@seams/wallet 0.28.0 → 0.29.0

package/dist/{public/sdk/secp256k1-CE7-q9Sn.js → esm/sdk/secp256k1-DPeaOjM0.js}

@@ -1 +1 @@
-import"./walletDbName-Ca0rCq5r.js";import"./activeWalletSession-BJ4B-nJo.js";import"./signingSessionSeal-BFOBKj-J.js";import"./capabilityKinds-DVlGMspk.js";import"./signerDomain-BAsLT3XN.js";import{t as e}from"./presignatures-BCeq56DG.js";import{Pt as t}from"./digestEncoding-CqNXPZY9.js";import{z as n}from"./ecdsaCapabilityManifest-DAJEVjlP.js";import"./emailOtpEcdsaDerivationIdentity-HFQXc1Yw.js";import{i as r,u as i}from"./trace--mRP2OQc.js";import{c as a,i as o,r as s}from"./presignaturePool-BbvqRWYw.js";function c(e){return e.kind===`digest`&&e.algorithm===`secp256k1`}function l(e){let t=String(e.intent.operationId||``).trim();if(!t)throw Error(`[multichain] exact EVM signing operation id is required`);return t}function u(e){switch(e.kind){case`reusable_wallet_session`:return{kind:`wallet_session_opaque`,walletSessionToken:e.walletSessionToken,home:e.home,ownershipGeneration:e.ownershipGeneration};case`operation_step_up`:return{kind:`wallet_session_opaque`,walletSessionToken:e.walletSessionToken,home:e.home,ownershipGeneration:e.ownershipGeneration}}throw Error(`[multichain] unsupported ECDSA signing credential`)}function d(r){let a=r.loadedMaterial.signerSession,o=a.publicFacts,c=a.transport.signingMaterial,l=s({relayerUrl:a.transport.relayerUrl,keyHandle:n(o.keyHandle),ecdsaThresholdKeyId:c.ecdsaThresholdKeyId,clientVerifyingShareB64u:c.clientVerifier33B64u,clientSigningMaterial:r.loadedMaterial.clientSigningMaterial,thresholdEcdsaPublicKeyB64u:o.publicKeyB64u,relayerVerifyingShareB64u:a.transport.relayerVerifyingShareB64u,credential:r.credential,materialActivation:t(a.materialActivation),routerAbEcdsaDerivationPoolFill:{kind:`router_ab_ecdsa_derivation_signing_worker_pool`,scope:a.routerAbEcdsaDerivationNormalSigning.state.scope,ceremonyExpiresAtMs:r.expiresAtMs,materialExpiresAtMs:Date.now()+e},workerCtx:r.workerCtx,authorization:r.authorization});i(`evm-family`,{event:`ecdsa_signing_refill`,operationId:r.operationId,scheduled:l.scheduled,reason:l.reason,depth:l.depth,targetDepth:l.targetDepth})}var f=class{algorithm=`secp256k1`;beforeSigning;shouldAbort;workerCtx;reconcileSession;constructor(e){this.beforeSigning=e.beforeSigning,this.shouldAbort=e.shouldAbort,this.workerCtx=e.workerCtx,this.reconcileSession=e.reconcileSession}async signReadySecp256k1Digest(e,s,c,f){let p=l(c),m=performance.now(),h=await a({signerSession:s.signerSession,workerCtx:this.workerCtx});r(p,`material_load`,m);let g=h.signerSession,_=g.publicFacts,v=g.transport,y=u(s.credential),b=!1;try{let r={relayerUrl:v.relayerUrl,scope:g.routerAbEcdsaDerivationNormalSigning.state.scope,operationId:p,operationDigests:{lane_digest_b64u:f.laneDigest,intent_digest_b64u:f.intentDigest,display_digest_b64u:f.displayDigest},materialActivation:t(g.materialActivation),credential:y,keyHandle:n(_.keyHandle),signingDigest32:e.digest32,clientSigningMaterial:h.clientSigningMaterial,expiresAtMs:s.expiresAtMs,workerCtx:this.workerCtx};this.beforeSigning?.(),s.authorization.kind===`reusable_wallet_session`?d({operationId:p,loadedMaterial:h,workerCtx:this.workerCtx,credential:y,expiresAtMs:s.expiresAtMs,authorization:s.authorization}):i(`evm-family`,{event:`ecdsa_signing_refill`,operationId:p,scheduled:!1,reason:`operation_step_up`});let a;if(s.authorization.kind===`reusable_wallet_session`)a=await o({...r,authorization:s.authorization,reconcileSession:this.reconcileSession});else{let e=s.operationStepUpPreparation;if(!e)throw Error(`[multichain] operation step-up preparation is required for signing`);a=await o({...r,authorization:s.authorization,operation:e})}if(!a.ok)throw Error(a.message||a.code||`[multichain] Router A/B ECDSA derivation signing failed`);return b=!0,a.signature65}finally{await h.cleanupAfterSign({singleUseEmailOtpSession:s.singleUseEmailOtpSession}),r(p,`sign_total`,m,b?`succeeded`:`failed`)}}async signReady(e,t,n,r){if(!c(e))throw Error(`[Secp256k1Engine] unsupported sign request`);if(e.digest32.length!==32)throw Error(`[Secp256k1Engine] digest32 must be 32 bytes`);if(this.shouldAbort?.()){let e=Error(`Request cancelled`);throw e.code=`cancelled`,e}return await this.signReadySecp256k1Digest(e,t,n,r)}};export{f as Secp256k1Engine};
+import"./walletDbName-Ca0rCq5r.js";import"./activeWalletSession-BJ4B-nJo.js";import"./signingSessionSeal-BFOBKj-J.js";import"./capabilityKinds-DVlGMspk.js";import"./signerDomain-D-EUTlLK.js";import{t as e}from"./presignatures-CkhuZ0YQ.js";import{Pt as t}from"./digestEncoding-34kXJoJr.js";import{z as n}from"./ecdsaCapabilityManifest--1Ztngfx.js";import"./emailOtpEcdsaDerivationIdentity-Qd4pBwHv.js";import{i as r,u as i}from"./trace-BnhLKxcu.js";import{c as a,i as o,r as s}from"./presignaturePool-Dq4RhzXn.js";function c(e){return e.kind===`digest`&&e.algorithm===`secp256k1`}function l(e){let t=String(e.intent.operationId||``).trim();if(!t)throw Error(`[multichain] exact EVM signing operation id is required`);return t}function u(e){switch(e.kind){case`reusable_wallet_session`:return{kind:`wallet_session_opaque`,walletSessionToken:e.walletSessionToken,home:e.home,ownershipGeneration:e.ownershipGeneration};case`operation_step_up`:return{kind:`wallet_session_opaque`,walletSessionToken:e.walletSessionToken,home:e.home,ownershipGeneration:e.ownershipGeneration}}throw Error(`[multichain] unsupported ECDSA signing credential`)}function d(r){let a=r.loadedMaterial.signerSession,o=a.publicFacts,c=a.transport.signingMaterial,l=s({relayerUrl:a.transport.relayerUrl,keyHandle:n(o.keyHandle),ecdsaThresholdKeyId:c.ecdsaThresholdKeyId,clientVerifyingShareB64u:c.clientVerifier33B64u,clientSigningMaterial:r.loadedMaterial.clientSigningMaterial,thresholdEcdsaPublicKeyB64u:o.publicKeyB64u,relayerVerifyingShareB64u:a.transport.relayerVerifyingShareB64u,credential:r.credential,materialActivation:t(a.materialActivation),routerAbEcdsaDerivationPoolFill:{kind:`router_ab_ecdsa_derivation_signing_worker_pool`,scope:a.routerAbEcdsaDerivationNormalSigning.state.scope,ceremonyExpiresAtMs:r.expiresAtMs,materialExpiresAtMs:Date.now()+e},workerCtx:r.workerCtx,authorization:r.authorization});i(`evm-family`,{event:`ecdsa_signing_refill`,operationId:r.operationId,scheduled:l.scheduled,reason:l.reason,depth:l.depth,targetDepth:l.targetDepth})}var f=class{algorithm=`secp256k1`;beforeSigning;shouldAbort;workerCtx;reconcileSession;constructor(e){this.beforeSigning=e.beforeSigning,this.shouldAbort=e.shouldAbort,this.workerCtx=e.workerCtx,this.reconcileSession=e.reconcileSession}async signReadySecp256k1Digest(e,s,c,f){let p=l(c),m=performance.now(),h=await a({signerSession:s.signerSession,workerCtx:this.workerCtx});r(p,`material_load`,m);let g=h.signerSession,_=g.publicFacts,v=g.transport,y=u(s.credential),b=!1;try{let r={relayerUrl:v.relayerUrl,scope:g.routerAbEcdsaDerivationNormalSigning.state.scope,operationId:p,operationDigests:{lane_digest_b64u:f.laneDigest,intent_digest_b64u:f.intentDigest,display_digest_b64u:f.displayDigest},materialActivation:t(g.materialActivation),credential:y,keyHandle:n(_.keyHandle),signingDigest32:e.digest32,clientSigningMaterial:h.clientSigningMaterial,expiresAtMs:s.expiresAtMs,workerCtx:this.workerCtx};this.beforeSigning?.(),s.authorization.kind===`reusable_wallet_session`?d({operationId:p,loadedMaterial:h,workerCtx:this.workerCtx,credential:y,expiresAtMs:s.expiresAtMs,authorization:s.authorization}):i(`evm-family`,{event:`ecdsa_signing_refill`,operationId:p,scheduled:!1,reason:`operation_step_up`});let a;if(s.authorization.kind===`reusable_wallet_session`)a=await o({...r,authorization:s.authorization,reconcileSession:this.reconcileSession});else{let e=s.operationStepUpPreparation;if(!e)throw Error(`[multichain] operation step-up preparation is required for signing`);a=await o({...r,authorization:s.authorization,operation:e})}if(!a.ok)throw Error(a.message||a.code||`[multichain] Router A/B ECDSA derivation signing failed`);return b=!0,a.signature65}finally{await h.cleanupAfterSign({singleUseEmailOtpSession:s.singleUseEmailOtpSession}),r(p,`sign_total`,m,b?`succeeded`:`failed`)}}async signReady(e,t,n,r){if(!c(e))throw Error(`[Secp256k1Engine] unsupported sign request`);if(e.digest32.length!==32)throw Error(`[Secp256k1Engine] digest32 must be 32 bytes`);if(this.shouldAbort?.()){let e=Error(`Request cancelled`);throw e.code=`cancelled`,e}return await this.signReadySecp256k1Digest(e,t,n,r)}};export{f as Secp256k1Engine};

package/dist/esm/sdk/signEvmFamily-Cksw3RpU.js

@@ -0,0 +1 @@
+import{n as e}from"./chunk-dVx5-UGu.js";import{i as t}from"./domainIds-t1lp25yU.js";import{n}from"./secureRandomId-8LSc91aN.js";import{X as r,a as i,t as a}from"./activeWalletSession-BJ4B-nJo.js";import{t as o}from"./chains-B72I4PDH.js";import{r as s}from"./transactionReviewAdmission-Cf_qUZJt.js";import{n as c}from"./signerDomain-D-EUTlLK.js";import{c as l,i as u,n as d,r as f,s as p}from"./types-A-w1cYlJ.js";import{c as m,o as h,s as g}from"./ecdsaChainTarget-BoRVQtjQ.js";import{s as _}from"./normalization-DmfGvZ_3.js";import{u as v}from"./walletAuthority-DbGaSw7D.js";import{F as y,I as b,Nt as x,Pt as S,U as C,it as w,lt as T,nt as E,rt as D,ut as ee}from"./digestEncoding-34kXJoJr.js";import{I as O,O as k,P as te,R as ne,y as re}from"./ecdsaCapabilityManifest--1Ztngfx.js";import{a as ie,m as ae,o as A}from"./sdkSentEvents-BFwv3mBw.js";import{g as oe,u as j}from"./emailOtpEcdsaDerivationIdentity-Qd4pBwHv.js";import{c as se,l as ce,s as M}from"./nonceLaneKeys-DtBpxubF.js";import{t as le}from"./walletSessionAuthorizationStatus-GhcGvDCX.js";import{D as N,E as ue,F as P,S as F,b as de,g as fe,v as pe,x as me}from"./nearEd25519YaoSigningPreparation-CnbgQfZc.js";import{r as he,t as ge}from"./lanes-vBKm6yBJ.js";import{r as _e}from"./operationFingerprint-Bas59T7L.js";import{c as ve,l as ye,o as be,s as xe,t as Se,u as I}from"./trace-BnhLKxcu.js";import{t as Ce}from"./challengeDelivery-Dj9HrjW9.js";import{a as we,i as Te,n as Ee,t as De}from"./authorizationAdmission-28jo_IVJ.js";import{i as Oe}from"./walletSessionFailure-CxsVtroW.js";import{a as ke,n as Ae,o as je,r as Me,s as Ne}from"./signingQueue-DoUBeaCv.js";import{h as Pe,i as Fe,l as Ie,n as Le,s as Re}from"./clientSessionPersistenceState-BxpITYM_.js";import{l as ze,n as Be,p as Ve,u as He}from"./signingFlow-Bd1X0e-1.js";import{t as Ue}from"./display-CUWg48tD.js";import{i as We,r as Ge,t as L}from"./types-C4OErbBf.js";import{E as Ke,u as qe}from"./requireStepUpAuth-iVo6h_U-.js";import{o as Je,r as Ye}from"./transactionState-G_FPe-U8.js";function Xe(e){let t=y(e.routerAbState);return{kind:`router_ab_ecdsa_derivation_signing_material_ref_v1`,activeStateId:b(t),ecdsaThresholdKeyId:O(t.scope.ecdsa_threshold_key_id),clientVerifier33B64u:ne(t.scope.public_identity.derivation_client_share_public_key33_b64u),serverVerifier33B64u:t.scope.public_identity.server_public_key33_b64u,thresholdVerifier33B64u:t.scope.public_identity.threshold_public_key33_b64u}}function Ze(e){return e.session.capabilitySubjects.filter(n=>n.kind===`sign`&&n.keyFamily===`ecdsa_secp256k1`&&t(n.materialActivation,e.materialActivation)).length===1}function Qe(e){return e.capability.manifest.signer.scope.targetMemberships.some(t=>g(t,e.chainTarget))}function $e(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function et(e){let{selectedAuthority:t,selectedAuthMethod:n}=e;return n.walletId===e.walletId&&n.status===`active`&&n.walletAuthorityId===t.authorityId&&t.walletId===e.walletId&&t.state===`active`}function tt(e){let t=e.capability.authority,n=e.runtime.authBinding;switch(n.kind){case`voiceid`:return T(t,n.voiceIdAuthority);case`email_otp`:return E(t)&&T(t,n.emailOtpAuthority);case`passkey`:return D(t)&&t.verifier.rpId===n.rpId&&t.factor.credentialIdB64u===n.credentialIdB64u;default:return n}}function nt(e){switch(e.runtime.authBinding.kind){case`voiceid`:return e.selectedAuthMethod.kind===`voiceid`&&e.selectedAuthMethod.walletAuthMethodId===e.runtime.authBinding.voiceIdAuthority.bindingId&&e.selectedAuthMethod.deviceKeyId===e.runtime.authBinding.voiceIdAuthority.factor.deviceKeyId;case`email_otp`:return e.selectedAuthMethod.kind===`email_otp`&&e.selectedAuthMethod.emailHashHex===e.runtime.authBinding.emailHashHex;case`passkey`:return e.selectedAuthMethod.kind===`passkey`&&String(e.selectedAuthMethod.rpId)===String(e.runtime.authBinding.rpId)&&e.selectedAuthMethod.credentialIdB64u===e.runtime.authBinding.credentialIdB64u;default:return e.runtime.authBinding}}function R(e){if(!Number.isSafeInteger(e.nowMs)||e.nowMs<0)return!1;let{capability:n,authorization:r}=e,i=r.session,a=r.operationCredential,o=r.runtime,s=n.manifest.signer,c=r.selectedAuthority.signerActivations.ecdsa;if(!c||!et({selectedAuthority:r.selectedAuthority,selectedAuthMethod:r.selectedAuthMethod,walletId:i.walletId})||i.walletId!==s.walletId||i.authorityId!==r.selectedAuthority.authorityId||i.authMethodId!==r.selectedAuthMethod.walletAuthMethodId||i.authorityDigestB64u!==r.selectedAuthority.authorityDigestB64u||i.authorityRevocationEpoch!==r.selectedAuthority.revocationEpoch||s.authority.walletId!==r.selectedAuthority.walletId||s.authority.walletAuthMethodId!==r.selectedAuthMethod.walletAuthMethodId||i.authorizationId.trim().length===0||i.quotaId.trim().length===0||a.walletSessionId.trim().length===0||a.token.trim().length===0||o.walletId!==i.walletId||!nt({selectedAuthMethod:r.selectedAuthMethod,runtime:o})||!t(o.materialActivation,n.manifest.activation.materialActivation)||!t(o.roleLocalMaterialRef.materialActivation,o.materialActivation)||!Qe({capability:n,chainTarget:o.chainTarget})||!tt({capability:n,runtime:o})||!Ze({session:i,materialActivation:n.manifest.activation.materialActivation})||!t(c.materialActivation,n.manifest.activation.materialActivation)||c.signer.walletId!==i.walletId||o.expiresAtMs<=0||!Number.isSafeInteger(o.remainingUses)||o.remainingUses<0)return!1;switch(o.kind){case`exact_ecdsa_direct_capability_runtime_v1`:break;case`exact_ecdsa_sealed_runtime_v1`:if(o.sealedRecord.authMethod!==r.selectedAuthMethod.kind||o.sealedRecord.storeKey.trim().length===0||o.sealedRecord.thresholdSessionId.trim().length===0)return!1;break;default:return o}return!(i.expiresAtMs<=e.nowMs||o.expiresAtMs<=e.nowMs||o.keyHandle!==String(n.material.publicFacts.keyHandle)||o.ecdsaThresholdKeyId!==String(n.material.publicFacts.ecdsaThresholdKeyId)||o.thresholdEcdsaPublicKeyB64u!==String(n.material.publicFacts.groupPublicKey33B64u)||!$e(o.participantIds,n.material.publicFacts.participantIds))}function rt(e){return e.kind===`exact_ecdsa_direct_capability_runtime_v1`&&e.authBinding.kind===`voiceid`}function it(e){return e.authBinding.kind===`passkey`}function at(e){return e.authBinding.kind===`email_otp`}function ot(e){if(it(e.runtime)&&e.selected.authMethod.kind===`passkey`||at(e.runtime)&&e.selected.authMethod.kind===`email_otp`||rt(e.runtime)&&e.selected.authMethod.kind===`voiceid`)return{kind:`ecdsa_preprocessing_session`,selectedAuthority:e.selected.authority,selectedAuthMethod:e.selected.authMethod,session:e.session,operationCredential:e.operationCredential,runtime:e.runtime};throw Error(`ECDSA preprocessing session auth method is inconsistent`)}function st(e){if(D(e))return{kind:`passkey`,rpId:String(e.verifier.rpId),credentialIdB64u:String(e.factor.credentialIdB64u)};if(E(e))return{kind:`email_otp`,providerSubjectId:String(e.factor.providerUserId),emailHashHex:String(e.verifier.emailHashHex),emailOtpAuthority:e};if(w(e))return{kind:`voiceid`,voiceIdAuthority:e};throw Error(`ECDSA authority is unsupported.`)}function ct(e){if(!Number.isSafeInteger(e.status.expiresAtMs)||e.status.expiresAtMs<=0||!Number.isSafeInteger(e.status.remainingUses)||e.status.remainingUses<0)throw Error(`Exact ECDSA direct capability requires valid session facts`);return{kind:`exact_ecdsa_direct_capability_runtime_v1`,walletId:e.runtime.walletId,chainTarget:e.runtime.chainTarget,materialActivation:e.runtime.materialActivation,normalSigning:e.runtime.normalSigning,relayerUrl:e.runtime.relayerUrl,relayerKeyId:e.runtime.relayerKeyId,clientVerifyingPublicKey33B64u:e.runtime.clientVerifyingPublicKey33B64u,participantIds:e.runtime.participantIds,ecdsaThresholdKeyId:e.runtime.ecdsaThresholdKeyId,thresholdEcdsaPublicKeyB64u:e.runtime.thresholdEcdsaPublicKeyB64u,keyHandle:e.runtime.keyHandle,runtimePolicyScope:e.runtime.runtimePolicyScope,roleLocalMaterialRef:e.runtime.roleLocalMaterialRef,authBinding:st(e.authority),expiresAtMs:e.status.expiresAtMs,remainingUses:e.status.remainingUses}}function lt(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`voiceid`:return t.kind===`voiceid`&&T(e.voiceIdAuthority,t.voiceIdAuthority);case`email_otp`:return t.kind===`email_otp`&&e.providerSubjectId===t.providerSubjectId&&e.emailHashHex===t.emailHashHex&&T(e.emailOtpAuthority,t.emailOtpAuthority);case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId&&e.credentialIdB64u===t.credentialIdB64u;default:return e}}function ut(e,n){if(e.kind!==n.kind||e.walletId!==n.walletId||!g(e.chainTarget,n.chainTarget)||!t(e.materialActivation,n.materialActivation)||e.keyHandle!==n.keyHandle||e.ecdsaThresholdKeyId!==n.ecdsaThresholdKeyId||!lt(e.authBinding,n.authBinding))return!1;switch(e.kind){case`exact_ecdsa_direct_capability_runtime_v1`:return n.kind===`exact_ecdsa_direct_capability_runtime_v1`;case`exact_ecdsa_sealed_runtime_v1`:return n.kind===`exact_ecdsa_sealed_runtime_v1`&&e.sealedRecord.authMethod===n.sealedRecord.authMethod&&e.sealedRecord.storeKey===n.sealedRecord.storeKey&&e.sealedRecord.thresholdSessionId===n.sealedRecord.thresholdSessionId;default:return e}}function dt(e){let t=e.session.walletId;if(!Number.isSafeInteger(e.nowMs)||e.nowMs<0)throw Error(`Exact EVM-family Wallet Session authorization requires a valid timestamp`);if(!et({selectedAuthority:e.selected.authority,selectedAuthMethod:e.selected.authMethod,walletId:t})||e.selected.selection.walletId!==t||e.selected.selection.walletAuthMethodId!==e.selected.authMethod.walletAuthMethodId||e.selected.selection.lockState!==`unlocked`)throw Error(`Exact EVM-family Wallet Session authorization selected authority is invalid`);let n=ot(e);if(!R({capability:e.capability,authorization:n,nowMs:e.nowMs}))throw Error(`Exact EVM-family Wallet Session authorization identity is inconsistent`);return n}function ft(e){let t=mt(pt(e),e.nowMs);if(!t)throw Error(`Exact ECDSA signing authorization requires remaining signing uses`);return t}function pt(e){return{kind:`authorized_ecdsa_preprocessing_capability`,capability:e.capability,authorization:dt(e)}}function mt(e,t){let n=e.authorization,r=n.runtime;return r.remainingUses<=0||!R({capability:e.capability,authorization:n,nowMs:t})?null:it(r)&&n.selectedAuthMethod.kind===`passkey`||at(r)&&n.selectedAuthMethod.kind===`email_otp`||rt(r)&&n.selectedAuthMethod.kind===`voiceid`?{kind:`exact_evm_family_wallet_session_authorization_v1`,selectedAuthority:n.selectedAuthority,selectedAuthMethod:n.selectedAuthMethod,session:n.session,operationCredential:n.operationCredential,runtime:r}:null}function ht(e){if(e.authorization.runtime.remainingUses<=0||!R({capability:e.capability,authorization:e.authorization,nowMs:e.nowMs}))throw Error(`Exact Wallet Session authorization does not bind the ECDSA signing capability`);return{kind:`authorized_evm_family_ecdsa_signing_capability`,capability:e.capability,authorization:e.authorization}}async function gt(e){let n=e.manifest.signer,r=n.registeredPublicFacts,i=e.material.publicFacts,a=await ee({authority:e.authority});if(a.authorityDigest!==n.authority.authorityDigest||a.walletId!==n.walletId||e.material.authority.walletId!==n.walletId||e.material.authority.authorityDigest!==n.authority.authorityDigest||!t(e.material.materialActivation,e.manifest.activation.materialActivation)||i.walletId!==n.walletId||i.keyHandle!==r.keyHandle||String(i.groupPublicKey33B64u)!==String(r.publicKeyB64u)||i.ethereumAddress!==r.thresholdOwnerAddress||i.participantIds.length!==r.participantIds.length||i.participantIds.some((e,t)=>e!==r.participantIds[t]))throw Error(`Canonical EVM-family ECDSA signing capability identity is inconsistent`);return{kind:`canonical_evm_family_ecdsa_signing_capability`,authority:e.authority,manifest:e.manifest,material:e.material}}function z(e){let t=e&&typeof e==`object`&&`code`in e?String(e.code||``).trim():``;if(t===`sealed_refresh_parity_fetch_failed`||t===`sealed_refresh_parity_http_error`||t===`sealed_refresh_parity_aborted`)return!0;let n=String(e instanceof Error?e.message:e||``);return n.includes(`Failed to fetch relayer well-known capabilities`)||/Well-known endpoint returned HTTP 5\d\d/.test(n)}function B(e){return e instanceof Error?e.message:String(e||`unknown error`)}async function _t(e,t){try{await e()}catch(e){if(t.kind===`key_enrollment_bootstrap_parity`){console.warn(`[threshold-ecdsa] key enrollment bootstrap skipped sealed-refresh startup parity enforcement`,{walletId:String(t.walletId||``).trim(),chainTarget:h(t.chainTarget),error:B(e)});return}if(t.kind===`transaction_bootstrap_parity`&&z(e)){console.warn(`[threshold-ecdsa] transaction bootstrap skipped retryable sealed-refresh capability fetch failure`,{walletId:String(t.walletId||``).trim(),chainTarget:h(t.chainTarget),error:B(e)});return}if(t.kind===`email_otp_bootstrap_parity`&&t.authMethod===c.emailOtp&&z(e)){console.warn(`[threshold-ecdsa] Email OTP bootstrap skipped retryable sealed-refresh capability fetch failure`,{walletId:String(t.walletId||``).trim(),chainTarget:h(t.chainTarget),error:B(e)});return}if(t.kind===`default_bootstrap_parity`&&z(e)){console.warn(`[threshold-ecdsa] default bootstrap skipped retryable sealed-refresh capability fetch failure`,{walletId:String(t.walletId||``).trim(),chainTarget:h(t.chainTarget),error:B(e)});return}throw e}}async function vt(e,t){try{await e()}catch(e){if(!z(e))throw e;console.warn(`[threshold-ecdsa] transaction signing skipped retryable sealed-refresh capability fetch failure`,{walletId:String(t.walletId||``).trim(),chainTarget:h(t.chainTarget),error:B(e)})}}function yt(e){if(e.kind===`tempoTransaction`)return`tempo`;if(e.kind===`eip1559`)return`evm_compatible`;let t=String(e.chain||``).trim();if(t===`tempo`||t===`evm`)return t;throw Error(`[SigningEngine][ecdsa] transaction request requires a concrete chain family`)}function bt(e){let t=Number(e.request.tx.chainId);if(!Number.isSafeInteger(t)||t<=0)throw Error(`[SigningEngine][ecdsa] transaction request requires a concrete chainId`);if(t!==e.chainTarget.chainId)throw Error(`[SigningEngine][ecdsa] transaction request chainId does not match chainTarget`);let n=yt(e.request);if(n!==`evm_compatible`&&n!==e.chainTarget.kind)throw Error(`[SigningEngine][ecdsa] transaction request chain does not match chainTarget`);return e.chainTarget}function xt(){let e=Error(`Request cancelled`);return e.code=`cancelled`,e}function St(e){if(typeof e==`function`&&e())throw xt()}function Ct(e){return String(e||``).trim().toLowerCase().replace(/[\s-]+/g,`_`)}function V(e){return!e||typeof e!=`object`||!(`code`in e)?``:Ct(e.code)}function wt(e){return e?typeof e==`string`?e.trim():e instanceof Error||typeof e==`object`&&`message`in e?String(e.message||``).trim():String(e).trim():``}function Tt(e){let t=`${e.code} ${e.message}`.toLowerCase();return t.trim()?t.includes(`nonce_too_low`)||t.includes(`nonce too low`)?`nonce_too_low`:t.includes(`nonce_too_high`)||t.includes(`nonce too high`)?`nonce_too_high`:t.includes(`already_known`)||t.includes(`already known`)?`already_known`:t.includes(`replacement_transaction_underpriced`)||t.includes(`replacement transaction underpriced`)?`replacement_underpriced`:t.includes(`nonce_conflict`)||t.includes(`nonce`)&&t.includes(`conflict`)||t.includes(`invalid nonce`)||t.includes(`nonce has already been used`)?`nonce_conflict`:null:null}function Et(e){let t=e.chain===`tempo`?`Tempo`:`EVM`,n=Error(`[SigningEngine] ${t} nonce conflict (${e.reason}) on ${e.networkKey}. Refresh nonce context and retry.`);if(n.code=`nonce_conflict_retryable`,n.retryable=!0,n.details={chain:e.chain,reason:e.reason,networkKey:e.networkKey,chainId:e.chainId},e.cause!==void 0)try{n.cause=e.cause}catch{}return n}function Dt(e){let t=e.chain===`tempo`?`Tempo`:`EVM`,n=Error(`[SigningEngine] ${t} nonce lane blocked on ${e.networkKey} (nonce=${e.blockedNonce}). Reconcile lane and retry.`);if(n.code=`nonce_lane_blocked`,n.retryable=!0,n.details={chain:e.chain,networkKey:e.networkKey,chainId:e.chainId,blockedNonce:e.blockedNonce,...typeof e.ageMs==`number`?{ageMs:e.ageMs}:{}},e.cause!==void 0)try{n.cause=e.cause}catch{}return n}function Ot(e){if(!e.error||typeof e.error!=`object`)return e.error;let t=V(e.error);if(t===`nonce_conflict_retryable`)return e.error;let n=Tt({code:t,message:wt(e.error)});return n?Et({chain:e.chain,networkKey:e.networkKey,chainId:e.chainId,reason:n,cause:e.error}):e.error}function kt(e){if(!e.error||typeof e.error!=`object`)return e.error;if(V(e.error)===`nonce_lane_blocked`){let t=typeof e.error.details==`object`&&e.error.details||{},n=String(t?.blockedNonce||``).trim(),r=Number(t?.ageMs);return Dt({chain:e.chain,networkKey:e.networkKey,chainId:e.chainId,blockedNonce:n||`unknown`,...Number.isFinite(r)?{ageMs:r}:{},cause:e.error})}let t=wt(e.error).toLowerCase();return t.includes(`nonce lane blocked`)||t.includes(`nonce`)&&t.includes(`blocked`)?Dt({chain:e.chain,networkKey:e.networkKey,chainId:e.chainId,blockedNonce:`unknown`,cause:e.error}):e.error}function H(e){let t=Ot(e);return kt({...e,error:t})}function At(e){return!e||typeof e!=`object`?!1:V(e)===`nonce_conflict_retryable`}function jt(e){return!e||typeof e!=`object`?!1:V(e)===`nonce_lane_blocked`}function U(e){if(!e)return{present:!1};let t=P(e.identity,`ECDSA lane summary`);return{present:!0,walletId:t.walletId,authMethod:l(e.auth),curve:e.curve,chain:e.chain,chainFamily:`chainFamily`in e?e.chainFamily:e.chain,keyKind:`keyKind`in e?e.keyKind:`threshold_ecdsa_secp256k1`,sessionOrigin:`sessionOrigin`in e?e.sessionOrigin:void 0,storageSource:`storageSource`in e?e.storageSource:void 0,retention:`retention`in e?e.retention:void 0,walletSessionId:e.authorization.operationCredential.walletSessionId,materialActivationId:e.materialActivation.activationId,chainTarget:t.chainTarget,evmFamilyKeyPresent:!!t.key}}function W(e,t){try{console.warn(`[SigningEngine][ecdsa] ${e}`,JSON.stringify(t,null,2))}catch{}}function Mt(e){let t=e.lane;if(!t)throw W(`missing selected signing lane`,{context:e.context,chain:e.chain,...e.diagnostics}),Error(`[SigningEngine][ecdsa] missing selected signing lane for ${e.context}`);if(t.curve!==`ecdsa`||t.keyKind!==`threshold_ecdsa_secp256k1`)throw W(`selected signing lane is not ECDSA`,{context:e.context,expectedChain:e.chain,lane:U(t),...e.diagnostics}),Error(`[SigningEngine][ecdsa] ${e.context} requires an ECDSA signing lane`);let n=t.identity,r=P(n,`${e.context} resolved ECDSA lane`),i=r.chainTarget;if(i.kind!==e.chain)throw W(`selected signing lane chain mismatch`,{context:e.context,expectedChain:e.chain,lane:U(t),...e.diagnostics}),Error(`[SigningEngine][ecdsa] ${e.context} chain does not match selected lane`);let a=r.key;if(!a?.ecdsaThresholdKeyId||!a.signingRootId||!a.signingRootVersion)throw W(`selected signing lane missing full ECDSA identity`,{context:e.context,expectedChain:e.chain,lane:U(t),...e.diagnostics}),Error(`[SigningEngine][ecdsa] incomplete ECDSA lane identity for ${e.context}`);if(!a||String(a.walletId)!==String(r.walletId)||String(r.keyHandle||``).trim()===``)throw W(`selected signing lane missing matching shared key identity`,{context:e.context,expectedChain:e.chain,lane:U(t),...e.diagnostics}),Error(`[SigningEngine][ecdsa] missing shared key identity for ${e.context}`);let o=pe({key:a,materialActivation:r.materialActivation,keyHandle:r.keyHandle,walletId:r.walletId,auth:n.auth,authorization:t.authorization,chainTarget:i});return{...t,...o,key:a,keyHandle:r.keyHandle,chainTarget:i,keyKind:`threshold_ecdsa_secp256k1`,chainFamily:r.chainTarget.kind}}function Nt(e){let t=e.authMethod;return{primaryAuthMethod:t,linkedAuthMethods:[t],...e.email?{email:e.email}:{},...e.passkeyCredentialIds?.length?{passkeyCredentialIds:e.passkeyCredentialIds}:{}}}async function Pt(e){if(e.senderSignatureAlgorithm===`webauthnP256`)return Nt({authMethod:c.passkey});if(e.signerAuthMethod!==void 0)return Nt({authMethod:e.signerAuthMethod});throw Error(`[SigningEngine][ecdsa] signer auth method is unavailable`)}function G(e,t){try{e?.(ae({...t,flowId:t.flowId??Ft(t)}))}catch{}}function Ft(e){let t=e.data||{};return[`signing`,String(t.chain||`evm_family`),String(t.networkKey||`unknown_network`),String(t.nonce||``)||String(e.phase)].join(`:`)}function K(e,t){G(e,t)}function It(e){if(Lt())try{console.debug(`[SigningOperationMachine][evm-family]`,e)}catch{}}function Lt(){try{return globalThis.localStorage?.getItem(`seams:debug:signing-operation`)===`1`}catch{return!1}}function Rt(e){let n=e.capability.authority;if(!E(n))throw Error(`[SigningEngine] Email OTP operation step-up requires an Email OTP capability authority`);if(e.claimedAuthority&&!T(n,e.claimedAuthority))throw Error(`[SigningEngine] Email OTP step-up authority does not match the selected capability`);if(!t(e.capability.manifest.activation.materialActivation,e.materialActivation))throw Error(`[SigningEngine] Email OTP step-up material activation does not match the selected capability`);let r=String(e.operationFingerprint||``).trim();if(!r)throw Error(`[SigningEngine] Email OTP operation step-up requires an operation fingerprint`);return{kind:`capability_step_up`,capabilityAuthority:n,materialActivation:e.materialActivation,operationFingerprint:r}}function zt(e){switch(e.kind){case`live_session`:if(e.committedLane.authority.factor.kind!==`email_otp`)throw Error(`[SigningEngine][ecdsa] Email OTP challenge requires Email OTP authority`);return{kind:`live_session`,authLane:e.committedLane.authLane};case`capability_step_up`:return{kind:`capability_step_up`,capabilityAuthority:e.capabilityAuthority,materialActivation:e.materialActivation,operationFingerprint:e.operationFingerprint}}}function Bt(e){let t=null;return{challenge:async()=>{if(typeof e.requestEmailOtpTransactionSigningChallenge!=`function`)throw Error(`[SigningEngine] Email OTP ECDSA signing step-up is not configured`);if(e.authority.kind===`capability_step_up`){if(t!==null&&t!==e.authority.operationFingerprint)throw Error(`[SigningEngine] Email OTP step-up challenge is bound to a different operation`);t=e.authority.operationFingerprint}K(e.onEvent,{phase:A.STEP_06_AUTH_EMAIL_OTP_CHALLENGE_STARTED,status:`running`,walletId:e.walletId,interaction:{kind:`none`,overlay:`none`}}),be(`evm-family`,Se({event:`auth_side_effect_started`,lane:e.selectedLane,sideEffect:`email_otp_challenge`,phase:`confirmed`}));let n=await e.requestEmailOtpTransactionSigningChallenge({walletSession:e.walletSession,chain:e.chain,authority:zt(e.authority),operationFingerprintDigest:e.operationFingerprintDigest}),r=String(n.challengeId||``).trim();if(!r)throw Error(`[SigningEngine] Email OTP challenge response did not include challengeId`);return K(e.onEvent,{phase:A.STEP_06_AUTH_EMAIL_OTP_INPUT_REQUIRED,status:`waiting_for_user`,walletId:e.walletId,interaction:{kind:`otp_input`,overlay:`show`},data:{emailHint:n.emailHint,demoOtpCode:Ce(n.delivery)}}),{challengeId:r,email:String(n.emailHint||``).trim()}}}}function Vt(e){return E(e.authority)}function Ht(e){let t=e.selection.committedLane;if(!Vt(t))throw Error(`[SigningEngine][ecdsa] Email OTP step-up requires Email OTP authority`);return t.authLane?{kind:`live_session`,committedLane:t}:{kind:`capability_step_up`,capabilityAuthority:t.authority,materialActivation:t.authorization.runtime.materialActivation,operationFingerprint:`sha256:${String(e.operationFingerprintDigest)}`}}function Ut(e){if(e.selection)return E(e.selection.committedLane.authority)?Ht({selection:e.selection,operationFingerprintDigest:e.operationFingerprintDigest}):void 0}async function Wt(e){let t=m(e.walletSession.walletId),n=e.senderSignatureAlgorithm===`secp256k1`&&e.ecdsaAuthorization===`reusable_wallet_session`?e.preparedOperation:null,r=n?n.metadata:null,i=n?.lane,a=r?.selection,o=e.confirmedDeps,s=(e.ecdsaAuthorization===`operation_step_up`&&E(e.capability.authority)?Rt({capability:e.capability,materialActivation:e.materialActivation,operationFingerprint:e.operationFingerprint}):void 0)??(i&&l(i.auth)===c.emailOtp?Ut({selection:a,operationFingerprintDigest:e.operationFingerprintDigest}):void 0),f=s?Bt({walletId:t,walletSession:e.walletSession,chain:e.chain,...i?{selectedLane:i}:{},authority:s,operationFingerprintDigest:e.operationFingerprintDigest,onEvent:e.onEvent,requestEmailOtpTransactionSigningChallenge:o.requestEmailOtpTransactionSigningChallenge}):null,p=d.TransactionSign,h=null,g;if(n){let e=n,r=e.signingSessionPlan;if(g=r,r.kind===u.NotReady)throw Error(`[SigningEngine] ECDSA signing session is not ready: ${r.reason}`);h=qe({plan:r,accountId:String(t),intent:p,curve:`ecdsa`,expiresAtMs:e.expiresAtMs,remainingUses:e.remainingUses})}let _=h?null:await x(),v=h||_.signingAuthPlan,y=_?.emailOtpAuthBridge||f;if(v.kind!==L.EmailOtpReauth||!y)return{signingAuthPlan:v,...g?{signingSessionPlan:g}:{}};let b=async()=>{let e=await y.challenge();return{challengeId:e.challengeId,...e.email?{emailHint:e.email}:{}}};return{signingAuthPlan:v,...g?{signingSessionPlan:g}:{},emailOtpSigning:{prepare:b,resend:async()=>await b()}};async function x(){if(e.ecdsaAuthorization===`operation_step_up`){if(e.capability.authority.factor.kind===`voiceid`)throw Error(`Unlock this wallet with VoiceID again before signing.`);if(D(e.capability.authority))return{signingAuthPlan:{kind:L.PasskeyReauth,method:`passkey`}};if(E(e.capability.authority)){if(!f)throw Error(`[SigningEngine] Email OTP step-up authority is unavailable for the selected capability`);return{signingAuthPlan:{kind:L.EmailOtpReauth,method:`email_otp`},emailOtpAuthBridge:f}}throw Error(`The EVM authentication method cannot authorize this step-up.`)}if(!(Array.isArray(e.accountAuth.linkedAuthMethods)?e.accountAuth.linkedAuthMethods:[]).includes(e.accountAuth.primaryAuthMethod))throw Error(`[SigningEngine] primary auth method is not linked: ${String(e.accountAuth.primaryAuthMethod||``)}`);if(e.accountAuth.primaryAuthMethod===c.passkey)return{signingAuthPlan:{kind:L.PasskeyReauth,method:`passkey`}};if(e.accountAuth.primaryAuthMethod===c.emailOtp){if(!f)throw Error(`[SigningEngine] Email OTP transaction signing requires ECDSA lane state`);return{signingAuthPlan:{kind:L.EmailOtpReauth,method:`email_otp`},emailOtpAuthBridge:f}}throw Error(`[SigningEngine] unsupported primary auth method: ${String(e.accountAuth.primaryAuthMethod||``)}`)}}function Gt(e){if(e.selectedAuthMethod.kind!==`email_otp`||e.runtime.kind!==`exact_ecdsa_sealed_runtime_v1`||e.runtime.authBinding.kind!==`email_otp`||e.operationCredential.token.trim().length===0||e.runtime.sealedRecord.thresholdSessionId.trim().length===0)throw Error(`Exact Email OTP ECDSA signing-session authorization is incomplete`);return{kind:`signing_session`,operationCredential:e.operationCredential,thresholdSessionId:e.runtime.sealedRecord.thresholdSessionId,curve:`ecdsa`,chainTarget:e.runtime.chainTarget}}function Kt(e,t){return{...e,primaryAuthMethod:t,linkedAuthMethods:Array.from(new Set([...e.linkedAuthMethods,t]))}}function qt(e){let t=e.chainTarget.kind===`tempo`?he:ge,n={key:e.key,materialActivation:e.materialActivation,keyHandle:e.keyHandle,walletId:e.walletId,chainTarget:e.chainTarget,authorization:e.authorization};return Mt({lane:t(e.auth.kind===`email_otp`?{...n,auth:e.auth,retention:`session`,sessionOrigin:`per_operation`}:{...n,auth:e.auth,storageSource:`manual-bootstrap`}),chain:e.chain,context:`build exact ECDSA candidate signing lane`})}function Jt(e){return{authMethod:e.auth.kind,chain:e.chain,chainTarget:e.chainTarget,state:e.state,walletSessionId:e.authorization.operationCredential.walletSessionId,materialActivationId:e.materialActivation.activationId,remainingUses:e.authorization.runtime.remainingUses,expiresAtMs:e.authorization.runtime.expiresAtMs}}function q(e){return{...Jt(e),source:`canonical_capability`}}function Yt(e){return e.selectedAuthMethod.kind===`email_otp`&&e.runtime.authBinding.kind===`email_otp`}function Xt(e){return e.runtime.kind===`exact_ecdsa_direct_capability_runtime_v1`}function Zt(e){return e.runtime.kind===`exact_ecdsa_sealed_runtime_v1`}function Qt(e){if(e.auth.kind!==`passkey`)throw Error(`[SigningEngine][ecdsa] passkey committed lane requires passkey candidate`);return{...e,auth:e.auth}}function $t(e){let t=String(e.authority.walletId);if(!(String(e.lane.key.walletId)===t&&String(e.candidate.walletId)===t))throw Error(`[SigningEngine][ecdsa] ${e.context} committed lane authority wallet mismatch`)}function en(e){return{selectedLaneCandidate:q(e.candidate)}}async function tn(e){let t=Qt(e.candidate),n=(await e.deps.resolveCanonicalEcdsaSigningCapability({walletId:t.walletId,chainTarget:t.chainTarget,materialActivation:t.materialActivation})).authority;if(!D(n)||String(n.verifier.rpId)!==String(t.auth.rpId)||n.factor.credentialIdB64u!==t.auth.credentialIdB64u)throw Error(`[SigningEngine][ecdsa] exact Passkey capability authority changed`);return $t({authority:n,lane:e.lane,candidate:t,context:`Passkey`}),{lane:e.lane,authority:n,authorization:e.lane.authorization}}async function nn(e){let t=e.candidate,n=(await e.deps.resolveCanonicalEcdsaSigningCapability({walletId:t.walletId,chainTarget:t.chainTarget,materialActivation:t.materialActivation})).authority;if(t.auth.kind!==`voiceid`||!w(n)||n.bindingId!==t.auth.walletAuthMethodId||n.factor.deviceKeyId!==t.auth.deviceKeyId)throw Error(`VoiceID ECDSA capability authority changed.`);return $t({authority:n,lane:e.lane,candidate:t,context:`VoiceID`}),{lane:e.lane,authority:n,authorization:e.lane.authorization}}async function rn(e){let t=F(e.lane),n=await e.deps.resolveDurableEmailOtpEcdsaSigningSessionAuthority({lane:t,chain:e.lane.chainTarget.kind});return n?Yt(n)?{kind:`durable_authority_backed`,authorization:n}:null:(W(`Email OTP exact ECDSA authority not found`,{lane:U(e.lane),candidate:q(e.candidate)}),null)}function an(e){if(e.authority)return e.authority;throw W(`Email OTP exact ECDSA signing-session authority missing`,{lane:U(e.lane),candidate:q(e.candidate)}),Error(`Email OTP ECDSA committed lane is missing wallet-session authority; unlock wallet again`)}function on(e){let t=Gt(e.authority.authorization);if(t.kind===`signing_session`&&t.curve===`ecdsa`&&g(t.chainTarget,e.lane.chainTarget))return t;throw W(`Email OTP ECDSA committed lane rejected for authority shape`,{authorityKind:t.kind,authorityCurve:t.kind===`signing_session`?t.curve:null,lane:U(e.lane),candidate:q(e.candidate)}),Error(`Email OTP ECDSA committed lane authority is not an ECDSA signing session; unlock wallet again`)}function sn(e){if(e.committedLane&&e.committedLane.authority.factor.kind===e.expectedFactor)return e.committedLane;throw W(`ECDSA committed lane missing for ready signing`,{expectedFactor:e.expectedFactor,lane:U(e.lane),candidate:q(e.candidate)}),Error(`[SigningEngine][ecdsa] committed lane is unavailable for ready signing`)}function cn(e){let t=e.authority.authorization;if(t.runtime.authBinding.kind!==`email_otp`)throw Error(`[SigningEngine][ecdsa] Email OTP authority runtime binding is invalid`);let n=t.runtime.authBinding.emailOtpAuthority;if($t({authority:n,lane:e.lane,candidate:e.candidate,context:`Email OTP`}),Xt(t))return{lane:e.lane,authority:n,authorization:t};if(Zt(t))return{lane:e.lane,authority:n,authorization:t,authLane:on({authority:e.authority,lane:e.lane,candidate:e.candidate})};throw Error(`[SigningEngine][ecdsa] Email OTP authorization runtime is unsupported`)}async function ln(e){let t=qt(e.laneCandidate),n=t,r=e.laneCandidate.auth.kind,i=r===c.emailOtp?await rn({deps:e.deps,lane:n,candidate:e.laneCandidate}):null,a=r===c.emailOtp?an({authority:i,lane:n,candidate:e.laneCandidate}):null,o=r===c.emailOtp&&a?cn({authority:a,lane:n,candidate:e.laneCandidate}):null,s=r===c.passkey?await tn({deps:e.deps,lane:t,candidate:e.laneCandidate}):null,l=r===`voiceid`?await nn({deps:e.deps,lane:t,candidate:e.laneCandidate}):null,u=o??s??l,d=u?.authority.factor.kind,f=Kt(await Pt({senderSignatureAlgorithm:e.senderSignatureAlgorithm,signerAuthMethod:d??r}),r),p=en({candidate:e.laneCandidate});return{kind:`ready`,accountAuth:f,lane:t,committedLane:sn({committedLane:u,expectedFactor:r,lane:t,candidate:e.laneCandidate}),diagnostics:p}}function un(e){let t={walletId:e.walletId,curve:`ecdsa`,authSelectionPolicy:e.authSelectionPolicy,operationUsesNeeded:e.operationUsesNeeded,...e.operationId?{operationId:e.operationId}:{}};return e.signingTarget.kind===`tempo`?{...t,chain:`tempo`,chainTarget:e.signingTarget}:{...t,chain:`evm`,chainTarget:e.signingTarget}}function dn(e){return{kind:`account_class`,authMethod:e.candidateAuthMethod}}function fn(e){let t=new Set;for(let n of Ie(e.availableLanes,e.signingTarget))Pe(n)&&g(n.chainTarget,e.signingTarget)&&t.add(Re(n));if(t.size!==1)throw Error(`[SigningEngine][ecdsa] exact capability authority is unavailable or ambiguous`);return Array.from(t)[0]}function pn(e){if(!e)return{present:!1};if(!Pe(e))return{present:!0,curve:e.curve,chain:e.chainTarget.kind,chainTarget:e.chainTarget,state:e.state};let t=oe({walletId:e.key.walletId,publicFacts:e.publicFacts});return{present:!0,authMethod:Re(e),curve:e.curve,chain:e.chainTarget?.kind,chainTarget:e.chainTarget,...t?{evmFamilyKeyFingerprint:t}:{},state:e.state,source:e.source,walletSessionId:e.authorization?.operationCredential.walletSessionId,materialActivationId:e.materialActivation.activationId,remainingUses:e.remainingUses,expiresAtMs:e.expiresAtMs}}function mn(e){return Object.fromEntries(Object.entries(e.ecdsa.candidatesByTarget).map(([e,t])=>[e,t.map(e=>pn(e))]))}function hn(e,t){try{console.warn(e,JSON.stringify(t,null,2))}catch{try{console.warn(e,t)}catch{}}}function gn(e){return Object.fromEntries(Object.entries(e.ecdsa.lanesByTarget).map(([e,t])=>[e,pn(t)]))}function _n(e){return e?{present:!0,authMethod:fe(e),curve:e.curve,chain:e.chainTarget.kind,chainTarget:e.chainTarget,state:e.state,source:e.source,materialActivationId:e.materialActivation.activationId,authorizationState:e.authorizationState,...e.authorizationState===`authorized`?{walletSessionId:e.authorization.operationCredential.walletSessionId,remainingUses:e.authorization.runtime.remainingUses,expiresAtMs:e.authorization.runtime.expiresAtMs}:{}}:{present:!1}}function vn(e,t){let n=e.session,r=t.session;return e.selectedAuthority.authorityId===t.selectedAuthority.authorityId&&e.selectedAuthMethod.kind===t.selectedAuthMethod.kind&&e.selectedAuthMethod.walletAuthMethodId===t.selectedAuthMethod.walletAuthMethodId&&n.walletId===r.walletId&&n.authorityId===r.authorityId&&n.authMethodId===r.authMethodId&&n.authorizationId===r.authorizationId&&n.quotaId===r.quotaId&&n.authorityDigestB64u===r.authorityDigestB64u&&n.authorityRevocationEpoch===r.authorityRevocationEpoch&&e.operationCredential.walletSessionId===t.operationCredential.walletSessionId&&e.operationCredential.token===t.operationCredential.token&&ut(e.runtime,t.runtime)}function yn(e){let t=e.candidate,n=fe(t),r=e.selection.committedLane.authority.factor.kind;if(n!==r)throw Error(`[SigningEngine][ecdsa] prepared auth method ${n} did not match committed lane auth method ${r}`);let i=l(e.selection.lane.auth);if(i!==r)throw Error(`[SigningEngine][ecdsa] selected lane auth method ${i} did not match committed lane auth method ${r}`);if(!vn(t.authorization,e.selection.lane.authorization))throw Error(`[SigningEngine][ecdsa] prepared authorization did not match lane`);if(N(F(e.selection.committedLane.lane))!==N(F(e.selection.lane)))throw Error(`[SigningEngine][ecdsa] committed lane did not match selected lane`)}function bn(e){let t=e.diagnostics.selectedLaneCandidate.state,{expiresAtMs:n,remainingUses:r}=e.lane.authorization.runtime;return t===`expired`?{readiness:{status:`expired`,curve:`ecdsa`,materialActivation:e.lane.materialActivation,authorization:e.lane.authorization,expiresAtMs:n},expiresAtMs:n,remainingUses:r}:t===`exhausted`?{readiness:{status:`exhausted`,curve:`ecdsa`,materialActivation:e.lane.materialActivation,authorization:e.lane.authorization,expiresAtMs:n,remainingUses:r},expiresAtMs:n,remainingUses:r}:{readiness:{status:`ready`,curve:`ecdsa`,materialActivation:e.lane.materialActivation,authorization:e.lane.authorization,expiresAtMs:n,remainingUses:r},expiresAtMs:n,remainingUses:r}}function xn(e){let t=e.preparedOperation.operation;if(!t)throw Error(`[SigningEngine][ecdsa] prepared material requires an operation identity`);if(e.metadata.materialBinding.operationId!==t.operationId)throw Error(`[SigningEngine][ecdsa] prepared material operation identity mismatch`);if(e.metadata.materialBinding.operationFingerprint&&t.operationFingerprint&&e.metadata.materialBinding.operationFingerprint!==t.operationFingerprint)throw Error(`[SigningEngine][ecdsa] prepared material fingerprint mismatch`);let n=N(ue(e.preparedOperation.lane));if(e.metadata.materialBinding.laneIdentityKey!==n)throw Error(`[SigningEngine][ecdsa] prepared material lane identity mismatch`)}async function Sn(e){let t=e.signingTarget,n=t.kind,r=m(e.walletSession.walletId),i=await e.deps.resolveOwnerLaneScope(r),a=await e.deps.readAvailableSigningLanesForSigning({walletId:r,curve:`ecdsa`,ecdsaChainTargets:[t],ownerScope:i}),o={walletId:r,chain:n,chainTarget:t,targetKey:h(t),candidateCount:Ie(a,t).length,selectedLanesByTarget:gn(a),candidatesByTarget:mn(a)};o.candidateCount===0&&hn(`[ECDSA_LANE_READ_DIAGNOSTIC][no-candidates]`,o),I(`evm-family`,{stage:`ecdsa_prepare.available_lanes_read`,...o});let s=fn({availableLanes:a,signingTarget:e.signingTarget}),c=un({walletId:r,authSelectionPolicy:dn({candidateAuthMethod:s}),operationUsesNeeded:1,signingTarget:e.signingTarget,...e.signingOperation.operationId?{operationId:e.signingOperation.operationId}:{}}),l=Je({intent:c,availableLanes:a});if(I(`evm-family`,{stage:`ecdsa_prepare.material_candidate_selected`,walletId:r,chain:n,chainTarget:t,primaryAuthMethod:l.ok?fe(l.candidate):s,selectionOk:l.ok,...l.ok?{authorizationState:l.kind,selectedAvailableLane:pn(l.availableLane),selectedLaneCandidate:_n(l.candidate),...l.kind===`authorized`?{transactionLane:l.lane}:{}}:{failure:l.failure}}),!l.ok){let e={stage:`ecdsa_prepare.exact_material_candidate_missing`,walletId:r,chain:n,chainTarget:t,targetKey:h(t),primaryAuthMethod:s,candidateCount:o.candidateCount,ecdsaTargets:a.ecdsa.targets,selectedLanesByTarget:o.selectedLanesByTarget,candidatesByTarget:o.candidatesByTarget,selectionFailure:l.failure};throw hn(`[ECDSA_NO_LANE_DIAGNOSTIC]`,e),ye(`evm-family`,e),Error(`[SigningEngine][ecdsa] transaction signing requires exact ECDSA material for ${n}`)}if(l.kind===`authorization_required`){let t=l.candidate;return e.diagnostics.selection={kind:`authorization_required`,authMethod:Re(l.availableLane),candidate:_n(t)},{kind:`authorization_required`,authMethod:Re(l.availableLane),availableLanesGeneration:a.generation,identity:me({signer:de({walletId:t.walletId,chainTarget:t.chainTarget,keyHandle:t.keyHandle,key:t.key,materialActivation:t.materialActivation}),auth:t.auth}),candidate:t,intent:c}}let u=l.candidate,d=l.lane,f=await Ye({intent:c,coordinator:e.signingSessionCoordinator,operation:e.signingOperation,forceFreshAuth:e.forceFreshAuth===!0,onPlannerTrace:e=>ve(`evm-family`,e),lifecycleAdapter:{prepare:async()=>{let i=await ln({deps:e.deps,walletId:r,chainTarget:t,senderSignatureAlgorithm:`secp256k1`,laneCandidate:u});I(`evm-family`,{stage:`ecdsa_prepare.material_selected`,walletId:r,chain:n,chainTarget:t,selectionKind:i.kind,authMethod:i.committedLane.authority.factor.kind,lane:U(i.lane),diagnostics:i.diagnostics});let o=i.committedLane.authority.factor.kind;xe(`evm-family`,i.lane,{reason:`evm_family_ecdsa_selection`}),e.diagnostics.selection={kind:i.kind,authMethod:o,lane:U(i.lane),diagnostics:i.diagnostics};let s=Mt({lane:i.lane,chain:n,context:`EVM-family signing preparation`,diagnostics:e.diagnostics});yn({candidate:u,selection:i});let l=bn(i);return I(`evm-family`,{stage:`ecdsa_prepare.readiness`,walletId:r,chain:n,chainTarget:t,authMethod:o,lane:U(s),readinessStatus:l.readiness.status}),be(`evm-family`,Se({event:`pre_confirm_readiness_checked`,lane:s,readinessStatus:l.readiness.status,phase:`pre_confirm`})),{lane:s,transactionLane:d,transactionIntent:c,readiness:{readiness:l.readiness,expiresAtMs:l.expiresAtMs,remainingUses:l.remainingUses},availableLanesGeneration:a.generation,metadata:{accountAuth:i.accountAuth,authMethod:o,source:i.diagnostics.selectedLaneCandidate.source,selection:i,materialBinding:{operationId:e.signingOperation.operationId,...e.signingOperation.operationFingerprint?{operationFingerprint:e.signingOperation.operationFingerprint}:{},laneIdentityKey:N(ue(s))},availableLanesGeneration:a.generation}}}}}),p=f.thresholdOperation,g=p.metadata;return xn({metadata:g,preparedOperation:p}),{kind:`authorized`,accountAuth:g.accountAuth,authMethod:g.authMethod,source:g.source,selection:g.selection,availableLanesGeneration:g.availableLanesGeneration,signingLane:p.lane,preparedOperation:p,transactionOperation:f.transactionOperation}}function J(e){let t=e.signedResult.managedNonce;if(!t||typeof t!=`object`)throw Error(`[SigningEngine][evm-family] managedNonce is required for nonce lifecycle`);try{let n=ze(t);return e.walletId,n}catch(e){throw Error(`[SigningEngine][evm-family] invalid managedNonce: ${e instanceof Error?e.message:String(e||`unknown error`)}`)}}async function Cn(e,t){let n=Y(t);await e.nonceCoordinator.release({...n,reason:`signing_failed`})}function wn(e){return{chainNextNonce:e.chainNextNonce.toString(),unresolvedInFlightNonces:e.unresolvedInFlightNonces.map(e=>e.toString()),blocked:e.blocked,...e.blockedNonce==null?{}:{blockedNonce:e.blockedNonce.toString()}}}async function Tn(e,t){let n=J({signedResult:t.signedResult,walletId:t.walletId});G(t.onEvent,{walletId:t.walletId,phase:A.STEP_12_BROADCAST_ACCEPTED,status:`running`,message:`Marking managed nonce lane as in-flight`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString()}});let r=En(t.txHash||(t.signedResult.chain===`evm`?t.signedResult.txHashHex:void 0));await e.nonceCoordinator.markBroadcastAccepted({...Y(n),txHash:r}),G(t.onEvent,{walletId:t.walletId,phase:A.STEP_12_BROADCAST_ACCEPTED,status:`succeeded`,message:`Managed nonce lane marked in-flight`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString(),txHash:r}})}function En(e){let t=String(e||``).trim().toLowerCase();if(!/^0x[0-9a-f]{64}$/.test(t))throw Error(`[SigningEngine][evm-family] broadcast acceptance requires txHash`);return t}async function Dn(e,t){let n=J({signedResult:t.signedResult,walletId:t.walletId});G(t.onEvent,{walletId:t.walletId,phase:A.STEP_12_BROADCAST_REJECTED,status:`running`,message:`Marking managed nonce reservation rejected`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString()}}),await e.nonceCoordinator.markBroadcastRejected({...Y(n),error:t.error});let r=H({error:t.error,chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId});if(G(t.onEvent,{walletId:t.walletId,phase:A.STEP_12_BROADCAST_REJECTED,status:`failed`,message:`Managed nonce reservation marked rejected`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString()}}),!At(r)&&!jt(r))return;G(t.onEvent,{walletId:t.walletId,phase:A.STEP_13_NONCE_RECONCILE_STARTED,status:`running`,message:`Reconciling managed nonce lane after broadcast error`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString(),errorCode:V(r)}});let i=await e.nonceCoordinator.reconcile({lane:M(n)}).catch(()=>null);throw G(t.onEvent,{walletId:t.walletId,phase:A.STEP_13_NONCE_RECONCILE_SUCCEEDED,status:`succeeded`,message:`Managed nonce lane reconciled`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),...i?{laneStatus:wn(i)}:{}}}),r}async function On(e,t){t.receiptStatus;let n=J({signedResult:t.signedResult,walletId:t.walletId}),r=t.txHash||(t.signedResult.chain===`evm`?t.signedResult.txHashHex:void 0);await e.nonceCoordinator.markFinalized({...Y(n),...r?{txHash:r}:{}})}async function kn(e,t){let n=J({signedResult:t.signedResult,walletId:t.walletId});G(t.onEvent,{walletId:t.walletId,phase:t.reason===`replaced`?A.STEP_13_TRANSACTION_REPLACED:A.STEP_13_TRANSACTION_DROPPED,status:`running`,message:t.reason===`replaced`?`Marking managed nonce lane replaced`:`Marking managed nonce lane dropped`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString(),reason:t.reason,...t.txHash?{txHash:t.txHash}:{}}}),await e.nonceCoordinator.markDroppedOrReplaced({...Y(n),reason:t.reason,...t.txHash?{txHash:t.txHash}:{}}),G(t.onEvent,{walletId:t.walletId,phase:t.reason===`replaced`?A.STEP_13_TRANSACTION_REPLACED:A.STEP_13_TRANSACTION_DROPPED,status:t.reason===`replaced`?`succeeded`:`failed`,message:t.reason===`replaced`?`Managed nonce lane marked replaced`:`Managed nonce lane marked dropped`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),nonce:n.nonce.toString(),reason:t.reason,...t.txHash?{txHash:t.txHash}:{}}})}async function An(e,t){let n=J({signedResult:t.signedResult,walletId:t.walletId});G(t.onEvent,{walletId:t.walletId,phase:A.STEP_13_NONCE_RECONCILE_STARTED,status:`running`,message:`Reconciling managed nonce lane`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString()}});let r=await e.nonceCoordinator.reconcile({lane:M(n)}),i=wn(r);if(G(t.onEvent,{walletId:t.walletId,phase:A.STEP_13_NONCE_RECONCILE_SUCCEEDED,status:`succeeded`,message:`Managed nonce lane reconciled`,data:{chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId.toString(),laneStatus:i}}),r.blocked)throw Dt({chain:n.chainTarget.kind,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId,blockedNonce:String(i.blockedNonce||`unknown`)});return i}function Y(e){let t=String(e.leaseId||``).trim(),n=String(e.operationId||``).trim(),r=String(e.operationFingerprint||``).trim();if(!t||!n||!r)throw Error(`[SigningEngine][evm-family] managedNonce lease metadata is required`);return{leaseId:t,operationId:n,operationFingerprint:r}}function jn(e){let t=String(e||``).trim().toLowerCase();if(/^0x[0-9a-f]{40}$/.test(t))return t}function Mn(e){if(`chainId`in e)return typeof e.chainId==`number`?e.chainId:void 0}function Nn(e){return String(o(e.network))===`evm`}function Pn(e){return String(o(e.network))===`tempo`}function Fn(e){let t=Ln(e);if(t)return t;let n=e.request.tx.chainId;throw Error(`[SigningEngine] unable to resolve nonce network for ${e.request.chain} chainId=${String(n)} from configured chains`)}function In(e){return Ln(e)||`${e.request.chain}:${String(e.request.tx.chainId)}`}function Ln(e){let t=e.request.tx.chainId,n=e.configs.network.chains.filter(e=>{let n=Mn(e);return typeof n==`number`&&n===t});if(!n.length)return null;if(e.request.chain===`tempo`){let t=n.filter(e=>Pn(e));if(t.length===1)return t[0].network;if(t.length>1){let n=t.map(e=>e.network).join(`, `);throw Error(`[SigningEngine] ambiguous nonce network for tempo chainId=${String(e.request.tx.chainId)} across [${n}]`)}return null}let r=n.filter(e=>Nn(e));if(r.length===1)return r[0].network;if(r.length>1){let t=r.map(e=>e.network).join(`, `);throw Error(`[SigningEngine] ambiguous nonce network for evm chainId=${String(e.request.tx.chainId)} across [${t}]`)}let i=n.filter(e=>Pn(e));if(i.length===1)return i[0].network;if(i.length>1){let t=i.map(e=>e.network).join(`, `);throw Error(`[SigningEngine] ambiguous nonce network for evm->tempo chainId=${String(e.request.tx.chainId)} across [${t}]`)}return null}function Rn(e){return{kind:`threshold_owner`,thresholdOwnerAddress:e}}function zn(e){return{kind:`chain_account`,chainAccountAddress:e}}function Bn(e){switch(e.kind){case`threshold_owner`:return e.thresholdOwnerAddress;case`chain_account`:return e.chainAccountAddress;default:return e}}async function Vn(e){let t=(await e.deps.walletSignerStore.getActiveWalletSignerForChainTarget({walletId:e.walletId,chainTarget:e.chainTarget}))?.metadata||{},n=jn(t.thresholdOwnerAddress);if(n)return Rn(n);let r=jn(t.accountAddress);if(r)return zn(r);let i=_(e.chainTarget);throw Error(`[SigningEngine] unable to resolve managed nonce wallet signer for ${e.walletId} (${i})`)}async function Hn(e){return Bn(e.senderIdentity)}async function Un(e){let t=await Hn({senderIdentity:e.senderIdentity});return He({chain:`evm`,networkKey:Fn({configs:e.deps.seamsWebConfigs,request:e.request}),chainId:e.request.tx.chainId,sender:t,walletId:e.walletId})}async function Wn(e){let t=e.reservationInput,n;try{n=se(await e.deps.nonceCoordinator.reserve({lane:ce(t),operation:e.operation}))}catch(e){throw H({error:e,chain:`evm`,networkKey:t.chainTarget.networkSlug,chainId:t.chainTarget.chainId})}return{request:{...e.request,tx:{...e.request.tx,nonce:n.nonce}},reservation:n}}let Gn=null,Kn=null,qn=null,Jn=null;async function Yn(){return Gn||=import(`./secp256k1-DPeaOjM0.js`).then(e=>e.Secp256k1Engine),await Gn}async function Xn(){return Kn||=import(`./webauthnP256-BGHikiNl.js`).then(e=>e.WebAuthnP256Engine),await Kn}async function Zn(){return qn||=import(`./signEvmWithUiConfirm-B14zYdwE.js`).then(e=>e.signEvmWithUiConfirm),await qn}async function Qn(){return Jn||=import(`./signEvmFamilyWithUiConfirmForTempo-B7p9UVix.js`).then(e=>e.signEvmFamilyWithUiConfirmForTempo),await Jn}async function $n(e){let t=await Hn({senderIdentity:e.senderIdentity}),n=He({chain:`tempo`,networkKey:Fn({configs:e.deps.seamsWebConfigs,request:e.request}),chainId:e.request.tx.chainId,sender:t,nonceKey:e.request.tx.nonceKey,walletId:e.walletId}),r;try{r=se(await e.deps.nonceCoordinator.reserve({lane:ce(n),operation:e.operation}))}catch(e){throw H({error:e,chain:`tempo`,networkKey:n.chainTarget.networkSlug,chainId:n.chainTarget.chainId})}return{request:{...e.request,tx:{...e.request.tx,nonce:r.nonce}},reservation:r}}function er(e){if(e.state.kind!==`not_required`)return Rn(e.state.thresholdOwnerAddress)}function tr(e){if(e.state.kind===`not_required`)throw Error(`[SigningEngine][evm-family] raw EIP-1559 signing requires prepared threshold ECDSA owner address for ${e.walletId}`);return Rn(e.state.thresholdOwnerAddress)}function nr(e){return Vn({deps:e.deps,walletId:e.walletId,chainTarget:e.chainTarget})}async function rr(e,t){let n=e.deps.nonceCoordinator.recoverDurableLeases({walletId:e.walletId});n.catch(()=>{});let r=await t.loadSigner();try{return await r({...e.flowArgs,authorization:e.flowArgs.authorization??{kind:`owner`},request:e.request,onConfirmationDisplayed:e.onConfirmationDisplayed,thresholdEcdsaStepUp:e.thresholdEcdsaStepUp,prepareRequestWithManagedNonce:async()=>(await n,await t.prepareRequestWithManagedNonce({deps:e.deps,walletId:e.walletId,request:e.request,nonceOperation:e.nonceOperation})),releaseNonceReservation:async t=>{await Cn(e.deps,t)}})}catch(n){let r=await e.retryWithFreshEmailOtpAuth(n);if(r)return r;throw H({error:n,chain:t.targetKind,networkKey:In({configs:e.deps.seamsWebConfigs,request:e.request}),chainId:e.chainTarget.chainId})}}async function ir(e){if(e.chainTarget.kind===`evm`||e.request.kind===`eip1559`){let t=null,n=null,r=e.request.kind===`eip1559`?tr({state:e.thresholdEcdsaState,walletId:e.walletId}):void 0,i=er({state:e.thresholdEcdsaState}),a=t=>{let a=r||i;return a?Promise.resolve(a):(n||=nr({deps:t.deps,walletId:t.walletId,chainTarget:e.chainTarget}),n)},o=e=>(t||=a(e).then(t=>Un({deps:e.deps,walletId:e.walletId,request:e.request,senderIdentity:t})),t),s=e.chainTarget.kind;return await rr({...e,request:e.request},{targetKind:s,loadSigner:s===`tempo`?Qn:Zn,prepareRequestWithManagedNonce:async e=>{let t=await o(e);return await Wn({deps:e.deps,request:e.request,reservationInput:t,operation:e.nonceOperation})}})}let t=null,n=er({state:e.thresholdEcdsaState}),r=r=>n?Promise.resolve(n):(t||=nr({deps:r.deps,walletId:r.walletId,chainTarget:e.chainTarget}),t);return await rr({...e,request:e.request},{targetKind:`tempo`,loadSigner:Qn,prepareRequestWithManagedNonce:async e=>{let t=await r(e);return await $n({deps:e.deps,walletId:e.walletId,request:e.request,operation:e.nonceOperation,senderIdentity:t})}})}async function ar(e){return je({purpose:`transaction_signing`,source:ke(e.persistedMaterial),workerCtx:e.workerCtx})}function or(e){let t=String(e.walletId||``).trim();if(!t)throw Error(`[multichain] Missing wallet id for ready secp256k1 signing material`);let n=e.signerSession;if(t!==String(n.walletId))throw Error(`[multichain] ready secp256k1 material wallet identity mismatch`);let r=Math.floor(Number(e.expiresAtMs));if(!Number.isSafeInteger(r)||r<=Date.now())throw Error(`[multichain] ready secp256k1 authorization expiry is invalid`);let i={kind:`ready_secp256k1_signing_material`,walletId:t,signerSession:n,expiresAtMs:r,singleUseEmailOtpSession:e.singleUseEmailOtpSession};switch(e.authorization.kind){case`reusable_wallet_session`:if(e.credential.kind!==`reusable_wallet_session`)throw Error(`[multichain] exact Wallet Session authorization requires its operation credential`);return{...i,authorization:e.authorization,credential:e.credential};case`operation_step_up`:if(!e.operationStepUpPreparation)throw Error(`[multichain] operation step-up preparation is required`);return{...i,authorization:e.authorization,credential:e.credential,operationStepUpPreparation:e.operationStepUpPreparation}}}async function sr(e){let n=e.capability,r=n.manifest,i=n.material,a=e.runtime,o=i.publicFacts;if(!t(e.materialActivation,r.activation.materialActivation))return{kind:`unavailable`,reason:`material_activation_mismatch`};if(!t(a.materialActivation,r.activation.materialActivation))return{kind:`unavailable`,reason:`runtime_correlation_mismatch`};let s=r.signer.scope.targetMemberships.some(e=>g(e,o.chainTarget)),c=r.signer.scope.targetMemberships.find(t=>g(t,e.chainTarget));if(!s||!c||!g(a.chainTarget,c))return{kind:`unavailable`,reason:`chain_mismatch`};let l=k({publicFacts:o,chainTarget:c});if(!a.runtimePolicyScope)return{kind:`unavailable`,reason:`runtime_policy_scope_missing`};let u=await ar({persistedMaterial:i,workerCtx:e.workerCtx}),d;switch(u.kind){case`rehydrated`:d=u;break;case`device_link_required`:return{kind:`unavailable`,reason:`device_link_required`};case`corrupt`:return{kind:`unavailable`,reason:`material_corrupt`};default:return u}let f=a.normalSigning,p=Xe({routerAbState:f});return{kind:`ready`,material:j({walletId:r.signer.walletId,materialActivation:r.activation.materialActivation,publicFacts:r.signer.registeredPublicFacts,transport:{kind:`threshold_ecdsa_signer_transport`,relayerUrl:a.relayerUrl,relayerKeyId:r.durableMaterial.roleLocalBinding.relayerKeyId,signingMaterial:p,relayerVerifyingShareB64u:l.relayerPublicKey33B64u},clientShare:{kind:`role_local_worker_share`,handle:d.liveHandle,material:{kind:`worker_loaded`,materialRef:d.materialRef}},routerAbEcdsaDerivationNormalSigning:{kind:`router_ab_ecdsa_derivation_normal_signing_hydrated_v1`,state:f,activeStateId:b(f)}})}}function cr(e){let n=ht({capability:e.capability,authorization:e.authorization,nowMs:e.nowMs}),r=n.authorization.session,i=n.authorization.operationCredential;if(r.walletId!==e.material.walletId||!t(e.material.materialActivation,e.capability.manifest.activation.materialActivation))throw Error(`Exact Wallet Session authorization wallet does not match hydrated material`);if(i.token.trim().length===0)throw Error(`Exact Wallet Session authorization is unavailable`);return or({walletId:e.material.walletId,signerSession:e.material,authorization:{kind:`reusable_wallet_session`,wallet_session_id:i.walletSessionId},credential:{kind:`reusable_wallet_session`,walletSessionToken:i.token,home:i.home,ownershipGeneration:i.ownershipGeneration},expiresAtMs:r.expiresAtMs,singleUseEmailOtpSession:!1})}function lr(e){return e.session.capabilitySubjects.some(n=>n.kind===`sign`&&n.keyFamily===`ecdsa_secp256k1`&&t(n.materialActivation,e.materialActivation))}function ur(e){let n=e.authorityRuntime,r=n.holderRuntime,i=n.session,a=n.operationCredential,o=r.activationReceipt.normalSigning,s=o.scope;if(i.walletId!==r.walletId||i.authorityId!==r.authorityId||i.authMethodId!==r.walletAuthMethodId||a.walletSessionId!==n.walletSessionId||i.expiresAtMs<=Date.now()||!lr({session:i,materialActivation:r.materialActivation})||s.wallet_id!==r.walletId||s.ecdsa_threshold_key_id!==r.ecdsaThresholdKeyId||!t(x(s.material_activation),r.materialActivation))throw Error(`[SigningEngine] active Wallet Authority session does not bind the ECDSA holder runtime`);let c=String(e.relayerUrl||``).trim();if(!c)throw Error(`[SigningEngine] active Wallet Authority ECDSA signing requires relayerUrl`);let l=j({walletId:m(r.walletId),materialActivation:r.materialActivation,publicFacts:n.publicFacts,transport:{kind:`threshold_ecdsa_signer_transport`,relayerUrl:c,relayerKeyId:n.relayerKeyId,signingMaterial:Xe({routerAbState:o}),relayerVerifyingShareB64u:s.public_identity.server_public_key33_b64u},clientShare:{kind:`linked_holder_worker_share`,holderHandleId:r.holderHandleId},routerAbEcdsaDerivationNormalSigning:{kind:`router_ab_ecdsa_derivation_normal_signing_hydrated_v1`,state:o,activeStateId:b(o)}});return or({walletId:r.walletId,signerSession:l,authorization:{kind:`reusable_wallet_session`,wallet_session_id:a.walletSessionId},credential:{kind:`reusable_wallet_session`,walletSessionToken:a.token,home:a.home,ownershipGeneration:a.ownershipGeneration},expiresAtMs:i.expiresAtMs,singleUseEmailOtpSession:!1})}function X(e){return{kind:`blocked`,reason:e}}function dr(e){switch(e){case`email_otp`:return`email_otp`;case`login`:case`registration`:case`manual-bootstrap`:return`passkey`;default:throw Error(`[SigningEngine] unsupported sealed ECDSA source`)}}function Z(e){return String(e??``).trim()}function fr(e){let n=e.record.ecdsaRestore,r=e.manifest.durableMaterial;return Z(e.record.walletId)!==String(e.walletId)||!g(n.chainTarget,e.chainTarget)||!t(n.roleLocalMaterialRef.materialActivation,r.materialActivation)||!t(r.materialActivation,e.manifest.activation.materialActivation)?!1:Z(n.roleLocalMaterialRef.durableMaterialRef)===Z(r.durableMaterialRef)}function pr(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function mr(e,t){return e.kind===t.kind&&String(e.walletId)===String(t.walletId)&&String(e.authorityDigest)===String(t.authorityDigest)}function hr(e){return e.manifest.signer.scope.targetMemberships.some(t=>g(t,e.chainTarget))}function gr(e){let t=e.record.ecdsaRestore,n=e.manifest.durableMaterial,r=n.roleLocalBinding,i=n.roleLocalPublicFacts,a=t.routerAbEcdsaDerivationNormalSigning.scope,o=dr(t.source),s=Z(t.ecdsaThresholdKeyId)||Z(a.ecdsa_threshold_key_id),c=`recordKind`in e.record?Z(r.clientVerifyingPublicKey33B64u):Z(t.clientVerifyingShareB64u)||Z(a.public_identity.derivation_client_share_public_key33_b64u),l=Z(t.thresholdEcdsaPublicKeyB64u)||Z(a.public_identity.threshold_public_key33_b64u);return String(e.manifest.signer.walletId)===String(e.walletId)&&String(i.walletId)===String(e.walletId)&&hr(e)&&e.record.authMethod===o&&mr(t.authority,e.manifest.signer.authority)&&Z(t.roleLocalMaterialRef.bindingDigest)===Z(n.bindingDigest)&&Z(t.keyHandle)===Z(r.keyHandle)&&Z(t.keyHandle)===Z(i.keyHandle)&&s===Z(r.ecdsaThresholdKeyId)&&s===Z(i.ecdsaThresholdKeyId)&&c===Z(r.clientVerifyingPublicKey33B64u)&&c===Z(i.derivationClientSharePublicKey33B64u)&&l===Z(i.groupPublicKey33B64u)&&Z(t.relayerKeyId)===Z(r.relayerKeyId)&&pr(t.participantIds,r.participantIds)&&pr(t.participantIds,i.participantIds)&&Z(t.signingRootId)===Z(e.manifest.signer.signingRootId)&&Z(t.signingRootId)===Z(i.signingRootId)&&Z(t.signingRootVersion)===Z(e.manifest.signer.signingRootVersion)&&Z(t.signingRootVersion)===Z(i.signingRootVersion)&&Z(t.ethereumAddress).toLowerCase()===Z(i.ethereumAddress).toLowerCase()&&re(t.publicCapability,i.publicCapability)&&C(a,{wallet_id:String(e.walletId),ecdsa_threshold_key_id:String(i.ecdsaThresholdKeyId),signing_root_id:String(i.signingRootId),signing_root_version:String(i.signingRootVersion),context:i.publicCapability.context,public_identity:i.publicCapability.public_identity,signing_worker:i.publicCapability.signer_set.selected_server,activation_epoch:i.publicCapability.activation_epoch,material_activation:S(n.materialActivation)})}function _r(e){let t=e.restore;if(t.source===`email_otp`){let n=Z(t.providerSubjectId),r=Z(t.emailHashHex),i=t.emailOtpAuthority,a=e.manifest.signer.authority;return!n||!r||!i||String(i.walletId)!==String(a.walletId)||String(i.factor.providerUserId)!==n||String(i.verifier.emailHashHex)!==r?null:{kind:`email_otp`,providerSubjectId:n,emailHashHex:r,emailOtpAuthority:{walletId:i.walletId,factor:i.factor,verifier:i.verifier,bindingId:a.walletAuthMethodId}}}let n=Z(t.rpId),r=Z(t.credentialIdB64u);return n&&r?{kind:`passkey`,rpId:n,credentialIdB64u:r}:null}function vr(e){if(e.length!==2)return null;let t=e[0],n=e[1];return!Number.isSafeInteger(t)||!Number.isSafeInteger(n)||t<=0||n<=0||t===n?null:[t,n]}function yr(e){let t=e.record.ecdsaRestore,n=_r({manifest:e.manifest,restore:t}),i=Z(e.record.relayerUrl).replace(/\/+$/g,``),a=Z(t.relayerKeyId),o=e.manifest.durableMaterial.roleLocalBinding.clientVerifyingPublicKey33B64u,s=Z(t.ecdsaThresholdKeyId)||Z(t.routerAbEcdsaDerivationNormalSigning.scope.ecdsa_threshold_key_id),c=Z(t.thresholdEcdsaPublicKeyB64u)||Z(t.routerAbEcdsaDerivationNormalSigning.scope.public_identity.threshold_public_key33_b64u),l=Z(t.keyHandle),u=Array.isArray(t.participantIds)?vr(t.participantIds):null,d;try{d=te(t.roleLocalMaterialRef)}catch{return null}let f=null;try{f=r(t.runtimePolicyScope)}catch{f=null}return!n||!i||!a||!o||!s||!c||!l||!u?null:{walletId:e.walletId,chainTarget:e.chainTarget,materialActivation:t.roleLocalMaterialRef.materialActivation,normalSigning:t.routerAbEcdsaDerivationNormalSigning,relayerUrl:i,relayerKeyId:a,clientVerifyingPublicKey33B64u:o,participantIds:u,ecdsaThresholdKeyId:s,thresholdEcdsaPublicKeyB64u:c,keyHandle:l,runtimePolicyScope:f,roleLocalMaterialRef:d,authBinding:n}}function br(e){let t=yr(e),n=Number(e.record.expiresAtMs),r=Number(e.record.remainingUses),i=Z(e.record.thresholdSessionIds.ecdsa),a=Z(e.record.storeKey);return!t||!a||!i||!Number.isSafeInteger(n)||n<=0||!Number.isSafeInteger(r)||r<0?null:{...t,kind:`exact_ecdsa_sealed_runtime_v1`,expiresAtMs:n,remainingUses:r,sealedRecord:{storeKey:a,thresholdSessionId:i,authMethod:e.record.authMethod}}}function xr(e){let t=e.sealedRecords.filter(t=>fr({manifest:e.manifest,walletId:e.walletId,chainTarget:e.chainTarget,record:t}));if(t.length===0)return X(`missing_material`);if(t.length>1)return X(`exact_record_conflict`);let n=br({manifest:e.manifest,walletId:e.walletId,chainTarget:e.chainTarget,record:t[0]});return n?gr({manifest:e.manifest,walletId:e.walletId,chainTarget:e.chainTarget,record:t[0]})?{kind:`resolved`,runtime:n}:X(`binding_mismatch`):X(`corrupt`)}function Sr(e){return e.manifest.signer.scope.targetMemberships.some(t=>g(t,e.chainTarget))}async function Cr(e){return(await e.ports.listActiveEcdsaCapabilityManifestsForWallet(e.walletId)).filter(t=>Sr({manifest:t,chainTarget:e.chainTarget}))}async function wr(e){let t=[],n=e.authMethod?[e.authMethod]:[`passkey`,`email_otp`];for(let r of n){let n=await e.ports.listExactSealedSessionsForWallet({walletId:String(e.walletId),filter:{authMethod:r,curve:`ecdsa`,chainTarget:e.chainTarget}}).catch(()=>[]);for(let e of n)e.curve===`ecdsa`&&t.push(e)}return t}async function Tr(e){if(!Sr({manifest:e.manifest,chainTarget:e.chainTarget}))return{kind:`blocked`,reason:`chain_mismatch`};let t=e.manifest.durableMaterial,n=t.roleLocalPublicFacts,r=Er(n.participantIds),i=String(e.relayerUrl).trim().replace(/\/+$/g,``);return!r||!i?{kind:`blocked`,reason:`corrupt`}:{kind:`resolved`,manifest:e.manifest,runtime:{kind:`exact_ecdsa_capability_runtime_v1`,walletId:e.manifest.signer.walletId,chainTarget:e.chainTarget,materialActivation:t.materialActivation,normalSigning:t.routerAbEcdsaDerivationNormalSigning,relayerUrl:i,relayerKeyId:String(t.roleLocalBinding.relayerKeyId),clientVerifyingPublicKey33B64u:t.roleLocalBinding.clientVerifyingPublicKey33B64u,participantIds:r,ecdsaThresholdKeyId:String(n.ecdsaThresholdKeyId),thresholdEcdsaPublicKeyB64u:n.groupPublicKey33B64u,keyHandle:String(n.keyHandle),runtimePolicyScope:t.runtimePolicyScope,roleLocalMaterialRef:{kind:`ecdsa_role_local_persisted_material_ref_v1`,durableMaterialRef:t.durableMaterialRef,bindingDigest:t.bindingDigest,materialActivation:t.materialActivation}}}}function Er(e){if(e.length!==2)return null;let t=e[0],n=e[1];return!Number.isSafeInteger(t)||!Number.isSafeInteger(n)||t<=0||n<=0||t===n?null:[t,n]}async function Dr(e,t,n){let r=await e.resolveSelectedWalletAuthority(String(t));if(r.kind!==`resolved`)return n;let i=String(r.authMethod.walletAuthMethodId),a=n.filter(e=>String(e.signer.authority.walletAuthMethodId)===i);return a.length>0?a:n}async function Or(e,t){let n=await Cr({ports:e,...t});if(n.length===0)return{kind:`blocked`,reason:`missing_capability`};let r=n.length>1?await Dr(e,t.walletId,n):n;if(r.length!==1)return{kind:`blocked`,reason:`exact_record_conflict`};let i=r[0],a=await wr({ports:e,...t}),o=xr({manifest:i,walletId:t.walletId,chainTarget:t.chainTarget,sealedRecords:a});return o.kind===`resolved`?{kind:`resolved`,manifest:i,runtime:o.runtime}:{kind:`blocked`,reason:o.reason}}function kr(e){return Or.bind(null,e)}async function Ar(e,t){let n=await e.listActiveEcdsaCapabilityManifestsForWallet(t.walletId),r=[];for(let e of n)for(let n of e.signer.scope.targetMemberships)n.kind===t.chain&&r.push({manifest:e,chainTarget:n});if(r.length===0)return{kind:`blocked`,reason:`missing_capability`};if(r.length>1)return{kind:`blocked`,reason:`exact_record_conflict`};let i=r[0],a=await wr({ports:e,walletId:t.walletId,chainTarget:i.chainTarget}),o=xr({manifest:i.manifest,walletId:t.walletId,chainTarget:i.chainTarget,sealedRecords:a});return o.kind===`resolved`?{kind:`resolved`,manifest:i.manifest,runtime:o.runtime}:{kind:`blocked`,reason:o.reason}}function jr(e){return Ar.bind(null,e)}async function Mr(e){let t=e.material,n=t.publicFacts.participantIds;if(n.length!==2)throw Error(`[chains] ECDSA operation step-up requires exactly two participants`);let r=String(e.operation.intent.operationId||``).trim(),i=Math.min(Date.now()+5*6e4,e.sessionExpiresAtMs);return await Me({walletId:t.walletId,operationKind:`evm.sign_transaction`,operationId:r,operationDigests:e.operationDigests,materialActivation:t.materialActivation,normalSigningScope:t.routerAbEcdsaDerivationNormalSigning.state.scope,keyHandle:t.publicFacts.keyHandle,relayerKeyId:t.transport.relayerKeyId,participantIds:[Number(n[0]),Number(n[1])],expiresAtMs:i})}async function Nr(e){let t=Pr({authority:e.authority,authorization:e.authorization}),n=await Ae({relayerUrl:e.relayerUrl,transport:{kind:`wallet_session`,credential:e.operationCredential},request:{kind:`router_ab_ecdsa_operation_step_up_v1`,operation:e.prepared.operation,proof:t}}),r={kind:`operation_step_up`,walletSessionToken:e.operationCredential.token,home:e.operationCredential.home,ownershipGeneration:e.operationCredential.ownershipGeneration};return or({walletId:e.material.walletId,signerSession:e.material,authorization:{kind:`operation_step_up`},credential:r,expiresAtMs:n.expires_at_ms,singleUseEmailOtpSession:!1,operationStepUpPreparation:e.prepared.operation})}function Pr(e){switch(e.authorization.kind){case`passkey`:{if(!D(e.authority))throw Error(`[chains] passkey step-up requires the exact passkey authority`);let t=e.authorization.credential;return{kind:`passkey`,authority:e.authority,webauthn_authentication:{id:t.id,rawId:t.rawId,type:t.type,authenticatorAttachment:t.authenticatorAttachment??null,response:{clientDataJSON:t.response.clientDataJSON,authenticatorData:t.response.authenticatorData,signature:t.response.signature,userHandle:t.response.userHandle??null},clientExtensionResults:null}}}case`email_otp`:if(!E(e.authority))throw Error(`[chains] Email OTP step-up requires the exact Email OTP authority`);return{kind:`email_otp`,authority:e.authority,challenge_id:e.authorization.challengeId,otp_code:e.authorization.otpCode}}}function Fr(e){return{kind:`active_wallet_authority`,method:e.auth.kind,accountId:String(e.walletId),intent:`transaction_sign`,curve:`ecdsa`,walletSessionId:e.operationCredential.walletSessionId,authorityId:e.authorityId,authMethodId:e.walletAuthMethodId,expiresAtMs:e.session.expiresAtMs}}function Ir(e){switch(e.factor.kind){case`voiceid`:return`voiceid`;case`passkey`:return`passkey`;case`email_otp`:return`email_otp`;default:throw e.factor,Error(`[SigningEngine] unsupported wallet authorization factor`)}}function Lr(e){let n=e.capability.manifest;return n.signer.walletId===e.scope.walletId&&t(n.activation.materialActivation,e.scope.materialActivation)&&n.signer.scope.targetMemberships.some(t=>g(t,e.scope.chainTarget))}function Rr(e){let n=e.capability.manifest.activation.materialActivation;return e.session.capabilitySubjects.filter(e=>e.kind===`sign`&&e.keyFamily===`ecdsa_secp256k1`&&t(e.materialActivation,n)).length===1}async function zr(e){if(!Lr(e))throw Error(`[SigningEngine] exact ECDSA Wallet Session material changed`);let n=e.ports,r=await n.resolveSelectedWalletAuthority(String(e.scope.walletId)),i=Vr(r,e.scope.walletId);if(i||r.kind!==`resolved`)throw Br(i??`selected_authority_invalid`);let a=await ee({authority:e.capability.authority}),o=e.capability.manifest.signer.authority,s=r.authority.signerActivations.ecdsa;if(a.walletId!==o.walletId||a.walletAuthMethodId!==o.walletAuthMethodId||a.authorityDigest!==o.authorityDigest||o.walletId!==r.authority.walletId||o.walletAuthMethodId!==r.authMethod.walletAuthMethodId||!s||!t(s.materialActivation,e.scope.materialActivation))throw Error(`[SigningEngine] exact ECDSA Wallet Session material changed`);let c=await n.readExactWithOperationCredential({walletId:e.scope.walletId,authorityId:r.authority.authorityId,authMethodId:r.authMethod.walletAuthMethodId});if(c.kind!==`found`)throw Br(c.kind===`missing`?`wallet_session_missing`:`wallet_session_upgrade_required`);let l=c.record,u=Hr({session:l,operationCredential:c.operationCredential,walletId:e.scope.walletId,authority:r.authority,authMethod:r.authMethod,capability:e.capability});if(u)throw Br(u);return{credential:c.operationCredential,expiresAtMs:l.expiresAtMs}}function Br(e){return Error(`[SigningEngine] exact ECDSA Wallet Session is unavailable: ${e}`)}function Vr(e,t){return e.kind===`resolved`?e.selection.walletId!==t||e.authMethod.walletId!==t||e.authority.walletId!==t||e.selection.walletAuthMethodId!==e.authMethod.walletAuthMethodId||e.authMethod.walletAuthorityId!==e.authority.authorityId?`authority_identity_mismatch`:e.selection.lockState===`unlocked`?e.authMethod.status===`active`?e.authority.state===`active`?null:`authority_inactive`:`auth_method_inactive`:`wallet_locked`:e.kind===`missing_selection`?`selected_authority_missing`:`selected_authority_invalid`}function Hr(e){let{session:t}=e;return t.walletId!==e.walletId||t.authorityId!==e.authority.authorityId||t.authMethodId!==e.authMethod.walletAuthMethodId?`wallet_session_identity_mismatch (authority or method)`:t.authorityDigestB64u===e.authority.authorityDigestB64u?t.authorityRevocationEpoch===e.authority.revocationEpoch?e.operationCredential.token.trim()?t.expiresAtMs<=Date.now()?`wallet_session_expired`:Rr({session:t,capability:e.capability})?null:`wallet_session_capability_mismatch`:`wallet_session_identity_mismatch (operation credential)`:`wallet_session_identity_mismatch (authority revocation epoch)`:`wallet_session_identity_mismatch (authority digest)`}async function Ur(e,t){let n=await zr(e);return await Mr({operation:t.operation,operationDigests:t.operationDigests,material:t.material,sessionExpiresAtMs:n.expiresAtMs})}async function Wr(e,t){return await e.deps.withThresholdEcdsaSigningQueue({queueKey:Fe({materialActivation:e.materialActivation}),walletId:e.walletId,enabled:!0,...e.shouldAbort?{shouldAbort:e.shouldAbort}:{},task:t})}function Gr(e){let t=String(e.seamsWebConfigs.network.relayer?.url||``).trim();if(!t)throw Error(`[SigningEngine] EVM-family signing requires relayerUrl`);return t}async function Kr(e){let t=await Ne({ports:e.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,input:{walletId:e.signer.walletId,chainTarget:e.signer.chainTarget,requiredCapability:`sign`,materialActivation:e.signer.materialActivation,nowMs:Date.now()}});if(t.kind!==`resolved`)throw Error(`[SigningEngine] active Wallet Authority ECDSA runtime is ${t.reason}`);let n=t.runtime;if(n.authorityId!==e.prepared.authorityId||n.walletAuthMethodId!==e.prepared.walletAuthMethodId||n.authorityDigestB64u!==e.prepared.authorityDigestB64u||n.authorityRevocationEpoch!==e.prepared.authorityRevocationEpoch||n.walletSessionId!==e.prepared.walletSessionId||n.publicFacts.keyHandle!==e.signer.keyHandle)throw Error(`[SigningEngine] active Wallet Authority ECDSA runtime was replaced`);return n}function qr(e){return t(e.currentMaterialActivation,e.preparedMaterialActivation)?null:{kind:`superseded`,supersessionKind:`material_activation_replaced`,preparedMaterialActivation:e.preparedMaterialActivation,currentMaterialActivation:e.currentMaterialActivation}}function Jr(e){let t=e.preparedCapability.manifest,n=t.activation.materialActivation,r=e.currentManifest.activation.materialActivation,i=qr({preparedMaterialActivation:n,currentMaterialActivation:r});if(i)return i;let a=t.signer,o=e.currentManifest.signer;return String(t.identity.manifestId)===String(e.currentManifest.identity.manifestId)&&Number(t.identity.manifestRevision)===Number(e.currentManifest.identity.manifestRevision)&&String(a.capability)===String(o.capability)&&String(a.authority.walletId)===String(o.authority.walletId)&&String(a.authority.authorityDigest)===String(o.authority.authorityDigest)?null:{kind:`superseded`,supersessionKind:`capability_authority_replaced`,preparedMaterialActivation:n,currentMaterialActivation:r}}function Yr(e){let n=e.preparedAuthorization,r=e.currentAuthorization;return r&&n.selectedAuthority.authorityId===r.selectedAuthority.authorityId&&n.selectedAuthMethod.kind===r.selectedAuthMethod.kind&&n.selectedAuthMethod.walletAuthMethodId===r.selectedAuthMethod.walletAuthMethodId&&n.session.walletId===r.session.walletId&&n.session.authorityId===r.session.authorityId&&n.session.authMethodId===r.session.authMethodId&&n.session.authorizationId===r.session.authorizationId&&n.session.quotaId===r.session.quotaId&&(n.session.authorityDigestB64u===r.session.authorityDigestB64u||v(n.selectedAuthority,r.selectedAuthority)&&i(n.session,r.session))&&n.session.issuedAtMs===r.session.issuedAtMs&&n.session.expiresAtMs===r.session.expiresAtMs&&n.session.authorityRevocationEpoch===r.session.authorityRevocationEpoch&&n.operationCredential.walletSessionId===r.operationCredential.walletSessionId&&n.operationCredential.token===r.operationCredential.token&&ut(n.runtime,r.runtime)&&t(r.runtime.materialActivation,e.materialActivation)?null:{kind:`superseded`,supersessionKind:`reusable_authorization_replaced`,preparedMaterialActivation:e.materialActivation,currentMaterialActivation:e.materialActivation}}async function Xr(e){let t=await Tr({manifest:e.capability.manifest,chainTarget:e.chainTarget,relayerUrl:e.relayerUrl});if(t.kind!==`resolved`)return{kind:`failed`,failure:{kind:`unavailable`,reason:`runtime_correlation_mismatch`}};let n=Jr({preparedCapability:e.capability,currentManifest:t.manifest});if(n)return{kind:`superseded`,replacement:n};let r=await sr({capability:e.capability,runtime:t.runtime,chainTarget:e.chainTarget,materialActivation:e.materialActivation,workerCtx:e.workerCtx});return r.kind===`unavailable`?{kind:`failed`,failure:r}:e.candidateAuthorization?{kind:`ready`,value:{kind:`material_from_canonical_capability`,material:cr({material:r.material,capability:e.capability,authorization:e.candidateAuthorization,nowMs:Date.now()})}}:{kind:`authorization_required`,requirement:{kind:`material_for_step_up`,material:r.material}}}async function Zr(e,t){let n=await e.resolve(e.scope,le.fromPrepare({relayerUrl:e.relayerUrl,operationCredential:e.prepared.operationCredential},t));if(Yr({preparedAuthorization:e.prepared,currentAuthorization:n,materialActivation:e.scope.materialActivation}))throw Error(`Wallet Session authority changed before client signing`)}async function Qr(e,t){let n=await Kr(e);if(t.walletSessionId!==n.operationCredential.walletSessionId||t.quotaId!==n.session.quotaId||t.quotaLifecycle!==`active`||t.remainingUses<=0||t.expiresAtMs<=Date.now()||t.expiresAtMs!==n.session.expiresAtMs||!a(t.authorization,n.session))throw Error(`Linked Wallet Session authority changed before client signing`)}async function $r(){throw Error(`Operation step-up cannot reconcile a reusable Wallet Session`)}async function ei(e){let[t,n]=await Promise.all([Yn(),Xn()]),r=e.deps.getSignerWorkerContext(),i=e.deps.touchConfirm.getContext(),a=m(e.walletSession.walletId),o=Gr(e.deps),s=e.senderSignatureAlgorithm===`secp256k1`?P(e.preparedSession.kind===`authorized`?e.preparedSession.signingLane.identity:e.preparedSession.identity,`ECDSA signing material hydration`):void 0;if(e.activeWalletAuthority&&!s)throw Error(`[SigningEngine] active Wallet Authority runtime requires a threshold ECDSA signer`);let c=s&&!e.activeWalletAuthority?await e.deps.resolveCanonicalEcdsaSigningCapability({walletId:s.walletId,chainTarget:s.chainTarget,materialActivation:s.materialActivation}):void 0,l=e.preparedSession?.kind===`authorized`?e.preparedSession.selection.lane.authorization:null,u=c&&l&&l.runtime.remainingUses>0&&R({capability:c,authorization:l,nowMs:Date.now()})?l:null,d=s&&c&&!e.activeWalletAuthority?{walletId:s.walletId,chainTarget:s.chainTarget,materialActivation:s.materialActivation}:void 0,f=!e.activeWalletAuthority&&c&&d?{...e.emailOtpSigningForFlow?{emailOtpSigning:e.emailOtpSigningForFlow}:{},reusableAuthorization:u?{kind:`active`}:{kind:`absent`,requiredFactor:Ir(c.authority)},operationStepUp:{prepare:Ur.bind(void 0,{ports:e.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,scope:d,capability:c}),authorize:async({authorization:t,prepared:n,material:r})=>{e.onAuthSideEffectStarted?.(t.kind===`passkey`?`passkey_reauth`:`email_otp_challenge`);let i=await zr({ports:e.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,scope:d,capability:c});return await Nr({relayerUrl:o,authority:c.authority,authorization:t,prepared:n,material:r,operationCredential:i.credential})}},...e.onAuthSideEffectStarted?{onAuthSideEffectStarted:e.onAuthSideEffectStarted}:{}}:void 0,p=$r;e.activeWalletAuthority&&s?p=Qr.bind(null,{deps:e.deps,prepared:e.activeWalletAuthority.runtime,signer:s}):u&&d&&(p=Zr.bind(null,{resolve:e.deps.resolveActiveEcdsaWalletSessionAuthorization,scope:d,prepared:u,relayerUrl:o}));let h=new t({reconcileSession:p,beforeSigning:e.deps.beforeSigning,getRpId:()=>i.touchIdPrompt.getRpId(),workerCtx:r,shouldAbort:e.shouldAbort}),g=e.activeWalletAuthority,_=g&&s?{kind:`active_wallet_authority`,confirmationAuthPlan:g.confirmationAuthPlan,sign:async t=>{if(String(g.intent.operationId)!==t.operationId)throw Error(`[SigningEngine] active Wallet Authority signing operation identity changed`);return await Wr({deps:e.deps,walletId:s.walletId,materialActivation:s.materialActivation,...e.shouldAbort?{shouldAbort:e.shouldAbort}:{}},async()=>{let n=ur({authorityRuntime:await Kr({deps:e.deps,prepared:g.runtime,signer:s}),chainTarget:s.chainTarget,relayerUrl:o});return await h.signReady({kind:`digest`,algorithm:`secp256k1`,digest32:t.signingDigest32},n,{intent:g.intent,authPlan:g.confirmationAuthPlan},t.operationDigests)})}}:void 0;return{flowArgs:{ctx:i,touchConfirm:e.deps.touchConfirm,workerCtx:r,walletId:a,onEvent:e.onEvent,engines:{secp256k1:h,webauthnP256:new n(r,e.deps.beforeSigning)},...s&&c?{runEcdsaMaterialUse:Wr.bind(null,{deps:e.deps,walletId:s.walletId,materialActivation:s.materialActivation,...e.shouldAbort?{shouldAbort:e.shouldAbort}:{}}),resolveEcdsaSigningMaterialPlan:async()=>await Xr({capability:c,candidateAuthorization:u,walletId:s.walletId,chainTarget:s.chainTarget,materialActivation:s.materialActivation,relayerUrl:o,workerCtx:r})}:{},..._?{authorization:_}:{},...e.signingSessionPlan?{signingSessionPlan:e.signingSessionPlan}:{},...e.signingOperation?{signingOperation:e.signingOperation}:{},onSigningOperationTransition:e.onSigningOperationTransition||It,...f?{thresholdEcdsaStepUpRuntime:f}:{},confirmationConfigOverride:e.confirmationConfigOverride}}}function ti(e){return e instanceof De?e.authorizationDecision:void 0}async function ni(e){switch(e.decision.retryMode){case`await_admission_owner_completion`:return await e.signingSessionCoordinator.runWalletSessionQuotaAdmissionRetry({queueKey:e.queueKey,refresh:e.rereadAuthoritativeReadiness,retryAfterRefresh:e.rereadAuthoritativeReadiness});case`email_otp_single_operation_step_up`:case`fresh_auth`:return await e.signingSessionCoordinator.runWalletSessionQuotaAdmissionRetry({queueKey:e.queueKey,refresh:e.performFreshAuth,retryAfterRefresh:e.rereadAuthoritativeReadiness});default:return ri(e.decision)}}function ri(e){throw Error(`[SigningEngine][ecdsa] unsupported fresh-auth retry mode: ${String(e)}`)}function ii(e){return{kind:`do_not_retry`,trigger:e.trigger,sideEffectState:e.sideEffectState,blockedReason:e.blockedReason}}function Q(e,t){return ii({trigger:e.trigger,sideEffectState:e.sideEffectState,blockedReason:t})}function ai(e){if(e.current===`threshold_reconnect_started`)return e.current;switch(e.sideEffect){case`auth_prompt_shown`:case`email_otp_challenge`:case`passkey_reauth`:return e.current===`no_auth_side_effect_started`?`auth_prompt_shown`:e.current;case`auth_confirmed`:return`auth_confirmed`;case`threshold_reconnect`:return`threshold_reconnect_started`}}function oi(e){if(e.alreadyRetryingFreshAuth)return Q(e,`already_retrying`);if(e.senderSignatureAlgorithm!==`secp256k1`)return Q(e,`non_secp256k1_sender`);let t=ti(e.error),n=Te(e.error),r=e.trigger===`wallet_signing_budget_exhausted`?t?.kind===`step_up_required`?we(n??{kind:`exhausted`,source:`server_prepare`,detail:`Server requires owner operation step-up`}):n?.kind===`in_flight`?we(n):null:null,i=r?.kind===`request_fresh_step_up`||r?.kind===`wait_and_retry_admission`;if(e.sideEffectState!==`no_auth_side_effect_started`&&!i)return Q(e,`auth_side_effect_started`);if(e.trigger===`wallet_session_reauthorization_required`){if(e.hasEmailOtpSigningPlan||e.hasStepUpAuthPlan)return Q(e,`signing_auth_plan_already_selected`);if(t?.kind!==`step_up_required`)return Q(e,`error_not_retryable`);if(e.accountAuth.primaryAuthMethod!==c.emailOtp&&e.accountAuth.primaryAuthMethod!==c.passkey)return Q(e,`unsupported_primary_auth`)}else{if(!r)return Q(e,`error_not_retryable`);if(e.hasStepUpAuthPlan&&r.kind!==`request_fresh_step_up`&&r.kind!==`wait_and_retry_admission`)return Q(e,`step_up_auth_plan_already_selected`);if(r.kind===`wait_and_retry_admission`)return e.admissionRetryState.kind===`authoritative_readiness_reread`?Q(e,`authoritative_readiness_still_in_flight`):{kind:`retry`,trigger:e.trigger,sideEffectState:e.sideEffectState,retryMode:`await_admission_owner_completion`,admissionDecision:r};if(e.activeSigningAuthMethod===c.emailOtp)return{kind:`retry`,trigger:e.trigger,sideEffectState:e.sideEffectState,retryMode:`email_otp_single_operation_step_up`,admissionDecision:r}}return{kind:`retry`,trigger:e.trigger,sideEffectState:e.sideEffectState,retryMode:`fresh_auth`}}function si(e){return Oe(e.error)?.kind===`expired`?e.candidate.kind===`unavailable`?{kind:`expired_without_exact_lane`}:{kind:`authoritative_expiry`,state:Le({source:{kind:`ecdsa`,laneIdentity:e.candidate.identity,authorization:e.candidate.authorization},expiresAtMs:e.candidate.expiresAtMs,detectedAtMs:e.detectedAtMs})}:{kind:`not_expired`}}async function ci(e){switch(e.context.kind){case`not_expired`:case`expired_without_exact_lane`:return;case`authoritative_expiry`:if((await e.coordinator.invalidateExpiredWalletSession({state:e.context.state,source:ie.serverRejection})).kind===`unavailable`)throw Error(`[SigningEngine][ecdsa] expired Wallet Session cleanup failed`);return;default:return li(e.context)}}function li(e){throw Error(`[SigningEngine][ecdsa] unsupported Wallet Session expiry context: ${String(e)}`)}async function ui(e){let t=oi({trigger:`wallet_session_reauthorization_required`,error:e.error,senderSignatureAlgorithm:e.senderSignatureAlgorithm,accountAuth:e.accountAuth,alreadyRetryingFreshAuth:e.alreadyRetryingFreshEmailOtpAuth,hasEmailOtpSigningPlan:e.hasEmailOtpSigningPlan,sideEffectState:e.sideEffectState});if(e.onDecision?.(t),t.kind!==`retry`)return null;await ci({context:e.expiryContext,coordinator:e.signingSessionCoordinator});let n=e.accountAuth.primaryAuthMethod===c.emailOtp;return K(e.onEvent,{phase:n?A.STEP_06_AUTH_EMAIL_OTP_CHALLENGE_STARTED:A.STEP_09_THRESHOLD_SESSION_RECONNECT_STARTED,status:`running`,walletId:e.walletId,message:n?`Signing session expired; requesting Email OTP reauthorization`:`Signing session expired; requesting passkey reauthorization`,interaction:{kind:`none`,overlay:`none`},data:{chain:e.chain,reason:`threshold_session_expired`}}),await e.retry()}function di(){let e=n(32,`EVM family signing operation IDs`);return f.signingOperation(`evm-family-sign:${e}`)}function fi(e){return e?{planningOperationId:e,confirmationOperationId:e,callerProvided:!0}:{planningOperationId:di(),callerProvided:!1}}function pi(e){return e.confirmationOperationId=e.confirmationOperationId||di(),e.confirmationOperationId}function mi(e,t,n){e.callerProvided&&n.bindCallerProvidedOperationIdToFingerprint({operationId:e.planningOperationId,operationFingerprint:t})}function hi(e){switch(e.publicIdentityContinuity.kind){case`lane_identity_only`:return e.laneThresholdOwnerAddress;case`verified_material_identity`:if(e.publicIdentityContinuity.verifiedMaterialThresholdOwnerAddress!==e.laneThresholdOwnerAddress)throw Error(`[SigningEngine][ecdsa] prepared material owner address does not match the exact signing lane`);return e.laneThresholdOwnerAddress;default:throw e.publicIdentityContinuity,Error(`[SigningEngine][ecdsa] unsupported prepared public identity state`)}}function gi(e){return{kind:`prepared`,thresholdOwnerAddress:hi(e)}}var _i=e({reconcileEvmFamilyNonceLane:()=>An,reconcileTempoNonceLane:()=>ki,reportEvmFamilyBroadcastAccepted:()=>Tn,reportEvmFamilyBroadcastRejected:()=>Dn,reportEvmFamilyDroppedOrReplaced:()=>kn,reportEvmFamilyFinalized:()=>On,reportTempoBroadcastAccepted:()=>Ti,reportTempoBroadcastRejected:()=>Ei,reportTempoDroppedOrReplaced:()=>Oi,reportTempoFinalized:()=>Di,signEvmFamily:()=>wi});function vi(e){return!e.prepared||e.prepared.kind!==`authorized`?{kind:`unavailable`}:{kind:`exact_ecdsa_lane`,identity:F(e.prepared.signingLane),authorization:e.prepared.signingLane.authorization,expiresAtMs:e.prepared.signingLane.authorization.session.expiresAtMs}}function yi(e){let t=e.prepared.signingLane.authorization.session.authorizationId;return Ee({walletId:e.walletId,materialActivationId:e.prepared.signingLane.materialActivation.activationId,authorizationId:t,authorityKey:p(e.prepared.signingLane.auth),targetKey:h(e.prepared.signingLane.chainTarget)})}function bi(e){if(e.kind!==`authorization_required`||e.candidate.source!==`active_wallet_authority`)return null;let t=Fr(e.candidate.runtime);return{runtime:e.candidate.runtime,intent:e.intent,confirmationAuthPlan:t}}function xi(e){let t=e.chainTarget.kind===`tempo`?`Sign Tempo Transaction`:`Sign EVM Transaction`,n={request:e.request,signerAccount:String(e.walletSession.walletId),title:t,subtitle:``};return e.request.kind===`eip1559`?Ve({...n,request:e.request}):Ue({...n,request:e.request})}async function Si(e){let t=$.bind(null,e.deps,e.signingArgs,{admissionRetryState:{kind:`authoritative_readiness_reread`},forceFreshAuth:!1,operationIds:e.operationIds,retryingFreshAuth:e.retryingFreshAuth,signingSessionCoordinator:e.signingSessionCoordinator}),n=$.bind(null,e.deps,e.signingArgs,{admissionRetryState:{kind:`initial_admission`},forceFreshAuth:!0,operationIds:e.operationIds,retryingFreshAuth:!0,signingSessionCoordinator:e.signingSessionCoordinator});return await ni({decision:e.decision,queueKey:e.queueKey,signingSessionCoordinator:e.signingSessionCoordinator,rereadAuthoritativeReadiness:t,performFreshAuth:n})}function Ci(e){let t=e.accountAuth.primaryAuthMethod===c.emailOtp;K(e.onEvent,{phase:t?A.STEP_06_AUTH_EMAIL_OTP_CHALLENGE_STARTED:A.STEP_09_THRESHOLD_SESSION_RECONNECT_STARTED,status:`running`,walletId:e.walletId,message:t?`Signing session needs reauthorization; requesting Email OTP`:`Signing session needs reauthorization; requesting passkey`,interaction:{kind:`none`,overlay:`none`},data:{chain:e.chain,reason:`wallet_signing_budget_reserved`}})}async function wi(e,t){let n=s(e.touchConfirm.getContext().surfaceMeasurementBinding);n&&(n.assertPending(),e={...e,beforeSigning:n.beforeSigning});let r={admissionRetryState:{kind:`initial_admission`},operationIds:fi(t.signingOperationId)};await e.touchConfirm.openTransactionPreparationModal({chain:`evm_family`,walletLabel:String(t.walletSession.walletId),model:xi(t),confirmationConfigOverride:t.confirmationConfigOverride});try{return await $(e,t,r)}finally{e.touchConfirm.closeTransactionPreparationModal()}}async function $(e,t,n){St(t.shouldAbort);let r=m(t.walletSession.walletId),i=bt({request:t.request,chainTarget:t.chainTarget});await vt(e.ensureSealedRefreshStartupParity,{walletId:r,chainTarget:i});let a=i.kind,o=i,c,l,u,f,p,h={walletId:r,chain:a,chainTarget:o,senderSignatureAlgorithm:t.request.senderSignatureAlgorithm},g=n.signingSessionCoordinator||e.signingSessionCoordinator;if(!g)throw Error(`[SigningEngine][ecdsa] production signing session coordinator is required`);let _=n.operationIds||fi(t.signingOperationId),v=await Ke({kind:`evm-family:${a}`,payload:{walletId:r,chainTarget:o,request:t.request}}),y=_e(v);mi(_,v,g);let b=()=>pi(_),x=()=>({operationId:b(),operationFingerprint:v,intent:d.TransactionSign}),S=e=>void 0,C=`no_auth_side_effect_started`,w=e=>{C=ai({current:C,sideEffect:e})},T=(e,t)=>{let n=t instanceof Error?t.message:String(t||`unknown error`);h.freshAuthRetry={decision:e,sideEffectState:C,errorMessage:n},I(`evm-family`,{stage:`fresh_auth_retry.decision`,walletId:r,chain:a,chainTarget:o,decision:e,sideEffectState:C,errorMessage:n})},E=()=>(w(`auth_prompt_shown`),b());t.request.senderSignatureAlgorithm===`secp256k1`?(f=await Sn({deps:e,walletSession:t.walletSession,signingTarget:i,signingOperation:x(),diagnostics:h,signingSessionCoordinator:g,forceFreshAuth:n.forceFreshAuth===!0}),p=bi(f)??void 0,l=f.kind===`authorized`?f.signingLane:void 0,u=f.authMethod,c=f.kind===`authorized`?f.accountAuth:await Pt({senderSignatureAlgorithm:`secp256k1`,signerAuthMethod:f.authMethod}),I(`evm-family`,{stage:`ecdsa_attempt.prepared`,walletId:r,chain:a,chainTarget:o,...S(f)?{evmFamilyKeyFingerprint:S(f)}:{},authorizationState:f.kind,authMethod:u,lane:U(l)})):c=await Pt({senderSignatureAlgorithm:t.request.senderSignatureAlgorithm});let D=c;St(t.shouldAbort);let ee=e.requestEmailOtpTransactionSigningChallenge,O={confirmedDeps:{...e,requestEmailOtpTransactionSigningChallenge:ee},walletSession:t.walletSession,chain:a,accountAuth:D,operationFingerprintDigest:y,onEvent:t.onEvent},k=()=>{if(f)return f;throw Error(`[SigningEngine][ecdsa] prepared signing session is required`)},te=()=>t.request.senderSignatureAlgorithm===`secp256k1`?k():void 0,ne=async i=>!Be(i)||n.reResolvedAfterSupersession?null:(I(`evm-family`,{stage:`ecdsa_attempt.material_superseded`,walletId:r,chain:a,chainTarget:o,supersessionKind:i.superseded.supersessionKind,preparedMaterialActivationId:String(i.superseded.preparedMaterialActivation.activationId),currentMaterialActivationId:String(i.superseded.currentMaterialActivation.activationId)}),await $(e,t,{admissionRetryState:{kind:`initial_admission`},operationIds:_,signingSessionCoordinator:g,reResolvedAfterSupersession:!0,...n.retryingFreshAuth?{retryingFreshAuth:!0}:{}})),re=async()=>t.request.senderSignatureAlgorithm===`secp256k1`?await(async()=>{let t=k();return p?{signingAuthPlan:p.confirmationAuthPlan}:t.kind===`authorized`?await Wt({...O,chainTarget:i,senderSignatureAlgorithm:`secp256k1`,ecdsaAuthorization:`reusable_wallet_session`,preparedOperation:t.preparedOperation}):await(async()=>{let n=P(t.identity,`auth-neutral ECDSA step-up planning`),r=await e.resolveCanonicalEcdsaSigningCapability({walletId:n.walletId,chainTarget:n.chainTarget,materialActivation:n.materialActivation});return await Wt({...O,chainTarget:i,senderSignatureAlgorithm:`secp256k1`,ecdsaAuthorization:`operation_step_up`,capability:r,materialActivation:n.materialActivation,operationFingerprint:v})})()})():await Wt({...O,chainTarget:i,senderSignatureAlgorithm:t.request.senderSignatureAlgorithm}),ie=async()=>{let{signingAuthPlan:n,signingSessionPlan:r,emailOtpSigning:i}=await re(),a=i?{prepare:i.prepare,...i.resend?{resend:i.resend}:{}}:void 0,{flowArgs:s}=await ei({deps:e,walletSession:t.walletSession,request:t.request,chainTarget:o,...t.request.senderSignatureAlgorithm===`secp256k1`?{senderSignatureAlgorithm:t.request.senderSignatureAlgorithm,preparedSession:k(),...p?{activeWalletAuthority:p}:{}}:{senderSignatureAlgorithm:t.request.senderSignatureAlgorithm},...r?{signingSessionPlan:r}:{},signingOperation:x(),onSigningOperationTransition:It,...a?{emailOtpSigningForFlow:a}:{},confirmationConfigOverride:t.confirmationConfigOverride,shouldAbort:t.shouldAbort,onEvent:t.onEvent,onAuthSideEffectStarted:w});return{signingAuthPlan:n,signingSessionPlan:r,emailOtpSigning:i,flowArgs:s}},ae;try{ae=await ie()}catch(e){let t=await ne(e);if(t)return t;throw e}let{signingAuthPlan:A,emailOtpSigning:oe,flowArgs:j}=ae;s(e.touchConfirm.getContext().surfaceMeasurementBinding)?.assertAuthMethodPolicy(A.method);let se=async i=>await ui({error:i,walletId:r,chain:t.request.chain,senderSignatureAlgorithm:t.request.senderSignatureAlgorithm,accountAuth:D,alreadyRetryingFreshEmailOtpAuth:n.retryingFreshAuth,hasEmailOtpSigningPlan:!!oe,sideEffectState:C,signingSessionCoordinator:g,expiryContext:si({error:i,candidate:vi({prepared:f}),detectedAtMs:Date.now()}),onDecision:e=>T(e,i),onEvent:t.onEvent,retry:async()=>await $(e,t,{admissionRetryState:{kind:`initial_admission`},forceFreshAuth:!0,operationIds:_,retryingFreshAuth:!0,signingSessionCoordinator:g})}),ce=async i=>{if(Be(i))return await ne(i)||null;let a=await se(i);if(a)return a;let o=oi({trigger:`wallet_signing_budget_exhausted`,error:i,senderSignatureAlgorithm:t.request.senderSignatureAlgorithm,accountAuth:D,activeSigningAuthMethod:k().authMethod,admissionRetryState:n.admissionRetryState,alreadyRetryingFreshAuth:n.retryingFreshAuth,hasStepUpAuthPlan:Ge(A)||We(A),sideEffectState:C});if(T(o,i),o.kind!==`retry`)return null;let s=k();return s.kind===`authorized`?(o.retryMode!==`await_admission_owner_completion`&&Ci({walletId:r,chain:t.request.chain,accountAuth:D,onEvent:t.onEvent}),await Si({deps:e,signingArgs:t,decision:o,queueKey:yi({walletId:r,prepared:s}),operationIds:_,retryingFreshAuth:n.retryingFreshAuth===!0,signingSessionCoordinator:g})):null},M=te(),le={...x(),accountId:String(r)};if(M){let e=S(M);I(`evm-family`,{stage:`ecdsa_attempt.nonce_operation_prepared`,walletId:r,chain:a,chainTarget:o,...e?{evmFamilyKeyFingerprint:e}:{},...M.kind===`authorized`?{walletSessionId:M.signingLane.authorization.operationCredential.walletSessionId}:{},materialActivationId:M.kind===`authorized`?M.signingLane.materialActivation.activationId:M.candidate.materialActivation.activationId})}let N=te(),ue=N&&!p?{kind:`required`,authPlan:{kind:`planned`,signingAuthPlan:A},operation:{intent:N.kind===`authorized`?N.transactionOperation.intent:N.intent,authPlan:A},runtime:(()=>{let e=j.thresholdEcdsaStepUpRuntime;if(!e)throw Error(`[SigningEngine][ecdsa] prepared executor requires threshold step-up runtime`);return e})()}:{kind:`not_required`},F;return F=N?gi({laneThresholdOwnerAddress:N.kind===`authorized`?N.signingLane.key.thresholdOwnerAddress:N.candidate.key.thresholdOwnerAddress,publicIdentityContinuity:{kind:`lane_identity_only`}}):{kind:`not_required`},await ir({deps:e,walletId:r,request:t.request,chainTarget:o,flowArgs:j,nonceOperation:le,thresholdEcdsaState:F,onConfirmationDisplayed:E,thresholdEcdsaStepUp:ue,retryWithFreshEmailOtpAuth:ce})}async function Ti(e,t){await Tn(e,t)}async function Ei(e,t){await Dn(e,t)}async function Di(e,t){await On(e,t)}async function Oi(e,t){await kn(e,t)}async function ki(e,t){return await An(e,t)}export{ct as _,Di as a,Xe as b,jr as c,xr as d,_t as f,pt as g,gt as h,Oi as i,kr as l,ht as m,Ti as n,wi as o,z as p,Ei as r,_i as s,ki as t,Tr as u,ft as v,mt as y};

package/dist/esm/sdk/{signEvmFamilyWithUiConfirmForTempo-CrMIAXUe.js → signEvmFamilyWithUiConfirmForTempo-B7p9UVix.js}

@@ -1 +1 @@
-import{r as e}from"./base64-BmKR3UqU.js";import"./signingSessionSeal-BFOBKj-J.js";import"./capabilityKinds-DVlGMspk.js";import"./errors-BJBDbwHk.js";import"./signerDomain-BAsLT3XN.js";import{c as t}from"./ecdsaChainTarget-Bm5X4k-V.js";import{t as n}from"./executeWorkerOperation-C9FOCCR7.js";import{i as r}from"./evmCryptoWasm-BUPb4hBH.js";import{t as i}from"./bytes-DXo6uALR.js";import{p as a,r as o}from"./signingFlow-BcetvUeS.js";import{t as s}from"./display-D0EPmU4w.js";import{n as c,t as l}from"./signatureUses-kSrUHSSH.js";function u(e){if(e<0n)throw Error(`[tempoSignerWasm] negative bigint not supported`);return e.toString(10)}function d(e){if(typeof e==`bigint`){if(e<0n)throw Error(`[tempoSignerWasm] chainId must be a non-negative integer`);let t=Number(e);if(!Number.isSafeInteger(t))throw Error(`[tempoSignerWasm] chainId must be a non-negative safe integer`);return t}if(!Number.isSafeInteger(e)||e<0)throw Error(`[tempoSignerWasm] chainId must be a non-negative safe integer`);return e}function f(e){if(e===null)return null;if(e!==void 0)return u(e)}function p(e){if(typeof e==`bigint`)return e;throw Error(`[tempoSignerWasm] missing tx nonce`)}function m(e){if(e!==void 0)return e instanceof Uint8Array?Array.from(e):e.map(e=>m(e))}function h(e){return{chainId:d(e.chainId),maxPriorityFeePerGas:u(e.maxPriorityFeePerGas),maxFeePerGas:u(e.maxFeePerGas),gasLimit:u(e.gasLimit),calls:e.calls.map(e=>({to:e.to,value:u(e.value),input:e.input??`0x`})),accessList:(e.accessList??[]).map(e=>({address:e.address,storageKeys:e.storageKeys})),nonceKey:u(e.nonceKey),nonce:u(p(e.nonce)),validBefore:f(e.validBefore),validAfter:f(e.validAfter),feeToken:e.feeToken??null,feePayerSignature:e.feePayerSignature??{kind:`none`},aaAuthorizationList:m(e.aaAuthorizationList),keyAuthorization:m(e.keyAuthorization)}}const g=`tempoSigner`,_=2e4;async function v(e,t){let r=await n({ctx:t,kind:g,request:{type:`computeTempoSenderHash`,payload:{tx:h(e)},timeoutMs:_}});return new Uint8Array(r)}async function y(e){let t=e.senderSignature.slice().buffer,r=await n({ctx:e.workerCtx,kind:g,request:{type:`encodeTempoSignedTx`,payload:{tx:h(e.tx),senderSignature:t},timeoutMs:_,transfer:[t]}});return new Uint8Array(r)}var b=class{chain=`tempo`;workerCtx;constructor(e){this.workerCtx=e}async buildIntent(e){if(e.chain!==`tempo`)throw Error(`[TempoAdapter] invalid chain`);if(e.kind!==`tempoTransaction`)throw Error(`[TempoAdapter] unsupported request kind`);let t=await v(e.tx,this.workerCtx),n=i(t);return{chain:`tempo`,uiModel:{kind:`tempoTransaction`,tx:e.tx},signRequests:[e.senderSignatureAlgorithm===`webauthnP256`?{kind:`webauthn`,algorithm:`webauthnP256`,challenge32:t,label:`tempo:0x76:sender`}:{kind:`digest`,algorithm:`secp256k1`,digest32:t,label:`tempo:0x76:sender`}],finalize:async t=>({chain:`tempo`,kind:`tempoTransaction`,senderHashHex:n,rawTxHex:i(await y({tx:e.tx,senderSignature:t[0],workerCtx:this.workerCtx}))})}}};async function x(n){let i=t(n.walletId),a=await n.passkeyAuthenticatorStore.listWalletPasskeyAuthenticators(i);if(!a.length)throw Error(`[multichain] no passkeys found for wallet ${i}`);let{authenticatorsForPrompt:o}=await n.passkeyAuthenticatorStore.selectProfileAuthenticatorsForPrompt({profileId:i,authenticators:a,accountLabel:i}),s=o[0];if(!s)throw Error(`[multichain] missing authenticator for wallet ${i}`);let{pubKeyX32:c,pubKeyY32:l}=await r({cosePublicKey:s.credentialPublicKey,workerCtx:n.workerCtx}),u=e(s.credentialId);if(u.length===0)throw Error(`[multichain] invalid credentialId for authenticator`);return{type:`webauthnP256`,credentialId:u,pubKeyX:c,pubKeyY:l,rpId:n.rpId}}async function S(e){return e.request.kind===`eip1559`?await o({config:{targetKind:`tempo`,flowName:`tempo`,explicitAuthErrorLabel:`Tempo`,nonceErrorLabel:`Tempo`,title:`Sign Tempo Transaction`,body:``,buildIntent:async({workerCtx:e,request:t})=>await new c(e).buildIntent(t),buildDisplayModel:a,requiredSignatureUsesForRequest:l,webauthn:{kind:`not_supported`}},input:e}):await o({config:{targetKind:`tempo`,flowName:`tempo`,explicitAuthErrorLabel:`Tempo`,nonceErrorLabel:`Tempo`,title:`Sign Tempo Transaction`,body:``,buildIntent:async({workerCtx:e,request:t})=>await new b(e).buildIntent(t),buildDisplayModel:s,requiredSignatureUsesForRequest:l,webauthn:{kind:`supported`,requestNeedsWebAuthn:e=>e.senderSignatureAlgorithm===`webauthnP256`,validateIntent:e=>{if(e.signRequests.filter(e=>e.kind===`webauthn`).length>1)throw Error(`[chains] multiple WebAuthn sign requests are not supported yet`)},resolveKeyRef:async({ctx:e,walletId:t,workerCtx:n,signReq:r,credential:i})=>{let a=await x({passkeyAuthenticatorStore:e.passkeyAuthenticatorStore,walletId:t,workerCtx:n,rpId:r.rpId});return{signReq:{...r,credential:i},keyRef:a}}}},input:e})}export{S as signEvmFamilyWithUiConfirmForTempo};
+import{r as e}from"./base64-BmKR3UqU.js";import"./signingSessionSeal-BFOBKj-J.js";import"./capabilityKinds-DVlGMspk.js";import"./errors-BJBDbwHk.js";import"./signerDomain-D-EUTlLK.js";import{c as t}from"./ecdsaChainTarget-BoRVQtjQ.js";import{t as n}from"./executeWorkerOperation-CAYSt0NA.js";import{i as r}from"./evmCryptoWasm-CeH6Qeaa.js";import{t as i}from"./bytes-DXo6uALR.js";import{p as a,r as o}from"./signingFlow-Bd1X0e-1.js";import{t as s}from"./display-CUWg48tD.js";import{n as c,t as l}from"./signatureUses-BLOoPRsb.js";function u(e){if(e<0n)throw Error(`[tempoSignerWasm] negative bigint not supported`);return e.toString(10)}function d(e){if(typeof e==`bigint`){if(e<0n)throw Error(`[tempoSignerWasm] chainId must be a non-negative integer`);let t=Number(e);if(!Number.isSafeInteger(t))throw Error(`[tempoSignerWasm] chainId must be a non-negative safe integer`);return t}if(!Number.isSafeInteger(e)||e<0)throw Error(`[tempoSignerWasm] chainId must be a non-negative safe integer`);return e}function f(e){if(e===null)return null;if(e!==void 0)return u(e)}function p(e){if(typeof e==`bigint`)return e;throw Error(`[tempoSignerWasm] missing tx nonce`)}function m(e){if(e!==void 0)return e instanceof Uint8Array?Array.from(e):e.map(e=>m(e))}function h(e){return{chainId:d(e.chainId),maxPriorityFeePerGas:u(e.maxPriorityFeePerGas),maxFeePerGas:u(e.maxFeePerGas),gasLimit:u(e.gasLimit),calls:e.calls.map(e=>({to:e.to,value:u(e.value),input:e.input??`0x`})),accessList:(e.accessList??[]).map(e=>({address:e.address,storageKeys:e.storageKeys})),nonceKey:u(e.nonceKey),nonce:u(p(e.nonce)),validBefore:f(e.validBefore),validAfter:f(e.validAfter),feeToken:e.feeToken??null,feePayerSignature:e.feePayerSignature??{kind:`none`},aaAuthorizationList:m(e.aaAuthorizationList),keyAuthorization:m(e.keyAuthorization)}}const g=`tempoSigner`,_=2e4;async function v(e,t){let r=await n({ctx:t,kind:g,request:{type:`computeTempoSenderHash`,payload:{tx:h(e)},timeoutMs:_}});return new Uint8Array(r)}async function y(e){let t=e.senderSignature.slice().buffer,r=await n({ctx:e.workerCtx,kind:g,request:{type:`encodeTempoSignedTx`,payload:{tx:h(e.tx),senderSignature:t},timeoutMs:_,transfer:[t]}});return new Uint8Array(r)}var b=class{chain=`tempo`;workerCtx;constructor(e){this.workerCtx=e}async buildIntent(e){if(e.chain!==`tempo`)throw Error(`[TempoAdapter] invalid chain`);if(e.kind!==`tempoTransaction`)throw Error(`[TempoAdapter] unsupported request kind`);let t=await v(e.tx,this.workerCtx),n=i(t);return{chain:`tempo`,uiModel:{kind:`tempoTransaction`,tx:e.tx},signRequests:[e.senderSignatureAlgorithm===`webauthnP256`?{kind:`webauthn`,algorithm:`webauthnP256`,challenge32:t,label:`tempo:0x76:sender`}:{kind:`digest`,algorithm:`secp256k1`,digest32:t,label:`tempo:0x76:sender`}],finalize:async t=>({chain:`tempo`,kind:`tempoTransaction`,senderHashHex:n,rawTxHex:i(await y({tx:e.tx,senderSignature:t[0],workerCtx:this.workerCtx}))})}}};async function x(n){let i=t(n.walletId),a=await n.passkeyAuthenticatorStore.listWalletPasskeyAuthenticators(i);if(!a.length)throw Error(`[multichain] no passkeys found for wallet ${i}`);let{authenticatorsForPrompt:o}=await n.passkeyAuthenticatorStore.selectProfileAuthenticatorsForPrompt({profileId:i,authenticators:a,accountLabel:i}),s=o[0];if(!s)throw Error(`[multichain] missing authenticator for wallet ${i}`);let{pubKeyX32:c,pubKeyY32:l}=await r({cosePublicKey:s.credentialPublicKey,workerCtx:n.workerCtx}),u=e(s.credentialId);if(u.length===0)throw Error(`[multichain] invalid credentialId for authenticator`);return{type:`webauthnP256`,credentialId:u,pubKeyX:c,pubKeyY:l,rpId:n.rpId}}async function S(e){return e.request.kind===`eip1559`?await o({config:{targetKind:`tempo`,flowName:`tempo`,explicitAuthErrorLabel:`Tempo`,nonceErrorLabel:`Tempo`,title:`Sign Tempo Transaction`,body:``,buildIntent:async({workerCtx:e,request:t})=>await new c(e).buildIntent(t),buildDisplayModel:a,requiredSignatureUsesForRequest:l,webauthn:{kind:`not_supported`}},input:e}):await o({config:{targetKind:`tempo`,flowName:`tempo`,explicitAuthErrorLabel:`Tempo`,nonceErrorLabel:`Tempo`,title:`Sign Tempo Transaction`,body:``,buildIntent:async({workerCtx:e,request:t})=>await new b(e).buildIntent(t),buildDisplayModel:s,requiredSignatureUsesForRequest:l,webauthn:{kind:`supported`,requestNeedsWebAuthn:e=>e.senderSignatureAlgorithm===`webauthnP256`,validateIntent:e=>{if(e.signRequests.filter(e=>e.kind===`webauthn`).length>1)throw Error(`[chains] multiple WebAuthn sign requests are not supported yet`)},resolveKeyRef:async({ctx:e,walletId:t,workerCtx:n,signReq:r,credential:i})=>{let a=await x({passkeyAuthenticatorStore:e.passkeyAuthenticatorStore,walletId:t,workerCtx:n,rpId:r.rpId});return{signReq:{...r,credential:i},keyRef:a}}}},input:e})}export{S as signEvmFamilyWithUiConfirmForTempo};

package/dist/esm/sdk/{signEvmWithUiConfirm-CGrLtMV6.js → signEvmWithUiConfirm-B14zYdwE.js}

@@ -1 +1 @@
-import"./signingSessionSeal-BFOBKj-J.js";import"./capabilityKinds-DVlGMspk.js";import"./errors-BJBDbwHk.js";import"./signerDomain-BAsLT3XN.js";import{p as e,r as t}from"./signingFlow-BcetvUeS.js";import{n,t as r}from"./signatureUses-kSrUHSSH.js";async function i(i){return await t({config:{targetKind:`evm`,flowName:`evm`,explicitAuthErrorLabel:`EVM`,nonceErrorLabel:`EVM`,title:`Sign EVM Transaction`,body:``,buildIntent:async({workerCtx:e,request:t})=>await new n(e).buildIntent(t),buildDisplayModel:e,requiredSignatureUsesForRequest:r,webauthn:{kind:`not_supported`}},input:i})}export{i as signEvmWithUiConfirm};
+import"./signingSessionSeal-BFOBKj-J.js";import"./capabilityKinds-DVlGMspk.js";import"./errors-BJBDbwHk.js";import"./signerDomain-D-EUTlLK.js";import{p as e,r as t}from"./signingFlow-Bd1X0e-1.js";import{n,t as r}from"./signatureUses-BLOoPRsb.js";async function i(i){return await t({config:{targetKind:`evm`,flowName:`evm`,explicitAuthErrorLabel:`EVM`,nonceErrorLabel:`EVM`,title:`Sign EVM Transaction`,body:``,buildIntent:async({workerCtx:e,request:t})=>await new n(e).buildIntent(t),buildDisplayModel:e,requiredSignatureUsesForRequest:r,webauthn:{kind:`not_supported`}},input:i})}export{i as signEvmWithUiConfirm};