@seams/wallet 0.29.0 → 0.31.0

package/dist/esm/sdk/{registration-D3p7muCc.js → registration-XNyt1YRK.js}

@@ -1 +1 @@
-import{n as e}from"./chunk-dVx5-UGu.js";import{s as t}from"./errors-BJBDbwHk.js";import{c as n,r}from"./helpers-B7c1zc7h.js";import{t as i}from"./webauthnPromptCoordinator-npsSRD51.js";import{a,d as o,f as s,m as c,n as l,o as u,t as d}from"./adapters-B2k8y0MB.js";import{a as f}from"./intentDigest-gM3r4SVX.js";var p=e({handleRegistrationFlow:()=>_});function m(e){return Math.max(0,Math.round(performance.now()-e))}function h(e){return{kind:`passkey_registration_confirm_display_v1`,intendedUserName:e.walletId,accountId:e.walletId,rpId:e.rpId,signerSlot:e.signerSlot}}function g(e){let t={walletId:e.walletId,intendedUserName:e.walletId,prompt:e.prompt};return e.recoveryRegistration?{...t,kind:`wallet_recovery`,recoveryRegistration:e.recoveryRegistration}:e.addAuthMethodRegistration?{...t,kind:`wallet_add_auth_method`,registration:e.addAuthMethodRegistration}:{...t,kind:`wallet_registration`,challengeB64u:e.challengeB64u,signerSlot:e.signerSlot}}async function _(e,p,_,v){let{confirmationConfig:y,transactionSummary:b,theme:x,surface:S}=v,C=performance.now(),w=0,T=0,E=0,D=0,O=0,k=0,A=0,j=0,M=0,N=0,P=0,F=0,I=null,L=()=>({kind:`registration_confirmation_diagnostics_v1`,workerReadyMs:0,workerRequestRoundTripMs:0,workerResponseValidationMs:0,requestSetupMs:w,promptUserMs:T,promptElementDefineMs:E,promptMountMs:D,promptHostFirstUpdateMs:O,promptHostInteractiveMs:k,promptConfirmEventMs:A,promptDecisionWaitMs:j,credentialCreateStartMs:M,credentialCreateMs:N,credentialSerializeMs:P,duplicateRetryCount:F,mainThreadTotalMs:m(C)}),R=l(e),z=d({adapters:R,worker:_,request:p,confirmationConfig:y,transactionSummary:b,theme:x,surface:S}),B=o(p),V=u(p);try{let e=performance.now(),o=p.payload.walletRecoveryRegistration,s=p.payload.walletAddAuthMethodRegistration,c=p.payload.webauthnChallenge,l=o?o.challengeB64u:s?s.challengeB64u:c?.kind===`intent_digest`?String(c.challengeB64u||``).trim():``,u=async()=>{if(l)return l;let e=a(p);if(!e)throw Error(`Missing intentDigest for registration flow`);return f(e)},d=o?.rpId??s?.rpId??R.security.getRpId();if(!d)throw Error(`Missing rpId for registration challenge`);let _=p.payload?.signerSlot??1,v=await u(),y={rpId:d,passkeyRegistration:h({walletId:B,nearAccountId:V,rpId:d,signerSlot:_})};w=m(e);let b={kind:`registration_modal`,requestId:p.requestId};I=await i.reserveRegistrationPrompt({owner:b,expiresAtMs:Date.now()+300*1e3,cancellation:{kind:`none`}});let x=performance.now(),{confirmed:S,error:H,diagnostics:U}=await z.promptUser({securityContext:y});if(T=m(x),E=U.elementDefineMs,D=U.mountMs,O=U.hostFirstUpdateMs,k=U.hostInteractiveMs,A=U.confirmEventMs,j=U.decisionWaitMs,!S)return z.confirmAndCloseModal({requestId:p.requestId,intentDigest:a(p),confirmed:!1,registrationDiagnostics:L(),error:H});let W,G=p.payload?.signerSlot??1;M=m(C);let K=performance.now();try{try{let e={kind:`reserved`,reservation:I,owner:b,cancellation:{kind:`none`}};W=await R.webauthn.createRegistrationCredential(g(o?{walletId:B,recoveryRegistration:o,prompt:e}:s?{walletId:B,addAuthMethodRegistration:s,prompt:e}:{walletId:B,challengeB64u:v,signerSlot:G,prompt:e}))}catch(e){let n=t(e),r=String(n?.name||``),i=String(n?.message||``);if(r===`InvalidStateError`||/excluded|already\s*registered/i.test(i)){if(F+=1,l)throw Error(`Registration credential already exists for this wallet registration intent; create a fresh intent before retrying`);if(p.payload.walletRecoveryRegistration||s)throw Error(`Server-issued registration requires a fresh ceremony`);let e=G!==void 0&&Number.isFinite(G)?G+1:2;G=e,p.payload.signerSlot=e,p.intentDigest=p.type===`registerAccount`?`register:${B}:${e}`:`device2-register:${B}:${e}`,v=await u(),W=await R.webauthn.createRegistrationCredential(g({walletId:B,challengeB64u:v,signerSlot:e,prompt:{kind:`immediate`,requestId:p.requestId,cancellation:{kind:`none`}}}))}else throw console.error(`[RegistrationFlow] credentials.create failed (non-duplicate)`,{name:r,msg:i}),n}}finally{N=m(K)}let q=performance.now(),J=r(W)?W:n({credential:W,firstPrfOutput:!0,secondPrfOutput:!0});P=m(q),z.confirmAndCloseModal({requestId:p.requestId,intentDigest:a(p),confirmed:!0,credential:J,registrationDiagnostics:L()})}catch(e){let n=c(e),r=String(t(e)?.message||e||``);n&&window.parent?.postMessage({type:`WALLET_UI_CLOSED`},`*`);let i=/WebAuthn PRF output is missing from navigator\.credentials\.create\(\)/i.test(r)||/does not fully support the WebAuthn PRF extension during registration/i.test(r)||/roaming hardware authenticators .* not supported in this flow/i.test(r);return z.confirmAndCloseModal({requestId:p.requestId,intentDigest:a(p),confirmed:!1,registrationDiagnostics:L(),error:n?s.cancelled:i?r:r||s.collectCredentialsFailed})}finally{I&&i.releaseReservation(I)}}export{p as n,_ as t};
+import{n as e}from"./chunk-dVx5-UGu.js";import{s as t}from"./errors-BJBDbwHk.js";import{c as n,r}from"./helpers-B7c1zc7h.js";import{t as i}from"./webauthnPromptCoordinator-npsSRD51.js";import{a,d as o,f as s,m as c,n as l,o as u,t as d}from"./adapters-BY1wGpm5.js";import{a as f}from"./intentDigest-gM3r4SVX.js";var p=e({handleRegistrationFlow:()=>_});function m(e){return Math.max(0,Math.round(performance.now()-e))}function h(e){return{kind:`passkey_registration_confirm_display_v1`,intendedUserName:e.walletId,accountId:e.walletId,rpId:e.rpId,signerSlot:e.signerSlot}}function g(e){let t={walletId:e.walletId,intendedUserName:e.walletId,prompt:e.prompt};return e.recoveryRegistration?{...t,kind:`wallet_recovery`,recoveryRegistration:e.recoveryRegistration}:e.addAuthMethodRegistration?{...t,kind:`wallet_add_auth_method`,registration:e.addAuthMethodRegistration}:{...t,kind:`wallet_registration`,challengeB64u:e.challengeB64u,signerSlot:e.signerSlot}}async function _(e,p,_,v){let{confirmationConfig:y,transactionSummary:b,theme:x,surface:S}=v,C=performance.now(),w=0,T=0,E=0,D=0,O=0,k=0,A=0,j=0,M=0,N=0,P=0,F=0,I=null,L=()=>({kind:`registration_confirmation_diagnostics_v1`,workerReadyMs:0,workerRequestRoundTripMs:0,workerResponseValidationMs:0,requestSetupMs:w,promptUserMs:T,promptElementDefineMs:E,promptMountMs:D,promptHostFirstUpdateMs:O,promptHostInteractiveMs:k,promptConfirmEventMs:A,promptDecisionWaitMs:j,credentialCreateStartMs:M,credentialCreateMs:N,credentialSerializeMs:P,duplicateRetryCount:F,mainThreadTotalMs:m(C)}),R=l(e),z=d({adapters:R,worker:_,request:p,confirmationConfig:y,transactionSummary:b,theme:x,surface:S}),B=o(p),V=u(p);try{let e=performance.now(),o=p.payload.walletRecoveryRegistration,s=p.payload.walletAddAuthMethodRegistration,c=p.payload.webauthnChallenge,l=o?o.challengeB64u:s?s.challengeB64u:c?.kind===`intent_digest`?String(c.challengeB64u||``).trim():``,u=async()=>{if(l)return l;let e=a(p);if(!e)throw Error(`Missing intentDigest for registration flow`);return f(e)},d=o?.rpId??s?.rpId??R.security.getRpId();if(!d)throw Error(`Missing rpId for registration challenge`);let _=p.payload?.signerSlot??1,v=await u(),y={rpId:d,passkeyRegistration:h({walletId:B,nearAccountId:V,rpId:d,signerSlot:_})};w=m(e);let b={kind:`registration_modal`,requestId:p.requestId};I=await i.reserveRegistrationPrompt({owner:b,expiresAtMs:Date.now()+300*1e3,cancellation:{kind:`none`}});let x=performance.now(),{confirmed:S,error:H,diagnostics:U}=await z.promptUser({securityContext:y});if(T=m(x),E=U.elementDefineMs,D=U.mountMs,O=U.hostFirstUpdateMs,k=U.hostInteractiveMs,A=U.confirmEventMs,j=U.decisionWaitMs,!S)return z.confirmAndCloseModal({requestId:p.requestId,intentDigest:a(p),confirmed:!1,registrationDiagnostics:L(),error:H});let W,G=p.payload?.signerSlot??1;M=m(C);let K=performance.now();try{try{let e={kind:`reserved`,reservation:I,owner:b,cancellation:{kind:`none`}};W=await R.webauthn.createRegistrationCredential(g(o?{walletId:B,recoveryRegistration:o,prompt:e}:s?{walletId:B,addAuthMethodRegistration:s,prompt:e}:{walletId:B,challengeB64u:v,signerSlot:G,prompt:e}))}catch(e){let n=t(e),r=String(n?.name||``),i=String(n?.message||``);if(r===`InvalidStateError`||/excluded|already\s*registered/i.test(i)){if(F+=1,l)throw Error(`Registration credential already exists for this wallet registration intent; create a fresh intent before retrying`);if(p.payload.walletRecoveryRegistration||s)throw Error(`Server-issued registration requires a fresh ceremony`);let e=G!==void 0&&Number.isFinite(G)?G+1:2;G=e,p.payload.signerSlot=e,p.intentDigest=p.type===`registerAccount`?`register:${B}:${e}`:`device2-register:${B}:${e}`,v=await u(),W=await R.webauthn.createRegistrationCredential(g({walletId:B,challengeB64u:v,signerSlot:e,prompt:{kind:`immediate`,requestId:p.requestId,cancellation:{kind:`none`}}}))}else throw console.error(`[RegistrationFlow] credentials.create failed (non-duplicate)`,{name:r,msg:i}),n}}finally{N=m(K)}let q=performance.now(),J=r(W)?W:n({credential:W,firstPrfOutput:!0,secondPrfOutput:!0});P=m(q),z.confirmAndCloseModal({requestId:p.requestId,intentDigest:a(p),confirmed:!0,credential:J,registrationDiagnostics:L()})}catch(e){let n=c(e),r=String(t(e)?.message||e||``);n&&window.parent?.postMessage({type:`WALLET_UI_CLOSED`},`*`);let i=/WebAuthn PRF output is missing from navigator\.credentials\.create\(\)/i.test(r)||/does not fully support the WebAuthn PRF extension during registration/i.test(r)||/roaming hardware authenticators .* not supported in this flow/i.test(r);return z.confirmAndCloseModal({requestId:p.requestId,intentDigest:a(p),confirmed:!1,registrationDiagnostics:L(),error:n?s.cancelled:i?r:r||s.collectCredentialsFailed})}finally{I&&i.releaseReservation(I)}}export{p as n,_ as t};

package/dist/esm/sdk/{registrationIntent-C1-Kyx_-.js → registrationIntent-Cb3tggIM.js}

@@ -1 +1 @@
-import{A as e,E as t,M as n,N as r,O as i,S as a,d as o,f as s,k as c,l,u as ee,x as te,y as ne}from"./domainIds-t1lp25yU.js";import{S as u,b as d,g as re,i as ie,r as f,t as p}from"./digests-BIaE0DMd.js";import{i as ae}from"./base64-BmKR3UqU.js";import{n as oe}from"./secureRandomId-8LSc91aN.js";import{A as se,D as m,E as h,J as g,M as ce,N as _,O as le,k as ue}from"./activeWalletSession-BJ4B-nJo.js";import{a as v,n as de}from"./presignatures-CkhuZ0YQ.js";import{kt as fe}from"./digestEncoding-34kXJoJr.js";import{i as y,n as pe,t as b}from"./registrationAuthMethodInput-C4o7yFBJ.js";import{a as me}from"./signerSlot-BlijMq8C.js";import{a as he}from"./registrationSignerPlan-CeMidFme.js";function ge(e){return typeof e==`string`&&/^wreg_[A-Za-z0-9_-]{43}$/u.test(e)?e:null}function _e(){return`wreg_${oe(32)}`}const x=`wallet_registration_setup:`;function S(e,t){return`${x}${e}:${t}`}function C(e){if(!re(e)||!re(e.value))throw Error(`Registration setup journal is invalid`);let t=e.value,n=d(t.scopeDigest,`Registration setup scope digest`),r=d(t.requestDigest,`Registration setup request digest`),i=ge(t.operationId);if(!i||!/^[a-f0-9]{64}$/u.test(n)||!/^[a-f0-9]{64}$/u.test(r)||e.key!==S(n,r))throw Error(`Registration setup journal scope is invalid`);if(t.state===`pending`&&!(`walletId`in t)&&!(`registrationCeremonyId`in t))return{state:`pending`,operationId:i,scopeDigest:n,requestDigest:r};if(t.state===`accepted`){let e=c(t.walletId);if(e.ok)return{state:`accepted`,operationId:i,scopeDigest:n,requestDigest:r,walletId:e.value,registrationCeremonyId:d(t.registrationCeremonyId,`Registration setup ceremony`)}}throw Error(`Registration setup journal state is invalid`)}async function ve(e){return ie(p({relayerUrl:e.relayerUrl.replace(/\/+$/u,``),publishableKey:e.publishableKey,environmentId:e.environmentId}))}function ye(){}var w=class{constructor(e){this.manager=e}async begin(e,t){let n=await ie(p(t)),r=S(e,n),i={state:`pending`,operationId:_e(),scopeDigest:e,requestDigest:n},a=(await this.manager.getDB()).transaction(v.appState,`readwrite`),o=await a.store.get(r),s=o===void 0?i:C(o);return o===void 0&&await a.store.put({key:r,value:s}),await a.done,s}async accept(e,t){let n=S(e.scopeDigest,e.requestDigest),r=(await this.manager.getDB()).transaction(v.appState,`readwrite`),i=C(await r.store.get(n));if(i.operationId!==e.operationId||i.state===`accepted`&&(i.walletId!==t.walletId||i.registrationCeremonyId!==t.registrationCeremonyId))throw r.abort(),await r.done.catch(ye),Error(`Registration setup response changed its operation, wallet or ceremony`);let a={state:`accepted`,operationId:i.operationId,scopeDigest:i.scopeDigest,requestDigest:i.requestDigest,walletId:t.walletId,registrationCeremonyId:t.registrationCeremonyId};await r.store.put({key:n,value:a}),await r.done}async complete(e){let t=(await this.manager.getDB()).transaction(v.appState,`readwrite`),n=(await t.store.getAll(IDBKeyRange.bound(x,`${x}\uffff`))).map(C);for(let r of n)r.state===`accepted`&&r.walletId===e.walletId&&r.registrationCeremonyId===e.registrationCeremonyId&&await t.store.delete(S(r.scopeDigest,r.requestDigest));await t.done}};const be=new w(de),T=`wallet_seed_parallel_hkdf_sha256_v1`;function xe(e){return e.kind===`wallet_custody_seed_v1`}function E(){return{kind:`wallet_custody_seed_v1`,derivationScheme:T}}function D(e){return{kind:`ed25519_yao_client_root_v1`,linkSessionId:e.linkSessionId,walletKeyId:e.walletKeyId,targetFactor:e.targetFactor,applicationBindingDigestB64u:e.applicationBindingDigestB64u,registeredPublicKeyB64u:e.registeredPublicKeyB64u,enrollmentId:e.enrollmentId,deviceId:e.deviceId,revocationEpoch:e.revocationEpoch}}function Se(e){return{kind:`ed25519_lane_holder_share_v1`,walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,registeredPublicKeyB64u:e.registeredPublicKeyB64u,participantBindingDigestB64u:e.participantBindingDigestB64u}}function Ce(e){return{kind:`ecdsa_lane_holder_share_v1`,walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,thresholdSessionId:e.thresholdSessionId,thresholdPublicKey33B64u:e.thresholdPublicKey33B64u}}const O=[`kind`,`walletKeyId`,`laneId`,`laneShareEpoch`],k={wallet_custody_seed_v1:[`kind`,`derivationScheme`],ed25519_yao_client_root_v1:[`kind`,`linkSessionId`,`walletKeyId`,`targetFactor`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`enrollmentId`,`deviceId`,`revocationEpoch`],ed25519_lane_holder_share_v1:[...O,`nearEd25519SigningKeyId`,`registeredPublicKeyB64u`,`participantBindingDigestB64u`],ecdsa_lane_holder_share_v1:[...O,`evmFamilySigningKeySlotId`,`thresholdSessionId`,`thresholdPublicKey33B64u`]},we=Array.from(new Set(Object.values(k).flat()));function Te(e,t){if(e===`wallet_custody_seed_v1`||e===`ed25519_yao_client_root_v1`||e===`ed25519_lane_holder_share_v1`||e===`ecdsa_lane_holder_share_v1`)return e;throw Error(`${t}.kind must be a known passkey custody secret kind`)}function Ee(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function De(e,t){let n=u(e,t);if(g(n,[`kind`],t),n.kind===`passkey_prf`||n.kind===`email_otp`)return{kind:n.kind};throw Error(`${t}.kind must be passkey_prf or email_otp`)}function A(t,n){let r=e(t.walletKeyId);if(!r.ok)throw Error(`${n}.walletKeyId ${r.error.message}`);let i=te(t.laneId);if(!i.ok)throw Error(`${n}.laneId ${i.error.message}`);let a=l(t.laneShareEpoch);if(!a.ok)throw Error(`${n}.laneShareEpoch ${a.error.message}`);return{walletKeyId:r.value,laneId:i.value,laneShareEpoch:a.value}}function Oe(e,t){let n=a(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function ke(t,n=`passkeyCustodySecretBinding`){let r=u(t,n),i=Te(r.kind,n);switch(g(r,k[i],n,we),i){case`wallet_custody_seed_v1`:if(r.derivationScheme!==T)throw Error(`${n}.derivationScheme must be ${T}`);return E();case`ed25519_yao_client_root_v1`:{let t=ee(r.linkSessionId);if(!t.ok)throw Error(`${n}.linkSessionId ${t.error.message}`);let i=e(r.walletKeyId);if(!i.ok)throw Error(`${n}.walletKeyId ${i.error.message}`);let a=o(r.enrollmentId);if(!a.ok)throw Error(`${n}.enrollmentId ${a.error.message}`);let c=s(r.deviceId);if(!c.ok)throw Error(`${n}.deviceId ${c.error.message}`);return D({linkSessionId:t.value,walletKeyId:i.value,targetFactor:De(r.targetFactor,`${n}.targetFactor`),applicationBindingDigestB64u:h(r.applicationBindingDigestB64u,`${n}.applicationBindingDigestB64u`),registeredPublicKeyB64u:m(r.registeredPublicKeyB64u,`${n}.registeredPublicKeyB64u`),enrollmentId:a.value,deviceId:c.value,revocationEpoch:Ee(r.revocationEpoch,`${n}.revocationEpoch`)})}case`ed25519_lane_holder_share_v1`:{let e=A(r,n);return Se({walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,nearEd25519SigningKeyId:me(r.nearEd25519SigningKeyId),registeredPublicKeyB64u:m(r.registeredPublicKeyB64u,`${n}.registeredPublicKeyB64u`),participantBindingDigestB64u:h(r.participantBindingDigestB64u,`${n}.participantBindingDigestB64u`)})}case`ecdsa_lane_holder_share_v1`:{let e=A(r,n);return Ce({walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,evmFamilySigningKeySlotId:fe(r.evmFamilySigningKeySlotId,`${n}.evmFamilySigningKeySlotId`),thresholdSessionId:Oe(r.thresholdSessionId,`${n}.thresholdSessionId`),thresholdPublicKey33B64u:ce(r.thresholdPublicKey33B64u,`${n}.thresholdPublicKey33B64u`)})}}}const j=`wallet_custody_envelope_v2`,M=`passkey_prf_kek_hkdf_sha256_v1`,N=`email_otp_factor_kek_hkdf_sha256_v1`,P=`voiceid_device_factor_kek_hkdf_sha256_v1`;function Ae(e){return e.ownership.kind===`method_bound`&&e.binding.kind===`wallet_custody_seed_v1`&&e.lifecycle.state===`active`}function je(e){return Ae(e)&&e.factor.kind===`voiceid`}const Me=[`kind`,`walletAuthMethodId`];function Ne(e,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be an object`);let r=e;switch(g(r,Me,n),r.kind){case`unbound`:if(r.walletAuthMethodId!==void 0)throw Error(`${n}.walletAuthMethodId belongs to the method_bound branch`);return{kind:`unbound`};case`method_bound`:{let e=t(r.walletAuthMethodId);if(!e.ok)throw Error(`${n}.walletAuthMethodId ${e.error.message}`);return{kind:`method_bound`,walletAuthMethodId:e.value}}default:throw Error(`${n}.kind must be unbound or method_bound`)}}function Pe(e){return JSON.stringify({walletId:e.walletId,envelopeId:e.envelopeId,factor:e.factor,envelopeRevision:e.envelopeRevision,binding:e.binding,ownership:F(e.ownership)})}function Fe(e,n){if(e===`unbound`)return{kind:`unbound`};if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be "unbound" or a methodBound object`);let r=e;g(r,[`methodBound`],n);let i=r.methodBound;if(typeof i!=`object`||!i||Array.isArray(i))throw Error(`${n}.methodBound must be an object`);let a=i;g(a,[`walletAuthMethodId`],`${n}.methodBound`);let o=t(a.walletAuthMethodId);if(!o.ok)throw Error(`${n}.methodBound.walletAuthMethodId ${o.error.message}`);return{kind:`method_bound`,walletAuthMethodId:o.value}}function F(e){switch(e.kind){case`unbound`:return`unbound`;case`method_bound`:return{methodBound:{walletAuthMethodId:String(e.walletAuthMethodId)}};default:throw Error(`Unhandled custody envelope ownership: ${String(e)}`)}}function Ie(e){return{kind:`method_bound`,walletAuthMethodId:e}}function I(e){return{kind:`passkey`,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,kekVersion:M}}function L(e){return{kind:`email_otp`,enrollmentId:e.enrollmentId,enrollmentSealKeyVersion:e.enrollmentSealKeyVersion,kekVersion:N}}function R(e){return{kind:`voiceid`,deviceKeyId:e.deviceKeyId,kekVersion:P}}function z(e){return{state:`active`,activatedAtMs:e.activatedAtMs}}function Le(e){return{state:`retired`,activatedAtMs:e.activatedAtMs,retiredAtMs:e.retiredAtMs}}function Re(e){return{state:`revoked`,activatedAtMs:e.activatedAtMs,revokedAtMs:e.revokedAtMs}}function B(e){return{kind:`wallet_custody_envelope_v2`,envelopeId:e.envelopeId,walletId:e.walletId,ownership:e.ownership,binding:e.binding,factor:e.factor,envelopeVersion:j,envelopeRevision:e.envelopeRevision,nonceB64u:e.nonceB64u,sealedCustodySecretB64u:e.sealedCustodySecretB64u,ciphertextDigestB64u:e.ciphertextDigestB64u,aadHashB64u:e.aadHashB64u,lifecycle:e.lifecycle,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs}}const ze=[`state`,`activatedAtMs`,`retiredAtMs`,`revokedAtMs`];function Be(e,t=`lifecycle`){let n=u(e,t);g(n,ze,t);let r=_(n.activatedAtMs,`${t}.activatedAtMs`);switch(n.state){case`active`:if(n.retiredAtMs!==void 0||n.revokedAtMs!==void 0)throw Error(`${t} cannot be active and carry a retired or revoked timestamp`);return z({activatedAtMs:r});case`retired`:{if(n.revokedAtMs!==void 0)throw Error(`${t} cannot be retired and carry a revoked timestamp`);let e=_(n.retiredAtMs,`${t}.retiredAtMs`);if(e<r)throw Error(`${t}.retiredAtMs cannot precede activation`);return Le({activatedAtMs:r,retiredAtMs:e})}case`revoked`:{if(n.retiredAtMs!==void 0)throw Error(`${t} cannot be revoked and carry a retired timestamp`);let e=_(n.revokedAtMs,`${t}.revokedAtMs`);if(e<r)throw Error(`${t}.revokedAtMs cannot precede activation`);return Re({activatedAtMs:r,revokedAtMs:e})}default:throw Error(`${t}.state must be active, retired, or revoked`)}}const V=[`kind`,`rpId`,`credentialIdB64u`,`kekVersion`],H=[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`,`kekVersion`],U=[`kind`,`deviceKeyId`,`kekVersion`],W=Array.from(new Set([...V,...H,...U]));function G(e,t){if(typeof e!=`string`||!e.trim())throw Error(`${t} is required`);return e}function Ve(e,t=`factor`){let i=u(e,t);switch(i.kind){case`passkey`:{if(g(i,V,t,W),i.kekVersion!==M)throw Error(`${t}.kekVersion must be ${M}`);let e=r(i.rpId);if(!e.ok)throw Error(`${t}.rpId ${e.error.message}`);let a=n(i.credentialIdB64u);if(!a.ok)throw Error(`${t}.credentialIdB64u ${a.error.message}`);return I({rpId:e.value,credentialIdB64u:a.value})}case`email_otp`:if(g(i,H,t,W),i.kekVersion!==N)throw Error(`${t}.kekVersion must be ${N}`);return L({enrollmentId:G(i.enrollmentId,`${t}.enrollmentId`),enrollmentSealKeyVersion:G(i.enrollmentSealKeyVersion,`${t}.enrollmentSealKeyVersion`)});case`voiceid`:if(g(i,U,t,W),i.kekVersion!==P)throw Error(`${t}.kekVersion must be ${P}`);return R({deviceKeyId:h(i.deviceKeyId,`${t}.deviceKeyId`)});default:throw Error(`${t}.kind must be passkey, email_otp, or voiceid`)}}const He=[`kind`,`envelopeId`,`walletId`,`ownership`,`binding`,`factor`,`envelopeVersion`,`envelopeRevision`,`nonceB64u`,`sealedCustodySecretB64u`,`ciphertextDigestB64u`,`aadHashB64u`,`lifecycle`,`createdAtMs`,`updatedAtMs`];function Ue(e,t=`walletCustodyEnvelope`){let n=u(e,t);if(n.kind!==`wallet_custody_envelope_v2`)throw Error(`${t}.kind must be ${j}`);if(g(n,He,t),n.envelopeVersion!==`wallet_custody_envelope_v2`)throw Error(`${t}.envelopeVersion must be ${j}`);let r=ne(n.envelopeId);if(!r.ok)throw Error(`${t}.envelopeId ${r.error.message}`);let i=c(n.walletId);if(!i.ok)throw Error(`${t}.walletId ${i.error.message}`);let a=Ne(n.ownership,`${t}.ownership`),o=_(n.createdAtMs,`${t}.createdAtMs`),s=_(n.updatedAtMs,`${t}.updatedAtMs`);if(s<o)throw Error(`${t}.updatedAtMs cannot precede createdAtMs`);return B({envelopeId:r.value,walletId:i.value,ownership:a,binding:ke(n.binding,`${t}.binding`),factor:Ve(n.factor,`${t}.factor`),envelopeRevision:se(n.envelopeRevision,`${t}.envelopeRevision`),nonceB64u:ue(n.nonceB64u,`${t}.nonceB64u`),sealedCustodySecretB64u:le(n.sealedCustodySecretB64u,`${t}.sealedCustodySecretB64u`),ciphertextDigestB64u:h(n.ciphertextDigestB64u,`${t}.ciphertextDigestB64u`),aadHashB64u:h(n.aadHashB64u,`${t}.aadHashB64u`),lifecycle:Be(n.lifecycle,`${t}.lifecycle`),createdAtMs:o,updatedAtMs:s})}function We(e,t){return e.kind===t.kind?e.kind===`unbound`?!0:t.kind===`method_bound`&&String(e.walletAuthMethodId)===String(t.walletAuthMethodId):!1}function Ge(e){if(!e.establishedCustody)throw Error(`only a custody-establishing commit issues recovery codes`);return{...e,recoveryBackupAcknowledged:!0}}function Ke(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} walletCustody must be an object`);let n=e;switch(n.status){case`not_requested`:case`custody_already_established`:return{status:n.status};case`committed`:return{status:`committed`,issuedAtMs:_(n.issuedAtMs,`${t}.issuedAtMs`)};case`joined`:{let e=n.keyManifestDigestB64u;if(typeof e!=`string`||!e)throw Error(`${t} joined custody carries no key manifest digest`);return{status:`joined`,keyManifestDigestB64u:e}}case`rejected`:{let e=n.reason;if(typeof e!=`string`||!e)throw Error(`${t} rejected custody carries no reason`);return{status:`rejected`,reason:e}}default:throw Error(`${t} walletCustody status is unrecognised`)}}function qe(e){return String(e||``).trim()}function Je(e){return String(e||``).trim()}async function Ye(e){return ae(await f(p(e)))}async function Xe(e){return ae(await f(p(e)))}function Ze(e){let n=b(e);if(!n||!(`caller`in n))return null;let r=y(n.caller);if(r===`linked_device_ceremony`)return Object.prototype.hasOwnProperty.call(n,`source`)?null:{caller:`linked_device_ceremony`};if(r!==`same_device_addition`)return null;let a=b(`source`in n?n.source:void 0);if(!a)return null;let o=i(`walletAuthorityId`in a?a.walletAuthorityId:void 0),s=t(`walletAuthMethodId`in a?a.walletAuthMethodId:void 0),c=y(`authorityDigestB64u`in a?a.authorityDigestB64u:void 0),l=`revocationEpoch`in a?a.revocationEpoch:void 0;return!o.ok||!s.ok||!c||typeof l!=`number`||!Number.isSafeInteger(l)||l<0?null:{caller:`same_device_addition`,source:{walletAuthorityId:o.value,walletAuthMethodId:s.value,authorityDigestB64u:c,revocationEpoch:l}}}function Qe(e,t){return e.walletAuthorityId===t.walletAuthorityId&&e.walletAuthMethodId===t.walletAuthMethodId&&e.authorityDigestB64u===t.authorityDigestB64u&&e.revocationEpoch===t.revocationEpoch}function K(e,t,n,r=[]){let i=b(e);if(!i)throw Error(t+` must be an object`);let a=new Set([...n,...r]),o=Object.keys(i);if(o.length<n.length||o.length>a.size)throw Error(t+` has invalid fields`);for(let e of n)if(!Object.prototype.hasOwnProperty.call(i,e))throw Error(t+`.`+e+` is required`);for(let e of o)if(!a.has(e))throw Error(t+` has invalid fields`);return i}function q(e,t,n){if(!Object.prototype.hasOwnProperty.call(e,t))throw Error(n+`.`+t+` is required`);return Reflect.get(e,t)}function J(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function Y(e,t,n){let r=q(e,t,n);if(typeof r!=`string`||r.length===0||r.trim()!==r)throw Error(n+`.`+t+` must be a non-empty canonical string`);return r}function X(e,t,n,r){let i=q(e,t,n);if(typeof i!=`number`||!Number.isSafeInteger(i)||i<r)throw Error(n+`.`+t+` must be a safe integer`);return i}function Z(e,t){if(!Array.isArray(e))throw Error(t+` must be an array`);return e}function Q(e,t,n){let r=Z(q(e,t,n),n+`.`+t);if(r.length===0)throw Error(n+`.`+t+` must not be empty`);let i=[];for(let e=0;e<r.length;e+=1){let a=r[e];if(typeof a!=`number`||!Number.isSafeInteger(a)||a<1)throw Error(n+`.`+t+`[`+e+`] must be a positive safe integer`);i.push(a)}return i}function $(e,t,n){return J(e,t)?Y(e,t,n):void 0}function $e(e,t=`addSignerIntent.signerSelection.ecdsa.chainTarget`){try{let n=K(e,t,[`kind`],[`namespace`,`chainId`,`networkSlug`]);switch(Y(n,`kind`,t)){case`evm`:{let e=K(n,t,[`kind`,`namespace`,`chainId`],[`networkSlug`]);if(Y(e,`namespace`,t)!==`eip155`)return null;let r=X(e,`chainId`,t,1),i=$(e,`networkSlug`,t);return i===void 0?{kind:`evm`,namespace:`eip155`,chainId:r}:{kind:`evm`,namespace:`eip155`,chainId:r,networkSlug:i}}case`tempo`:{let e=K(n,t,[`kind`,`chainId`],[`networkSlug`]),r=X(e,`chainId`,t,1),i=$(e,`networkSlug`,t);return i===void 0?{kind:`tempo`,chainId:r}:{kind:`tempo`,chainId:r,networkSlug:i}}default:return null}}catch{return null}}function et(e){let t=`addSignerIntent.signerSelection`,n=K(e,t,[`mode`],[`ed25519`,`ecdsa`]);switch(Y(n,`mode`,t)){case`ed25519`:{let e=K(q(K(n,t,[`mode`,`ed25519`]),`ed25519`,t),t+`.ed25519`,[`mode`,`signerSlot`,`participantIds`,`keyPurpose`,`keyVersion`,`derivationVersion`]);if(Y(e,`mode`,t+`.ed25519`)!==`create_implicit_near_account`)throw Error(t+`.ed25519.mode is unsupported`);X(e,`signerSlot`,t+`.ed25519`,1),Q(e,`participantIds`,t+`.ed25519`),Y(e,`keyPurpose`,t+`.ed25519`),Y(e,`keyVersion`,t+`.ed25519`),X(e,`derivationVersion`,t+`.ed25519`,1);break}case`ecdsa`:{let e=K(q(K(n,t,[`mode`,`ecdsa`]),`ecdsa`,t),t+`.ecdsa`,[`chainTargets`,`participantIds`]),r=Z(q(e,`chainTargets`,t+`.ecdsa`),t+`.ecdsa.chainTargets`);if(r.length===0)throw Error(t+`.ecdsa.chainTargets must not be empty`);for(let e of r)if(!$e(e))throw Error(t+`.ecdsa.chainTargets contains an invalid target`);Q(e,`participantIds`,t+`.ecdsa`);break}default:throw Error(t+`.mode is unsupported`)}let r=he(e,{normalizeEcdsaChainTarget:$e});if(!r.ok)throw Error(r.message);return r.value}function tt(e){let t=`addAuthMethodIntent.authMethod`,n=K(e,t,[`kind`],[`rpId`,`email`]);switch(Y(n,`kind`,t)){case`passkey`:{let e=r(Y(K(n,t,[`kind`,`rpId`]),`rpId`,t));if(!e.ok)throw Error(e.error.message);break}case`email_otp`:Y(K(n,t,[`kind`,`email`]),`email`,t);break;default:throw Error(t+`.kind is unsupported`)}let i=pe(e);if(!i)throw Error(t+` is invalid`);return i}function nt(e){let n=`addAuthMethodIntent.source`,r=K(e,n,[`walletAuthorityId`,`walletAuthMethodId`,`authorityDigestB64u`,`revocationEpoch`]),a=i(Y(r,`walletAuthorityId`,n)),o=t(Y(r,`walletAuthMethodId`,n));if(!a.ok||!o.ok)throw Error(n+` has invalid identity`);Y(r,`authorityDigestB64u`,n),X(r,`revocationEpoch`,n,0)}function rt(e,t){if(!J(e,`runtimePolicyScope`))return;let n=t+`.runtimePolicyScope`,r=K(q(e,`runtimePolicyScope`,t),n,[`orgId`,`projectId`,`envId`],[`signingRootVersion`]),i=Y(r,`orgId`,n),a=Y(r,`projectId`,n),o=Y(r,`envId`,n),s=$(r,`signingRootVersion`,n);return s===void 0?{orgId:i,projectId:a,envId:o}:{orgId:i,projectId:a,envId:o,signingRootVersion:s}}function it(e,t){let n=c(Y(e,`walletId`,t));if(!n.ok)throw Error(n.error.message);return n.value}function at(e,n,r){let i=t(Y(e,n,r));if(!i.ok)throw Error(i.error.message);return i.value}function ot(e){let t=`addSignerIntent`,n=K(e,t,[`version`,`walletId`,`signerSelection`,`nonceB64u`],[`runtimePolicyScope`]);if(Y(n,`version`,t)!==`add_signer_intent_v1`)throw Error(t+`.version is unsupported`);let r=it(n,t),i=rt(n,t),a=Y(n,`nonceB64u`,t),o=et(q(n,`signerSelection`,t));return i===void 0?{version:`add_signer_intent_v1`,walletId:r,signerSelection:o,nonceB64u:a}:{version:`add_signer_intent_v1`,walletId:r,signerSelection:o,runtimePolicyScope:i,nonceB64u:a}}function st(e){let t=`addAuthMethodIntent`,n=K(e,t,[`version`,`walletId`,`authMethod`,`targetWalletAuthMethodId`,`caller`,`nonceB64u`],[`runtimePolicyScope`,`source`]);if(Y(n,`version`,t)!==`add_auth_method_intent_v1`)throw Error(t+`.version is unsupported`);let r=it(n,t),i=at(n,`targetWalletAuthMethodId`,t),a=tt(q(n,`authMethod`,t)),o=rt(n,t),s=Y(n,`nonceB64u`,t);switch(Y(n,`caller`,t)){case`same_device_addition`:nt(q(n,`source`,t));break;case`linked_device_ceremony`:if(J(n,`source`))throw Error(t+`.source is not valid for linked_device_ceremony`);break;default:throw Error(t+`.caller is unsupported`)}let c=Ze(n);if(!c)throw Error(t+`.caller is invalid`);let l=o===void 0?{version:`add_auth_method_intent_v1`,walletId:r,authMethod:a,targetWalletAuthMethodId:i,nonceB64u:s}:{version:`add_auth_method_intent_v1`,walletId:r,authMethod:a,targetWalletAuthMethodId:i,runtimePolicyScope:o,nonceB64u:s};switch(c.caller){case`same_device_addition`:return{...l,caller:c.caller,source:c.source};case`linked_device_ceremony`:return{...l,caller:c.caller};default:return ct(c)}}function ct(e){throw Error(`Unsupported add-auth-method intent caller: ${String(e)}`)}function lt(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(!Number.isSafeInteger(e[n])||e[n]!==t[n])return!1;return!0}function ut(e,t){switch(e.kind){case`evm`:return t.kind===`evm`&&e.namespace===t.namespace&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;case`tempo`:return t.kind===`tempo`&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;default:return dt(e)}}function dt(e){throw Error(`Unsupported add-signer chain target: ${String(e)}`)}function ft(e,t){if(e.mode!==t.mode)return!1;switch(e.mode){case`ed25519`:return t.mode===`ed25519`&&e.ed25519.mode===t.ed25519.mode&&e.ed25519.signerSlot===t.ed25519.signerSlot&&lt(e.ed25519.participantIds,t.ed25519.participantIds)&&e.ed25519.keyPurpose===t.ed25519.keyPurpose&&e.ed25519.keyVersion===t.ed25519.keyVersion&&e.ed25519.derivationVersion===t.ed25519.derivationVersion;case`ecdsa`:if(t.mode!==`ecdsa`||e.ecdsa.chainTargets.length!==t.ecdsa.chainTargets.length)return!1;for(let n=0;n<e.ecdsa.chainTargets.length;n+=1)if(!ut(e.ecdsa.chainTargets[n],t.ecdsa.chainTargets[n]))return!1;return lt(e.ecdsa.participantIds,t.ecdsa.participantIds);default:return pt(e)}}function pt(e){throw Error(`Unsupported add-signer selection: ${String(e)}`)}function mt(e,t){return e===void 0||t===void 0?e===t:e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function ht(e,t){return e.version===t.version&&e.walletId===t.walletId&&ft(e.signerSelection,t.signerSelection)&&mt(e.runtimePolicyScope,t.runtimePolicyScope)&&e.nonceB64u===t.nonceB64u}function gt(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId;case`email_otp`:return t.kind===`email_otp`&&e.email===t.email;default:return _t(e)}}function _t(e){throw Error(`Unsupported add-auth-method input: ${String(e)}`)}function vt(e,t){if(e.version!==t.version||e.walletId!==t.walletId||!gt(e.authMethod,t.authMethod)||e.targetWalletAuthMethodId!==t.targetWalletAuthMethodId||!mt(e.runtimePolicyScope,t.runtimePolicyScope)||e.nonceB64u!==t.nonceB64u)return!1;switch(e.caller){case`same_device_addition`:return t.caller===`same_device_addition`&&Qe(e.source,t.source);case`linked_device_ceremony`:return t.caller===`linked_device_ceremony`;default:return yt(e)}}function yt(e){throw Error(`Unsupported add-auth-method intent: ${String(e)}`)}export{We as C,w as D,xe as E,be as O,Fe as S,E as T,R as _,st as a,je as b,ht as c,j as d,z as f,I as g,B as h,Ye as i,ve as k,Ke as l,Ie as m,Je as n,ot as o,L as p,Xe as r,vt as s,qe as t,Ge as u,Pe as v,D as w,Ue as x,F as y};
+import{A as e,E as t,M as n,N as r,O as i,S as a,d as o,f as s,k as c,l,u as ee,x as te,y as ne}from"./domainIds-t1lp25yU.js";import{S as u,b as d,g as re,i as ie,r as f,t as p}from"./digests-BIaE0DMd.js";import{i as ae}from"./base64-BmKR3UqU.js";import{n as oe}from"./secureRandomId-8LSc91aN.js";import{A as se,D as m,E as h,J as g,M as ce,N as _,O as le,k as ue}from"./activeWalletSession-HAOgRKzn.js";import{a as v,n as de}from"./presignatures-B9KnQyfE.js";import{kt as fe}from"./digestEncoding-Rx8Vjy4J.js";import{i as y,n as pe,t as b}from"./registrationAuthMethodInput-C4o7yFBJ.js";import{a as me}from"./signerSlot-BlijMq8C.js";import{a as he}from"./registrationSignerPlan-CeMidFme.js";function ge(e){return typeof e==`string`&&/^wreg_[A-Za-z0-9_-]{43}$/u.test(e)?e:null}function _e(){return`wreg_${oe(32)}`}const x=`wallet_registration_setup:`;function S(e,t){return`${x}${e}:${t}`}function C(e){if(!re(e)||!re(e.value))throw Error(`Registration setup journal is invalid`);let t=e.value,n=d(t.scopeDigest,`Registration setup scope digest`),r=d(t.requestDigest,`Registration setup request digest`),i=ge(t.operationId);if(!i||!/^[a-f0-9]{64}$/u.test(n)||!/^[a-f0-9]{64}$/u.test(r)||e.key!==S(n,r))throw Error(`Registration setup journal scope is invalid`);if(t.state===`pending`&&!(`walletId`in t)&&!(`registrationCeremonyId`in t))return{state:`pending`,operationId:i,scopeDigest:n,requestDigest:r};if(t.state===`accepted`){let e=c(t.walletId);if(e.ok)return{state:`accepted`,operationId:i,scopeDigest:n,requestDigest:r,walletId:e.value,registrationCeremonyId:d(t.registrationCeremonyId,`Registration setup ceremony`)}}throw Error(`Registration setup journal state is invalid`)}async function ve(e){return ie(p({relayerUrl:e.relayerUrl.replace(/\/+$/u,``),publishableKey:e.publishableKey,environmentId:e.environmentId}))}function ye(){}var w=class{constructor(e){this.manager=e}async begin(e,t){let n=await ie(p(t)),r=S(e,n),i={state:`pending`,operationId:_e(),scopeDigest:e,requestDigest:n},a=(await this.manager.getDB()).transaction(v.appState,`readwrite`),o=await a.store.get(r),s=o===void 0?i:C(o);return o===void 0&&await a.store.put({key:r,value:s}),await a.done,s}async accept(e,t){let n=S(e.scopeDigest,e.requestDigest),r=(await this.manager.getDB()).transaction(v.appState,`readwrite`),i=C(await r.store.get(n));if(i.operationId!==e.operationId||i.state===`accepted`&&(i.walletId!==t.walletId||i.registrationCeremonyId!==t.registrationCeremonyId))throw r.abort(),await r.done.catch(ye),Error(`Registration setup response changed its operation, wallet or ceremony`);let a={state:`accepted`,operationId:i.operationId,scopeDigest:i.scopeDigest,requestDigest:i.requestDigest,walletId:t.walletId,registrationCeremonyId:t.registrationCeremonyId};await r.store.put({key:n,value:a}),await r.done}async complete(e){let t=(await this.manager.getDB()).transaction(v.appState,`readwrite`),n=(await t.store.getAll(IDBKeyRange.bound(x,`${x}\uffff`))).map(C);for(let r of n)r.state===`accepted`&&r.walletId===e.walletId&&r.registrationCeremonyId===e.registrationCeremonyId&&await t.store.delete(S(r.scopeDigest,r.requestDigest));await t.done}};const be=new w(de),T=`wallet_seed_parallel_hkdf_sha256_v1`;function xe(e){return e.kind===`wallet_custody_seed_v1`}function E(){return{kind:`wallet_custody_seed_v1`,derivationScheme:T}}function D(e){return{kind:`ed25519_yao_client_root_v1`,linkSessionId:e.linkSessionId,walletKeyId:e.walletKeyId,targetFactor:e.targetFactor,applicationBindingDigestB64u:e.applicationBindingDigestB64u,registeredPublicKeyB64u:e.registeredPublicKeyB64u,enrollmentId:e.enrollmentId,deviceId:e.deviceId,revocationEpoch:e.revocationEpoch}}function Se(e){return{kind:`ed25519_lane_holder_share_v1`,walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,nearEd25519SigningKeyId:e.nearEd25519SigningKeyId,registeredPublicKeyB64u:e.registeredPublicKeyB64u,participantBindingDigestB64u:e.participantBindingDigestB64u}}function Ce(e){return{kind:`ecdsa_lane_holder_share_v1`,walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,evmFamilySigningKeySlotId:e.evmFamilySigningKeySlotId,thresholdSessionId:e.thresholdSessionId,thresholdPublicKey33B64u:e.thresholdPublicKey33B64u}}const O=[`kind`,`walletKeyId`,`laneId`,`laneShareEpoch`],k={wallet_custody_seed_v1:[`kind`,`derivationScheme`],ed25519_yao_client_root_v1:[`kind`,`linkSessionId`,`walletKeyId`,`targetFactor`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`enrollmentId`,`deviceId`,`revocationEpoch`],ed25519_lane_holder_share_v1:[...O,`nearEd25519SigningKeyId`,`registeredPublicKeyB64u`,`participantBindingDigestB64u`],ecdsa_lane_holder_share_v1:[...O,`evmFamilySigningKeySlotId`,`thresholdSessionId`,`thresholdPublicKey33B64u`]},we=Array.from(new Set(Object.values(k).flat()));function Te(e,t){if(e===`wallet_custody_seed_v1`||e===`ed25519_yao_client_root_v1`||e===`ed25519_lane_holder_share_v1`||e===`ecdsa_lane_holder_share_v1`)return e;throw Error(`${t}.kind must be a known passkey custody secret kind`)}function Ee(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function De(e,t){let n=u(e,t);if(g(n,[`kind`],t),n.kind===`passkey_prf`||n.kind===`email_otp`)return{kind:n.kind};throw Error(`${t}.kind must be passkey_prf or email_otp`)}function A(t,n){let r=e(t.walletKeyId);if(!r.ok)throw Error(`${n}.walletKeyId ${r.error.message}`);let i=te(t.laneId);if(!i.ok)throw Error(`${n}.laneId ${i.error.message}`);let a=l(t.laneShareEpoch);if(!a.ok)throw Error(`${n}.laneShareEpoch ${a.error.message}`);return{walletKeyId:r.value,laneId:i.value,laneShareEpoch:a.value}}function Oe(e,t){let n=a(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function ke(t,n=`passkeyCustodySecretBinding`){let r=u(t,n),i=Te(r.kind,n);switch(g(r,k[i],n,we),i){case`wallet_custody_seed_v1`:if(r.derivationScheme!==T)throw Error(`${n}.derivationScheme must be ${T}`);return E();case`ed25519_yao_client_root_v1`:{let t=ee(r.linkSessionId);if(!t.ok)throw Error(`${n}.linkSessionId ${t.error.message}`);let i=e(r.walletKeyId);if(!i.ok)throw Error(`${n}.walletKeyId ${i.error.message}`);let a=o(r.enrollmentId);if(!a.ok)throw Error(`${n}.enrollmentId ${a.error.message}`);let c=s(r.deviceId);if(!c.ok)throw Error(`${n}.deviceId ${c.error.message}`);return D({linkSessionId:t.value,walletKeyId:i.value,targetFactor:De(r.targetFactor,`${n}.targetFactor`),applicationBindingDigestB64u:h(r.applicationBindingDigestB64u,`${n}.applicationBindingDigestB64u`),registeredPublicKeyB64u:m(r.registeredPublicKeyB64u,`${n}.registeredPublicKeyB64u`),enrollmentId:a.value,deviceId:c.value,revocationEpoch:Ee(r.revocationEpoch,`${n}.revocationEpoch`)})}case`ed25519_lane_holder_share_v1`:{let e=A(r,n);return Se({walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,nearEd25519SigningKeyId:me(r.nearEd25519SigningKeyId),registeredPublicKeyB64u:m(r.registeredPublicKeyB64u,`${n}.registeredPublicKeyB64u`),participantBindingDigestB64u:h(r.participantBindingDigestB64u,`${n}.participantBindingDigestB64u`)})}case`ecdsa_lane_holder_share_v1`:{let e=A(r,n);return Ce({walletKeyId:e.walletKeyId,laneId:e.laneId,laneShareEpoch:e.laneShareEpoch,evmFamilySigningKeySlotId:fe(r.evmFamilySigningKeySlotId,`${n}.evmFamilySigningKeySlotId`),thresholdSessionId:Oe(r.thresholdSessionId,`${n}.thresholdSessionId`),thresholdPublicKey33B64u:ce(r.thresholdPublicKey33B64u,`${n}.thresholdPublicKey33B64u`)})}}}const j=`wallet_custody_envelope_v2`,M=`passkey_prf_kek_hkdf_sha256_v1`,N=`email_otp_factor_kek_hkdf_sha256_v1`,P=`voiceid_device_factor_kek_hkdf_sha256_v1`;function Ae(e){return e.ownership.kind===`method_bound`&&e.binding.kind===`wallet_custody_seed_v1`&&e.lifecycle.state===`active`}function je(e){return Ae(e)&&e.factor.kind===`voiceid`}const Me=[`kind`,`walletAuthMethodId`];function Ne(e,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be an object`);let r=e;switch(g(r,Me,n),r.kind){case`unbound`:if(r.walletAuthMethodId!==void 0)throw Error(`${n}.walletAuthMethodId belongs to the method_bound branch`);return{kind:`unbound`};case`method_bound`:{let e=t(r.walletAuthMethodId);if(!e.ok)throw Error(`${n}.walletAuthMethodId ${e.error.message}`);return{kind:`method_bound`,walletAuthMethodId:e.value}}default:throw Error(`${n}.kind must be unbound or method_bound`)}}function Pe(e){return JSON.stringify({walletId:e.walletId,envelopeId:e.envelopeId,factor:e.factor,envelopeRevision:e.envelopeRevision,binding:e.binding,ownership:F(e.ownership)})}function Fe(e,n){if(e===`unbound`)return{kind:`unbound`};if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be "unbound" or a methodBound object`);let r=e;g(r,[`methodBound`],n);let i=r.methodBound;if(typeof i!=`object`||!i||Array.isArray(i))throw Error(`${n}.methodBound must be an object`);let a=i;g(a,[`walletAuthMethodId`],`${n}.methodBound`);let o=t(a.walletAuthMethodId);if(!o.ok)throw Error(`${n}.methodBound.walletAuthMethodId ${o.error.message}`);return{kind:`method_bound`,walletAuthMethodId:o.value}}function F(e){switch(e.kind){case`unbound`:return`unbound`;case`method_bound`:return{methodBound:{walletAuthMethodId:String(e.walletAuthMethodId)}};default:throw Error(`Unhandled custody envelope ownership: ${String(e)}`)}}function Ie(e){return{kind:`method_bound`,walletAuthMethodId:e}}function I(e){return{kind:`passkey`,rpId:e.rpId,credentialIdB64u:e.credentialIdB64u,kekVersion:M}}function L(e){return{kind:`email_otp`,enrollmentId:e.enrollmentId,enrollmentSealKeyVersion:e.enrollmentSealKeyVersion,kekVersion:N}}function R(e){return{kind:`voiceid`,deviceKeyId:e.deviceKeyId,kekVersion:P}}function z(e){return{state:`active`,activatedAtMs:e.activatedAtMs}}function Le(e){return{state:`retired`,activatedAtMs:e.activatedAtMs,retiredAtMs:e.retiredAtMs}}function Re(e){return{state:`revoked`,activatedAtMs:e.activatedAtMs,revokedAtMs:e.revokedAtMs}}function B(e){return{kind:`wallet_custody_envelope_v2`,envelopeId:e.envelopeId,walletId:e.walletId,ownership:e.ownership,binding:e.binding,factor:e.factor,envelopeVersion:j,envelopeRevision:e.envelopeRevision,nonceB64u:e.nonceB64u,sealedCustodySecretB64u:e.sealedCustodySecretB64u,ciphertextDigestB64u:e.ciphertextDigestB64u,aadHashB64u:e.aadHashB64u,lifecycle:e.lifecycle,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs}}const ze=[`state`,`activatedAtMs`,`retiredAtMs`,`revokedAtMs`];function Be(e,t=`lifecycle`){let n=u(e,t);g(n,ze,t);let r=_(n.activatedAtMs,`${t}.activatedAtMs`);switch(n.state){case`active`:if(n.retiredAtMs!==void 0||n.revokedAtMs!==void 0)throw Error(`${t} cannot be active and carry a retired or revoked timestamp`);return z({activatedAtMs:r});case`retired`:{if(n.revokedAtMs!==void 0)throw Error(`${t} cannot be retired and carry a revoked timestamp`);let e=_(n.retiredAtMs,`${t}.retiredAtMs`);if(e<r)throw Error(`${t}.retiredAtMs cannot precede activation`);return Le({activatedAtMs:r,retiredAtMs:e})}case`revoked`:{if(n.retiredAtMs!==void 0)throw Error(`${t} cannot be revoked and carry a retired timestamp`);let e=_(n.revokedAtMs,`${t}.revokedAtMs`);if(e<r)throw Error(`${t}.revokedAtMs cannot precede activation`);return Re({activatedAtMs:r,revokedAtMs:e})}default:throw Error(`${t}.state must be active, retired, or revoked`)}}const V=[`kind`,`rpId`,`credentialIdB64u`,`kekVersion`],H=[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`,`kekVersion`],U=[`kind`,`deviceKeyId`,`kekVersion`],W=Array.from(new Set([...V,...H,...U]));function G(e,t){if(typeof e!=`string`||!e.trim())throw Error(`${t} is required`);return e}function Ve(e,t=`factor`){let i=u(e,t);switch(i.kind){case`passkey`:{if(g(i,V,t,W),i.kekVersion!==M)throw Error(`${t}.kekVersion must be ${M}`);let e=r(i.rpId);if(!e.ok)throw Error(`${t}.rpId ${e.error.message}`);let a=n(i.credentialIdB64u);if(!a.ok)throw Error(`${t}.credentialIdB64u ${a.error.message}`);return I({rpId:e.value,credentialIdB64u:a.value})}case`email_otp`:if(g(i,H,t,W),i.kekVersion!==N)throw Error(`${t}.kekVersion must be ${N}`);return L({enrollmentId:G(i.enrollmentId,`${t}.enrollmentId`),enrollmentSealKeyVersion:G(i.enrollmentSealKeyVersion,`${t}.enrollmentSealKeyVersion`)});case`voiceid`:if(g(i,U,t,W),i.kekVersion!==P)throw Error(`${t}.kekVersion must be ${P}`);return R({deviceKeyId:h(i.deviceKeyId,`${t}.deviceKeyId`)});default:throw Error(`${t}.kind must be passkey, email_otp, or voiceid`)}}const He=[`kind`,`envelopeId`,`walletId`,`ownership`,`binding`,`factor`,`envelopeVersion`,`envelopeRevision`,`nonceB64u`,`sealedCustodySecretB64u`,`ciphertextDigestB64u`,`aadHashB64u`,`lifecycle`,`createdAtMs`,`updatedAtMs`];function Ue(e,t=`walletCustodyEnvelope`){let n=u(e,t);if(n.kind!==`wallet_custody_envelope_v2`)throw Error(`${t}.kind must be ${j}`);if(g(n,He,t),n.envelopeVersion!==`wallet_custody_envelope_v2`)throw Error(`${t}.envelopeVersion must be ${j}`);let r=ne(n.envelopeId);if(!r.ok)throw Error(`${t}.envelopeId ${r.error.message}`);let i=c(n.walletId);if(!i.ok)throw Error(`${t}.walletId ${i.error.message}`);let a=Ne(n.ownership,`${t}.ownership`),o=_(n.createdAtMs,`${t}.createdAtMs`),s=_(n.updatedAtMs,`${t}.updatedAtMs`);if(s<o)throw Error(`${t}.updatedAtMs cannot precede createdAtMs`);return B({envelopeId:r.value,walletId:i.value,ownership:a,binding:ke(n.binding,`${t}.binding`),factor:Ve(n.factor,`${t}.factor`),envelopeRevision:se(n.envelopeRevision,`${t}.envelopeRevision`),nonceB64u:ue(n.nonceB64u,`${t}.nonceB64u`),sealedCustodySecretB64u:le(n.sealedCustodySecretB64u,`${t}.sealedCustodySecretB64u`),ciphertextDigestB64u:h(n.ciphertextDigestB64u,`${t}.ciphertextDigestB64u`),aadHashB64u:h(n.aadHashB64u,`${t}.aadHashB64u`),lifecycle:Be(n.lifecycle,`${t}.lifecycle`),createdAtMs:o,updatedAtMs:s})}function We(e,t){return e.kind===t.kind?e.kind===`unbound`?!0:t.kind===`method_bound`&&String(e.walletAuthMethodId)===String(t.walletAuthMethodId):!1}function Ge(e){if(!e.establishedCustody)throw Error(`only a custody-establishing commit issues recovery codes`);return{...e,recoveryBackupAcknowledged:!0}}function Ke(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} walletCustody must be an object`);let n=e;switch(n.status){case`not_requested`:case`custody_already_established`:return{status:n.status};case`committed`:return{status:`committed`,issuedAtMs:_(n.issuedAtMs,`${t}.issuedAtMs`)};case`joined`:{let e=n.keyManifestDigestB64u;if(typeof e!=`string`||!e)throw Error(`${t} joined custody carries no key manifest digest`);return{status:`joined`,keyManifestDigestB64u:e}}case`rejected`:{let e=n.reason;if(typeof e!=`string`||!e)throw Error(`${t} rejected custody carries no reason`);return{status:`rejected`,reason:e}}default:throw Error(`${t} walletCustody status is unrecognised`)}}function qe(e){return String(e||``).trim()}function Je(e){return String(e||``).trim()}async function Ye(e){return ae(await f(p(e)))}async function Xe(e){return ae(await f(p(e)))}function Ze(e){let n=b(e);if(!n||!(`caller`in n))return null;let r=y(n.caller);if(r===`linked_device_ceremony`)return Object.prototype.hasOwnProperty.call(n,`source`)?null:{caller:`linked_device_ceremony`};if(r!==`same_device_addition`)return null;let a=b(`source`in n?n.source:void 0);if(!a)return null;let o=i(`walletAuthorityId`in a?a.walletAuthorityId:void 0),s=t(`walletAuthMethodId`in a?a.walletAuthMethodId:void 0),c=y(`authorityDigestB64u`in a?a.authorityDigestB64u:void 0),l=`revocationEpoch`in a?a.revocationEpoch:void 0;return!o.ok||!s.ok||!c||typeof l!=`number`||!Number.isSafeInteger(l)||l<0?null:{caller:`same_device_addition`,source:{walletAuthorityId:o.value,walletAuthMethodId:s.value,authorityDigestB64u:c,revocationEpoch:l}}}function Qe(e,t){return e.walletAuthorityId===t.walletAuthorityId&&e.walletAuthMethodId===t.walletAuthMethodId&&e.authorityDigestB64u===t.authorityDigestB64u&&e.revocationEpoch===t.revocationEpoch}function K(e,t,n,r=[]){let i=b(e);if(!i)throw Error(t+` must be an object`);let a=new Set([...n,...r]),o=Object.keys(i);if(o.length<n.length||o.length>a.size)throw Error(t+` has invalid fields`);for(let e of n)if(!Object.prototype.hasOwnProperty.call(i,e))throw Error(t+`.`+e+` is required`);for(let e of o)if(!a.has(e))throw Error(t+` has invalid fields`);return i}function q(e,t,n){if(!Object.prototype.hasOwnProperty.call(e,t))throw Error(n+`.`+t+` is required`);return Reflect.get(e,t)}function J(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function Y(e,t,n){let r=q(e,t,n);if(typeof r!=`string`||r.length===0||r.trim()!==r)throw Error(n+`.`+t+` must be a non-empty canonical string`);return r}function X(e,t,n,r){let i=q(e,t,n);if(typeof i!=`number`||!Number.isSafeInteger(i)||i<r)throw Error(n+`.`+t+` must be a safe integer`);return i}function Z(e,t){if(!Array.isArray(e))throw Error(t+` must be an array`);return e}function Q(e,t,n){let r=Z(q(e,t,n),n+`.`+t);if(r.length===0)throw Error(n+`.`+t+` must not be empty`);let i=[];for(let e=0;e<r.length;e+=1){let a=r[e];if(typeof a!=`number`||!Number.isSafeInteger(a)||a<1)throw Error(n+`.`+t+`[`+e+`] must be a positive safe integer`);i.push(a)}return i}function $(e,t,n){return J(e,t)?Y(e,t,n):void 0}function $e(e,t=`addSignerIntent.signerSelection.ecdsa.chainTarget`){try{let n=K(e,t,[`kind`],[`namespace`,`chainId`,`networkSlug`]);switch(Y(n,`kind`,t)){case`evm`:{let e=K(n,t,[`kind`,`namespace`,`chainId`],[`networkSlug`]);if(Y(e,`namespace`,t)!==`eip155`)return null;let r=X(e,`chainId`,t,1),i=$(e,`networkSlug`,t);return i===void 0?{kind:`evm`,namespace:`eip155`,chainId:r}:{kind:`evm`,namespace:`eip155`,chainId:r,networkSlug:i}}case`tempo`:{let e=K(n,t,[`kind`,`chainId`],[`networkSlug`]),r=X(e,`chainId`,t,1),i=$(e,`networkSlug`,t);return i===void 0?{kind:`tempo`,chainId:r}:{kind:`tempo`,chainId:r,networkSlug:i}}default:return null}}catch{return null}}function et(e){let t=`addSignerIntent.signerSelection`,n=K(e,t,[`mode`],[`ed25519`,`ecdsa`]);switch(Y(n,`mode`,t)){case`ed25519`:{let e=K(q(K(n,t,[`mode`,`ed25519`]),`ed25519`,t),t+`.ed25519`,[`mode`,`signerSlot`,`participantIds`,`keyPurpose`,`keyVersion`,`derivationVersion`]);if(Y(e,`mode`,t+`.ed25519`)!==`create_implicit_near_account`)throw Error(t+`.ed25519.mode is unsupported`);X(e,`signerSlot`,t+`.ed25519`,1),Q(e,`participantIds`,t+`.ed25519`),Y(e,`keyPurpose`,t+`.ed25519`),Y(e,`keyVersion`,t+`.ed25519`),X(e,`derivationVersion`,t+`.ed25519`,1);break}case`ecdsa`:{let e=K(q(K(n,t,[`mode`,`ecdsa`]),`ecdsa`,t),t+`.ecdsa`,[`chainTargets`,`participantIds`]),r=Z(q(e,`chainTargets`,t+`.ecdsa`),t+`.ecdsa.chainTargets`);if(r.length===0)throw Error(t+`.ecdsa.chainTargets must not be empty`);for(let e of r)if(!$e(e))throw Error(t+`.ecdsa.chainTargets contains an invalid target`);Q(e,`participantIds`,t+`.ecdsa`);break}default:throw Error(t+`.mode is unsupported`)}let r=he(e,{normalizeEcdsaChainTarget:$e});if(!r.ok)throw Error(r.message);return r.value}function tt(e){let t=`addAuthMethodIntent.authMethod`,n=K(e,t,[`kind`],[`rpId`,`email`]);switch(Y(n,`kind`,t)){case`passkey`:{let e=r(Y(K(n,t,[`kind`,`rpId`]),`rpId`,t));if(!e.ok)throw Error(e.error.message);break}case`email_otp`:Y(K(n,t,[`kind`,`email`]),`email`,t);break;default:throw Error(t+`.kind is unsupported`)}let i=pe(e);if(!i)throw Error(t+` is invalid`);return i}function nt(e){let n=`addAuthMethodIntent.source`,r=K(e,n,[`walletAuthorityId`,`walletAuthMethodId`,`authorityDigestB64u`,`revocationEpoch`]),a=i(Y(r,`walletAuthorityId`,n)),o=t(Y(r,`walletAuthMethodId`,n));if(!a.ok||!o.ok)throw Error(n+` has invalid identity`);Y(r,`authorityDigestB64u`,n),X(r,`revocationEpoch`,n,0)}function rt(e,t){if(!J(e,`runtimePolicyScope`))return;let n=t+`.runtimePolicyScope`,r=K(q(e,`runtimePolicyScope`,t),n,[`orgId`,`projectId`,`envId`],[`signingRootVersion`]),i=Y(r,`orgId`,n),a=Y(r,`projectId`,n),o=Y(r,`envId`,n),s=$(r,`signingRootVersion`,n);return s===void 0?{orgId:i,projectId:a,envId:o}:{orgId:i,projectId:a,envId:o,signingRootVersion:s}}function it(e,t){let n=c(Y(e,`walletId`,t));if(!n.ok)throw Error(n.error.message);return n.value}function at(e,n,r){let i=t(Y(e,n,r));if(!i.ok)throw Error(i.error.message);return i.value}function ot(e){let t=`addSignerIntent`,n=K(e,t,[`version`,`walletId`,`signerSelection`,`nonceB64u`],[`runtimePolicyScope`]);if(Y(n,`version`,t)!==`add_signer_intent_v1`)throw Error(t+`.version is unsupported`);let r=it(n,t),i=rt(n,t),a=Y(n,`nonceB64u`,t),o=et(q(n,`signerSelection`,t));return i===void 0?{version:`add_signer_intent_v1`,walletId:r,signerSelection:o,nonceB64u:a}:{version:`add_signer_intent_v1`,walletId:r,signerSelection:o,runtimePolicyScope:i,nonceB64u:a}}function st(e){let t=`addAuthMethodIntent`,n=K(e,t,[`version`,`walletId`,`authMethod`,`targetWalletAuthMethodId`,`caller`,`nonceB64u`],[`runtimePolicyScope`,`source`]);if(Y(n,`version`,t)!==`add_auth_method_intent_v1`)throw Error(t+`.version is unsupported`);let r=it(n,t),i=at(n,`targetWalletAuthMethodId`,t),a=tt(q(n,`authMethod`,t)),o=rt(n,t),s=Y(n,`nonceB64u`,t);switch(Y(n,`caller`,t)){case`same_device_addition`:nt(q(n,`source`,t));break;case`linked_device_ceremony`:if(J(n,`source`))throw Error(t+`.source is not valid for linked_device_ceremony`);break;default:throw Error(t+`.caller is unsupported`)}let c=Ze(n);if(!c)throw Error(t+`.caller is invalid`);let l=o===void 0?{version:`add_auth_method_intent_v1`,walletId:r,authMethod:a,targetWalletAuthMethodId:i,nonceB64u:s}:{version:`add_auth_method_intent_v1`,walletId:r,authMethod:a,targetWalletAuthMethodId:i,runtimePolicyScope:o,nonceB64u:s};switch(c.caller){case`same_device_addition`:return{...l,caller:c.caller,source:c.source};case`linked_device_ceremony`:return{...l,caller:c.caller};default:return ct(c)}}function ct(e){throw Error(`Unsupported add-auth-method intent caller: ${String(e)}`)}function lt(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(!Number.isSafeInteger(e[n])||e[n]!==t[n])return!1;return!0}function ut(e,t){switch(e.kind){case`evm`:return t.kind===`evm`&&e.namespace===t.namespace&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;case`tempo`:return t.kind===`tempo`&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;default:return dt(e)}}function dt(e){throw Error(`Unsupported add-signer chain target: ${String(e)}`)}function ft(e,t){if(e.mode!==t.mode)return!1;switch(e.mode){case`ed25519`:return t.mode===`ed25519`&&e.ed25519.mode===t.ed25519.mode&&e.ed25519.signerSlot===t.ed25519.signerSlot&&lt(e.ed25519.participantIds,t.ed25519.participantIds)&&e.ed25519.keyPurpose===t.ed25519.keyPurpose&&e.ed25519.keyVersion===t.ed25519.keyVersion&&e.ed25519.derivationVersion===t.ed25519.derivationVersion;case`ecdsa`:if(t.mode!==`ecdsa`||e.ecdsa.chainTargets.length!==t.ecdsa.chainTargets.length)return!1;for(let n=0;n<e.ecdsa.chainTargets.length;n+=1)if(!ut(e.ecdsa.chainTargets[n],t.ecdsa.chainTargets[n]))return!1;return lt(e.ecdsa.participantIds,t.ecdsa.participantIds);default:return pt(e)}}function pt(e){throw Error(`Unsupported add-signer selection: ${String(e)}`)}function mt(e,t){return e===void 0||t===void 0?e===t:e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function ht(e,t){return e.version===t.version&&e.walletId===t.walletId&&ft(e.signerSelection,t.signerSelection)&&mt(e.runtimePolicyScope,t.runtimePolicyScope)&&e.nonceB64u===t.nonceB64u}function gt(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId;case`email_otp`:return t.kind===`email_otp`&&e.email===t.email;default:return _t(e)}}function _t(e){throw Error(`Unsupported add-auth-method input: ${String(e)}`)}function vt(e,t){if(e.version!==t.version||e.walletId!==t.walletId||!gt(e.authMethod,t.authMethod)||e.targetWalletAuthMethodId!==t.targetWalletAuthMethodId||!mt(e.runtimePolicyScope,t.runtimePolicyScope)||e.nonceB64u!==t.nonceB64u)return!1;switch(e.caller){case`same_device_addition`:return t.caller===`same_device_addition`&&Qe(e.source,t.source);case`linked_device_ceremony`:return t.caller===`linked_device_ceremony`;default:return yt(e)}}function yt(e){throw Error(`Unsupported add-auth-method intent: ${String(e)}`)}export{We as C,w as D,xe as E,be as O,Fe as S,E as T,R as _,st as a,je as b,ht as c,j as d,z as f,I as g,B as h,Ye as i,ve as k,Ke as l,Ie as m,Je as n,ot as o,L as p,Xe as r,vt as s,qe as t,Ge as u,Pe as v,D as w,Ue as x,F as y};

package/dist/{public/sdk/requireStepUpAuth-iVo6h_U-.js → esm/sdk/requireStepUpAuth-ByMTPBu4.js}

@@ -1 +1 @@
-import{r as e,t}from"./digests-BIaE0DMd.js";import{i as n}from"./base64-BmKR3UqU.js";import{r}from"./secureRandomId-8LSc91aN.js";import{i}from"./errors-BJBDbwHk.js";import{a as ee,c as a,i as o,o as s,r as te,t as ne}from"./types-A-w1cYlJ.js";import{o as c}from"./sdkSentEvents-BFwv3mBw.js";import{t as l}from"./types-C4OErbBf.js";import{t as u}from"./promptText-bcKcsSka.js";async function d(r){let i=await e(t({kind:String(r.kind||``).trim()||`unknown`,payload:f(r.payload)}));return te.signingOperationFingerprint(`sha256:${n(i)}`)}function f(e){if(typeof e==`bigint`)return e.toString(10);if(e instanceof Uint8Array)return{__bytesB64u:n(e)};if(ArrayBuffer.isView(e))return{__bytesB64u:n(new Uint8Array(e.buffer,e.byteOffset,e.byteLength))};if(e instanceof ArrayBuffer)return{__bytesB64u:n(new Uint8Array(e))};if(Array.isArray(e))return e.map(f);if(!e||typeof e!=`object`)return e;let t={};for(let n of Object.keys(e).sort()){let r=f(e[n]);r!==void 0&&(t[n]=r)}return t}const p={Created:`created`,Planned:`planned`,ConfirmationApproved:`confirmation_approved`,AuthenticationInProgress:`authentication_in_progress`,AuthReady:`auth_ready`,ThresholdConnected:`threshold_connected`,PayloadPrepared:`payload_prepared`,Signed:`signed`,CleanedUp:`cleaned_up`,Completed:`completed`,Failed:`failed`,Cancelled:`cancelled`},m={ShowConfirmation:`showConfirmation`,RequestOtp:`requestOtp`,RequestPasskey:`requestPasskey`,ConnectThreshold:`connectThreshold`,PreparePayload:`preparePayload`,Sign:`sign`,Cleanup:`cleanup`},h={Review:`review`,Authentication:`authentication`,Execution:`execution`},g={Pending:`pending`,Approved:`approved`},_={ReviewApproved:`review_approved`,AuthenticationStarted:`authentication_started`,AuthenticationCompleted:`authentication_completed`};function v(e){return{operationId:e.operationId,current:{kind:p.Created}}}function y(e,t){switch(e.current.kind){case p.Created:case p.Planned:{let n={kind:p.Planned,plan:t};return e.current=n,n}case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:{let n={kind:p.ConfirmationApproved,plan:t};return e.current=n,n}case p.AuthenticationInProgress:{let n={kind:e.current.reviewApproval===g.Approved?p.ConfirmationApproved:p.Planned,plan:t};return e.current=n,n}case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot be replanned`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be replanned`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot be replanned`);default:return I(e.current)}}function b(e){switch(e.current.kind){case p.Planned:e.current={kind:p.ConfirmationApproved,plan:e.current.plan};return;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.AuthenticationInProgress:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Approved};return;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before confirmation`);case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot be confirmed`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be confirmed`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot be confirmed`);default:return I(e.current)}}function x(e){switch(e.current.kind){case p.Planned:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Pending};return;case p.ConfirmationApproved:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Approved};return;case p.AuthenticationInProgress:return;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before authentication`);case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot authenticate`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot authenticate`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot authenticate`);default:return I(e.current)}}function S(e){switch(e.current.kind){case p.AuthenticationInProgress:if(e.current.reviewApproval!==g.Approved)throw Error(`[SigningOperationMachine] authentication cannot complete before transaction approval`);e.current={kind:p.AuthReady,plan:e.current.plan};return;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.Created:case p.Planned:throw Error(`[SigningOperationMachine] authentication cannot complete before transaction approval`);case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot authenticate`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot authenticate`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot authenticate`);default:return I(e.current)}}function C(e,t){switch(t.kind){case _.ReviewApproved:b(e);return;case _.AuthenticationStarted:x(e);return;case _.AuthenticationCompleted:S(e);return;default:return L(t)}}function w(e){let t;switch(e.current.kind){case p.Planned:t=h.Review;break;case p.AuthenticationInProgress:t=h.Authentication;break;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:t=h.Execution;break;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before cancellation`);case p.Signed:case p.CleanedUp:case p.Completed:throw Error(`[SigningOperationMachine] completed signing cannot be cancelled`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be cancelled`);case p.Cancelled:return e.current;default:return I(e.current)}let n={kind:p.Cancelled,plan:e.current.plan,phase:t};return e.current=n,n}function re(e){switch(e){case p.Planned:return!1;case p.ConfirmationApproved:return!0;default:return R(e)}}function ie(e){switch(e.kind){case p.Created:case p.Planned:case p.Failed:case p.Cancelled:return!1;case p.AuthenticationInProgress:return e.reviewApproval===g.Approved;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:case p.Completed:return!0;default:return I(e)}}function T(e){return{kind:`signing_operation_plan`,sessionPlan:e.sessionPlan,operation:e.operation,commands:e.commands}}async function E(e){let t=[];for(let n of e.steps){if(n.command)try{await e.executor.execute(n.command)}catch(r){let i=j({from:n.from,to:{kind:p.Failed,plan:n.command.plan,reason:F(r)},command:n.command,reason:F(r)});return await e.onTransition?.(i.traceEvent),t.push(i),{ok:!1,finalState:i.to,error:r}}if(await e.onTransition?.(n.traceEvent),t.push(n),n.to.kind===p.Failed)return{ok:!0,finalState:n.to}}let n=t.at(-1)?.to||e.steps.at(-1)?.from;if(!n)throw Error(`[SigningOperationMachine] command sequence produced no steps`);return{ok:!0,finalState:n}}async function ae(e){for(let t of e.commands)await e.execute(t)}function D(e){let t=k(e),n=-1;return t.forEach((e,t)=>{e.command&&(n=t)}),n>=0?t.slice(0,n+1):[]}async function O(e){let t,n=await E({steps:D(T({sessionPlan:e.signingSessionPlan,operation:e.signingOperation,commands:[e.commandKind]})),executor:{execute:async n=>{n.kind===e.commandKind&&(t=await e.execute())}}});if(!n.ok)throw n.error;if(n.finalState.kind===p.Failed)throw Error(n.finalState.reason);return t}function k(e,t={kind:p.Planned,plan:e.sessionPlan}){let n=e.sessionPlan;if(n.kind===o.NotReady)return[j({from:t,to:{kind:p.Failed,plan:n,reason:n.reason},reason:n.reason})];let r=[],i=t;return i=A(r,i,{to:{kind:p.ConfirmationApproved,plan:n},command:N(e,{kind:m.ShowConfirmation,plan:n,lane:n.lane})}),n.kind===o.EmailOtpReauth?(i=A(r,i,{to:{kind:p.AuthReady,plan:n},command:N(e,{kind:m.RequestOtp,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.ThresholdConnected,plan:n},command:N(e,{kind:m.ConnectThreshold,plan:n,lane:n.lane})})):n.kind===o.PasskeyReauth?(i=A(r,i,{to:{kind:p.AuthReady,plan:n},command:N(e,{kind:m.RequestPasskey,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.ThresholdConnected,plan:n},command:N(e,{kind:m.ConnectThreshold,plan:n,lane:n.lane})})):i=A(r,i,{to:{kind:p.AuthReady,plan:n}}),i=A(r,i,{to:{kind:p.PayloadPrepared,plan:n},command:N(e,{kind:m.PreparePayload,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.Signed,plan:n},command:N(e,{kind:m.Sign,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.CleanedUp,plan:n},command:N(e,{kind:m.Cleanup,plan:n,lane:n.lane})}),A(r,i,{to:{kind:p.Completed,plan:n}}),r}function A(e,t,n){let r=j({from:t,to:n.to,command:n.command,reason:n.reason});return e.push(r),r.to}function j(e){let t=M(e.from,e.to);return{from:e.from,to:e.to,command:e.command,traceEvent:{event:`signing_operation_transition`,from:e.from.kind,to:e.to.kind,...e.command?{command:e.command.kind}:{},...e.command?.operation?{operationId:e.command.operation.operationId}:{},plan:s(t),lane:ee(t.lane),...e.reason?{reason:e.reason}:{}}}}function M(e,t){if(`plan`in t)return t.plan;if(`plan`in e)return e.plan;throw Error(`[SigningOperationMachine] transition has no signing plan`)}function N(e,t){if(e.commands.includes(t.kind))return P(t,e.operation)}function P(e,t){return t?{...e,operation:t}:e}function F(e){return e instanceof Error&&e.message.trim()?e.message:`execution_command_failed`}function I(e){throw Error(`Unsupported signing operation state: ${String(e)}`)}function L(e){throw Error(`[SigningOperationMachine] unsupported interaction event: ${String(e)}`)}function R(e){throw Error(`Unsupported signing operation state kind: ${String(e)}`)}function z(e){switch(e.signingAuthPlan.kind){case l.WarmSession:return{signingAuthPlan:e.signingAuthPlan};case l.ActiveWalletAuthority:return{signingAuthPlan:e.signingAuthPlan};case l.PasskeyReauth:return{signingAuthPlan:e.signingAuthPlan,...e.webauthnChallenge?{webauthnChallenge:e.webauthnChallenge}:{}};case l.EmailOtpReauth:{let t=e.emailOtpPrompt??e.signingAuthPlan.emailOtpPrompt;if(!t)throw Error(`[SigningConfirmation] missing_email_otp_prompt`);return{signingAuthPlan:e.signingAuthPlan,emailOtpPrompt:t}}default:return B(e.signingAuthPlan)}}function B(e){throw Error(`Unsupported signing auth plan: ${String(e.kind)}`)}async function V(e){H(e.request);let t=e.runtime.orchestrateSigningConfirmation;return await t(e.request)}function H(e){let t=e;switch(e.signingAuthPlan.kind){case l.WarmSession:if(t.emailOtpPrompt!==void 0||t.webauthnChallenge!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.ActiveWalletAuthority:if(t.emailOtpPrompt!==void 0||t.webauthnChallenge!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.PasskeyReauth:if(t.emailOtpPrompt!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.EmailOtpReauth:if(t.webauthnChallenge!==void 0||!t.emailOtpPrompt)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;default:return B(e.signingAuthPlan)}}function U(e){switch(e){case`missing_capability`:case`missing_material`:case`authority_ambiguous`:case`binding_mismatch`:case`exact_record_conflict`:case`corrupt`:return{kind:`invalid_material`,reason:e};case`revoked`:case`replaced`:return{kind:`full_login_required`,reason:e};case`persistence_unavailable`:return{kind:`temporarily_unavailable`,reason:e};default:throw Error(`[SigningEngine] unsupported signing material block reason`)}}var W=class extends Error{name=`InvalidWalletSigningMaterialError`;code=`wallet_signing_material_invalid`;constructor(e){super(`Wallet signing material is invalid. Log in again or recover the wallet.`),this.reason=e}},G=class extends Error{name=`WalletFullLoginRequiredError`;code=`wallet_full_login_required`;constructor(e){super(`A full wallet login is required before signing.`),this.reason=e}},K=class extends Error{name=`WalletOperationStepUpCancelled`;code=`wallet_operation_step_up_cancelled`;constructor(){super(`Request cancelled.`)}},q=class extends Error{name=`WalletSigningMaterialTemporarilyUnavailableError`;code=`wallet_signing_material_temporarily_unavailable`;reason=`persistence_unavailable`;constructor(){super(`Wallet signing material storage is temporarily unavailable. Retry the operation.`)}};function J(e){return new W(e)}function Y(e){return new G(e)}function oe(e){let t=U(e);switch(t.kind){case`invalid_material`:return J(t.reason);case`full_login_required`:return Y(t.reason);case`temporarily_unavailable`:return new q;default:throw Error(`[SigningEngine] unsupported signing material disposition`)}}function se(){return new K}function ce(e){return e instanceof W||e instanceof G||e instanceof K}function le(e){return r(e,32,`signing confirmation request IDs`)}function ue(e){return e.override}function de(e){return e.kind===`digest`?e.digest32:e.challenge32}function X(e){let t=V;return async()=>await t({runtime:e.runtime,request:e.request})}async function fe(e){let t=y(e.signingOperationState,e.signingSessionPlan),n={...e.request,signingOperationStateKind:t.kind,onSigningOperationInteractionEvent:C.bind(void 0,e.signingOperationState)},r=X({runtime:e.runtime,request:n});try{return await O({signingSessionPlan:e.signingSessionPlan,signingOperation:e.signingOperation,commandKind:m.ShowConfirmation,execute:r})}catch(t){throw i(t)&&w(e.signingOperationState).phase===h.Authentication?se():t}}async function pe(e){let t=X({runtime:e.runtime,request:e.request});return await O({signingSessionPlan:e.signingSessionPlan,signingOperation:e.signingOperation,commandKind:m.ShowConfirmation,execute:t})}function me(e){let t=e.plan;if(t.kind===o.WarmSession){if(t.keyRef.kind!==ne.Cached)throw Error(`[SigningEngine] warm signing-session plan requires a cached key ref`);let n=Math.floor(Number(e.expiresAtMs)||0),r=Math.floor(Number(e.remainingUses)||0);if(n<=0||r<=0)throw Error(`[SigningEngine] warm signing-session auth plan requires positive expiresAtMs and remainingUses`);if(e.curve===`ed25519`){if(t.keyRef.curve!==`ed25519`)throw Error(`[SigningEngine] Ed25519 warm plan requires an Ed25519 key ref`);return{kind:l.WarmSession,method:a(t.lane.auth),accountId:e.accountId,intent:e.intent,curve:`ed25519`,thresholdSessionId:String(t.keyRef.thresholdSessionId),retention:t.lane.retention,expiresAtMs:n,remainingUses:r}}if(t.keyRef.curve!==`ecdsa`)throw Error(`[SigningEngine] ECDSA warm plan requires an ECDSA key ref`);return{kind:l.WarmSession,method:a(t.lane.auth),accountId:e.accountId,intent:e.intent,curve:`ecdsa`,materialActivation:t.keyRef.materialActivation,authorization:t.keyRef.authorization,retention:t.lane.retention,expiresAtMs:n,remainingUses:r}}return t.kind===o.EmailOtpReauth?{kind:l.EmailOtpReauth,method:`email_otp`,...e.emailOtpPrompt?{emailOtpPrompt:e.emailOtpPrompt}:{}}:{kind:l.PasskeyReauth,method:`passkey`}}function he(e){switch(e.kind){case l.EmailOtpReauth:return`email_otp`;case l.WarmSession:return`warm_session`;case l.ActiveWalletAuthority:return`warm_session`;case l.PasskeyReauth:return`passkey`;default:{let t=e.kind;throw Error(`Unsupported signing confirmation auth method: ${String(t)}`)}}}function Z(e,t){let n=String(e.phase||``),r=e.status===`failed`;if(n===`intent-confirmation-required`)return{phase:c.STEP_05_CONFIRMATION_DISPLAYED,status:`waiting_for_user`,interaction:{kind:`transaction_confirmation`,overlay:`show`},data:Q(e.data)};if(n===`confirmation.complete`)return r?{phase:c.STEP_05_CONFIRMATION_CANCELLED,status:`cancelled`,interaction:{kind:`transaction_confirmation`,overlay:`hide`},error:{message:e.message||`Transaction rejected`},data:Q(e.data)}:{phase:t===`email_otp`?c.STEP_06_AUTH_EMAIL_OTP_VERIFY_SUCCEEDED:c.STEP_05_CONFIRMATION_APPROVED,status:`succeeded`,interaction:{kind:t===`email_otp`?`otp_input`:`transaction_confirmation`,overlay:`hide`},data:Q(e.data)};if(n===`auth.passkey.prompt.started`)return{phase:c.STEP_06_AUTH_PASSKEY_PROMPT_STARTED,status:`waiting_for_user`,interaction:{kind:`passkey_assert`,overlay:`show`},data:Q(e.data)};if(n===`auth.passkey.prompt.succeeded`){let t=`passkey_assert`;return r?{phase:c.FAILED,status:`failed`,interaction:{kind:t,overlay:`hide`},error:{message:e.message||`Transaction signing failed`},data:Q(e.data)}:{phase:c.STEP_06_AUTH_PASSKEY_PROMPT_SUCCEEDED,status:`succeeded`,interaction:{kind:t,overlay:`hide`},data:Q(e.data)}}return null}function Q(e){if(e!=null)return typeof e==`object`&&!Array.isArray(e)?e:{value:e}}function ge(e){return{challengeId:e.challenge.challengeId,...e.challenge.emailHint?{emailHint:e.challenge.emailHint}:{},title:`Enter email code to sign`,helperText:u(e.challenge.emailHint),...e.resend?{onResend:e.resend}:{}}}var $=class extends Error{code;method;constructor(e,t,n){super(n),this.name=`StepUpMethodSelectionError`,this.code=e,this.method=t}};function _e(e,t){if(t.kind===`reuse_warm_session`)return`warm_session`;if(e.authMethod===`voiceid`)throw Error(`Unlock with VoiceID again before signing.`);return t.kind===`force_method`?t.method:e.authMethod}function ve(e){if(e.policy.kind===`reuse_warm_session`)return{method:`warm_session`,authorization:e.policy.authorization};let t=_e(e.selectedLane,e.policy);if(t===`passkey`){if(!e.methods.passkey)throw new $(`missing_step_up_runner`,t,`Passkey step-up runner is required for this operation`);return{method:`passkey`,runner:e.methods.passkey}}if(t===`email_otp`){if(!e.methods.emailOtp)throw new $(`missing_step_up_runner`,t,`Email OTP step-up runner is required for this operation`);return{method:`email_otp`,runner:e.methods.emailOtp}}let n=t;throw new $(`unsupported_step_up_method`,n,`Unsupported step-up method: ${n}`)}async function ye(e){let t=ve({selectedLane:e.selectedLane,policy:e.policy,methods:e.methods});if(t.method===`warm_session`)return{method:`warm_session`,authorization:t.authorization};if(t.method===`passkey`){let n=await t.runner.prepare();return{method:`passkey`,prompt:n,complete:async r=>await t.runner.complete({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,prompt:n,confirmation:r})}}let n=await t.runner.prepareChallenge({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy}),r={},i=ge({challenge:n,resend:t.runner.resendChallenge?async()=>await t.runner.resendChallenge({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,currentPrompt:r.prompt||i}):void 0});return r.prompt=i,{method:`email_otp`,prompt:i,complete:async n=>await t.runner.complete({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,prompt:i,confirmation:n})}}export{O as C,d as E,re as S,ae as T,_,le as a,v as b,pe as c,Y as d,J as f,m as g,z as h,de as i,fe as l,oe as m,ue as n,Z as o,ce as p,X as r,he as s,ye as t,me as u,D as v,E as w,ie as x,T as y};
+import{r as e,t}from"./digests-BIaE0DMd.js";import{i as n}from"./base64-BmKR3UqU.js";import{r}from"./secureRandomId-8LSc91aN.js";import{i}from"./errors-BJBDbwHk.js";import{a as ee,c as a,i as o,o as s,r as te,t as ne}from"./types-D2Zk1W7I.js";import{o as c}from"./sdkSentEvents-BFwv3mBw.js";import{t as l}from"./types-C4OErbBf.js";import{t as u}from"./promptText-bcKcsSka.js";async function d(r){let i=await e(t({kind:String(r.kind||``).trim()||`unknown`,payload:f(r.payload)}));return te.signingOperationFingerprint(`sha256:${n(i)}`)}function f(e){if(typeof e==`bigint`)return e.toString(10);if(e instanceof Uint8Array)return{__bytesB64u:n(e)};if(ArrayBuffer.isView(e))return{__bytesB64u:n(new Uint8Array(e.buffer,e.byteOffset,e.byteLength))};if(e instanceof ArrayBuffer)return{__bytesB64u:n(new Uint8Array(e))};if(Array.isArray(e))return e.map(f);if(!e||typeof e!=`object`)return e;let t={};for(let n of Object.keys(e).sort()){let r=f(e[n]);r!==void 0&&(t[n]=r)}return t}const p={Created:`created`,Planned:`planned`,ConfirmationApproved:`confirmation_approved`,AuthenticationInProgress:`authentication_in_progress`,AuthReady:`auth_ready`,ThresholdConnected:`threshold_connected`,PayloadPrepared:`payload_prepared`,Signed:`signed`,CleanedUp:`cleaned_up`,Completed:`completed`,Failed:`failed`,Cancelled:`cancelled`},m={ShowConfirmation:`showConfirmation`,RequestOtp:`requestOtp`,RequestPasskey:`requestPasskey`,ConnectThreshold:`connectThreshold`,PreparePayload:`preparePayload`,Sign:`sign`,Cleanup:`cleanup`},h={Review:`review`,Authentication:`authentication`,Execution:`execution`},g={Pending:`pending`,Approved:`approved`},_={ReviewApproved:`review_approved`,AuthenticationStarted:`authentication_started`,AuthenticationCompleted:`authentication_completed`};function v(e){return{operationId:e.operationId,current:{kind:p.Created}}}function y(e,t){switch(e.current.kind){case p.Created:case p.Planned:{let n={kind:p.Planned,plan:t};return e.current=n,n}case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:{let n={kind:p.ConfirmationApproved,plan:t};return e.current=n,n}case p.AuthenticationInProgress:{let n={kind:e.current.reviewApproval===g.Approved?p.ConfirmationApproved:p.Planned,plan:t};return e.current=n,n}case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot be replanned`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be replanned`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot be replanned`);default:return I(e.current)}}function b(e){switch(e.current.kind){case p.Planned:e.current={kind:p.ConfirmationApproved,plan:e.current.plan};return;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.AuthenticationInProgress:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Approved};return;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before confirmation`);case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot be confirmed`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be confirmed`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot be confirmed`);default:return I(e.current)}}function x(e){switch(e.current.kind){case p.Planned:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Pending};return;case p.ConfirmationApproved:e.current={kind:p.AuthenticationInProgress,plan:e.current.plan,reviewApproval:g.Approved};return;case p.AuthenticationInProgress:return;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before authentication`);case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot authenticate`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot authenticate`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot authenticate`);default:return I(e.current)}}function S(e){switch(e.current.kind){case p.AuthenticationInProgress:if(e.current.reviewApproval!==g.Approved)throw Error(`[SigningOperationMachine] authentication cannot complete before transaction approval`);e.current={kind:p.AuthReady,plan:e.current.plan};return;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:return;case p.Created:case p.Planned:throw Error(`[SigningOperationMachine] authentication cannot complete before transaction approval`);case p.Completed:throw Error(`[SigningOperationMachine] completed operation cannot authenticate`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot authenticate`);case p.Cancelled:throw Error(`[SigningOperationMachine] cancelled operation cannot authenticate`);default:return I(e.current)}}function C(e,t){switch(t.kind){case _.ReviewApproved:b(e);return;case _.AuthenticationStarted:x(e);return;case _.AuthenticationCompleted:S(e);return;default:return L(t)}}function w(e){let t;switch(e.current.kind){case p.Planned:t=h.Review;break;case p.AuthenticationInProgress:t=h.Authentication;break;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:t=h.Execution;break;case p.Created:throw Error(`[SigningOperationMachine] operation must be planned before cancellation`);case p.Signed:case p.CleanedUp:case p.Completed:throw Error(`[SigningOperationMachine] completed signing cannot be cancelled`);case p.Failed:throw Error(`[SigningOperationMachine] failed operation cannot be cancelled`);case p.Cancelled:return e.current;default:return I(e.current)}let n={kind:p.Cancelled,plan:e.current.plan,phase:t};return e.current=n,n}function re(e){switch(e){case p.Planned:return!1;case p.ConfirmationApproved:return!0;default:return R(e)}}function ie(e){switch(e.kind){case p.Created:case p.Planned:case p.Failed:case p.Cancelled:return!1;case p.AuthenticationInProgress:return e.reviewApproval===g.Approved;case p.ConfirmationApproved:case p.AuthReady:case p.ThresholdConnected:case p.PayloadPrepared:case p.Signed:case p.CleanedUp:case p.Completed:return!0;default:return I(e)}}function T(e){return{kind:`signing_operation_plan`,sessionPlan:e.sessionPlan,operation:e.operation,commands:e.commands}}async function E(e){let t=[];for(let n of e.steps){if(n.command)try{await e.executor.execute(n.command)}catch(r){let i=j({from:n.from,to:{kind:p.Failed,plan:n.command.plan,reason:F(r)},command:n.command,reason:F(r)});return await e.onTransition?.(i.traceEvent),t.push(i),{ok:!1,finalState:i.to,error:r}}if(await e.onTransition?.(n.traceEvent),t.push(n),n.to.kind===p.Failed)return{ok:!0,finalState:n.to}}let n=t.at(-1)?.to||e.steps.at(-1)?.from;if(!n)throw Error(`[SigningOperationMachine] command sequence produced no steps`);return{ok:!0,finalState:n}}async function ae(e){for(let t of e.commands)await e.execute(t)}function D(e){let t=k(e),n=-1;return t.forEach((e,t)=>{e.command&&(n=t)}),n>=0?t.slice(0,n+1):[]}async function O(e){let t,n=await E({steps:D(T({sessionPlan:e.signingSessionPlan,operation:e.signingOperation,commands:[e.commandKind]})),executor:{execute:async n=>{n.kind===e.commandKind&&(t=await e.execute())}}});if(!n.ok)throw n.error;if(n.finalState.kind===p.Failed)throw Error(n.finalState.reason);return t}function k(e,t={kind:p.Planned,plan:e.sessionPlan}){let n=e.sessionPlan;if(n.kind===o.NotReady)return[j({from:t,to:{kind:p.Failed,plan:n,reason:n.reason},reason:n.reason})];let r=[],i=t;return i=A(r,i,{to:{kind:p.ConfirmationApproved,plan:n},command:N(e,{kind:m.ShowConfirmation,plan:n,lane:n.lane})}),n.kind===o.EmailOtpReauth?(i=A(r,i,{to:{kind:p.AuthReady,plan:n},command:N(e,{kind:m.RequestOtp,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.ThresholdConnected,plan:n},command:N(e,{kind:m.ConnectThreshold,plan:n,lane:n.lane})})):n.kind===o.PasskeyReauth?(i=A(r,i,{to:{kind:p.AuthReady,plan:n},command:N(e,{kind:m.RequestPasskey,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.ThresholdConnected,plan:n},command:N(e,{kind:m.ConnectThreshold,plan:n,lane:n.lane})})):i=A(r,i,{to:{kind:p.AuthReady,plan:n}}),i=A(r,i,{to:{kind:p.PayloadPrepared,plan:n},command:N(e,{kind:m.PreparePayload,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.Signed,plan:n},command:N(e,{kind:m.Sign,plan:n,lane:n.lane})}),i=A(r,i,{to:{kind:p.CleanedUp,plan:n},command:N(e,{kind:m.Cleanup,plan:n,lane:n.lane})}),A(r,i,{to:{kind:p.Completed,plan:n}}),r}function A(e,t,n){let r=j({from:t,to:n.to,command:n.command,reason:n.reason});return e.push(r),r.to}function j(e){let t=M(e.from,e.to);return{from:e.from,to:e.to,command:e.command,traceEvent:{event:`signing_operation_transition`,from:e.from.kind,to:e.to.kind,...e.command?{command:e.command.kind}:{},...e.command?.operation?{operationId:e.command.operation.operationId}:{},plan:s(t),lane:ee(t.lane),...e.reason?{reason:e.reason}:{}}}}function M(e,t){if(`plan`in t)return t.plan;if(`plan`in e)return e.plan;throw Error(`[SigningOperationMachine] transition has no signing plan`)}function N(e,t){if(e.commands.includes(t.kind))return P(t,e.operation)}function P(e,t){return t?{...e,operation:t}:e}function F(e){return e instanceof Error&&e.message.trim()?e.message:`execution_command_failed`}function I(e){throw Error(`Unsupported signing operation state: ${String(e)}`)}function L(e){throw Error(`[SigningOperationMachine] unsupported interaction event: ${String(e)}`)}function R(e){throw Error(`Unsupported signing operation state kind: ${String(e)}`)}function z(e){switch(e.signingAuthPlan.kind){case l.WarmSession:return{signingAuthPlan:e.signingAuthPlan};case l.ActiveWalletAuthority:return{signingAuthPlan:e.signingAuthPlan};case l.PasskeyReauth:return{signingAuthPlan:e.signingAuthPlan,...e.webauthnChallenge?{webauthnChallenge:e.webauthnChallenge}:{}};case l.EmailOtpReauth:{let t=e.emailOtpPrompt??e.signingAuthPlan.emailOtpPrompt;if(!t)throw Error(`[SigningConfirmation] missing_email_otp_prompt`);return{signingAuthPlan:e.signingAuthPlan,emailOtpPrompt:t}}default:return B(e.signingAuthPlan)}}function B(e){throw Error(`Unsupported signing auth plan: ${String(e.kind)}`)}async function V(e){H(e.request);let t=e.runtime.orchestrateSigningConfirmation;return await t(e.request)}function H(e){let t=e;switch(e.signingAuthPlan.kind){case l.WarmSession:if(t.emailOtpPrompt!==void 0||t.webauthnChallenge!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.ActiveWalletAuthority:if(t.emailOtpPrompt!==void 0||t.webauthnChallenge!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.PasskeyReauth:if(t.emailOtpPrompt!==void 0)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;case l.EmailOtpReauth:if(t.webauthnChallenge!==void 0||!t.emailOtpPrompt)throw Error(`[SigningConfirmation] auth_method_route_mismatch`);return;default:return B(e.signingAuthPlan)}}function U(e){switch(e){case`missing_capability`:case`missing_material`:case`authority_ambiguous`:case`binding_mismatch`:case`exact_record_conflict`:case`corrupt`:return{kind:`invalid_material`,reason:e};case`revoked`:case`replaced`:return{kind:`full_login_required`,reason:e};case`persistence_unavailable`:return{kind:`temporarily_unavailable`,reason:e};default:throw Error(`[SigningEngine] unsupported signing material block reason`)}}var W=class extends Error{name=`InvalidWalletSigningMaterialError`;code=`wallet_signing_material_invalid`;constructor(e){super(`Wallet signing material is invalid. Log in again or recover the wallet.`),this.reason=e}},G=class extends Error{name=`WalletFullLoginRequiredError`;code=`wallet_full_login_required`;constructor(e){super(`A full wallet login is required before signing.`),this.reason=e}},K=class extends Error{name=`WalletOperationStepUpCancelled`;code=`wallet_operation_step_up_cancelled`;constructor(){super(`Request cancelled.`)}},q=class extends Error{name=`WalletSigningMaterialTemporarilyUnavailableError`;code=`wallet_signing_material_temporarily_unavailable`;reason=`persistence_unavailable`;constructor(){super(`Wallet signing material storage is temporarily unavailable. Retry the operation.`)}};function J(e){return new W(e)}function Y(e){return new G(e)}function oe(e){let t=U(e);switch(t.kind){case`invalid_material`:return J(t.reason);case`full_login_required`:return Y(t.reason);case`temporarily_unavailable`:return new q;default:throw Error(`[SigningEngine] unsupported signing material disposition`)}}function se(){return new K}function ce(e){return e instanceof W||e instanceof G||e instanceof K}function le(e){return r(e,32,`signing confirmation request IDs`)}function ue(e){return e.override}function de(e){return e.kind===`digest`?e.digest32:e.challenge32}function X(e){let t=V;return async()=>await t({runtime:e.runtime,request:e.request})}async function fe(e){let t=y(e.signingOperationState,e.signingSessionPlan),n={...e.request,signingOperationStateKind:t.kind,onSigningOperationInteractionEvent:C.bind(void 0,e.signingOperationState)},r=X({runtime:e.runtime,request:n});try{return await O({signingSessionPlan:e.signingSessionPlan,signingOperation:e.signingOperation,commandKind:m.ShowConfirmation,execute:r})}catch(t){throw i(t)&&w(e.signingOperationState).phase===h.Authentication?se():t}}async function pe(e){let t=X({runtime:e.runtime,request:e.request});return await O({signingSessionPlan:e.signingSessionPlan,signingOperation:e.signingOperation,commandKind:m.ShowConfirmation,execute:t})}function me(e){let t=e.plan;if(t.kind===o.WarmSession){if(t.keyRef.kind!==ne.Cached)throw Error(`[SigningEngine] warm signing-session plan requires a cached key ref`);let n=Math.floor(Number(e.expiresAtMs)||0),r=Math.floor(Number(e.remainingUses)||0);if(n<=0||r<=0)throw Error(`[SigningEngine] warm signing-session auth plan requires positive expiresAtMs and remainingUses`);if(e.curve===`ed25519`){if(t.keyRef.curve!==`ed25519`)throw Error(`[SigningEngine] Ed25519 warm plan requires an Ed25519 key ref`);return{kind:l.WarmSession,method:a(t.lane.auth),accountId:e.accountId,intent:e.intent,curve:`ed25519`,thresholdSessionId:String(t.keyRef.thresholdSessionId),retention:t.lane.retention,expiresAtMs:n,remainingUses:r}}if(t.keyRef.curve!==`ecdsa`)throw Error(`[SigningEngine] ECDSA warm plan requires an ECDSA key ref`);return{kind:l.WarmSession,method:a(t.lane.auth),accountId:e.accountId,intent:e.intent,curve:`ecdsa`,materialActivation:t.keyRef.materialActivation,authorization:t.keyRef.authorization,retention:t.lane.retention,expiresAtMs:n,remainingUses:r}}return t.kind===o.EmailOtpReauth?{kind:l.EmailOtpReauth,method:`email_otp`,...e.emailOtpPrompt?{emailOtpPrompt:e.emailOtpPrompt}:{}}:{kind:l.PasskeyReauth,method:`passkey`}}function he(e){switch(e.kind){case l.EmailOtpReauth:return`email_otp`;case l.WarmSession:return`warm_session`;case l.ActiveWalletAuthority:return`warm_session`;case l.PasskeyReauth:return`passkey`;default:{let t=e.kind;throw Error(`Unsupported signing confirmation auth method: ${String(t)}`)}}}function Z(e,t){let n=String(e.phase||``),r=e.status===`failed`;if(n===`intent-confirmation-required`)return{phase:c.STEP_05_CONFIRMATION_DISPLAYED,status:`waiting_for_user`,interaction:{kind:`transaction_confirmation`,overlay:`show`},data:Q(e.data)};if(n===`confirmation.complete`)return r?{phase:c.STEP_05_CONFIRMATION_CANCELLED,status:`cancelled`,interaction:{kind:`transaction_confirmation`,overlay:`hide`},error:{message:e.message||`Transaction rejected`},data:Q(e.data)}:{phase:t===`email_otp`?c.STEP_06_AUTH_EMAIL_OTP_VERIFY_SUCCEEDED:c.STEP_05_CONFIRMATION_APPROVED,status:`succeeded`,interaction:{kind:t===`email_otp`?`otp_input`:`transaction_confirmation`,overlay:`hide`},data:Q(e.data)};if(n===`auth.passkey.prompt.started`)return{phase:c.STEP_06_AUTH_PASSKEY_PROMPT_STARTED,status:`waiting_for_user`,interaction:{kind:`passkey_assert`,overlay:`show`},data:Q(e.data)};if(n===`auth.passkey.prompt.succeeded`){let t=`passkey_assert`;return r?{phase:c.FAILED,status:`failed`,interaction:{kind:t,overlay:`hide`},error:{message:e.message||`Transaction signing failed`},data:Q(e.data)}:{phase:c.STEP_06_AUTH_PASSKEY_PROMPT_SUCCEEDED,status:`succeeded`,interaction:{kind:t,overlay:`hide`},data:Q(e.data)}}return null}function Q(e){if(e!=null)return typeof e==`object`&&!Array.isArray(e)?e:{value:e}}function ge(e){return{challengeId:e.challenge.challengeId,...e.challenge.emailHint?{emailHint:e.challenge.emailHint}:{},title:`Enter email code to sign`,helperText:u(e.challenge.emailHint),...e.resend?{onResend:e.resend}:{}}}var $=class extends Error{code;method;constructor(e,t,n){super(n),this.name=`StepUpMethodSelectionError`,this.code=e,this.method=t}};function _e(e,t){if(t.kind===`reuse_warm_session`)return`warm_session`;if(e.authMethod===`voiceid`)throw Error(`Unlock with VoiceID again before signing.`);return t.kind===`force_method`?t.method:e.authMethod}function ve(e){if(e.policy.kind===`reuse_warm_session`)return{method:`warm_session`,authorization:e.policy.authorization};let t=_e(e.selectedLane,e.policy);if(t===`passkey`){if(!e.methods.passkey)throw new $(`missing_step_up_runner`,t,`Passkey step-up runner is required for this operation`);return{method:`passkey`,runner:e.methods.passkey}}if(t===`email_otp`){if(!e.methods.emailOtp)throw new $(`missing_step_up_runner`,t,`Email OTP step-up runner is required for this operation`);return{method:`email_otp`,runner:e.methods.emailOtp}}let n=t;throw new $(`unsupported_step_up_method`,n,`Unsupported step-up method: ${n}`)}async function ye(e){let t=ve({selectedLane:e.selectedLane,policy:e.policy,methods:e.methods});if(t.method===`warm_session`)return{method:`warm_session`,authorization:t.authorization};if(t.method===`passkey`){let n=await t.runner.prepare();return{method:`passkey`,prompt:n,complete:async r=>await t.runner.complete({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,prompt:n,confirmation:r})}}let n=await t.runner.prepareChallenge({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy}),r={},i=ge({challenge:n,resend:t.runner.resendChallenge?async()=>await t.runner.resendChallenge({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,currentPrompt:r.prompt||i}):void 0});return r.prompt=i,{method:`email_otp`,prompt:i,complete:async n=>await t.runner.complete({operation:e.operation,selectedLane:e.selectedLane,policy:e.policy,prompt:i,confirmation:n})}}export{O as C,d as E,re as S,ae as T,_,le as a,v as b,pe as c,Y as d,J as f,m as g,z as h,de as i,fe as l,oe as m,ue as n,Z as o,ce as p,X as r,he as s,ye as t,me as u,D as v,E as w,ie as x,T as y};

package/dist/esm/sdk/resealedEnvelopeResult-DKY5fVNY.js

@@ -0,0 +1 @@
+import{k as e}from"./domainIds-t1lp25yU.js";import{S as t}from"./digests-BIaE0DMd.js";import{E as n,J as r,O as i,k as a}from"./activeWalletSession-HAOgRKzn.js";import{a as o}from"./presignatures-B9KnQyfE.js";import{t as s}from"./indexedDB-BqsYXybq.js";import{n as c}from"./walletOwnershipGeneration-B3uE9GRG.js";import{o as l}from"./walletSessionAuthorizationStore-CGt-s5fX.js";async function u(e,t){let n=f(e,t);if(n===null)return;let r=await s.resolveSelectedWalletAuthority(n);if(r.kind!==`resolved`)return;let i=await l.readExactWithOperationCredential({walletId:n,authorityId:r.authority.authorityId,authMethodId:r.authMethod.walletAuthMethodId});i.kind===`found`&&await c(n,i.operationCredential.ownershipGeneration)}function d(t){let n=e(t);if(!n.ok)throw Error(`Wallet mutation identity is invalid`);return n.value}function f(e,t){switch(e.type){case`PM_ADD_WALLET_SIGNER`:case`PM_ADD_PASSKEY`:case`PM_ACTIVATE_AUTH_METHOD`:case`PM_SET_AUTH_METHOD_ENABLED`:case`PM_ADD_EMAIL_OTP`:case`PM_REVOKE_AUTH_METHOD`:case`PM_ACKNOWLEDGE_WALLET_RECOVERY_CODE_BACKUP`:case`PM_ROTATE_WALLET_RECOVERY_CODES`:case`PM_REQUEST_WALLET_CUSTODY_EMAIL_OTP_CHALLENGE`:case`PM_SIGN_TX_WITH_ACTIONS`:case`PM_SIGN_AND_SEND_TX`:case`PM_SIGN_DELEGATE_ACTION`:case`PM_SIGN_NEP413`:case`PM_REVOKE_LINKED_DEVICE`:return d(e.payload?.walletId);case`PM_SIGN_TEMPO`:case`PM_RESOLVE_EXACT_KEY_EXPORT_LANE`:case`PM_EXPORT_KEYPAIR_UI`:return d(e.payload?.walletSession.walletId);case`PM_SYNC_ACCOUNT_FLOW`:{let n=e.payload?.walletId??t;return n===null?null:d(n)}case`PM_SCAN_AND_LINK_DEVICE`:return t===null?null:d(t);case`PM_OWNER_NEAR_TRANSACTION`:return e.payload.action===`approve`?d(e.payload.authentication.walletId):null;case`PM_EXTERNAL_OWNER_AUTH`:{let t=e.payload;return d(t.action===`associate`?t.input.walletId:t.walletId)}case`PM_SET_TRANSACTION_VIEW`:case`PM_TRANSACTION_BROADCAST_STARTED`:case`PING`:case`PM_GET_AUTH_METHOD_AVAILABILITY`:case`PM_PREPARE_WALLET_RUNTIME`:case`PM_SET_CONFIG`:case`PM_ACTIVATE_TRANSACTION_REVIEW`:case`PM_CANCEL`:case`PM_OPEN_AUTH_MENU`:case`PM_CANCEL_AUTH_MENU`:case`PM_RESOLVE_AUTH_MENU_EXTERNAL_AUTH`:case`PM_RESOLVE_WALLET_CONNECTION`:case`PM_REDEEM_HOSTED_WALLET_SEAMS_SESSION`:case`PM_REGISTER_WALLET`:case`PM_UNLOCK`:case`PM_UNLOCK_AUTH_METHOD`:case`PM_EXTERNAL_AUTH`:case`PM_LOCK`:case`PM_LOCK_EXACT_WALLET_SESSION`:case`PM_GET_LAST_WALLET_MOVE_REQUEST`:case`PM_MOVE_WALLET`:case`PM_GET_WALLET_MOVE`:case`PM_GET_WALLET_PLACEMENT`:case`PM_GET_WALLET_SESSION`:case`PM_GET_EXACT_WALLET_SESSION_STATE`:case`PM_GET_NEAR_PROVISIONING_STATE`:case`PM_REQUEST_EMAIL_OTP_CHALLENGE`:case`PM_BEGIN_GOOGLE_EMAIL_OTP_WALLET_AUTH`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_RESEND`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_REROLL_WALLET_ID`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_SUBMIT`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_COMPLETE_REGISTRATION`:case`PM_GOOGLE_EMAIL_OTP_WALLET_AUTH_CANCEL`:case`PM_GET_WALLET_RECOVERY_CODE_STATUS`:case`PM_SEND_TRANSACTION`:case`PM_REPORT_TEMPO_BROADCAST_ACCEPTED`:case`PM_REPORT_TEMPO_BROADCAST_REJECTED`:case`PM_REPORT_TEMPO_FINALIZED`:case`PM_REPORT_TEMPO_DROPPED_OR_REPLACED`:case`PM_RECONCILE_TEMPO_NONCE_LANE`:case`PM_GET_RECENT_UNLOCKS`:case`PM_SET_CONFIRM_BEHAVIOR`:case`PM_SET_CONFIRMATION_CONFIG`:case`PM_GET_CONFIRMATION_CONFIG`:case`PM_HAS_PASSKEY`:case`PM_LIST_LINKED_DEVICES`:case`PM_START_DEVICE2_LINKING_FLOW`:case`PM_DEVICE_LINK_TARGET_FACTOR_ACTION`:case`PM_DEVICE_LINK_EMAIL_OTP_BASE_FACTOR_ACTION`:case`PM_CANCEL_DEVICE_LINKING`:return null;default:throw Error(`Unsupported wallet mutation request`)}}function p(e,t){return`wallet-auth-method-availability:${encodeURIComponent(e)}:${encodeURIComponent(t)}`}async function m(e,t){return h(await s.getAppState(p(e,t))).enabled}function h(e){if(e==null)return{enabled:!0,revision:`initial`};let n=t(e,`authentication method availability`);if(r(n,[`kind`,`revision`],`authentication method availability`),n.kind!==`enabled`&&n.kind!==`disabled`)throw Error(`Authentication method availability is invalid.`);if(n.revision!==void 0&&(typeof n.revision!=`string`||!n.revision))throw Error(`Authentication method availability revision is invalid.`);return{enabled:n.kind===`enabled`,revision:n.revision??`initial`}}async function g(e,t,n){await s.setAppState(p(e,t),{kind:n?`enabled`:`disabled`,revision:crypto.randomUUID()})}async function _(e){let t=await s.resolveSelectedWalletAuthority(e);if(t.kind!==`resolved`)return{kind:`not_enrolled`};let n=(await s.listWalletAuthMethodsV2ForWallet(e)).filter(v.bind(null,t.authority.authorityId));if(n.length===0)return{kind:`not_enrolled`};if(n.length!==1)throw Error(`Select the device authority before managing VoiceID.`);let r=n[0];return await m(e,r.walletAuthMethodId)?{kind:`enabled`,walletAuthMethodId:r.walletAuthMethodId}:{kind:`disabled`,walletAuthMethodId:r.walletAuthMethodId}}function v(e,t){return t.walletAuthorityId===e&&t.kind===`voiceid`&&t.status===`active`}async function y(e,t){let n=await s.getWalletAuthMethodV2(t);if(!n||n.walletId!==e)return!1;let r=await s.listWalletAuthMethodsV2ForWallet(e);for(let e of r)if(e.walletAuthorityId===n.walletAuthorityId&&e.walletAuthMethodId!==t&&e.status===`active`&&e.kind!==`voiceid`)return!0;return!1}async function b(e,t){let n=(await s.seamsWalletDB.getDB()).transaction(o.appState,`readwrite`),r=n.objectStore(o.appState);for(let n of await r.getAllKeys()){if(typeof n!=`string`||!n.startsWith(`voiceid-browser-enrollment-v2:`))continue;let i=await r.get(n);i?.value?.scope?.walletId===e&&i.value.scope.walletAuthMethodId===t&&await r.delete(n)}await n.done}function x(e){let o=t(e,`wallet custody worker reseal`);return r(o,[`nonceB64u`,`sealedCustodySecretB64u`,`aadHashB64u`,`ciphertextDigestB64u`],`wallet custody worker reseal`),{nonceB64u:a(o.nonceB64u),sealedCustodySecretB64u:i(o.sealedCustodySecretB64u),aadHashB64u:n(o.aadHashB64u,`aadHashB64u`),ciphertextDigestB64u:n(o.ciphertextDigestB64u,`ciphertextDigestB64u`)}}export{m as a,g as c,h as i,u as l,p as n,_ as o,y as r,b as s,x as t,f as u};

package/dist/esm/sdk/routerAbNormalSigning-CPLDkttX.js

@@ -0,0 +1 @@
+import{S as e,c as t,t as n}from"./digests-BIaE0DMd.js";import{c as r,l as i,o as a,u as o}from"./participants-BXdREC5k.js";import{i as s,r as c,t as l}from"./base64-BmKR3UqU.js";import{r as u}from"./walletDbName-B6-CV_Rq.js";import{c as d,s as f}from"./signingSessionSeal-BFOBKj-J.js";import{d as p,h as m}from"./capabilityKinds-Cafn86Y1.js";import{E as h,L as g,Mt as ee,R as te,jt as _,v as ne,y as re}from"./digestEncoding-Rx8Vjy4J.js";import{t as ie}from"./authenticatorOptions-B4q62CLs.js";import{r as v,t as ae}from"./walletSessionAuthorizationStatus-CQ3qA9tI.js";import{t as y}from"./authorizationAdmission-28jo_IVJ.js";import{n as oe}from"./walletSessionFailure-CxsVtroW.js";const b={enabled:!0,targetDepth:5,lowWatermark:4,maxRefillInFlight:1,refillAttemptTimeoutMs:3e4},x={authMethods:[],network:{chains:[{network:`near-testnet`,rpcUrl:`https://rpc.testnet.fastnear.com`,explorerUrl:`https://testnet.nearblocks.io`},{network:`tempo-testnet`,rpcUrl:`https://rpc.moderato.tempo.xyz`,explorerUrl:`https://explore.tempo.xyz`,chainId:42431},{network:`arc-testnet`,rpcUrl:`https://rpc.testnet.arc.io`,explorerUrl:`https://testnet.arcscan.app`,chainId:5042002},{network:`ethereum-sepolia`,rpcUrl:`https://ethereum-sepolia-rpc.publicnode.com`,explorerUrl:`https://sepolia.etherscan.io`,chainId:11155111}],relayer:{accountId:``,url:``,routes:{delegateAction:`/signed-delegate`}}},registration:{mode:`managed`,projectEnvironmentId:``,publishableKey:``,paymentMode:`disabled`,nearAccountProvisioning:{kind:`implicit_account`}},signing:{sessionDefaults:{ttlMs:u,remainingUses:3},emailOtp:{authPolicy:`session`},sessionPersistenceMode:`sealed_refresh_v1`,sessionSeal:{mode:`sealed_refresh_v1`,protocol:{algorithm:f,groupId:d}},routerAb:{normalSigning:{mode:`disabled`}},routerAbEcdsaDerivation:{presignaturePool:b},thresholdEcdsa:{provisioningDefaults:{tempo:{enabled:!0,signingSession:{kind:`jwt`,ttlMs:u,remainingUses:3}},evm:{enabled:!0,signingSession:{kind:`jwt`,ttlMs:u,remainingUses:3}}}}},wallet:{mode:`iframe`,iframe:{origin:`https://wallet.example.localhost`,servicePath:`/wallet-service`,sdkBasePath:`/sdk`,walletHostVariant:`runtime`,rpIdOverride:`example.localhost`}},webauthn:{authenticatorOptions:{userVerification:ie.Preferred,originPolicy:{single:void 0,all_subdomains:!0,multiple:void 0}}},ui:{appearance:{theme:{id:`default`,mode:`dark`,colors:{}},palette:`default`}}};async function se(t,n){let r=e(n,`ECDSA prepare response`);if(r.kind!==t.authorization.kind)throw Error(`ECDSA prepare authorization kind does not match the request`);let i=await ne(t,r.signing);if(t.authorization.kind===`operation_step_up`){if(Object.keys(r).some(S))throw Error(`Invalid step-up prepare response`);return{kind:`operation_step_up`,signing:i}}if(Object.keys(r).some(ce))throw Error(`Invalid Wallet Session prepare response`);let a=e(r.session_status,`ECDSA prepare session status`),o=p(a.quotaId),s=m(t.authorization.wallet_session_id);if(!o.ok||!s.ok)throw Error(`Invalid prepare session identity`);let c=v(a,{walletSessionId:s.value,quotaId:o.value});if(!c||c.status!==`active`||c.authorization.walletId!==t.scope.wallet_id)throw Error(`ECDSA prepare did not return the admitted Wallet Session`);return{kind:`reusable_wallet_session`,signing:i,sessionStatus:c}}function S(e){return e!==`kind`&&e!==`signing`}function ce(e){return S(e)&&e!==`session_status`}var C=class extends Error{code;path;status;constructor(e){super(`Router A/B signing ${e.path} returned HTTP ${e.status}: ${e.message||e.code}`),this.name=`RouterAbSigningRequestError`,this.code=e.code,this.path=e.path,this.status=e.status}};function w(e){let t=String(e.code||``).trim(),n=`Router A/B signing ${e.path} returned HTTP ${e.status}: ${e.message||t||`unknown admission failure`}`;if(e.authorizationDecision?.kind===`step_up_required`)return new y({kind:`exhausted`,source:`server_prepare`,detail:n},e.authorizationDecision);switch(t){case`wallet_budget_exhausted`:return new y({kind:`exhausted`,source:`server_prepare`,detail:n},e.authorizationDecision);case`wallet_budget_in_flight`:case`wallet_budget_reserved`:return new y({kind:`in_flight`,source:`server_prepare`,detail:n,retryAfterMs:150});default:return null}}function T(e,t){let n=Math.floor(Number(e));if(!Number.isSafeInteger(n)||n<=0)throw Error(`${t} must be a positive integer`);return n}function E(e,t,n){if(!Array.isArray(e))throw Error(`${t} must be a byte array`);let r=e.map(e=>Number(e));if(!r.every(e=>Number.isInteger(e)&&e>=0&&e<=255))throw Error(`${t} must contain bytes`);if(n!==void 0&&r.length!==n)throw Error(`${t} must contain ${n} bytes`);return r}function D(e,n){let r=t(e,n);if(c(r).length!==32)throw Error(`${n} must decode to 32 bytes`);return r}function O(e,n){let r=t(e,n);if(c(r).length===0)throw Error(`${n} must decode to non-empty bytes`);return r}function k(e,n){let r=t(e,n),i;try{i=l(r)}catch{i=c(r)}if(i.length!==32)throw Error(`${n} must decode to 32 bytes`);return s(i)}function A(e){return{bytes:[...E([...e],`digest bytes`,32)]}}function le(e,t){return s(Uint8Array.from(E(e.bytes,t)))}async function ue(e){return s(await Q(new TextEncoder().encode(n(e))))}function de(e){let n=t(e.message,`nep413.message`),r=t(e.recipient,`nep413.recipient`),i=c(k(e.nonce,`nep413.nonce`)),a=e.callbackUrl==null?void 0:t(e.callbackUrl,`callbackUrl`),o=[];return Z(o,2147484061),q(o,n),Y(o,i),q(o,r),a?(o.push(1),q(o,a)):o.push(0),s(Uint8Array.from(o))}async function fe(e){let n={scope:I(e.scope,`scope`),expires_at_ms:T(e.expiresAtMs,`expiresAtMs`),display_digest:A(c(D(e.displayDigestB64u,`displayDigestB64u`))),intent:{kind:`near_transaction_v1`,operation_id:t(e.operationId,`operationId`),operation_fingerprint:t(e.operationFingerprint,`operationFingerprint`),near_account_id:t(e.nearAccountId,`nearAccountId`),near_network_id:e.nearNetworkId,transactions:e.transactions.map((e,n)=>({receiver_id:t(e.receiverId,`transactions[${n}].receiverId`),action_fingerprint:t(e.actionFingerprint,`transactions[${n}].actionFingerprint`)})),unsigned_transaction_borsh_b64u:O(e.unsignedTransactionBorshB64u,`unsignedTransactionBorshB64u`)},signing_payload:{kind:`near_unsigned_transaction_borsh_v1`,unsigned_transaction_borsh_b64u:O(e.unsignedTransactionBorshB64u,`unsignedTransactionBorshB64u`),expected_signing_digest_b64u:D(e.expectedSigningDigestB64u,`expectedSigningDigestB64u`)}};return{request:n,admissionMaterial:await P(n)}}async function j(e){let n=k(e.nonce,`nonce`),r=e.callbackUrl==null?void 0:t(e.callbackUrl,`callbackUrl`),i=de({message:e.message,recipient:e.recipient,nonce:n,...r?{callbackUrl:r}:{}}),a={scope:I(e.scope,`scope`),expires_at_ms:T(e.expiresAtMs,`expiresAtMs`),display_digest:A(c(D(e.displayDigestB64u,`displayDigestB64u`))),intent:{kind:`nep413_v1`,operation_id:t(e.operationId,`operationId`),operation_fingerprint:t(e.operationFingerprint,`operationFingerprint`),near_account_id:t(e.nearAccountId,`nearAccountId`),near_network_id:e.nearNetworkId,recipient:t(e.recipient,`recipient`),message:t(e.message,`message`),nonce_b64u:n,...r?{callback_url:r}:{}},signing_payload:{kind:`nep413_message_v1`,canonical_message_b64u:i,expected_signing_digest_b64u:D(e.expectedSigningDigestB64u,`expectedSigningDigestB64u`)}};return{request:a,admissionMaterial:await P(a)}}async function M(e){let n=O(e.delegate.canonicalDelegateBorshB64u,`canonicalDelegateBorshB64u`),r={scope:I(e.scope,`scope`),expires_at_ms:T(e.expiresAtMs,`expiresAtMs`),display_digest:A(c(D(e.displayDigestB64u,`displayDigestB64u`))),intent:{kind:`near_delegate_action_v1`,operation_id:t(e.operationId,`operationId`),operation_fingerprint:t(e.operationFingerprint,`operationFingerprint`),near_account_id:t(e.nearAccountId,`nearAccountId`),near_network_id:e.nearNetworkId,delegate:{sender_id:t(e.delegate.senderId,`delegate.senderId`),receiver_id:t(e.delegate.receiverId,`delegate.receiverId`),public_key:t(e.delegate.publicKey,`delegate.publicKey`),nonce:t(e.delegate.nonce,`delegate.nonce`),max_block_height:t(e.delegate.maxBlockHeight,`delegate.maxBlockHeight`),action_fingerprint:t(e.delegate.actionFingerprint,`delegate.actionFingerprint`),canonical_delegate_borsh_b64u:n}},signing_payload:{kind:`near_delegate_action_v1`,canonical_delegate_borsh_b64u:n,expected_signing_digest_b64u:D(e.expectedSigningDigestB64u,`expectedSigningDigestB64u`)}};return{request:r,admissionMaterial:await P(r)}}function N(e){let n=I(e.scope,`scope`),r={scope:n,expires_at_ms:T(e.expiresAtMs,`expiresAtMs`),prepare_binding:{server_round1_handle:t(e.prepareResponse.server_round1_handle,`server_round1_handle`),round1_binding_digest:L(e.prepareResponse.round1_binding_digest,`round1_binding_digest`),intent_digest:L(e.admissionMaterial.intentDigest,`intent_digest`),signing_payload_digest:L(e.admissionMaterial.signingPayloadDigest,`signing_payload_digest`)},protocol:{kind:`ed25519_two_party_frost_finalize_v1`,client_commitments:z(e.clientCommitments,`clientCommitments`),server_commitments:z(e.prepareResponse.server_commitments,`serverCommitments`),client_verifying_share_b64u:t(e.clientVerifyingShareB64u,`clientVerifyingShareB64u`),server_verifying_share_b64u:t(e.prepareResponse.server_verifying_share_b64u,`serverVerifyingShareB64u`),client_signature_share_b64u:t(e.clientSignatureShareB64u,`clientSignatureShareB64u`)}};if(n.authorization.kind===`reusable_wallet_session`&&e.prepareResponse.scope.authorization.kind===`reusable_wallet_session`)return{...r,scope:{...n,authorization:n.authorization},authorized_operation:V(e.prepareResponse.authorized_operation,`authorized_operation`)};if(n.authorization.kind===`operation_step_up`&&e.prepareResponse.scope.authorization.kind===`operation_step_up`)return{...r,scope:{...n,authorization:n.authorization},authorized_operation:H(e.prepareResponse.authorized_operation,`authorized_operation`)};throw Error(`Router A/B normal-signing authorization changed after prepare`)}async function P(e){let t=A(await Q(Te(e.intent))),n=A(await Q(Ee(e.signing_payload))),r=A(await Q(G(e.signing_payload))),i=c(De(e.signing_payload));if(!ke(r.bytes,i))throw Error(`Router A/B normal-signing expected signing digest drift`);return{intentDigest:t,signingPayloadDigest:n,admittedSigningDigest:r}}function F(e,t,n){let r=Object.keys(e).sort(),i=[...t].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${n} has invalid fields`)}function I(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);F(r,[`request_id`,`account_id`,`authorization`,`material_activation`,`signing_worker_id`],n);let i={request_id:t(r.request_id,`${n}.request_id`),account_id:t(r.account_id,`${n}.account_id`),authorization:ee(r.authorization),material_activation:_(r.material_activation),signing_worker_id:t(r.signing_worker_id,`${n}.signing_worker_id`)};if(i.material_activation.signing_worker!==i.signing_worker_id)throw Error(`${n} material activation SigningWorker mismatch`);return i}function L(e,t){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`${t} must be an object`);return{bytes:E(n.bytes,`${t}.bytes`,32)}}function R(e,t){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`${t} must be an object`);let r=E(n.bytes,`${t}.bytes`);if(r.length===0)throw Error(`${t}.bytes must be non-empty`);return{bytes:r}}function z(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);return{hiding:t(r.hiding,`${n}.hiding`),binding:t(r.binding,`${n}.binding`)}}function B(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);return{server_id:t(r.server_id,`${n}.server_id`),key_epoch:t(r.key_epoch,`${n}.key_epoch`),recipient_encryption_key:t(r.recipient_encryption_key,`${n}.recipient_encryption_key`)}}function V(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);F(r,[`kind`,`authorized_operation_id`,`operation_id`,`capability_kind`,`operation_kind`,`lane_digest_b64u`,`intent_digest_b64u`,`display_digest_b64u`,`operation_fingerprint_digest`],n);let i=t(r.kind,`${n}.kind`);if(i!==`reusable_wallet_session_authorized_operation_v1`)throw Error(`${n}.kind is invalid`);let a=t(r.capability_kind,`${n}.capability_kind`);if(a!==`near_ed25519_mpc_signing`)throw Error(`${n}.capability_kind is invalid`);let o=t(r.operation_kind,`${n}.operation_kind`);if(o!==`near.sign_transaction`&&o!==`near.sign_delegate_action`&&o!==`near.sign_nep413_message`)throw Error(`${n}.operation_kind is invalid`);return{kind:i,authorized_operation_id:t(r.authorized_operation_id,`${n}.authorized_operation_id`),operation_id:t(r.operation_id,`${n}.operation_id`),capability_kind:a,operation_kind:o,lane_digest_b64u:D(r.lane_digest_b64u,`${n}.lane_digest_b64u`),intent_digest_b64u:D(r.intent_digest_b64u,`${n}.intent_digest_b64u`),display_digest_b64u:D(r.display_digest_b64u,`${n}.display_digest_b64u`),operation_fingerprint_digest:D(r.operation_fingerprint_digest,`${n}.operation_fingerprint_digest`)}}function H(e,n){let r=e&&typeof e==`object`?e:null;if(!r)throw Error(`${n} must be an object`);if(F(r,[`kind`,`authorization_session_id`,`evidence_set_digest`,`authorized_operation_id`,`operation_id`,`capability_kind`,`operation_kind`,`lane_digest_b64u`,`intent_digest_b64u`,`display_digest_b64u`,`operation_fingerprint_digest`],n),t(r.kind,`${n}.kind`)!==`verified_step_up_authorized_operation_v1`)throw Error(`${n}.kind is invalid`);if(t(r.capability_kind,`${n}.capability_kind`)!==`near_ed25519_mpc_signing`)throw Error(`${n}.capability_kind is invalid`);let i=t(r.operation_kind,`${n}.operation_kind`);if(i!==`near.sign_transaction`&&i!==`near.sign_delegate_action`&&i!==`near.sign_nep413_message`)throw Error(`${n}.operation_kind is invalid`);return{kind:`verified_step_up_authorized_operation_v1`,authorization_session_id:t(r.authorization_session_id,`${n}.authorization_session_id`),evidence_set_digest:D(r.evidence_set_digest,`${n}.evidence_set_digest`),authorized_operation_id:t(r.authorized_operation_id,`${n}.authorized_operation_id`),operation_id:t(r.operation_id,`${n}.operation_id`),capability_kind:`near_ed25519_mpc_signing`,operation_kind:i,lane_digest_b64u:D(r.lane_digest_b64u,`${n}.lane_digest_b64u`),intent_digest_b64u:D(r.intent_digest_b64u,`${n}.intent_digest_b64u`),display_digest_b64u:D(r.display_digest_b64u,`${n}.display_digest_b64u`),operation_fingerprint_digest:D(r.operation_fingerprint_digest,`${n}.operation_fingerprint_digest`)}}function pe(e){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`Router A/B normal-signing prepare response must be an object`);let r=t(n.signature_scheme,`signature_scheme`);if(r!==`ed25519_v1`)throw Error(`Unsupported Router A/B normal-signing signature scheme: ${r}`);let i=I(n.scope,`scope`),a={scope:i,signing_payload_digest:L(n.signing_payload_digest,`signing_payload_digest`),round1_binding_digest:L(n.round1_binding_digest,`round1_binding_digest`),signing_worker:B(n.signing_worker,`signing_worker`),server_round1_handle:t(n.server_round1_handle,`server_round1_handle`),server_commitments:z(n.server_commitments,`server_commitments`),server_verifying_share_b64u:t(n.server_verifying_share_b64u,`server_verifying_share_b64u`),signature_scheme:`ed25519_v1`,prepared_at_ms:T(n.prepared_at_ms,`prepared_at_ms`),expires_at_ms:T(n.expires_at_ms,`expires_at_ms`)};switch(i.authorization.kind){case`reusable_wallet_session`:return F(n,[`scope`,`signing_payload_digest`,`round1_binding_digest`,`signing_worker`,`server_round1_handle`,`server_commitments`,`server_verifying_share_b64u`,`signature_scheme`,`prepared_at_ms`,`expires_at_ms`,`authorized_operation`],`Router A/B reusable Wallet Session prepare response`),{...a,scope:{...i,authorization:i.authorization},authorized_operation:V(n.authorized_operation,`authorized_operation`)};case`operation_step_up`:return F(n,[`scope`,`signing_payload_digest`,`round1_binding_digest`,`signing_worker`,`server_round1_handle`,`server_commitments`,`server_verifying_share_b64u`,`signature_scheme`,`prepared_at_ms`,`expires_at_ms`,`authorized_operation`],`Router A/B operation step-up prepare response`),{...a,scope:{...i,authorization:i.authorization},authorized_operation:H(n.authorized_operation,`authorized_operation`)}}}function me(e){let n=e&&typeof e==`object`?e:null;if(!n)throw Error(`Router A/B normal-signing response must be an object`);F(n,[`scope`,`signing_payload_digest`,`signing_worker`,`signature_scheme`,`signature`,`signed_at_ms`],`Router A/B normal-signing response`);let r=t(n.signature_scheme,`signature_scheme`);if(r!==`ed25519_v1`)throw Error(`Unsupported Router A/B normal-signing signature scheme: ${r}`);return{scope:I(n.scope,`scope`),signing_payload_digest:L(n.signing_payload_digest,`signing_payload_digest`),signing_worker:B(n.signing_worker,`signing_worker`),signature_scheme:`ed25519_v1`,signature:R(n.signature,`signature`),signed_at_ms:T(n.signed_at_ms,`signed_at_ms`)}}function he(e){let t=e.credential.kind===`wallet_session_opaque`?{token:e.credential.walletSessionToken,home:e.credential.home}:null;return a({...t?{headers:r(t)}:{},body:e.body})}function ge(e){if(!e.trim())return null;try{let t=JSON.parse(e),n=t&&typeof t==`object`?t:null;if(!n)return null;let r=String(n.code||``).trim(),i=String(n.message||``).trim();if(!r)return null;let a=n.authorization_decision===void 0?void 0:_e(n.authorization_decision);return{code:r,message:i,...a?{authorizationDecision:a}:{}}}catch{return null}}function _e(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`Router A/B owner-operation authorization decision is invalid`);let t=e,n=t.kind;if(n===`step_up_required`){U(t,[`kind`,`reason`,`step_up`],`owner-operation step-up decision`);let e=t.reason;if(e!==`wallet_session_missing`&&e!==`wallet_session_expired`&&e!==`wallet_session_exhausted`&&e!==`wallet_session_ended`&&e!==`wallet_session_superseded`)throw Error(`owner-operation step-up decision reason is invalid`);let r=t.step_up;return r&&typeof r==`object`&&!Array.isArray(r)&&`operation_digests`in r?{kind:n,reason:e,step_up:h(r)}:{kind:n,reason:e,step_up:ve(r)}}if(n===`denied`){if(U(t,[`kind`,`denial`],`owner-operation denial decision`),!t.denial||typeof t.denial!=`object`||Array.isArray(t.denial))throw Error(`owner-operation denial is invalid`);let e=t.denial;U(e,[`code`,`message`],`owner-operation denial`);let r=e.code;if(r!==`invalid_identity`&&r!==`invalid_authority`&&r!==`invalid_operation`&&r!==`inactive_material`&&r!==`replayed_step_up`&&r!==`authorization_unavailable`)throw Error(`owner-operation denial code is invalid`);if(typeof e.message!=`string`||e.message.trim()!==e.message)throw Error(`owner-operation denial message is invalid`);return{kind:n,denial:{code:r,message:e.message}}}if(n===`authorized`){if(U(t,[`kind`,`operation`,`source`],`owner-operation decision`),!t.operation||typeof t.operation!=`object`||Array.isArray(t.operation))throw Error(`owner-operation authorized operation is invalid`);let e=t.operation;if(U(e,[`kind`,`operation_id`,`authorized_operation_id`,`operation_fingerprint_digest`],`owner-operation authorized operation`),e.kind!==`authorized_operation`||typeof e.operation_id!=`string`||typeof e.authorized_operation_id!=`string`||typeof e.operation_fingerprint_digest!=`string`)throw Error(`owner-operation authorized operation is invalid`);if(!t.source||typeof t.source!=`object`||Array.isArray(t.source))throw Error(`owner-operation authorized source is invalid`);let r=t.source;if(U(r,[`kind`,`wallet_session_id`,`quota_id`],`owner-operation authorized source`),r.kind!==`reusable_wallet_session`||typeof r.wallet_session_id!=`string`||typeof r.quota_id!=`string`)throw Error(`owner-operation authorized source is invalid`);return{kind:n,operation:{kind:`authorized_operation`,operation_id:e.operation_id,authorized_operation_id:e.authorized_operation_id,operation_fingerprint_digest:e.operation_fingerprint_digest},source:{kind:`reusable_wallet_session`,wallet_session_id:r.wallet_session_id,quota_id:r.quota_id}}}throw Error(`owner-operation authorization decision kind is invalid`)}function ve(e){if(!e||typeof e!=`object`||Array.isArray(e))throw Error(`Ed25519 operation step-up preparation is invalid`);let t=e;U(t,[`wallet_id`,`operation_kind`,`operation_id`,`request_id`,`account_id`,`material_activation`,`signing_worker_id`,`near_account_id`,`signer_slot`,`participant_ids`,`expires_at_ms`],`Ed25519 owner-operation step-up preparation`);let n=t.operation_kind;if(n!==`near.sign_transaction`&&n!==`near.sign_delegate_action`&&n!==`near.sign_nep413_message`)throw Error(`Ed25519 operation step-up kind is invalid`);if(typeof t.wallet_id!=`string`||typeof t.operation_id!=`string`||typeof t.request_id!=`string`||typeof t.account_id!=`string`||typeof t.signing_worker_id!=`string`||typeof t.near_account_id!=`string`||!Number.isSafeInteger(t.signer_slot)||!Number.isSafeInteger(t.expires_at_ms)||!Array.isArray(t.participant_ids)||t.participant_ids.length!==2||!t.participant_ids.every(e=>Number.isSafeInteger(e)&&Number(e)>0))throw Error(`Ed25519 operation step-up preparation fields are invalid`);let[r,i]=t.participant_ids,a=t.signer_slot,o=t.expires_at_ms;if(typeof r!=`number`||typeof i!=`number`||typeof a!=`number`||typeof o!=`number`)throw Error(`Ed25519 operation step-up participants are invalid`);return{wallet_id:t.wallet_id,operation_kind:n,operation_id:t.operation_id,request_id:t.request_id,account_id:t.account_id,material_activation:_(t.material_activation),signing_worker_id:t.signing_worker_id,near_account_id:t.near_account_id,signer_slot:a,participant_ids:[r,i],expires_at_ms:o}}function U(e,t,n){let r=new Set(t);for(let t of Object.keys(e))if(!r.has(t))throw Error(`${n} contains unsupported field ${t}`);for(let r of t)if(!Object.hasOwn(e,r))throw Error(`${n} is missing ${r}`)}function ye(e){let t=ge(e.bodyText);return t?w({code:t.code,message:t.message,path:e.path,status:e.status,authorizationDecision:t.authorizationDecision})||oe({code:t.code,message:`Router A/B signing ${e.path} returned HTTP ${e.status}: ${t.message}`})||new C({code:t.code,message:t.message,path:e.path,status:e.status}):Error(`Router A/B signing ${e.path} returned HTTP ${e.status}${e.bodyText?`: ${e.bodyText}`:``}`)}async function W(e){if(typeof fetch!=`function`)throw Error(`fetch is not available for Router A/B normal-signing request`);let n=o(t(e.relayServerUrl,`relayServerUrl`)),r=await i(new Request(`${n}${e.path}`,{...he({credential:e.credential,body:e.body}),signal:e.signal}));try{e.onServerTiming?.(r.headers.get(`Server-Timing`))}catch{}if(!r.ok){let t=await r.text().catch(()=>``),n=ye({path:e.path,status:r.status,bodyText:t});throw e.credential.kind===`wallet_session_opaque`&&n instanceof y&&n.failure.kind===`exhausted`&&ae.forgetCredential(e.credential.walletSessionToken),n}return e.parse(await r.json())}function be(t,n){let r=e(n,`Ed25519 prepare response`);if(r.kind!==t.scope.authorization.kind)throw Error(`Ed25519 prepare authorization kind does not match the request`);let i=pe(r.signing);if(t.scope.authorization.kind===`operation_step_up`)return U(r,[`kind`,`signing`],`Ed25519 step-up prepare response`),{kind:`operation_step_up`,signing:i};U(r,[`kind`,`signing`,`session_status`],`Ed25519 session prepare response`);let a=e(r.session_status,`Ed25519 prepare session status`),o=m(t.scope.authorization.wallet_session_id),s=p(a.quotaId);if(!o.ok||!s.ok)throw Error(`Invalid Ed25519 prepare session identity`);let c=v(a,{walletSessionId:o.value,quotaId:s.value});if(!c||c.status!==`active`)throw Error(`Ed25519 prepare did not return an active Wallet Session`);return{kind:`reusable_wallet_session`,signing:i,sessionStatus:c}}async function xe(e){return W({relayServerUrl:e.relayServerUrl,path:`/router-ab/ed25519/sign/prepare`,credential:e.credential,body:e.request,parse:be.bind(null,e.request)})}async function Se(e){return await te(e.request),W({relayServerUrl:e.relayServerUrl,path:`/router-ab/ecdsa-derivation/sign/prepare`,onServerTiming:e.onServerTiming,credential:e.credential,body:e.request,parse:se.bind(null,e.request)})}async function Ce(e){return W({relayServerUrl:e.relayServerUrl,path:`/router-ab/ed25519/sign`,credential:e.credential,body:e.request,parse:me})}async function we(e){return await g(e.request),W({relayServerUrl:e.relayServerUrl,path:`/router-ab/ecdsa-derivation/sign`,onServerTiming:e.onServerTiming,credential:e.credential,body:e.request,parse:t=>re(e.request,t)})}function Te(e){let t=[];switch(J(t,$(`router-ab-protocol/ed25519-normal-signing/intent/v2`)),e.kind){case`near_transaction_v1`:J(t,$(`near_transaction_v1`)),K(t,e),X(t,e.transactions.length);for(let n of e.transactions)J(t,$(n.receiver_id)),J(t,$(n.action_fingerprint));return J(t,$(e.unsigned_transaction_borsh_b64u)),Uint8Array.from(t);case`nep413_v1`:return J(t,$(`nep413_v1`)),K(t,e),J(t,$(e.recipient)),J(t,$(e.message)),J(t,$(e.nonce_b64u)),Oe(t,e.callback_url),Uint8Array.from(t);case`near_delegate_action_v1`:return J(t,$(`near_delegate_action_v1`)),K(t,e),J(t,$(e.delegate.sender_id)),J(t,$(e.delegate.receiver_id)),J(t,$(e.delegate.public_key)),J(t,$(e.delegate.nonce)),J(t,$(e.delegate.max_block_height)),J(t,$(e.delegate.action_fingerprint)),J(t,$(e.delegate.canonical_delegate_borsh_b64u)),Uint8Array.from(t)}}function Ee(e){let t=[];switch(J(t,$(`router-ab-protocol/ed25519-normal-signing/payload/v2`)),e.kind){case`near_unsigned_transaction_borsh_v1`:return J(t,$(`near_unsigned_transaction_borsh_v1`)),J(t,$(e.unsigned_transaction_borsh_b64u)),J(t,$(e.expected_signing_digest_b64u)),Uint8Array.from(t);case`nep413_message_v1`:return J(t,$(`nep413_message_v1`)),J(t,$(e.canonical_message_b64u)),J(t,$(e.expected_signing_digest_b64u)),Uint8Array.from(t);case`near_delegate_action_v1`:return J(t,$(`near_delegate_action_v1`)),J(t,$(e.canonical_delegate_borsh_b64u)),J(t,$(e.expected_signing_digest_b64u)),Uint8Array.from(t)}}function G(e){switch(e.kind){case`near_unsigned_transaction_borsh_v1`:return c(e.unsigned_transaction_borsh_b64u);case`nep413_message_v1`:return c(e.canonical_message_b64u);case`near_delegate_action_v1`:return c(e.canonical_delegate_borsh_b64u)}}function De(e){switch(e.kind){case`near_unsigned_transaction_borsh_v1`:case`nep413_message_v1`:case`near_delegate_action_v1`:return e.expected_signing_digest_b64u}}function K(e,t){J(e,$(t.operation_id)),J(e,$(t.operation_fingerprint)),J(e,$(t.near_account_id)),J(e,$(t.near_network_id))}function Oe(e,t){t?(e.push(1),J(e,$(t))):e.push(0)}function q(e,t){let n=$(t);Z(e,n.length),Y(e,n)}function J(e,t){X(e,t.length),Y(e,t)}function Y(e,t){for(let n of t)e.push(n)}function X(e,t){e.push(t>>>24&255,t>>>16&255,t>>>8&255,t&255)}function Z(e,t){e.push(t&255,t>>>8&255,t>>>16&255,t>>>24&255)}async function Q(e){let t=globalThis.crypto?.subtle;if(!t)throw Error(`Web Crypto SHA-256 is unavailable for Router A/B normal signing`);let n=new Uint8Array(e.length);return n.set(e),new Uint8Array(await t.digest(`SHA-256`,n.buffer))}function $(e){return new TextEncoder().encode(e)}function ke(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}export{N as a,Se as c,ue as d,b as f,j as i,xe as l,M as n,we as o,x as p,fe as r,Ce as s,C as t,le as u};