ids:rt(t.participant_ids),active_capability_binding:n,replacement_capability_binding:r,registered_public_key:E(t.registered_public_key,`recovery admission request.registered_public_key`,!0)}}function vt(e){let t=l(e,`warm recovery bootstrap request`);if(j(t,`warm recovery bootstrap request`,[`kind`,`walletId`,`nearAccountId`,`nearEd25519SigningKeyId`,`signerSlot`,`thresholdSessionId`,`signingWorkerId`,`participantIds`]),t.kind!==`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`)throw Error(`warm recovery bootstrap request.kind is invalid`);return{kind:`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`,walletId:T(t.walletId,`warm recovery bootstrap request.walletId`),nearAccountId:T(t.nearAccountId,`warm recovery bootstrap request.nearAccountId`),nearEd25519SigningKeyId:T(t.nearEd25519SigningKeyId,`warm recovery bootstrap request.nearEd25519SigningKeyId`),signerSlot:Ye(t.signerSlot,`warm recovery bootstrap request.signerSlot`),thresholdSessionId:T(t.thresholdSessionId,`warm recovery bootstrap request.thresholdSessionId`),signingWorkerId:T(t.signingWorkerId,`warm recovery bootstrap request.signingWorkerId`),participantIds:rt(t.participantIds)}}function yt(e){let t=l(e,`export admission receipt`);return j(t,`export admission receipt`,[`binding`,`keyset`]),{binding:lt(t.binding),keyset:ut(t.keyset)}}function bt(e){let t=l(e,`export execute request`);j(t,`export execute request`,[`binding`,`deriver_a_input`,`deriver_b_input`]);let n=lt(t.binding);return{binding:n,deriver_a_input:pt(n,dt(t.deriver_a_input,`deriver_a_input`),`deriver_a`,`deriver_a_input`),deriver_b_input:pt(n,dt(t.deriver_b_input,`deriver_b_input`),`deriver_b`,`deriver_b_input`)}}function xt(e){let t=l(e,`export result`);j(t,`export result`,[`binding`,`transcript`,`deriver_a_client_package`,`deriver_b_client_package`]);let n=lt(t.binding),r=E(t.transcript,`export result.transcript`,!0);return{binding:n,transcript:r,deriver_a_client_package:ht(n,r,P(t.deriver_a_client_package,`deriver_a_client_package`),`deriver_a`,`deriver_a_client_package`),deriver_b_client_package:ht(n,r,P(t.deriver_b_client_package,`deriver_b_client_package`),`deriver_b`,`deriver_b_client_package`)}}function St(e){let t=l(e,`activation admission receipt`);j(t,`activation admission receipt`,[`binding`,`keyset`]);let n=N(t.binding),r=ut(t.keyset);switch(n.operation){case`registration`:return{binding:n,keyset:r};case`recovery`:return{binding:n,keyset:r}}}function Ct(e){let t=l(e,`activation execute request`);j(t,`activation execute request`,[`binding`,`deriver_a_input`,`deriver_b_input`]);let n=N(t.binding),r=ft(n,dt(t.deriver_a_input,`deriver_a_input`),`deriver_a`,`deriver_a_input`),i=ft(n,dt(t.deriver_b_input,`deriver_b_input`),`deriver_b`,`deriver_b_input`);if(n.operation===`registration`){if(r.operation!==`registration`||i.operation!==`registration`)throw Error(`activation inputs do not match registration binding`);return{binding:n,deriver_a_input:r,deriver_b_input:i}}if(r.operation!==`recovery`||i.operation!==`recovery`)throw Error(`activation inputs do not match recovery binding`);return{binding:n,deriver_a_input:r,deriver_b_input:i}}function wt(e){let t=l(e,`activation result`);j(t,`activation result`,[`binding`,`deriver_a_client_package`,`deriver_b_client_package`,`public_receipt`]);let n=N(t.binding),r=F(t.public_receipt);if(!ae(n.material_activation,r.material_activation))throw Error(`activation result receipt material does not match the admitted binding`);let i=P(t.deriver_a_client_package,`deriver_a_client_package`),a=P(t.deriver_b_client_package,`deriver_b_client_package`),o=mt(n,r,i,`deriver_a`,`deriver_a_client_package`),s=mt(n,r,a,`deriver_b`,`deriver_b_client_package`);switch(n.operation){case`registration`:return{binding:n,deriver_a_client_package:o,deriver_b_client_package:s,public_receipt:r};case`recovery`:return{binding:n,deriver_a_client_package:o,deriver_b_client_package:s,public_receipt:r}}}function Tt(e){let t=N(e);switch(t.operation){case`registration`:throw Error(`recovery activation requires a recovery binding`);case`recovery`:return t}}function Et(e){let t=l(e,`recovery activation receipt`);j(t,`recovery activation receipt`,[`binding`,`public_receipt`,`active_capability_binding`,`retired_capability_binding`]);let n=E(t.active_capability_binding,`recovery activation receipt.active_capability_binding`,!0),r=E(t.retired_capability_binding,`recovery activation receipt.retired_capability_binding`,!0);if(D(n,r))throw Error(`recovery activation receipt capability bindings must be distinct`);return{binding:Tt(t.binding),public_receipt:F(t.public_receipt),active_capability_binding:n,retired_capability_binding:r}}function Dt(e,t){return e.binding.operation===t}function Ot(e,t){return e.binding.operation===t}function kt(e,t){return e.binding.operation===t}function L(e){return{ok:!1,code:`invalid_body`,message:`activation value must use the ${e} operation`}}function At(e){return I(gt,e)}function jt(e){return I(_t,e)}function Mt(e){return I(vt,e)}function Nt(e){return I(yt,e)}function Pt(e){return I(bt,e)}function Ft(e){return I(xt,e)}function It(e){return I(St,e)}function Lt(e){let t=It(e);return t.ok?Dt(t.value,`registration`)?{ok:!0,value:t.value}:L(`registration`):t}function Rt(e){let t=It(e);return t.ok?Dt(t.value,`recovery`)?{ok:!0,value:t.value}:L(`recovery`):t}function zt(e){return I(Ct,e)}function Bt(e){let t=zt(e);return t.ok?Ot(t.value,`registration`)?{ok:!0,value:t.value}:L(`registration`):t}function Vt(e){let t=zt(e);return t.ok?Ot(t.value,`recovery`)?{ok:!0,value:t.value}:L(`recovery`):t}function Ht(e){return I(wt,e)}function Ut(e){let t=Ht(e);return t.ok?kt(t.value,`registration`)?{ok:!0,value:t.value}:L(`registration`):t}function Wt(e){let t=Ht(e);return t.ok?kt(t.value,`recovery`)?{ok:!0,value:t.value}:L(`recovery`):t}function Gt(e){return I(Et,e)}function Kt(e){return I(qt,e)}function qt(e){return P(e,`encrypted_package`)}const Jt=`seams/linked-device/ecdsa-source-contribution-envelope/v1`;function Yt(e){let t=c(e,`linked-device ordinary source contribution`);switch(t.kind){case`linked_device_ed25519_source_contribution_v1`:return nn(t);case`linked_device_ecdsa_source_contribution_v1`:return rn(t);default:throw Error(`linked-device ordinary source contribution kind is invalid`)}}function Xt(e){let t=q(e,[`state`,`reservation_id`,`participant_ids`,`activation_receipt`,`deriver_a_client_package`,`deriver_b_client_package`],`linked-device Ed25519 source-preserving reservation`);if(t.state!==`inactive`)throw Error(`linked-device Ed25519 source-preserving reservation is not inactive`);let n=F(t.activation_receipt),r=it(t.participant_ids),i=R(t.deriver_a_client_package,`deriver_a`),a=R(t.deriver_b_client_package,`deriver_b`);if(!k(n.transcript,i.transcript)||!k(n.transcript,a.transcript))throw Error(`linked-device Ed25519 reservation packages have mismatched transcripts`);return{state:`inactive`,reservationId:K(t.reservation_id,`reservation_id`),participantIds:r,activationReceipt:n,deriver_a_client_package:i,deriver_b_client_package:a}}function Zt(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`linked-device ordinary source contributions must contain one or two entries`);let t=e.map(Yt),n=t.map(e=>e.keyFamily);if(new Set(n).size!==n.length)throw Error(`linked-device ordinary source contributions repeat a key family`);if(t.length===2&&(t[0]?.keyFamily!==`ed25519`||t[1]?.keyFamily!==`ecdsa_secp256k1`))throw Error(`linked-device ordinary source contributions must be Ed25519 then ECDSA`);let r=t[0];if(!r)throw Error(`linked-device ordinary source contributions are empty`);return[r,...t.slice(1)]}function Qt(e){let t=q(e,[`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`source`,`target`],`linked-device ECDSA source contribution preparation`),n=fn(t.source),r=pn(t.target);return bn(n.activation,r.activation),{linkSessionId:B(t.linkSessionId),enrollmentId:V(t.enrollmentId),sourceAuthorityId:H(t.sourceAuthorityId),source:n,target:r}}function $t(e){let t=c(e,`linked-device ordinary source contribution preparation`);if(t.kind===`linked_device_ed25519_source_contribution_preparation_v1`)return tn(t);if(Object.prototype.hasOwnProperty.call(t,`source`)&&Object.prototype.hasOwnProperty.call(t,`target`))return Qt(t);throw Error(`linked-device ordinary source contribution preparation family is invalid`)}function en(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`linked-device ordinary source contribution preparations must contain one or two entries`);let t=e.map($t),n=t.map(e=>`kind`in e?`ed25519`:`ecdsa_secp256k1`);if(new Set(n).size!==n.length)throw Error(`linked-device ordinary source contribution preparations repeat a key family`);if(t.length===2&&(n[0]!==`ed25519`||n[1]!==`ecdsa_secp256k1`))throw Error(`linked-device ordinary source contribution preparations must be ordered Ed25519 then ECDSA`);let r=t[0];if(!r)throw Error(`linked-device ordinary source contribution preparation is empty`);return[r,...t.slice(1)]}function tn(e){if(q(e,[`kind`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`sourceBinding`,`targetAdmission`,`applicationBinding`,`sourceRevocationEpoch`,`participantIds`,`targetMaterialActivation`,`targetClientRecipientPublicKeyB64u`,`targetSigningWorkerRecipientPublicKeyB64u`,`sourceRegisteredPublicKeyB64u`],`linked-device Ed25519 source contribution preparation`),e.kind!==`linked_device_ed25519_source_contribution_preparation_v1`)throw Error(`linked-device Ed25519 source contribution preparation kind is invalid`);let t=N(e.sourceBinding),n=Lt(e.targetAdmission);if(!n.ok)throw Error(`targetAdmission ${n.message}`);let r=n.value,a=M(e.applicationBinding);if(typeof e.sourceRevocationEpoch!=`number`||!Number.isSafeInteger(e.sourceRevocationEpoch)||e.sourceRevocationEpoch<0)throw Error(`sourceRevocationEpoch must be a non-negative safe integer`);let o=z(e.targetMaterialActivation,`targetMaterialActivation`),s=B(e.linkSessionId),c=V(e.enrollmentId),l=H(e.sourceAuthorityId),u=Sn(e.walletKeyId),d=U(e.targetDeviceId),f=W(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),ee=G(e.targetClientRecipientPublicKeyB64u,32,`targetClientRecipientPublicKeyB64u`),m=G(e.targetSigningWorkerRecipientPublicKeyB64u,32,`targetSigningWorkerRecipientPublicKeyB64u`);if(ee===m)throw Error(`linked-device Ed25519 source contribution recipients must differ`);let h=it(e.participantIds);if(_n(t,s,`sourceBinding`),!i(o,v(r.binding.material_activation)))throw Error(`targetAdmission activation differs from targetMaterialActivation`);if(!vn(t,r.binding))throw Error(`source and target Ed25519 contribution bindings differ`);if(t.material_activation.activation_id===o.activationId)throw Error(`source and target Ed25519 contribution activations must differ`);return{kind:`linked_device_ed25519_source_contribution_preparation_v1`,linkSessionId:s,enrollmentId:c,sourceAuthorityId:l,walletKeyId:u,targetDeviceId:d,targetFactorVerificationDigestB64u:f,sourceBinding:t,targetAdmission:r,applicationBinding:a,sourceRevocationEpoch:e.sourceRevocationEpoch,participantIds:h,targetMaterialActivation:o,targetClientRecipientPublicKeyB64u:ee,targetSigningWorkerRecipientPublicKeyB64u:m,sourceRegisteredPublicKeyB64u:p(e.sourceRegisteredPublicKeyB64u,`sourceRegisteredPublicKeyB64u`)}}function nn(e){if(q(e,[`kind`,`keyFamily`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`targetMaterialActivation`,`targetClientRecipientPublicKeyB64u`,`targetSigningWorkerRecipientPublicKeyB64u`,`sourceBinding`,`reservationId`,`targetBinding`,`activationReceipt`,`participantIds`,`deriver_a_client_package`,`deriver_b_client_package`,`sourceRegisteredPublicKeyB64u`],`linked-device Ed25519 source contribution`),e.kind!==`linked_device_ed25519_source_contribution_v1`)throw Error(`linked-device Ed25519 source contribution kind is invalid`);if(e.keyFamily!==`ed25519`)throw Error(`linked-device Ed25519 source contribution family is invalid`);let t=N(e.sourceBinding),n=z(e.targetMaterialActivation,`source contribution targetMaterialActivation`),r=hn(e.targetBinding,`targetBinding`),a=F(e.activationReceipt),o=K(e.reservationId,`reservationId`),s=it(e.participantIds),c=B(e.linkSessionId),l=V(e.enrollmentId),u=H(e.sourceAuthorityId),d=Sn(e.walletKeyId),ee=U(e.targetDeviceId),m=W(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),h=G(e.targetClientRecipientPublicKeyB64u,32,`targetClientRecipientPublicKeyB64u`),te=G(e.targetSigningWorkerRecipientPublicKeyB64u,32,`targetSigningWorkerRecipientPublicKeyB64u`);if(h===te)throw Error(`linked-device Ed25519 source contribution recipients must differ`);if(_n(t,c,`sourceBinding`),gn(r,c,n,`targetBinding`),!vn(t,r))throw Error(`linked-device Ed25519 source contribution stable identity differs`);if(!i(v(a.material_activation),n))throw Error(`linked-device Ed25519 source contribution receipt activation differs`);let g=p(e.sourceRegisteredPublicKeyB64u,`sourceRegisteredPublicKeyB64u`);if(!k(a.registered_public_key,Array.from(f(g))))throw Error(`linked-device Ed25519 source contribution receipt public key differs`);let ne=R(e.deriver_a_client_package,`deriver_a`),_=R(e.deriver_b_client_package,`deriver_b`);if(!k(a.transcript,ne.transcript)||!k(a.transcript,_.transcript))throw Error(`linked-device Ed25519 source contribution package transcript differs`);if(t.material_activation.activation_id===n.activationId)throw Error(`linked-device Ed25519 source contribution reuses the source activation`);return{kind:`linked_device_ed25519_source_contribution_v1`,keyFamily:`ed25519`,linkSessionId:c,enrollmentId:l,sourceAuthorityId:u,walletKeyId:d,targetDeviceId:ee,targetFactorVerificationDigestB64u:m,targetMaterialActivation:n,targetClientRecipientPublicKeyB64u:h,targetSigningWorkerRecipientPublicKeyB64u:te,sourceBinding:t,reservationId:o,targetBinding:r,activationReceipt:a,participantIds:s,deriver_a_client_package:ne,deriver_b_client_package:_,sourceRegisteredPublicKeyB64u:g}}function rn(e){if(q(e,[`kind`,`keyFamily`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`sourceSigner`,`sourceDerivation`,`target`,`package`],`linked-device ECDSA source contribution`),e.kind!==`linked_device_ecdsa_source_contribution_v1`)throw Error(`linked-device ECDSA source contribution kind is invalid`);if(e.keyFamily!==`ecdsa_secp256k1`)throw Error(`linked-device ECDSA source contribution family is invalid`);let t=B(e.linkSessionId),n=V(e.enrollmentId),r=H(e.sourceAuthorityId),i=Sn(e.walletKeyId),a=U(e.targetDeviceId),o=W(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),s=fn(e.sourceSigner),c=an(e.sourceDerivation),l=pn(e.target);bn(s.activation,l.activation);let u=un(e.package);if(u.binding.linkSessionId!==t||u.binding.enrollmentId!==n||u.binding.sourceAuthorityId!==r||u.binding.target.targetDeviceId!==a||u.binding.target.targetFactorVerificationDigestB64u!==o)throw Error(`linked-device ECDSA source contribution package binding differs`);if(!yn(u.binding.source,s))throw Error(`linked-device ECDSA source contribution signer differs from package binding`);if(!xn(u.binding.target,l))throw Error(`linked-device ECDSA source contribution target differs from package binding`);return{kind:`linked_device_ecdsa_source_contribution_v1`,keyFamily:`ecdsa_secp256k1`,linkSessionId:t,enrollmentId:n,sourceAuthorityId:r,walletKeyId:i,targetDeviceId:a,targetFactorVerificationDigestB64u:o,sourceSigner:s,sourceDerivation:c,target:l,package:u}}function an(e){let t=q(e,[`applicationBindingDigestB64u`,`clientShareRetryCounter`,`ecdsaThresholdKeyId`,`sourceNormalSigning`],`linked-device ECDSA source derivation`),n=t.clientShareRetryCounter;if(typeof n!=`number`||!Number.isSafeInteger(n)||n<0)throw Error(`linked-device ECDSA source derivation retry counter is invalid`);let r=W(t.applicationBindingDigestB64u,`sourceDerivation.applicationBindingDigestB64u`),i=ie(t.sourceNormalSigning),a=re(t.ecdsaThresholdKeyId);if(i.scope.context.application_binding_digest_b64u!==r||i.scope.public_identity.client_share_retry_counter!==n||i.scope.ecdsa_threshold_key_id!==a)throw Error(`linked-device ECDSA source derivation differs from normal signing`);return{applicationBindingDigestB64u:r,clientShareRetryCounter:n,ecdsaThresholdKeyId:a,sourceNormalSigning:i}}function on(e){let t=q(e,[`state`,`binding`,`sourceDerivation`,`targetRelayerPublicKey33B64u`,`thresholdPublicKey33B64u`,`thresholdEthereumAddress20B64u`,`normalSigning`],`linked-device ECDSA source-preserving activation receipt`);if(t.state!==`inactive`)throw Error(`linked-device ECDSA source-preserving activation receipt is not inactive`);let n=dn(t.binding),r=an(t.sourceDerivation),i=h(t.targetRelayerPublicKey33B64u,`targetRelayerPublicKey33B64u`),a=h(t.thresholdPublicKey33B64u,`thresholdPublicKey33B64u`),o=G(t.thresholdEthereumAddress20B64u,20,`thresholdEthereumAddress20B64u`),s=ie(t.normalSigning);return sn({binding:n,sourceDerivation:r,targetRelayerPublicKey33B64u:i,thresholdPublicKey33B64u:a,thresholdEthereumAddress20B64u:o,normalSigning:s}),{state:`inactive`,binding:n,sourceDerivation:r,targetRelayerPublicKey33B64u:i,thresholdPublicKey33B64u:a,thresholdEthereumAddress20B64u:o,normalSigning:s}}function sn(e){let t=e.sourceDerivation.sourceNormalSigning.scope,n=e.normalSigning.scope;if(!i(v(t.material_activation),e.binding.source.activation)||!i(v(n.material_activation),e.binding.target.activation)||t.wallet_id!==n.wallet_id||t.wallet_id!==e.binding.source.activation.materialOwner||n.wallet_id!==e.binding.target.activation.materialOwner||t.ecdsa_threshold_key_id!==n.ecdsa_threshold_key_id||t.signing_root_id!==n.signing_root_id||t.signing_root_version!==n.signing_root_version||t.context.application_binding_digest_b64u!==n.context.application_binding_digest_b64u||t.activation_epoch!==n.activation_epoch||t.public_identity.derivation_client_share_public_key33_b64u!==e.binding.source.clientPublicKey33B64u||t.public_identity.server_public_key33_b64u!==e.binding.source.relayerPublicKey33B64u||t.public_identity.threshold_public_key33_b64u!==e.binding.source.thresholdPublicKey33B64u||t.public_identity.ethereum_address20_b64u!==e.binding.source.thresholdEthereumAddress20B64u||n.public_identity.context_binding_b64u!==t.public_identity.context_binding_b64u||n.public_identity.derivation_client_share_public_key33_b64u!==e.binding.targetClientPublicKey33B64u||n.public_identity.server_public_key33_b64u!==e.targetRelayerPublicKey33B64u||n.public_identity.threshold_public_key33_b64u!==e.thresholdPublicKey33B64u||n.public_identity.ethereum_address20_b64u!==e.thresholdEthereumAddress20B64u||n.public_identity.client_share_retry_counter!==t.public_identity.client_share_retry_counter||n.public_identity.server_share_retry_counter!==t.public_identity.server_share_retry_counter||n.signing_worker.server_id!==e.binding.target.activation.signingWorker||n.signing_worker.key_epoch!==t.signing_worker.key_epoch||n.signing_worker.recipient_encryption_key!==cn(e.binding.target.signingWorkerRecipientPublicKeyB64u))throw Error(`linked-device ECDSA normal signing state differs from its activation receipt`)}function cn(e){let t=f(e);if(t.length!==32||d(t)!==e)throw Error(`linked-device signing-worker recipient key is invalid`);let n=``;for(let e of t)n+=e.toString(16).padStart(2,`0`);return`x25519:${n}`}function R(e,t){let n=ln(e,`${t} client package`);if(n.kind!==`activation_client`||n.deriver!==t)throw Error(`${t} client package is not an activation client package`);return t===`deriver_a`?{kind:`activation_client`,deriver:`deriver_a`,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}:{kind:`activation_client`,deriver:`deriver_b`,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function ln(e,t){let n=Kt(e);if(!n.ok)throw Error(`${t} ${n.message}`);return n.value}function un(e){let t=q(e,[`binding`,`encryptedDelta`,`encryptedTargetClientShare`],`linked-device ECDSA source contribution package`),n=dn(t.binding),r=mn(t.encryptedDelta,`encryptedDelta`),i=mn(t.encryptedTargetClientShare,`encryptedTargetClientShare`),a=r.bindingDigestB64u;if(i.bindingDigestB64u!==a)throw Error(`linked-device ECDSA source contribution envelope bindings differ`);if(r.recipientPublicKeyB64u!==n.target.signingWorkerRecipientPublicKeyB64u||i.recipientPublicKeyB64u!==n.target.clientRecipientPublicKeyB64u)throw Error(`linked-device ECDSA source contribution envelope recipients differ`);return{binding:n,encryptedDelta:r,encryptedTargetClientShare:i}}function dn(e){let t=q(e,[`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`source`,`target`,`targetClientPublicKey33B64u`],`linked-device ECDSA source contribution binding`),n=fn(t.source),r=pn(t.target);return bn(n.activation,r.activation),{linkSessionId:K(t.linkSessionId,`binding.linkSessionId`),enrollmentId:K(t.enrollmentId,`binding.enrollmentId`),sourceAuthorityId:K(t.sourceAuthorityId,`binding.sourceAuthorityId`),source:n,target:r,targetClientPublicKey33B64u:h(t.targetClientPublicKey33B64u,`binding.targetClientPublicKey33B64u`)}}function fn(e){let t=q(e,[`activation`,`clientPublicKey33B64u`,`relayerPublicKey33B64u`,`thresholdPublicKey33B64u`,`thresholdEthereumAddress20B64u`],`linked-device ECDSA source signer`);return{activation:z(t.activation,`source.activation`),clientPublicKey33B64u:h(t.clientPublicKey33B64u,`source.clientPublicKey33B64u`),relayerPublicKey33B64u:h(t.relayerPublicKey33B64u,`source.relayerPublicKey33B64u`),thresholdPublicKey33B64u:h(t.thresholdPublicKey33B64u,`source.thresholdPublicKey33B64u`),thresholdEthereumAddress20B64u:G(t.thresholdEthereumAddress20B64u,20,`source.thresholdEthereumAddress20B64u`)}}function pn(e){let t=q(e,[`activation`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`clientRecipientPublicKeyB64u`,`signingWorkerRecipientPublicKeyB64u`],`linked-device ECDSA target recipient`),n=G(t.clientRecipientPublicKeyB64u,32,`target.clientRecipientPublicKeyB64u`),r=G(t.signingWorkerRecipientPublicKeyB64u,32,`target.signingWorkerRecipientPublicKeyB64u`);if(n===r)throw Error(`linked-device ECDSA target recipients must differ`);return{activation:z(t.activation,`target.activation`),targetDeviceId:U(t.targetDeviceId),targetFactorVerificationDigestB64u:W(t.targetFactorVerificationDigestB64u,`target.targetFactorVerificationDigestB64u`),clientRecipientPublicKeyB64u:n,signingWorkerRecipientPublicKeyB64u:r}}function mn(e,t){let n=q(e,[`kind`,`recipientPublicKeyB64u`,`bindingDigestB64u`,`encappedKeyB64u`,`ciphertextB64u`],`linked-device ECDSA ${t}`);if(n.kind!==Jt)throw Error(`${t}.kind is invalid`);return{kind:Jt,recipientPublicKeyB64u:G(n.recipientPublicKeyB64u,32,`${t}.recipientPublicKeyB64u`),bindingDigestB64u:W(n.bindingDigestB64u,`${t}.bindingDigestB64u`),encappedKeyB64u:G(n.encappedKeyB64u,32,`${t}.encappedKeyB64u`),ciphertextB64u:te(n.ciphertextB64u,`${t}.ciphertextB64u`)}}function hn(e,t){let n=N(e);if(n.operation!==`registration`)throw Error(`${t} must use the registration operation`);return n}function gn(e,t,n,r){if(e.material_activation.activation_id!==n.activationId)throw Error(`${r} activation does not match the target activation`);if(e.material_activation.material_owner!==n.materialOwner)throw Error(`${r} material owner does not match the target activation`);if(e.material_activation.signing_worker!==n.signingWorker)throw Error(`${r} signing worker does not match the target activation`);if(e.session_id.length!==32||String(t).length===0)throw Error(`${r} link binding is invalid`)}function _n(e,t,n){if(e.session_id.length!==32||String(t).length===0)throw Error(`${n} link binding is invalid`)}function vn(e,t){return e.stable_key_context_binding.every((e,n)=>e===t.stable_key_context_binding[n])&&e.material_activation.capability===t.material_activation.capability&&e.material_activation.material_owner===t.material_activation.material_owner&&e.material_activation.key_binding===t.material_activation.key_binding&&e.material_activation.lifecycle_binding===t.material_activation.lifecycle_binding&&e.material_activation.signing_worker===t.material_activation.signing_worker&&e.lifecycle.root_share_epoch===t.lifecycle.root_share_epoch&&e.lifecycle.account_id===t.lifecycle.account_id&&e.lifecycle.signer_set_id===t.lifecycle.signer_set_id&&e.lifecycle.selected_server_id===t.lifecycle.selected_server_id}function yn(e,t){return i(e.activation,t.activation)&&e.clientPublicKey33B64u===t.clientPublicKey33B64u&&e.relayerPublicKey33B64u===t.relayerPublicKey33B64u&&e.thresholdPublicKey33B64u===t.thresholdPublicKey33B64u&&e.thresholdEthereumAddress20B64u===t.thresholdEthereumAddress20B64u}function bn(e,t){if(i(e,t)||e.materialOwner!==t.materialOwner||e.signingWorker!==t.signingWorker)throw Error(`linked-device ECDSA source and target activations are invalid`)}function xn(e,t){return i(e.activation,t.activation)&&e.targetDeviceId===t.targetDeviceId&&e.targetFactorVerificationDigestB64u===t.targetFactorVerificationDigestB64u&&e.clientRecipientPublicKeyB64u===t.clientRecipientPublicKeyB64u&&e.signingWorkerRecipientPublicKeyB64u===t.signingWorkerRecipientPublicKeyB64u}function z(e,t){let n=r(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function B(e){let t=s(K(e,`linkSessionId`));if(!t.ok)throw Error(`linkSessionId ${t.error.message}`);return t.value}function V(e){let t=n(K(e,`enrollmentId`));if(!t.ok)throw Error(`enrollmentId ${t.error.message}`);return t.value}function H(e){let n=t(K(e,`sourceAuthorityId`));if(!n.ok)throw Error(`sourceAuthorityId ${n.error.message}`);return n.value}function Sn(t){let n=e(K(t,`walletKeyId`));if(!n.ok)throw Error(`walletKeyId ${n.error.message}`);return n.value}function U(e){let t=ne(K(e,`targetDeviceId`));if(!t.ok)throw Error(`targetDeviceId ${t.error.message}`);return t.value}function W(e,t){try{return _(e)}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}function G(e,t,n){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} must be canonical base64url`);let r;try{r=f(e)}catch{throw Error(`${n} must be canonical base64url`)}if(r.length!==t||d(r)!==e)throw Error(`${n} must decode to ${t} bytes`);return e}function K(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e||[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127}))throw Error(`${t} must be a non-empty visible string`);return e}function q(e,t,n){let r=c(e,n),i=new Set(t),a=Object.keys(r);if(a.length!==t.length||a.some(e=>!i.has(e))||t.some(e=>!Object.prototype.hasOwnProperty.call(r,e)))throw Error(`${n} contains unknown or missing fields`);return r}function Cn(e){return br(e)}function wn(e){return yr(e.signerActivations)}function Tn(e){return vr(e.signerActivations)}function En(e){return e.provenance.kind===`wallet_recovery`}function Dn(e){return{kind:`wallet_ed25519_signer_activation_v1`,signer:e.signer,materialActivation:e.materialActivation}}function On(e){return{kind:`wallet_ecdsa_signer_activation_v1`,signer:e.signer,materialActivation:e.materialActivation}}function kn(e){let t=pe(e.manifest),n=_r(e.materialActivations);if(!ur(t.keyFamilies,n.keyFamilies))throw Error(`wallet signer activation materials must match the signer manifest families`);if(dr(t)){if(!mr(n))throw Error(`Ed25519 signer activation requires one Ed25519 material activation`);return{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`],ed25519:Dn({signer:t.signers[0],materialActivation:n.ed25519})}}if(fr(t)){if(!hr(n))throw Error(`ECDSA signer activation requires one ECDSA material activation`);return{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ecdsa_secp256k1`],ecdsa:On({signer:t.signers[0],materialActivation:n.ecdsa})}}if(!pr(t)||!gr(n))throw Error(`wallet signer activation set has unsupported families`);if(n.ed25519.activationId===n.ecdsa.activationId)throw Error(`wallet signer activation references must be distinct`);return{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:Dn({signer:t.signers[0],materialActivation:n.ed25519}),ecdsa:On({signer:t.signers[1],materialActivation:n.ecdsa})}}function An(e){try{let t=l(e,`WalletSignerActivationSetV1`);if(t.kind!==`wallet_signer_activation_set_v1`)return $(`wallet signer activation set kind is unsupported`);if(!Object.prototype.hasOwnProperty.call(t,`keyFamilies`))return $(`WalletSignerActivationSetV1.keyFamilies is required`);let n=lr(t.keyFamilies,`WalletSignerActivationSetV1.keyFamilies`);if(n.length===1&&n[0]===`ed25519`)return J(t,[`kind`,`keyFamilies`,`ed25519`],`WalletSignerActivationSetV1`),{ok:!0,value:{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`],ed25519:Zn(t.ed25519,`ed25519`)}};if(n.length===1&&n[0]===`ecdsa_secp256k1`)return J(t,[`kind`,`keyFamilies`,`ecdsa`],`WalletSignerActivationSetV1`),{ok:!0,value:{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ecdsa_secp256k1`],ecdsa:Qn(t.ecdsa,`ecdsa`)}};J(t,[`kind`,`keyFamilies`,`ed25519`,`ecdsa`],`WalletSignerActivationSetV1`);let r=Zn(t.ed25519,`ed25519`),i=Qn(t.ecdsa,`ecdsa`);return r.materialActivation.activationId===i.materialActivation.activationId?$(`wallet signer activation references must be distinct`):{ok:!0,value:{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:r,ecdsa:i}}}catch(e){return $(xr(e,`wallet signer activation set is invalid`))}}function jn(e){let t=[y(`seams/wallet-signer-activation-set/v1`,`domain`),y(e.kind,`kind`),se(e.keyFamilies.length,`keyFamilies`)];for(let n of e.keyFamilies)t.push(y(n,`keyFamilies.item`));return(vr(e)||br(e))&&t.push(x(er(e.ed25519),`ed25519`)),(yr(e)||br(e))&&t.push(x(tr(e.ecdsa),`ecdsa`)),S(t)}async function Mn(e){return _(d(await u(jn(e))))}function Nn(e){return{kind:`wallet_authority_v1`,authorityId:e.authorityId,walletId:e.walletId,principal:e.principal,provenance:e.provenance,permissions:e.permissions,signerActivations:e.signerActivations,signerActivationSetDigestB64u:e.signerActivationSetDigestB64u,authorityDigestB64u:e.authorityDigestB64u,revocationEpoch:e.revocationEpoch,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs}}function Pn(e){return Kn(e),{...Nn(e),state:`pending_local_install`,localInstallPackageSetDigestB64u:e.localInstallPackageSetDigestB64u}}function Fn(e){return Kn(e),{...Nn(e),state:`active`,activatedAtMs:e.activatedAtMs}}async function In(e){let t=e.authority.signerActivations;if(!t.ed25519)throw Error(`active Wallet Authority has no Ed25519 material activation to replace`);let n=t.ecdsa?kn({manifest:C([t.ed25519.signer,t.ecdsa.signer]),materialActivations:{keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:e.materialActivation,ecdsa:t.ecdsa.materialActivation}}):kn({manifest:C([t.ed25519.signer]),materialActivations:{keyFamilies:[`ed25519`],ed25519:e.materialActivation}}),r=await Mn(n),i={kind:e.authority.kind,authorityId:e.authority.authorityId,walletId:e.authority.walletId,principal:e.authority.principal,provenance:e.authority.provenance,permissions:e.authority.permissions,signerActivations:n,signerActivationSetDigestB64u:r,authorityDigestB64u:e.authority.authorityDigestB64u,revocationEpoch:e.authority.revocationEpoch,createdAtMs:e.authority.createdAtMs,updatedAtMs:Math.max(e.authority.updatedAtMs,e.updatedAtMs),state:`active`,activatedAtMs:e.authority.activatedAtMs};return Fn({...i,authorityDigestB64u:await Hn(i)})}function Ln(e){return Kn(e),{...Nn(e),state:`active`,activatedAtMs:e.activatedAtMs}}function Rn(e){return Kn(e),{...Nn(e),state:`revoked`,activatedAtMs:e.activatedAtMs,revokedAtMs:e.revokedAtMs}}const zn=[`kind`,`authorityId`,`walletId`,`principal`,`provenance`,`permissions`,`signerActivations`,`signerActivationSetDigestB64u`,`authorityDigestB64u`,`revocationEpoch`,`createdAtMs`,`updatedAtMs`,`state`];function Bn(e){try{let t=l(e,`WalletAuthorityV1`),n=Gn(t);switch(t.state){case`pending_local_install`:return J(t,[...zn,`localInstallPackageSetDigestB64u`],`WalletAuthorityV1`),{ok:!0,value:Pn({kind:`wallet_authority_v1`,...n,state:`pending_local_install`,localInstallPackageSetDigestB64u:Y(t.localInstallPackageSetDigestB64u,`localInstallPackageSetDigestB64u`)})};case`active`:return J(t,[...zn,`activatedAtMs`],`WalletAuthorityV1`),{ok:!0,value:Fn({kind:`wallet_authority_v1`,...n,state:`active`,activatedAtMs:X(t.activatedAtMs,`activatedAtMs`)})};case`revoked`:return J(t,[...zn,`activatedAtMs`,`revokedAtMs`],`WalletAuthorityV1`),{ok:!0,value:Rn({kind:`wallet_authority_v1`,...n,state:`revoked`,activatedAtMs:X(t.activatedAtMs,`activatedAtMs`),revokedAtMs:X(t.revokedAtMs,`revokedAtMs`)})};default:return $(`WalletAuthorityV1.state is unsupported`)}}catch(e){return $(xr(e,`wallet authority is invalid`))}}function Vn(e){return S([y(`seams/wallet-authority/v1`,`domain`),y(e.kind,`kind`),y(e.authorityId,`authorityId`),y(e.walletId,`walletId`),x(ar(e.principal),`principal`),x(or(e.provenance),`provenance`),x(sr(e.permissions),`permissions`),ce(e.signerActivationSetDigestB64u,`signerActivationSetDigestB64u`),y(e.state,`state`),le(e.revocationEpoch,`revocationEpoch`)])}async function Hn(e){return _(d(await u(Vn(e))))}async function Un(e){return await Mn(e.signerActivations)===e.signerActivationSetDigestB64u?await Hn(e)===e.authorityDigestB64u:!1}async function Wn(e,t){let[n,r]=await Promise.all([Un(e),Un(t)]);return n&&r&&e.authorityDigestB64u===t.authorityDigestB64u&&e.signerActivationSetDigestB64u===t.signerActivationSetDigestB64u&&e.createdAtMs===t.createdAtMs&&e.updatedAtMs===t.updatedAtMs&&e.activatedAtMs===t.activatedAtMs}function Gn(e){if(e.kind!==`wallet_authority_v1`)throw Error(`WalletAuthorityV1.kind is unsupported`);let n=Q(t(e.authorityId),`authorityId`),r=Q(o(e.walletId),`walletId`),i=qn(e.principal),a=Jn(e.provenance),s=Q(ee(e.permissions),`permissions`),c=Q(An(e.signerActivations),`signerActivations`),l=Y(e.signerActivationSetDigestB64u,`signerActivationSetDigestB64u`),u=Y(e.authorityDigestB64u,`authorityDigestB64u`),d=X(e.revocationEpoch,`revocationEpoch`),f=X(e.createdAtMs,`createdAtMs`),p=X(e.updatedAtMs,`updatedAtMs`);return Xn(c,r),{authorityId:n,walletId:r,principal:i,provenance:a,permissions:s,signerActivations:c,signerActivationSetDigestB64u:l,authorityDigestB64u:u,revocationEpoch:d,createdAtMs:f,updatedAtMs:p}}function Kn(e){if(e.kind!==`wallet_authority_v1`)throw Error(`wallet authority kind is unsupported`);if(!Number.isSafeInteger(e.revocationEpoch)||e.revocationEpoch<0)throw Error(`wallet authority revocationEpoch must be a non-negative safe integer`);if(Z(e.createdAtMs,`createdAtMs`),Z(e.updatedAtMs,`updatedAtMs`),e.updatedAtMs<e.createdAtMs)throw Error(`wallet authority updatedAtMs cannot precede createdAtMs`);switch(Y(e.signerActivationSetDigestB64u,`signerActivationSetDigestB64u`),Y(e.authorityDigestB64u,`authorityDigestB64u`),Xn(e.signerActivations,e.walletId),Yn(e.provenance),e.state){case`pending_local_install`:Y(e.localInstallPackageSetDigestB64u,`localInstallPackageSetDigestB64u`);break;case`active`:Z(e.activatedAtMs,`activatedAtMs`);break;case`revoked`:if(Z(e.activatedAtMs,`activatedAtMs`),Z(e.revokedAtMs,`revokedAtMs`),e.revokedAtMs<e.activatedAtMs)throw Error(`revokedAtMs cannot precede activatedAtMs`);break}}function qn(e){let t=cr(e,[`kind`,`deviceId`],`WalletAuthorityPrincipalV1`);if(t.kind!==`owner_device`)throw Error(`wallet authority principal kind is unsupported`);return{kind:`owner_device`,deviceId:Q(ne(t.deviceId),`deviceId`)}}function Jn(e){let r=l(e,`WalletAuthorityProvenanceV1`);switch(r.kind){case`wallet_registration`:return J(r,[`kind`],`WalletAuthorityProvenanceV1`),{kind:`wallet_registration`};case`device_link`:return J(r,[`kind`,`enrollmentId`,`sourceAuthorityId`,`linkSessionId`],`WalletAuthorityProvenanceV1`),{kind:`device_link`,enrollmentId:Q(n(r.enrollmentId),`enrollmentId`),sourceAuthorityId:Q(t(r.sourceAuthorityId),`sourceAuthorityId`),linkSessionId:Q(s(r.linkSessionId),`linkSessionId`)};case`wallet_recovery`:return J(r,[`kind`,`recoveryOperationId`,`continuityAuthorityId`],`WalletAuthorityProvenanceV1`),{kind:`wallet_recovery`,recoveryOperationId:Q(a(r.recoveryOperationId),`recoveryOperationId`),continuityAuthorityId:Q(t(r.continuityAuthorityId),`continuityAuthorityId`)};default:throw Error(`wallet authority provenance kind is unsupported`)}}function Yn(e){switch(e.kind){case`wallet_registration`:return;case`device_link`:if(!e.enrollmentId||!e.sourceAuthorityId||!e.linkSessionId)throw Error(`device-link provenance requires every audit identity`);return;case`wallet_recovery`:if(!e.recoveryOperationId||!e.continuityAuthorityId)throw Error(`wallet-recovery provenance requires every audit identity`);return}Sr(e,`wallet authority provenance`)}function Xn(e,t){if(vr(e)){if(e.ed25519.signer.walletId!==t)throw Error(`Ed25519 signer activation uses a different wallet id`);return}if(yr(e)){if(e.ecdsa.signer.walletId!==t)throw Error(`ECDSA signer activation uses a different wallet id`);return}if(br(e)){if(e.ed25519.signer.walletId!==t||e.ecdsa.signer.walletId!==t)throw Error(`signer activations must use the authority wallet id`);return}throw Error(`wallet signer activation families are unsupported`)}function Zn(e,t){let n=cr(e,[`kind`,`signer`,`materialActivation`],t);if(n.kind!==`wallet_ed25519_signer_activation_v1`)throw Error(`${t}.kind is invalid`);let i=$n(n.signer,`ed25519`,`${t}.signer`);if(!dr(i))throw Error(`${t}.signer is not Ed25519`);return Dn({signer:i.signers[0],materialActivation:Q(r(n.materialActivation),`${t}.materialActivation`)})}function Qn(e,t){let n=cr(e,[`kind`,`signer`,`materialActivation`],t);if(n.kind!==`wallet_ecdsa_signer_activation_v1`)throw Error(`${t}.kind is invalid`);let i=$n(n.signer,`ecdsa_secp256k1`,`${t}.signer`);if(!fr(i))throw Error(`${t}.signer is not ECDSA`);return On({signer:i.signers[0],materialActivation:Q(r(n.materialActivation),`${t}.materialActivation`)})}function $n(e,t,n){return pe({kind:`exact_administered_signer_manifest_v1`,keyFamilies:[t],signers:[e]})}function er(e){return S([y(e.kind,`ed25519.kind`),x(nr(e.signer),`ed25519.signer`),x(ir(e.materialActivation),`ed25519.materialActivation`)])}function tr(e){return S([y(e.kind,`ecdsa.kind`),x(rr(e.signer),`ecdsa.signer`),x(ir(e.materialActivation),`ecdsa.materialActivation`)])}function nr(e){return S([y(e.kind,`ed25519.signer.kind`),y(e.keyFamily,`ed25519.signer.keyFamily`),y(e.walletId,`ed25519.signer.walletId`),y(e.walletKeyId,`ed25519.signer.walletKeyId`),x(oe(e.registeredPublicKeyB64u,`ed25519.signer.registeredPublicKeyB64u`),`ed25519.signer.registeredPublicKeyB64u`)])}function rr(e){return S([y(e.kind,`ecdsa.signer.kind`),y(e.keyFamily,`ecdsa.signer.keyFamily`),y(e.walletId,`ecdsa.signer.walletId`),y(e.walletKeyId,`ecdsa.signer.walletKeyId`),x(oe(e.thresholdPublicKey33B64u,`ecdsa.signer.thresholdPublicKey33B64u`),`ecdsa.signer.thresholdPublicKey33B64u`),y(e.evmAddress,`ecdsa.signer.evmAddress`)])}function ir(e){return S([y(e.kind,`materialActivation.kind`),y(e.activationId,`materialActivation.activationId`),y(e.capability,`materialActivation.capability`),y(e.materialOwner,`materialActivation.materialOwner`),y(e.keyBinding,`materialActivation.keyBinding`),y(e.lifecycleBinding,`materialActivation.lifecycleBinding`),y(e.signingWorker,`materialActivation.signingWorker`)])}function ar(e){return S([y(e.kind,`principal.kind`),y(e.deviceId,`principal.deviceId`)])}function or(e){switch(e.kind){case`wallet_registration`:return y(e.kind,`provenance.kind`);case`device_link`:return S([y(e.kind,`provenance.kind`),y(e.enrollmentId,`provenance.enrollmentId`),y(e.sourceAuthorityId,`provenance.sourceAuthorityId`),y(e.linkSessionId,`provenance.linkSessionId`)]);case`wallet_recovery`:return S([y(e.kind,`provenance.kind`),y(e.recoveryOperationId,`provenance.recoveryOperationId`),y(e.continuityAuthorityId,`provenance.continuityAuthorityId`)])}return Sr(e,`wallet authority provenance`)}function sr(e){let t=[se(e.length,`permissions`)];for(let n of e)t.push(x(y(n,`permissions.item`),`permissions.item`));return S(t)}function cr(e,t,n){let r=l(e,n);return J(r,t,n),r}function J(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length)throw Error(`${n} contains unexpected fields`);for(let e of i)if(!r.has(e))throw Error(`${n}.${e} is not allowed`);for(let r of t)if(!Object.prototype.hasOwnProperty.call(e,r))throw Error(`${n}.${r} is required`)}function lr(e,t){if(!Array.isArray(e))throw Error(`${t} must be an array`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`${t} must use canonical family order`)}function ur(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function dr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`}function fr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`}function pr(e){return e.keyFamilies.length===2}function mr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`}function hr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`}function gr(e){return e.keyFamilies.length===2}function _r(e){if(mr(e))return{keyFamilies:[`ed25519`],ed25519:Q(r(e.ed25519),`materialActivations.ed25519`)};if(hr(e))return{keyFamilies:[`ecdsa_secp256k1`],ecdsa:Q(r(e.ecdsa),`materialActivations.ecdsa`)};if(gr(e))return{keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:Q(r(e.ed25519),`materialActivations.ed25519`),ecdsa:Q(r(e.ecdsa),`materialActivations.ecdsa`)};throw Error(`wallet signer activation materials are unsupported`)}function vr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`}function yr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`}function br(e){return e.keyFamilies.length===2}function Y(e,t){try{return _(e)}catch(e){throw Error(`${t} ${xr(e,`is invalid`)}`)}}function X(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function Z(e,t){if(!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`)}function Q(e,t){if(e.ok)return e.value;throw Error(`${t} ${e.error.message}`)}function $(e){return{ok:!1,error:{code:`invalid`,message:e}}}function xr(e,t){return e instanceof Error?e.message:t}function Sr(e,t){throw Error(`${t} branch is unsupported: ${String(e)}`)}async function Cr(e,t,n){let r=await Mn(t),i={kind:`wallet_authority_v1`,authorityId:e.authorityId,walletId:e.walletId,principal:e.principal,provenance:e.provenance,permissions:e.permissions,signerActivations:t,signerActivationSetDigestB64u:r,authorityDigestB64u:e.authorityDigestB64u,revocationEpoch:e.revocationEpoch,createdAtMs:e.createdAtMs,updatedAtMs:Math.max(e.updatedAtMs,n),state:`active`,activatedAtMs:e.activatedAtMs};return Ln({...i,authorityDigestB64u:await Hn(i)})}async function wr(e){if(e.ed25519.signer.walletId!==e.authority.walletId)throw Error(`NEAR signer belongs to a different wallet authority`);let t=e.authority.signerActivations.ecdsa,n=e.ed25519.signer,r=kn({manifest:C([n,t.signer]),materialActivations:{keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:e.ed25519.materialActivation,ecdsa:t.materialActivation}});if(!Cn(r))throw Error(`Deferred Ed25519 activation did not produce a combined signer activation set`);return Cr(e.authority,r,e.now)}function Tr(e,t){return e.authorityId===t.authorityId&&e.walletId===t.walletId&&e.revocationEpoch===t.revocationEpoch&&e.createdAtMs===t.createdAtMs&&e.activatedAtMs===t.activatedAtMs&&d(ar(e.principal))===d(ar(t.principal))&&d(or(e.provenance))===d(or(t.provenance))&&d(sr(e.permissions))===d(sr(t.permissions))}function Er(e,t){return Tn(e)&&Cn(t.signerActivations)&&Tr(e,t)&&d(er(e.signerActivations.ed25519))===d(er(t.signerActivations.ed25519))}function Dr(e,t){return wn(e)&&Cn(t.signerActivations)&&e.provenance.kind===`wallet_registration`&&Tr(e,t)&&d(tr(e.signerActivations.ecdsa))===d(tr(t.signerActivations.ecdsa))}export{k as $,Ae as A,Ft as B,xn as C,je as D,Ie as E,M as F,Wt as G,Rt as H,st as I,Bt as J,jt as K,Kt as L,Oe as M,Ne as N,ke as O,F as P,Re as Q,Nt as R,yn as S,Fe as T,Vt as U,it as V,Gt as W,At as X,Ut as Y,Mt as Z,on as _,wn as a,$t as b,Cn as c,Bn as d,He as et,An as f,mn as g,Un as h,wr as i,De as j,Me as k,Er as l,Wn as m,Mn as n,pe as nt,Tn as o,In as p,Lt as q,jn as r,En as s,Hn as t,Ee as tt,Dr as u,Xt as v,Pe as w,Zt as x,en as y,Pt as z};
+import{A as e,O as t,d as n,g as r,i,j as a,k as o,u as s}from"./domainIds-t1lp25yU.js";import{C as c,S as l,n as u}from"./digests-BIaE0DMd.js";import{i as d,r as f}from"./base64-BmKR3UqU.js";import{B as ee,D as p,J as m,M as h,O as te,P as g}from"./activeWalletSession-BJ4B-nJo.js";import{l as ne}from"./capabilityKinds-DVlGMspk.js";import{r as _}from"./canonicalPrimitives-Jd3i_Ngz.js";import{Dt as re,F as ie,Ft as ae,Nt as v,a as y,i as oe,jt as b,n as x,o as se,r as ce,s as le,t as S}from"./digestEncoding-34kXJoJr.js";const ue=[`kind`,`keyFamilies`,`signers`],de=[`kind`,`keyFamily`,`walletId`,`walletKeyId`,`registeredPublicKeyB64u`],fe=[`kind`,`keyFamily`,`walletId`,`walletKeyId`,`thresholdPublicKey33B64u`,`evmAddress`];function C(e){if(e.length===0)throw Error(`exact administered signer manifest must contain at least one active family`);let t,n,r,i=new Set;for(let a of e){if(t!==void 0&&t!==a.walletId)throw Error(`exact administered signer manifest must use one wallet identity`);if(t=a.walletId,i.has(a.walletKeyId))throw Error(`exact administered signer manifest repeats wallet key ${a.walletKeyId}`);switch(i.add(a.walletKeyId),a.keyFamily){case`ed25519`:if(n!==void 0)throw Error(`exact administered signer manifest repeats the ed25519 family`);if(a.kind!==`exact_administered_ed25519_signer_v1`)throw Error(`exact administered signer manifest has an invalid Ed25519 signer`);n=a;break;case`ecdsa_secp256k1`:if(r!==void 0)throw Error(`exact administered signer manifest repeats the ecdsa family`);if(a.kind!==`exact_administered_ecdsa_signer_v1`)throw Error(`exact administered signer manifest has an invalid ECDSA signer`);r=a;break}}if(n!==void 0&&r!==void 0)return{kind:`exact_administered_signer_manifest_v1`,keyFamilies:[`ed25519`,`ecdsa_secp256k1`],signers:[n,r]};if(n!==void 0)return{kind:`exact_administered_signer_manifest_v1`,keyFamilies:[`ed25519`],signers:[n]};if(r!==void 0)return{kind:`exact_administered_signer_manifest_v1`,keyFamilies:[`ecdsa_secp256k1`],signers:[r]};throw Error(`exact administered signer manifest must contain a supported family`)}function pe(e){let t=ve(e,ue,`ExactAdministeredSignerManifestV1`);if(t.kind!==`exact_administered_signer_manifest_v1`)throw Error(`ExactAdministeredSignerManifestV1.kind is invalid`);let n=he(t.keyFamilies);if(!Array.isArray(t.signers))throw Error(`ExactAdministeredSignerManifestV1.signers must be an array`);let r=[];for(let e=0;e<t.signers.length;e+=1)r.push(me(t.signers[e],`signers[${e}]`));let i=C(r);if(!ge(n,i.keyFamilies))throw Error(`ExactAdministeredSignerManifestV1.keyFamilies do not match signers`);return i}function me(t,n){let r=l(t,n);switch(r.keyFamily){case`ed25519`:if(m(r,de,n),r.kind!==`exact_administered_ed25519_signer_v1`)throw Error(`${n}.kind is invalid for Ed25519`);return{kind:`exact_administered_ed25519_signer_v1`,keyFamily:`ed25519`,walletId:g(o(r.walletId),`${n}.walletId`),walletKeyId:g(e(r.walletKeyId),`${n}.walletKeyId`),registeredPublicKeyB64u:p(r.registeredPublicKeyB64u,`${n}.registeredPublicKeyB64u`)};case`ecdsa_secp256k1`:if(m(r,fe,n),r.kind!==`exact_administered_ecdsa_signer_v1`)throw Error(`${n}.kind is invalid for ECDSA`);return{kind:`exact_administered_ecdsa_signer_v1`,keyFamily:`ecdsa_secp256k1`,walletId:g(o(r.walletId),`${n}.walletId`),walletKeyId:g(e(r.walletKeyId),`${n}.walletKeyId`),thresholdPublicKey33B64u:h(r.thresholdPublicKey33B64u,`${n}.thresholdPublicKey33B64u`),evmAddress:_e(r.evmAddress,`${n}.evmAddress`)};default:throw Error(`${n}.keyFamily is unsupported`)}}function he(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`ExactAdministeredSignerManifestV1.keyFamilies must be non-empty`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`ExactAdministeredSignerManifestV1.keyFamilies must be canonical and duplicate-free`)}function ge(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function _e(e,t){if(typeof e!=`string`||!/^0x[0-9a-fA-F]{40}$/.test(e))throw Error(`${t} must be a 20-byte hexadecimal EVM address`);return e}function ve(e,t,n){let r=l(e,n);m(r,t,n);for(let e of t)if(!(e in r))throw Error(`${n}.${e} is required`);return r}const w=new TextEncoder;function T(e,t){if(typeof e!=`string`||e.length===0)throw Error(`${t} must be a non-empty visible ASCII string`);for(let n=0;n<e.length;n+=1){let r=e.charCodeAt(n);if(r<33||r>126)throw Error(`${t} must contain visible ASCII bytes`)}return e}function ye(e,t){if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`${t} must be a byte`);return e}function be(e,t,n,r){if(!Array.isArray(e))throw Error(`${t} must be a byte array`);if(e.length<n||e.length>r)throw Error(`${t} has an invalid length`);let i=[];for(let n=0;n<e.length;n+=1)i.push(ye(e[n],`${t}[${n}]`));return i}function E(e,t,n){let r=be(e,t,32,32);if(n&&xe(r))throw Error(`${t} must be nonzero`);return r}function xe(e){for(let t of e)if(t!==0)return!1;return!0}function D(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function Se(e){let t=new Uint8Array(4);return new DataView(t.buffer).setUint32(0,e,!1),t}function Ce(e){let t=0;for(let n of e)t+=n.length;let n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function we(e){return Ce([Se(e.length),e])}function O(e,t){return Ce([we(w.encode(e)),we(t)])}async function Te(e){let t=await globalThis.crypto.subtle.digest(`SHA-256`,e);return new Uint8Array(t)}async function Ee(e){let t=Ce([we(w.encode(`seams/router-ab/ed25519-yao/application-binding/v1`)),O(`walletId`,w.encode(e.wallet_id)),O(`nearEd25519SigningKeyId`,w.encode(e.near_ed25519_signing_key_id)),O(`signingRootId`,w.encode(e.signing_root_id)),O(`keyCreationSignerSlot`,Se(e.key_creation_signer_slot))]);return Array.from(await Te(t))}const De=`/router-ab/ed25519/yao/registration/admit`,Oe=`/router-ab/ed25519/yao/registration/execute`,ke=`/router-ab/ed25519/yao/recovery/admit`,Ae=`/router-ab/ed25519/yao/recovery/execute`,je=`/router-ab/ed25519/yao/recovery/activate`,Me=`x-seams-wallet-recovery-challenge-id`,Ne=`/router-ab/ed25519/yao/recovery/bootstrap`,Pe=`router_ab_ed25519_yao_email_otp_recovery_v1`,Fe=`/router-ab/ed25519/yao/export/admit`,Ie=`/router-ab/ed25519/yao/export/execute`,Le=64*1024;function Re(e,t){return e.operation===t.operation&&k(e.session_id,t.session_id)&&k(e.stable_key_context_binding,t.stable_key_context_binding)&&ae(e.material_activation,t.material_activation)&&e.lifecycle.lifecycle_id===t.lifecycle.lifecycle_id&&e.lifecycle.work_kind===t.lifecycle.work_kind&&e.lifecycle.primitive_request_kind===t.lifecycle.primitive_request_kind&&e.lifecycle.root_share_epoch===t.lifecycle.root_share_epoch&&e.lifecycle.account_id===t.lifecycle.account_id&&e.lifecycle.session_id===t.lifecycle.session_id&&e.lifecycle.signer_set_id===t.lifecycle.signer_set_id&&e.lifecycle.selected_server_id===t.lifecycle.selected_server_id}function k(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function ze(e,t){return e[0]===t[0]&&e[1]===t[1]}function Be(e,t){return e.lifecycle_id===t.lifecycle_id&&e.root_share_epoch===t.root_share_epoch&&e.account_id===t.account_id&&e.threshold_session_id===t.threshold_session_id&&e.signer_set_id===t.signer_set_id&&e.signing_worker_id===t.signing_worker_id&&ae(e.material_activation,t.material_activation)}function Ve(e,t){return e.wallet_id===t.wallet_id&&e.near_ed25519_signing_key_id===t.near_ed25519_signing_key_id&&e.signing_root_id===t.signing_root_id&&e.key_creation_signer_slot===t.key_creation_signer_slot}function He(e,t){return Be(e.scope,t.scope)&&Ve(e.application_binding,t.application_binding)&&ze(e.participant_ids,t.participant_ids)}const Ue=`registration_prepare`,We=`registration`,Ge=`recovery`,Ke=`recovery`,A=`key_export`,qe=`export`;function j(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`);for(let r of n)if(!Object.hasOwn(e,r))throw Error(`${t}.${r} is required`)}function Je(e,t){if(!Number.isInteger(e)||typeof e!=`number`||e<=0||e>4294967295)throw Error(`${t} must be a positive u32`);return e}function Ye(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe integer`);return e}function Xe(e,t){switch(e){case`registration`:case`recovery`:case`refresh`:case`export`:case`lane_provisioning`:case`lane_refresh`:return e;default:throw Error(`${t} is invalid`)}}function Ze(e,t){switch(e){case`deriver_a`:case`deriver_b`:return e;default:throw Error(`${t} is invalid`)}}function Qe(e,t){switch(e){case`activation`:case`export`:return e;default:throw Error(`${t} is invalid`)}}function $e(e,t){switch(e){case`activation_client`:case`activation_signing_worker`:case`export_client`:return e;default:throw Error(`${t} is invalid`)}}function et(e,t){switch(e){case`registration_prepare`:case`key_export`:case`recovery`:case`server_share_refresh`:return e;default:throw Error(`${t} is invalid`)}}function tt(e,t){switch(e){case`registration`:case`recovery`:case`export`:case`refresh`:return e;default:throw Error(`${t} is invalid`)}}function M(e){let t=l(e,`application_binding`);return j(t,`application_binding`,[`wallet_id`,`near_ed25519_signing_key_id`,`signing_root_id`,`key_creation_signer_slot`]),{wallet_id:T(t.wallet_id,`application_binding.wallet_id`),near_ed25519_signing_key_id:T(t.near_ed25519_signing_key_id,`application_binding.near_ed25519_signing_key_id`),signing_root_id:T(t.signing_root_id,`application_binding.signing_root_id`),key_creation_signer_slot:Je(t.key_creation_signer_slot,`application_binding.key_creation_signer_slot`)}}function nt(e){let t=l(e,`scope`);j(t,`scope`,[`lifecycle_id`,`root_share_epoch`,`account_id`,`threshold_session_id`,`signer_set_id`,`signing_worker_id`,`material_activation`]);let n=T(t.account_id,`scope.account_id`),r=T(t.signing_worker_id,`scope.signing_worker_id`),i=b(t.material_activation);if(i.material_owner!==n||i.signing_worker!==r)throw Error(`scope.material_activation does not match the lifecycle owner and worker`);return{lifecycle_id:T(t.lifecycle_id,`scope.lifecycle_id`),root_share_epoch:T(t.root_share_epoch,`scope.root_share_epoch`),account_id:n,threshold_session_id:T(t.threshold_session_id,`scope.threshold_session_id`),signer_set_id:T(t.signer_set_id,`scope.signer_set_id`),signing_worker_id:r,material_activation:i}}function rt(e){if(!Array.isArray(e)||e.length!==2)throw Error(`participant_ids must contain exactly two values`);let t=Je(e[0],`participant_ids[0]`),n=Je(e[1],`participant_ids[1]`);if(t>65535||n>65535||t>=n)throw Error(`participant_ids must be distinct, nonzero, ascending u16 values`);return[t,n]}function it(e){return rt(e)}function at(e){let t=l(e,`binding.lifecycle`);j(t,`binding.lifecycle`,[`lifecycle_id`,`work_kind`,`primitive_request_kind`,`root_share_epoch`,`account_id`,`session_id`,`signer_set_id`,`selected_server_id`]);let n={lifecycle_id:T(t.lifecycle_id,`binding.lifecycle.lifecycle_id`),work_kind:et(t.work_kind,`binding.lifecycle.work_kind`),primitive_request_kind:tt(t.primitive_request_kind,`binding.lifecycle.primitive_request_kind`),root_share_epoch:T(t.root_share_epoch,`binding.lifecycle.root_share_epoch`),account_id:T(t.account_id,`binding.lifecycle.account_id`),session_id:T(t.session_id,`binding.lifecycle.session_id`),signer_set_id:T(t.signer_set_id,`binding.lifecycle.signer_set_id`),selected_server_id:T(t.selected_server_id,`binding.lifecycle.selected_server_id`)};if(n.work_kind===Ue&&n.primitive_request_kind!==We||n.work_kind===Ge&&n.primitive_request_kind!==Ke||n.work_kind===A&&n.primitive_request_kind!==qe)throw Error(`binding.lifecycle primitive request kind does not match its work kind`);return n}function ot(e){let t=l(e,`binding`);j(t,`binding`,[`lifecycle`,`operation`,`session_id`,`stable_key_context_binding`,`material_activation`]);let n={lifecycle:at(t.lifecycle),operation:Xe(t.operation,`binding.operation`),session_id:E(t.session_id,`binding.session_id`,!0),stable_key_context_binding:E(t.stable_key_context_binding,`binding.stable_key_context_binding`,!1),material_activation:b(t.material_activation)};if(n.operation===`registration`&&n.lifecycle.work_kind!==Ue||n.operation===`recovery`&&n.lifecycle.work_kind!==Ge||n.operation===`export`&&n.lifecycle.work_kind!==A)throw Error(`binding operation does not match its lifecycle work kind`);if(n.material_activation.material_owner!==n.lifecycle.account_id||n.material_activation.signing_worker!==n.lifecycle.selected_server_id)throw Error(`binding material activation does not match its lifecycle owner and worker`);return n}function st(e){return ot(e)}function ct(e){let t=ot(e);if(t.operation!==`export`||t.lifecycle.work_kind!==A||t.lifecycle.primitive_request_kind!==qe)throw Error(`export binding requires the exact export lifecycle`);return{lifecycle:{lifecycle_id:t.lifecycle.lifecycle_id,work_kind:A,primitive_request_kind:qe,root_share_epoch:t.lifecycle.root_share_epoch,account_id:t.lifecycle.account_id,session_id:t.lifecycle.session_id,signer_set_id:t.lifecycle.signer_set_id,selected_server_id:t.lifecycle.selected_server_id},operation:`export`,session_id:t.session_id,stable_key_context_binding:t.stable_key_context_binding,material_activation:t.material_activation}}function lt(e){let t=l(e,`export binding`);return j(t,`export binding`,[`ceremony`,`registered_public_key`,`state_epoch`,`runtime_policy_binding`,`authorization_digest`]),{ceremony:ct(t.ceremony),registered_public_key:E(t.registered_public_key,`export binding.registered_public_key`,!0),state_epoch:Ye(t.state_epoch,`export binding.state_epoch`),runtime_policy_binding:E(t.runtime_policy_binding,`export binding.runtime_policy_binding`,!0),authorization_digest:E(t.authorization_digest,`export binding.authorization_digest`,!0)}}function N(e){let t=ot(e);switch(t.operation){case`registration`:if(t.lifecycle.work_kind!==Ue||t.lifecycle.primitive_request_kind!==We)throw Error(`activation binding has the wrong registration lifecycle kind`);return{lifecycle:{lifecycle_id:t.lifecycle.lifecycle_id,work_kind:Ue,primitive_request_kind:We,root_share_epoch:t.lifecycle.root_share_epoch,account_id:t.lifecycle.account_id,session_id:t.lifecycle.session_id,signer_set_id:t.lifecycle.signer_set_id,selected_server_id:t.lifecycle.selected_server_id},operation:`registration`,session_id:t.session_id,stable_key_context_binding:t.stable_key_context_binding,material_activation:t.material_activation};case`recovery`:if(t.lifecycle.work_kind!==Ge||t.lifecycle.primitive_request_kind!==Ke)throw Error(`activation binding has the wrong recovery lifecycle kind`);return{lifecycle:{lifecycle_id:t.lifecycle.lifecycle_id,work_kind:Ge,primitive_request_kind:Ke,root_share_epoch:t.lifecycle.root_share_epoch,account_id:t.lifecycle.account_id,session_id:t.lifecycle.session_id,signer_set_id:t.lifecycle.signer_set_id,selected_server_id:t.lifecycle.selected_server_id},operation:`recovery`,session_id:t.session_id,stable_key_context_binding:t.stable_key_context_binding,material_activation:t.material_activation};case`refresh`:case`export`:case`lane_provisioning`:case`lane_refresh`:throw Error(`activation binding has a non-activation operation`)}}function ut(e){let t=l(e,`keyset`);j(t,`keyset`,[`deriver_a_input_public_key`,`deriver_b_input_public_key`,`signing_worker_recipient_public_key`]);let n={deriver_a_input_public_key:E(t.deriver_a_input_public_key,`keyset.deriver_a_input_public_key`,!0),deriver_b_input_public_key:E(t.deriver_b_input_public_key,`keyset.deriver_b_input_public_key`,!0),signing_worker_recipient_public_key:E(t.signing_worker_recipient_public_key,`keyset.signing_worker_recipient_public_key`,!0)};if(D(n.deriver_a_input_public_key,n.deriver_b_input_public_key)||D(n.deriver_a_input_public_key,n.signing_worker_recipient_public_key)||D(n.deriver_b_input_public_key,n.signing_worker_recipient_public_key))throw Error(`keyset public keys must be distinct`);return n}function dt(e,t){let n=l(e,t);j(n,t,[`kind`,`deriver`,`operation`,`session`,`stable_context_binding`,`encapsulated_key`,`ciphertext`]);let r={kind:Qe(n.kind,`${t}.kind`),deriver:Ze(n.deriver,`${t}.deriver`),operation:Xe(n.operation,`${t}.operation`),session:E(n.session,`${t}.session`,!0),stable_context_binding:E(n.stable_context_binding,`${t}.stable_context_binding`,!0),encapsulated_key:E(n.encapsulated_key,`${t}.encapsulated_key`,!0),ciphertext:be(n.ciphertext,`${t}.ciphertext`,16,Le)};if(r.kind===`activation`&&r.operation===`export`||r.kind===`export`&&r.operation!==`export`)throw Error(`${t} operation does not match its circuit family`);return r}function ft(e,t,n,r){if(t.kind!==`activation`||t.deriver!==n||t.operation!==e.operation||!D(t.session,e.session_id)||!D(t.stable_context_binding,e.stable_key_context_binding))throw Error(`${r} does not match the admitted activation binding`);switch(e.operation){case`registration`:return{kind:`activation`,deriver:n,operation:`registration`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext};case`recovery`:return{kind:`activation`,deriver:n,operation:`recovery`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext}}}function pt(e,t,n,r){if(t.kind!==`export`||t.deriver!==n||t.operation!==`export`||!D(t.session,e.ceremony.session_id)||!D(t.stable_context_binding,e.ceremony.stable_key_context_binding))throw Error(`${r} does not match the admitted export binding`);return{kind:`export`,deriver:n,operation:`export`,session:t.session,stable_context_binding:t.stable_context_binding,encapsulated_key:t.encapsulated_key,ciphertext:t.ciphertext}}function P(e,t){let n=l(e,t);return j(n,t,[`kind`,`deriver`,`session`,`transcript`,`encapsulated_key`,`ciphertext`]),{kind:$e(n.kind,`${t}.kind`),deriver:Ze(n.deriver,`${t}.deriver`),session:E(n.session,`${t}.session`,!0),transcript:E(n.transcript,`${t}.transcript`,!0),encapsulated_key:E(n.encapsulated_key,`${t}.encapsulated_key`,!0),ciphertext:be(n.ciphertext,`${t}.ciphertext`,16,Le)}}function F(e){let t=l(e,`public_receipt`);return j(t,`public_receipt`,[`transcript`,`registered_public_key`,`joined_client_commitment`,`joined_signing_worker_commitment`,`signing_worker_verifying_share`,`state_epoch`,`material_activation`]),{transcript:E(t.transcript,`public_receipt.transcript`,!0),registered_public_key:E(t.registered_public_key,`public_receipt.registered_public_key`,!0),joined_client_commitment:E(t.joined_client_commitment,`public_receipt.joined_client_commitment`,!0),joined_signing_worker_commitment:E(t.joined_signing_worker_commitment,`public_receipt.joined_signing_worker_commitment`,!0),signing_worker_verifying_share:E(t.signing_worker_verifying_share,`public_receipt.signing_worker_verifying_share`,!0),state_epoch:Ye(t.state_epoch,`public_receipt.state_epoch`),material_activation:b(t.material_activation)}}function mt(e,t,n,r,i){if(n.kind!==`activation_client`||n.deriver!==r||!D(n.session,e.session_id)||!D(n.transcript,t.transcript))throw Error(`${i} does not match the terminal activation receipt`);return{kind:`activation_client`,deriver:r,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function ht(e,t,n,r,i){if(n.kind!==`export_client`||n.deriver!==r||!D(n.session,e.ceremony.session_id)||!D(n.transcript,t))throw Error(`${i} does not match the terminal export result`);return{kind:`export_client`,deriver:r,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function I(e,t){try{return{ok:!0,value:e(t)}}catch(e){return{ok:!1,code:`invalid_body`,message:e instanceof Error?e.message:String(e)}}}function gt(e){let t=l(e,`registration admission request`);return j(t,`registration admission request`,[`scope`,`application_binding`,`participant_ids`]),{scope:nt(t.scope),application_binding:M(t.application_binding),participant_ids:rt(t.participant_ids)}}function _t(e){let t=l(e,`recovery admission request`);j(t,`recovery admission request`,[`scope`,`active_material_activation`,`application_binding`,`participant_ids`,`active_capability_binding`,`replacement_capability_binding`,`registered_public_key`]);let n=E(t.active_capability_binding,`recovery admission request.active_capability_binding`,!0),r=E(t.replacement_capability_binding,`recovery admission request.replacement_capability_binding`,!0);if(D(n,r))throw Error(`recovery replacement capability binding must be fresh`);let i=nt(t.scope),a=b(t.active_material_activation),o=i.material_activation;if(a.activation_id===o.activation_id||a.lifecycle_binding===o.lifecycle_binding)throw Error(`recovery replacement material activation identity must be fresh`);if(a.capability!==o.capability||a.material_owner!==o.material_owner||a.key_binding!==o.key_binding||a.signing_worker!==o.signing_worker)throw Error(`recovery replacement material activation changed stable identity facts`);return{scope:i,active_material_activation:a,application_binding:M(t.application_binding),participant_ids:rt(t.participant_ids),active_capability_binding:n,replacement_capability_binding:r,registered_public_key:E(t.registered_public_key,`recovery admission request.registered_public_key`,!0)}}function vt(e){let t=l(e,`warm recovery bootstrap request`);if(j(t,`warm recovery bootstrap request`,[`kind`,`walletId`,`nearAccountId`,`nearEd25519SigningKeyId`,`signerSlot`,`thresholdSessionId`,`signingWorkerId`,`participantIds`]),t.kind!==`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`)throw Error(`warm recovery bootstrap request.kind is invalid`);return{kind:`router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1`,walletId:T(t.walletId,`warm recovery bootstrap request.walletId`),nearAccountId:T(t.nearAccountId,`warm recovery bootstrap request.nearAccountId`),nearEd25519SigningKeyId:T(t.nearEd25519SigningKeyId,`warm recovery bootstrap request.nearEd25519SigningKeyId`),signerSlot:Ye(t.signerSlot,`warm recovery bootstrap request.signerSlot`),thresholdSessionId:T(t.thresholdSessionId,`warm recovery bootstrap request.thresholdSessionId`),signingWorkerId:T(t.signingWorkerId,`warm recovery bootstrap request.signingWorkerId`),participantIds:rt(t.participantIds)}}function yt(e){let t=l(e,`export admission receipt`);return j(t,`export admission receipt`,[`binding`,`keyset`]),{binding:lt(t.binding),keyset:ut(t.keyset)}}function bt(e){let t=l(e,`export execute request`);j(t,`export execute request`,[`binding`,`deriver_a_input`,`deriver_b_input`]);let n=lt(t.binding);return{binding:n,deriver_a_input:pt(n,dt(t.deriver_a_input,`deriver_a_input`),`deriver_a`,`deriver_a_input`),deriver_b_input:pt(n,dt(t.deriver_b_input,`deriver_b_input`),`deriver_b`,`deriver_b_input`)}}function xt(e){let t=l(e,`export result`);j(t,`export result`,[`binding`,`transcript`,`deriver_a_client_package`,`deriver_b_client_package`]);let n=lt(t.binding),r=E(t.transcript,`export result.transcript`,!0);return{binding:n,transcript:r,deriver_a_client_package:ht(n,r,P(t.deriver_a_client_package,`deriver_a_client_package`),`deriver_a`,`deriver_a_client_package`),deriver_b_client_package:ht(n,r,P(t.deriver_b_client_package,`deriver_b_client_package`),`deriver_b`,`deriver_b_client_package`)}}function St(e){let t=l(e,`activation admission receipt`);j(t,`activation admission receipt`,[`binding`,`keyset`]);let n=N(t.binding),r=ut(t.keyset);switch(n.operation){case`registration`:return{binding:n,keyset:r};case`recovery`:return{binding:n,keyset:r}}}function Ct(e){let t=l(e,`activation execute request`);j(t,`activation execute request`,[`binding`,`deriver_a_input`,`deriver_b_input`]);let n=N(t.binding),r=ft(n,dt(t.deriver_a_input,`deriver_a_input`),`deriver_a`,`deriver_a_input`),i=ft(n,dt(t.deriver_b_input,`deriver_b_input`),`deriver_b`,`deriver_b_input`);if(n.operation===`registration`){if(r.operation!==`registration`||i.operation!==`registration`)throw Error(`activation inputs do not match registration binding`);return{binding:n,deriver_a_input:r,deriver_b_input:i}}if(r.operation!==`recovery`||i.operation!==`recovery`)throw Error(`activation inputs do not match recovery binding`);return{binding:n,deriver_a_input:r,deriver_b_input:i}}function wt(e){let t=l(e,`activation result`);j(t,`activation result`,[`binding`,`deriver_a_client_package`,`deriver_b_client_package`,`public_receipt`]);let n=N(t.binding),r=F(t.public_receipt);if(!ae(n.material_activation,r.material_activation))throw Error(`activation result receipt material does not match the admitted binding`);let i=P(t.deriver_a_client_package,`deriver_a_client_package`),a=P(t.deriver_b_client_package,`deriver_b_client_package`),o=mt(n,r,i,`deriver_a`,`deriver_a_client_package`),s=mt(n,r,a,`deriver_b`,`deriver_b_client_package`);switch(n.operation){case`registration`:return{binding:n,deriver_a_client_package:o,deriver_b_client_package:s,public_receipt:r};case`recovery`:return{binding:n,deriver_a_client_package:o,deriver_b_client_package:s,public_receipt:r}}}function Tt(e){let t=N(e);switch(t.operation){case`registration`:throw Error(`recovery activation requires a recovery binding`);case`recovery`:return t}}function Et(e){let t=l(e,`recovery activation receipt`);j(t,`recovery activation receipt`,[`binding`,`public_receipt`,`active_capability_binding`,`retired_capability_binding`]);let n=E(t.active_capability_binding,`recovery activation receipt.active_capability_binding`,!0),r=E(t.retired_capability_binding,`recovery activation receipt.retired_capability_binding`,!0);if(D(n,r))throw Error(`recovery activation receipt capability bindings must be distinct`);return{binding:Tt(t.binding),public_receipt:F(t.public_receipt),active_capability_binding:n,retired_capability_binding:r}}function Dt(e,t){return e.binding.operation===t}function Ot(e,t){return e.binding.operation===t}function kt(e,t){return e.binding.operation===t}function L(e){return{ok:!1,code:`invalid_body`,message:`activation value must use the ${e} operation`}}function At(e){return I(gt,e)}function jt(e){return I(_t,e)}function Mt(e){return I(vt,e)}function Nt(e){return I(yt,e)}function Pt(e){return I(bt,e)}function Ft(e){return I(xt,e)}function It(e){return I(St,e)}function Lt(e){let t=It(e);return t.ok?Dt(t.value,`registration`)?{ok:!0,value:t.value}:L(`registration`):t}function Rt(e){let t=It(e);return t.ok?Dt(t.value,`recovery`)?{ok:!0,value:t.value}:L(`recovery`):t}function zt(e){return I(Ct,e)}function Bt(e){let t=zt(e);return t.ok?Ot(t.value,`registration`)?{ok:!0,value:t.value}:L(`registration`):t}function Vt(e){let t=zt(e);return t.ok?Ot(t.value,`recovery`)?{ok:!0,value:t.value}:L(`recovery`):t}function Ht(e){return I(wt,e)}function Ut(e){let t=Ht(e);return t.ok?kt(t.value,`registration`)?{ok:!0,value:t.value}:L(`registration`):t}function Wt(e){let t=Ht(e);return t.ok?kt(t.value,`recovery`)?{ok:!0,value:t.value}:L(`recovery`):t}function Gt(e){return I(Et,e)}function Kt(e){return I(qt,e)}function qt(e){return P(e,`encrypted_package`)}const Jt=`seams/linked-device/ecdsa-source-contribution-envelope/v1`;function Yt(e){let t=c(e,`linked-device ordinary source contribution`);switch(t.kind){case`linked_device_ed25519_source_contribution_v1`:return nn(t);case`linked_device_ecdsa_source_contribution_v1`:return rn(t);default:throw Error(`linked-device ordinary source contribution kind is invalid`)}}function Xt(e){let t=q(e,[`state`,`reservation_id`,`participant_ids`,`activation_receipt`,`deriver_a_client_package`,`deriver_b_client_package`],`linked-device Ed25519 source-preserving reservation`);if(t.state!==`inactive`)throw Error(`linked-device Ed25519 source-preserving reservation is not inactive`);let n=F(t.activation_receipt),r=it(t.participant_ids),i=R(t.deriver_a_client_package,`deriver_a`),a=R(t.deriver_b_client_package,`deriver_b`);if(!k(n.transcript,i.transcript)||!k(n.transcript,a.transcript))throw Error(`linked-device Ed25519 reservation packages have mismatched transcripts`);return{state:`inactive`,reservationId:K(t.reservation_id,`reservation_id`),participantIds:r,activationReceipt:n,deriver_a_client_package:i,deriver_b_client_package:a}}function Zt(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`linked-device ordinary source contributions must contain one or two entries`);let t=e.map(Yt),n=t.map(e=>e.keyFamily);if(new Set(n).size!==n.length)throw Error(`linked-device ordinary source contributions repeat a key family`);if(t.length===2&&(t[0]?.keyFamily!==`ed25519`||t[1]?.keyFamily!==`ecdsa_secp256k1`))throw Error(`linked-device ordinary source contributions must be Ed25519 then ECDSA`);let r=t[0];if(!r)throw Error(`linked-device ordinary source contributions are empty`);return[r,...t.slice(1)]}function Qt(e){let t=q(e,[`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`source`,`target`],`linked-device ECDSA source contribution preparation`),n=fn(t.source),r=pn(t.target);return bn(n.activation,r.activation),{linkSessionId:B(t.linkSessionId),enrollmentId:V(t.enrollmentId),sourceAuthorityId:H(t.sourceAuthorityId),source:n,target:r}}function $t(e){let t=c(e,`linked-device ordinary source contribution preparation`);if(t.kind===`linked_device_ed25519_source_contribution_preparation_v1`)return tn(t);if(Object.prototype.hasOwnProperty.call(t,`source`)&&Object.prototype.hasOwnProperty.call(t,`target`))return Qt(t);throw Error(`linked-device ordinary source contribution preparation family is invalid`)}function en(e){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`linked-device ordinary source contribution preparations must contain one or two entries`);let t=e.map($t),n=t.map(e=>`kind`in e?`ed25519`:`ecdsa_secp256k1`);if(new Set(n).size!==n.length)throw Error(`linked-device ordinary source contribution preparations repeat a key family`);if(t.length===2&&(n[0]!==`ed25519`||n[1]!==`ecdsa_secp256k1`))throw Error(`linked-device ordinary source contribution preparations must be ordered Ed25519 then ECDSA`);let r=t[0];if(!r)throw Error(`linked-device ordinary source contribution preparation is empty`);return[r,...t.slice(1)]}function tn(e){if(q(e,[`kind`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`sourceBinding`,`targetAdmission`,`applicationBinding`,`sourceRevocationEpoch`,`participantIds`,`targetMaterialActivation`,`targetClientRecipientPublicKeyB64u`,`targetSigningWorkerRecipientPublicKeyB64u`,`sourceRegisteredPublicKeyB64u`],`linked-device Ed25519 source contribution preparation`),e.kind!==`linked_device_ed25519_source_contribution_preparation_v1`)throw Error(`linked-device Ed25519 source contribution preparation kind is invalid`);let t=N(e.sourceBinding),n=Lt(e.targetAdmission);if(!n.ok)throw Error(`targetAdmission ${n.message}`);let r=n.value,a=M(e.applicationBinding);if(typeof e.sourceRevocationEpoch!=`number`||!Number.isSafeInteger(e.sourceRevocationEpoch)||e.sourceRevocationEpoch<0)throw Error(`sourceRevocationEpoch must be a non-negative safe integer`);let o=z(e.targetMaterialActivation,`targetMaterialActivation`),s=B(e.linkSessionId),c=V(e.enrollmentId),l=H(e.sourceAuthorityId),u=Sn(e.walletKeyId),d=U(e.targetDeviceId),f=W(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),ee=G(e.targetClientRecipientPublicKeyB64u,32,`targetClientRecipientPublicKeyB64u`),m=G(e.targetSigningWorkerRecipientPublicKeyB64u,32,`targetSigningWorkerRecipientPublicKeyB64u`);if(ee===m)throw Error(`linked-device Ed25519 source contribution recipients must differ`);let h=it(e.participantIds);if(_n(t,s,`sourceBinding`),!i(o,v(r.binding.material_activation)))throw Error(`targetAdmission activation differs from targetMaterialActivation`);if(!vn(t,r.binding))throw Error(`source and target Ed25519 contribution bindings differ`);if(t.material_activation.activation_id===o.activationId)throw Error(`source and target Ed25519 contribution activations must differ`);return{kind:`linked_device_ed25519_source_contribution_preparation_v1`,linkSessionId:s,enrollmentId:c,sourceAuthorityId:l,walletKeyId:u,targetDeviceId:d,targetFactorVerificationDigestB64u:f,sourceBinding:t,targetAdmission:r,applicationBinding:a,sourceRevocationEpoch:e.sourceRevocationEpoch,participantIds:h,targetMaterialActivation:o,targetClientRecipientPublicKeyB64u:ee,targetSigningWorkerRecipientPublicKeyB64u:m,sourceRegisteredPublicKeyB64u:p(e.sourceRegisteredPublicKeyB64u,`sourceRegisteredPublicKeyB64u`)}}function nn(e){if(q(e,[`kind`,`keyFamily`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`targetMaterialActivation`,`targetClientRecipientPublicKeyB64u`,`targetSigningWorkerRecipientPublicKeyB64u`,`sourceBinding`,`reservationId`,`targetBinding`,`activationReceipt`,`participantIds`,`deriver_a_client_package`,`deriver_b_client_package`,`sourceRegisteredPublicKeyB64u`],`linked-device Ed25519 source contribution`),e.kind!==`linked_device_ed25519_source_contribution_v1`)throw Error(`linked-device Ed25519 source contribution kind is invalid`);if(e.keyFamily!==`ed25519`)throw Error(`linked-device Ed25519 source contribution family is invalid`);let t=N(e.sourceBinding),n=z(e.targetMaterialActivation,`source contribution targetMaterialActivation`),r=hn(e.targetBinding,`targetBinding`),a=F(e.activationReceipt),o=K(e.reservationId,`reservationId`),s=it(e.participantIds),c=B(e.linkSessionId),l=V(e.enrollmentId),u=H(e.sourceAuthorityId),d=Sn(e.walletKeyId),ee=U(e.targetDeviceId),m=W(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),h=G(e.targetClientRecipientPublicKeyB64u,32,`targetClientRecipientPublicKeyB64u`),te=G(e.targetSigningWorkerRecipientPublicKeyB64u,32,`targetSigningWorkerRecipientPublicKeyB64u`);if(h===te)throw Error(`linked-device Ed25519 source contribution recipients must differ`);if(_n(t,c,`sourceBinding`),gn(r,c,n,`targetBinding`),!vn(t,r))throw Error(`linked-device Ed25519 source contribution stable identity differs`);if(!i(v(a.material_activation),n))throw Error(`linked-device Ed25519 source contribution receipt activation differs`);let g=p(e.sourceRegisteredPublicKeyB64u,`sourceRegisteredPublicKeyB64u`);if(!k(a.registered_public_key,Array.from(f(g))))throw Error(`linked-device Ed25519 source contribution receipt public key differs`);let ne=R(e.deriver_a_client_package,`deriver_a`),_=R(e.deriver_b_client_package,`deriver_b`);if(!k(a.transcript,ne.transcript)||!k(a.transcript,_.transcript))throw Error(`linked-device Ed25519 source contribution package transcript differs`);if(t.material_activation.activation_id===n.activationId)throw Error(`linked-device Ed25519 source contribution reuses the source activation`);return{kind:`linked_device_ed25519_source_contribution_v1`,keyFamily:`ed25519`,linkSessionId:c,enrollmentId:l,sourceAuthorityId:u,walletKeyId:d,targetDeviceId:ee,targetFactorVerificationDigestB64u:m,targetMaterialActivation:n,targetClientRecipientPublicKeyB64u:h,targetSigningWorkerRecipientPublicKeyB64u:te,sourceBinding:t,reservationId:o,targetBinding:r,activationReceipt:a,participantIds:s,deriver_a_client_package:ne,deriver_b_client_package:_,sourceRegisteredPublicKeyB64u:g}}function rn(e){if(q(e,[`kind`,`keyFamily`,`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`walletKeyId`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`sourceSigner`,`sourceDerivation`,`target`,`package`],`linked-device ECDSA source contribution`),e.kind!==`linked_device_ecdsa_source_contribution_v1`)throw Error(`linked-device ECDSA source contribution kind is invalid`);if(e.keyFamily!==`ecdsa_secp256k1`)throw Error(`linked-device ECDSA source contribution family is invalid`);let t=B(e.linkSessionId),n=V(e.enrollmentId),r=H(e.sourceAuthorityId),i=Sn(e.walletKeyId),a=U(e.targetDeviceId),o=W(e.targetFactorVerificationDigestB64u,`targetFactorVerificationDigestB64u`),s=fn(e.sourceSigner),c=an(e.sourceDerivation),l=pn(e.target);bn(s.activation,l.activation);let u=un(e.package);if(u.binding.linkSessionId!==t||u.binding.enrollmentId!==n||u.binding.sourceAuthorityId!==r||u.binding.target.targetDeviceId!==a||u.binding.target.targetFactorVerificationDigestB64u!==o)throw Error(`linked-device ECDSA source contribution package binding differs`);if(!yn(u.binding.source,s))throw Error(`linked-device ECDSA source contribution signer differs from package binding`);if(!xn(u.binding.target,l))throw Error(`linked-device ECDSA source contribution target differs from package binding`);return{kind:`linked_device_ecdsa_source_contribution_v1`,keyFamily:`ecdsa_secp256k1`,linkSessionId:t,enrollmentId:n,sourceAuthorityId:r,walletKeyId:i,targetDeviceId:a,targetFactorVerificationDigestB64u:o,sourceSigner:s,sourceDerivation:c,target:l,package:u}}function an(e){let t=q(e,[`applicationBindingDigestB64u`,`clientShareRetryCounter`,`ecdsaThresholdKeyId`,`sourceNormalSigning`],`linked-device ECDSA source derivation`),n=t.clientShareRetryCounter;if(typeof n!=`number`||!Number.isSafeInteger(n)||n<0)throw Error(`linked-device ECDSA source derivation retry counter is invalid`);let r=W(t.applicationBindingDigestB64u,`sourceDerivation.applicationBindingDigestB64u`),i=ie(t.sourceNormalSigning),a=re(t.ecdsaThresholdKeyId);if(i.scope.context.application_binding_digest_b64u!==r||i.scope.public_identity.client_share_retry_counter!==n||i.scope.ecdsa_threshold_key_id!==a)throw Error(`linked-device ECDSA source derivation differs from normal signing`);return{applicationBindingDigestB64u:r,clientShareRetryCounter:n,ecdsaThresholdKeyId:a,sourceNormalSigning:i}}function on(e){let t=q(e,[`state`,`binding`,`sourceDerivation`,`targetRelayerPublicKey33B64u`,`thresholdPublicKey33B64u`,`thresholdEthereumAddress20B64u`,`normalSigning`],`linked-device ECDSA source-preserving activation receipt`);if(t.state!==`inactive`)throw Error(`linked-device ECDSA source-preserving activation receipt is not inactive`);let n=dn(t.binding),r=an(t.sourceDerivation),i=h(t.targetRelayerPublicKey33B64u,`targetRelayerPublicKey33B64u`),a=h(t.thresholdPublicKey33B64u,`thresholdPublicKey33B64u`),o=G(t.thresholdEthereumAddress20B64u,20,`thresholdEthereumAddress20B64u`),s=ie(t.normalSigning);return sn({binding:n,sourceDerivation:r,targetRelayerPublicKey33B64u:i,thresholdPublicKey33B64u:a,thresholdEthereumAddress20B64u:o,normalSigning:s}),{state:`inactive`,binding:n,sourceDerivation:r,targetRelayerPublicKey33B64u:i,thresholdPublicKey33B64u:a,thresholdEthereumAddress20B64u:o,normalSigning:s}}function sn(e){let t=e.sourceDerivation.sourceNormalSigning.scope,n=e.normalSigning.scope;if(!i(v(t.material_activation),e.binding.source.activation)||!i(v(n.material_activation),e.binding.target.activation)||t.wallet_id!==n.wallet_id||t.wallet_id!==e.binding.source.activation.materialOwner||n.wallet_id!==e.binding.target.activation.materialOwner||t.ecdsa_threshold_key_id!==n.ecdsa_threshold_key_id||t.signing_root_id!==n.signing_root_id||t.signing_root_version!==n.signing_root_version||t.context.application_binding_digest_b64u!==n.context.application_binding_digest_b64u||t.activation_epoch!==n.activation_epoch||t.public_identity.derivation_client_share_public_key33_b64u!==e.binding.source.clientPublicKey33B64u||t.public_identity.server_public_key33_b64u!==e.binding.source.relayerPublicKey33B64u||t.public_identity.threshold_public_key33_b64u!==e.binding.source.thresholdPublicKey33B64u||t.public_identity.ethereum_address20_b64u!==e.binding.source.thresholdEthereumAddress20B64u||n.public_identity.context_binding_b64u!==t.public_identity.context_binding_b64u||n.public_identity.derivation_client_share_public_key33_b64u!==e.binding.targetClientPublicKey33B64u||n.public_identity.server_public_key33_b64u!==e.targetRelayerPublicKey33B64u||n.public_identity.threshold_public_key33_b64u!==e.thresholdPublicKey33B64u||n.public_identity.ethereum_address20_b64u!==e.thresholdEthereumAddress20B64u||n.public_identity.client_share_retry_counter!==t.public_identity.client_share_retry_counter||n.public_identity.server_share_retry_counter!==t.public_identity.server_share_retry_counter||n.signing_worker.server_id!==e.binding.target.activation.signingWorker||n.signing_worker.key_epoch!==t.signing_worker.key_epoch||n.signing_worker.recipient_encryption_key!==cn(e.binding.target.signingWorkerRecipientPublicKeyB64u))throw Error(`linked-device ECDSA normal signing state differs from its activation receipt`)}function cn(e){let t=f(e);if(t.length!==32||d(t)!==e)throw Error(`linked-device signing-worker recipient key is invalid`);let n=``;for(let e of t)n+=e.toString(16).padStart(2,`0`);return`x25519:${n}`}function R(e,t){let n=ln(e,`${t} client package`);if(n.kind!==`activation_client`||n.deriver!==t)throw Error(`${t} client package is not an activation client package`);return t===`deriver_a`?{kind:`activation_client`,deriver:`deriver_a`,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}:{kind:`activation_client`,deriver:`deriver_b`,session:n.session,transcript:n.transcript,encapsulated_key:n.encapsulated_key,ciphertext:n.ciphertext}}function ln(e,t){let n=Kt(e);if(!n.ok)throw Error(`${t} ${n.message}`);return n.value}function un(e){let t=q(e,[`binding`,`encryptedDelta`,`encryptedTargetClientShare`],`linked-device ECDSA source contribution package`),n=dn(t.binding),r=mn(t.encryptedDelta,`encryptedDelta`),i=mn(t.encryptedTargetClientShare,`encryptedTargetClientShare`),a=r.bindingDigestB64u;if(i.bindingDigestB64u!==a)throw Error(`linked-device ECDSA source contribution envelope bindings differ`);if(r.recipientPublicKeyB64u!==n.target.signingWorkerRecipientPublicKeyB64u||i.recipientPublicKeyB64u!==n.target.clientRecipientPublicKeyB64u)throw Error(`linked-device ECDSA source contribution envelope recipients differ`);return{binding:n,encryptedDelta:r,encryptedTargetClientShare:i}}function dn(e){let t=q(e,[`linkSessionId`,`enrollmentId`,`sourceAuthorityId`,`source`,`target`,`targetClientPublicKey33B64u`],`linked-device ECDSA source contribution binding`),n=fn(t.source),r=pn(t.target);return bn(n.activation,r.activation),{linkSessionId:K(t.linkSessionId,`binding.linkSessionId`),enrollmentId:K(t.enrollmentId,`binding.enrollmentId`),sourceAuthorityId:K(t.sourceAuthorityId,`binding.sourceAuthorityId`),source:n,target:r,targetClientPublicKey33B64u:h(t.targetClientPublicKey33B64u,`binding.targetClientPublicKey33B64u`)}}function fn(e){let t=q(e,[`activation`,`clientPublicKey33B64u`,`relayerPublicKey33B64u`,`thresholdPublicKey33B64u`,`thresholdEthereumAddress20B64u`],`linked-device ECDSA source signer`);return{activation:z(t.activation,`source.activation`),clientPublicKey33B64u:h(t.clientPublicKey33B64u,`source.clientPublicKey33B64u`),relayerPublicKey33B64u:h(t.relayerPublicKey33B64u,`source.relayerPublicKey33B64u`),thresholdPublicKey33B64u:h(t.thresholdPublicKey33B64u,`source.thresholdPublicKey33B64u`),thresholdEthereumAddress20B64u:G(t.thresholdEthereumAddress20B64u,20,`source.thresholdEthereumAddress20B64u`)}}function pn(e){let t=q(e,[`activation`,`targetDeviceId`,`targetFactorVerificationDigestB64u`,`clientRecipientPublicKeyB64u`,`signingWorkerRecipientPublicKeyB64u`],`linked-device ECDSA target recipient`),n=G(t.clientRecipientPublicKeyB64u,32,`target.clientRecipientPublicKeyB64u`),r=G(t.signingWorkerRecipientPublicKeyB64u,32,`target.signingWorkerRecipientPublicKeyB64u`);if(n===r)throw Error(`linked-device ECDSA target recipients must differ`);return{activation:z(t.activation,`target.activation`),targetDeviceId:U(t.targetDeviceId),targetFactorVerificationDigestB64u:W(t.targetFactorVerificationDigestB64u,`target.targetFactorVerificationDigestB64u`),clientRecipientPublicKeyB64u:n,signingWorkerRecipientPublicKeyB64u:r}}function mn(e,t){let n=q(e,[`kind`,`recipientPublicKeyB64u`,`bindingDigestB64u`,`encappedKeyB64u`,`ciphertextB64u`],`linked-device ECDSA ${t}`);if(n.kind!==Jt)throw Error(`${t}.kind is invalid`);return{kind:Jt,recipientPublicKeyB64u:G(n.recipientPublicKeyB64u,32,`${t}.recipientPublicKeyB64u`),bindingDigestB64u:W(n.bindingDigestB64u,`${t}.bindingDigestB64u`),encappedKeyB64u:G(n.encappedKeyB64u,32,`${t}.encappedKeyB64u`),ciphertextB64u:te(n.ciphertextB64u,`${t}.ciphertextB64u`)}}function hn(e,t){let n=N(e);if(n.operation!==`registration`)throw Error(`${t} must use the registration operation`);return n}function gn(e,t,n,r){if(e.material_activation.activation_id!==n.activationId)throw Error(`${r} activation does not match the target activation`);if(e.material_activation.material_owner!==n.materialOwner)throw Error(`${r} material owner does not match the target activation`);if(e.material_activation.signing_worker!==n.signingWorker)throw Error(`${r} signing worker does not match the target activation`);if(e.session_id.length!==32||String(t).length===0)throw Error(`${r} link binding is invalid`)}function _n(e,t,n){if(e.session_id.length!==32||String(t).length===0)throw Error(`${n} link binding is invalid`)}function vn(e,t){return e.stable_key_context_binding.every((e,n)=>e===t.stable_key_context_binding[n])&&e.material_activation.capability===t.material_activation.capability&&e.material_activation.material_owner===t.material_activation.material_owner&&e.material_activation.key_binding===t.material_activation.key_binding&&e.material_activation.lifecycle_binding===t.material_activation.lifecycle_binding&&e.material_activation.signing_worker===t.material_activation.signing_worker&&e.lifecycle.root_share_epoch===t.lifecycle.root_share_epoch&&e.lifecycle.account_id===t.lifecycle.account_id&&e.lifecycle.signer_set_id===t.lifecycle.signer_set_id&&e.lifecycle.selected_server_id===t.lifecycle.selected_server_id}function yn(e,t){return i(e.activation,t.activation)&&e.clientPublicKey33B64u===t.clientPublicKey33B64u&&e.relayerPublicKey33B64u===t.relayerPublicKey33B64u&&e.thresholdPublicKey33B64u===t.thresholdPublicKey33B64u&&e.thresholdEthereumAddress20B64u===t.thresholdEthereumAddress20B64u}function bn(e,t){if(i(e,t)||e.materialOwner!==t.materialOwner||e.signingWorker!==t.signingWorker)throw Error(`linked-device ECDSA source and target activations are invalid`)}function xn(e,t){return i(e.activation,t.activation)&&e.targetDeviceId===t.targetDeviceId&&e.targetFactorVerificationDigestB64u===t.targetFactorVerificationDigestB64u&&e.clientRecipientPublicKeyB64u===t.clientRecipientPublicKeyB64u&&e.signingWorkerRecipientPublicKeyB64u===t.signingWorkerRecipientPublicKeyB64u}function z(e,t){let n=r(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function B(e){let t=s(K(e,`linkSessionId`));if(!t.ok)throw Error(`linkSessionId ${t.error.message}`);return t.value}function V(e){let t=n(K(e,`enrollmentId`));if(!t.ok)throw Error(`enrollmentId ${t.error.message}`);return t.value}function H(e){let n=t(K(e,`sourceAuthorityId`));if(!n.ok)throw Error(`sourceAuthorityId ${n.error.message}`);return n.value}function Sn(t){let n=e(K(t,`walletKeyId`));if(!n.ok)throw Error(`walletKeyId ${n.error.message}`);return n.value}function U(e){let t=ne(K(e,`targetDeviceId`));if(!t.ok)throw Error(`targetDeviceId ${t.error.message}`);return t.value}function W(e,t){try{return _(e)}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}function G(e,t,n){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} must be canonical base64url`);let r;try{r=f(e)}catch{throw Error(`${n} must be canonical base64url`)}if(r.length!==t||d(r)!==e)throw Error(`${n} must decode to ${t} bytes`);return e}function K(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e||[...e].some(e=>{let t=e.charCodeAt(0);return t<32||t===127}))throw Error(`${t} must be a non-empty visible string`);return e}function q(e,t,n){let r=c(e,n),i=new Set(t),a=Object.keys(r);if(a.length!==t.length||a.some(e=>!i.has(e))||t.some(e=>!Object.prototype.hasOwnProperty.call(r,e)))throw Error(`${n} contains unknown or missing fields`);return r}function Cn(e){return br(e)}function wn(e){return yr(e.signerActivations)}function Tn(e){return vr(e.signerActivations)}function En(e){return e.provenance.kind===`wallet_recovery`}function Dn(e){return{kind:`wallet_ed25519_signer_activation_v1`,signer:e.signer,materialActivation:e.materialActivation}}function On(e){return{kind:`wallet_ecdsa_signer_activation_v1`,signer:e.signer,materialActivation:e.materialActivation}}function kn(e){let t=pe(e.manifest),n=_r(e.materialActivations);if(!ur(t.keyFamilies,n.keyFamilies))throw Error(`wallet signer activation materials must match the signer manifest families`);if(dr(t)){if(!mr(n))throw Error(`Ed25519 signer activation requires one Ed25519 material activation`);return{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`],ed25519:Dn({signer:t.signers[0],materialActivation:n.ed25519})}}if(fr(t)){if(!hr(n))throw Error(`ECDSA signer activation requires one ECDSA material activation`);return{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ecdsa_secp256k1`],ecdsa:On({signer:t.signers[0],materialActivation:n.ecdsa})}}if(!pr(t)||!gr(n))throw Error(`wallet signer activation set has unsupported families`);if(n.ed25519.activationId===n.ecdsa.activationId)throw Error(`wallet signer activation references must be distinct`);return{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:Dn({signer:t.signers[0],materialActivation:n.ed25519}),ecdsa:On({signer:t.signers[1],materialActivation:n.ecdsa})}}function An(e){try{let t=l(e,`WalletSignerActivationSetV1`);if(t.kind!==`wallet_signer_activation_set_v1`)return $(`wallet signer activation set kind is unsupported`);if(!Object.prototype.hasOwnProperty.call(t,`keyFamilies`))return $(`WalletSignerActivationSetV1.keyFamilies is required`);let n=lr(t.keyFamilies,`WalletSignerActivationSetV1.keyFamilies`);if(n.length===1&&n[0]===`ed25519`)return J(t,[`kind`,`keyFamilies`,`ed25519`],`WalletSignerActivationSetV1`),{ok:!0,value:{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`],ed25519:Zn(t.ed25519,`ed25519`)}};if(n.length===1&&n[0]===`ecdsa_secp256k1`)return J(t,[`kind`,`keyFamilies`,`ecdsa`],`WalletSignerActivationSetV1`),{ok:!0,value:{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ecdsa_secp256k1`],ecdsa:Qn(t.ecdsa,`ecdsa`)}};J(t,[`kind`,`keyFamilies`,`ed25519`,`ecdsa`],`WalletSignerActivationSetV1`);let r=Zn(t.ed25519,`ed25519`),i=Qn(t.ecdsa,`ecdsa`);return r.materialActivation.activationId===i.materialActivation.activationId?$(`wallet signer activation references must be distinct`):{ok:!0,value:{kind:`wallet_signer_activation_set_v1`,keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:r,ecdsa:i}}}catch(e){return $(xr(e,`wallet signer activation set is invalid`))}}function jn(e){let t=[y(`seams/wallet-signer-activation-set/v1`,`domain`),y(e.kind,`kind`),se(e.keyFamilies.length,`keyFamilies`)];for(let n of e.keyFamilies)t.push(y(n,`keyFamilies.item`));return(vr(e)||br(e))&&t.push(x(er(e.ed25519),`ed25519`)),(yr(e)||br(e))&&t.push(x(tr(e.ecdsa),`ecdsa`)),S(t)}async function Mn(e){return _(d(await u(jn(e))))}function Nn(e){return{kind:`wallet_authority_v1`,authorityId:e.authorityId,walletId:e.walletId,principal:e.principal,provenance:e.provenance,permissions:e.permissions,signerActivations:e.signerActivations,signerActivationSetDigestB64u:e.signerActivationSetDigestB64u,authorityDigestB64u:e.authorityDigestB64u,revocationEpoch:e.revocationEpoch,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs}}function Pn(e){return Kn(e),{...Nn(e),state:`pending_local_install`,localInstallPackageSetDigestB64u:e.localInstallPackageSetDigestB64u}}function Fn(e){return Kn(e),{...Nn(e),state:`active`,activatedAtMs:e.activatedAtMs}}async function In(e){let t=e.authority.signerActivations;if(!t.ed25519)throw Error(`active Wallet Authority has no Ed25519 material activation to replace`);let n=t.ecdsa?kn({manifest:C([t.ed25519.signer,t.ecdsa.signer]),materialActivations:{keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:e.materialActivation,ecdsa:t.ecdsa.materialActivation}}):kn({manifest:C([t.ed25519.signer]),materialActivations:{keyFamilies:[`ed25519`],ed25519:e.materialActivation}}),r=await Mn(n),i={kind:e.authority.kind,authorityId:e.authority.authorityId,walletId:e.authority.walletId,principal:e.authority.principal,provenance:e.authority.provenance,permissions:e.authority.permissions,signerActivations:n,signerActivationSetDigestB64u:r,authorityDigestB64u:e.authority.authorityDigestB64u,revocationEpoch:e.authority.revocationEpoch,createdAtMs:e.authority.createdAtMs,updatedAtMs:Math.max(e.authority.updatedAtMs,e.updatedAtMs),state:`active`,activatedAtMs:e.authority.activatedAtMs};return Fn({...i,authorityDigestB64u:await Hn(i)})}function Ln(e){return Kn(e),{...Nn(e),state:`active`,activatedAtMs:e.activatedAtMs}}function Rn(e){return Kn(e),{...Nn(e),state:`revoked`,activatedAtMs:e.activatedAtMs,revokedAtMs:e.revokedAtMs}}const zn=[`kind`,`authorityId`,`walletId`,`principal`,`provenance`,`permissions`,`signerActivations`,`signerActivationSetDigestB64u`,`authorityDigestB64u`,`revocationEpoch`,`createdAtMs`,`updatedAtMs`,`state`];function Bn(e){try{let t=l(e,`WalletAuthorityV1`),n=Gn(t);switch(t.state){case`pending_local_install`:return J(t,[...zn,`localInstallPackageSetDigestB64u`],`WalletAuthorityV1`),{ok:!0,value:Pn({kind:`wallet_authority_v1`,...n,state:`pending_local_install`,localInstallPackageSetDigestB64u:Y(t.localInstallPackageSetDigestB64u,`localInstallPackageSetDigestB64u`)})};case`active`:return J(t,[...zn,`activatedAtMs`],`WalletAuthorityV1`),{ok:!0,value:Fn({kind:`wallet_authority_v1`,...n,state:`active`,activatedAtMs:X(t.activatedAtMs,`activatedAtMs`)})};case`revoked`:return J(t,[...zn,`activatedAtMs`,`revokedAtMs`],`WalletAuthorityV1`),{ok:!0,value:Rn({kind:`wallet_authority_v1`,...n,state:`revoked`,activatedAtMs:X(t.activatedAtMs,`activatedAtMs`),revokedAtMs:X(t.revokedAtMs,`revokedAtMs`)})};default:return $(`WalletAuthorityV1.state is unsupported`)}}catch(e){return $(xr(e,`wallet authority is invalid`))}}function Vn(e){return S([y(`seams/wallet-authority/v1`,`domain`),y(e.kind,`kind`),y(e.authorityId,`authorityId`),y(e.walletId,`walletId`),x(ar(e.principal),`principal`),x(or(e.provenance),`provenance`),x(sr(e.permissions),`permissions`),ce(e.signerActivationSetDigestB64u,`signerActivationSetDigestB64u`),y(e.state,`state`),le(e.revocationEpoch,`revocationEpoch`)])}async function Hn(e){return _(d(await u(Vn(e))))}async function Un(e){return await Mn(e.signerActivations)===e.signerActivationSetDigestB64u?await Hn(e)===e.authorityDigestB64u:!1}async function Wn(e,t){let[n,r]=await Promise.all([Un(e),Un(t)]);return n&&r&&e.authorityDigestB64u===t.authorityDigestB64u&&e.signerActivationSetDigestB64u===t.signerActivationSetDigestB64u&&e.createdAtMs===t.createdAtMs&&e.updatedAtMs===t.updatedAtMs&&e.activatedAtMs===t.activatedAtMs}function Gn(e){if(e.kind!==`wallet_authority_v1`)throw Error(`WalletAuthorityV1.kind is unsupported`);let n=Q(t(e.authorityId),`authorityId`),r=Q(o(e.walletId),`walletId`),i=qn(e.principal),a=Jn(e.provenance),s=Q(ee(e.permissions),`permissions`),c=Q(An(e.signerActivations),`signerActivations`),l=Y(e.signerActivationSetDigestB64u,`signerActivationSetDigestB64u`),u=Y(e.authorityDigestB64u,`authorityDigestB64u`),d=X(e.revocationEpoch,`revocationEpoch`),f=X(e.createdAtMs,`createdAtMs`),p=X(e.updatedAtMs,`updatedAtMs`);return Xn(c,r),{authorityId:n,walletId:r,principal:i,provenance:a,permissions:s,signerActivations:c,signerActivationSetDigestB64u:l,authorityDigestB64u:u,revocationEpoch:d,createdAtMs:f,updatedAtMs:p}}function Kn(e){if(e.kind!==`wallet_authority_v1`)throw Error(`wallet authority kind is unsupported`);if(!Number.isSafeInteger(e.revocationEpoch)||e.revocationEpoch<0)throw Error(`wallet authority revocationEpoch must be a non-negative safe integer`);if(Z(e.createdAtMs,`createdAtMs`),Z(e.updatedAtMs,`updatedAtMs`),e.updatedAtMs<e.createdAtMs)throw Error(`wallet authority updatedAtMs cannot precede createdAtMs`);switch(Y(e.signerActivationSetDigestB64u,`signerActivationSetDigestB64u`),Y(e.authorityDigestB64u,`authorityDigestB64u`),Xn(e.signerActivations,e.walletId),Yn(e.provenance),e.state){case`pending_local_install`:Y(e.localInstallPackageSetDigestB64u,`localInstallPackageSetDigestB64u`);break;case`active`:Z(e.activatedAtMs,`activatedAtMs`);break;case`revoked`:if(Z(e.activatedAtMs,`activatedAtMs`),Z(e.revokedAtMs,`revokedAtMs`),e.revokedAtMs<e.activatedAtMs)throw Error(`revokedAtMs cannot precede activatedAtMs`);break}}function qn(e){let t=cr(e,[`kind`,`deviceId`],`WalletAuthorityPrincipalV1`);if(t.kind!==`owner_device`)throw Error(`wallet authority principal kind is unsupported`);return{kind:`owner_device`,deviceId:Q(ne(t.deviceId),`deviceId`)}}function Jn(e){let r=l(e,`WalletAuthorityProvenanceV1`);switch(r.kind){case`wallet_registration`:return J(r,[`kind`],`WalletAuthorityProvenanceV1`),{kind:`wallet_registration`};case`device_link`:return J(r,[`kind`,`enrollmentId`,`sourceAuthorityId`,`linkSessionId`],`WalletAuthorityProvenanceV1`),{kind:`device_link`,enrollmentId:Q(n(r.enrollmentId),`enrollmentId`),sourceAuthorityId:Q(t(r.sourceAuthorityId),`sourceAuthorityId`),linkSessionId:Q(s(r.linkSessionId),`linkSessionId`)};case`wallet_recovery`:return J(r,[`kind`,`recoveryOperationId`,`continuityAuthorityId`],`WalletAuthorityProvenanceV1`),{kind:`wallet_recovery`,recoveryOperationId:Q(a(r.recoveryOperationId),`recoveryOperationId`),continuityAuthorityId:Q(t(r.continuityAuthorityId),`continuityAuthorityId`)};default:throw Error(`wallet authority provenance kind is unsupported`)}}function Yn(e){switch(e.kind){case`wallet_registration`:return;case`device_link`:if(!e.enrollmentId||!e.sourceAuthorityId||!e.linkSessionId)throw Error(`device-link provenance requires every audit identity`);return;case`wallet_recovery`:if(!e.recoveryOperationId||!e.continuityAuthorityId)throw Error(`wallet-recovery provenance requires every audit identity`);return}Sr(e,`wallet authority provenance`)}function Xn(e,t){if(vr(e)){if(e.ed25519.signer.walletId!==t)throw Error(`Ed25519 signer activation uses a different wallet id`);return}if(yr(e)){if(e.ecdsa.signer.walletId!==t)throw Error(`ECDSA signer activation uses a different wallet id`);return}if(br(e)){if(e.ed25519.signer.walletId!==t||e.ecdsa.signer.walletId!==t)throw Error(`signer activations must use the authority wallet id`);return}throw Error(`wallet signer activation families are unsupported`)}function Zn(e,t){let n=cr(e,[`kind`,`signer`,`materialActivation`],t);if(n.kind!==`wallet_ed25519_signer_activation_v1`)throw Error(`${t}.kind is invalid`);let i=$n(n.signer,`ed25519`,`${t}.signer`);if(!dr(i))throw Error(`${t}.signer is not Ed25519`);return Dn({signer:i.signers[0],materialActivation:Q(r(n.materialActivation),`${t}.materialActivation`)})}function Qn(e,t){let n=cr(e,[`kind`,`signer`,`materialActivation`],t);if(n.kind!==`wallet_ecdsa_signer_activation_v1`)throw Error(`${t}.kind is invalid`);let i=$n(n.signer,`ecdsa_secp256k1`,`${t}.signer`);if(!fr(i))throw Error(`${t}.signer is not ECDSA`);return On({signer:i.signers[0],materialActivation:Q(r(n.materialActivation),`${t}.materialActivation`)})}function $n(e,t,n){return pe({kind:`exact_administered_signer_manifest_v1`,keyFamilies:[t],signers:[e]})}function er(e){return S([y(e.kind,`ed25519.kind`),x(nr(e.signer),`ed25519.signer`),x(ir(e.materialActivation),`ed25519.materialActivation`)])}function tr(e){return S([y(e.kind,`ecdsa.kind`),x(rr(e.signer),`ecdsa.signer`),x(ir(e.materialActivation),`ecdsa.materialActivation`)])}function nr(e){return S([y(e.kind,`ed25519.signer.kind`),y(e.keyFamily,`ed25519.signer.keyFamily`),y(e.walletId,`ed25519.signer.walletId`),y(e.walletKeyId,`ed25519.signer.walletKeyId`),x(oe(e.registeredPublicKeyB64u,`ed25519.signer.registeredPublicKeyB64u`),`ed25519.signer.registeredPublicKeyB64u`)])}function rr(e){return S([y(e.kind,`ecdsa.signer.kind`),y(e.keyFamily,`ecdsa.signer.keyFamily`),y(e.walletId,`ecdsa.signer.walletId`),y(e.walletKeyId,`ecdsa.signer.walletKeyId`),x(oe(e.thresholdPublicKey33B64u,`ecdsa.signer.thresholdPublicKey33B64u`),`ecdsa.signer.thresholdPublicKey33B64u`),y(e.evmAddress,`ecdsa.signer.evmAddress`)])}function ir(e){return S([y(e.kind,`materialActivation.kind`),y(e.activationId,`materialActivation.activationId`),y(e.capability,`materialActivation.capability`),y(e.materialOwner,`materialActivation.materialOwner`),y(e.keyBinding,`materialActivation.keyBinding`),y(e.lifecycleBinding,`materialActivation.lifecycleBinding`),y(e.signingWorker,`materialActivation.signingWorker`)])}function ar(e){return S([y(e.kind,`principal.kind`),y(e.deviceId,`principal.deviceId`)])}function or(e){switch(e.kind){case`wallet_registration`:return y(e.kind,`provenance.kind`);case`device_link`:return S([y(e.kind,`provenance.kind`),y(e.enrollmentId,`provenance.enrollmentId`),y(e.sourceAuthorityId,`provenance.sourceAuthorityId`),y(e.linkSessionId,`provenance.linkSessionId`)]);case`wallet_recovery`:return S([y(e.kind,`provenance.kind`),y(e.recoveryOperationId,`provenance.recoveryOperationId`),y(e.continuityAuthorityId,`provenance.continuityAuthorityId`)])}return Sr(e,`wallet authority provenance`)}function sr(e){let t=[se(e.length,`permissions`)];for(let n of e)t.push(x(y(n,`permissions.item`),`permissions.item`));return S(t)}function cr(e,t,n){let r=l(e,n);return J(r,t,n),r}function J(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length)throw Error(`${n} contains unexpected fields`);for(let e of i)if(!r.has(e))throw Error(`${n}.${e} is not allowed`);for(let r of t)if(!Object.prototype.hasOwnProperty.call(e,r))throw Error(`${n}.${r} is required`)}function lr(e,t){if(!Array.isArray(e))throw Error(`${t} must be an array`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`${t} must use canonical family order`)}function ur(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function dr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`}function fr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`}function pr(e){return e.keyFamilies.length===2}function mr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`}function hr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`}function gr(e){return e.keyFamilies.length===2}function _r(e){if(mr(e))return{keyFamilies:[`ed25519`],ed25519:Q(r(e.ed25519),`materialActivations.ed25519`)};if(hr(e))return{keyFamilies:[`ecdsa_secp256k1`],ecdsa:Q(r(e.ecdsa),`materialActivations.ecdsa`)};if(gr(e))return{keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:Q(r(e.ed25519),`materialActivations.ed25519`),ecdsa:Q(r(e.ecdsa),`materialActivations.ecdsa`)};throw Error(`wallet signer activation materials are unsupported`)}function vr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`}function yr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`}function br(e){return e.keyFamilies.length===2}function Y(e,t){try{return _(e)}catch(e){throw Error(`${t} ${xr(e,`is invalid`)}`)}}function X(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function Z(e,t){if(!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`)}function Q(e,t){if(e.ok)return e.value;throw Error(`${t} ${e.error.message}`)}function $(e){return{ok:!1,error:{code:`invalid`,message:e}}}function xr(e,t){return e instanceof Error?e.message:t}function Sr(e,t){throw Error(`${t} branch is unsupported: ${String(e)}`)}async function Cr(e,t,n){let r=await Mn(t),i={kind:`wallet_authority_v1`,authorityId:e.authorityId,walletId:e.walletId,principal:e.principal,provenance:e.provenance,permissions:e.permissions,signerActivations:t,signerActivationSetDigestB64u:r,authorityDigestB64u:e.authorityDigestB64u,revocationEpoch:e.revocationEpoch,createdAtMs:e.createdAtMs,updatedAtMs:Math.max(e.updatedAtMs,n),state:`active`,activatedAtMs:e.activatedAtMs};return Ln({...i,authorityDigestB64u:await Hn(i)})}async function wr(e){if(e.ed25519.signer.walletId!==e.authority.walletId)throw Error(`NEAR signer belongs to a different wallet authority`);let t=e.authority.signerActivations.ecdsa,n=e.ed25519.signer,r=kn({manifest:C([n,t.signer]),materialActivations:{keyFamilies:[`ed25519`,`ecdsa_secp256k1`],ed25519:e.ed25519.materialActivation,ecdsa:t.materialActivation}});if(!Cn(r))throw Error(`Deferred Ed25519 activation did not produce a combined signer activation set`);return Cr(e.authority,r,e.now)}function Tr(e,t){return e.authorityId===t.authorityId&&e.walletId===t.walletId&&e.revocationEpoch===t.revocationEpoch&&e.createdAtMs===t.createdAtMs&&e.activatedAtMs===t.activatedAtMs&&d(ar(e.principal))===d(ar(t.principal))&&d(or(e.provenance))===d(or(t.provenance))&&d(sr(e.permissions))===d(sr(t.permissions))}function Er(e,t){return Tn(e)&&Cn(t.signerActivations)&&Tr(e,t)&&d(er(e.signerActivations.ed25519))===d(er(t.signerActivations.ed25519))}function Dr(e,t){return wn(e)&&Cn(t.signerActivations)&&e.provenance.kind===`wallet_registration`&&Tr(e,t)&&d(tr(e.signerActivations.ecdsa))===d(tr(t.signerActivations.ecdsa))}export{k as $,Ae as A,Ft as B,xn as C,je as D,Ie as E,M as F,Wt as G,Rt as H,st as I,Bt as J,jt as K,Kt as L,Oe as M,Ne as N,ke as O,F as P,Re as Q,Nt as R,yn as S,Fe as T,Vt as U,it as V,Gt as W,At as X,Ut as Y,Mt as Z,on as _,wn as a,$t as b,Cn as c,Bn as d,He as et,An as f,mn as g,Un as h,wr as i,De as j,Me as k,Er as l,Wn as m,Mn as n,pe as nt,Tn as o,In as p,Lt as q,jn as r,En as s,Hn as t,Ee as tt,Dr as u,Xt as v,Pe as w,Zt as x,en as y,Pt as z};

package/dist/esm/sdk/{walletCapabilityBindings-D5YYB7nN.js → walletCapabilityBindings-mPx-6_r-.js}

@@ -1 +1 @@
-import{N as e,k as t}from"./domainIds-t1lp25yU.js";import{c as n,s as r}from"./accountIds-CW2BP-d9.js";import{i}from"./signerSlot-D2RZnb27.js";function a(e){return!e||typeof e!=`object`||Array.isArray(e)?null:e}function o(e){return typeof e==`string`?e.trim():``}function s(e,t){let n=o(e);return n?{ok:!0,value:n}:{ok:!1,error:{code:`missing`,message:`${t} is required`}}}function c(e){let t=typeof e==`number`?e:Number(e);return!Number.isSafeInteger(t)||t<1?{ok:!1,error:{code:`invalid`,message:`signerSlot must be an integer >= 1`}}:{ok:!0,value:t}}function l(e){return{ok:!1,error:{code:`invalid`,message:`${e} must be an object`}}}function u(t){let n=e(t);return n.ok?{ok:!0,value:n.value}:{ok:!1,error:n.error}}function d(e){let n=a(e);if(!n)return l(`WalletIdentity`);let r=t(n.walletId);return r.ok?{ok:!0,value:{walletId:r.value}}:{ok:!1,error:r.error}}function f(e){return{walletId:e.walletId}}function p(e){return{wallet:e.wallet,rpId:e.rpId}}function m(e){let t=o(e.credentialIdB64u);if(!t)throw Error(`credentialIdB64u is required`);return{kind:`passkey`,walletAuthMethodId:e.walletAuthMethodId,scope:e.scope,credentialIdB64u:t}}function h(e){let t=o(e.emailHashHex),n=o(e.registrationAuthorityId);if(!t)throw Error(`emailHashHex is required`);if(!n)throw Error(`registrationAuthorityId is required`);return{kind:`email_otp`,walletAuthMethodId:e.walletAuthMethodId,wallet:e.wallet,emailHashHex:t,registrationAuthorityId:n}}function g(e){return{kind:`voiceid`,walletAuthMethodId:e.walletAuthMethodId,wallet:e.wallet,deviceKeyId:e.deviceKeyId}}function _(e){return{kind:`implicit_near_account`,wallet:e.wallet,nearAccountId:e.nearAccountId}}function v(e){return{kind:`named_near_account`,wallet:e.wallet,nearAccountId:e.nearAccountId}}function y(e){let t=a(e);if(!t)return l(`NearAccountBinding`);let i=d(t.wallet);if(!i.ok)return i;let s=o(t.kind);if(s===`implicit_near_account`){let e=r(t.nearAccountId);return e.ok?{ok:!0,value:_({wallet:i.value,nearAccountId:e.value})}:{ok:!1,error:{code:e.code,message:e.message}}}if(s===`named_near_account`){let e=n(t.nearAccountId);return e.ok?{ok:!0,value:v({wallet:i.value,nearAccountId:e.value})}:{ok:!1,error:{code:e.code,message:e.message}}}return{ok:!1,error:{code:`invalid`,message:`NearAccountBinding kind is invalid`}}}function b(e){let t=c(e.signerSlot);if(!t.ok)throw Error(t.error.message);return{kind:`near_ed25519_signer`,account:e.account,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:t.value}}function x(e){let t=a(e);if(!t)return l(`NearEd25519SignerBinding`);let n=y(t.account);if(!n.ok)return n;let r=s(t.nearEd25519SigningKeyId,`nearEd25519SigningKeyId`);if(!r.ok)return r;let o=c(t.signerSlot);return o.ok?{ok:!0,value:b({account:n.value,nearEd25519SigningKeyId:i(r.value),signerSlot:o.value})}:o}export{p as a,f as c,b as i,x as l,_ as n,m as o,v as r,g as s,h as t,u};
+import{N as e,k as t}from"./domainIds-t1lp25yU.js";import{c as n,s as r}from"./accountIds-DGWFzEnw.js";import{i}from"./signerSlot-BlijMq8C.js";function a(e){return!e||typeof e!=`object`||Array.isArray(e)?null:e}function o(e){return typeof e==`string`?e.trim():``}function s(e,t){let n=o(e);return n?{ok:!0,value:n}:{ok:!1,error:{code:`missing`,message:`${t} is required`}}}function c(e){let t=typeof e==`number`?e:Number(e);return!Number.isSafeInteger(t)||t<1?{ok:!1,error:{code:`invalid`,message:`signerSlot must be an integer >= 1`}}:{ok:!0,value:t}}function l(e){return{ok:!1,error:{code:`invalid`,message:`${e} must be an object`}}}function u(t){let n=e(t);return n.ok?{ok:!0,value:n.value}:{ok:!1,error:n.error}}function d(e){let n=a(e);if(!n)return l(`WalletIdentity`);let r=t(n.walletId);return r.ok?{ok:!0,value:{walletId:r.value}}:{ok:!1,error:r.error}}function f(e){return{walletId:e.walletId}}function p(e){return{wallet:e.wallet,rpId:e.rpId}}function m(e){let t=o(e.credentialIdB64u);if(!t)throw Error(`credentialIdB64u is required`);return{kind:`passkey`,walletAuthMethodId:e.walletAuthMethodId,scope:e.scope,credentialIdB64u:t}}function h(e){let t=o(e.emailHashHex),n=o(e.registrationAuthorityId);if(!t)throw Error(`emailHashHex is required`);if(!n)throw Error(`registrationAuthorityId is required`);return{kind:`email_otp`,walletAuthMethodId:e.walletAuthMethodId,wallet:e.wallet,emailHashHex:t,registrationAuthorityId:n}}function g(e){return{kind:`voiceid`,walletAuthMethodId:e.walletAuthMethodId,wallet:e.wallet,deviceKeyId:e.deviceKeyId}}function _(e){return{kind:`implicit_near_account`,wallet:e.wallet,nearAccountId:e.nearAccountId}}function v(e){return{kind:`named_near_account`,wallet:e.wallet,nearAccountId:e.nearAccountId}}function y(e){let t=a(e);if(!t)return l(`NearAccountBinding`);let i=d(t.wallet);if(!i.ok)return i;let s=o(t.kind);if(s===`implicit_near_account`){let e=r(t.nearAccountId);return e.ok?{ok:!0,value:_({wallet:i.value,nearAccountId:e.value})}:{ok:!1,error:{code:e.code,message:e.message}}}if(s===`named_near_account`){let e=n(t.nearAccountId);return e.ok?{ok:!0,value:v({wallet:i.value,nearAccountId:e.value})}:{ok:!1,error:{code:e.code,message:e.message}}}return{ok:!1,error:{code:`invalid`,message:`NearAccountBinding kind is invalid`}}}function b(e){let t=c(e.signerSlot);if(!t.ok)throw Error(t.error.message);return{kind:`near_ed25519_signer`,account:e.account,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,signerSlot:t.value}}function x(e){let t=a(e);if(!t)return l(`NearEd25519SignerBinding`);let n=y(t.account);if(!n.ok)return n;let r=s(t.nearEd25519SigningKeyId,`nearEd25519SigningKeyId`);if(!r.ok)return r;let o=c(t.signerSlot);return o.ok?{ok:!0,value:b({account:n.value,nearEd25519SigningKeyId:i(r.value),signerSlot:o.value})}:o}export{p as a,f as c,b as i,x as l,_ as n,m as o,v as r,g as s,h as t,u};

package/dist/{public/sdk/walletCustodyEcdsaContinuity-C31YQ9av.js → esm/sdk/walletCustodyEcdsaContinuity-BnyL1Ryu.js}

@@ -1 +1 @@
-import{V as e,i as t}from"./domainIds-t1lp25yU.js";import{i as n}from"./base64-BmKR3UqU.js";import{r}from"./secureRandomId-8LSc91aN.js";import{X as i}from"./activeWalletSession-BJ4B-nJo.js";import{i as a,r as o}from"./canonicalPrimitives-Jd3i_Ngz.js";import{n as s}from"./presignatures-BCeq56DG.js";import{A as c,Et as l,Nt as u,S as d,St as f,Tt as p,ct as m,mt as h,pt as g}from"./digestEncoding-CqNXPZY9.js";import{A as _,B as v,C as y,I as b,M as x,a as S,h as C,i as w,j as T,o as E,r as D,z as O}from"./ecdsaCapabilityManifest-DAJEVjlP.js";import{f as k,i as A,m as j,p as M}from"./indexedDB-C4SDsyOG.js";import{F as N,N as P,P as F}from"./walletOwnershipGeneration-CgjCtPrV.js";import{C as I,p as L,w as R}from"./emailOtpEcdsaDerivationIdentity-HFQXc1Yw.js";import{i as z,n as B}from"./profileAccountProjection-C5sNt-s2.js";import{M as V,N as H,P as U}from"./accountLifecycle-6DHYWf0v.js";async function W(t,n){let r=e(n.explicitProfileId||``),i=e(n.explicitChainIdKey||``).toLowerCase(),a=e(n.explicitAccountAddress||``).toLowerCase();if(r||i||a){if(!r||!i||!a)throw Error(`IndexedDBManager: profileId, chainIdKey, and accountAddress are required for explicit key target writes`);let o=n.accountRefs.find(t=>e(t.chainIdKey||``).toLowerCase()===i);if(o){let e=await t.resolveProfileAccountContext(o).catch(()=>null);if(e?.profileId&&String(e.profileId).trim()!==r)throw Error(`IndexedDBManager: Explicit key target (${r}, ${i}, ${o.accountAddress}) mismatches mapped profile ${String(e.profileId).trim()}`)}return{profileId:r,chainIdKey:i,accountAddress:a}}let o=await B(t,n.accountRefs);return o?.profileId?{profileId:o.profileId,chainIdKey:o.accountRef.chainIdKey,accountAddress:o.accountRef.accountAddress}:null}async function G(e){let t=await W(e.deps.clientDB,{accountRefs:e.accountRefs});return!t?.profileId||!t.chainIdKey?null:e.deps.keyMaterialStore.getKeyMaterial(t.profileId,e.signerSlot,t.chainIdKey,e.keyKind)}async function K(t,n){if(!Number.isSafeInteger(n.signerSlot)||n.signerSlot<1)throw Error(`IndexedDBManager: Invalid signerSlot for key write`);let r=e(n.keyKind||``);if(!r)throw Error(`IndexedDBManager: Missing keyKind for key write`);let i=e(n.algorithm||``).toLowerCase();if(!i)throw Error(`IndexedDBManager: Missing algorithm for key write`);let a=e(n.publicKey||``);if(!a)throw Error(`IndexedDBManager: Missing publicKey for key write`);let o=e(n.signerId||``);if(!o)throw Error(`IndexedDBManager: Missing signerId for key write`);let s=await W(t.clientDB,n);if(!s?.profileId||!s.chainIdKey||!s.accountAddress)throw Error(`IndexedDBManager: Missing profile/account mapping for key write. Persist profile/account first or pass explicit profileId + chainIdKey.`);let c=Number.isSafeInteger(n.schemaVersion)&&typeof n.schemaVersion==`number`&&n.schemaVersion>=1?n.schemaVersion:1,l={profileId:s.profileId,signerSlot:n.signerSlot,chainIdKey:s.chainIdKey,accountAddress:s.accountAddress,keyKind:r,algorithm:i,publicKey:a,signerId:o,timestamp:typeof n.timestamp==`number`?n.timestamp:Date.now(),schemaVersion:c},u=e(n.wrapKeySalt||``);u&&(l.wrapKeySalt=u),n.payload&&(l.payload=n.payload),await t.keyMaterialStore.storeKeyMaterial(l)}async function q(e){let t=await W(e.store,{accountRefs:z(e.binding.nearAccountId)});if(!t)throw Error(`Wallet custody Ed25519 material requires a persisted wallet profile`);await e.store.storeKeyMaterial(U({target:t,...e}))}async function J(e){let t=await W(e.store,{accountRefs:z(e.nearAccountId)});t&&await e.store.deleteKeyMaterial(t.profileId,e.signerSlot,t.chainIdKey,V)}async function Y(e){let t=await G({deps:{clientDB:e.store,keyMaterialStore:e.store},accountRefs:z(e.nearAccountId),signerSlot:e.signerSlot,keyKind:V});if(!t)return{kind:`absent`};let n=t.payloadEnvelope;if(!n?.ciphertext||!n.nonce)return{kind:`unusable`,reason:`cached custody material has no sealed payload`};if(n.alg!==`chacha20poly1305-hkdf-sha256-wallet-custody-seed-v1`)return{kind:`unusable`,reason:`cached custody material was sealed under another key`};let r=t.payload?.binding;if(!r||typeof r!=`object`)return{kind:`unusable`,reason:`cached custody material has no binding`};let i=r;if(i.kind!==`wallet_custody_ed25519_active_client_v1`)return{kind:`unusable`,reason:`cached custody material is not a wallet custody record`};try{H(i)}catch(e){return{kind:`unusable`,reason:e instanceof Error?e.message:`cached custody binding is incomplete`}}let a=String(e.expectedRegisteredPublicKeyB64u||``).trim();return a&&a!==String(i.registeredPublicKeyB64u||``).trim()?{kind:`unusable`,reason:`cached custody material is for another key set`}:{kind:`found`,material:{binding:i,sealed:{ciphertextB64u:n.ciphertext,nonceB64u:n.nonce}}}}function X(e){let s=m(e.authority);if(!s||String(s.walletId)!==String(e.walletId))throw Error(`ECDSA custody import authority is invalid`);let k=d(e.publicCapability),A=c(e.activationReceipt),j=u(A.ecdsa_activation.material_activation);if(!t(j,u(k.material_activation)))throw Error(`ECDSA custody continuity changed the material activation`);let M=[R(e.participantIds[0]),R(e.participantIds[1])],N=E({keyHandle:O(e.keyHandle),ecdsaThresholdKeyId:b(e.ecdsaThresholdKeyId),clientVerifyingPublicKey33B64u:_(e.publicFacts.derivationClientSharePublicKey33B64u),participantIds:M,relayerKeyId:v(e.relayerKeyId)}),P=C({capability:j.capability,signerId:f(r(`ecdsa-signer`,32,`ECDSA custody signer identities`)),authority:s,scope:w({targetMemberships:e.chainTargets}),materialOwner:j.materialOwner,signingRootId:p(e.signingRootId),signingRootVersion:l(e.signingRootVersion)}),F=D({targetManifest:S({manifestId:g(r(`ecdsa-manifest`,32,`ECDSA custody manifest identities`)),manifestRevision:h(1)}),signer:P,roleLocalBinding:N,bindingDigest:T(e.publicFacts.contextBinding32B64u),durableMaterialRef:x(r(`ecdsa-role-local-material`,32,`ECDSA custody material identities`))}),z=e.publicFacts.ethereumAddress,B=L({keyHandle:I(e.keyHandle),publicKeyB64u:e.publicFacts.groupPublicKey33B64u,participantIds:M,thresholdOwnerAddress:z}),V=y({walletId:s.walletId,chainTarget:e.chainTargets[0],keyHandle:N.keyHandle,ecdsaThresholdKeyId:N.ecdsaThresholdKeyId,signingRootId:P.signingRootId,signingRootVersion:P.signingRootVersion,applicationBindingDigestB64u:k.context.application_binding_digest_b64u,clientParticipantId:M[0],relayerParticipantId:M[1],participantIds:M,contextBinding32B64u:e.publicFacts.contextBinding32B64u,derivationClientSharePublicKey33B64u:e.publicFacts.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:e.publicFacts.relayerPublicKey33B64u,groupPublicKey33B64u:e.publicFacts.groupPublicKey33B64u,ethereumAddress:z,publicCapability:k}),H={kind:`router_ab_ecdsa_derivation_normal_signing_v1`,scope:{wallet_id:String(s.walletId),ecdsa_threshold_key_id:String(N.ecdsaThresholdKeyId),signing_root_id:String(P.signingRootId),signing_root_version:String(P.signingRootVersion),context:A.ecdsa_activation.context,public_identity:A.ecdsa_activation.public_identity,material_activation:A.ecdsa_activation.material_activation,signing_worker:A.ecdsa_activation.signing_worker,activation_epoch:A.ecdsa_activation.activation_epoch}};return{activationBinding:F,serverCommit:{correlationId:A.activation_correlation_id,activationRequestDigest:o(n(Uint8Array.from(A.activation_request_digest.bytes))),serverGeneration:A.server_generation,protocolReceipt:A},readyStateBlobB64u:e.readyStateBlobB64u,registeredPublicFacts:B,roleLocalPublicFacts:V,routerAbEcdsaDerivationNormalSigning:H,runtimePolicyScope:i(e.runtimePolicyScope),committedAt:a(new Date(A.ecdsa_activation.activated_at_ms).toISOString())}}async function Z(e){return j(X(e))}async function Q(e){return await M(e.store,X(e),t=>e.store.persistPreparedWalletCustodyEcdsaContinuity(t))}async function $(e){let t=new A(s);for(let n of e.walletAuthMethodIds){let r=await t.getWalletAuthMethodV2(String(n));if(!r||r.status!==`active`||r.walletId!==e.walletId||r.walletAuthorityId!==e.walletAuthorityId)throw Error(`ECDSA custody continuity method ${String(n)} is not an active member of the wallet authority`)}}async function ee(e){if(e.targetAuthority.walletId!==e.walletId||e.targetAuthority.walletAuthMethodId===e.sourceWalletAuthMethodId)throw Error(`ECDSA custody continuity target is invalid`);await $({walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,walletAuthMethodIds:[e.sourceWalletAuthMethodId,e.targetAuthority.walletAuthMethodId]});let t=new k,n=await t.listActiveWalletCapabilitySubjects(e.walletId);if(n.kind!==`resolved`)throw Error(`ECDSA custody continuity inventory is ${n.kind}`);if(n.subjects.length===0)return;let r=n.subjects.filter(t=>t.authority.walletAuthMethodId===e.sourceWalletAuthMethodId);if(r.length===0)throw Error(`ECDSA custody continuity found no active capability for source method ${String(e.sourceWalletAuthMethodId)} among [${n.subjects.map(e=>String(e.authority.walletAuthMethodId)).join(`, `)}]`);for(let n of r){let r=await t.lookup(n);if(r.kind!==`active`)throw Error(`ECDSA custody continuity source is ${r.kind}`);let i={capability:n.capability,authority:e.targetAuthority},a=await t.lookup(i);if(a.kind===`active`){let e=a.manifest.durableMaterial,t=r.manifest.durableMaterial;if(e.activationDigest!==t.activationDigest||e.bindingDigest!==t.bindingDigest||e.roleLocalBinding.ecdsaThresholdKeyId!==t.roleLocalBinding.ecdsaThresholdKeyId||!F(e.roleLocalBinding,t.roleLocalBinding)||!N(e.roleLocalPublicFacts,t.roleLocalPublicFacts)||!P(a.manifest.signer.registeredPublicFacts,r.manifest.signer.registeredPublicFacts))throw Error(`ECDSA custody continuity target conflicts with source material`);continue}if(a.kind!==`missing`)throw Error(`ECDSA custody continuity target is ${a.kind}`);let o=await t.openActiveMaterialLookup(r);if(o.kind!==`active`)throw Error(`ECDSA custody continuity material is ${o.kind}`);let s=o.manifest,c=s.durableMaterial.roleLocalPublicFacts,l=await Q({store:t,authority:e.targetAuthority,chainTargets:s.signer.scope.targetMemberships,walletId:String(e.walletId),keyHandle:c.keyHandle,ecdsaThresholdKeyId:String(c.ecdsaThresholdKeyId),signingRootId:String(c.signingRootId),signingRootVersion:String(c.signingRootVersion),relayerKeyId:String(s.durableMaterial.roleLocalBinding.relayerKeyId),participantIds:c.participantIds,publicCapability:c.publicCapability,activationReceipt:s.activation.serverActivation.serverActivationReceipt.protocolReceipt,runtimePolicyScope:s.durableMaterial.runtimePolicyScope,readyStateBlobB64u:o.readyStateBlobB64u,publicFacts:{contextBinding32B64u:c.contextBinding32B64u,derivationClientSharePublicKey33B64u:c.derivationClientSharePublicKey33B64u,clientVerifyingShare33B64u:c.publicCapability.public_identity.derivation_client_share_public_key33_b64u,relayerPublicKey33B64u:c.relayerPublicKey33B64u,groupPublicKey33B64u:c.groupPublicKey33B64u,ethereumAddress:c.ethereumAddress,clientShareRetryCounter:c.publicCapability.public_identity.client_share_retry_counter,relayerShareRetryCounter:c.publicCapability.public_identity.server_share_retry_counter}});if(l.kind!==`committed`)throw Error(`ECDSA custody continuity import is ${l.kind}`)}}export{Y as a,W as c,J as i,K as l,Q as n,q as o,Z as r,G as s,ee as t};
+import{V as e,i as t}from"./domainIds-t1lp25yU.js";import{i as n}from"./base64-BmKR3UqU.js";import{r}from"./secureRandomId-8LSc91aN.js";import{X as i}from"./activeWalletSession-BJ4B-nJo.js";import{i as a,r as o}from"./canonicalPrimitives-Jd3i_Ngz.js";import{n as s}from"./presignatures-CkhuZ0YQ.js";import{A as c,Et as l,Nt as u,S as d,St as f,Tt as p,ct as m,mt as h,pt as g}from"./digestEncoding-34kXJoJr.js";import{A as _,B as v,C as y,I as b,M as x,a as S,h as C,i as w,j as T,o as E,r as D,z as O}from"./ecdsaCapabilityManifest--1Ztngfx.js";import{f as k,i as A,m as j,p as M}from"./indexedDB-CA4tGqkr.js";import{F as N,N as P,P as F}from"./walletOwnershipGeneration-BZc6UKqX.js";import{C as I,p as L,w as R}from"./emailOtpEcdsaDerivationIdentity-Qd4pBwHv.js";import{i as z,n as B}from"./profileAccountProjection-dvLchPBo.js";import{F as V,I as H,P as U}from"./accountLifecycle-B5a9SCM7.js";async function W(t,n){let r=e(n.explicitProfileId||``),i=e(n.explicitChainIdKey||``).toLowerCase(),a=e(n.explicitAccountAddress||``).toLowerCase();if(r||i||a){if(!r||!i||!a)throw Error(`IndexedDBManager: profileId, chainIdKey, and accountAddress are required for explicit key target writes`);let o=n.accountRefs.find(t=>e(t.chainIdKey||``).toLowerCase()===i);if(o){let e=await t.resolveProfileAccountContext(o).catch(()=>null);if(e?.profileId&&String(e.profileId).trim()!==r)throw Error(`IndexedDBManager: Explicit key target (${r}, ${i}, ${o.accountAddress}) mismatches mapped profile ${String(e.profileId).trim()}`)}return{profileId:r,chainIdKey:i,accountAddress:a}}let o=await B(t,n.accountRefs);return o?.profileId?{profileId:o.profileId,chainIdKey:o.accountRef.chainIdKey,accountAddress:o.accountRef.accountAddress}:null}async function G(e){let t=await W(e.deps.clientDB,{accountRefs:e.accountRefs});return!t?.profileId||!t.chainIdKey?null:e.deps.keyMaterialStore.getKeyMaterial(t.profileId,e.signerSlot,t.chainIdKey,e.keyKind)}async function K(t,n){if(!Number.isSafeInteger(n.signerSlot)||n.signerSlot<1)throw Error(`IndexedDBManager: Invalid signerSlot for key write`);let r=e(n.keyKind||``);if(!r)throw Error(`IndexedDBManager: Missing keyKind for key write`);let i=e(n.algorithm||``).toLowerCase();if(!i)throw Error(`IndexedDBManager: Missing algorithm for key write`);let a=e(n.publicKey||``);if(!a)throw Error(`IndexedDBManager: Missing publicKey for key write`);let o=e(n.signerId||``);if(!o)throw Error(`IndexedDBManager: Missing signerId for key write`);let s=await W(t.clientDB,n);if(!s?.profileId||!s.chainIdKey||!s.accountAddress)throw Error(`IndexedDBManager: Missing profile/account mapping for key write. Persist profile/account first or pass explicit profileId + chainIdKey.`);let c=Number.isSafeInteger(n.schemaVersion)&&typeof n.schemaVersion==`number`&&n.schemaVersion>=1?n.schemaVersion:1,l={profileId:s.profileId,signerSlot:n.signerSlot,chainIdKey:s.chainIdKey,accountAddress:s.accountAddress,keyKind:r,algorithm:i,publicKey:a,signerId:o,timestamp:typeof n.timestamp==`number`?n.timestamp:Date.now(),schemaVersion:c},u=e(n.wrapKeySalt||``);u&&(l.wrapKeySalt=u),n.payload&&(l.payload=n.payload),await t.keyMaterialStore.storeKeyMaterial(l)}async function q(e){let t=await W(e.store,{accountRefs:z(e.binding.nearAccountId)});if(!t)throw Error(`Wallet custody Ed25519 material requires a persisted wallet profile`);await e.store.storeKeyMaterial(H({target:t,...e}))}async function J(e){let t=await W(e.store,{accountRefs:z(e.nearAccountId)});t&&await e.store.deleteKeyMaterial(t.profileId,e.signerSlot,t.chainIdKey,U)}async function Y(e){let t=await G({deps:{clientDB:e.store,keyMaterialStore:e.store},accountRefs:z(e.nearAccountId),signerSlot:e.signerSlot,keyKind:U});if(!t)return{kind:`absent`};let n=t.payloadEnvelope;if(!n?.ciphertext||!n.nonce)return{kind:`unusable`,reason:`cached custody material has no sealed payload`};if(n.alg!==`chacha20poly1305-hkdf-sha256-wallet-custody-seed-v1`)return{kind:`unusable`,reason:`cached custody material was sealed under another key`};let r=t.payload?.binding;if(!r||typeof r!=`object`)return{kind:`unusable`,reason:`cached custody material has no binding`};let i=r;if(i.kind!==`wallet_custody_ed25519_active_client_v1`)return{kind:`unusable`,reason:`cached custody material is not a wallet custody record`};try{V(i)}catch(e){return{kind:`unusable`,reason:e instanceof Error?e.message:`cached custody binding is incomplete`}}let a=String(e.expectedRegisteredPublicKeyB64u||``).trim();return a&&a!==String(i.registeredPublicKeyB64u||``).trim()?{kind:`unusable`,reason:`cached custody material is for another key set`}:{kind:`found`,material:{binding:i,sealed:{ciphertextB64u:n.ciphertext,nonceB64u:n.nonce}}}}function X(e){let s=m(e.authority);if(!s||String(s.walletId)!==String(e.walletId))throw Error(`ECDSA custody import authority is invalid`);let k=d(e.publicCapability),A=c(e.activationReceipt),j=u(A.ecdsa_activation.material_activation);if(!t(j,u(k.material_activation)))throw Error(`ECDSA custody continuity changed the material activation`);let M=[R(e.participantIds[0]),R(e.participantIds[1])],N=E({keyHandle:O(e.keyHandle),ecdsaThresholdKeyId:b(e.ecdsaThresholdKeyId),clientVerifyingPublicKey33B64u:_(e.publicFacts.derivationClientSharePublicKey33B64u),participantIds:M,relayerKeyId:v(e.relayerKeyId)}),P=C({capability:j.capability,signerId:f(r(`ecdsa-signer`,32,`ECDSA custody signer identities`)),authority:s,scope:w({targetMemberships:e.chainTargets}),materialOwner:j.materialOwner,signingRootId:p(e.signingRootId),signingRootVersion:l(e.signingRootVersion)}),F=D({targetManifest:S({manifestId:g(r(`ecdsa-manifest`,32,`ECDSA custody manifest identities`)),manifestRevision:h(1)}),signer:P,roleLocalBinding:N,bindingDigest:T(e.publicFacts.contextBinding32B64u),durableMaterialRef:x(r(`ecdsa-role-local-material`,32,`ECDSA custody material identities`))}),z=e.publicFacts.ethereumAddress,B=L({keyHandle:I(e.keyHandle),publicKeyB64u:e.publicFacts.groupPublicKey33B64u,participantIds:M,thresholdOwnerAddress:z}),V=y({walletId:s.walletId,chainTarget:e.chainTargets[0],keyHandle:N.keyHandle,ecdsaThresholdKeyId:N.ecdsaThresholdKeyId,signingRootId:P.signingRootId,signingRootVersion:P.signingRootVersion,applicationBindingDigestB64u:k.context.application_binding_digest_b64u,clientParticipantId:M[0],relayerParticipantId:M[1],participantIds:M,contextBinding32B64u:e.publicFacts.contextBinding32B64u,derivationClientSharePublicKey33B64u:e.publicFacts.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:e.publicFacts.relayerPublicKey33B64u,groupPublicKey33B64u:e.publicFacts.groupPublicKey33B64u,ethereumAddress:z,publicCapability:k}),H={kind:`router_ab_ecdsa_derivation_normal_signing_v1`,scope:{wallet_id:String(s.walletId),ecdsa_threshold_key_id:String(N.ecdsaThresholdKeyId),signing_root_id:String(P.signingRootId),signing_root_version:String(P.signingRootVersion),context:A.ecdsa_activation.context,public_identity:A.ecdsa_activation.public_identity,material_activation:A.ecdsa_activation.material_activation,signing_worker:A.ecdsa_activation.signing_worker,activation_epoch:A.ecdsa_activation.activation_epoch}};return{activationBinding:F,serverCommit:{correlationId:A.activation_correlation_id,activationRequestDigest:o(n(Uint8Array.from(A.activation_request_digest.bytes))),serverGeneration:A.server_generation,protocolReceipt:A},readyStateBlobB64u:e.readyStateBlobB64u,registeredPublicFacts:B,roleLocalPublicFacts:V,routerAbEcdsaDerivationNormalSigning:H,runtimePolicyScope:i(e.runtimePolicyScope),committedAt:a(new Date(A.ecdsa_activation.activated_at_ms).toISOString())}}async function Z(e){return j(X(e))}async function Q(e){return await M(e.store,X(e),t=>e.store.persistPreparedWalletCustodyEcdsaContinuity(t))}async function $(e){let t=new A(s);for(let n of e.walletAuthMethodIds){let r=await t.getWalletAuthMethodV2(String(n));if(!r||r.status!==`active`||r.walletId!==e.walletId||r.walletAuthorityId!==e.walletAuthorityId)throw Error(`ECDSA custody continuity method ${String(n)} is not an active member of the wallet authority`)}}async function ee(e){if(e.targetAuthority.walletId!==e.walletId||e.targetAuthority.walletAuthMethodId===e.sourceWalletAuthMethodId)throw Error(`ECDSA custody continuity target is invalid`);await $({walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,walletAuthMethodIds:[e.sourceWalletAuthMethodId,e.targetAuthority.walletAuthMethodId]});let t=new k,n=await t.listActiveWalletCapabilitySubjects(e.walletId);if(n.kind!==`resolved`)throw Error(`ECDSA custody continuity inventory is ${n.kind}`);if(n.subjects.length===0)return;let r=n.subjects.filter(t=>t.authority.walletAuthMethodId===e.sourceWalletAuthMethodId);if(r.length===0)throw Error(`ECDSA custody continuity found no active capability for source method ${String(e.sourceWalletAuthMethodId)} among [${n.subjects.map(e=>String(e.authority.walletAuthMethodId)).join(`, `)}]`);for(let n of r){let r=await t.lookup(n);if(r.kind!==`active`)throw Error(`ECDSA custody continuity source is ${r.kind}`);let i={capability:n.capability,authority:e.targetAuthority},a=await t.lookup(i);if(a.kind===`active`){let e=a.manifest.durableMaterial,t=r.manifest.durableMaterial;if(e.activationDigest!==t.activationDigest||e.bindingDigest!==t.bindingDigest||e.roleLocalBinding.ecdsaThresholdKeyId!==t.roleLocalBinding.ecdsaThresholdKeyId||!F(e.roleLocalBinding,t.roleLocalBinding)||!N(e.roleLocalPublicFacts,t.roleLocalPublicFacts)||!P(a.manifest.signer.registeredPublicFacts,r.manifest.signer.registeredPublicFacts))throw Error(`ECDSA custody continuity target conflicts with source material`);continue}if(a.kind!==`missing`)throw Error(`ECDSA custody continuity target is ${a.kind}`);let o=await t.openActiveMaterialLookup(r);if(o.kind!==`active`)throw Error(`ECDSA custody continuity material is ${o.kind}`);let s=o.manifest,c=s.durableMaterial.roleLocalPublicFacts,l=await Q({store:t,authority:e.targetAuthority,chainTargets:s.signer.scope.targetMemberships,walletId:String(e.walletId),keyHandle:c.keyHandle,ecdsaThresholdKeyId:String(c.ecdsaThresholdKeyId),signingRootId:String(c.signingRootId),signingRootVersion:String(c.signingRootVersion),relayerKeyId:String(s.durableMaterial.roleLocalBinding.relayerKeyId),participantIds:c.participantIds,publicCapability:c.publicCapability,activationReceipt:s.activation.serverActivation.serverActivationReceipt.protocolReceipt,runtimePolicyScope:s.durableMaterial.runtimePolicyScope,readyStateBlobB64u:o.readyStateBlobB64u,publicFacts:{contextBinding32B64u:c.contextBinding32B64u,derivationClientSharePublicKey33B64u:c.derivationClientSharePublicKey33B64u,clientVerifyingShare33B64u:c.publicCapability.public_identity.derivation_client_share_public_key33_b64u,relayerPublicKey33B64u:c.relayerPublicKey33B64u,groupPublicKey33B64u:c.groupPublicKey33B64u,ethereumAddress:c.ethereumAddress,clientShareRetryCounter:c.publicCapability.public_identity.client_share_retry_counter,relayerShareRetryCounter:c.publicCapability.public_identity.server_share_retry_counter}});if(l.kind!==`committed`)throw Error(`ECDSA custody continuity import is ${l.kind}`)}}export{Y as a,W as c,J as i,K as l,Q as n,q as o,Z as r,G as s,ee as t};

package/dist/esm/sdk/{walletOwnershipGeneration-CgjCtPrV.js → walletOwnershipGeneration-BZc6UKqX.js}

@@ -1 +1 @@
-import{_ as e,a as t,b as n,i as r}from"./domainIds-t1lp25yU.js";import{S as i,n as a,t as o,y as s}from"./digests-BIaE0DMd.js";import{i as c,r as l}from"./base64-BmKR3UqU.js";import{X as u}from"./activeWalletSession-BJ4B-nJo.js";import{i as d,n as f,r as p}from"./canonicalPrimitives-Jd3i_Ngz.js";import{a as m,i as h,n as g}from"./presignatures-BCeq56DG.js";import{a as _}from"./ecdsaChainTarget-Bm5X4k-V.js";import{A as ee,At as te,Et as ne,F as re,G as ie,Pt as ae,St as oe,Tt as se,W as ce,_t as v,b as le,bt as ue,ct as y,dt as de,gt as b,ht as x,mt as S,pt as C,q as fe,xt as w,yt as T,z as pe}from"./digestEncoding-CqNXPZY9.js";import{A as E,B as me,C as he,I as ge,M as _e,P as ve,_ as ye,a as be,b as D,c as xe,d as Se,f as Ce,g as we,h as Te,i as Ee,j as O,l as De,m as k,n as Oe,o as ke,p as A,r as Ae,s as je,t as Me,u as Ne,v as Pe,z as Fe}from"./ecdsaCapabilityManifest-DAJEVjlP.js";import{C as Ie,p as Le,w as Re}from"./emailOtpEcdsaDerivationIdentity-HFQXc1Yw.js";const j=`seams/router-ab-ecdsa-presign/fixed-2of2/v1`;function M(e,t){if(typeof e!=`string`||!e)throw Error(`${t} is required`);if(e.trim()!==e)throw Error(`${t} must be canonical`);return e}function N(e){if(typeof e!=`object`||!e)throw Error(`poolIdentity is required`);let t=e;if(!Number.isSafeInteger(t.ownershipGeneration)||Number(t.ownershipGeneration)<1)throw Error(`poolIdentity.ownershipGeneration must be a positive safe integer`);if(t.pairRole!==`client`)throw Error(`poolIdentity.pairRole must be client`);if(t.protocolId!==`seams/router-ab-ecdsa-presign/fixed-2of2/v1`)throw Error(`poolIdentity.protocolId is unsupported`);let n=M(t.relayerUrl,`poolIdentity.relayerUrl`);if(n.replace(/\/+$/g,``)!==n)throw Error(`poolIdentity.relayerUrl must be canonical`);return{ownershipGeneration:Number(t.ownershipGeneration),relayerUrl:n,materialActivationB64u:M(t.materialActivationB64u,`poolIdentity.materialActivationB64u`),materialActivationId:M(t.materialActivationId,`poolIdentity.materialActivationId`),capability:M(t.capability,`poolIdentity.capability`),keyBinding:M(t.keyBinding,`poolIdentity.keyBinding`),walletId:M(t.walletId,`poolIdentity.walletId`),signingScopeB64u:M(t.signingScopeB64u,`poolIdentity.signingScopeB64u`),pairRole:`client`,keyEpoch:M(t.keyEpoch,`poolIdentity.keyEpoch`),activationEpoch:ze(t.activationEpoch),protocolId:j}}function ze(e){let t=n(e);if(!t.ok)throw Error(`poolIdentity.activationEpoch is invalid`);return t.value}function Be(e,t){return e.ownershipGeneration===t.ownershipGeneration&&e.relayerUrl===t.relayerUrl&&e.materialActivationB64u===t.materialActivationB64u&&e.materialActivationId===t.materialActivationId&&e.capability===t.capability&&e.keyBinding===t.keyBinding&&e.walletId===t.walletId&&e.signingScopeB64u===t.signingScopeB64u&&e.pairRole===t.pairRole&&e.keyEpoch===t.keyEpoch&&e.activationEpoch===t.activationEpoch&&e.protocolId===t.protocolId}function P(e){return[e.protocolId,e.relayerUrl,e.signingScopeB64u,e.materialActivationB64u,e.ownershipGeneration].join(`|`)}function Ve(e){let t=le(e.scope),n=e.materialActivation,r=String(e.relayerUrl||``).trim().replace(/\/+$/g,``);return{ownershipGeneration:e.ownershipGeneration,relayerUrl:r,materialActivationB64u:c(te(n)),materialActivationId:n.activation_id,capability:n.capability,keyBinding:n.key_binding,walletId:t.wallet_id,signingScopeB64u:c(pe(t)),pairRole:`client`,keyEpoch:t.signing_worker.key_epoch,activationEpoch:t.activation_epoch,protocolId:j}}const He=`ecdsa_capability_manifest_v3`,F=`ecdsa_current_capability_manifest_v2`,Ue=`ecdsa_role_local_material_v2`,We=`ecdsa_activation_commit_journal_v1`,Ge=`ecdsa_material_sealing_key_v1`,Ke=m.ecdsaCapabilityManifests,qe=m.ecdsaCurrentCapabilityManifests,Je=m.ecdsaRoleLocalMaterial,Ye=m.ecdsaActivationCommitJournals,Xe=m.ecdsaMaterialSealingKeys,I=m.ecdsaClientPresignatures;function L(e,t,n){let r=Object.keys(e).sort(),i=[...n].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${t} has unexpected fields`)}function Ze(e){let n=y(e.authority);if(!n)throw Error(`ECDSA capability selector authority is invalid`);return{capability:D(t(e.capability)),authority:n}}function R(e){return{capability:e.capability,authority:e.authority}}function z(e){return R(e.candidate.activationBinding.signer)}function B(e){return R(e.signer)}function V(e){return[String(e.capability),String(e.authority.walletId),String(e.authority.authorityDigest)]}function H(e){return{capability_ref:e.capability,wallet_id:e.authority.walletId,authority_digest:e.authority.authorityDigest,wallet_auth_method_id:e.authority.walletAuthMethodId}}function Qe(e){return y({kind:`wallet_auth_authority_ref`,walletId:e.wallet_id,authorityDigest:e.authority_digest,walletAuthMethodId:e.wallet_auth_method_id})}function $e(e,t){return e.kind===t.kind&&e.walletId===t.walletId&&e.authorityDigest===t.authorityDigest&&e.walletAuthMethodId===t.walletAuthMethodId}function et(e,t){let n=V(e),r=V(t);return n[0]===r[0]&&n[1]===r[1]&&n[2]===r[2]}function U(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function tt(e,t){return e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function W(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`evm`:return t.kind===`evm`&&e.namespace===t.namespace&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;case`tempo`:return t.kind===`tempo`&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;default:return Y(e)}}function nt(e,t){return e.kind===t.kind&&e.targetMemberships.length===t.targetMemberships.length&&e.targetMemberships.every((e,n)=>W(e,t.targetMemberships[n]))}function G(e,t){return e.kind===t.kind&&e.keyHandle===t.keyHandle&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.clientVerifyingPublicKey33B64u===t.clientVerifyingPublicKey33B64u&&U(e.participantIds,t.participantIds)&&e.relayerKeyId===t.relayerKeyId}function rt(e,t){return e.walletId===t.walletId&&W(e.chainTarget,t.chainTarget)&&e.keyHandle===t.keyHandle&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.signingRootId===t.signingRootId&&e.signingRootVersion===t.signingRootVersion&&e.applicationBindingDigestB64u===t.applicationBindingDigestB64u&&e.clientParticipantId===t.clientParticipantId&&e.relayerParticipantId===t.relayerParticipantId&&U(e.participantIds,t.participantIds)&&e.contextBinding32B64u===t.contextBinding32B64u&&e.derivationClientSharePublicKey33B64u===t.derivationClientSharePublicKey33B64u&&e.relayerPublicKey33B64u===t.relayerPublicKey33B64u&&e.groupPublicKey33B64u===t.groupPublicKey33B64u&&e.ethereumAddress===t.ethereumAddress&&ie(e.publicCapability,t.publicCapability)}function it(e,t){return e.kind===t.kind&&e.keyHandle===t.keyHandle&&e.publicKeyB64u===t.publicKeyB64u&&U(e.participantIds,t.participantIds)&&e.thresholdOwnerAddress===t.thresholdOwnerAddress}function at(e,t){return e.manifestId===t.manifestId&&e.manifestRevision===t.manifestRevision}function ot(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`no_current_manifest`:return!0;case`exact_manifest`:return t.kind===`exact_manifest`&&e.manifestId===t.manifestId&&e.manifestRevision===t.manifestRevision;default:return Y(e)}}function st(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`no_current_generation`:return!0;case`exact_generation`:return t.kind===`exact_generation`&&e.serverGeneration===t.serverGeneration;default:return Y(e)}}function ct(e,t){return e.kind===t.kind&&e.capability===t.capability&&e.signerId===t.signerId&&e.walletId===t.walletId&&$e(e.authority,t.authority)&&nt(e.scope,t.scope)&&e.materialOwner===t.materialOwner&&e.signingRootId===t.signingRootId&&e.signingRootVersion===t.signingRootVersion}function lt(e,t){return ct(e,t)&&it(e.registeredPublicFacts,t.registeredPublicFacts)}function ut(e,t){return e.kind===t.kind&&e.sealingKeyId===t.sealingKeyId&&e.iv12B64u===t.iv12B64u&&e.ciphertextB64u===t.ciphertextB64u&&e.ciphertextDigest===t.ciphertextDigest}function dt(e,t){return e.kind===t.kind&&at(e.targetManifest,t.targetManifest)&&ct(e.signer,t.signer)&&G(e.roleLocalBinding,t.roleLocalBinding)&&e.bindingDigest===t.bindingDigest&&e.durableMaterialRef===t.durableMaterialRef}function K(e,t){return e.kind===t.kind&&e.correlationId===t.correlationId&&e.activationRequestDigest===t.activationRequestDigest&&e.serverGeneration===t.serverGeneration&&ft(e.serverActivationReceipt,t.serverActivationReceipt)}function ft(e,t){return e.kind===t.kind&&e.lifecycleId===t.lifecycleId&&e.activationDigest===t.activationDigest&&e.activatedAt===t.activatedAt&&fe(e.protocolReceipt,t.protocolReceipt)}function pt(e,t){return e.kind===t.kind&&e.correlationId===t.correlationId&&st(e.expectedGeneration,t.expectedGeneration)&&e.requestDigest===t.requestDigest&&e.canonicalRequest===t.canonicalRequest}function mt(e,t){return e.kind===t.kind&&dt(e.activationBinding,t.activationBinding)&&ut(e.encryptedPending,t.encryptedPending)}function ht(e,t){if(e.kind!==t.kind||!(e.journalId===t.journalId&&ot(e.expectedManifest,t.expectedManifest)&&pt(e.activationCommand,t.activationCommand)&&mt(e.candidate,t.candidate)&&e.createdAt===t.createdAt))return!1;switch(e.kind){case`activation_prepared`:return!0;case`server_activation_committed`:return t.kind===`server_activation_committed`&&K(e.serverActivation,t.serverActivation);default:return Y(e)}}function gt(e,t){return e.kind===t.kind&&r(e.materialActivation,t.materialActivation)&&ce(e.routerAbEcdsaDerivationNormalSigning,t.routerAbEcdsaDerivationNormalSigning)&&rt(e.roleLocalPublicFacts,t.roleLocalPublicFacts)&&G(e.roleLocalBinding,t.roleLocalBinding)&&e.durableMaterialRef===t.durableMaterialRef&&e.bindingDigest===t.bindingDigest&&e.lifecycleId===t.lifecycleId&&e.ciphertextDigest===t.ciphertextDigest&&e.activationDigest===t.activationDigest&&e.activatedAt===t.activatedAt&&tt(e.runtimePolicyScope,t.runtimePolicyScope)}function _t(e,t){return e.kind===t.kind&&r(e.materialActivation,t.materialActivation)&&K(e.serverActivation,t.serverActivation)&&e.retention===t.retention}function vt(e,t){return e.kind===t.kind&&at(e.identity,t.identity)&&lt(e.signer,t.signer)&&_t(e.activation,t.activation)&&gt(e.durableMaterial,t.durableMaterial)&&e.committedAt===t.committedAt}function yt(e,t){try{let n=i(t.serverActivationReceipt,`ECDSA server activation receipt`);return t.kind===e.kind&&f(t.correlationId)===e.correlationId&&p(t.activationRequestDigest)===e.activationRequestDigest&&w(t.serverGeneration)===e.serverGeneration&&n.kind===e.serverActivationReceipt.kind&&n.lifecycleId===String(e.serverActivationReceipt.lifecycleId)&&n.activationDigest===String(e.serverActivationReceipt.activationDigest)&&d(n.activatedAt)===e.serverActivationReceipt.activatedAt&&fe(ee(n.protocolReceipt),e.serverActivationReceipt.protocolReceipt)}catch{return!1}}function bt(e){let t=A({activationBinding:e.preparation.activationBinding,encryptedPending:e.encryptedPending});return xt({...e.preparation,candidate:t})}function xt(e){let t={journalId:e.journalId,candidate:e.candidate,requestDigest:e.requestDigest,canonicalRequest:e.canonicalRequest,createdAt:e.createdAt};switch(e.expectedManifest.kind){case`no_current_manifest`:if(e.expectedGeneration.kind!==`no_current_generation`)throw Error(`Initial ECDSA activation cannot expect a server generation`);return k({...t,expectedManifest:e.expectedManifest,expectedGeneration:e.expectedGeneration});case`exact_manifest`:if(e.expectedGeneration.kind!==`exact_generation`)throw Error(`Replacement ECDSA activation requires an exact server generation`);return k({...t,expectedManifest:e.expectedManifest,expectedGeneration:e.expectedGeneration});default:return Y(e.expectedManifest)}}function St(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be non-empty unpadded base64url`);let n=l(e);if(n.length===0||c(n)!==e)throw n.fill(0),Error(`${t} must be canonical base64url`);return n}function q(e){return new TextEncoder().encode(o(e))}async function Ct(){return await crypto.subtle.generateKey({name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}async function wt(e){let t=St(e.stateBlobB64u,`ECDSA state blob`),n=crypto.getRandomValues(new Uint8Array(12)),r=q(e.aadProjection);try{let i=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n,additionalData:r},e.key,t));try{return{iv12B64u:v(c(n)),ciphertextB64u:x(c(i)),digestB64u:c(await a(i))}}finally{i.fill(0)}}finally{t.fill(0),r.fill(0)}}async function Tt(e){let t=l(e);try{return c(await a(t))}finally{t.fill(0)}}async function Et(e){let t=l(e.iv12B64u),n=l(e.ciphertextB64u),r=q(e.aadProjection),i=null;try{if(i=new Uint8Array(await crypto.subtle.decrypt({name:`AES-GCM`,iv:t,additionalData:r},e.key,n)),i.length===0)throw Error(`decrypted ECDSA state blob must not be empty`);return c(i)}finally{t.fill(0),n.fill(0),r.fill(0),i?.fill(0)}}function Dt(e){let t=i(e,`ECDSA manifest identity`);return L(t,`ECDSA manifest identity`,[`manifestId`,`manifestRevision`]),be({manifestId:C(t.manifestId),manifestRevision:S(t.manifestRevision)})}function Ot(e){let t=i(e,`ECDSA manifest expectation`);switch(t.kind){case`no_current_manifest`:return L(t,`ECDSA no-current manifest expectation`,[`kind`]),Se();case`exact_manifest`:return L(t,`ECDSA exact manifest expectation`,[`kind`,`manifestId`,`manifestRevision`]),De(be({manifestId:C(t.manifestId),manifestRevision:S(t.manifestRevision)}));default:throw Error(`ECDSA manifest expectation kind is invalid`)}}function kt(e){let t=i(e,`ECDSA capability target`);switch(t.kind){case`evm`:return L(t,`ECDSA EVM capability target`,[`kind`,`namespace`,`chainId`,`networkSlug`]),_({kind:t.kind,namespace:t.namespace,chainId:t.chainId,networkSlug:t.networkSlug});case`tempo`:return L(t,`ECDSA Tempo capability target`,[`kind`,`chainId`,`networkSlug`]),_({kind:t.kind,chainId:t.chainId,networkSlug:t.networkSlug});default:throw Error(`ECDSA capability target kind is invalid`)}}function At(e){let t=i(e,`ECDSA capability scope`);if(L(t,`ECDSA capability scope`,[`kind`,`targetMemberships`]),t.kind!==`evm_family`)throw Error(`ECDSA capability scope kind is invalid`);let n=s(t.targetMemberships,`ECDSA capability target memberships`),r=[];for(let e of n)r.push(kt(e));let[a,...o]=r;if(!a)throw Error(`ECDSA capability scope requires at least one target`);return Ee({targetMemberships:[a,...o]})}function jt(e){let t=i(e,`ECDSA role-local material binding`);if(L(t,`ECDSA role-local material binding`,[`kind`,`keyHandle`,`ecdsaThresholdKeyId`,`clientVerifyingPublicKey33B64u`,`participantIds`,`relayerKeyId`]),t.kind!==`ecdsa_role_local_material_binding`)throw Error(`ECDSA role-local material binding kind is invalid`);let n=s(t.participantIds,`ECDSA role-local participant ids`),r=[];for(let e of n)r.push(Re(e));let[a,...o]=r;if(!a)throw Error(`ECDSA role-local material requires at least one participant`);return ke({keyHandle:Fe(t.keyHandle),ecdsaThresholdKeyId:ge(t.ecdsaThresholdKeyId),clientVerifyingPublicKey33B64u:E(t.clientVerifyingPublicKey33B64u),participantIds:[a,...o],relayerKeyId:me(t.relayerKeyId)})}function Mt(n){let r=i(n,`prepared ECDSA signer`);if(L(r,`prepared ECDSA signer`,[`kind`,`capability`,`signerId`,`walletId`,`authority`,`scope`,`materialOwner`,`signingRootId`,`signingRootVersion`]),r.kind!==`prepared_evm_family_signer`)throw Error(`prepared ECDSA signer kind is invalid`);let a=y(r.authority);if(!a)throw Error(`prepared ECDSA signer authority is invalid`);if(String(r.walletId)!==String(a.walletId))throw Error(`prepared ECDSA signer wallet does not match its authority`);return Te({capability:D(t(r.capability)),signerId:oe(r.signerId),authority:a,scope:At(r.scope),materialOwner:D(e(r.materialOwner)),signingRootId:se(r.signingRootId),signingRootVersion:ne(r.signingRootVersion)})}function Nt(e){let t=i(e,`encrypted ECDSA pending candidate`);if(L(t,`encrypted ECDSA pending candidate`,[`kind`,`sealingKeyId`,`iv12B64u`,`ciphertextB64u`,`ciphertextDigest`]),t.kind!==`encrypted_ecdsa_pending_candidate`)throw Error(`encrypted ECDSA pending candidate kind is invalid`);return xe({sealingKeyId:T(t.sealingKeyId),iv12B64u:v(t.iv12B64u),ciphertextB64u:x(t.ciphertextB64u),ciphertextDigest:ue(t.ciphertextDigest)})}function Pt(e){let t=i(e,`ECDSA activation binding`);if(L(t,`ECDSA activation binding`,[`kind`,`targetManifest`,`signer`,`roleLocalBinding`,`bindingDigest`,`durableMaterialRef`]),t.kind!==`ecdsa_activation_binding`)throw Error(`ECDSA activation binding kind is invalid`);return Ae({targetManifest:Dt(t.targetManifest),signer:Mt(t.signer),roleLocalBinding:jt(t.roleLocalBinding),bindingDigest:O(t.bindingDigest),durableMaterialRef:_e(t.durableMaterialRef)})}function Ft(e){let t=i(e,`prepared ECDSA activation candidate`);if(L(t,`prepared ECDSA activation candidate`,[`kind`,`activationBinding`,`encryptedPending`]),t.kind!==`prepared_ecdsa_activation_candidate`)throw Error(`prepared ECDSA activation candidate kind is invalid`);return A({activationBinding:Pt(t.activationBinding),encryptedPending:Nt(t.encryptedPending)})}function It(e){let t=i(e,`ECDSA server generation expectation`);switch(t.kind){case`no_current_generation`:return L(t,`ECDSA no-current server generation expectation`,[`kind`]),Ce();case`exact_generation`:return L(t,`ECDSA exact server generation expectation`,[`kind`,`serverGeneration`]),Ne(w(t.serverGeneration));default:throw Error(`ECDSA server generation expectation kind is invalid`)}}function Lt(e){let t=i(e,`prepared ECDSA activation journal`);if(L(t,`prepared ECDSA activation journal`,[`kind`,`journalId`,`expectedManifest`,`activationCommand`,`candidate`,`createdAt`]),t.kind!==`activation_prepared`)throw Error(`prepared ECDSA activation journal kind is invalid`);let n=i(t.activationCommand,`ECDSA activation command`);if(L(n,`ECDSA activation command`,[`kind`,`correlationId`,`expectedGeneration`,`requestDigest`,`canonicalRequest`]),n.kind!==`ecdsa_server_activation_command`)throw Error(`ECDSA activation command kind is invalid`);let r=f(t.journalId);if(f(n.correlationId)!==r)throw Error(`ECDSA activation command correlation does not match its journal`);let a=Ot(t.expectedManifest),o=It(n.expectedGeneration),s={journalId:r,candidate:Ft(t.candidate),requestDigest:p(n.requestDigest),canonicalRequest:de(n.canonicalRequest),createdAt:d(t.createdAt)};switch(a.kind){case`no_current_manifest`:if(o.kind!==`no_current_generation`)throw Error(`initial ECDSA journal has an exact server generation`);return k({...s,expectedManifest:a,expectedGeneration:o});case`exact_manifest`:if(o.kind!==`exact_generation`)throw Error(`replacement ECDSA journal is missing its exact server generation`);return k({...s,expectedManifest:a,expectedGeneration:o})}return Y(a)}function Rt(e){return{kind:`activation_prepared`,journalId:e.journalId,expectedManifest:e.expectedManifest,activationCommand:e.activationCommand,candidate:e.candidate,createdAt:e.createdAt}}function zt(e){return e.kind===`activation_prepared`?e:xt({journalId:e.journalId,expectedManifest:e.expectedManifest,expectedGeneration:e.activationCommand.expectedGeneration,candidate:e.candidate,requestDigest:e.activationCommand.requestDigest,canonicalRequest:e.activationCommand.canonicalRequest,createdAt:e.createdAt})}function Bt(e){let t=i(e,`server-committed ECDSA activation journal`);if(L(t,`server-committed ECDSA activation journal`,[`kind`,`journalId`,`expectedManifest`,`activationCommand`,`candidate`,`createdAt`,`serverActivation`]),t.kind!==`server_activation_committed`)throw Error(`server-committed ECDSA activation journal kind is invalid`);let n=Lt(Rt(t)),r=Vt(t.serverActivation),a=ye({preparedJournal:n,serverCommit:r.serverCommit});if(!yt(a.serverActivation,r.record))throw Error(`ECDSA server activation commit fields are inconsistent`);return a}function Vt(e){let t=i(e,`ECDSA server activation commit`);if(L(t,`ECDSA server activation commit`,[`kind`,`correlationId`,`activationRequestDigest`,`serverGeneration`,`serverActivationReceipt`]),t.kind!==`ecdsa_server_activation_commit`)throw Error(`ECDSA server activation commit kind is invalid`);let n=i(t.serverActivationReceipt,`ECDSA server activation receipt`);if(L(n,`ECDSA server activation receipt`,[`kind`,`lifecycleId`,`activationDigest`,`activatedAt`,`protocolReceipt`]),n.kind!==`ecdsa_server_activation_receipt`)throw Error(`ECDSA server activation receipt kind is invalid`);return{record:t,serverCommit:{correlationId:f(t.correlationId),activationRequestDigest:p(t.activationRequestDigest),serverGeneration:w(t.serverGeneration),protocolReceipt:n.protocolReceipt}}}function Ht(e){let t=i(e,`ECDSA activation journal`);switch(t.kind){case`activation_prepared`:return Lt(t);case`server_activation_committed`:return Bt(t);default:throw Error(`ECDSA activation journal kind is invalid`)}}function Ut(e){let t=i(e,`registered ECDSA public facts`);if(L(t,`registered ECDSA public facts`,[`kind`,`keyHandle`,`publicKeyB64u`,`participantIds`,`thresholdOwnerAddress`]),t.kind!==`verified_ecdsa_public_facts`)throw Error(`registered ECDSA public facts kind is invalid`);return Le({keyHandle:Ie(t.keyHandle),publicKeyB64u:t.publicKeyB64u,participantIds:s(t.participantIds,`registered ECDSA participant ids`),thresholdOwnerAddress:t.thresholdOwnerAddress})}function J(e){let t=i(e,`active ECDSA manifest proof`);L(t,`active ECDSA manifest proof`,[`activation_binding`,`server_activation`,`registered_public_facts`,`role_local_public_facts`,`router_ab_ecdsa_derivation_normal_signing`,`runtime_policy_scope`,`ciphertext_digest`,`committed_at`]);let n=Pt(t.activation_binding),r=Vt(t.server_activation),a=je({activationBinding:n,serverCommit:r.serverCommit});if(!yt(a,r.record))throw Error(`ECDSA server activation commit fields are inconsistent`);let o=Oe({activationBinding:n,serverActivation:a,routerAbEcdsaDerivationNormalSigning:re(t.router_ab_ecdsa_derivation_normal_signing),roleLocalPublicFacts:he(t.role_local_public_facts),ciphertextDigest:b(t.ciphertext_digest),runtimePolicyScope:u(t.runtime_policy_scope)}),s=d(t.committed_at);return{activationBinding:n,serverActivation:a,durableMaterial:o,activeManifest:Me({activationBinding:n,serverActivation:a,registeredPublicFacts:Ut(t.registered_public_facts),durableMaterial:o,committedAt:s}),committedAt:s}}function Wt(e){let t=i(e,`ECDSA capability manifest row`),n=[`record_version`,`manifest_id`,`manifest_revision`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`manifest_state`,`active_proof`];switch(t.manifest_state){case`active`:{L(t,`active ECDSA capability manifest row`,n);let e=J(t.active_proof),r=B(e.activeManifest);return Gt(t,e.activeManifest,r),{state:`active`,selector:r,manifest:e.activeManifest,activeProof:e}}case`replaced`:{L(t,`replaced ECDSA capability manifest row`,[...n,`replacement_proof`]);let e=J(t.active_proof),r=J(t.replacement_proof),i=we({activeManifest:e.activeManifest,replacementManifest:r.activeManifest}),a=B(e.activeManifest);return Gt(t,e.activeManifest,a),{state:`replaced`,selector:a,manifest:i,activeProof:e,replacementProof:r}}default:throw Error(`ECDSA capability manifest row state is invalid`)}}function Gt(e,t,n){if(e.record_version!==`ecdsa_capability_manifest_v3`||C(e.manifest_id)!==t.identity.manifestId||S(e.manifest_revision)!==t.identity.manifestRevision||String(e.capability_ref)!==String(n.capability)||String(e.wallet_id)!==String(n.authority.walletId)||String(e.authority_digest)!==String(n.authority.authorityDigest))throw Error(`ECDSA capability manifest row identity is inconsistent`)}function Kt(e){return{record_version:F,...H(B(e)),manifest_id:e.identity.manifestId,manifest_revision:e.identity.manifestRevision}}function qt(e){let n=i(e,`current ECDSA capability pointer`);if(L(n,`current ECDSA capability pointer`,[`record_version`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`manifest_id`,`manifest_revision`]),n.record_version!==F)throw Error(`current ECDSA capability pointer version is invalid`);let r=Qe(n);if(!r)throw Error(`current ECDSA capability pointer authority is invalid`);return{selector:{capability:D(t(n.capability_ref)),authority:r},manifestId:C(n.manifest_id),manifestRevision:S(n.manifest_revision)}}function Jt(e,t){return{record_version:Ue,durable_material_ref:e.binding.durableMaterialRef,binding_digest:e.binding.bindingDigest,...H(B(t)),sealing_key_id:e.sealingKeyId,iv:e.iv12B64u,ciphertext:e.ciphertextB64u}}function Yt(e){let n=i(e,`ECDSA role-local material row`);if(L(n,`ECDSA role-local material row`,[`record_version`,`durable_material_ref`,`binding_digest`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`sealing_key_id`,`iv`,`ciphertext`]),n.record_version!==Ue)throw Error(`ECDSA role-local material row version is invalid`);let r=Qe(n);if(!r)throw Error(`ECDSA role-local material authority is invalid`);return{durableMaterialRef:_e(n.durable_material_ref),bindingDigest:O(n.binding_digest),selector:{capability:D(t(n.capability_ref)),authority:r}}}function Xt(e,t){let n=i(e,`ECDSA role-local material row`),r=Yt(n),a=Pe({binding:t.durableMaterial,sealingKeyId:T(n.sealing_key_id),iv12B64u:v(n.iv),ciphertextB64u:x(n.ciphertext)});if(r.durableMaterialRef!==a.binding.durableMaterialRef||r.bindingDigest!==a.binding.bindingDigest||!et(r.selector,B(t.activeManifest)))throw Error(`ECDSA role-local material row binding is inconsistent`);return a}function Zt(e,t){return e.binding.durableMaterialRef===t.durableMaterial.durableMaterialRef&&e.binding.bindingDigest===t.durableMaterial.bindingDigest&&e.binding.lifecycleId===t.durableMaterial.lifecycleId&&e.binding.ciphertextDigest===t.durableMaterial.ciphertextDigest&&e.binding.activationDigest===t.durableMaterial.activationDigest&&e.binding.activatedAt===t.durableMaterial.activatedAt&&r(e.binding.materialActivation,t.durableMaterial.materialActivation)&&G(e.binding.roleLocalBinding,t.durableMaterial.roleLocalBinding)}function Qt(e){return{record_version:We,journal_id:e.journalId,...H(z(e)),journal:e}}function $t(e){let t=i(e,`ECDSA activation commit journal row`);if(L(t,`ECDSA activation commit journal row`,[`record_version`,`journal_id`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`journal`]),t.record_version!==We)throw Error(`ECDSA activation commit journal row version is invalid`);let n=Ht(t.journal),r=z(n);if(f(t.journal_id)!==n.journalId||String(t.capability_ref)!==String(r.capability)||String(t.wallet_id)!==String(r.authority.walletId)||String(t.authority_digest)!==String(r.authority.authorityDigest))throw Error(`ECDSA activation commit journal row identity is inconsistent`);return{journal:n,selector:r}}function en(e){return typeof CryptoKey>`u`||!(e instanceof CryptoKey)||e.type!==`secret`||e.extractable||e.algorithm.name!==`AES-GCM`?!1:e.usages.includes(`encrypt`)&&e.usages.includes(`decrypt`)}function tn(e,t){return{record_version:Ge,key_id:e,key:t}}function nn(e){let t=i(e,`ECDSA material sealing key row`);if(L(t,`ECDSA material sealing key row`,[`record_version`,`key_id`,`key`]),t.record_version!==Ge)throw Error(`ECDSA material sealing key row version is invalid`);if(!en(t.key))throw Error(`ECDSA material sealing key must be a non-extractable AES-GCM key`);return{keyId:T(t.key_id),key:t.key}}function Y(e){throw Error(`Unexpected ECDSA persistence branch: ${String(e)}`)}const rn=5*6e4;function an(e,t,n){let i=e.binding.routerAbEcdsaDerivationNormalSigning.scope,a=ae(e.binding.materialActivation);return i.wallet_id===t.walletId&&c(pe(i))===t.signingScopeB64u&&c(te(a))===t.materialActivationB64u&&i.signing_worker.key_epoch===t.keyEpoch&&i.activation_epoch===t.activationEpoch&&a.activation_id===t.materialActivationId&&a.capability===t.capability&&a.key_binding===t.keyBinding&&a.material_owner===t.walletId&&e.binding.durableMaterialRef===n.durableMaterialRef&&e.binding.bindingDigest===n.bindingDigest&&r(e.binding.materialActivation,n.materialActivation)}function on(e,t){return e.materialActivation.activationId===t.materialActivationId&&e.materialActivation.capability===t.capability&&e.materialActivation.keyBinding===t.keyBinding&&e.materialActivation.materialOwner===t.walletId}function sn(e){if(typeof e!=`string`||!/^ecdsa-client-presignature-[A-Za-z0-9_-]+$/.test(e))throw Error(`ECDSA durable presignature record id is invalid`);return e}function X(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} is invalid`);return e}function Z(e){if(!e||typeof e!=`object`||!(`record_id`in e))return null;let t=e.record_id;return typeof t==`string`?t:null}function cn(){return typeof IDBTransaction<`u`&&`durability`in IDBTransaction.prototype}async function ln(e,t=1/0){let n=0;for(;e&&n<t;)await e.delete(),n+=1,e=await e.continue();return n}async function un(e,t,n){return await ln(await e.store(I).index(h.walletExpiresAt).openCursor(IDBKeyRange.bound([t,0],[t,n])),32)}async function dn(e,t,n){await un(e,t.walletId,n);let r=e.store(I),i=await r.index(h.poolIdentityKey).getAll(P(t));t.ownershipGeneration===1&&i.push(...await r.index(h.poolIdentityKey).getAll(pn(t)));let a=[];for(let e of i)try{let t=Q(e);t.expires_at_ms<=n?await r.delete(t.record_id):(e.pool_identity_key!==t.pool_identity_key&&await r.put(t),a.push(t))}catch{let t=Z(e);t&&await r.delete(t)}return a}function fn(e){let{ownershipGeneration:t,...n}=e.poolIdentity;return{domain:`seams/ecdsa-client-presignature/v1`,version:1,pool_identity:t===1?n:e.poolIdentity,durable_material_ref:e.durableMaterialRef,presignature_id:e.presignatureId,group_public_key33_b64u:e.groupPublicKey33B64u,big_r33_b64u:e.bigR33B64u,created_at_ms:e.createdAtMs,expires_at_ms:e.expiresAtMs,sealing_key_id:e.sealingKeyId}}function pn(e){return[e.protocolId,e.relayerUrl,e.signingScopeB64u,e.materialActivationB64u].join(`|`)}function Q(e){let t=i(e,`ECDSA durable presignature row`);if(L(t,`ECDSA durable presignature row`,[`kind`,`record_id`,`pool_identity`,`pool_identity_key`,`wallet_id`,`material_activation_id`,`durable_material_ref`,`presignature_id`,`group_public_key33_b64u`,`big_r33_b64u`,`created_at_ms`,`expires_at_ms`,`sealed`]),t.kind!==`sealed_available_client_presignature_v1`)throw Error(`ECDSA durable presignature row kind is invalid`);let n=i(t.pool_identity,`ECDSA durable presignature pool identity`),r=!Object.hasOwn(n,`ownershipGeneration`);L(n,`ECDSA durable presignature pool identity`,[...r?[]:[`ownershipGeneration`],`activationEpoch`,`capability`,`keyBinding`,`keyEpoch`,`materialActivationB64u`,`materialActivationId`,`pairRole`,`protocolId`,`relayerUrl`,`signingScopeB64u`,`walletId`]);let a=N(r?{...n,ownershipGeneration:1}:n),o=sn(t.record_id),s=String(t.pool_identity_key??``);if(s!==P(a)&&!(r&&s===pn(a)))throw Error(`ECDSA durable presignature pool identity index is inconsistent`);let c=String(t.wallet_id??``).trim(),l=String(t.material_activation_id??``).trim();if(!c||c!==a.walletId)throw Error(`ECDSA durable presignature wallet binding is inconsistent`);if(!l||l!==a.materialActivationId)throw Error(`ECDSA durable presignature activation binding is inconsistent`);let u=ve(t.durable_material_ref);if(!on(u,a))throw Error(`ECDSA durable presignature material binding is inconsistent`);let d=String(t.presignature_id??``).trim();if(!d)throw Error(`ECDSA durable presignature id is invalid`);let f=E(t.group_public_key33_b64u),p=E(t.big_r33_b64u),m=X(t.created_at_ms,`created_at_ms`),h=X(t.expires_at_ms,`expires_at_ms`);if(m>Date.now()+3e5)throw Error(`ECDSA durable presignature creation timestamp is in the future`);if(h<=m)throw Error(`ECDSA durable presignature expiry must follow creation`);if(h-m>7776e6)throw Error(`ECDSA durable presignature lifetime exceeds the maximum`);let g=i(t.sealed,`ECDSA durable presignature sealed payload`);if(L(g,`ECDSA durable presignature sealed payload`,[`kind`,`sealing_key_id`,`iv12_b64u`,`ciphertext_b64u`,`ciphertext_digest_b64u`]),g.kind!==`ecdsa_activation_aes_gcm_v1`)throw Error(`ECDSA durable presignature sealing kind is invalid`);return{kind:`sealed_available_client_presignature_v1`,record_id:o,pool_identity:a,pool_identity_key:P(a),wallet_id:c,material_activation_id:l,durable_material_ref:u,presignature_id:d,group_public_key33_b64u:f,big_r33_b64u:p,created_at_ms:m,expires_at_ms:h,sealed:{kind:`ecdsa_activation_aes_gcm_v1`,sealing_key_id:T(g.sealing_key_id),iv12_b64u:v(g.iv12_b64u),ciphertext_b64u:x(g.ciphertext_b64u),ciphertext_digest_b64u:b(g.ciphertext_digest_b64u)}}}function mn(e){return{kind:`sealed_available_client_presignature_v1`,recordId:e.record_id,poolIdentity:e.pool_identity,durableMaterialRef:e.durable_material_ref,presignatureId:e.presignature_id,groupPublicKey33B64u:e.group_public_key33_b64u,bigR33B64u:e.big_r33_b64u,createdAtMs:e.created_at_ms,expiresAtMs:e.expires_at_ms,sealingKeyId:e.sealed.sealing_key_id}}async function hn(e){let t=crypto.getRandomValues(new Uint8Array(12)),n=q(fn(e.metadata));try{let r=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:t,additionalData:n},e.key,e.plaintext97));try{let e=c(r);return{iv12B64u:v(c(t)),ciphertextB64u:x(e),ciphertextDigestB64u:b(c(await a(r)))}}finally{r.fill(0)}}finally{t.fill(0),n.fill(0),e.plaintext97.fill(0)}}async function gn(e){let t=l(e.sealed.iv12_b64u),n=l(e.sealed.ciphertext_b64u),r=q(fn(e.metadata)),i=null;try{if(c(await a(n))!==e.sealed.ciphertext_digest_b64u)throw Error(`ECDSA durable presignature ciphertext digest mismatch`);if(i=new Uint8Array(await crypto.subtle.decrypt({name:`AES-GCM`,iv:t,additionalData:r},e.key,n)),i.length!==97)throw Error(`ECDSA durable presignature plaintext length is invalid`);return i.slice()}finally{t.fill(0),n.fill(0),r.fill(0),i?.fill(0)}}async function _n(e,t,n){let r=e.store(I),i=await r.index(h.walletMaterialActivationId).getAll([t,n]);for(let e of i){let t=Z(e);t&&await r.delete(t)}}async function $(e,t){let n=await e.store(m.appState).get(`wallet_ownership_generation:${t}`);if(n===void 0)return 1;let r=i(n,`Wallet ownership generation`).value;if(typeof r!=`number`||!Number.isSafeInteger(r)||r<1)throw Error(`Stored wallet ownership generation is invalid`);return r}async function vn(e,t,n){if(await $(e,t)!==n)throw Error(`Wallet ownership generation requires fresh authentication`)}async function yn(e,t,n){let r=await $(e,t);if(n<r)throw Error(`Wallet session belongs to an obsolete ownership generation`);if(n===r)return;await e.store(m.appState).put({key:`wallet_ownership_generation:${t}`,value:n});let i=await e.store(m.ecdsaClientPresignatures).index(h.walletId).openCursor(t);for(;i;){let e=!0;try{e=Q(i.value).pool_identity.ownershipGeneration<n}catch{}e&&await i.delete(),i=await i.continue()}}async function bn(e,t){await g.runTransaction([m.appState],`readonly`,xn.bind(null,e,t))}function xn(e,t,n){return vn(n,e,t)}async function Sn(e,t){await g.runTransaction([m.appState,m.ecdsaClientPresignatures],`readwrite`,Cn.bind(null,e,t))}async function Cn(e,t,n){t<=await $(n,e)||await yn(n,e,t)}export{B as $,vt as A,Ze as B,I as C,Tt as D,bt as E,rt as F,Yt as G,Bt as H,K as I,nn as J,Xt as K,wt as L,gt as M,it as N,Et as O,G as P,z as Q,Ct as R,qe as S,Y as T,$t as U,J as V,Wt as W,tt as X,zt as Y,H as Z,cn as _,rn as a,Kt as at,Ke as b,hn as c,P as ct,sn as d,N as dt,R as et,X as f,_n as g,dn as h,Sn as i,Jt as it,nt as j,ht as k,on as l,Be as lt,Z as m,bn as n,et as nt,an as o,tn as ot,Q as p,qt as q,vn as r,Qt as rt,gn as s,$e as st,yn as t,V as tt,mn as u,Ve as ut,Ye as v,Xe as w,Je as x,He as y,Zt as z};
+import{_ as e,a as t,b as n,i as r}from"./domainIds-t1lp25yU.js";import{S as i,n as a,t as o,y as s}from"./digests-BIaE0DMd.js";import{i as c,r as l}from"./base64-BmKR3UqU.js";import{X as u}from"./activeWalletSession-BJ4B-nJo.js";import{i as d,n as f,r as p}from"./canonicalPrimitives-Jd3i_Ngz.js";import{a as m,i as h,n as g}from"./presignatures-CkhuZ0YQ.js";import{a as _}from"./ecdsaChainTarget-BoRVQtjQ.js";import{A as ee,At as te,Et as ne,F as re,G as ie,Pt as ae,St as oe,Tt as se,W as ce,_t as v,b as le,bt as ue,ct as y,dt as de,gt as b,ht as x,mt as S,pt as C,q as fe,xt as w,yt as T,z as pe}from"./digestEncoding-34kXJoJr.js";import{A as E,B as me,C as he,I as ge,M as _e,P as ve,_ as ye,a as be,b as D,c as xe,d as Se,f as Ce,g as we,h as Te,i as Ee,j as O,l as De,m as k,n as Oe,o as ke,p as A,r as Ae,s as je,t as Me,u as Ne,v as Pe,z as Fe}from"./ecdsaCapabilityManifest--1Ztngfx.js";import{C as Ie,p as Le,w as Re}from"./emailOtpEcdsaDerivationIdentity-Qd4pBwHv.js";const j=`seams/router-ab-ecdsa-presign/fixed-2of2/v1`;function M(e,t){if(typeof e!=`string`||!e)throw Error(`${t} is required`);if(e.trim()!==e)throw Error(`${t} must be canonical`);return e}function N(e){if(typeof e!=`object`||!e)throw Error(`poolIdentity is required`);let t=e;if(!Number.isSafeInteger(t.ownershipGeneration)||Number(t.ownershipGeneration)<1)throw Error(`poolIdentity.ownershipGeneration must be a positive safe integer`);if(t.pairRole!==`client`)throw Error(`poolIdentity.pairRole must be client`);if(t.protocolId!==`seams/router-ab-ecdsa-presign/fixed-2of2/v1`)throw Error(`poolIdentity.protocolId is unsupported`);let n=M(t.relayerUrl,`poolIdentity.relayerUrl`);if(n.replace(/\/+$/g,``)!==n)throw Error(`poolIdentity.relayerUrl must be canonical`);return{ownershipGeneration:Number(t.ownershipGeneration),relayerUrl:n,materialActivationB64u:M(t.materialActivationB64u,`poolIdentity.materialActivationB64u`),materialActivationId:M(t.materialActivationId,`poolIdentity.materialActivationId`),capability:M(t.capability,`poolIdentity.capability`),keyBinding:M(t.keyBinding,`poolIdentity.keyBinding`),walletId:M(t.walletId,`poolIdentity.walletId`),signingScopeB64u:M(t.signingScopeB64u,`poolIdentity.signingScopeB64u`),pairRole:`client`,keyEpoch:M(t.keyEpoch,`poolIdentity.keyEpoch`),activationEpoch:ze(t.activationEpoch),protocolId:j}}function ze(e){let t=n(e);if(!t.ok)throw Error(`poolIdentity.activationEpoch is invalid`);return t.value}function Be(e,t){return e.ownershipGeneration===t.ownershipGeneration&&e.relayerUrl===t.relayerUrl&&e.materialActivationB64u===t.materialActivationB64u&&e.materialActivationId===t.materialActivationId&&e.capability===t.capability&&e.keyBinding===t.keyBinding&&e.walletId===t.walletId&&e.signingScopeB64u===t.signingScopeB64u&&e.pairRole===t.pairRole&&e.keyEpoch===t.keyEpoch&&e.activationEpoch===t.activationEpoch&&e.protocolId===t.protocolId}function P(e){return[e.protocolId,e.relayerUrl,e.signingScopeB64u,e.materialActivationB64u,e.ownershipGeneration].join(`|`)}function Ve(e){let t=le(e.scope),n=e.materialActivation,r=String(e.relayerUrl||``).trim().replace(/\/+$/g,``);return{ownershipGeneration:e.ownershipGeneration,relayerUrl:r,materialActivationB64u:c(te(n)),materialActivationId:n.activation_id,capability:n.capability,keyBinding:n.key_binding,walletId:t.wallet_id,signingScopeB64u:c(pe(t)),pairRole:`client`,keyEpoch:t.signing_worker.key_epoch,activationEpoch:t.activation_epoch,protocolId:j}}const He=`ecdsa_capability_manifest_v3`,F=`ecdsa_current_capability_manifest_v2`,Ue=`ecdsa_role_local_material_v2`,We=`ecdsa_activation_commit_journal_v1`,Ge=`ecdsa_material_sealing_key_v1`,Ke=m.ecdsaCapabilityManifests,qe=m.ecdsaCurrentCapabilityManifests,Je=m.ecdsaRoleLocalMaterial,Ye=m.ecdsaActivationCommitJournals,Xe=m.ecdsaMaterialSealingKeys,I=m.ecdsaClientPresignatures;function L(e,t,n){let r=Object.keys(e).sort(),i=[...n].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${t} has unexpected fields`)}function Ze(e){let n=y(e.authority);if(!n)throw Error(`ECDSA capability selector authority is invalid`);return{capability:D(t(e.capability)),authority:n}}function R(e){return{capability:e.capability,authority:e.authority}}function z(e){return R(e.candidate.activationBinding.signer)}function B(e){return R(e.signer)}function V(e){return[String(e.capability),String(e.authority.walletId),String(e.authority.authorityDigest)]}function H(e){return{capability_ref:e.capability,wallet_id:e.authority.walletId,authority_digest:e.authority.authorityDigest,wallet_auth_method_id:e.authority.walletAuthMethodId}}function Qe(e){return y({kind:`wallet_auth_authority_ref`,walletId:e.wallet_id,authorityDigest:e.authority_digest,walletAuthMethodId:e.wallet_auth_method_id})}function $e(e,t){return e.kind===t.kind&&e.walletId===t.walletId&&e.authorityDigest===t.authorityDigest&&e.walletAuthMethodId===t.walletAuthMethodId}function et(e,t){let n=V(e),r=V(t);return n[0]===r[0]&&n[1]===r[1]&&n[2]===r[2]}function U(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function tt(e,t){return e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function W(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`evm`:return t.kind===`evm`&&e.namespace===t.namespace&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;case`tempo`:return t.kind===`tempo`&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;default:return Y(e)}}function nt(e,t){return e.kind===t.kind&&e.targetMemberships.length===t.targetMemberships.length&&e.targetMemberships.every((e,n)=>W(e,t.targetMemberships[n]))}function G(e,t){return e.kind===t.kind&&e.keyHandle===t.keyHandle&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.clientVerifyingPublicKey33B64u===t.clientVerifyingPublicKey33B64u&&U(e.participantIds,t.participantIds)&&e.relayerKeyId===t.relayerKeyId}function rt(e,t){return e.walletId===t.walletId&&W(e.chainTarget,t.chainTarget)&&e.keyHandle===t.keyHandle&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.signingRootId===t.signingRootId&&e.signingRootVersion===t.signingRootVersion&&e.applicationBindingDigestB64u===t.applicationBindingDigestB64u&&e.clientParticipantId===t.clientParticipantId&&e.relayerParticipantId===t.relayerParticipantId&&U(e.participantIds,t.participantIds)&&e.contextBinding32B64u===t.contextBinding32B64u&&e.derivationClientSharePublicKey33B64u===t.derivationClientSharePublicKey33B64u&&e.relayerPublicKey33B64u===t.relayerPublicKey33B64u&&e.groupPublicKey33B64u===t.groupPublicKey33B64u&&e.ethereumAddress===t.ethereumAddress&&ie(e.publicCapability,t.publicCapability)}function it(e,t){return e.kind===t.kind&&e.keyHandle===t.keyHandle&&e.publicKeyB64u===t.publicKeyB64u&&U(e.participantIds,t.participantIds)&&e.thresholdOwnerAddress===t.thresholdOwnerAddress}function at(e,t){return e.manifestId===t.manifestId&&e.manifestRevision===t.manifestRevision}function ot(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`no_current_manifest`:return!0;case`exact_manifest`:return t.kind===`exact_manifest`&&e.manifestId===t.manifestId&&e.manifestRevision===t.manifestRevision;default:return Y(e)}}function st(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`no_current_generation`:return!0;case`exact_generation`:return t.kind===`exact_generation`&&e.serverGeneration===t.serverGeneration;default:return Y(e)}}function ct(e,t){return e.kind===t.kind&&e.capability===t.capability&&e.signerId===t.signerId&&e.walletId===t.walletId&&$e(e.authority,t.authority)&&nt(e.scope,t.scope)&&e.materialOwner===t.materialOwner&&e.signingRootId===t.signingRootId&&e.signingRootVersion===t.signingRootVersion}function lt(e,t){return ct(e,t)&&it(e.registeredPublicFacts,t.registeredPublicFacts)}function ut(e,t){return e.kind===t.kind&&e.sealingKeyId===t.sealingKeyId&&e.iv12B64u===t.iv12B64u&&e.ciphertextB64u===t.ciphertextB64u&&e.ciphertextDigest===t.ciphertextDigest}function dt(e,t){return e.kind===t.kind&&at(e.targetManifest,t.targetManifest)&&ct(e.signer,t.signer)&&G(e.roleLocalBinding,t.roleLocalBinding)&&e.bindingDigest===t.bindingDigest&&e.durableMaterialRef===t.durableMaterialRef}function K(e,t){return e.kind===t.kind&&e.correlationId===t.correlationId&&e.activationRequestDigest===t.activationRequestDigest&&e.serverGeneration===t.serverGeneration&&ft(e.serverActivationReceipt,t.serverActivationReceipt)}function ft(e,t){return e.kind===t.kind&&e.lifecycleId===t.lifecycleId&&e.activationDigest===t.activationDigest&&e.activatedAt===t.activatedAt&&fe(e.protocolReceipt,t.protocolReceipt)}function pt(e,t){return e.kind===t.kind&&e.correlationId===t.correlationId&&st(e.expectedGeneration,t.expectedGeneration)&&e.requestDigest===t.requestDigest&&e.canonicalRequest===t.canonicalRequest}function mt(e,t){return e.kind===t.kind&&dt(e.activationBinding,t.activationBinding)&&ut(e.encryptedPending,t.encryptedPending)}function ht(e,t){if(e.kind!==t.kind||!(e.journalId===t.journalId&&ot(e.expectedManifest,t.expectedManifest)&&pt(e.activationCommand,t.activationCommand)&&mt(e.candidate,t.candidate)&&e.createdAt===t.createdAt))return!1;switch(e.kind){case`activation_prepared`:return!0;case`server_activation_committed`:return t.kind===`server_activation_committed`&&K(e.serverActivation,t.serverActivation);default:return Y(e)}}function gt(e,t){return e.kind===t.kind&&r(e.materialActivation,t.materialActivation)&&ce(e.routerAbEcdsaDerivationNormalSigning,t.routerAbEcdsaDerivationNormalSigning)&&rt(e.roleLocalPublicFacts,t.roleLocalPublicFacts)&&G(e.roleLocalBinding,t.roleLocalBinding)&&e.durableMaterialRef===t.durableMaterialRef&&e.bindingDigest===t.bindingDigest&&e.lifecycleId===t.lifecycleId&&e.ciphertextDigest===t.ciphertextDigest&&e.activationDigest===t.activationDigest&&e.activatedAt===t.activatedAt&&tt(e.runtimePolicyScope,t.runtimePolicyScope)}function _t(e,t){return e.kind===t.kind&&r(e.materialActivation,t.materialActivation)&&K(e.serverActivation,t.serverActivation)&&e.retention===t.retention}function vt(e,t){return e.kind===t.kind&&at(e.identity,t.identity)&&lt(e.signer,t.signer)&&_t(e.activation,t.activation)&&gt(e.durableMaterial,t.durableMaterial)&&e.committedAt===t.committedAt}function yt(e,t){try{let n=i(t.serverActivationReceipt,`ECDSA server activation receipt`);return t.kind===e.kind&&f(t.correlationId)===e.correlationId&&p(t.activationRequestDigest)===e.activationRequestDigest&&w(t.serverGeneration)===e.serverGeneration&&n.kind===e.serverActivationReceipt.kind&&n.lifecycleId===String(e.serverActivationReceipt.lifecycleId)&&n.activationDigest===String(e.serverActivationReceipt.activationDigest)&&d(n.activatedAt)===e.serverActivationReceipt.activatedAt&&fe(ee(n.protocolReceipt),e.serverActivationReceipt.protocolReceipt)}catch{return!1}}function bt(e){let t=A({activationBinding:e.preparation.activationBinding,encryptedPending:e.encryptedPending});return xt({...e.preparation,candidate:t})}function xt(e){let t={journalId:e.journalId,candidate:e.candidate,requestDigest:e.requestDigest,canonicalRequest:e.canonicalRequest,createdAt:e.createdAt};switch(e.expectedManifest.kind){case`no_current_manifest`:if(e.expectedGeneration.kind!==`no_current_generation`)throw Error(`Initial ECDSA activation cannot expect a server generation`);return k({...t,expectedManifest:e.expectedManifest,expectedGeneration:e.expectedGeneration});case`exact_manifest`:if(e.expectedGeneration.kind!==`exact_generation`)throw Error(`Replacement ECDSA activation requires an exact server generation`);return k({...t,expectedManifest:e.expectedManifest,expectedGeneration:e.expectedGeneration});default:return Y(e.expectedManifest)}}function St(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be non-empty unpadded base64url`);let n=l(e);if(n.length===0||c(n)!==e)throw n.fill(0),Error(`${t} must be canonical base64url`);return n}function q(e){return new TextEncoder().encode(o(e))}async function Ct(){return await crypto.subtle.generateKey({name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}async function wt(e){let t=St(e.stateBlobB64u,`ECDSA state blob`),n=crypto.getRandomValues(new Uint8Array(12)),r=q(e.aadProjection);try{let i=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n,additionalData:r},e.key,t));try{return{iv12B64u:v(c(n)),ciphertextB64u:x(c(i)),digestB64u:c(await a(i))}}finally{i.fill(0)}}finally{t.fill(0),r.fill(0)}}async function Tt(e){let t=l(e);try{return c(await a(t))}finally{t.fill(0)}}async function Et(e){let t=l(e.iv12B64u),n=l(e.ciphertextB64u),r=q(e.aadProjection),i=null;try{if(i=new Uint8Array(await crypto.subtle.decrypt({name:`AES-GCM`,iv:t,additionalData:r},e.key,n)),i.length===0)throw Error(`decrypted ECDSA state blob must not be empty`);return c(i)}finally{t.fill(0),n.fill(0),r.fill(0),i?.fill(0)}}function Dt(e){let t=i(e,`ECDSA manifest identity`);return L(t,`ECDSA manifest identity`,[`manifestId`,`manifestRevision`]),be({manifestId:C(t.manifestId),manifestRevision:S(t.manifestRevision)})}function Ot(e){let t=i(e,`ECDSA manifest expectation`);switch(t.kind){case`no_current_manifest`:return L(t,`ECDSA no-current manifest expectation`,[`kind`]),Se();case`exact_manifest`:return L(t,`ECDSA exact manifest expectation`,[`kind`,`manifestId`,`manifestRevision`]),De(be({manifestId:C(t.manifestId),manifestRevision:S(t.manifestRevision)}));default:throw Error(`ECDSA manifest expectation kind is invalid`)}}function kt(e){let t=i(e,`ECDSA capability target`);switch(t.kind){case`evm`:return L(t,`ECDSA EVM capability target`,[`kind`,`namespace`,`chainId`,`networkSlug`]),_({kind:t.kind,namespace:t.namespace,chainId:t.chainId,networkSlug:t.networkSlug});case`tempo`:return L(t,`ECDSA Tempo capability target`,[`kind`,`chainId`,`networkSlug`]),_({kind:t.kind,chainId:t.chainId,networkSlug:t.networkSlug});default:throw Error(`ECDSA capability target kind is invalid`)}}function At(e){let t=i(e,`ECDSA capability scope`);if(L(t,`ECDSA capability scope`,[`kind`,`targetMemberships`]),t.kind!==`evm_family`)throw Error(`ECDSA capability scope kind is invalid`);let n=s(t.targetMemberships,`ECDSA capability target memberships`),r=[];for(let e of n)r.push(kt(e));let[a,...o]=r;if(!a)throw Error(`ECDSA capability scope requires at least one target`);return Ee({targetMemberships:[a,...o]})}function jt(e){let t=i(e,`ECDSA role-local material binding`);if(L(t,`ECDSA role-local material binding`,[`kind`,`keyHandle`,`ecdsaThresholdKeyId`,`clientVerifyingPublicKey33B64u`,`participantIds`,`relayerKeyId`]),t.kind!==`ecdsa_role_local_material_binding`)throw Error(`ECDSA role-local material binding kind is invalid`);let n=s(t.participantIds,`ECDSA role-local participant ids`),r=[];for(let e of n)r.push(Re(e));let[a,...o]=r;if(!a)throw Error(`ECDSA role-local material requires at least one participant`);return ke({keyHandle:Fe(t.keyHandle),ecdsaThresholdKeyId:ge(t.ecdsaThresholdKeyId),clientVerifyingPublicKey33B64u:E(t.clientVerifyingPublicKey33B64u),participantIds:[a,...o],relayerKeyId:me(t.relayerKeyId)})}function Mt(n){let r=i(n,`prepared ECDSA signer`);if(L(r,`prepared ECDSA signer`,[`kind`,`capability`,`signerId`,`walletId`,`authority`,`scope`,`materialOwner`,`signingRootId`,`signingRootVersion`]),r.kind!==`prepared_evm_family_signer`)throw Error(`prepared ECDSA signer kind is invalid`);let a=y(r.authority);if(!a)throw Error(`prepared ECDSA signer authority is invalid`);if(String(r.walletId)!==String(a.walletId))throw Error(`prepared ECDSA signer wallet does not match its authority`);return Te({capability:D(t(r.capability)),signerId:oe(r.signerId),authority:a,scope:At(r.scope),materialOwner:D(e(r.materialOwner)),signingRootId:se(r.signingRootId),signingRootVersion:ne(r.signingRootVersion)})}function Nt(e){let t=i(e,`encrypted ECDSA pending candidate`);if(L(t,`encrypted ECDSA pending candidate`,[`kind`,`sealingKeyId`,`iv12B64u`,`ciphertextB64u`,`ciphertextDigest`]),t.kind!==`encrypted_ecdsa_pending_candidate`)throw Error(`encrypted ECDSA pending candidate kind is invalid`);return xe({sealingKeyId:T(t.sealingKeyId),iv12B64u:v(t.iv12B64u),ciphertextB64u:x(t.ciphertextB64u),ciphertextDigest:ue(t.ciphertextDigest)})}function Pt(e){let t=i(e,`ECDSA activation binding`);if(L(t,`ECDSA activation binding`,[`kind`,`targetManifest`,`signer`,`roleLocalBinding`,`bindingDigest`,`durableMaterialRef`]),t.kind!==`ecdsa_activation_binding`)throw Error(`ECDSA activation binding kind is invalid`);return Ae({targetManifest:Dt(t.targetManifest),signer:Mt(t.signer),roleLocalBinding:jt(t.roleLocalBinding),bindingDigest:O(t.bindingDigest),durableMaterialRef:_e(t.durableMaterialRef)})}function Ft(e){let t=i(e,`prepared ECDSA activation candidate`);if(L(t,`prepared ECDSA activation candidate`,[`kind`,`activationBinding`,`encryptedPending`]),t.kind!==`prepared_ecdsa_activation_candidate`)throw Error(`prepared ECDSA activation candidate kind is invalid`);return A({activationBinding:Pt(t.activationBinding),encryptedPending:Nt(t.encryptedPending)})}function It(e){let t=i(e,`ECDSA server generation expectation`);switch(t.kind){case`no_current_generation`:return L(t,`ECDSA no-current server generation expectation`,[`kind`]),Ce();case`exact_generation`:return L(t,`ECDSA exact server generation expectation`,[`kind`,`serverGeneration`]),Ne(w(t.serverGeneration));default:throw Error(`ECDSA server generation expectation kind is invalid`)}}function Lt(e){let t=i(e,`prepared ECDSA activation journal`);if(L(t,`prepared ECDSA activation journal`,[`kind`,`journalId`,`expectedManifest`,`activationCommand`,`candidate`,`createdAt`]),t.kind!==`activation_prepared`)throw Error(`prepared ECDSA activation journal kind is invalid`);let n=i(t.activationCommand,`ECDSA activation command`);if(L(n,`ECDSA activation command`,[`kind`,`correlationId`,`expectedGeneration`,`requestDigest`,`canonicalRequest`]),n.kind!==`ecdsa_server_activation_command`)throw Error(`ECDSA activation command kind is invalid`);let r=f(t.journalId);if(f(n.correlationId)!==r)throw Error(`ECDSA activation command correlation does not match its journal`);let a=Ot(t.expectedManifest),o=It(n.expectedGeneration),s={journalId:r,candidate:Ft(t.candidate),requestDigest:p(n.requestDigest),canonicalRequest:de(n.canonicalRequest),createdAt:d(t.createdAt)};switch(a.kind){case`no_current_manifest`:if(o.kind!==`no_current_generation`)throw Error(`initial ECDSA journal has an exact server generation`);return k({...s,expectedManifest:a,expectedGeneration:o});case`exact_manifest`:if(o.kind!==`exact_generation`)throw Error(`replacement ECDSA journal is missing its exact server generation`);return k({...s,expectedManifest:a,expectedGeneration:o})}return Y(a)}function Rt(e){return{kind:`activation_prepared`,journalId:e.journalId,expectedManifest:e.expectedManifest,activationCommand:e.activationCommand,candidate:e.candidate,createdAt:e.createdAt}}function zt(e){return e.kind===`activation_prepared`?e:xt({journalId:e.journalId,expectedManifest:e.expectedManifest,expectedGeneration:e.activationCommand.expectedGeneration,candidate:e.candidate,requestDigest:e.activationCommand.requestDigest,canonicalRequest:e.activationCommand.canonicalRequest,createdAt:e.createdAt})}function Bt(e){let t=i(e,`server-committed ECDSA activation journal`);if(L(t,`server-committed ECDSA activation journal`,[`kind`,`journalId`,`expectedManifest`,`activationCommand`,`candidate`,`createdAt`,`serverActivation`]),t.kind!==`server_activation_committed`)throw Error(`server-committed ECDSA activation journal kind is invalid`);let n=Lt(Rt(t)),r=Vt(t.serverActivation),a=ye({preparedJournal:n,serverCommit:r.serverCommit});if(!yt(a.serverActivation,r.record))throw Error(`ECDSA server activation commit fields are inconsistent`);return a}function Vt(e){let t=i(e,`ECDSA server activation commit`);if(L(t,`ECDSA server activation commit`,[`kind`,`correlationId`,`activationRequestDigest`,`serverGeneration`,`serverActivationReceipt`]),t.kind!==`ecdsa_server_activation_commit`)throw Error(`ECDSA server activation commit kind is invalid`);let n=i(t.serverActivationReceipt,`ECDSA server activation receipt`);if(L(n,`ECDSA server activation receipt`,[`kind`,`lifecycleId`,`activationDigest`,`activatedAt`,`protocolReceipt`]),n.kind!==`ecdsa_server_activation_receipt`)throw Error(`ECDSA server activation receipt kind is invalid`);return{record:t,serverCommit:{correlationId:f(t.correlationId),activationRequestDigest:p(t.activationRequestDigest),serverGeneration:w(t.serverGeneration),protocolReceipt:n.protocolReceipt}}}function Ht(e){let t=i(e,`ECDSA activation journal`);switch(t.kind){case`activation_prepared`:return Lt(t);case`server_activation_committed`:return Bt(t);default:throw Error(`ECDSA activation journal kind is invalid`)}}function Ut(e){let t=i(e,`registered ECDSA public facts`);if(L(t,`registered ECDSA public facts`,[`kind`,`keyHandle`,`publicKeyB64u`,`participantIds`,`thresholdOwnerAddress`]),t.kind!==`verified_ecdsa_public_facts`)throw Error(`registered ECDSA public facts kind is invalid`);return Le({keyHandle:Ie(t.keyHandle),publicKeyB64u:t.publicKeyB64u,participantIds:s(t.participantIds,`registered ECDSA participant ids`),thresholdOwnerAddress:t.thresholdOwnerAddress})}function J(e){let t=i(e,`active ECDSA manifest proof`);L(t,`active ECDSA manifest proof`,[`activation_binding`,`server_activation`,`registered_public_facts`,`role_local_public_facts`,`router_ab_ecdsa_derivation_normal_signing`,`runtime_policy_scope`,`ciphertext_digest`,`committed_at`]);let n=Pt(t.activation_binding),r=Vt(t.server_activation),a=je({activationBinding:n,serverCommit:r.serverCommit});if(!yt(a,r.record))throw Error(`ECDSA server activation commit fields are inconsistent`);let o=Oe({activationBinding:n,serverActivation:a,routerAbEcdsaDerivationNormalSigning:re(t.router_ab_ecdsa_derivation_normal_signing),roleLocalPublicFacts:he(t.role_local_public_facts),ciphertextDigest:b(t.ciphertext_digest),runtimePolicyScope:u(t.runtime_policy_scope)}),s=d(t.committed_at);return{activationBinding:n,serverActivation:a,durableMaterial:o,activeManifest:Me({activationBinding:n,serverActivation:a,registeredPublicFacts:Ut(t.registered_public_facts),durableMaterial:o,committedAt:s}),committedAt:s}}function Wt(e){let t=i(e,`ECDSA capability manifest row`),n=[`record_version`,`manifest_id`,`manifest_revision`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`manifest_state`,`active_proof`];switch(t.manifest_state){case`active`:{L(t,`active ECDSA capability manifest row`,n);let e=J(t.active_proof),r=B(e.activeManifest);return Gt(t,e.activeManifest,r),{state:`active`,selector:r,manifest:e.activeManifest,activeProof:e}}case`replaced`:{L(t,`replaced ECDSA capability manifest row`,[...n,`replacement_proof`]);let e=J(t.active_proof),r=J(t.replacement_proof),i=we({activeManifest:e.activeManifest,replacementManifest:r.activeManifest}),a=B(e.activeManifest);return Gt(t,e.activeManifest,a),{state:`replaced`,selector:a,manifest:i,activeProof:e,replacementProof:r}}default:throw Error(`ECDSA capability manifest row state is invalid`)}}function Gt(e,t,n){if(e.record_version!==`ecdsa_capability_manifest_v3`||C(e.manifest_id)!==t.identity.manifestId||S(e.manifest_revision)!==t.identity.manifestRevision||String(e.capability_ref)!==String(n.capability)||String(e.wallet_id)!==String(n.authority.walletId)||String(e.authority_digest)!==String(n.authority.authorityDigest))throw Error(`ECDSA capability manifest row identity is inconsistent`)}function Kt(e){return{record_version:F,...H(B(e)),manifest_id:e.identity.manifestId,manifest_revision:e.identity.manifestRevision}}function qt(e){let n=i(e,`current ECDSA capability pointer`);if(L(n,`current ECDSA capability pointer`,[`record_version`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`manifest_id`,`manifest_revision`]),n.record_version!==F)throw Error(`current ECDSA capability pointer version is invalid`);let r=Qe(n);if(!r)throw Error(`current ECDSA capability pointer authority is invalid`);return{selector:{capability:D(t(n.capability_ref)),authority:r},manifestId:C(n.manifest_id),manifestRevision:S(n.manifest_revision)}}function Jt(e,t){return{record_version:Ue,durable_material_ref:e.binding.durableMaterialRef,binding_digest:e.binding.bindingDigest,...H(B(t)),sealing_key_id:e.sealingKeyId,iv:e.iv12B64u,ciphertext:e.ciphertextB64u}}function Yt(e){let n=i(e,`ECDSA role-local material row`);if(L(n,`ECDSA role-local material row`,[`record_version`,`durable_material_ref`,`binding_digest`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`sealing_key_id`,`iv`,`ciphertext`]),n.record_version!==Ue)throw Error(`ECDSA role-local material row version is invalid`);let r=Qe(n);if(!r)throw Error(`ECDSA role-local material authority is invalid`);return{durableMaterialRef:_e(n.durable_material_ref),bindingDigest:O(n.binding_digest),selector:{capability:D(t(n.capability_ref)),authority:r}}}function Xt(e,t){let n=i(e,`ECDSA role-local material row`),r=Yt(n),a=Pe({binding:t.durableMaterial,sealingKeyId:T(n.sealing_key_id),iv12B64u:v(n.iv),ciphertextB64u:x(n.ciphertext)});if(r.durableMaterialRef!==a.binding.durableMaterialRef||r.bindingDigest!==a.binding.bindingDigest||!et(r.selector,B(t.activeManifest)))throw Error(`ECDSA role-local material row binding is inconsistent`);return a}function Zt(e,t){return e.binding.durableMaterialRef===t.durableMaterial.durableMaterialRef&&e.binding.bindingDigest===t.durableMaterial.bindingDigest&&e.binding.lifecycleId===t.durableMaterial.lifecycleId&&e.binding.ciphertextDigest===t.durableMaterial.ciphertextDigest&&e.binding.activationDigest===t.durableMaterial.activationDigest&&e.binding.activatedAt===t.durableMaterial.activatedAt&&r(e.binding.materialActivation,t.durableMaterial.materialActivation)&&G(e.binding.roleLocalBinding,t.durableMaterial.roleLocalBinding)}function Qt(e){return{record_version:We,journal_id:e.journalId,...H(z(e)),journal:e}}function $t(e){let t=i(e,`ECDSA activation commit journal row`);if(L(t,`ECDSA activation commit journal row`,[`record_version`,`journal_id`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`journal`]),t.record_version!==We)throw Error(`ECDSA activation commit journal row version is invalid`);let n=Ht(t.journal),r=z(n);if(f(t.journal_id)!==n.journalId||String(t.capability_ref)!==String(r.capability)||String(t.wallet_id)!==String(r.authority.walletId)||String(t.authority_digest)!==String(r.authority.authorityDigest))throw Error(`ECDSA activation commit journal row identity is inconsistent`);return{journal:n,selector:r}}function en(e){return typeof CryptoKey>`u`||!(e instanceof CryptoKey)||e.type!==`secret`||e.extractable||e.algorithm.name!==`AES-GCM`?!1:e.usages.includes(`encrypt`)&&e.usages.includes(`decrypt`)}function tn(e,t){return{record_version:Ge,key_id:e,key:t}}function nn(e){let t=i(e,`ECDSA material sealing key row`);if(L(t,`ECDSA material sealing key row`,[`record_version`,`key_id`,`key`]),t.record_version!==Ge)throw Error(`ECDSA material sealing key row version is invalid`);if(!en(t.key))throw Error(`ECDSA material sealing key must be a non-extractable AES-GCM key`);return{keyId:T(t.key_id),key:t.key}}function Y(e){throw Error(`Unexpected ECDSA persistence branch: ${String(e)}`)}const rn=5*6e4;function an(e,t,n){let i=e.binding.routerAbEcdsaDerivationNormalSigning.scope,a=ae(e.binding.materialActivation);return i.wallet_id===t.walletId&&c(pe(i))===t.signingScopeB64u&&c(te(a))===t.materialActivationB64u&&i.signing_worker.key_epoch===t.keyEpoch&&i.activation_epoch===t.activationEpoch&&a.activation_id===t.materialActivationId&&a.capability===t.capability&&a.key_binding===t.keyBinding&&a.material_owner===t.walletId&&e.binding.durableMaterialRef===n.durableMaterialRef&&e.binding.bindingDigest===n.bindingDigest&&r(e.binding.materialActivation,n.materialActivation)}function on(e,t){return e.materialActivation.activationId===t.materialActivationId&&e.materialActivation.capability===t.capability&&e.materialActivation.keyBinding===t.keyBinding&&e.materialActivation.materialOwner===t.walletId}function sn(e){if(typeof e!=`string`||!/^ecdsa-client-presignature-[A-Za-z0-9_-]+$/.test(e))throw Error(`ECDSA durable presignature record id is invalid`);return e}function X(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} is invalid`);return e}function Z(e){if(!e||typeof e!=`object`||!(`record_id`in e))return null;let t=e.record_id;return typeof t==`string`?t:null}function cn(){return typeof IDBTransaction<`u`&&`durability`in IDBTransaction.prototype}async function ln(e,t=1/0){let n=0;for(;e&&n<t;)await e.delete(),n+=1,e=await e.continue();return n}async function un(e,t,n){return await ln(await e.store(I).index(h.walletExpiresAt).openCursor(IDBKeyRange.bound([t,0],[t,n])),32)}async function dn(e,t,n){await un(e,t.walletId,n);let r=e.store(I),i=await r.index(h.poolIdentityKey).getAll(P(t));t.ownershipGeneration===1&&i.push(...await r.index(h.poolIdentityKey).getAll(pn(t)));let a=[];for(let e of i)try{let t=Q(e);t.expires_at_ms<=n?await r.delete(t.record_id):(e.pool_identity_key!==t.pool_identity_key&&await r.put(t),a.push(t))}catch{let t=Z(e);t&&await r.delete(t)}return a}function fn(e){let{ownershipGeneration:t,...n}=e.poolIdentity;return{domain:`seams/ecdsa-client-presignature/v1`,version:1,pool_identity:t===1?n:e.poolIdentity,durable_material_ref:e.durableMaterialRef,presignature_id:e.presignatureId,group_public_key33_b64u:e.groupPublicKey33B64u,big_r33_b64u:e.bigR33B64u,created_at_ms:e.createdAtMs,expires_at_ms:e.expiresAtMs,sealing_key_id:e.sealingKeyId}}function pn(e){return[e.protocolId,e.relayerUrl,e.signingScopeB64u,e.materialActivationB64u].join(`|`)}function Q(e){let t=i(e,`ECDSA durable presignature row`);if(L(t,`ECDSA durable presignature row`,[`kind`,`record_id`,`pool_identity`,`pool_identity_key`,`wallet_id`,`material_activation_id`,`durable_material_ref`,`presignature_id`,`group_public_key33_b64u`,`big_r33_b64u`,`created_at_ms`,`expires_at_ms`,`sealed`]),t.kind!==`sealed_available_client_presignature_v1`)throw Error(`ECDSA durable presignature row kind is invalid`);let n=i(t.pool_identity,`ECDSA durable presignature pool identity`),r=!Object.hasOwn(n,`ownershipGeneration`);L(n,`ECDSA durable presignature pool identity`,[...r?[]:[`ownershipGeneration`],`activationEpoch`,`capability`,`keyBinding`,`keyEpoch`,`materialActivationB64u`,`materialActivationId`,`pairRole`,`protocolId`,`relayerUrl`,`signingScopeB64u`,`walletId`]);let a=N(r?{...n,ownershipGeneration:1}:n),o=sn(t.record_id),s=String(t.pool_identity_key??``);if(s!==P(a)&&!(r&&s===pn(a)))throw Error(`ECDSA durable presignature pool identity index is inconsistent`);let c=String(t.wallet_id??``).trim(),l=String(t.material_activation_id??``).trim();if(!c||c!==a.walletId)throw Error(`ECDSA durable presignature wallet binding is inconsistent`);if(!l||l!==a.materialActivationId)throw Error(`ECDSA durable presignature activation binding is inconsistent`);let u=ve(t.durable_material_ref);if(!on(u,a))throw Error(`ECDSA durable presignature material binding is inconsistent`);let d=String(t.presignature_id??``).trim();if(!d)throw Error(`ECDSA durable presignature id is invalid`);let f=E(t.group_public_key33_b64u),p=E(t.big_r33_b64u),m=X(t.created_at_ms,`created_at_ms`),h=X(t.expires_at_ms,`expires_at_ms`);if(m>Date.now()+3e5)throw Error(`ECDSA durable presignature creation timestamp is in the future`);if(h<=m)throw Error(`ECDSA durable presignature expiry must follow creation`);if(h-m>7776e6)throw Error(`ECDSA durable presignature lifetime exceeds the maximum`);let g=i(t.sealed,`ECDSA durable presignature sealed payload`);if(L(g,`ECDSA durable presignature sealed payload`,[`kind`,`sealing_key_id`,`iv12_b64u`,`ciphertext_b64u`,`ciphertext_digest_b64u`]),g.kind!==`ecdsa_activation_aes_gcm_v1`)throw Error(`ECDSA durable presignature sealing kind is invalid`);return{kind:`sealed_available_client_presignature_v1`,record_id:o,pool_identity:a,pool_identity_key:P(a),wallet_id:c,material_activation_id:l,durable_material_ref:u,presignature_id:d,group_public_key33_b64u:f,big_r33_b64u:p,created_at_ms:m,expires_at_ms:h,sealed:{kind:`ecdsa_activation_aes_gcm_v1`,sealing_key_id:T(g.sealing_key_id),iv12_b64u:v(g.iv12_b64u),ciphertext_b64u:x(g.ciphertext_b64u),ciphertext_digest_b64u:b(g.ciphertext_digest_b64u)}}}function mn(e){return{kind:`sealed_available_client_presignature_v1`,recordId:e.record_id,poolIdentity:e.pool_identity,durableMaterialRef:e.durable_material_ref,presignatureId:e.presignature_id,groupPublicKey33B64u:e.group_public_key33_b64u,bigR33B64u:e.big_r33_b64u,createdAtMs:e.created_at_ms,expiresAtMs:e.expires_at_ms,sealingKeyId:e.sealed.sealing_key_id}}async function hn(e){let t=crypto.getRandomValues(new Uint8Array(12)),n=q(fn(e.metadata));try{let r=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:t,additionalData:n},e.key,e.plaintext97));try{let e=c(r);return{iv12B64u:v(c(t)),ciphertextB64u:x(e),ciphertextDigestB64u:b(c(await a(r)))}}finally{r.fill(0)}}finally{t.fill(0),n.fill(0),e.plaintext97.fill(0)}}async function gn(e){let t=l(e.sealed.iv12_b64u),n=l(e.sealed.ciphertext_b64u),r=q(fn(e.metadata)),i=null;try{if(c(await a(n))!==e.sealed.ciphertext_digest_b64u)throw Error(`ECDSA durable presignature ciphertext digest mismatch`);if(i=new Uint8Array(await crypto.subtle.decrypt({name:`AES-GCM`,iv:t,additionalData:r},e.key,n)),i.length!==97)throw Error(`ECDSA durable presignature plaintext length is invalid`);return i.slice()}finally{t.fill(0),n.fill(0),r.fill(0),i?.fill(0)}}async function _n(e,t,n){let r=e.store(I),i=await r.index(h.walletMaterialActivationId).getAll([t,n]);for(let e of i){let t=Z(e);t&&await r.delete(t)}}async function $(e,t){let n=await e.store(m.appState).get(`wallet_ownership_generation:${t}`);if(n===void 0)return 1;let r=i(n,`Wallet ownership generation`).value;if(typeof r!=`number`||!Number.isSafeInteger(r)||r<1)throw Error(`Stored wallet ownership generation is invalid`);return r}async function vn(e,t,n){if(await $(e,t)!==n)throw Error(`Wallet ownership generation requires fresh authentication`)}async function yn(e,t,n){let r=await $(e,t);if(n<r)throw Error(`Wallet session belongs to an obsolete ownership generation`);if(n===r)return;await e.store(m.appState).put({key:`wallet_ownership_generation:${t}`,value:n});let i=await e.store(m.ecdsaClientPresignatures).index(h.walletId).openCursor(t);for(;i;){let e=!0;try{e=Q(i.value).pool_identity.ownershipGeneration<n}catch{}e&&await i.delete(),i=await i.continue()}}async function bn(e,t){await g.runTransaction([m.appState],`readonly`,xn.bind(null,e,t))}function xn(e,t,n){return vn(n,e,t)}async function Sn(e,t){await g.runTransaction([m.appState,m.ecdsaClientPresignatures],`readwrite`,Cn.bind(null,e,t))}async function Cn(e,t,n){t<=await $(n,e)||await yn(n,e,t)}export{B as $,vt as A,Ze as B,I as C,Tt as D,bt as E,rt as F,Yt as G,Bt as H,K as I,nn as J,Xt as K,wt as L,gt as M,it as N,Et as O,G as P,z as Q,Ct as R,qe as S,Y as T,$t as U,J as V,Wt as W,tt as X,zt as Y,H as Z,cn as _,rn as a,Kt as at,Ke as b,hn as c,P as ct,sn as d,N as dt,R as et,X as f,_n as g,dn as h,Sn as i,Jt as it,nt as j,ht as k,on as l,Be as lt,Z as m,bn as n,et as nt,an as o,tn as ot,Q as p,qt as q,vn as r,Qt as rt,gn as s,$e as st,yn as t,V as tt,mn as u,Ve as ut,Ye as v,Xe as w,Je as x,He as y,Zt as z};