@seams/wallet 0.29.0 → 0.31.0

package/dist/{esm/sdk/device-linking-_o3_fgiG.js → public/sdk/device-linking-BL2aDEUF.js}

@@ -1 +1 @@
-import{A as e,E as t,N as n,O as r,d as i,f as a,g as o,i as s,k as c,u as l}from"./domainIds-t1lp25yU.js";import{S as u,t as ee,y as te}from"./digests-BIaE0DMd.js";import{i as d,r as f}from"./base64-BmKR3UqU.js";import{C as p,D as ne,E as m,H as h,J as g,K as _,O as re,P as v,R as ie,S as y,T as ae,U as oe,W as b,_ as x,b as S,c as C,d as w,f as se,g as T,h as E,k as ce,l as D,m as O,n as le,o as ue,p as k,q as A,s as de,u as j,v as fe,w as pe,x as M,y as N}from"./activeWalletSession-BJ4B-nJo.js";import{d as me,f as he,h as ge,m as _e,p as ve}from"./capabilityKinds-DVlGMspk.js";import{a as ye,o as P,r as F}from"./canonicalPrimitives-Jd3i_Ngz.js";import{$ as be,F as xe,I as Se,L as Ce,P as we,V as Te,_ as Ee,d as De,f as Oe,g as ke,x as Ae,y as je}from"./walletAuthority-DbGaSw7D.js";import{It as Me,Nt as Ne,a as I,i as Pe,n as L,o as Fe,r as Ie,s as R,t as z}from"./digestEncoding-34kXJoJr.js";import{r as Le}from"./walletAuthMethodRecord-BW-XV4fv.js";function Re(e){throw Error(`[LinkSessionStateV1] unsupported state: ${String(e)}`)}const ze=`x25519-hkdf-sha256-chacha20poly1305-v1`,Be=/^[A-Za-z0-9_-]+$/,Ve=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`registeredAtMs`],He=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`ephemeralPublicKeyB64u`,`nonceB64u`,`sealedExportRootB64u`,`bindingDigestB64u`,`ciphertextDigestB64u`,`sealedAtMs`];function Ue(e,t=`recipientPublicKeyB64u`){if(typeof e!=`string`||!Be.test(e))throw Error(`${t} must be unpadded base64url`);let n;try{n=f(e)}catch{throw Error(`${t} must be valid base64url`)}if(d(n)!==e)throw Error(`${t} must be canonical base64url`);if(n.length!==32)throw Error(`${t} must decode to a 32-byte X25519 public key`);return e}function We(e){return{linkSessionId:e.linkSessionId,walletId:e.walletId,walletKeyId:e.walletKeyId,targetFactor:e.targetFactor,enrollmentId:e.enrollmentId,deviceId:e.deviceId,revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:e.applicationBindingDigestB64u,registeredPublicKeyB64u:e.registeredPublicKeyB64u,recipientPublicKeyB64u:e.recipientPublicKeyB64u}}function Ge(e){return JSON.stringify({linkSessionId:String(e.linkSessionId),walletId:String(e.walletId),walletKeyId:String(e.walletKeyId),targetFactor:e.targetFactor,enrollmentId:String(e.enrollmentId),deviceId:String(e.deviceId),revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:String(e.applicationBindingDigestB64u),registeredPublicKeyB64u:String(e.registeredPublicKeyB64u),recipientPublicKeyB64u:String(e.recipientPublicKeyB64u)})}function Ke(t){let n=Ye(t,Ve,`LinkedDeviceEd25519ExportRootRecipientV1`);if(n.kind!==`linked_device_ed25519_export_root_recipient_v1`)throw Error(`LinkedDeviceEd25519ExportRootRecipientV1.kind is invalid`);return Xe(n.transferAlg,`LinkedDeviceEd25519ExportRootRecipientV1.transferAlg`),{kind:`linked_device_ed25519_export_root_recipient_v1`,linkSessionId:v(l(n.linkSessionId),`LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId`),walletId:v(c(n.walletId),`walletId`),walletKeyId:v(e(n.walletKeyId),`walletKeyId`),enrollmentId:v(i(n.enrollmentId),`enrollmentId`),deviceId:v(a(n.deviceId),`deviceId`),transferAlg:ze,applicationBindingDigestB64u:m(n.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:ne(n.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:Je(n.targetFactor),revocationEpoch:Ze(n.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:Ue(n.recipientPublicKeyB64u,`recipientPublicKeyB64u`),registeredAtMs:Qe(n.registeredAtMs,`registeredAtMs`)}}function qe(t){let n=Ye(t,He,`LinkedDeviceEd25519ExportRootPackageV1`);if(n.kind!==`linked_device_ed25519_export_root_package_v1`)throw Error(`LinkedDeviceEd25519ExportRootPackageV1.kind is invalid`);Xe(n.transferAlg,`LinkedDeviceEd25519ExportRootPackageV1.transferAlg`);let r=Ue(n.recipientPublicKeyB64u,`recipientPublicKeyB64u`),o=Ue(n.ephemeralPublicKeyB64u,`ephemeralPublicKeyB64u`);if(r===o)throw Error(`ephemeralPublicKeyB64u repeats the recipient key`);return{kind:`linked_device_ed25519_export_root_package_v1`,linkSessionId:v(l(n.linkSessionId),`linkSessionId`),walletId:v(c(n.walletId),`walletId`),walletKeyId:v(e(n.walletKeyId),`walletKeyId`),enrollmentId:v(i(n.enrollmentId),`enrollmentId`),deviceId:v(a(n.deviceId),`deviceId`),transferAlg:ze,applicationBindingDigestB64u:m(n.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:ne(n.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:Je(n.targetFactor),revocationEpoch:Ze(n.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:r,ephemeralPublicKeyB64u:o,nonceB64u:ce(n.nonceB64u,`nonceB64u`),sealedExportRootB64u:re(n.sealedExportRootB64u,`sealedExportRootB64u`),bindingDigestB64u:m(n.bindingDigestB64u,`bindingDigestB64u`),ciphertextDigestB64u:m(n.ciphertextDigestB64u,`ciphertextDigestB64u`),sealedAtMs:Qe(n.sealedAtMs,`sealedAtMs`)}}function Je(e){switch(Ye(e,[`kind`],`targetFactor`).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`targetFactor.kind is unsupported`)}}function Ye(e,t,n){let r=u(e,n);g(r,t,n);for(let e of t)if(r[e]===void 0)throw Error(`${n}.${e} is required`);return r}function Xe(e,t){if(e!==`x25519-hkdf-sha256-chacha20poly1305-v1`)throw Error(`${t} must be ${ze}`)}function Ze(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function Qe(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive unix-millisecond timestamp`);return e}function B(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);return e}function V(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} must not be empty`);if(n!==e)throw Error(`${t} must not be padded with whitespace`);return n}function $e(e,t){let r=n(V(e,t));if(!r.ok)throw Error(`${t} is invalid: ${r.error.message}`);return r.value}function H(e,t,n){if(e!==t)throw Error(`${n} must be ${String(t)}`);return t}function et(e){let t=`WalletAddAuthMethodRegistrationOptions`,n=B(e,t);H(n.kind,`webauthn_add_auth_method_registration_v1`,`${t}.kind`);let r=B(n.user,`${t}.user`),i=B(n.authenticatorSelection,`${t}.authenticatorSelection`),a=B(B(B(n.extensions,`${t}.extensions`).prf,`${t}.extensions.prf`).eval,`${t}.extensions.prf.eval`);if(!Array.isArray(n.pubKeyCredParams)||n.pubKeyCredParams.length!==2)throw Error(`${t}.pubKeyCredParams must list exactly two algorithms`);let[o,s]=n.pubKeyCredParams;if(H(B(o,`${t}.pubKeyCredParams[0]`).type,`public-key`,`${t}.pubKeyCredParams[0].type`),H(B(o,`${t}.pubKeyCredParams[0]`).alg,-7,`${t}.pubKeyCredParams[0].alg`),H(B(s,`${t}.pubKeyCredParams[1]`).type,`public-key`,`${t}.pubKeyCredParams[1].type`),H(B(s,`${t}.pubKeyCredParams[1]`).alg,-257,`${t}.pubKeyCredParams[1].alg`),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);let c=n.excludeCredentials.map((e,n)=>{let r=B(e,`${t}.excludeCredentials[${n}]`);return{type:H(r.type,`public-key`,`${t}.excludeCredentials[${n}].type`),id:V(r.id,`${t}.excludeCredentials[${n}].id`)}}),l=n.timeoutMs;if(typeof l!=`number`||!Number.isSafeInteger(l)||l<=0)throw Error(`${t}.timeoutMs must be a positive safe integer`);return{kind:`webauthn_add_auth_method_registration_v1`,challengeId:V(n.challengeId,`${t}.challengeId`),challengeB64u:V(n.challengeB64u,`${t}.challengeB64u`),rpId:$e(n.rpId,`${t}.rpId`),user:{idB64u:V(r.idB64u,`${t}.user.idB64u`),name:V(r.name,`${t}.user.name`),displayName:V(r.displayName,`${t}.user.displayName`)},pubKeyCredParams:[{type:`public-key`,alg:-7},{type:`public-key`,alg:-257}],authenticatorSelection:{residentKey:H(i.residentKey,`required`,`${t}.authenticatorSelection.residentKey`),userVerification:H(i.userVerification,`preferred`,`${t}.authenticatorSelection.userVerification`)},timeoutMs:l,attestation:H(n.attestation,`none`,`${t}.attestation`),extensions:{prf:{eval:{firstB64u:V(a.firstB64u,`${t}.extensions.prf.eval.firstB64u`),secondB64u:V(a.secondB64u,`${t}.extensions.prf.eval.secondB64u`)}}},excludeCredentials:c}}function tt(e){let t=ut(e);if(t.kind!==`committed_authority_packages_v1`)throw Error(`CommittedAuthorityPackagesV1.kind is invalid`);let n=De(t.authority);if(!n.ok||n.value.state!==`pending_local_install`)throw Error(`CommittedAuthorityPackagesV1.authority is not pending`);let r=Le(t.authMethod);if(!r||r.status!==`pending_local_install`||r.kind===`voiceid`)throw Error(`CommittedAuthorityPackagesV1.authMethod is not pending`);if(r.walletId!==n.value.walletId||r.walletAuthorityId!==n.value.authorityId)throw Error(`CommittedAuthorityPackagesV1 authority and auth method identities differ`);let i=rt(t.signerPackages);nt(i,n.value.signerActivations);let a=t.ed25519ExportRootPackage===null?null:qe(t.ed25519ExportRootPackage);if(a&&(a.walletId!==n.value.walletId||a.revocationEpoch!==n.value.revocationEpoch||n.value.provenance.kind!==`device_link`||a.enrollmentId!==n.value.provenance.enrollmentId||a.linkSessionId!==n.value.provenance.linkSessionId||String(a.deviceId)!==String(n.value.principal.deviceId)))throw Error(`CommittedAuthorityPackagesV1 export root identity does not match authority`);return{kind:`committed_authority_packages_v1`,authority:n.value,authMethod:r,signerPackages:i,ed25519ExportRootPackage:a,packageSetDigestB64u:it(t.packageSetDigestB64u)}}function nt(e,t){if(e.keyFamilies.length!==t.keyFamilies.length)throw Error(`CommittedAuthorityPackagesV1 signer families do not match authority`);for(let n=0;n<e.keyFamilies.length;n+=1)if(e.keyFamilies[n]!==t.keyFamilies[n])throw Error(`CommittedAuthorityPackagesV1 signer family order does not match authority`);if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`){if(!t.ed25519||!e.ed25519)throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation is missing`);if(!s(e.ed25519.materialActivation,t.ed25519.materialActivation))throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation does not match authority`);return}if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`){if(!t.ecdsa||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 ECDSA activation is missing`);if(!s(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 ECDSA activation does not match authority`);return}if(!t.ed25519||!t.ecdsa||!e.ed25519||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 combined activations are incomplete`);if(!s(e.ed25519.materialActivation,t.ed25519.materialActivation)||!s(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 activation references do not match authority`)}function rt(e){let t=dt(e);if(t.kind!==`committed_signer_package_set_v1`)throw Error(`CommittedSignerPackageSetV1.kind is invalid`);let n=lt(t.keyFamilies);if(n.length===1&&n[0]===`ed25519`){if(!(`ed25519`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:at(t.ed25519)}}if(n.length===1&&n[0]===`ecdsa_secp256k1`){if(!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ecdsa:ot(t.ecdsa)}}if(!(`ed25519`in t)||!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);let r=at(t.ed25519),i=ot(t.ecdsa);if(r.materialActivation.activationId===i.materialActivation.activationId)throw Error(`CommittedSignerPackageSetV1 activation references must be distinct`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:r,ecdsa:i}}function it(e){return F(e)}function at(e){let t=ft(e);if(t.kind!==`committed_ed25519_signer_package_v1`)throw Error(`CommittedEd25519SignerPackageV1.kind is invalid`);let n=ct(t.materialActivation,`materialActivation`),r=Se(t.targetBinding),i=xe(t.applicationBinding),a=we(t.activationReceipt);if(!s(n,Ne(a.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 activation receipt does not match material`);if(!s(n,Ne(r.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 target binding does not match material`);let o=st(t.deriver_a_client_package,`deriver_a_client_package`,`deriver_a`),c=st(t.deriver_b_client_package,`deriver_b_client_package`,`deriver_b`);if(!be(a.transcript,o.transcript)||!be(a.transcript,c.transcript))throw Error(`CommittedEd25519SignerPackageV1 receipt transcript does not match packages`);return{kind:`committed_ed25519_signer_package_v1`,materialActivation:n,targetBinding:r,applicationBinding:i,participantIds:Te(t.participantIds),activationReceipt:a,deriver_a_client_package:o,deriver_b_client_package:c}}function ot(e){let t=pt(e);if(t.kind!==`committed_ecdsa_signer_package_v1`)throw Error(`CommittedEcdsaSignerPackageV1.kind is invalid`);let n=ct(t.materialActivation,`materialActivation`),r=Ee(t.activationReceipt),i=r.binding.target.activation;if(!s(n,i))throw Error(`CommittedEcdsaSignerPackageV1 receipt activation does not match material`);let a=ke(t.encryptedTargetClientShare,`encryptedTargetClientShare`);if(a.recipientPublicKeyB64u!==r.binding.target.clientRecipientPublicKeyB64u)throw Error(`CommittedEcdsaSignerPackageV1 client share recipient does not match receipt`);return{kind:`committed_ecdsa_signer_package_v1`,materialActivation:n,encryptedTargetClientShare:a,activationReceipt:r}}function st(e,t,n){let r=Ce(e);if(!r.ok)throw Error(`${t} ${r.message}`);if(r.value.kind!==`activation_client`||r.value.deriver!==n)throw Error(`${t} must be an activation_client for ${n}`);return{kind:`activation_client`,deriver:n,session:r.value.session,transcript:r.value.transcript,encapsulated_key:r.value.encapsulated_key,ciphertext:r.value.ciphertext}}function ct(e,t){let n=o(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function lt(e){if(!Array.isArray(e))throw Error(`CommittedSignerPackageSetV1.keyFamilies must be an array`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`CommittedSignerPackageSetV1.keyFamilies must use canonical family order`)}function ut(e){let t=mt(e);if(t===null)throw Error(`CommittedAuthorityPackagesV1 must be an object`);return U(t,[`kind`,`authority`,`authMethod`,`signerPackages`,`ed25519ExportRootPackage`,`packageSetDigestB64u`],`CommittedAuthorityPackagesV1`),{kind:Reflect.get(t,`kind`),authority:Reflect.get(t,`authority`),authMethod:Reflect.get(t,`authMethod`),signerPackages:Reflect.get(t,`signerPackages`),ed25519ExportRootPackage:Reflect.get(t,`ed25519ExportRootPackage`),packageSetDigestB64u:Reflect.get(t,`packageSetDigestB64u`)}}function dt(e){let t=mt(e);if(t===null)throw Error(`CommittedSignerPackageSetV1 must be an object`);let n=Object.keys(t),r=n.includes(`ed25519`),i=n.includes(`ecdsa`);return r&&i?(U(t,[`kind`,`keyFamilies`,`ed25519`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`),ecdsa:Reflect.get(t,`ecdsa`)}):r?(U(t,[`kind`,`keyFamilies`,`ed25519`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`)}):i?(U(t,[`kind`,`keyFamilies`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ecdsa:Reflect.get(t,`ecdsa`)}):(U(t,[`kind`,`keyFamilies`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`)})}function ft(e){let t=mt(e);if(t===null)throw Error(`CommittedEd25519SignerPackageV1 must be an object`);return U(t,[`kind`,`materialActivation`,`targetBinding`,`applicationBinding`,`participantIds`,`activationReceipt`,`deriver_a_client_package`,`deriver_b_client_package`],`CommittedEd25519SignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),targetBinding:Reflect.get(t,`targetBinding`),applicationBinding:Reflect.get(t,`applicationBinding`),participantIds:Reflect.get(t,`participantIds`),activationReceipt:Reflect.get(t,`activationReceipt`),deriver_a_client_package:Reflect.get(t,`deriver_a_client_package`),deriver_b_client_package:Reflect.get(t,`deriver_b_client_package`)}}function pt(e){let t=mt(e);if(t===null)throw Error(`CommittedEcdsaSignerPackageV1 must be an object`);return U(t,[`kind`,`materialActivation`,`encryptedTargetClientShare`,`activationReceipt`],`CommittedEcdsaSignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),encryptedTargetClientShare:Reflect.get(t,`encryptedTargetClientShare`),activationReceipt:Reflect.get(t,`activationReceipt`)}}function mt(e){return typeof e==`object`&&e&&!Array.isArray(e)?e:null}function U(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length)throw Error(`${n} contains unexpected fields`);for(let e of i)if(!r.has(e))throw Error(`${n} contains unexpected fields`);for(let r of t)if(!Object.prototype.hasOwnProperty.call(e,r))throw Error(`${n}.${r} is required`)}const ht=[`version`,`purpose`,`linkSessionId`,`linkPublicKeyB64u`,`devicePublicKeyB64u`,`requestedPermission`,`targetFactor`,`issuedAtMs`,`expiresAtMs`];function gt(...e){return(t,n)=>{if(!e.includes(t))throw Error(`${n} is unsupported`);return t}}function _t(e,t){if(typeof e!=`string`||!/^[0-9a-f]{64}$/.test(e))throw Error(`${t} must be 32 canonical lowercase hex bytes`);return e}function W(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=f(e);if(t.length!==32||d(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be a canonical 32-byte unpadded base64url key`)}return e}function G(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=f(e);if(t.length===0||d(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be canonical unpadded base64url`)}return e}function vt(e,t,n){let r=G(e,n),i=f(r);try{if(i.length!==t)throw Error(`${n} must encode ${t} bytes`);return r}finally{i.fill(0)}}const K=BigInt(`0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff`),yt=K-3n,bt=BigInt(`0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b`);function xt(e){let t=0n;for(let n of e)t=t<<8n|BigInt(n);return t}function St(e){let t=xt(e.subarray(1,33)),n=xt(e.subarray(33,65));return t>=K||n>=K?!1:n*n%K===(t*t*t%K+yt*t%K+bt)%K}function q(e,t){let n=vt(e,65,t),r=f(n);try{if(r[0]!==4)throw Error(`${t} must be an uncompressed SEC1 P-256 point`);if(!St(r))throw Error(`${t} must be an on-curve P-256 point`);return n}finally{r.fill(0)}}function Ct(e){return W(e,`LinkDevicePublicKeyB64u`)}function wt(e,t){return de(G(e,t),t)}function Tt(e,t){if(e!==`ed25519`&&e!==`ecdsa_secp256k1`)throw Error(`${t} must identify a supported key family`);return e}function J(e,t,n){if(t<=e)throw Error(`${n}.expiresAtMs must be after issuedAtMs`)}function Et(e){return{kind:e.kind,permissions:[...ie(e)]}}function Dt(e){let t={version:e.version,purpose:e.purpose,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:Et(e.requestedPermission),targetFactor:e.targetFactor,issuedAtMs:e.issuedAtMs,expiresAtMs:e.expiresAtMs};return e.targetFactor.kind===`email_otp`?{...t,targetEmail:e.targetEmail}:t}function Y(e,t){switch(A(e,[`kind`],t).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`${t}.kind is unsupported`)}}function Ot(){return b({kind:h(`passkey_prf`)})}function kt(){return b({kind:h(`email_otp`)})}function At(){return b({kind:h(`existing_enrollment`)})}function jt(){return b({kind:h(`new_enrollment`)})}function Mt(){return _(`kind`,[At(),jt()])}function Nt(e,t){return Mt()(e,t)}function Pt(){return b({enrollmentSealKeyVersion:O,clientUnlockPublicKeyB64u:O,unlockKeyVersion:O,serverSealedFactorCiphertextB64u:O})}function Ft(e,t){let n=u(e,t);if(n.kind===`passkey_prf`)return A(n,[`kind`],t),{kind:`passkey_prf`};if(n.kind===`email_otp`){let e=Nt(n.enrollment,`${t}.enrollment`),r=T(n.targetEmail,`${t}.targetEmail`);return e.kind===`existing_enrollment`?{kind:`email_otp`,targetEmail:r,enrollment:e,baseWalletAuthMethodId:S(A(n,[`kind`,`targetEmail`,`enrollment`,`baseWalletAuthMethodId`],t).baseWalletAuthMethodId,`${t}.baseWalletAuthMethodId`)}:(A(n,[`kind`,`targetEmail`,`enrollment`],t),{kind:`email_otp`,targetEmail:r,enrollment:e})}throw Error(`${t}.kind is unsupported`)}function It(e){if(e.version!==`v5`)throw Error(`QrLinkedDeviceSessionPayloadV5.version is invalid`);if(e.purpose!==`linked_device_lane_creation`)throw Error(`QrLinkedDeviceSessionPayloadV5.purpose is invalid`);let t=x(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=x(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);J(t,n,`QrLinkedDeviceSessionPayloadV5`);let r={version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:N(e.linkSessionId,`QrLinkedDeviceSessionPayloadV5.linkSessionId`),linkPublicKeyB64u:W(e.linkPublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.linkPublicKeyB64u`),devicePublicKeyB64u:W(e.devicePublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.devicePublicKeyB64u`),requestedPermission:k(e.requestedPermission,`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:Y(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`),issuedAtMs:t,expiresAtMs:n};return r.targetFactor.kind===`email_otp`?{...r,targetFactor:{kind:`email_otp`},targetEmail:T(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`)}:{...r,targetFactor:{kind:`passkey_prf`}}}function Lt(e){let t=u(e,`QrLinkedDeviceSessionPayloadV5`);return It(A(t,Y(t.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`).kind===`email_otp`?[...ht,`targetEmail`]:ht,`QrLinkedDeviceSessionPayloadV5`))}function Rt(e){let t=It(Dt(e)),n={v:5,s:t.linkSessionId,l:t.linkPublicKeyB64u,d:t.devicePublicKeyB64u,a:Et(t.requestedPermission),f:t.targetFactor.kind===`passkey_prf`?`p`:`e`,i:t.issuedAtMs,e:t.expiresAtMs};return t.targetFactor.kind===`email_otp`?JSON.stringify({...n,t:t.targetEmail}):JSON.stringify(n)}function zt(){return b({payload:Lt,requestedAtMs:x})}function Bt(e){return zt()(e,`LinkedDeviceOwnerAuthorizationRequestV1`)}function Vt(){let e=e=>b({state:h(e),deviceId:ue});return[b({state:h(`displaying_qr`)}),e(`claimed`),e(`awaiting_target_factor`),e(`awaiting_source_contribution`),e(`provisioning`),b({state:h(`authority_pending_local_install`),deviceId:ue,authorityId:M,packageSetDigestB64u:C}),b({state:h(`active`),deviceId:ue,authorityId:M,activatedAtMs:x}),b({state:h(`failed_before_commit`),error:Ut}),b({state:h(`cancelled`),cancelledAtMs:x}),b({state:h(`expired`),expiredAtMs:x})]}function Ht(e){let t=u(e,`LinkSessionStateV1`).state;if(typeof t!=`string`)throw Error(`LinkSessionStateV1.state is invalid`);let n=Vt().find(e=>e.shape.state.literals.includes(t));if(!n)throw Error(`LinkSessionStateV1.state ${t} is unsupported`);return n(e,`LinkSessionStateV1.${t}`)}function Ut(e){let t=A(e,[`kind`,`reason`],`LinkPrecommitFailureV1`);if(t.kind!==`invalid_input`&&t.kind!==`unauthorized_source`&&t.kind!==`revoked_source`&&t.kind!==`permission_attenuation_failed`&&t.kind!==`target_factor_failed`&&t.kind!==`expired_session`&&t.kind!==`cancelled_session`&&t.kind!==`claim_conflict`&&t.kind!==`package_preparation_failed`)throw Error(`LinkPrecommitFailureV1.kind is invalid`);return{kind:t.kind,reason:O(t.reason,`LinkPrecommitFailureV1.reason`)}}function Wt(){return b({kind:h(`linked_device_session_projection_v1`),linkSessionId:N,qrPayload:Lt,revision:E,createdAtMs:x,updatedAtMs:x,state:Ht})}function Gt(e){return Wt()(e,`LinkSessionProjectionV1`)}function Kt(){return b({kind:h(`linked_device_session_event_v1`),linkSessionId:N,state:Ht,emittedAtMs:x})}function qt(e){return Kt()(e,`LinkSessionTransportEventV1`)}function Jt(){return _(`outcome`,[b({outcome:h(`pending`),state:Xt}),b({outcome:h(`replayed`),replay:b({state:()=>`pending`,session:Xt})})])}function Yt(e){return Jt()(e,`LinkedDeviceApprovalResultV1`)}function Xt(e){let t=Ht(e);switch(t.state){case`awaiting_target_factor`:case`awaiting_source_contribution`:case`provisioning`:case`authority_pending_local_install`:return t;default:throw Error(`LinkedDeviceApprovalResultV1 state is not pending`)}}function Zt(){return b({kind:h(`linked_device_session_claim_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,devicePublicKeyB64u:W,targetFactor:Y,sessionRevision:x,claimedAtMs:x,claimExpiresAtMs:x},(e,t)=>J(e.claimedAtMs,e.claimExpiresAtMs,t))}function Qt(e){return Zt()(e,`LinkedDeviceSessionClaimV1`)}function $t(){return b({kind:h(`wallet_session`),walletSessionId:ae,authorizationId:pe})}function en(e,t=`ownerAuthorization`){if(u(e,t).kind!==`wallet_session`)throw Error(`${t}.kind is unsupported`);return $t()(e,t)}function tn(){return{kind:h(`linked_device_approval_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,linkPublicKeyB64u:W,devicePublicKeyB64u:W,permission:k,targetFactor:Ft,ownerAuthorization:en,approvedAtMs:x,expiresAtMs:x}}function nn(e,t){J(e.approvedAtMs,e.expiresAtMs,t)}function rn(){return b(tn(),nn)}function an(){return b({...tn(),sourceContribution:Ae},nn)}function on(e){let t=u(e,`LinkedDeviceApprovalV1`);return(t.sourceContribution===void 0?rn():an())(t,`LinkedDeviceApprovalV1`)}function sn(){return b({kind:h(`linked_device_approval_delivery_v1`),approval:on})}function cn(e){return sn()(e,`LinkedDeviceApprovalDeliveryV1`)}function ln(){return{kind:h(`linked_device_target_preparation_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,deliveryRecipientPublicKey65B64u:q,walletAuthMethodId:S,ed25519ExportRoot:oe(Cn()),ordinarySignerMaterialRecipientRequirements:En,issuedAtMs:x,expiresAtMs:x}}function un(e,t){if(e.expiresAtMs<=e.issuedAtMs)throw Error(`${t}.expiresAtMs must follow issuedAtMs`)}function dn(){return b({...ln(),targetFactor:Ot(),passkeyCreationOptions:Sn,passkeyConfigurationDigestB64u:C},(e,t)=>{if(un(e,t),e.passkeyCreationOptions.walletAuthMethodId!==e.walletAuthMethodId)throw Error(`${t}.passkeyCreationOptions.walletAuthMethodId must match the preparation`)})}function fn(){return b({...ln(),targetFactor:kt(),targetEmail:T,enrollment:At(),baseWalletAuthMethodId:S},un)}function pn(){return b({...ln(),targetFactor:kt(),targetEmail:T,enrollment:jt()},un)}function mn(e){let t=`LinkedDeviceTargetPreparationV1`,n=u(e,t);return Y(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?dn()(n,t):(Nt(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?pn():fn())(n,t)}function hn(){return b({kind:h(`linked_device_target_preparation_request_v1`),linkSessionId:N,deliveryRecipientPublicKey65B64u:q})}function gn(e){return hn()(e,`LinkedDeviceTargetPreparationRequestV1`)}function _n(){return b({baseWalletAuthMethodId:S,maskedEmailHint:(e,t)=>{if(typeof e!=`string`||e.length===0)throw Error(`${t} is invalid`);return e}})}function vn(){let e=_n(),t=t=>e(t,`LinkedDeviceEmailOtpBaseFactorChoiceV1`);return{selected:b({kind:h(`selected`),choice:t}),selection_required:b({kind:h(`selection_required`),choices:(e,n)=>{if(!Array.isArray(e)||e.length===0)throw Error(`${n} must not be empty`);let r=e.map(t);return[r[0],...r.slice(1)]}}),unavailable:b({kind:h(`unavailable`),reason:gt(`no_active_email_otp_base_factor`)})}}function yn(e){let t=`LinkedDeviceEmailOtpBaseFactorResolutionV1`,n=u(e,t),r=vn();switch(n.kind){case`selected`:case`selection_required`:case`unavailable`:return r[n.kind](n,t);default:throw Error(`${t}.kind is unsupported`)}}function bn(){return b({revision:x,resolution:yn})}function xn(e){return bn()(e,`LinkedDeviceEmailOtpBaseFactorResolutionResultV1`)}function Sn(e,t){let n=A(e,[`kind`,`walletAuthMethodId`,`challengeId`,`challengeB64u`,`rpId`,`user`,`pubKeyCredParams`,`authenticatorSelection`,`timeoutMs`,`attestation`,`extensions`,`excludeCredentials`],t),r=S(n.walletAuthMethodId,`${t}.walletAuthMethodId`);if(A(n.user,[`idB64u`,`name`,`displayName`],`${t}.user`),A(n.authenticatorSelection,[`residentKey`,`userVerification`],`${t}.authenticatorSelection`),A(A(A(n.extensions,[`prf`],`${t}.extensions`).prf,[`eval`],`${t}.extensions.prf`).eval,[`firstB64u`,`secondB64u`],`${t}.extensions.prf.eval`),!Array.isArray(n.pubKeyCredParams))throw Error(`${t}.pubKeyCredParams must be an array`);if(n.pubKeyCredParams.forEach((e,n)=>{A(e,[`type`,`alg`],`${t}.pubKeyCredParams[${n}]`)}),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);n.excludeCredentials.forEach((e,n)=>{A(e,[`type`,`id`],`${t}.excludeCredentials[${n}]`)});let i=et(n);return{kind:i.kind,walletAuthMethodId:r,challengeId:i.challengeId,challengeB64u:i.challengeB64u,rpId:i.rpId,user:i.user,pubKeyCredParams:i.pubKeyCredParams,authenticatorSelection:i.authenticatorSelection,timeoutMs:i.timeoutMs,attestation:i.attestation,extensions:i.extensions,excludeCredentials:i.excludeCredentials}}function Cn(){return b({kind:h(`linked_device_ed25519_export_root_preparation_v1`),walletKeyId:p,applicationBindingDigestB64u:C,registeredPublicKeyB64u:ne,revocationEpoch:E})}function wn(e,t,n){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`${n} must contain one or two entries`);let r=e.map((e,r)=>t(e,`${n}[${r}]`));if(new Set(r.map(e=>e.keyFamily)).size!==r.length)throw Error(`${n} repeats a key family`);if(new Set(r.map(e=>String(e.walletKeyId))).size!==r.length)throw Error(`${n} repeats a wallet key`);if(r.length===2&&(r[0]?.keyFamily!==`ed25519`||r[1]?.keyFamily!==`ecdsa_secp256k1`))throw Error(`${n} must be ordered Ed25519 then ECDSA`);return r}function Tn(){return b({kind:h(`ordinary_signer_material_recipient_requirement_v1`),keyFamily:Tt,walletKeyId:p})}function En(e){let t=wn(e,Tn(),`LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requirements are empty`);return[n,...t.slice(1)]}const Dn=h(`ble`,`cable`,`hybrid`,`internal`,`nfc`,`smart-card`,`usb`);function On(e,t){let n=te(e,t).map((e,n)=>Dn(e,`${t}[${n}]`));if(new Set(n).size!==n.length)throw Error(`${t} contains duplicates`);return n}function kn(){return b({kind:h(`linked_device_webauthn_registration_v1`),credentialIdB64u:wt,authenticatorAttachment:oe(h(`platform`,`cross-platform`)),clientDataJsonB64u:G,attestationObjectB64u:G,transports:On})}function An(){let e=e=>(t,n)=>{if(t!==e)throw Error(`${n} does not match its kind`);return e};return _(`kind`,[b({kind:h(`ordinary_ed25519_signer_material_recipient_request_v1`),keyFamily:e(`ed25519`),walletKeyId:p,recipientPublicKeyB64u:(e,t)=>vt(e,32,t)}),b({kind:h(`ordinary_ecdsa_signer_material_recipient_request_v1`),keyFamily:e(`ecdsa_secp256k1`),walletKeyId:p,clientEphemeralPublicKey:Me})])}function X(e){let t=wn(e,An(),`LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requests are empty`);return[n,...t.slice(1)]}function jn(){return{kind:h(`linked_device_target_credential_registration_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,walletAuthMethodId:S}}function Mn(){return b({...jn(),targetFactor:Ot(),targetPreparationDigestB64u:C,ordinarySignerMaterialRecipientRequests:X,webauthnRegistration:kn(),registeredAtMs:x})}function Nn(){return b({...jn(),targetFactor:kt(),targetEmail:T,targetPreparationDigestB64u:C,ordinarySignerMaterialRecipientRequests:X,emailOtpVerificationGrant:Z,registeredAtMs:x})}function Pn(){return b({...jn(),targetFactor:kt(),targetEmail:T,targetPreparationDigestB64u:C,ordinarySignerMaterialRecipientRequests:X,emailOtpVerificationGrant:Z,emailOtpEnrollment:Pt(),registeredAtMs:x})}function Fn(e){let t=`LinkedDeviceTargetCredentialRegistrationV1`,n=u(e,t);return Y(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?Mn()(n,t):(Z(n.emailOtpVerificationGrant).enrollment.kind===`new_enrollment`?Pn():Nn())(n,t)}function In(){return b({kind:h(`linked_device_target_credential_registration_result_v1`),outcome:h(`applied`,`replayed`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,walletAuthMethodId:S,targetPreparationDigestB64u:C,targetFactor:Hn,ordinarySignerMaterialPreparations:je,ordinarySignerMaterialRecipientRequests:X,keyManifestDigestB64u:C},(e,t)=>{let{authMethod:n}=e.targetFactor;if(n.walletAuthMethodId!==e.walletAuthMethodId||n.walletId!==e.walletId)throw Error(`${t} target identity differs`)})}function Ln(e){return In()(e,`LinkedDeviceTargetCredentialRegistrationResultV1`)}function Rn(e,t){if(e.verifiedAtMs<e.authMethod.createdAtMs)throw Error(`${t}.verifiedAtMs precedes authMethod.createdAtMs`)}function zn(){return b({kind:h(`verified_passkey_target_v1`),authMethod:Wn,verificationDigestB64u:C,verifiedAtMs:x},Rn)}function Bn(){return b({kind:h(`verified_email_otp_target_v1`),authMethod:Kn,targetEmail:T,enrollment:At(),baseWalletAuthMethodId:S,providerUserId:O,verificationDigestB64u:C,verifiedAtMs:x},Rn)}function Vn(){return b({kind:h(`verified_email_otp_target_v1`),authMethod:Kn,targetEmail:T,enrollment:jt(),providerUserId:O,verificationDigestB64u:C,verifiedAtMs:x},Rn)}function Hn(e,t){let n=u(e,t);if(n.kind===`verified_passkey_target_v1`)return zn()(n,t);if(n.kind!==`verified_email_otp_target_v1`)throw Error(`${t}.kind is invalid`);return(Nt(n.enrollment,`${t}.enrollment`).kind===`existing_enrollment`?Bn():Vn())(n,t)}function Un(){return b({walletAuthMethodId:S,walletId:y,createdAtMs:x,kind:h(`passkey`),rpId:fe,credentialIdB64u:de,credentialPublicKeyB64u:G,counter:E})}function Wn(e,t){return Un()(e,t)}function Gn(){return b({walletAuthMethodId:S,walletId:y,createdAtMs:x,kind:h(`email_otp`),emailHashHex:_t,registrationAuthorityId:O})}function Kn(e,t){return Gn()(e,t)}function qn(e){return{kind:h(`linked_device_email_otp_verification_grant_v1`),grantId:O,grantToken:O,challengeId:O,linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,targetPreparationDigestB64u:C,targetEmail:T,enrollment:e,emailHashHex:_t,registrationAuthorityId:O,providerUserId:O,authorityDigestB64u:C,issuedAtMs:x,expiresAtMs:x}}function Jn(e,t){J(e.issuedAtMs,e.expiresAtMs,t)}function Yn(){return b({...qn(At()),baseWalletAuthMethodId:S},Jn)}function Xn(){return b(qn(jt()),Jn)}function Z(e){let t=`LinkedDeviceEmailOtpVerificationGrantV1`,n=u(e,t);return(Nt(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?Xn():Yn())(n,t)}function Zn(){return b({kind:h(`email_otp_factor_release_v1`),challengeId:O,enrollmentId:O,enrollmentSealKeyVersion:O,serverEphemeralPublicKey65B64u:q,nonce12B64u:(e,t)=>vt(e,12,t),ciphertextB64u:G})}function Qn(e){return Zn()(e,`LinkedDeviceEmailOtpFactorReleaseEnvelopeV1`)}function $n(){return b({kind:h(`linked_device_email_otp_challenge_start_request_v1`),linkSessionId:N,workerEphemeralPublicKey65B64u:q})}function er(e){return $n()(e,`LinkedDeviceEmailOtpChallengeStartRequestV1`)}function tr(){return b({kind:h(`linked_device_email_otp_challenge_resend_request_v1`),linkSessionId:N,challengeId:O})}function nr(e){return tr()(e,`LinkedDeviceEmailOtpChallengeResendRequestV1`)}function rr(){return b({kind:h(`linked_device_email_otp_challenge_verify_request_v1`),linkSessionId:N,challengeId:O,otpCode:(e,t)=>{if(typeof e!=`string`||!/^[0-9]{6,10}$/.test(e))throw Error(`${t} is invalid`);return e}})}function ir(e){return rr()(e,`LinkedDeviceEmailOtpChallengeVerifyRequestV1`)}function ar(){return b({kind:h(`linked_device_email_otp_challenge_result_v1`),challengeId:O,maskedEmailHint:O,expiresAtMs:x,resendAvailableAtMs:x})}function or(e){return ar()(e,`LinkedDeviceEmailOtpChallengeResultV1`)}function sr(e){let t=A(e,[`kind`,`verificationGrant`,`factorRelease`],`LinkedDeviceEmailOtpVerificationResultV1`);if(t.kind!==`linked_device_email_otp_verification_result_v1`)throw Error(`LinkedDeviceEmailOtpVerificationResultV1.kind is invalid`);let n=Z(t.verificationGrant);if(cr(n)){if(t.factorRelease!==null)throw Error(`new linked-device Email OTP enrollment cannot carry a factor release`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:null}}let r=Qn(t.factorRelease);if(r.challengeId!==n.challengeId)throw Error(`LinkedDeviceEmailOtpVerificationResultV1 challenge binding changed`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:r}}function cr(e){return e.enrollment.kind===`new_enrollment`}function lr(e){let t=x(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=x(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);J(t,n,`QrLinkedDeviceSessionPayloadV5`);let r=Y(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`);if(r.kind===`passkey_prf`)return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:k(Et(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,issuedAtMs:t,expiresAtMs:n};if(e.targetEmail===void 0)throw Error(`QrLinkedDeviceSessionPayloadV5.targetEmail is required for Email OTP`);return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:k(Et(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,targetEmail:T(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`),issuedAtMs:t,expiresAtMs:n}}function ur(e){return{kind:`linked_device_session_claim_request_v1`,payload:e}}function dr(e,t,n){let r=x(e,`${n}.approvedAtMs`),i=x(t,`${n}.expiresAtMs`);return J(r,i,n),{approvedAtMs:r,expiresAtMs:i}}function fr(e){let t=dr(e.approvedAtMs,e.expiresAtMs,`LinkedDeviceApprovalV1`);return on({kind:`linked_device_approval_v1`,...e,...t})}function pr(e){return Fn({kind:`linked_device_target_credential_registration_v1`,...e})}function mr(e){return{kind:`linked_device_session_cancel_unclaimed_request_v1`,linkSessionId:e.linkSessionId,reason:`user_cancelled`,requestedAtMs:x(e.requestedAtMs,`LinkedDeviceSessionCancelUnclaimedRequestV1.requestedAtMs`)}}function hr(e){return{kind:`linked_device_session_cancel_claimed_request_v1`,...e,requestedAtMs:x(e.requestedAtMs,`LinkedDeviceSessionCancelClaimedRequestV1.requestedAtMs`)}}const gr=[`chrome`,`safari`,`firefox`,`edge`,`other`],_r=[`macos`,`ios`,`windows`,`android`,`linux`,`other`];function vr(e){return typeof e==`string`&&gr.some(t=>t===e)}function yr(e){return typeof e==`string`&&_r.some(t=>t===e)}function br(e){if(!e||typeof e!=`object`||Array.isArray(e))return null;let t=e,n=typeof t.label==`string`?t.label.trim():``;if(!n||!vr(t.browser)||!yr(t.os)||typeof t.synced!=`boolean`||!Array.isArray(t.transports))return null;let r=t.transports.map(e=>typeof e==`string`?e.trim():``).filter(e=>e.length>0),i=typeof t.provider==`string`?t.provider.trim():``,a=typeof t.providerLabel==`string`?t.providerLabel.trim():``;return{label:n,browser:t.browser,os:t.os,synced:t.synced,transports:r,...i?{provider:i}:{},...a?{providerLabel:a}:{}}}function xr(e){return(t,n)=>{if(!Array.isArray(t))throw Error(`${n} is invalid`);return t.map((t,r)=>e(t,`${n}[${r}]`))}}function Sr(e,t){let n=S(e,t);if(n.startsWith(`wallet-authority:`)||n.startsWith(`authority:`))throw Error(`${t} must identify a WalletAuthMethodId`);return n}function Cr(e,t){let n=E(e,t);if(n<1)throw Error(`${t} must be a positive safe integer`);return n}function wr(e,t){let n=br(e);if(!n)throw Error(`${t} is invalid`);return n}function Tr(){return _(`kind`,[b({kind:h(`passkey`),walletAuthMethodId:S,credentialIdB64u:de,device:wr}),b({kind:h(`email_otp`),walletAuthMethodId:S}),b({kind:h(`voiceid`),walletAuthMethodId:S,deviceKeyId:C})])}function Er(e,t){return Tr()(e,t)}function Dr(){return b({deviceId:w,enrollmentId:D,walletId:y,credential:Er,permission:k,keyManifestDigestB64u:C,coveredWalletKeys:xr(p),state:h(`provisioning`,`active`,`suspended`,`expired`,`revoked`),createdAtMs:x,lastActivityAtMs:x,revocationEpoch:E})}function Or(e){return Dr()(e,`LinkedDeviceSummaryV1`)}function kr(){return b({kind:h(`linked_device_list_request_v1`),walletId:y,limit:Cr,cursor:se})}function Ar(e){return kr()(e,`LinkedDeviceListRequestV1`)}function jr(){return b({walletId:y,walletAuthorityId:M,credential:Er,createdAtMs:x,lastActivityAtMs:x})}function Mr(){let e=jr();return b({devices:xr(Or),ownerDevices:xr(t=>e(t,`OwnerDeviceSummaryV1`)),nextCursor:se})}function Nr(e){return Mr()(e,`LinkedDeviceListResultV1`)}function Pr(){return b({kind:h(`linked_device_revoke_request_v1`),walletId:y,walletAuthMethodId:Sr,requestedAtMs:x})}function Fr(e){return Pr()(e,`LinkedDeviceRevokeRequestV1`)}function Ir(){return b({kind:h(`not_found`,`conflict`,`unauthorized`)})}function Lr(){return b({kind:h(`revoked`),walletAuthMethodId:Sr,authorityId:M,revocationEpoch:E})}function Rr(e){let t=u(e,`LinkedDeviceRevokeResultV1`);return(t.kind===`not_found`||t.kind===`conflict`||t.kind===`unauthorized`?Ir():Lr())(t,`LinkedDeviceRevokeResultV1`)}function zr(e){return ee({domain:`seams/linked-device/wallet-session-credential-delivery-aad/v1`,aad:e})}function Br(e){let t=qr(e,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`],`LinkedDeviceWalletSessionCredentialDeliveryBindingV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_binding_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryBindingV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_binding_v1`,namespace:Q(t.namespace,`namespace`),orgId:Q(t.orgId,`orgId`),projectId:Q(t.projectId,`projectId`),envId:Q(t.envId,`envId`),tenantId:$(ve(t.tenantId)),principalId:$(he(t.principalId))}}async function Vr(e){return P(zr(e))}async function Hr(e){return P(ee({domain:`seams/linked-device/wallet-session-credential-delivery-envelope/v1`,envelope:e}))}async function Ur(e){if(await Vr(e.aad)!==e.aadDigestB64u)throw Error(`linked-device Wallet Session credential delivery AAD digest is invalid`);if(await Hr(e.envelope)!==e.envelopeDigestB64u)throw Error(`linked-device Wallet Session credential delivery envelope digest is invalid`);if(await P(ee({domain:`seams/linked-device/delivery-recipient/v1`,recipientPublicKey65B64u:e.aad.recipientPublicKey65B64u}))!==e.recipientBindingDigestB64u)throw Error(`linked-device Wallet Session credential delivery recipient binding is invalid`)}function Wr(e){let t=qr(e,[`kind`,`aad`,`aadDigestB64u`,`recipientBindingDigestB64u`,`envelope`,`envelopeDigestB64u`,`installationReceiptDigestB64u`],`LinkedDeviceWalletSessionCredentialDeliveryV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_v1`,aad:Gr(t.aad),aadDigestB64u:F(t.aadDigestB64u),recipientBindingDigestB64u:F(t.recipientBindingDigestB64u),envelope:Kr(t.envelope),envelopeDigestB64u:F(t.envelopeDigestB64u),installationReceiptDigestB64u:F(t.installationReceiptDigestB64u)}}function Gr(e){let n=qr(e,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`,`linkSessionId`,`walletId`,`authorityId`,`walletAuthMethodId`,`authorizationId`,`walletSessionId`,`quotaId`,`credentialDigestB64u`,`recipientPublicKey65B64u`,`issuedAtMs`,`expiresAtMs`],`LinkedDeviceWalletSessionCredentialDeliveryAadV1`);if(n.kind!==`linked_device_wallet_session_credential_delivery_aad_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryAadV1.kind is invalid`);let i=Jr(n.issuedAtMs,`issuedAtMs`),a=Jr(n.expiresAtMs,`expiresAtMs`);if(a<=i)throw Error(`expiresAtMs must be after issuedAtMs`);return{kind:`linked_device_wallet_session_credential_delivery_aad_v1`,namespace:Q(n.namespace,`namespace`),orgId:Q(n.orgId,`orgId`),projectId:Q(n.projectId,`projectId`),envId:Q(n.envId,`envId`),tenantId:$(ve(n.tenantId)),principalId:$(he(n.principalId)),linkSessionId:$(l(n.linkSessionId)),walletId:$(c(n.walletId)),authorityId:$(r(n.authorityId)),walletAuthMethodId:$(t(n.walletAuthMethodId)),authorizationId:$(_e(n.authorizationId)),walletSessionId:$(ge(n.walletSessionId)),quotaId:$(me(n.quotaId)),credentialDigestB64u:F(n.credentialDigestB64u),recipientPublicKey65B64u:Xr(n.recipientPublicKey65B64u,65),issuedAtMs:i,expiresAtMs:a}}function Kr(e){let t=qr(e,[`kind`,`algorithm`,`serverEphemeralPublicKey65B64u`,`nonce12B64u`,`ciphertextB64u`],`LinkedDeviceWalletSessionCredentialEnvelopeV1`);if(t.kind!==`linked_device_wallet_session_credential_envelope_v1`||t.algorithm!==`p256-ecdh-aes256gcm-v1`)throw Error(`LinkedDeviceWalletSessionCredentialEnvelopeV1 identity is invalid`);return{kind:`linked_device_wallet_session_credential_envelope_v1`,algorithm:`p256-ecdh-aes256gcm-v1`,serverEphemeralPublicKey65B64u:Xr(t.serverEphemeralPublicKey65B64u,65),nonce12B64u:Xr(t.nonce12B64u,12),ciphertextB64u:Yr(t.ciphertextB64u)}}function qr(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be an object`);let r=e,i=new Set(t);for(let e of Object.keys(r))if(!i.has(e))throw Error(`${n}.${e} is not supported`);for(let e of t)if(!(e in r))throw Error(`${n}.${e} is required`);return r}function Q(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} is required`);return e}function Jr(e,t){if(!Number.isSafeInteger(e)||Number(e)<=0)throw Error(`${t} is invalid`);return Number(e)}function Yr(e){let t=Q(e,`base64url`);if(d(f(t))!==t)throw Error(`base64url is not canonical`);return t}function Xr(e,t){let n=Yr(e),r=f(n);if(r.length!==t)throw Error(`base64url must contain ${t} bytes`);if(t===65&&r[0]!==4)throw Error(`P-256 public key is invalid`);return n}function $(e){if(!e.ok)throw Error(e.error.message);return e.value}function Zr(e,t){let n=Oe(e);if(!n.ok)throw Error(`${t} ${n.error}`);return n.value}function Qr(){return b({kind:h(`local_authority_installation_receipt_v1`),authorityId:j(M),walletId:j(y),authMethodId:j(S),deviceId:j(ue),packageSetDigestB64u:j(C),installedActivationRefs:Zr,installedRecordSetDigestB64u:j(C),targetFactorVerificationDigestB64u:j(C),installedAtMs:j(x)})}function $r(e){return Qr()(e,`LocalAuthorityInstallationReceiptV1`)}function ei(){return b({kind:h(`local_authority_activation_final_ack_v1`),linkSessionId:j(N),authorityId:j(M),packageSetDigestB64u:j(C),authorizationId:j(pe),walletSessionId:j(ae),credentialDigestB64u:j(C),installationReceiptDigestB64u:j(C),acknowledgedAtMs:j(x)})}function ti(e){return ei()(e,`LocalAuthorityActivationFinalAckV1`)}function ni(e){let t=u(e,`ActivateInstalledAuthorityResultV1`);switch(t.kind){case`active`:{g(t,[`kind`,`authority`,`authMethod`,`walletSession`,`deliveryBinding`,`sealedDelivery`],`ActivateInstalledAuthorityResultV1`);let e=De(t.authority);if(!e.ok||e.value.state!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authority must be active`);let n=Le(t.authMethod);if(!n||n.status!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authMethod must be active`);let r=le(t.walletSession),i=Br(t.deliveryBinding),a=Wr(t.sealedDelivery);if(e.value.walletId!==n.walletId||e.value.authorityId!==n.walletAuthorityId||r.walletId!==e.value.walletId||r.authorityId!==e.value.authorityId||r.authMethodId!==n.walletAuthMethodId||r.authorityDigestB64u!==e.value.authorityDigestB64u||r.authorityRevocationEpoch!==e.value.revocationEpoch||i.namespace!==a.aad.namespace||i.orgId!==a.aad.orgId||i.projectId!==a.aad.projectId||i.envId!==a.aad.envId||i.tenantId!==a.aad.tenantId||i.principalId!==a.aad.principalId||a.aad.walletId!==r.walletId||a.aad.authorityId!==r.authorityId||a.aad.walletAuthMethodId!==r.authMethodId||a.aad.authorizationId!==r.authorizationId||a.aad.quotaId!==r.quotaId||a.aad.issuedAtMs!==r.issuedAtMs||a.aad.expiresAtMs!==r.expiresAtMs)throw Error(`ActivateInstalledAuthorityResultV1 identities do not match`);return{kind:`active`,authority:e.value,authMethod:n,walletSession:r,deliveryBinding:i,sealedDelivery:a}}case`pending_local_install`:return g(t,[`kind`,`authorityId`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`pending_local_install`,authorityId:M(t.authorityId,`authorityId`),reason:ri()(t.reason,`ActivationRetryReasonV1`)};case`integrity_error`:return g(t,[`kind`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`integrity_error`,reason:ii(t.reason)};default:throw Error(`ActivateInstalledAuthorityResultV1.kind is invalid`)}}function ri(){return _(`kind`,[b({kind:h(`installation_receipt_not_found`)}),b({kind:h(`server_worker_activation_pending`)}),b({kind:h(`wallet_session_issuance_pending`)})])}function ii(e){let t=u(e,`LinkIntegrityFailureV1`);switch(t.kind){case`authority_id_mismatch`:return g(t,[`kind`,`expectedAuthorityId`,`actualAuthorityId`],`LinkIntegrityFailureV1`),{kind:`authority_id_mismatch`,expectedAuthorityId:M(t.expectedAuthorityId,`expectedAuthorityId`),actualAuthorityId:M(t.actualAuthorityId,`actualAuthorityId`)};case`package_set_digest_mismatch`:return g(t,[`kind`,`expectedPackageSetDigestB64u`,`actualPackageSetDigestB64u`],`LinkIntegrityFailureV1`),{kind:`package_set_digest_mismatch`,expectedPackageSetDigestB64u:C(t.expectedPackageSetDigestB64u,`expectedPackageSetDigestB64u`),actualPackageSetDigestB64u:C(t.actualPackageSetDigestB64u,`actualPackageSetDigestB64u`)};case`installation_receipt_mismatch`:if(g(t,[`kind`,`field`],`LinkIntegrityFailureV1`),t.field!==`walletId`&&t.field!==`authMethodId`&&t.field!==`deviceId`&&t.field!==`targetFactorVerificationDigestB64u`&&t.field!==`installedActivationRefs`)throw Error(`LinkIntegrityFailureV1.field is invalid`);return{kind:`installation_receipt_mismatch`,field:t.field};default:throw Error(`LinkIntegrityFailureV1.kind is invalid`)}}new TextEncoder;async function ai(e){return P(e.token)}function oi(e){return ee({domain:`seams/linked-device/local-authority-installation-receipt/v1`,receipt:e})}async function si(e){return P(oi(e))}function ci(e,t){if(e===void 0)throw Error(`${t} is required`);return e}function li(e){return I(e.kind,`targetFactor.kind`)}function ui(e){let t=e.pubKeyCredParams.map(e=>z([I(e.type,`passkeyCreationOptions.pubKeyCredParams.type`),I(String(e.alg),`passkeyCreationOptions.pubKeyCredParams.alg`)])),n=e.excludeCredentials.map(e=>z([I(e.type,`passkeyCreationOptions.excludeCredentials.type`),I(e.id,`passkeyCreationOptions.excludeCredentials.id`)]));return z([I(e.kind,`passkeyCreationOptions.kind`),I(e.walletAuthMethodId,`passkeyCreationOptions.walletAuthMethodId`),I(e.challengeId,`passkeyCreationOptions.challengeId`),I(e.challengeB64u,`passkeyCreationOptions.challengeB64u`),I(e.rpId,`passkeyCreationOptions.rpId`),I(e.user.idB64u,`passkeyCreationOptions.user.idB64u`),I(e.user.name,`passkeyCreationOptions.user.name`),I(e.user.displayName,`passkeyCreationOptions.user.displayName`),Fe(t.length,`passkeyCreationOptions.pubKeyCredParams`),...t.map(e=>L(e,`passkeyCreationOptions.pubKeyCredParams.item`)),I(e.authenticatorSelection.residentKey,`passkeyCreationOptions.authenticatorSelection.residentKey`),I(e.authenticatorSelection.userVerification,`passkeyCreationOptions.authenticatorSelection.userVerification`),R(e.timeoutMs,`passkeyCreationOptions.timeoutMs`),I(e.attestation,`passkeyCreationOptions.attestation`),I(e.extensions.prf.eval.firstB64u,`passkeyCreationOptions.extensions.prf.eval.firstB64u`),I(e.extensions.prf.eval.secondB64u,`passkeyCreationOptions.extensions.prf.eval.secondB64u`),Fe(n.length,`passkeyCreationOptions.excludeCredentials`),...n.map(e=>L(e,`passkeyCreationOptions.excludeCredentials.item`))])}function di(e){return z([I(e.kind,`recipientRequirement.kind`),I(e.keyFamily,`recipientRequirement.keyFamily`),I(e.walletKeyId,`recipientRequirement.walletKeyId`)])}function fi(e){return e===null?I(`none`,`ed25519ExportRoot.kind`):z([I(e.kind,`ed25519ExportRoot.kind`),I(e.walletKeyId,`ed25519ExportRoot.walletKeyId`),Ie(e.applicationBindingDigestB64u,`ed25519ExportRoot.applicationBindingDigestB64u`),Pe(e.registeredPublicKeyB64u,`ed25519ExportRoot.registeredPublicKeyB64u`),R(e.revocationEpoch,`ed25519ExportRoot.revocationEpoch`)])}function pi(e){let t=e.ordinarySignerMaterialRecipientRequirements.map(di),n=hi(e)?e:void 0,r=n?.passkeyCreationOptions;if(e.targetFactor.kind===`passkey_prf`&&!r)throw Error(`passkey target preparation is missing creation options`);return z([I(`seams/linked-device/target-preparation/v1`,`domain`),I(e.kind,`kind`),I(e.linkSessionId,`linkSessionId`),I(e.walletId,`walletId`),I(e.enrollmentId,`enrollmentId`),I(e.deviceId,`deviceId`),L(Pe(e.deliveryRecipientPublicKey65B64u,`deliveryRecipientPublicKey65B64u`),`deliveryRecipientPublicKey65B64u`),I(e.walletAuthMethodId,`walletAuthMethodId`),L(fi(e.ed25519ExportRoot),`ed25519ExportRoot`),L(li(e.targetFactor),`targetFactor`),...r?[L(ui(r),`passkeyCreationOptions`),Ie(n.passkeyConfigurationDigestB64u,`passkeyConfigurationDigestB64u`)]:[],...mi(e),Fe(t.length,`ordinarySignerMaterialRecipientRequirements`),...t.map(e=>L(e,`ordinarySignerMaterialRecipientRequirements.item`)),R(e.issuedAtMs,`issuedAtMs`),R(e.expiresAtMs,`expiresAtMs`)])}function mi(e){return hi(e)?[]:[I(e.targetEmail,`targetEmail`),I(e.enrollment.kind,`enrollment.kind`),...e.enrollment.kind===`existing_enrollment`?[I(ci(e.baseWalletAuthMethodId,`baseWalletAuthMethodId`),`baseWalletAuthMethodId`)]:[]]}function hi(e){return e.targetFactor.kind===`passkey_prf`}async function gi(e){return ye(pi(e))}const _i=`x-seams-linked-device-proof-v1`,vi=6e4,yi=6e4;async function bi(e){return ye(xi(e,32,`devicePublicKeyB64u`))}function xi(e,t,n){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} is invalid`);let r;try{r=f(e)}catch{throw Error(`${n} is invalid`)}if(r.length!==t||d(r)!==e)throw Error(`${n} is invalid`);return r}export{Ge as $,xn as A,Qt as B,pr as C,qt as D,Gt as E,Qn as F,Rt as G,gn as H,Z as I,ze as J,tt as K,sr as L,or as M,er as N,cn as O,ir as P,Ke as Q,Bt as R,ur as S,Ct as T,mn as U,Ln as V,Lt as W,qe as X,We as Y,Ue as Z,Rr as _,gi as a,hr as b,ni as c,Ur as d,Re as et,Br as f,Fr as g,Nr as h,bi as i,nr as j,Yt as k,ti as l,Ar as m,_i as n,si as o,Wr as p,et as q,vi as r,ai as s,yi as t,$r as u,br as v,lr as w,mr as x,fr as y,en as z};
+import{A as e,E as t,N as n,O as r,d as i,f as a,g as o,i as s,k as c,u as l}from"./domainIds-t1lp25yU.js";import{S as u,t as ee,y as te}from"./digests-BIaE0DMd.js";import{i as d,r as f}from"./base64-BmKR3UqU.js";import{C as p,D as ne,E as m,H as h,J as g,K as _,O as re,P as v,R as ie,S as y,T as ae,U as oe,W as b,_ as x,b as S,c as C,d as w,f as se,g as T,h as E,k as ce,l as D,m as O,n as le,o as ue,p as k,q as A,s as de,u as j,v as fe,w as pe,x as M,y as N}from"./activeWalletSession-HAOgRKzn.js";import{d as me,f as he,h as ge,m as _e,p as ve}from"./capabilityKinds-Cafn86Y1.js";import{a as ye,o as P,r as F}from"./canonicalPrimitives-DKeS3M40.js";import{$ as be,F as xe,I as Se,L as Ce,P as we,V as Te,_ as Ee,d as De,f as Oe,g as ke,x as Ae,y as je}from"./walletAuthority-CU9nO0Ze.js";import{It as Me,Nt as Ne,a as I,i as Pe,n as L,o as Fe,r as Ie,s as R,t as z}from"./digestEncoding-Rx8Vjy4J.js";import{r as Le}from"./walletAuthMethodRecord--fvGr8r1.js";function Re(e){throw Error(`[LinkSessionStateV1] unsupported state: ${String(e)}`)}const ze=`x25519-hkdf-sha256-chacha20poly1305-v1`,Be=/^[A-Za-z0-9_-]+$/,Ve=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`registeredAtMs`],He=[`kind`,`linkSessionId`,`walletId`,`walletKeyId`,`enrollmentId`,`deviceId`,`transferAlg`,`applicationBindingDigestB64u`,`registeredPublicKeyB64u`,`targetFactor`,`revocationEpoch`,`recipientPublicKeyB64u`,`ephemeralPublicKeyB64u`,`nonceB64u`,`sealedExportRootB64u`,`bindingDigestB64u`,`ciphertextDigestB64u`,`sealedAtMs`];function Ue(e,t=`recipientPublicKeyB64u`){if(typeof e!=`string`||!Be.test(e))throw Error(`${t} must be unpadded base64url`);let n;try{n=f(e)}catch{throw Error(`${t} must be valid base64url`)}if(d(n)!==e)throw Error(`${t} must be canonical base64url`);if(n.length!==32)throw Error(`${t} must decode to a 32-byte X25519 public key`);return e}function We(e){return{linkSessionId:e.linkSessionId,walletId:e.walletId,walletKeyId:e.walletKeyId,targetFactor:e.targetFactor,enrollmentId:e.enrollmentId,deviceId:e.deviceId,revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:e.applicationBindingDigestB64u,registeredPublicKeyB64u:e.registeredPublicKeyB64u,recipientPublicKeyB64u:e.recipientPublicKeyB64u}}function Ge(e){return JSON.stringify({linkSessionId:String(e.linkSessionId),walletId:String(e.walletId),walletKeyId:String(e.walletKeyId),targetFactor:e.targetFactor,enrollmentId:String(e.enrollmentId),deviceId:String(e.deviceId),revocationEpoch:e.revocationEpoch,applicationBindingDigestB64u:String(e.applicationBindingDigestB64u),registeredPublicKeyB64u:String(e.registeredPublicKeyB64u),recipientPublicKeyB64u:String(e.recipientPublicKeyB64u)})}function Ke(t){let n=Ye(t,Ve,`LinkedDeviceEd25519ExportRootRecipientV1`);if(n.kind!==`linked_device_ed25519_export_root_recipient_v1`)throw Error(`LinkedDeviceEd25519ExportRootRecipientV1.kind is invalid`);return Xe(n.transferAlg,`LinkedDeviceEd25519ExportRootRecipientV1.transferAlg`),{kind:`linked_device_ed25519_export_root_recipient_v1`,linkSessionId:v(l(n.linkSessionId),`LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId`),walletId:v(c(n.walletId),`walletId`),walletKeyId:v(e(n.walletKeyId),`walletKeyId`),enrollmentId:v(i(n.enrollmentId),`enrollmentId`),deviceId:v(a(n.deviceId),`deviceId`),transferAlg:ze,applicationBindingDigestB64u:m(n.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:ne(n.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:Je(n.targetFactor),revocationEpoch:Ze(n.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:Ue(n.recipientPublicKeyB64u,`recipientPublicKeyB64u`),registeredAtMs:Qe(n.registeredAtMs,`registeredAtMs`)}}function qe(t){let n=Ye(t,He,`LinkedDeviceEd25519ExportRootPackageV1`);if(n.kind!==`linked_device_ed25519_export_root_package_v1`)throw Error(`LinkedDeviceEd25519ExportRootPackageV1.kind is invalid`);Xe(n.transferAlg,`LinkedDeviceEd25519ExportRootPackageV1.transferAlg`);let r=Ue(n.recipientPublicKeyB64u,`recipientPublicKeyB64u`),o=Ue(n.ephemeralPublicKeyB64u,`ephemeralPublicKeyB64u`);if(r===o)throw Error(`ephemeralPublicKeyB64u repeats the recipient key`);return{kind:`linked_device_ed25519_export_root_package_v1`,linkSessionId:v(l(n.linkSessionId),`linkSessionId`),walletId:v(c(n.walletId),`walletId`),walletKeyId:v(e(n.walletKeyId),`walletKeyId`),enrollmentId:v(i(n.enrollmentId),`enrollmentId`),deviceId:v(a(n.deviceId),`deviceId`),transferAlg:ze,applicationBindingDigestB64u:m(n.applicationBindingDigestB64u,`applicationBindingDigestB64u`),registeredPublicKeyB64u:ne(n.registeredPublicKeyB64u,`registeredPublicKeyB64u`),targetFactor:Je(n.targetFactor),revocationEpoch:Ze(n.revocationEpoch,`revocationEpoch`),recipientPublicKeyB64u:r,ephemeralPublicKeyB64u:o,nonceB64u:ce(n.nonceB64u,`nonceB64u`),sealedExportRootB64u:re(n.sealedExportRootB64u,`sealedExportRootB64u`),bindingDigestB64u:m(n.bindingDigestB64u,`bindingDigestB64u`),ciphertextDigestB64u:m(n.ciphertextDigestB64u,`ciphertextDigestB64u`),sealedAtMs:Qe(n.sealedAtMs,`sealedAtMs`)}}function Je(e){switch(Ye(e,[`kind`],`targetFactor`).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`targetFactor.kind is unsupported`)}}function Ye(e,t,n){let r=u(e,n);g(r,t,n);for(let e of t)if(r[e]===void 0)throw Error(`${n}.${e} is required`);return r}function Xe(e,t){if(e!==`x25519-hkdf-sha256-chacha20poly1305-v1`)throw Error(`${t} must be ${ze}`)}function Ze(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);return e}function Qe(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive unix-millisecond timestamp`);return e}function B(e,t){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${t} must be an object`);return e}function V(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} must not be empty`);if(n!==e)throw Error(`${t} must not be padded with whitespace`);return n}function $e(e,t){let r=n(V(e,t));if(!r.ok)throw Error(`${t} is invalid: ${r.error.message}`);return r.value}function H(e,t,n){if(e!==t)throw Error(`${n} must be ${String(t)}`);return t}function et(e){let t=`WalletAddAuthMethodRegistrationOptions`,n=B(e,t);H(n.kind,`webauthn_add_auth_method_registration_v1`,`${t}.kind`);let r=B(n.user,`${t}.user`),i=B(n.authenticatorSelection,`${t}.authenticatorSelection`),a=B(B(B(n.extensions,`${t}.extensions`).prf,`${t}.extensions.prf`).eval,`${t}.extensions.prf.eval`);if(!Array.isArray(n.pubKeyCredParams)||n.pubKeyCredParams.length!==2)throw Error(`${t}.pubKeyCredParams must list exactly two algorithms`);let[o,s]=n.pubKeyCredParams;if(H(B(o,`${t}.pubKeyCredParams[0]`).type,`public-key`,`${t}.pubKeyCredParams[0].type`),H(B(o,`${t}.pubKeyCredParams[0]`).alg,-7,`${t}.pubKeyCredParams[0].alg`),H(B(s,`${t}.pubKeyCredParams[1]`).type,`public-key`,`${t}.pubKeyCredParams[1].type`),H(B(s,`${t}.pubKeyCredParams[1]`).alg,-257,`${t}.pubKeyCredParams[1].alg`),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);let c=n.excludeCredentials.map((e,n)=>{let r=B(e,`${t}.excludeCredentials[${n}]`);return{type:H(r.type,`public-key`,`${t}.excludeCredentials[${n}].type`),id:V(r.id,`${t}.excludeCredentials[${n}].id`)}}),l=n.timeoutMs;if(typeof l!=`number`||!Number.isSafeInteger(l)||l<=0)throw Error(`${t}.timeoutMs must be a positive safe integer`);return{kind:`webauthn_add_auth_method_registration_v1`,challengeId:V(n.challengeId,`${t}.challengeId`),challengeB64u:V(n.challengeB64u,`${t}.challengeB64u`),rpId:$e(n.rpId,`${t}.rpId`),user:{idB64u:V(r.idB64u,`${t}.user.idB64u`),name:V(r.name,`${t}.user.name`),displayName:V(r.displayName,`${t}.user.displayName`)},pubKeyCredParams:[{type:`public-key`,alg:-7},{type:`public-key`,alg:-257}],authenticatorSelection:{residentKey:H(i.residentKey,`required`,`${t}.authenticatorSelection.residentKey`),userVerification:H(i.userVerification,`preferred`,`${t}.authenticatorSelection.userVerification`)},timeoutMs:l,attestation:H(n.attestation,`none`,`${t}.attestation`),extensions:{prf:{eval:{firstB64u:V(a.firstB64u,`${t}.extensions.prf.eval.firstB64u`),secondB64u:V(a.secondB64u,`${t}.extensions.prf.eval.secondB64u`)}}},excludeCredentials:c}}function tt(e){let t=ut(e);if(t.kind!==`committed_authority_packages_v1`)throw Error(`CommittedAuthorityPackagesV1.kind is invalid`);let n=De(t.authority);if(!n.ok||n.value.state!==`pending_local_install`)throw Error(`CommittedAuthorityPackagesV1.authority is not pending`);let r=Le(t.authMethod);if(!r||r.status!==`pending_local_install`||r.kind===`voiceid`)throw Error(`CommittedAuthorityPackagesV1.authMethod is not pending`);if(r.walletId!==n.value.walletId||r.walletAuthorityId!==n.value.authorityId)throw Error(`CommittedAuthorityPackagesV1 authority and auth method identities differ`);let i=rt(t.signerPackages);nt(i,n.value.signerActivations);let a=t.ed25519ExportRootPackage===null?null:qe(t.ed25519ExportRootPackage);if(a&&(a.walletId!==n.value.walletId||a.revocationEpoch!==n.value.revocationEpoch||n.value.provenance.kind!==`device_link`||a.enrollmentId!==n.value.provenance.enrollmentId||a.linkSessionId!==n.value.provenance.linkSessionId||String(a.deviceId)!==String(n.value.principal.deviceId)))throw Error(`CommittedAuthorityPackagesV1 export root identity does not match authority`);return{kind:`committed_authority_packages_v1`,authority:n.value,authMethod:r,signerPackages:i,ed25519ExportRootPackage:a,packageSetDigestB64u:it(t.packageSetDigestB64u)}}function nt(e,t){if(e.keyFamilies.length!==t.keyFamilies.length)throw Error(`CommittedAuthorityPackagesV1 signer families do not match authority`);for(let n=0;n<e.keyFamilies.length;n+=1)if(e.keyFamilies[n]!==t.keyFamilies[n])throw Error(`CommittedAuthorityPackagesV1 signer family order does not match authority`);if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`){if(!t.ed25519||!e.ed25519)throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation is missing`);if(!s(e.ed25519.materialActivation,t.ed25519.materialActivation))throw Error(`CommittedAuthorityPackagesV1 Ed25519 activation does not match authority`);return}if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`){if(!t.ecdsa||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 ECDSA activation is missing`);if(!s(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 ECDSA activation does not match authority`);return}if(!t.ed25519||!t.ecdsa||!e.ed25519||!e.ecdsa)throw Error(`CommittedAuthorityPackagesV1 combined activations are incomplete`);if(!s(e.ed25519.materialActivation,t.ed25519.materialActivation)||!s(e.ecdsa.materialActivation,t.ecdsa.materialActivation))throw Error(`CommittedAuthorityPackagesV1 activation references do not match authority`)}function rt(e){let t=dt(e);if(t.kind!==`committed_signer_package_set_v1`)throw Error(`CommittedSignerPackageSetV1.kind is invalid`);let n=lt(t.keyFamilies);if(n.length===1&&n[0]===`ed25519`){if(!(`ed25519`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:at(t.ed25519)}}if(n.length===1&&n[0]===`ecdsa_secp256k1`){if(!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ecdsa:ot(t.ecdsa)}}if(!(`ed25519`in t)||!(`ecdsa`in t))throw Error(`CommittedSignerPackageSetV1 fields are invalid`);let r=at(t.ed25519),i=ot(t.ecdsa);if(r.materialActivation.activationId===i.materialActivation.activationId)throw Error(`CommittedSignerPackageSetV1 activation references must be distinct`);return{kind:`committed_signer_package_set_v1`,keyFamilies:n,ed25519:r,ecdsa:i}}function it(e){return F(e)}function at(e){let t=ft(e);if(t.kind!==`committed_ed25519_signer_package_v1`)throw Error(`CommittedEd25519SignerPackageV1.kind is invalid`);let n=ct(t.materialActivation,`materialActivation`),r=Se(t.targetBinding),i=xe(t.applicationBinding),a=we(t.activationReceipt);if(!s(n,Ne(a.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 activation receipt does not match material`);if(!s(n,Ne(r.material_activation)))throw Error(`CommittedEd25519SignerPackageV1 target binding does not match material`);let o=st(t.deriver_a_client_package,`deriver_a_client_package`,`deriver_a`),c=st(t.deriver_b_client_package,`deriver_b_client_package`,`deriver_b`);if(!be(a.transcript,o.transcript)||!be(a.transcript,c.transcript))throw Error(`CommittedEd25519SignerPackageV1 receipt transcript does not match packages`);return{kind:`committed_ed25519_signer_package_v1`,materialActivation:n,targetBinding:r,applicationBinding:i,participantIds:Te(t.participantIds),activationReceipt:a,deriver_a_client_package:o,deriver_b_client_package:c}}function ot(e){let t=pt(e);if(t.kind!==`committed_ecdsa_signer_package_v1`)throw Error(`CommittedEcdsaSignerPackageV1.kind is invalid`);let n=ct(t.materialActivation,`materialActivation`),r=Ee(t.activationReceipt),i=r.binding.target.activation;if(!s(n,i))throw Error(`CommittedEcdsaSignerPackageV1 receipt activation does not match material`);let a=ke(t.encryptedTargetClientShare,`encryptedTargetClientShare`);if(a.recipientPublicKeyB64u!==r.binding.target.clientRecipientPublicKeyB64u)throw Error(`CommittedEcdsaSignerPackageV1 client share recipient does not match receipt`);return{kind:`committed_ecdsa_signer_package_v1`,materialActivation:n,encryptedTargetClientShare:a,activationReceipt:r}}function st(e,t,n){let r=Ce(e);if(!r.ok)throw Error(`${t} ${r.message}`);if(r.value.kind!==`activation_client`||r.value.deriver!==n)throw Error(`${t} must be an activation_client for ${n}`);return{kind:`activation_client`,deriver:n,session:r.value.session,transcript:r.value.transcript,encapsulated_key:r.value.encapsulated_key,ciphertext:r.value.ciphertext}}function ct(e,t){let n=o(e);if(!n.ok)throw Error(`${t} ${n.error.message}`);return n.value}function lt(e){if(!Array.isArray(e))throw Error(`CommittedSignerPackageSetV1.keyFamilies must be an array`);if(e.length===1&&e[0]===`ed25519`)return[`ed25519`];if(e.length===1&&e[0]===`ecdsa_secp256k1`)return[`ecdsa_secp256k1`];if(e.length===2&&e[0]===`ed25519`&&e[1]===`ecdsa_secp256k1`)return[`ed25519`,`ecdsa_secp256k1`];throw Error(`CommittedSignerPackageSetV1.keyFamilies must use canonical family order`)}function ut(e){let t=mt(e);if(t===null)throw Error(`CommittedAuthorityPackagesV1 must be an object`);return U(t,[`kind`,`authority`,`authMethod`,`signerPackages`,`ed25519ExportRootPackage`,`packageSetDigestB64u`],`CommittedAuthorityPackagesV1`),{kind:Reflect.get(t,`kind`),authority:Reflect.get(t,`authority`),authMethod:Reflect.get(t,`authMethod`),signerPackages:Reflect.get(t,`signerPackages`),ed25519ExportRootPackage:Reflect.get(t,`ed25519ExportRootPackage`),packageSetDigestB64u:Reflect.get(t,`packageSetDigestB64u`)}}function dt(e){let t=mt(e);if(t===null)throw Error(`CommittedSignerPackageSetV1 must be an object`);let n=Object.keys(t),r=n.includes(`ed25519`),i=n.includes(`ecdsa`);return r&&i?(U(t,[`kind`,`keyFamilies`,`ed25519`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`),ecdsa:Reflect.get(t,`ecdsa`)}):r?(U(t,[`kind`,`keyFamilies`,`ed25519`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ed25519:Reflect.get(t,`ed25519`)}):i?(U(t,[`kind`,`keyFamilies`,`ecdsa`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`),ecdsa:Reflect.get(t,`ecdsa`)}):(U(t,[`kind`,`keyFamilies`],`CommittedSignerPackageSetV1`),{kind:Reflect.get(t,`kind`),keyFamilies:Reflect.get(t,`keyFamilies`)})}function ft(e){let t=mt(e);if(t===null)throw Error(`CommittedEd25519SignerPackageV1 must be an object`);return U(t,[`kind`,`materialActivation`,`targetBinding`,`applicationBinding`,`participantIds`,`activationReceipt`,`deriver_a_client_package`,`deriver_b_client_package`],`CommittedEd25519SignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),targetBinding:Reflect.get(t,`targetBinding`),applicationBinding:Reflect.get(t,`applicationBinding`),participantIds:Reflect.get(t,`participantIds`),activationReceipt:Reflect.get(t,`activationReceipt`),deriver_a_client_package:Reflect.get(t,`deriver_a_client_package`),deriver_b_client_package:Reflect.get(t,`deriver_b_client_package`)}}function pt(e){let t=mt(e);if(t===null)throw Error(`CommittedEcdsaSignerPackageV1 must be an object`);return U(t,[`kind`,`materialActivation`,`encryptedTargetClientShare`,`activationReceipt`],`CommittedEcdsaSignerPackageV1`),{kind:Reflect.get(t,`kind`),materialActivation:Reflect.get(t,`materialActivation`),encryptedTargetClientShare:Reflect.get(t,`encryptedTargetClientShare`),activationReceipt:Reflect.get(t,`activationReceipt`)}}function mt(e){return typeof e==`object`&&e&&!Array.isArray(e)?e:null}function U(e,t,n){let r=new Set(t),i=Object.keys(e);if(i.length!==t.length)throw Error(`${n} contains unexpected fields`);for(let e of i)if(!r.has(e))throw Error(`${n} contains unexpected fields`);for(let r of t)if(!Object.prototype.hasOwnProperty.call(e,r))throw Error(`${n}.${r} is required`)}const ht=[`version`,`purpose`,`linkSessionId`,`linkPublicKeyB64u`,`devicePublicKeyB64u`,`requestedPermission`,`targetFactor`,`issuedAtMs`,`expiresAtMs`];function gt(...e){return(t,n)=>{if(!e.includes(t))throw Error(`${n} is unsupported`);return t}}function _t(e,t){if(typeof e!=`string`||!/^[0-9a-f]{64}$/.test(e))throw Error(`${t} must be 32 canonical lowercase hex bytes`);return e}function W(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=f(e);if(t.length!==32||d(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be a canonical 32-byte unpadded base64url key`)}return e}function G(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical unpadded base64url`);try{let t=f(e);if(t.length===0||d(t)!==e)throw Error(`non-canonical`)}catch{throw Error(`${t} must be canonical unpadded base64url`)}return e}function vt(e,t,n){let r=G(e,n),i=f(r);try{if(i.length!==t)throw Error(`${n} must encode ${t} bytes`);return r}finally{i.fill(0)}}const K=BigInt(`0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff`),yt=K-3n,bt=BigInt(`0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b`);function xt(e){let t=0n;for(let n of e)t=t<<8n|BigInt(n);return t}function St(e){let t=xt(e.subarray(1,33)),n=xt(e.subarray(33,65));return t>=K||n>=K?!1:n*n%K===(t*t*t%K+yt*t%K+bt)%K}function q(e,t){let n=vt(e,65,t),r=f(n);try{if(r[0]!==4)throw Error(`${t} must be an uncompressed SEC1 P-256 point`);if(!St(r))throw Error(`${t} must be an on-curve P-256 point`);return n}finally{r.fill(0)}}function Ct(e){return W(e,`LinkDevicePublicKeyB64u`)}function wt(e,t){return de(G(e,t),t)}function Tt(e,t){if(e!==`ed25519`&&e!==`ecdsa_secp256k1`)throw Error(`${t} must identify a supported key family`);return e}function J(e,t,n){if(t<=e)throw Error(`${n}.expiresAtMs must be after issuedAtMs`)}function Et(e){return{kind:e.kind,permissions:[...ie(e)]}}function Dt(e){let t={version:e.version,purpose:e.purpose,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:Et(e.requestedPermission),targetFactor:e.targetFactor,issuedAtMs:e.issuedAtMs,expiresAtMs:e.expiresAtMs};return e.targetFactor.kind===`email_otp`?{...t,targetEmail:e.targetEmail}:t}function Y(e,t){switch(A(e,[`kind`],t).kind){case`passkey_prf`:return{kind:`passkey_prf`};case`email_otp`:return{kind:`email_otp`};default:throw Error(`${t}.kind is unsupported`)}}function Ot(){return b({kind:h(`passkey_prf`)})}function kt(){return b({kind:h(`email_otp`)})}function At(){return b({kind:h(`existing_enrollment`)})}function jt(){return b({kind:h(`new_enrollment`)})}function Mt(){return _(`kind`,[At(),jt()])}function Nt(e,t){return Mt()(e,t)}function Pt(){return b({enrollmentSealKeyVersion:O,clientUnlockPublicKeyB64u:O,unlockKeyVersion:O,serverSealedFactorCiphertextB64u:O})}function Ft(e,t){let n=u(e,t);if(n.kind===`passkey_prf`)return A(n,[`kind`],t),{kind:`passkey_prf`};if(n.kind===`email_otp`){let e=Nt(n.enrollment,`${t}.enrollment`),r=T(n.targetEmail,`${t}.targetEmail`);return e.kind===`existing_enrollment`?{kind:`email_otp`,targetEmail:r,enrollment:e,baseWalletAuthMethodId:S(A(n,[`kind`,`targetEmail`,`enrollment`,`baseWalletAuthMethodId`],t).baseWalletAuthMethodId,`${t}.baseWalletAuthMethodId`)}:(A(n,[`kind`,`targetEmail`,`enrollment`],t),{kind:`email_otp`,targetEmail:r,enrollment:e})}throw Error(`${t}.kind is unsupported`)}function It(e){if(e.version!==`v5`)throw Error(`QrLinkedDeviceSessionPayloadV5.version is invalid`);if(e.purpose!==`linked_device_lane_creation`)throw Error(`QrLinkedDeviceSessionPayloadV5.purpose is invalid`);let t=x(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=x(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);J(t,n,`QrLinkedDeviceSessionPayloadV5`);let r={version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:N(e.linkSessionId,`QrLinkedDeviceSessionPayloadV5.linkSessionId`),linkPublicKeyB64u:W(e.linkPublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.linkPublicKeyB64u`),devicePublicKeyB64u:W(e.devicePublicKeyB64u,`QrLinkedDeviceSessionPayloadV5.devicePublicKeyB64u`),requestedPermission:k(e.requestedPermission,`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:Y(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`),issuedAtMs:t,expiresAtMs:n};return r.targetFactor.kind===`email_otp`?{...r,targetFactor:{kind:`email_otp`},targetEmail:T(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`)}:{...r,targetFactor:{kind:`passkey_prf`}}}function Lt(e){let t=u(e,`QrLinkedDeviceSessionPayloadV5`);return It(A(t,Y(t.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`).kind===`email_otp`?[...ht,`targetEmail`]:ht,`QrLinkedDeviceSessionPayloadV5`))}function Rt(e){let t=It(Dt(e)),n={v:5,s:t.linkSessionId,l:t.linkPublicKeyB64u,d:t.devicePublicKeyB64u,a:Et(t.requestedPermission),f:t.targetFactor.kind===`passkey_prf`?`p`:`e`,i:t.issuedAtMs,e:t.expiresAtMs};return t.targetFactor.kind===`email_otp`?JSON.stringify({...n,t:t.targetEmail}):JSON.stringify(n)}function zt(){return b({payload:Lt,requestedAtMs:x})}function Bt(e){return zt()(e,`LinkedDeviceOwnerAuthorizationRequestV1`)}function Vt(){let e=e=>b({state:h(e),deviceId:ue});return[b({state:h(`displaying_qr`)}),e(`claimed`),e(`awaiting_target_factor`),e(`awaiting_source_contribution`),e(`provisioning`),b({state:h(`authority_pending_local_install`),deviceId:ue,authorityId:M,packageSetDigestB64u:C}),b({state:h(`active`),deviceId:ue,authorityId:M,activatedAtMs:x}),b({state:h(`failed_before_commit`),error:Ut}),b({state:h(`cancelled`),cancelledAtMs:x}),b({state:h(`expired`),expiredAtMs:x})]}function Ht(e){let t=u(e,`LinkSessionStateV1`).state;if(typeof t!=`string`)throw Error(`LinkSessionStateV1.state is invalid`);let n=Vt().find(e=>e.shape.state.literals.includes(t));if(!n)throw Error(`LinkSessionStateV1.state ${t} is unsupported`);return n(e,`LinkSessionStateV1.${t}`)}function Ut(e){let t=A(e,[`kind`,`reason`],`LinkPrecommitFailureV1`);if(t.kind!==`invalid_input`&&t.kind!==`unauthorized_source`&&t.kind!==`revoked_source`&&t.kind!==`permission_attenuation_failed`&&t.kind!==`target_factor_failed`&&t.kind!==`expired_session`&&t.kind!==`cancelled_session`&&t.kind!==`claim_conflict`&&t.kind!==`package_preparation_failed`)throw Error(`LinkPrecommitFailureV1.kind is invalid`);return{kind:t.kind,reason:O(t.reason,`LinkPrecommitFailureV1.reason`)}}function Wt(){return b({kind:h(`linked_device_session_projection_v1`),linkSessionId:N,qrPayload:Lt,revision:E,createdAtMs:x,updatedAtMs:x,state:Ht})}function Gt(e){return Wt()(e,`LinkSessionProjectionV1`)}function Kt(){return b({kind:h(`linked_device_session_event_v1`),linkSessionId:N,state:Ht,emittedAtMs:x})}function qt(e){return Kt()(e,`LinkSessionTransportEventV1`)}function Jt(){return _(`outcome`,[b({outcome:h(`pending`),state:Xt}),b({outcome:h(`replayed`),replay:b({state:()=>`pending`,session:Xt})})])}function Yt(e){return Jt()(e,`LinkedDeviceApprovalResultV1`)}function Xt(e){let t=Ht(e);switch(t.state){case`awaiting_target_factor`:case`awaiting_source_contribution`:case`provisioning`:case`authority_pending_local_install`:return t;default:throw Error(`LinkedDeviceApprovalResultV1 state is not pending`)}}function Zt(){return b({kind:h(`linked_device_session_claim_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,devicePublicKeyB64u:W,targetFactor:Y,sessionRevision:x,claimedAtMs:x,claimExpiresAtMs:x},(e,t)=>J(e.claimedAtMs,e.claimExpiresAtMs,t))}function Qt(e){return Zt()(e,`LinkedDeviceSessionClaimV1`)}function $t(){return b({kind:h(`wallet_session`),walletSessionId:ae,authorizationId:pe})}function en(e,t=`ownerAuthorization`){if(u(e,t).kind!==`wallet_session`)throw Error(`${t}.kind is unsupported`);return $t()(e,t)}function tn(){return{kind:h(`linked_device_approval_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,linkPublicKeyB64u:W,devicePublicKeyB64u:W,permission:k,targetFactor:Ft,ownerAuthorization:en,approvedAtMs:x,expiresAtMs:x}}function nn(e,t){J(e.approvedAtMs,e.expiresAtMs,t)}function rn(){return b(tn(),nn)}function an(){return b({...tn(),sourceContribution:Ae},nn)}function on(e){let t=u(e,`LinkedDeviceApprovalV1`);return(t.sourceContribution===void 0?rn():an())(t,`LinkedDeviceApprovalV1`)}function sn(){return b({kind:h(`linked_device_approval_delivery_v1`),approval:on})}function cn(e){return sn()(e,`LinkedDeviceApprovalDeliveryV1`)}function ln(){return{kind:h(`linked_device_target_preparation_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,deliveryRecipientPublicKey65B64u:q,walletAuthMethodId:S,ed25519ExportRoot:oe(Cn()),ordinarySignerMaterialRecipientRequirements:En,issuedAtMs:x,expiresAtMs:x}}function un(e,t){if(e.expiresAtMs<=e.issuedAtMs)throw Error(`${t}.expiresAtMs must follow issuedAtMs`)}function dn(){return b({...ln(),targetFactor:Ot(),passkeyCreationOptions:Sn,passkeyConfigurationDigestB64u:C},(e,t)=>{if(un(e,t),e.passkeyCreationOptions.walletAuthMethodId!==e.walletAuthMethodId)throw Error(`${t}.passkeyCreationOptions.walletAuthMethodId must match the preparation`)})}function fn(){return b({...ln(),targetFactor:kt(),targetEmail:T,enrollment:At(),baseWalletAuthMethodId:S},un)}function pn(){return b({...ln(),targetFactor:kt(),targetEmail:T,enrollment:jt()},un)}function mn(e){let t=`LinkedDeviceTargetPreparationV1`,n=u(e,t);return Y(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?dn()(n,t):(Nt(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?pn():fn())(n,t)}function hn(){return b({kind:h(`linked_device_target_preparation_request_v1`),linkSessionId:N,deliveryRecipientPublicKey65B64u:q})}function gn(e){return hn()(e,`LinkedDeviceTargetPreparationRequestV1`)}function _n(){return b({baseWalletAuthMethodId:S,maskedEmailHint:(e,t)=>{if(typeof e!=`string`||e.length===0)throw Error(`${t} is invalid`);return e}})}function vn(){let e=_n(),t=t=>e(t,`LinkedDeviceEmailOtpBaseFactorChoiceV1`);return{selected:b({kind:h(`selected`),choice:t}),selection_required:b({kind:h(`selection_required`),choices:(e,n)=>{if(!Array.isArray(e)||e.length===0)throw Error(`${n} must not be empty`);let r=e.map(t);return[r[0],...r.slice(1)]}}),unavailable:b({kind:h(`unavailable`),reason:gt(`no_active_email_otp_base_factor`)})}}function yn(e){let t=`LinkedDeviceEmailOtpBaseFactorResolutionV1`,n=u(e,t),r=vn();switch(n.kind){case`selected`:case`selection_required`:case`unavailable`:return r[n.kind](n,t);default:throw Error(`${t}.kind is unsupported`)}}function bn(){return b({revision:x,resolution:yn})}function xn(e){return bn()(e,`LinkedDeviceEmailOtpBaseFactorResolutionResultV1`)}function Sn(e,t){let n=A(e,[`kind`,`walletAuthMethodId`,`challengeId`,`challengeB64u`,`rpId`,`user`,`pubKeyCredParams`,`authenticatorSelection`,`timeoutMs`,`attestation`,`extensions`,`excludeCredentials`],t),r=S(n.walletAuthMethodId,`${t}.walletAuthMethodId`);if(A(n.user,[`idB64u`,`name`,`displayName`],`${t}.user`),A(n.authenticatorSelection,[`residentKey`,`userVerification`],`${t}.authenticatorSelection`),A(A(A(n.extensions,[`prf`],`${t}.extensions`).prf,[`eval`],`${t}.extensions.prf`).eval,[`firstB64u`,`secondB64u`],`${t}.extensions.prf.eval`),!Array.isArray(n.pubKeyCredParams))throw Error(`${t}.pubKeyCredParams must be an array`);if(n.pubKeyCredParams.forEach((e,n)=>{A(e,[`type`,`alg`],`${t}.pubKeyCredParams[${n}]`)}),!Array.isArray(n.excludeCredentials))throw Error(`${t}.excludeCredentials must be an array`);n.excludeCredentials.forEach((e,n)=>{A(e,[`type`,`id`],`${t}.excludeCredentials[${n}]`)});let i=et(n);return{kind:i.kind,walletAuthMethodId:r,challengeId:i.challengeId,challengeB64u:i.challengeB64u,rpId:i.rpId,user:i.user,pubKeyCredParams:i.pubKeyCredParams,authenticatorSelection:i.authenticatorSelection,timeoutMs:i.timeoutMs,attestation:i.attestation,extensions:i.extensions,excludeCredentials:i.excludeCredentials}}function Cn(){return b({kind:h(`linked_device_ed25519_export_root_preparation_v1`),walletKeyId:p,applicationBindingDigestB64u:C,registeredPublicKeyB64u:ne,revocationEpoch:E})}function wn(e,t,n){if(!Array.isArray(e)||e.length===0||e.length>2)throw Error(`${n} must contain one or two entries`);let r=e.map((e,r)=>t(e,`${n}[${r}]`));if(new Set(r.map(e=>e.keyFamily)).size!==r.length)throw Error(`${n} repeats a key family`);if(new Set(r.map(e=>String(e.walletKeyId))).size!==r.length)throw Error(`${n} repeats a wallet key`);if(r.length===2&&(r[0]?.keyFamily!==`ed25519`||r[1]?.keyFamily!==`ecdsa_secp256k1`))throw Error(`${n} must be ordered Ed25519 then ECDSA`);return r}function Tn(){return b({kind:h(`ordinary_signer_material_recipient_requirement_v1`),keyFamily:Tt,walletKeyId:p})}function En(e){let t=wn(e,Tn(),`LinkedDeviceTargetPreparationV1.ordinarySignerMaterialRecipientRequirements`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requirements are empty`);return[n,...t.slice(1)]}const Dn=h(`ble`,`cable`,`hybrid`,`internal`,`nfc`,`smart-card`,`usb`);function On(e,t){let n=te(e,t).map((e,n)=>Dn(e,`${t}[${n}]`));if(new Set(n).size!==n.length)throw Error(`${t} contains duplicates`);return n}function kn(){return b({kind:h(`linked_device_webauthn_registration_v1`),credentialIdB64u:wt,authenticatorAttachment:oe(h(`platform`,`cross-platform`)),clientDataJsonB64u:G,attestationObjectB64u:G,transports:On})}function An(){let e=e=>(t,n)=>{if(t!==e)throw Error(`${n} does not match its kind`);return e};return _(`kind`,[b({kind:h(`ordinary_ed25519_signer_material_recipient_request_v1`),keyFamily:e(`ed25519`),walletKeyId:p,recipientPublicKeyB64u:(e,t)=>vt(e,32,t)}),b({kind:h(`ordinary_ecdsa_signer_material_recipient_request_v1`),keyFamily:e(`ecdsa_secp256k1`),walletKeyId:p,clientEphemeralPublicKey:Me})])}function X(e){let t=wn(e,An(),`LinkedDeviceTargetCredentialRegistrationV1.ordinarySignerMaterialRecipientRequests`),n=t[0];if(!n)throw Error(`ordinary signer material recipient requests are empty`);return[n,...t.slice(1)]}function jn(){return{kind:h(`linked_device_target_credential_registration_v1`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,walletAuthMethodId:S}}function Mn(){return b({...jn(),targetFactor:Ot(),targetPreparationDigestB64u:C,ordinarySignerMaterialRecipientRequests:X,webauthnRegistration:kn(),registeredAtMs:x})}function Nn(){return b({...jn(),targetFactor:kt(),targetEmail:T,targetPreparationDigestB64u:C,ordinarySignerMaterialRecipientRequests:X,emailOtpVerificationGrant:Z,registeredAtMs:x})}function Pn(){return b({...jn(),targetFactor:kt(),targetEmail:T,targetPreparationDigestB64u:C,ordinarySignerMaterialRecipientRequests:X,emailOtpVerificationGrant:Z,emailOtpEnrollment:Pt(),registeredAtMs:x})}function Fn(e){let t=`LinkedDeviceTargetCredentialRegistrationV1`,n=u(e,t);return Y(n.targetFactor,`${t}.targetFactor`).kind===`passkey_prf`?Mn()(n,t):(Z(n.emailOtpVerificationGrant).enrollment.kind===`new_enrollment`?Pn():Nn())(n,t)}function In(){return b({kind:h(`linked_device_target_credential_registration_result_v1`),outcome:h(`applied`,`replayed`),linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,walletAuthMethodId:S,targetPreparationDigestB64u:C,targetFactor:Hn,ordinarySignerMaterialPreparations:je,ordinarySignerMaterialRecipientRequests:X,keyManifestDigestB64u:C},(e,t)=>{let{authMethod:n}=e.targetFactor;if(n.walletAuthMethodId!==e.walletAuthMethodId||n.walletId!==e.walletId)throw Error(`${t} target identity differs`)})}function Ln(e){return In()(e,`LinkedDeviceTargetCredentialRegistrationResultV1`)}function Rn(e,t){if(e.verifiedAtMs<e.authMethod.createdAtMs)throw Error(`${t}.verifiedAtMs precedes authMethod.createdAtMs`)}function zn(){return b({kind:h(`verified_passkey_target_v1`),authMethod:Wn,verificationDigestB64u:C,verifiedAtMs:x},Rn)}function Bn(){return b({kind:h(`verified_email_otp_target_v1`),authMethod:Kn,targetEmail:T,enrollment:At(),baseWalletAuthMethodId:S,providerUserId:O,verificationDigestB64u:C,verifiedAtMs:x},Rn)}function Vn(){return b({kind:h(`verified_email_otp_target_v1`),authMethod:Kn,targetEmail:T,enrollment:jt(),providerUserId:O,verificationDigestB64u:C,verifiedAtMs:x},Rn)}function Hn(e,t){let n=u(e,t);if(n.kind===`verified_passkey_target_v1`)return zn()(n,t);if(n.kind!==`verified_email_otp_target_v1`)throw Error(`${t}.kind is invalid`);return(Nt(n.enrollment,`${t}.enrollment`).kind===`existing_enrollment`?Bn():Vn())(n,t)}function Un(){return b({walletAuthMethodId:S,walletId:y,createdAtMs:x,kind:h(`passkey`),rpId:fe,credentialIdB64u:de,credentialPublicKeyB64u:G,counter:E})}function Wn(e,t){return Un()(e,t)}function Gn(){return b({walletAuthMethodId:S,walletId:y,createdAtMs:x,kind:h(`email_otp`),emailHashHex:_t,registrationAuthorityId:O})}function Kn(e,t){return Gn()(e,t)}function qn(e){return{kind:h(`linked_device_email_otp_verification_grant_v1`),grantId:O,grantToken:O,challengeId:O,linkSessionId:N,walletId:y,enrollmentId:D,deviceId:w,targetPreparationDigestB64u:C,targetEmail:T,enrollment:e,emailHashHex:_t,registrationAuthorityId:O,providerUserId:O,authorityDigestB64u:C,issuedAtMs:x,expiresAtMs:x}}function Jn(e,t){J(e.issuedAtMs,e.expiresAtMs,t)}function Yn(){return b({...qn(At()),baseWalletAuthMethodId:S},Jn)}function Xn(){return b(qn(jt()),Jn)}function Z(e){let t=`LinkedDeviceEmailOtpVerificationGrantV1`,n=u(e,t);return(Nt(n.enrollment,`${t}.enrollment`).kind===`new_enrollment`?Xn():Yn())(n,t)}function Zn(){return b({kind:h(`email_otp_factor_release_v1`),challengeId:O,enrollmentId:O,enrollmentSealKeyVersion:O,serverEphemeralPublicKey65B64u:q,nonce12B64u:(e,t)=>vt(e,12,t),ciphertextB64u:G})}function Qn(e){return Zn()(e,`LinkedDeviceEmailOtpFactorReleaseEnvelopeV1`)}function $n(){return b({kind:h(`linked_device_email_otp_challenge_start_request_v1`),linkSessionId:N,workerEphemeralPublicKey65B64u:q})}function er(e){return $n()(e,`LinkedDeviceEmailOtpChallengeStartRequestV1`)}function tr(){return b({kind:h(`linked_device_email_otp_challenge_resend_request_v1`),linkSessionId:N,challengeId:O})}function nr(e){return tr()(e,`LinkedDeviceEmailOtpChallengeResendRequestV1`)}function rr(){return b({kind:h(`linked_device_email_otp_challenge_verify_request_v1`),linkSessionId:N,challengeId:O,otpCode:(e,t)=>{if(typeof e!=`string`||!/^[0-9]{6,10}$/.test(e))throw Error(`${t} is invalid`);return e}})}function ir(e){return rr()(e,`LinkedDeviceEmailOtpChallengeVerifyRequestV1`)}function ar(){return b({kind:h(`linked_device_email_otp_challenge_result_v1`),challengeId:O,maskedEmailHint:O,expiresAtMs:x,resendAvailableAtMs:x})}function or(e){return ar()(e,`LinkedDeviceEmailOtpChallengeResultV1`)}function sr(e){let t=A(e,[`kind`,`verificationGrant`,`factorRelease`],`LinkedDeviceEmailOtpVerificationResultV1`);if(t.kind!==`linked_device_email_otp_verification_result_v1`)throw Error(`LinkedDeviceEmailOtpVerificationResultV1.kind is invalid`);let n=Z(t.verificationGrant);if(cr(n)){if(t.factorRelease!==null)throw Error(`new linked-device Email OTP enrollment cannot carry a factor release`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:null}}let r=Qn(t.factorRelease);if(r.challengeId!==n.challengeId)throw Error(`LinkedDeviceEmailOtpVerificationResultV1 challenge binding changed`);return{kind:`linked_device_email_otp_verification_result_v1`,verificationGrant:n,factorRelease:r}}function cr(e){return e.enrollment.kind===`new_enrollment`}function lr(e){let t=x(e.issuedAtMs,`QrLinkedDeviceSessionPayloadV5.issuedAtMs`),n=x(e.expiresAtMs,`QrLinkedDeviceSessionPayloadV5.expiresAtMs`);J(t,n,`QrLinkedDeviceSessionPayloadV5`);let r=Y(e.targetFactor,`QrLinkedDeviceSessionPayloadV5.targetFactor`);if(r.kind===`passkey_prf`)return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:k(Et(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,issuedAtMs:t,expiresAtMs:n};if(e.targetEmail===void 0)throw Error(`QrLinkedDeviceSessionPayloadV5.targetEmail is required for Email OTP`);return{version:`v5`,purpose:`linked_device_lane_creation`,linkSessionId:e.linkSessionId,linkPublicKeyB64u:e.linkPublicKeyB64u,devicePublicKeyB64u:e.devicePublicKeyB64u,requestedPermission:k(Et(e.requestedPermission),`QrLinkedDeviceSessionPayloadV5.requestedPermission`),targetFactor:r,targetEmail:T(e.targetEmail,`QrLinkedDeviceSessionPayloadV5.targetEmail`),issuedAtMs:t,expiresAtMs:n}}function ur(e){return{kind:`linked_device_session_claim_request_v1`,payload:e}}function dr(e,t,n){let r=x(e,`${n}.approvedAtMs`),i=x(t,`${n}.expiresAtMs`);return J(r,i,n),{approvedAtMs:r,expiresAtMs:i}}function fr(e){let t=dr(e.approvedAtMs,e.expiresAtMs,`LinkedDeviceApprovalV1`);return on({kind:`linked_device_approval_v1`,...e,...t})}function pr(e){return Fn({kind:`linked_device_target_credential_registration_v1`,...e})}function mr(e){return{kind:`linked_device_session_cancel_unclaimed_request_v1`,linkSessionId:e.linkSessionId,reason:`user_cancelled`,requestedAtMs:x(e.requestedAtMs,`LinkedDeviceSessionCancelUnclaimedRequestV1.requestedAtMs`)}}function hr(e){return{kind:`linked_device_session_cancel_claimed_request_v1`,...e,requestedAtMs:x(e.requestedAtMs,`LinkedDeviceSessionCancelClaimedRequestV1.requestedAtMs`)}}const gr=[`chrome`,`safari`,`firefox`,`edge`,`other`],_r=[`macos`,`ios`,`windows`,`android`,`linux`,`other`];function vr(e){return typeof e==`string`&&gr.some(t=>t===e)}function yr(e){return typeof e==`string`&&_r.some(t=>t===e)}function br(e){if(!e||typeof e!=`object`||Array.isArray(e))return null;let t=e,n=typeof t.label==`string`?t.label.trim():``;if(!n||!vr(t.browser)||!yr(t.os)||typeof t.synced!=`boolean`||!Array.isArray(t.transports))return null;let r=t.transports.map(e=>typeof e==`string`?e.trim():``).filter(e=>e.length>0),i=typeof t.provider==`string`?t.provider.trim():``,a=typeof t.providerLabel==`string`?t.providerLabel.trim():``;return{label:n,browser:t.browser,os:t.os,synced:t.synced,transports:r,...i?{provider:i}:{},...a?{providerLabel:a}:{}}}function xr(e){return(t,n)=>{if(!Array.isArray(t))throw Error(`${n} is invalid`);return t.map((t,r)=>e(t,`${n}[${r}]`))}}function Sr(e,t){let n=S(e,t);if(n.startsWith(`wallet-authority:`)||n.startsWith(`authority:`))throw Error(`${t} must identify a WalletAuthMethodId`);return n}function Cr(e,t){let n=E(e,t);if(n<1)throw Error(`${t} must be a positive safe integer`);return n}function wr(e,t){let n=br(e);if(!n)throw Error(`${t} is invalid`);return n}function Tr(){return _(`kind`,[b({kind:h(`passkey`),walletAuthMethodId:S,credentialIdB64u:de,device:wr}),b({kind:h(`email_otp`),walletAuthMethodId:S}),b({kind:h(`voiceid`),walletAuthMethodId:S,deviceKeyId:C})])}function Er(e,t){return Tr()(e,t)}function Dr(){return b({deviceId:w,enrollmentId:D,walletId:y,credential:Er,permission:k,keyManifestDigestB64u:C,coveredWalletKeys:xr(p),state:h(`provisioning`,`active`,`suspended`,`expired`,`revoked`),createdAtMs:x,lastActivityAtMs:x,revocationEpoch:E})}function Or(e){return Dr()(e,`LinkedDeviceSummaryV1`)}function kr(){return b({kind:h(`linked_device_list_request_v1`),walletId:y,limit:Cr,cursor:se})}function Ar(e){return kr()(e,`LinkedDeviceListRequestV1`)}function jr(){return b({walletId:y,walletAuthorityId:M,credential:Er,createdAtMs:x,lastActivityAtMs:x})}function Mr(){let e=jr();return b({devices:xr(Or),ownerDevices:xr(t=>e(t,`OwnerDeviceSummaryV1`)),nextCursor:se})}function Nr(e){return Mr()(e,`LinkedDeviceListResultV1`)}function Pr(){return b({kind:h(`linked_device_revoke_request_v1`),walletId:y,walletAuthMethodId:Sr,requestedAtMs:x})}function Fr(e){return Pr()(e,`LinkedDeviceRevokeRequestV1`)}function Ir(){return b({kind:h(`not_found`,`conflict`,`unauthorized`)})}function Lr(){return b({kind:h(`revoked`),walletAuthMethodId:Sr,authorityId:M,revocationEpoch:E})}function Rr(e){let t=u(e,`LinkedDeviceRevokeResultV1`);return(t.kind===`not_found`||t.kind===`conflict`||t.kind===`unauthorized`?Ir():Lr())(t,`LinkedDeviceRevokeResultV1`)}function zr(e){return ee({domain:`seams/linked-device/wallet-session-credential-delivery-aad/v1`,aad:e})}function Br(e){let t=qr(e,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`],`LinkedDeviceWalletSessionCredentialDeliveryBindingV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_binding_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryBindingV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_binding_v1`,namespace:Q(t.namespace,`namespace`),orgId:Q(t.orgId,`orgId`),projectId:Q(t.projectId,`projectId`),envId:Q(t.envId,`envId`),tenantId:$(ve(t.tenantId)),principalId:$(he(t.principalId))}}async function Vr(e){return P(zr(e))}async function Hr(e){return P(ee({domain:`seams/linked-device/wallet-session-credential-delivery-envelope/v1`,envelope:e}))}async function Ur(e){if(await Vr(e.aad)!==e.aadDigestB64u)throw Error(`linked-device Wallet Session credential delivery AAD digest is invalid`);if(await Hr(e.envelope)!==e.envelopeDigestB64u)throw Error(`linked-device Wallet Session credential delivery envelope digest is invalid`);if(await P(ee({domain:`seams/linked-device/delivery-recipient/v1`,recipientPublicKey65B64u:e.aad.recipientPublicKey65B64u}))!==e.recipientBindingDigestB64u)throw Error(`linked-device Wallet Session credential delivery recipient binding is invalid`)}function Wr(e){let t=qr(e,[`kind`,`aad`,`aadDigestB64u`,`recipientBindingDigestB64u`,`envelope`,`envelopeDigestB64u`,`installationReceiptDigestB64u`],`LinkedDeviceWalletSessionCredentialDeliveryV1`);if(t.kind!==`linked_device_wallet_session_credential_delivery_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryV1.kind is invalid`);return{kind:`linked_device_wallet_session_credential_delivery_v1`,aad:Gr(t.aad),aadDigestB64u:F(t.aadDigestB64u),recipientBindingDigestB64u:F(t.recipientBindingDigestB64u),envelope:Kr(t.envelope),envelopeDigestB64u:F(t.envelopeDigestB64u),installationReceiptDigestB64u:F(t.installationReceiptDigestB64u)}}function Gr(e){let n=qr(e,[`kind`,`namespace`,`orgId`,`projectId`,`envId`,`tenantId`,`principalId`,`linkSessionId`,`walletId`,`authorityId`,`walletAuthMethodId`,`authorizationId`,`walletSessionId`,`quotaId`,`credentialDigestB64u`,`recipientPublicKey65B64u`,`issuedAtMs`,`expiresAtMs`],`LinkedDeviceWalletSessionCredentialDeliveryAadV1`);if(n.kind!==`linked_device_wallet_session_credential_delivery_aad_v1`)throw Error(`LinkedDeviceWalletSessionCredentialDeliveryAadV1.kind is invalid`);let i=Jr(n.issuedAtMs,`issuedAtMs`),a=Jr(n.expiresAtMs,`expiresAtMs`);if(a<=i)throw Error(`expiresAtMs must be after issuedAtMs`);return{kind:`linked_device_wallet_session_credential_delivery_aad_v1`,namespace:Q(n.namespace,`namespace`),orgId:Q(n.orgId,`orgId`),projectId:Q(n.projectId,`projectId`),envId:Q(n.envId,`envId`),tenantId:$(ve(n.tenantId)),principalId:$(he(n.principalId)),linkSessionId:$(l(n.linkSessionId)),walletId:$(c(n.walletId)),authorityId:$(r(n.authorityId)),walletAuthMethodId:$(t(n.walletAuthMethodId)),authorizationId:$(_e(n.authorizationId)),walletSessionId:$(ge(n.walletSessionId)),quotaId:$(me(n.quotaId)),credentialDigestB64u:F(n.credentialDigestB64u),recipientPublicKey65B64u:Xr(n.recipientPublicKey65B64u,65),issuedAtMs:i,expiresAtMs:a}}function Kr(e){let t=qr(e,[`kind`,`algorithm`,`serverEphemeralPublicKey65B64u`,`nonce12B64u`,`ciphertextB64u`],`LinkedDeviceWalletSessionCredentialEnvelopeV1`);if(t.kind!==`linked_device_wallet_session_credential_envelope_v1`||t.algorithm!==`p256-ecdh-aes256gcm-v1`)throw Error(`LinkedDeviceWalletSessionCredentialEnvelopeV1 identity is invalid`);return{kind:`linked_device_wallet_session_credential_envelope_v1`,algorithm:`p256-ecdh-aes256gcm-v1`,serverEphemeralPublicKey65B64u:Xr(t.serverEphemeralPublicKey65B64u,65),nonce12B64u:Xr(t.nonce12B64u,12),ciphertextB64u:Yr(t.ciphertextB64u)}}function qr(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`${n} must be an object`);let r=e,i=new Set(t);for(let e of Object.keys(r))if(!i.has(e))throw Error(`${n}.${e} is not supported`);for(let e of t)if(!(e in r))throw Error(`${n}.${e} is required`);return r}function Q(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} is required`);return e}function Jr(e,t){if(!Number.isSafeInteger(e)||Number(e)<=0)throw Error(`${t} is invalid`);return Number(e)}function Yr(e){let t=Q(e,`base64url`);if(d(f(t))!==t)throw Error(`base64url is not canonical`);return t}function Xr(e,t){let n=Yr(e),r=f(n);if(r.length!==t)throw Error(`base64url must contain ${t} bytes`);if(t===65&&r[0]!==4)throw Error(`P-256 public key is invalid`);return n}function $(e){if(!e.ok)throw Error(e.error.message);return e.value}function Zr(e,t){let n=Oe(e);if(!n.ok)throw Error(`${t} ${n.error}`);return n.value}function Qr(){return b({kind:h(`local_authority_installation_receipt_v1`),authorityId:j(M),walletId:j(y),authMethodId:j(S),deviceId:j(ue),packageSetDigestB64u:j(C),installedActivationRefs:Zr,installedRecordSetDigestB64u:j(C),targetFactorVerificationDigestB64u:j(C),installedAtMs:j(x)})}function $r(e){return Qr()(e,`LocalAuthorityInstallationReceiptV1`)}function ei(){return b({kind:h(`local_authority_activation_final_ack_v1`),linkSessionId:j(N),authorityId:j(M),packageSetDigestB64u:j(C),authorizationId:j(pe),walletSessionId:j(ae),credentialDigestB64u:j(C),installationReceiptDigestB64u:j(C),acknowledgedAtMs:j(x)})}function ti(e){return ei()(e,`LocalAuthorityActivationFinalAckV1`)}function ni(e){let t=u(e,`ActivateInstalledAuthorityResultV1`);switch(t.kind){case`active`:{g(t,[`kind`,`authority`,`authMethod`,`walletSession`,`deliveryBinding`,`sealedDelivery`],`ActivateInstalledAuthorityResultV1`);let e=De(t.authority);if(!e.ok||e.value.state!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authority must be active`);let n=Le(t.authMethod);if(!n||n.status!==`active`)throw Error(`ActivateInstalledAuthorityResultV1.authMethod must be active`);let r=le(t.walletSession),i=Br(t.deliveryBinding),a=Wr(t.sealedDelivery);if(e.value.walletId!==n.walletId||e.value.authorityId!==n.walletAuthorityId||r.walletId!==e.value.walletId||r.authorityId!==e.value.authorityId||r.authMethodId!==n.walletAuthMethodId||r.authorityDigestB64u!==e.value.authorityDigestB64u||r.authorityRevocationEpoch!==e.value.revocationEpoch||i.namespace!==a.aad.namespace||i.orgId!==a.aad.orgId||i.projectId!==a.aad.projectId||i.envId!==a.aad.envId||i.tenantId!==a.aad.tenantId||i.principalId!==a.aad.principalId||a.aad.walletId!==r.walletId||a.aad.authorityId!==r.authorityId||a.aad.walletAuthMethodId!==r.authMethodId||a.aad.authorizationId!==r.authorizationId||a.aad.quotaId!==r.quotaId||a.aad.issuedAtMs!==r.issuedAtMs||a.aad.expiresAtMs!==r.expiresAtMs)throw Error(`ActivateInstalledAuthorityResultV1 identities do not match`);return{kind:`active`,authority:e.value,authMethod:n,walletSession:r,deliveryBinding:i,sealedDelivery:a}}case`pending_local_install`:return g(t,[`kind`,`authorityId`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`pending_local_install`,authorityId:M(t.authorityId,`authorityId`),reason:ri()(t.reason,`ActivationRetryReasonV1`)};case`integrity_error`:return g(t,[`kind`,`reason`],`ActivateInstalledAuthorityResultV1`),{kind:`integrity_error`,reason:ii(t.reason)};default:throw Error(`ActivateInstalledAuthorityResultV1.kind is invalid`)}}function ri(){return _(`kind`,[b({kind:h(`installation_receipt_not_found`)}),b({kind:h(`server_worker_activation_pending`)}),b({kind:h(`wallet_session_issuance_pending`)})])}function ii(e){let t=u(e,`LinkIntegrityFailureV1`);switch(t.kind){case`authority_id_mismatch`:return g(t,[`kind`,`expectedAuthorityId`,`actualAuthorityId`],`LinkIntegrityFailureV1`),{kind:`authority_id_mismatch`,expectedAuthorityId:M(t.expectedAuthorityId,`expectedAuthorityId`),actualAuthorityId:M(t.actualAuthorityId,`actualAuthorityId`)};case`package_set_digest_mismatch`:return g(t,[`kind`,`expectedPackageSetDigestB64u`,`actualPackageSetDigestB64u`],`LinkIntegrityFailureV1`),{kind:`package_set_digest_mismatch`,expectedPackageSetDigestB64u:C(t.expectedPackageSetDigestB64u,`expectedPackageSetDigestB64u`),actualPackageSetDigestB64u:C(t.actualPackageSetDigestB64u,`actualPackageSetDigestB64u`)};case`installation_receipt_mismatch`:if(g(t,[`kind`,`field`],`LinkIntegrityFailureV1`),t.field!==`walletId`&&t.field!==`authMethodId`&&t.field!==`deviceId`&&t.field!==`targetFactorVerificationDigestB64u`&&t.field!==`installedActivationRefs`)throw Error(`LinkIntegrityFailureV1.field is invalid`);return{kind:`installation_receipt_mismatch`,field:t.field};default:throw Error(`LinkIntegrityFailureV1.kind is invalid`)}}new TextEncoder;async function ai(e){return P(e.token)}function oi(e){return ee({domain:`seams/linked-device/local-authority-installation-receipt/v1`,receipt:e})}async function si(e){return P(oi(e))}function ci(e,t){if(e===void 0)throw Error(`${t} is required`);return e}function li(e){return I(e.kind,`targetFactor.kind`)}function ui(e){let t=e.pubKeyCredParams.map(e=>z([I(e.type,`passkeyCreationOptions.pubKeyCredParams.type`),I(String(e.alg),`passkeyCreationOptions.pubKeyCredParams.alg`)])),n=e.excludeCredentials.map(e=>z([I(e.type,`passkeyCreationOptions.excludeCredentials.type`),I(e.id,`passkeyCreationOptions.excludeCredentials.id`)]));return z([I(e.kind,`passkeyCreationOptions.kind`),I(e.walletAuthMethodId,`passkeyCreationOptions.walletAuthMethodId`),I(e.challengeId,`passkeyCreationOptions.challengeId`),I(e.challengeB64u,`passkeyCreationOptions.challengeB64u`),I(e.rpId,`passkeyCreationOptions.rpId`),I(e.user.idB64u,`passkeyCreationOptions.user.idB64u`),I(e.user.name,`passkeyCreationOptions.user.name`),I(e.user.displayName,`passkeyCreationOptions.user.displayName`),Fe(t.length,`passkeyCreationOptions.pubKeyCredParams`),...t.map(e=>L(e,`passkeyCreationOptions.pubKeyCredParams.item`)),I(e.authenticatorSelection.residentKey,`passkeyCreationOptions.authenticatorSelection.residentKey`),I(e.authenticatorSelection.userVerification,`passkeyCreationOptions.authenticatorSelection.userVerification`),R(e.timeoutMs,`passkeyCreationOptions.timeoutMs`),I(e.attestation,`passkeyCreationOptions.attestation`),I(e.extensions.prf.eval.firstB64u,`passkeyCreationOptions.extensions.prf.eval.firstB64u`),I(e.extensions.prf.eval.secondB64u,`passkeyCreationOptions.extensions.prf.eval.secondB64u`),Fe(n.length,`passkeyCreationOptions.excludeCredentials`),...n.map(e=>L(e,`passkeyCreationOptions.excludeCredentials.item`))])}function di(e){return z([I(e.kind,`recipientRequirement.kind`),I(e.keyFamily,`recipientRequirement.keyFamily`),I(e.walletKeyId,`recipientRequirement.walletKeyId`)])}function fi(e){return e===null?I(`none`,`ed25519ExportRoot.kind`):z([I(e.kind,`ed25519ExportRoot.kind`),I(e.walletKeyId,`ed25519ExportRoot.walletKeyId`),Ie(e.applicationBindingDigestB64u,`ed25519ExportRoot.applicationBindingDigestB64u`),Pe(e.registeredPublicKeyB64u,`ed25519ExportRoot.registeredPublicKeyB64u`),R(e.revocationEpoch,`ed25519ExportRoot.revocationEpoch`)])}function pi(e){let t=e.ordinarySignerMaterialRecipientRequirements.map(di),n=hi(e)?e:void 0,r=n?.passkeyCreationOptions;if(e.targetFactor.kind===`passkey_prf`&&!r)throw Error(`passkey target preparation is missing creation options`);return z([I(`seams/linked-device/target-preparation/v1`,`domain`),I(e.kind,`kind`),I(e.linkSessionId,`linkSessionId`),I(e.walletId,`walletId`),I(e.enrollmentId,`enrollmentId`),I(e.deviceId,`deviceId`),L(Pe(e.deliveryRecipientPublicKey65B64u,`deliveryRecipientPublicKey65B64u`),`deliveryRecipientPublicKey65B64u`),I(e.walletAuthMethodId,`walletAuthMethodId`),L(fi(e.ed25519ExportRoot),`ed25519ExportRoot`),L(li(e.targetFactor),`targetFactor`),...r?[L(ui(r),`passkeyCreationOptions`),Ie(n.passkeyConfigurationDigestB64u,`passkeyConfigurationDigestB64u`)]:[],...mi(e),Fe(t.length,`ordinarySignerMaterialRecipientRequirements`),...t.map(e=>L(e,`ordinarySignerMaterialRecipientRequirements.item`)),R(e.issuedAtMs,`issuedAtMs`),R(e.expiresAtMs,`expiresAtMs`)])}function mi(e){return hi(e)?[]:[I(e.targetEmail,`targetEmail`),I(e.enrollment.kind,`enrollment.kind`),...e.enrollment.kind===`existing_enrollment`?[I(ci(e.baseWalletAuthMethodId,`baseWalletAuthMethodId`),`baseWalletAuthMethodId`)]:[]]}function hi(e){return e.targetFactor.kind===`passkey_prf`}async function gi(e){return ye(pi(e))}const _i=`x-seams-linked-device-proof-v1`,vi=6e4,yi=6e4;async function bi(e){return ye(xi(e,32,`devicePublicKeyB64u`))}function xi(e,t,n){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${n} is invalid`);let r;try{r=f(e)}catch{throw Error(`${n} is invalid`)}if(r.length!==t||d(r)!==e)throw Error(`${n} is invalid`);return r}export{Ge as $,xn as A,Qt as B,pr as C,qt as D,Gt as E,Qn as F,Rt as G,gn as H,Z as I,ze as J,tt as K,sr as L,or as M,er as N,cn as O,ir as P,Ke as Q,Bt as R,ur as S,Ct as T,mn as U,Ln as V,Lt as W,qe as X,We as Y,Ue as Z,Rr as _,gi as a,hr as b,ni as c,Ur as d,Re as et,Br as f,Fr as g,Nr as h,bi as i,nr as j,Yt as k,ti as l,Ar as m,_i as n,si as o,Wr as p,et as q,vi as r,ai as s,yi as t,$r as u,br as v,lr as w,mr as x,fr as y,en as z};

package/dist/public/sdk/{deviceLinkApproval-CObsEWBa.js → deviceLinkApproval-C4T8XAmi.js}

@@ -1,2 +1,2 @@
-import{n as e}from"./chunk-dVx5-UGu.js";import{o as t}from"./canonicalPrimitives-Jd3i_Ngz.js";import{G as n,W as r}from"./device-linking-_o3_fgiG.js";var i=e({approveDeviceLinkWithConsent:()=>d,cancelDeviceLinkApproval:()=>f,confirmDeviceLinkApproval:()=>u});const a=`Device linking was cancelled`;let o=null;function s(e){switch(e){case`sign`:return`Sign transactions`;case`export_keys`:return`Export signing keys`;case`link_devices`:return`Link other devices`;case`revoke_devices`:return`Remove devices`;default:throw Error(`Unsupported device permission`)}}var c=class{surface=null;state=`pending`;snapshot;constructor(e,t,r,i){this.requestId=e,this.target=t,this.appearance=r,this.measurement=i,Object.freeze(t.targetFactor),Object.freeze(t.requestedPermission),Object.freeze(t),this.snapshot=n(t)}cancel(){this.state=`cancelled`,this.surface?.close(!1)}assertCurrent(){if(o!==this||this.state===`cancelled`||this.target.expiresAtMs<=Date.now())throw this.cancel(),Error(a)}async confirm(e){if(this.assertCurrent(),this.state!==`pending`)throw Error(`Device approval was already requested`);this.state=`showing`;let n=setTimeout(this.cancel.bind(this),Math.max(0,this.target.expiresAtMs-Date.now()));try{let n=await t(this.snapshot),{mountConfirmUI:r}=await import(`./confirm-ui-Dx6c4-Rk.js`).then(e=>e.n);this.assertCurrent();let i=this.target.targetFactor.kind===`passkey_prf`?`Passkey`:`Email code: ${this.target.targetEmail}`;this.surface=await r({ctx:{surfaceMeasurementBinding:this.measurement},summary:{title:`Link a device?`,body:[`Wallet: ${String(e).slice(0,12)}…`,`Device request: ${n.slice(0,16)}`,`Sign-in method: ${i}`,``,`This device will be able to:`,...this.target.requestedPermission.permissions.map(l)].join(`
+import{n as e}from"./chunk-dVx5-UGu.js";import{o as t}from"./canonicalPrimitives-DKeS3M40.js";import{G as n,W as r}from"./device-linking-BL2aDEUF.js";var i=e({approveDeviceLinkWithConsent:()=>d,cancelDeviceLinkApproval:()=>f,confirmDeviceLinkApproval:()=>u});const a=`Device linking was cancelled`;let o=null;function s(e){switch(e){case`sign`:return`Sign transactions`;case`export_keys`:return`Export signing keys`;case`link_devices`:return`Link other devices`;case`revoke_devices`:return`Remove devices`;default:throw Error(`Unsupported device permission`)}}var c=class{surface=null;state=`pending`;snapshot;constructor(e,t,r,i){this.requestId=e,this.target=t,this.appearance=r,this.measurement=i,Object.freeze(t.targetFactor),Object.freeze(t.requestedPermission),Object.freeze(t),this.snapshot=n(t)}cancel(){this.state=`cancelled`,this.surface?.close(!1)}assertCurrent(){if(o!==this||this.state===`cancelled`||this.target.expiresAtMs<=Date.now())throw this.cancel(),Error(a)}async confirm(e){if(this.assertCurrent(),this.state!==`pending`)throw Error(`Device approval was already requested`);this.state=`showing`;let n=setTimeout(this.cancel.bind(this),Math.max(0,this.target.expiresAtMs-Date.now()));try{let n=await t(this.snapshot),{mountConfirmUI:r}=await import(`./confirm-ui-DWFcGTsT.js`).then(e=>e.n);this.assertCurrent();let i=this.target.targetFactor.kind===`passkey_prf`?`Passkey`:`Email code: ${this.target.targetEmail}`;this.surface=await r({ctx:{surfaceMeasurementBinding:this.measurement},summary:{title:`Link a device?`,body:[`Wallet: ${String(e).slice(0,12)}…`,`Device request: ${n.slice(0,16)}`,`Sign-in method: ${i}`,``,`This device will be able to:`,...this.target.requestedPermission.permissions.map(l)].join(`
 `)},securityContext:{rpId:window.location.hostname},appearance:this.appearance,uiMode:`modal`}),this.surface.element.dataset.seamsDeviceLinkApproval=n,this.surface.element.dataset.seamsDeviceLinkWallet=e,this.surface.update({confirmText:`Link device`,cancelText:`Cancel`}),this.assertCurrent();let o=await this.surface.takeDecision();if(this.assertCurrent(),o.kind!==`confirmed`)throw this.cancel(),Error(a);this.state=`approved`}finally{clearTimeout(n),this.surface?.close(!1),this.surface=null}}};function l(e){return`• ${s(e)}`}const u=async e=>{let t=o;if(!t||n(e.payload)!==t.snapshot)throw Error(`Device linking requires its exact Wallet-origin approval`);return await t.confirm(e.walletId),{assertCurrent:t.assertCurrent.bind(t)}};async function d(e,t,n){if(o)throw Error(`Another device-link request is active`);let i=e.readMeasurementBinding();if(i.kind!==`wallet_iframe`)throw Error(`Device approval requires the Wallet origin`);let a=r(t),s=new c(i.requestId,a,e.readAppearance(),i);o=s;try{return await e.execute(a,n)}finally{s.cancel(),o===s&&(o=null)}}function f(e){(e.kind===`all`||o?.requestId===e.requestId)&&o?.cancel()}export{i,f as n,u as r,d as t};

package/dist/public/sdk/{digestEncoding-34kXJoJr.js → digestEncoding-Rx8Vjy4J.js}

@@ -1 +1 @@
-import{A as e,D as t,E as n,M as r,N as i,S as a,b as o,c as s,g as c,k as l,o as u}from"./domainIds-t1lp25yU.js";import{S as d,c as ee,r as f,t as p}from"./digests-BIaE0DMd.js";import{i as m,r as h}from"./base64-BmKR3UqU.js";import{J as g,X as te,i as ne,n as re}from"./activeWalletSession-BJ4B-nJo.js";import{d as ie,g as ae,h as oe,m as se,n as ce,u as le}from"./capabilityKinds-DVlGMspk.js";import{n as ue,r as de}from"./canonicalPrimitives-Jd3i_Ngz.js";function fe(e,t){let n=ee(e,t);if(!/^x25519:[0-9a-f]{64}$/.test(n))throw Error(`${t} must use x25519:<64 lowercase hex chars> encoding`);return n}function pe(e,t,n){let r=Object.keys(e).sort(),i=[...t].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${n} has invalid fields`)}function _(e,t){if(typeof e!=`string`||e.trim()!==e||!e)throw Error(`${t} is required`);if(!/^[\x20-\x7e]+$/.test(e))throw Error(`${t} must be printable ASCII`);return e}function v(e){let t=d(e,`authorization`);switch(t.kind){case`reusable_wallet_session`:return pe(t,[`kind`,`wallet_session_id`],`authorization`),{kind:`reusable_wallet_session`,wallet_session_id:_(t.wallet_session_id,`authorization.wallet_session_id`)};case`operation_step_up`:return pe(t,[`kind`],`authorization`),{kind:`operation_step_up`};default:throw Error(`authorization.kind is not supported`)}}function y(e){let t=d(e,`material_activation`);if(pe(t,[`kind`,`activation_id`,`capability`,`material_owner`,`key_binding`,`lifecycle_binding`,`signing_worker`],`material_activation`),t.kind!==`mpc_material_activation_ref`)throw Error(`material_activation.kind is not supported`);return{kind:`mpc_material_activation_ref`,activation_id:_(t.activation_id,`material_activation.activation_id`),capability:_(t.capability,`material_activation.capability`),material_owner:_(t.material_owner,`material_activation.material_owner`),key_binding:_(t.key_binding,`material_activation.key_binding`),lifecycle_binding:_(t.lifecycle_binding,`material_activation.lifecycle_binding`),signing_worker:_(t.signing_worker,`material_activation.signing_worker`)}}function me(e){return y({kind:e.kind,activation_id:e.activationId,capability:e.capability,material_owner:e.materialOwner,key_binding:e.keyBinding,lifecycle_binding:e.lifecycleBinding,signing_worker:e.signingWorker})}function he(e){let t=y(e),n=c({kind:t.kind,activationId:t.activation_id,capability:t.capability,materialOwner:t.material_owner,keyBinding:t.key_binding,lifecycleBinding:t.lifecycle_binding,signingWorker:t.signing_worker});if(!n.ok)throw Error(`material_activation is invalid: ${n.error.message}`);return n.value}function ge(e){return new TextEncoder().encode(e)}function b(e,t){let n=ge(t),r=n.length>>>0;e.push(r>>>24&255,r>>>16&255,r>>>8&255,r&255),e.push(...n)}function _e(e){let t=v(e),n=[];switch(b(n,t.kind),t.kind){case`reusable_wallet_session`:b(n,t.wallet_session_id);break;case`operation_step_up`:break}return new Uint8Array(n)}function x(e){let t=y(e),n=[];return b(n,t.kind),b(n,t.activation_id),b(n,t.capability),b(n,t.material_owner),b(n,t.key_binding),b(n,t.lifecycle_binding),b(n,t.signing_worker),new Uint8Array(n)}function S(e,t){return e.kind===t.kind&&e.activation_id===t.activation_id&&e.capability===t.capability&&e.material_owner===t.material_owner&&e.key_binding===t.key_binding&&e.lifecycle_binding===t.lifecycle_binding&&e.signing_worker===t.signing_worker}function ve(e,t){if(typeof e!=`string`)throw Error(`EVM-family signing key slot id requires ${t}`);let n=e.trim();if(!n)throw Error(`EVM-family signing key slot id requires ${t}`);return n}function C(e){return encodeURIComponent(ve(e,`non-empty components`))}function ye(e){let t=e.split(`:`);return t.length===5&&t[0]===`wallet-key`&&t[1]===`evm-family`&&t.slice(2).every(e=>e.length>0)}function be(t){let n=e(t);return n.ok?ye(String(n.value))?{ok:!0,value:String(n.value)}:{ok:!1,error:{code:`invalid`,message:`EVM-family signing key slot id must be wallet-key:evm-family:<walletId>:<signingRootId>:<signingRootVersion>`}}:n}function xe(e,t=`evmFamilySigningKeySlotId`){let n=be(e);if(n.ok)return n.value;throw n.error.code===`missing`?Error(`${t} is required`):Error(`${t} must be an EVM-family signing key slot id`)}function Se(e){return xe([`wallet-key`,`evm-family`,C(e.walletId),C(e.signingRootId),C(e.signingRootVersion)].join(`:`))}function Ce(e){let t=e.trim(),n=h(t);if(n.length!==33||m(n)!==t)throw Error(`ECDSA client root public key must be canonical base64url for 33 bytes`);return t}function w(e,t){let n=String(e??``).trim();if(!n)throw Error(`${t} is required`);return n}function we(e){return w(e,`ecdsaThresholdKeyId`)}function Te(e){return w(e,`signingRootId`)}function Ee(e){return w(e,`signingRootVersion`)}async function De(e){let t=Se(e);return`ederivation-relayer-${m(await f(p({version:`threshold_ecdsa_derivation_relayer_key_id_v1`,schemeId:`threshold-secp256k1-ecdsa-2p-v1`,walletId:e.walletId,evmFamilySigningKeySlotId:t})))}`}function T(e,t){if(typeof e!=`string`||e.trim()!==e||e.length===0)throw Error(`${t} must be a non-empty canonical string`);return e}function E(e,t,n){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be unpadded base64url`);let r;try{r=h(e)}catch{throw Error(`${t} must be valid base64url`)}if(r.length===0||n!==null&&r.length!==n||m(r)!==e)throw Error(`${t} has an invalid canonical byte length`);return e}function Oe(e){return T(e,`ECDSA signer id`)}function ke(e){return T(e,`ECDSA server generation`)}function Ae(e){return T(e,`ECDSA manifest id`)}function je(e){if(!Number.isSafeInteger(e)||Number(e)<1)throw Error(`ECDSA manifest revision must be a positive safe integer`);return e}function Me(e){return E(e,`ECDSA ciphertext digest`,32)}function Ne(e){return E(e,`ECDSA pending ciphertext digest`,32)}function Pe(e){return E(e,`ECDSA activation digest`,32)}function Fe(e){return T(e,`ECDSA lifecycle id`)}function Ie(e){return T(e,`ECDSA material sealing key id`)}function Le(e){return E(e,`ECDSA AES-GCM IV`,12)}function Re(e){return E(e,`ECDSA ciphertext`,null)}function ze(e){if(typeof e!=`string`||e.trim()!==e)throw Error(`ECDSA server activation request must be canonical JSON`);let t;try{t=JSON.parse(e)}catch{throw Error(`ECDSA server activation request must be canonical JSON`)}if(typeof t!=`object`||!t||Array.isArray(t)||p(t)!==e)throw Error(`ECDSA server activation request must be a canonical JSON object`);return e}function Be(e){return{walletId:e.walletId,bindingId:e.walletAuthMethodId,factor:{kind:`voiceid`,deviceKeyId:e.deviceKeyId},verifier:{kind:`device_signature`}}}function D(e){return e.factor.kind===`voiceid`}function O(e){return e.factor.kind===`passkey`}function k(e){return e.factor.kind===`email_otp`}function Ve(e,t){return e.walletId!==t.walletId||e.bindingId!==t.bindingId?!1:O(e)?O(t)?e.factor.credentialIdB64u===t.factor.credentialIdB64u&&e.verifier.rpId===t.verifier.rpId:!1:k(e)?k(t)?e.factor.provider===t.factor.provider&&e.factor.providerUserId===t.factor.providerUserId&&e.verifier.emailHashHex===t.verifier.emailHashHex:!1:D(e)?D(t)&&e.factor.deviceKeyId===t.factor.deviceKeyId:!1}function He(e){if(!e||typeof e!=`object`||Array.isArray(e))return null;let r=e,i=Object.keys(r);if(i.length!==4||!i.every(e=>[`kind`,`walletId`,`authorityDigest`,`walletAuthMethodId`].includes(e))||r.kind!==`wallet_auth_authority_ref`)return null;let a=l(r.walletId),o=t(r.authorityDigest),s=n(r.walletAuthMethodId);return!a.ok||!o.ok||!s.ok?null:{kind:`wallet_auth_authority_ref`,walletId:a.value,authorityDigest:o.value,walletAuthMethodId:s.value}}function Ue(e){let t=String(e||``).trim().toLowerCase();return t===`google`||t===`email`?t:null}function A(e,t){if(e.ok)return e.value;throw Error(t)}function We(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function Ge(e,t){for(let n of t)if(We(e,n))return!0;return!1}function Ke(e){let t=A(l(e.walletId),`Passkey wallet auth authority requires walletId`),a=A(i(e.rpId),`Passkey wallet auth authority requires rpId`),o=A(r(e.credentialIdB64u),`Passkey wallet auth authority requires credentialIdB64u`),s=A(n(`passkey:${a}:${o}`),`Passkey wallet auth authority requires bindingId`);return{walletId:t,factor:{kind:`passkey`,credentialIdB64u:o},verifier:{kind:`webauthn`,rpId:a},bindingId:s}}function qe(e){let t=Ue(e.provider);if(!t)throw Error(`Email OTP factor identity requires provider`);return{kind:`email_otp`,provider:t,providerUserId:A(s(e.providerUserId),`Email OTP factor identity requires providerUserId`)}}function Je(e){let t=A(l(e.walletId),`Email OTP wallet auth authority requires walletId`),r=qe(e),i=String(e.emailHashHex||``).trim();if(!i)throw Error(`Email OTP wallet auth authority requires emailHashHex`);let a=A(n(`email_otp:${t}:${i}`),`Email OTP wallet auth authority requires bindingId`);return{walletId:t,factor:r,verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:i},bindingId:a}}function Ye(e){return e.factor.provider}function Xe(e){return e.factor.providerUserId}function Ze(e){return e.verifier.emailHashHex}function Qe(e){let t=e.factor;if(!t||typeof t!=`object`||Array.isArray(t))return null;let a=e.verifier;if(!a||typeof a!=`object`||Array.isArray(a))return null;let o=t,s=a,c=String(o.kind||``).trim().toLowerCase(),u=String(s.kind||``).trim().toLowerCase();if(c!==`passkey`||u!==`webauthn`)return null;try{if(Ge(e,[`kind`,`rpId`,`credentialIdB64u`,`provider`,`providerUserId`]))return null;let t=l(e.walletId),a=i(s.rpId),c=r(o.credentialIdB64u),u=n(e.bindingId);return!t.ok||!a.ok||!c.ok||!u.ok?null:{walletId:t.value,factor:{kind:`passkey`,credentialIdB64u:c.value},verifier:{kind:`webauthn`,rpId:a.value},bindingId:u.value}}catch{return null}}function $e(e){let t=e.factor;if(!t||typeof t!=`object`||Array.isArray(t))return null;let r=e.verifier;if(!r||typeof r!=`object`||Array.isArray(r))return null;let i=t,a=r,o=String(i.kind||``).trim().toLowerCase(),c=String(a.kind||``).trim().toLowerCase();if(o!==`email_otp`||c!==`email_otp_wallet_auth_method`)return null;try{if(Ge(e,[`kind`,`rpId`,`credentialIdB64u`,`provider`,`providerUserId`]))return null;let t=l(e.walletId),r=Ue(i.provider),o=s(i.providerUserId),c=String(a.emailHashHex||``).trim(),u=n(e.bindingId);return!t.ok||!r||!o.ok||!c||!u.ok?null:{walletId:t.value,factor:{kind:`email_otp`,provider:r,providerUserId:o.value},verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:c},bindingId:u.value}}catch{return null}}function et(e){if(!e||typeof e!=`object`||Array.isArray(e))return null;let t=e;return Qe(t)||$e(t)||tt(t)}function tt(e){try{let t=d(e,`device authority`);g(t,[`walletId`,`bindingId`,`factor`,`verifier`],`device authority`);let r=d(t.factor,`device factor`),i=d(t.verifier,`device verifier`);if(g(r,[`kind`,`deviceKeyId`],`device factor`),g(i,[`kind`],`device verifier`),r.kind!==`voiceid`||i.kind!==`device_signature`)return null;let a=l(t.walletId),o=n(t.bindingId);return!a.ok||!o.ok?null:Be({walletId:a.value,walletAuthMethodId:o.value,deviceKeyId:de(r.deviceKeyId)})}catch{return null}}function nt(e){return!e||typeof e!=`object`||Array.isArray(e)?null:$e(e)}function rt(e){return!e||typeof e!=`object`||Array.isArray(e)?null:Qe(e)}function it(e){return`seams:wallet-authority-binding:v1|${p(e.authority)}`}async function at(e){return A(t(m(await f(it(e)))),`Wallet authority binding digest must be non-empty`)}async function ot(e){return{kind:`wallet_auth_authority_ref`,walletId:e.authority.walletId,authorityDigest:await at({authority:e.authority}),walletAuthMethodId:e.authority.bindingId}}const st=5*6e4,ct=`/router-ab/ecdsa-derivation/export`,lt=`/router-ab/ecdsa-derivation/presignature-pool/fill/init`,ut=`/router-ab/ecdsa-derivation/presignature-pool/fill/step`,dt=`/router-ab/ecdsa-derivation/session/activate`,ft=`/router-ab/ecdsa-derivation/operation-step-up`,pt=[1,2];function mt(e,t){if(e===`reusable_wallet_session`||e===`verified_step_up`)return e;throw Error(`${t} must be reusable_wallet_session or verified_step_up`)}function ht(e){let t=d(e,`operationStepUpAuthorizationResponse.export_topology`);j(t,`operationStepUpAuthorizationResponse.export_topology`,[`signer_set`,`deriver_recipient_keys`,`router_id`]);let n=kt(t.signer_set,`operationStepUpAuthorizationResponse.export_topology.signer_set`),r=Mt(t.deriver_recipient_keys,`operationStepUpAuthorizationResponse.export_topology.deriver_recipient_keys`);if(r.deriver_a.key_epoch!==n.signer_a.key_epoch||r.deriver_b.key_epoch!==n.signer_b.key_epoch)throw Error(`operationStepUpAuthorizationResponse.export_topology recipient key epochs do not match signer_set`);return{signer_set:n,deriver_recipient_keys:r,router_id:M(t.router_id,`operationStepUpAuthorizationResponse.export_topology.router_id`)}}function gt(e){let t=d(e,`operationStepUpAuthorizationResponse`),n=zn(t.operation_kind);if(j(t,`operationStepUpAuthorizationResponse`,[`ok`,`kind`,`authorization`,`expires_at_ms`,`operation_kind`,...n===`evm.export_key`?[`export_topology`]:[]]),t.ok!==!0||t.kind!==`verified_step_up`)throw Error(`operationStepUpAuthorizationResponse is invalid`);let r=d(t.authorization,`operationStepUpAuthorizationResponse.authorization`);if(j(r,`operationStepUpAuthorizationResponse.authorization`,[`kind`,`evidence_set_digest`,`unseal`]),r.kind!==`operation_step_up`)throw Error(`operationStepUpAuthorizationResponse.authorization.kind is invalid`);let i=F(t.expires_at_ms,`operationStepUpAuthorizationResponse.expires_at_ms`);if(i<=Date.now())throw Error(`operationStepUpAuthorizationResponse.expires_at_ms is expired`);let a=d(r.unseal,`operationStepUpAuthorizationResponse.authorization.unseal`),o=M(a.kind,`operationStepUpAuthorizationResponse.authorization.unseal.kind`),s;switch(o){case`not_requested`:j(a,`operationStepUpAuthorizationResponse.authorization.unseal`,[`kind`]),s={kind:`not_requested`};break;case`email_otp_grant`:j(a,`operationStepUpAuthorizationResponse.authorization.unseal`,[`kind`,`grant`,`challenge_id`]),s={kind:`email_otp_grant`,grant:M(a.grant,`operationStepUpAuthorizationResponse.authorization.unseal.grant`),challenge_id:M(a.challenge_id,`operationStepUpAuthorizationResponse.authorization.unseal.challenge_id`)};break;default:throw Error(`operationStepUpAuthorizationResponse.authorization.unseal.kind is invalid`)}let c={ok:!0,kind:`verified_step_up`,authorization:{kind:`operation_step_up`,evidence_set_digest:de(r.evidence_set_digest),unseal:s},expires_at_ms:i};return n===`evm.sign_transaction`?{...c,operation_kind:`evm.sign_transaction`}:{...c,operation_kind:`evm.export_key`,export_topology:ht(t.export_topology)}}async function _t(e){return m(await f(p({domain:`router-ab-ecdsa-operation-step-up/challenge/v1`,operation:Rn(e)})))}function j(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`)}function M(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} is required`);if(!/^[\x20-\x7e]+$/.test(n))throw Error(`${t} must be printable ASCII`);return n}function N(e,t){let n=o(M(e,t));if(!n.ok)throw Error(`${t} is invalid`);return n.value}function P(e,t){let n=a(M(e,t));if(!n.ok)throw Error(`${t} is invalid`);return n.value}function vt(e,t){let n=le(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function yt(e,t){let n=se(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function bt(e,t){let n=oe(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function xt(e,t){let n=ie(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function F(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe integer`);return e}function I(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe-integer counter`);return e}function L(e,t){if(typeof e!=`number`||!Number.isFinite(e))throw Error(`${t} must be a finite number`);let n=Math.floor(e);if(n!==e||n<0||n>4294967295)throw Error(`${t} must be a u32 integer`);return n}function St(e,t){if(typeof e!=`number`||!Number.isFinite(e))throw Error(`${t} must be a finite number`);let n=Math.floor(e);if(n!==e||n<0||n>255)throw Error(`${t} must be a byte`);return n}function R(e,t,n){let r=M(e,t);if(!/^[A-Za-z0-9_-]+$/.test(r))throw Error(`${t} must be unpadded base64url`);let i;try{i=h(r)}catch{throw Error(`${t} must be valid base64url`)}if(i.length!==n)throw Error(`${t} must decode to ${n} bytes`);return r}function z(e,t){let n=R(e,t,33),r=h(n);if(r[0]!==2&&r[0]!==3)throw Error(`${t} must be a compressed secp256k1 public key`);return n}function Ct(e,t){let n=M(e,t);if(!/^[A-Za-z0-9_-]+$/.test(n))throw Error(`${t} must be unpadded base64url`);let r;try{r=h(n)}catch{throw Error(`${t} must be valid base64url`)}if(r.length===0)throw Error(`${t} must decode to non-empty bytes`);return n}function wt(e,t){let n=M(e,t);if(!/^x25519:[0-9a-f]{64}$/.test(n))throw Error(`${t} must use x25519:<64 lowercase hex chars> encoding`);return n}function B(e,t,n){if(!(e instanceof Uint8Array))throw Error(`${t} must be a Uint8Array`);if(e.length!==n)throw Error(`${t} must contain ${n} bytes`);return e}function Tt(e,t){let n=M(e,t);if(n!==`ecdsa_secp256k1_recoverable_v1`)throw Error(`${t} must be ecdsa_secp256k1_recoverable_v1`);return n}function V(e,t){let n=d(e,t);if(j(n,t,[`bytes`]),!Array.isArray(n.bytes))throw Error(`${t}.bytes must be an array`);if(n.bytes.length!==32)throw Error(`${t}.bytes must contain 32 bytes`);return{bytes:n.bytes.map((e,n)=>St(e,`${t}.bytes[${n}]`))}}function H(e){let t=d(e,`scope.context`);j(t,`scope.context`,[`application_binding_digest_b64u`]);let n=h(M(t.application_binding_digest_b64u,`scope.context.application_binding_digest_b64u`));if(n.length!==32)throw Error(`scope.context.application_binding_digest_b64u must decode to 32 bytes`);return{application_binding_digest_b64u:m(n)}}function U(e){let t=d(e,`scope.public_identity`);return j(t,`scope.public_identity`,[`context_binding_b64u`,`derivation_client_share_public_key33_b64u`,`server_public_key33_b64u`,`threshold_public_key33_b64u`,`ethereum_address20_b64u`,`client_share_retry_counter`,`server_share_retry_counter`]),{context_binding_b64u:R(t.context_binding_b64u,`scope.public_identity.context_binding_b64u`,32),derivation_client_share_public_key33_b64u:z(t.derivation_client_share_public_key33_b64u,`scope.public_identity.derivation_client_share_public_key33_b64u`),server_public_key33_b64u:z(t.server_public_key33_b64u,`scope.public_identity.server_public_key33_b64u`),threshold_public_key33_b64u:z(t.threshold_public_key33_b64u,`scope.public_identity.threshold_public_key33_b64u`),ethereum_address20_b64u:R(t.ethereum_address20_b64u,`scope.public_identity.ethereum_address20_b64u`,20),client_share_retry_counter:L(t.client_share_retry_counter,`scope.public_identity.client_share_retry_counter`),server_share_retry_counter:L(t.server_share_retry_counter,`scope.public_identity.server_share_retry_counter`)}}function Et(e){return Dt(e,`scope.signing_worker`)}function Dt(e,t){let n=d(e,t);return j(n,t,[`server_id`,`key_epoch`,`recipient_encryption_key`]),{server_id:M(n.server_id,`${t}.server_id`),key_epoch:M(n.key_epoch,`${t}.key_epoch`),recipient_encryption_key:fe(n.recipient_encryption_key,`${t}.recipient_encryption_key`)}}function Ot(e,t,n){let r=d(e,t);if(j(r,t,[`role`,`signer_id`,`key_epoch`]),M(r.role,`${t}.role`)!==n)throw Error(`${t}.role must be ${n}`);return{role:n,signer_id:M(r.signer_id,`${t}.signer_id`),key_epoch:M(r.key_epoch,`${t}.key_epoch`)}}function kt(e,t){let n=d(e,t);j(n,t,[`signer_set_id`,`policy`,`signer_a`,`signer_b`,`selected_server`]);let r=M(n.policy,`${t}.policy`);if(r!==`all_2`)throw Error(`${t}.policy must be all_2`);let i=Ot(n.signer_a,`${t}.signer_a`,`signer_a`),a=Ot(n.signer_b,`${t}.signer_b`,`signer_b`);if(i.signer_id===a.signer_id)throw Error(`${t} requires distinct signer ids`);return{signer_set_id:M(n.signer_set_id,`${t}.signer_set_id`),policy:r,signer_a:i,signer_b:a,selected_server:Dt(n.selected_server,`${t}.selected_server`)}}function At(e){let t=`registration.lifecycle`,n=d(e,t);if(j(n,t,[`lifecycle_id`,`work_kind`,`primitive_request_kind`,`root_share_epoch`,`account_id`,`session_id`,`signer_set_id`,`selected_server_id`]),n.work_kind!==`registration_prepare`)throw Error(`${t}.work_kind must be registration_prepare`);if(n.primitive_request_kind!==`registration`)throw Error(`${t}.primitive_request_kind must be registration`);return{lifecycle_id:M(n.lifecycle_id,`${t}.lifecycle_id`),work_kind:`registration_prepare`,primitive_request_kind:`registration`,root_share_epoch:N(n.root_share_epoch,`${t}.root_share_epoch`),account_id:M(n.account_id,`${t}.account_id`),session_id:M(n.session_id,`${t}.session_id`),signer_set_id:M(n.signer_set_id,`${t}.signer_set_id`),selected_server_id:M(n.selected_server_id,`${t}.selected_server_id`)}}function jt(e,t,n){let r=d(e,t);if(j(r,t,[`role`,`key_epoch`,`public_key`]),r.role!==n)throw Error(`${t}.role must be ${n}`);return{role:n,key_epoch:M(r.key_epoch,`${t}.key_epoch`),public_key:fe(r.public_key,`${t}.public_key`)}}function Mt(e,t=`registration.deriver_recipient_keys`){let n=d(e,t);return j(n,t,[`deriver_a`,`deriver_b`]),{deriver_a:jt(n.deriver_a,`${t}.deriver_a`,`signer_a`),deriver_b:jt(n.deriver_b,`${t}.deriver_b`,`signer_b`)}}function Nt(e){let t=`registration`,n=d(e,t);if(j(n,t,[`registration_purpose`,`context`,`lifecycle`,`signer_set`,`router_id`,`client_id`,`replay_nonce`,`expires_at_ms`,`deriver_recipient_keys`]),n.registration_purpose!==`wallet_registration`&&n.registration_purpose!==`wallet_add_signer`)throw Error(`${t}.registration_purpose is invalid`);let r=At(n.lifecycle),i=kt(n.signer_set,`${t}.signer_set`);if(r.signer_set_id!==i.signer_set_id)throw Error(`${t}.lifecycle signer set does not match signer_set`);if(r.selected_server_id!==i.selected_server.server_id)throw Error(`${t}.lifecycle selected server does not match signer_set`);let a=Mt(n.deriver_recipient_keys);if(a.deriver_a.key_epoch!==i.signer_a.key_epoch)throw Error(`${t}.deriver_a recipient key epoch does not match signer_set`);if(a.deriver_b.key_epoch!==i.signer_b.key_epoch)throw Error(`${t}.deriver_b recipient key epoch does not match signer_set`);return{registration_purpose:n.registration_purpose,context:H(n.context),lifecycle:r,signer_set:i,router_id:M(n.router_id,`${t}.router_id`),client_id:M(n.client_id,`${t}.client_id`),replay_nonce:M(n.replay_nonce,`${t}.replay_nonce`),expires_at_ms:F(n.expires_at_ms,`${t}.expires_at_ms`),deriver_recipient_keys:a}}function Pt(e,t){let n=d(e,t);if(j(n,t,[`kind`,`transcriptDigestB64u`,`payloadB64u`]),n.kind!==`recipient_proof_bundle`)throw Error(`${t}.kind must be recipient_proof_bundle`);return{kind:`recipient_proof_bundle`,transcriptDigestB64u:R(n.transcriptDigestB64u,`${t}.transcriptDigestB64u`,32),payloadB64u:Ct(n.payloadB64u,`${t}.payloadB64u`)}}function Ft(e){let t=`registrationForwarded`,n=d(e,t);if(j(n,t,[`result`,`response`]),n.result!==`forwarded`)throw Error(`${t}.result must be forwarded`);return{result:`forwarded`,response:Vt(n.response,`${t}.response`)}}function It(e){return Lt(e,Rt)}function Lt(e,t){let n=`explicitExportForwarded`,r=d(e,n);if(j(r,n,[`result`,`response`,`signing_worker_export`]),r.result!==`forwarded`)throw Error(`${n}.result must be forwarded`);return{result:`forwarded`,response:Vt(r.response,`${n}.response`),signing_worker_export:t(r.signing_worker_export)}}function Rt(e){return Bt(e,y)}function zt(e,t,n){let r=d(e,n);j(r,n,[`wallet_id`,`key_handle`,`ecdsa_threshold_key_id`,`signing_root_id`,`signing_root_version`,`activation_epoch`,`signing_worker_id`,`context_binding_b64u`,`threshold_public_key33_b64u`,`export_request_digest_b64u`,`export_authorization_digest_b64u`,`export_nonce`,`authorization_kind`,`authorization_id`,`material_activation`,`lifecycle_id`,`recipient_identity`,`recipient_public_key`,`expires_at_ms`]);let i=t(r.material_activation);if(i.material_owner!==r.wallet_id||i.signing_worker!==r.signing_worker_id)throw Error(`${n}.material_activation is not bound to wallet and worker`);return{wallet_id:M(r.wallet_id,`${n}.wallet_id`),key_handle:M(r.key_handle,`${n}.key_handle`),ecdsa_threshold_key_id:M(r.ecdsa_threshold_key_id,`${n}.ecdsa_threshold_key_id`),signing_root_id:M(r.signing_root_id,`${n}.signing_root_id`),signing_root_version:M(r.signing_root_version,`${n}.signing_root_version`),activation_epoch:N(r.activation_epoch,`${n}.activation_epoch`),signing_worker_id:M(r.signing_worker_id,`${n}.signing_worker_id`),context_binding_b64u:R(r.context_binding_b64u,`${n}.context_binding_b64u`,32),threshold_public_key33_b64u:z(r.threshold_public_key33_b64u,`${n}.threshold_public_key33_b64u`),export_request_digest_b64u:R(r.export_request_digest_b64u,`${n}.export_request_digest_b64u`,32),export_authorization_digest_b64u:R(r.export_authorization_digest_b64u,`${n}.export_authorization_digest_b64u`,32),export_nonce:M(r.export_nonce,`${n}.export_nonce`),authorization_kind:mt(r.authorization_kind,`${n}.authorization_kind`),authorization_id:M(r.authorization_id,`${n}.authorization_id`),material_activation:i,lifecycle_id:M(r.lifecycle_id,`${n}.lifecycle_id`),recipient_identity:M(r.recipient_identity,`${n}.recipient_identity`),recipient_public_key:wt(r.recipient_public_key,`${n}.recipient_public_key`),expires_at_ms:F(r.expires_at_ms,`${n}.expires_at_ms`)}}function Bt(e,t){let n=`signingWorkerExportShare`,r=d(e,n);if(j(r,n,[`version`,`algorithm`,`binding`,`ciphertext_and_tag`]),r.version!==`router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1`)throw Error(`${n}.version is invalid`);if(r.algorithm!==`hpke_x25519_hkdf_sha256_aes256gcm_v1`)throw Error(`${n}.algorithm is invalid`);if(!Array.isArray(r.ciphertext_and_tag)||r.ciphertext_and_tag.length<=48)throw Error(`${n}.ciphertext_and_tag is invalid`);return{version:`router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1`,algorithm:`hpke_x25519_hkdf_sha256_aes256gcm_v1`,binding:zt(r.binding,t,`${n}.binding`),ciphertext_and_tag:r.ciphertext_and_tag.map((e,t)=>St(e,`${n}.ciphertext_and_tag[${t}]`))}}function Vt(e,t){let n=d(e,t);j(n,t,[`bundles`]);let r=`${t}.bundles`,i=d(n.bundles,r);return j(i,r,[`signerA`,`signerB`]),{bundles:{signerA:Pt(i.signerA,`${r}.signerA`),signerB:Pt(i.signerB,`${r}.signerB`)}}}function Ht(e){let t=`registrationActivation.publicFacts`,n=d(e,t);if(j(n,t,[`registrationRequestDigestB64u`,`proofTranscriptDigestB64u`,`contextBinding32B64u`,`derivationClientSharePublicKey33B64u`,`clientShareRetryCounter`,`participantId`]),n.participantId!==1)throw Error(`${t}.participantId must be 1`);return{registrationRequestDigestB64u:R(n.registrationRequestDigestB64u,`${t}.registrationRequestDigestB64u`,32),proofTranscriptDigestB64u:R(n.proofTranscriptDigestB64u,`${t}.proofTranscriptDigestB64u`,32),contextBinding32B64u:R(n.contextBinding32B64u,`${t}.contextBinding32B64u`,32),derivationClientSharePublicKey33B64u:z(n.derivationClientSharePublicKey33B64u,`${t}.derivationClientSharePublicKey33B64u`),clientShareRetryCounter:L(n.clientShareRetryCounter,`${t}.clientShareRetryCounter`),participantId:1}}function Ut(e){let t=`registrationActivationReceipt`,n=d(e,t);j(n,t,[`activation_correlation_id`,`activation_request_digest`,`server_generation`,`ecdsa_activation`,`lifecycle_id`,`transcript_digest`]);let r=`${t}.ecdsa_activation`,i=d(n.ecdsa_activation,r);j(i,r,[`context`,`public_identity`,`signing_worker`,`material_activation`,`activation_epoch`,`activation_digest_b64u`,`activated_at_ms`]);let a=Dt(i.signing_worker,`${r}.signing_worker`),o=y(i.material_activation);if(o.signing_worker!==a.server_id)throw Error(`${r}.material_activation.signing_worker does not match signing_worker`);let s=R(i.activation_digest_b64u,`${r}.activation_digest_b64u`,32),c=V(n.transcript_digest,`${t}.transcript_digest`);return{activation_correlation_id:ue(n.activation_correlation_id),activation_request_digest:V(n.activation_request_digest,`${t}.activation_request_digest`),server_generation:ke(n.server_generation),ecdsa_activation:{context:H(i.context),public_identity:U(i.public_identity),signing_worker:a,material_activation:o,activation_epoch:N(i.activation_epoch,`${r}.activation_epoch`),activation_digest_b64u:s,activated_at_ms:F(i.activated_at_ms,`${r}.activated_at_ms`)},lifecycle_id:M(n.lifecycle_id,`${t}.lifecycle_id`),transcript_digest:c}}function Wt(e){return Ut(e)}function W(e,t){return e.server_id===t.server_id&&e.key_epoch===t.key_epoch&&e.recipient_encryption_key===t.recipient_encryption_key}function Gt(e,t){return e.registrationRequestDigestB64u===t.registrationRequestDigestB64u&&e.proofTranscriptDigestB64u===t.proofTranscriptDigestB64u&&e.contextBinding32B64u===t.contextBinding32B64u&&e.derivationClientSharePublicKey33B64u===t.derivationClientSharePublicKey33B64u&&e.clientShareRetryCounter===t.clientShareRetryCounter&&e.participantId===t.participantId}function Kt(e,t){return e.signer_set_id===t.signer_set_id&&e.policy===t.policy&&e.signer_a.role===t.signer_a.role&&e.signer_a.signer_id===t.signer_a.signer_id&&e.signer_a.key_epoch===t.signer_a.key_epoch&&e.signer_b.role===t.signer_b.role&&e.signer_b.signer_id===t.signer_b.signer_id&&e.signer_b.key_epoch===t.signer_b.key_epoch&&W(e.selected_server,t.selected_server)}function G(e){let t=`ecdsaPublicCapability`,n=d(e,t);if(j(n,t,[`kind`,`context`,`public_identity`,`material_activation`,`signer_set`,`deriver_recipient_keys`,`router_id`,`client_id`,`activation_epoch`,`registration_request_digest_b64u`,`proof_transcript_digest_b64u`]),n.kind!==`router_ab_ecdsa_derivation_public_capability_v1`)throw Error(`${t}.kind is invalid`);let r=kt(n.signer_set,`${t}.signer_set`),i=Mt(n.deriver_recipient_keys,`${t}.deriver_recipient_keys`);if(i.deriver_a.key_epoch!==r.signer_a.key_epoch||i.deriver_b.key_epoch!==r.signer_b.key_epoch)throw Error(`${t} Deriver recipient key epochs do not match signer_set`);return{kind:`router_ab_ecdsa_derivation_public_capability_v1`,context:H(n.context),public_identity:U(n.public_identity),material_activation:y(n.material_activation),signer_set:r,deriver_recipient_keys:i,router_id:M(n.router_id,`${t}.router_id`),client_id:M(n.client_id,`${t}.client_id`),activation_epoch:N(n.activation_epoch,`${t}.activation_epoch`),registration_request_digest_b64u:R(n.registration_request_digest_b64u,`${t}.registration_request_digest_b64u`,32),proof_transcript_digest_b64u:R(n.proof_transcript_digest_b64u,`${t}.proof_transcript_digest_b64u`,32)}}function qt(e){let t=`postRegistrationSessionActivation.session_policy`,n=d(e,t);return j(n,t,[`threshold_session_id`,`wallet_session_mint_id`,`ttl_ms`,`remaining_uses`,`runtime_policy_scope`]),{threshold_session_id:P(n.threshold_session_id,`${t}.threshold_session_id`),wallet_session_mint_id:Yt(n.wallet_session_mint_id,`${t}.wallet_session_mint_id`),ttl_ms:I(n.ttl_ms,`${t}.ttl_ms`),remaining_uses:I(n.remaining_uses,`${t}.remaining_uses`),runtime_policy_scope:te(n.runtime_policy_scope)}}function Jt(e){let t=`postRegistrationSessionActivationPolicy`,n=d(e,t);if(j(n,t,[`kind`,`key_handle`,`session_policy`]),n.kind!==`router_ab_ecdsa_post_registration_session_activation_policy_v1`)throw Error(`${t}.kind is invalid`);return{kind:`router_ab_ecdsa_post_registration_session_activation_policy_v1`,key_handle:M(n.key_handle,`${t}.key_handle`),session_policy:qt(n.session_policy)}}function Yt(e,t){let n=ae(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function K(e,t){return e.context_binding_b64u===t.context_binding_b64u&&e.derivation_client_share_public_key33_b64u===t.derivation_client_share_public_key33_b64u&&e.server_public_key33_b64u===t.server_public_key33_b64u&&e.threshold_public_key33_b64u===t.threshold_public_key33_b64u&&e.ethereum_address20_b64u===t.ethereum_address20_b64u&&e.client_share_retry_counter===t.client_share_retry_counter&&e.server_share_retry_counter===t.server_share_retry_counter}function Xt(e,t){for(let n of e.capabilitySubjects)if(!(n.kind!==`sign`||n.keyFamily!==`ecdsa_secp256k1`))return S(t.material_activation,me(n.materialActivation));return!1}function Zt(e){let t=`postRegistrationSessionActivation`,n=d(e,t);if(j(n,t,[`kind`,`public_capability`,`session_policy`]),n.kind!==`router_ab_ecdsa_post_registration_session_activation_v1`)throw Error(`${t}.kind is invalid`);return{kind:`router_ab_ecdsa_post_registration_session_activation_v1`,public_capability:G(n.public_capability),session_policy:qt(n.session_policy)}}function Qt(e){let t=`postRegistrationSessionActivated`,n=d(e,t);if(j(n,t,[`kind`,`public_capability`,`session`,`normal_signing`]),n.kind!==`router_ab_ecdsa_post_registration_session_activated_v1`)throw Error(`${t}.kind is invalid`);let r=G(n.public_capability),i=d(n.session,`${t}.session`);j(i,`${t}.session`,[`authorization_session_id`,`authorization_id`,`threshold_session_id`,`wallet_session_id`,`quota_id`,`expires_at_ms`,`remaining_uses`,`wallet_session`,`operation_credential`]);let a=jn(n.normal_signing),o=yt(i.authorization_id,`${t}.session.authorization_id`),s=bt(i.wallet_session_id,`${t}.session.wallet_session_id`),c=F(i.expires_at_ms,`${t}.session.expires_at_ms`),l=re(i.wallet_session),u=ne(i.operation_credential);if(!K(r.public_identity,a.scope.public_identity)||r.context.application_binding_digest_b64u!==a.scope.context.application_binding_digest_b64u||a.scope.activation_epoch!==r.activation_epoch||!W(a.scope.signing_worker,r.signer_set.selected_server)||l.authorizationId!==o||l.walletId!==r.client_id||l.expiresAtMs!==c||!Xt(l,r)||u.walletSessionId!==s)throw Error(`${t} exact Wallet Session does not match the activated capability`);return{kind:`router_ab_ecdsa_post_registration_session_activated_v1`,public_capability:r,session:{authorization_session_id:vt(i.authorization_session_id,`${t}.session.authorization_session_id`),authorization_id:o,threshold_session_id:P(i.threshold_session_id,`${t}.session.threshold_session_id`),wallet_session_id:s,quota_id:xt(i.quota_id,`${t}.session.quota_id`),expires_at_ms:c,remaining_uses:I(i.remaining_uses,`${t}.session.remaining_uses`),wallet_session:l,operation_credential:u},normal_signing:a}}function $t(e){let t=`credentialFreeSessionActivated`,n=d(e,t);if(j(n,t,[`kind`,`public_capability`,`session`,`normal_signing`]),n.kind!==`router_ab_ecdsa_credential_free_session_activated_v1`)throw Error(`${t}.kind is invalid`);let r=G(n.public_capability),i=d(n.session,`${t}.session`);j(i,`${t}.session`,[`authorization_session_id`,`authorization_id`,`threshold_session_id`,`wallet_session_id`,`quota_id`,`expires_at_ms`,`remaining_uses`]);let a=jn(n.normal_signing);if(!K(r.public_identity,a.scope.public_identity)||r.context.application_binding_digest_b64u!==a.scope.context.application_binding_digest_b64u||a.scope.activation_epoch!==r.activation_epoch||!W(a.scope.signing_worker,r.signer_set.selected_server))throw Error(`${t} normal-signing state does not match public capability`);return{kind:`router_ab_ecdsa_credential_free_session_activated_v1`,public_capability:r,session:{authorization_session_id:vt(i.authorization_session_id,`${t}.session.authorization_session_id`),authorization_id:yt(i.authorization_id,`${t}.session.authorization_id`),threshold_session_id:P(i.threshold_session_id,`${t}.session.threshold_session_id`),wallet_session_id:bt(i.wallet_session_id,`${t}.session.wallet_session_id`),quota_id:xt(i.quota_id,`${t}.session.quota_id`),expires_at_ms:F(i.expires_at_ms,`${t}.session.expires_at_ms`),remaining_uses:I(i.remaining_uses,`${t}.session.remaining_uses`)},normal_signing:a}}function en(e,t=`signing_digest_b64u`){return{bytes:Array.from(h(R(e,t,32)))}}function q(e,t){return e.bytes.length===32&&t.bytes.length===32&&e.bytes.every((e,n)=>e===t.bytes[n])}function tn(e,t){return e.bytes.length===t.bytes.length&&e.bytes.every((e,n)=>e===t.bytes[n])}function nn(e,t){return e.deriver_a.role===t.deriver_a.role&&e.deriver_a.key_epoch===t.deriver_a.key_epoch&&e.deriver_a.public_key===t.deriver_a.public_key&&e.deriver_b.role===t.deriver_b.role&&e.deriver_b.key_epoch===t.deriver_b.key_epoch&&e.deriver_b.public_key===t.deriver_b.public_key}function rn(e,t){let n=e.ecdsa_activation,r=t.ecdsa_activation;return e.activation_correlation_id===t.activation_correlation_id&&tn(e.activation_request_digest,t.activation_request_digest)&&e.server_generation===t.server_generation&&e.lifecycle_id===t.lifecycle_id&&tn(e.transcript_digest,t.transcript_digest)&&n.context.application_binding_digest_b64u===r.context.application_binding_digest_b64u&&K(n.public_identity,r.public_identity)&&W(n.signing_worker,r.signing_worker)&&S(n.material_activation,r.material_activation)&&n.activation_epoch===r.activation_epoch&&n.activation_digest_b64u===r.activation_digest_b64u&&n.activated_at_ms===r.activated_at_ms}function an(e,t){let n=e.scope,r=t.scope;return e.kind===t.kind&&n.wallet_id===r.wallet_id&&n.ecdsa_threshold_key_id===r.ecdsa_threshold_key_id&&n.signing_root_id===r.signing_root_id&&n.signing_root_version===r.signing_root_version&&n.context.application_binding_digest_b64u===r.context.application_binding_digest_b64u&&K(n.public_identity,r.public_identity)&&S(n.material_activation,r.material_activation)&&W(n.signing_worker,r.signing_worker)&&n.activation_epoch===r.activation_epoch}function on(e,t){return e.kind===t.kind&&e.context.application_binding_digest_b64u===t.context.application_binding_digest_b64u&&K(e.public_identity,t.public_identity)&&S(e.material_activation,t.material_activation)&&Kt(e.signer_set,t.signer_set)&&nn(e.deriver_recipient_keys,t.deriver_recipient_keys)&&e.router_id===t.router_id&&e.client_id===t.client_id&&e.activation_epoch===t.activation_epoch&&e.registration_request_digest_b64u===t.registration_request_digest_b64u&&e.proof_transcript_digest_b64u===t.proof_transcript_digest_b64u}function J(e){return new TextEncoder().encode(M(e,`canonical string`))}function sn(e){let t=e.reduce((e,t)=>e+t.length,0),n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function Y(e,t){for(let n of t)e.push(n)}function cn(e,t){Y(e,h(t.lane_digest_b64u)),Y(e,h(t.intent_digest_b64u)),Y(e,h(t.display_digest_b64u))}function ln(e,t){if(!Number.isInteger(t)||t<0||t>65535)throw Error(`canonical u16 must be an integer between 0 and 65535`);e.push(t>>>8&255,t&255)}function un(e,t){if(!Number.isInteger(t)||t<0||t>4294967295)throw Error(`canonical u32 must be an integer between 0 and 4294967295`);e.push(t>>>24&255,t>>>16&255,t>>>8&255,t&255)}function dn(e,t){if(!Number.isSafeInteger(t)||t<0)throw Error(`canonical u64 must be a non-negative safe integer`);let n=BigInt(t);for(let t=56;t>=0;t-=8)e.push(Number(n>>BigInt(t)&255n))}function X(e,t){un(e,t.length),Y(e,t)}function fn(e,t){let n=J(t);ln(e,n.length),Y(e,n)}function pn(e,t){X(e,J(t.server_id)),X(e,J(t.key_epoch)),X(e,J(t.recipient_encryption_key))}async function mn(e){let t=globalThis.crypto?.subtle;if(!t)throw Error(`crypto.subtle is required for Router A/B ECDSA derivation request digest binding`);let n=new ArrayBuffer(e.byteLength);return new Uint8Array(n).set(e),new Uint8Array(await t.digest(`SHA-256`,n))}async function hn(e){let t=B(e,`clientRerandomizationContribution32`,32);return await mn(sn([J(`router-ab-ecdsa-derivation/client-rerandomization-commitment/v1`),t]))}function gn(e){let t=H(e),n=[];Y(n,J(`router-ab-ecdsa-derivation/context/v1`)),fn(n,`router-ab-ecdsa-derivation-v1`),fn(n,`secp256k1`),Y(n,h(t.application_binding_digest_b64u)),n.push(pt.length);for(let e of pt)ln(n,e);return new Uint8Array(n)}function _n(e){let t=[];return Y(t,J(`router-ab-ecdsa-derivation/role-local/context-binding/v1`)),t.push(1),t.push(1),ln(t,e.length),Y(t,e),new Uint8Array(t)}async function vn(e){return wn(_n(gn(e)))}function yn(e){let t=U(e),n=[];return X(n,J(`router-ab-ecdsa-derivation/public-identity/v1`)),X(n,J(t.context_binding_b64u)),X(n,J(t.derivation_client_share_public_key33_b64u)),X(n,J(t.server_public_key33_b64u)),X(n,J(t.threshold_public_key33_b64u)),X(n,J(t.ethereum_address20_b64u)),un(n,t.client_share_retry_counter),un(n,t.server_share_retry_counter),new Uint8Array(n)}function bn(e){let t=Z(e),n=[];return X(n,J(`router-ab-ecdsa-derivation/normal-signing-scope/v1`)),X(n,J(t.wallet_id)),X(n,J(t.ecdsa_threshold_key_id)),X(n,J(t.signing_root_id)),X(n,J(t.signing_root_version)),X(n,gn(t.context)),X(n,yn(t.public_identity)),n.push(...x(t.material_activation)),pn(n,t.signing_worker),X(n,J(t.activation_epoch)),new Uint8Array(n)}function xn(e){return bn(e)}function Sn(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function Cn(e,t){try{return Sn(xn(e),xn(t))}catch{return!1}}async function wn(e){return{bytes:Array.from(await mn(e))}}async function Tn(e){let t=Z(e),n=await vn(t.context);if(!q(en(t.public_identity.context_binding_b64u,`scope.public_identity.context_binding_b64u`),n))throw Error(`scope.public_identity.context_binding_b64u does not match scope.context`);return t}function En(e){let t=Q(e),n=[];return X(n,J(`router-ab-ecdsa-derivation/normal-signing-request/v1`)),X(n,bn(t.scope)),X(n,J(t.request_id)),X(n,J(t.operation_id)),cn(n,t.operation_digests),n.push(..._e(t.authorization)),n.push(...x(t.material_activation)),X(n,J(t.client_presignature_id)),dn(n,t.expires_at_ms),Y(n,h(t.signing_digest_b64u)),X(n,h(t.client_rerandomization_commitment32_b64u)),new Uint8Array(n)}async function Dn(e){let t=Q(e);return await Tn(t.scope),wn(En(t))}function On(e){let t=$(e),n=[];return X(n,J(`router-ab-ecdsa-derivation/normal-signing-finalize-request/v1`)),X(n,bn(t.scope)),X(n,J(t.request_id)),X(n,J(t.operation_id)),cn(n,t.operation_digests),n.push(..._e(t.authorization)),n.push(...x(t.material_activation)),dn(n,t.expires_at_ms),Y(n,h(t.signing_digest_b64u)),X(n,J(t.server_presignature_id)),X(n,h(t.client_signature_share32_b64u)),X(n,h(t.client_rerandomization_contribution32_b64u)),new Uint8Array(n)}async function kn(e){let t=$(e);return await Tn(t.scope),wn(On(t))}function Z(e){let t=d(e,`scope`);return j(t,`scope`,[`wallet_id`,`ecdsa_threshold_key_id`,`signing_root_id`,`signing_root_version`,`context`,`public_identity`,`material_activation`,`signing_worker`,`activation_epoch`]),{wallet_id:M(t.wallet_id,`scope.wallet_id`),ecdsa_threshold_key_id:M(t.ecdsa_threshold_key_id,`scope.ecdsa_threshold_key_id`),signing_root_id:M(t.signing_root_id,`scope.signing_root_id`),signing_root_version:M(t.signing_root_version,`scope.signing_root_version`),context:H(t.context),public_identity:U(t.public_identity),material_activation:y(t.material_activation),signing_worker:Et(t.signing_worker),activation_epoch:N(t.activation_epoch,`scope.activation_epoch`)}}function An(e){if(e==null)return null;let t=d(e,`routerAbEcdsaDerivationNormalSigning`);if(j(t,`routerAbEcdsaDerivationNormalSigning`,[`kind`,`scope`]),M(t.kind,`routerAbEcdsaDerivationNormalSigning.kind`)!==`router_ab_ecdsa_derivation_normal_signing_v1`)throw Error(`routerAbEcdsaDerivationNormalSigning.kind is not supported`);return{kind:`router_ab_ecdsa_derivation_normal_signing_v1`,scope:Z(t.scope)}}function jn(e){let t=An(e);if(!t)throw Error(`Router A/B ECDSA derivation normal-signing state is required`);return t}function Mn(e){let t=u([M(e.ecdsaThresholdKeyId,`ecdsaThresholdKeyId`),M(e.signingRootId,`signingRootId`),M(e.signingRootVersion,`signingRootVersion`),N(e.activationEpoch,`activationEpoch`)].join(`:`));if(!t.ok)throw Error(`activeStateId ${t.error.message}`);return t.value}function Nn(e){return Mn({ecdsaThresholdKeyId:e.scope.ecdsa_threshold_key_id,signingRootId:e.scope.signing_root_id,signingRootVersion:e.scope.signing_root_version,activationEpoch:e.scope.activation_epoch})}function Pn(e,t){let n=d(e,t);return j(n,t,[`lane_digest_b64u`,`intent_digest_b64u`,`display_digest_b64u`]),{lane_digest_b64u:R(n.lane_digest_b64u,`${t}.lane_digest_b64u`,32),intent_digest_b64u:R(n.intent_digest_b64u,`${t}.intent_digest_b64u`,32),display_digest_b64u:R(n.display_digest_b64u,`${t}.display_digest_b64u`,32)}}function Fn(e){return Q({scope:e.scope,request_id:e.requestId,operation_id:e.operationId,operation_digests:e.operationDigests,authorization:e.authorization,material_activation:e.materialActivation,client_presignature_id:e.clientPresignatureId,expires_at_ms:e.expiresAtMs,signing_digest_b64u:m(B(e.signingDigest32,`signingDigest32`,32)),client_rerandomization_commitment32_b64u:m(B(e.clientRerandomizationCommitment32,`clientRerandomizationCommitment32`,32))})}function Q(e){let t=d(e,`ecdsaSigningRequest`);j(t,`ecdsaSigningRequest`,[`scope`,`request_id`,`operation_id`,`operation_digests`,`authorization`,`material_activation`,`client_presignature_id`,`expires_at_ms`,`signing_digest_b64u`,`client_rerandomization_commitment32_b64u`]);let n={scope:Z(t.scope),request_id:M(t.request_id,`ecdsaSigningRequest.request_id`),operation_id:M(t.operation_id,`ecdsaSigningRequest.operation_id`),operation_digests:Pn(t.operation_digests,`ecdsaSigningRequest.operation_digests`),authorization:v(t.authorization),material_activation:y(t.material_activation),client_presignature_id:M(t.client_presignature_id,`ecdsaSigningRequest.client_presignature_id`),expires_at_ms:F(t.expires_at_ms,`ecdsaSigningRequest.expires_at_ms`),signing_digest_b64u:R(t.signing_digest_b64u,`ecdsaSigningRequest.signing_digest_b64u`,32),client_rerandomization_commitment32_b64u:R(t.client_rerandomization_commitment32_b64u,`ecdsaSigningRequest.client_rerandomization_commitment32_b64u`,32)};if(n.operation_digests.intent_digest_b64u!==n.signing_digest_b64u)throw Error(`ecdsaSigningRequest intent digest must equal the admitted signing digest`);return n}function In(e){let t=d(e,`webauthn_authentication`);j(t,`webauthn_authentication`,[`id`,`rawId`,`type`,`authenticatorAttachment`,`response`,`clientExtensionResults`]);let n=d(t.response,`webauthn_authentication.response`);if(j(n,`webauthn_authentication.response`,[`clientDataJSON`,`authenticatorData`,`signature`,`userHandle`]),t.clientExtensionResults!==null)throw Error(`webauthn_authentication.clientExtensionResults must be redacted`);let r=t.authenticatorAttachment===null?null:M(t.authenticatorAttachment,`webauthn_authentication.authenticatorAttachment`),i=n.userHandle===null?null:M(n.userHandle,`webauthn_authentication.response.userHandle`);return{id:M(t.id,`webauthn_authentication.id`),rawId:M(t.rawId,`webauthn_authentication.rawId`),type:M(t.type,`webauthn_authentication.type`),authenticatorAttachment:r,response:{clientDataJSON:M(n.clientDataJSON,`webauthn_authentication.response.clientDataJSON`),authenticatorData:M(n.authenticatorData,`webauthn_authentication.response.authenticatorData`),signature:M(n.signature,`webauthn_authentication.response.signature`),userHandle:i},clientExtensionResults:null}}function Ln(e){let t=d(e,`operationStepUpAuthorizationRequest`);if(j(t,`operationStepUpAuthorizationRequest`,[`kind`,`operation`,`proof`]),t.kind!==`router_ab_ecdsa_operation_step_up_v1`)throw Error(`operationStepUpAuthorizationRequest.kind must be router_ab_ecdsa_operation_step_up_v1`);let n=Rn(t.operation),r=d(t.proof,`operationStepUpAuthorizationRequest.proof`),i=et(r.authority),a;switch(r.kind){case`passkey`:if(j(r,`operationStepUpAuthorizationRequest.proof`,[`kind`,`authority`,`webauthn_authentication`]),!i||!O(i))throw Error(`operationStepUpAuthorizationRequest.proof requires an exact passkey authority`);a={kind:`passkey`,authority:i,webauthn_authentication:In(r.webauthn_authentication)};break;case`email_otp`:if(j(r,`operationStepUpAuthorizationRequest.proof`,[`kind`,`authority`,`challenge_id`,`otp_code`]),!i||!k(i))throw Error(`operationStepUpAuthorizationRequest.proof requires an exact Email OTP authority`);a={kind:`email_otp`,authority:i,challenge_id:M(r.challenge_id,`operationStepUpAuthorizationRequest.proof.challenge_id`),otp_code:M(r.otp_code,`operationStepUpAuthorizationRequest.proof.otp_code`)};break;default:throw Error(`operationStepUpAuthorizationRequest.proof.kind is invalid`)}return{kind:`router_ab_ecdsa_operation_step_up_v1`,operation:n,proof:a}}function Rn(e){let t=d(e,`ecdsaOperationStepUpPreparation`);if(j(t,`operationStepUpGrantRequest.operation`,[`wallet_id`,`operation_kind`,`operation_id`,`operation_digests`,`material_activation`,`normal_signing_scope`,`signing_worker_id`,`key_handle`,`relayer_key_id`,`participant_ids`,`expires_at_ms`]),!Array.isArray(t.participant_ids)||t.participant_ids.length!==2||!t.participant_ids.every(e=>Number.isSafeInteger(e)&&e>0))throw Error(`operationStepUpGrantRequest.operation.participant_ids must contain two positive integers`);return{wallet_id:M(t.wallet_id,`operationStepUpGrantRequest.operation.wallet_id`),operation_kind:zn(t.operation_kind),operation_id:M(t.operation_id,`operationStepUpGrantRequest.operation.operation_id`),operation_digests:Pn(t.operation_digests,`operationStepUpGrantRequest.operation.operation_digests`),material_activation:y(t.material_activation),normal_signing_scope:Z(t.normal_signing_scope),signing_worker_id:M(t.signing_worker_id,`operationStepUpGrantRequest.operation.signing_worker_id`),key_handle:M(t.key_handle,`operationStepUpGrantRequest.operation.key_handle`),relayer_key_id:M(t.relayer_key_id,`operationStepUpGrantRequest.operation.relayer_key_id`),participant_ids:[Number(t.participant_ids[0]),Number(t.participant_ids[1])],expires_at_ms:F(t.expires_at_ms,`operationStepUpGrantRequest.operation.expires_at_ms`)}}function zn(e){switch(e){case ce.signTransaction:case ce.exportKey:return e;default:throw Error(`operationStepUpGrantRequest.operation.operation_kind must be evm.sign_transaction or evm.export_key`)}}function Bn(e){return $({scope:e.scope,request_id:e.requestId,operation_id:e.operationId,operation_digests:e.operationDigests,authorization:e.authorization,material_activation:e.materialActivation,expires_at_ms:e.expiresAtMs,signing_digest_b64u:m(B(e.signingDigest32,`signingDigest32`,32)),server_presignature_id:e.serverPresignatureId,client_signature_share32_b64u:m(B(e.clientSignatureShare32,`clientSignatureShare32`,32)),client_rerandomization_contribution32_b64u:m(B(e.clientRerandomizationContribution32,`clientRerandomizationContribution32`,32))})}function $(e){let t=d(e,`ecdsaFinalizeCoreRequest`);return j(t,`ecdsaFinalizeCoreRequest`,[`scope`,`request_id`,`operation_id`,`operation_digests`,`authorization`,`material_activation`,`expires_at_ms`,`signing_digest_b64u`,`server_presignature_id`,`client_signature_share32_b64u`,`client_rerandomization_contribution32_b64u`]),Vn(t)}function Vn(e){let t={scope:Z(e.scope),request_id:M(e.request_id,`ecdsaFinalizeRequest.request_id`),operation_id:M(e.operation_id,`ecdsaFinalizeRequest.operation_id`),operation_digests:Pn(e.operation_digests,`ecdsaFinalizeRequest.operation_digests`),authorization:v(e.authorization),material_activation:y(e.material_activation),expires_at_ms:F(e.expires_at_ms,`ecdsaFinalizeRequest.expires_at_ms`),signing_digest_b64u:R(e.signing_digest_b64u,`ecdsaFinalizeRequest.signing_digest_b64u`,32),server_presignature_id:M(e.server_presignature_id,`ecdsaFinalizeRequest.server_presignature_id`),client_signature_share32_b64u:R(e.client_signature_share32_b64u,`ecdsaFinalizeRequest.client_signature_share32_b64u`,32),client_rerandomization_contribution32_b64u:R(e.client_rerandomization_contribution32_b64u,`ecdsaFinalizeRequest.client_rerandomization_contribution32_b64u`,32)};if(t.operation_digests.intent_digest_b64u!==t.signing_digest_b64u)throw Error(`ecdsaFinalizeRequest intent digest must equal the admitted signing digest`);return t}function Hn(e){let t=d(e,`ecdsaPrepareResponse`);return j(t,`ecdsaPrepareResponse`,[`scope`,`request_id`,`request_digest`,`signing_digest`,`server_presignature_id`,`server_big_r33_b64u`,`signing_worker_rerandomization_contribution32_b64u`,`signature_scheme`,`prepared_at_ms`,`expires_at_ms`]),{scope:Z(t.scope),request_id:M(t.request_id,`ecdsaPrepareResponse.request_id`),request_digest:V(t.request_digest,`ecdsaPrepareResponse.request_digest`),signing_digest:V(t.signing_digest,`ecdsaPrepareResponse.signing_digest`),server_presignature_id:M(t.server_presignature_id,`ecdsaPrepareResponse.server_presignature_id`),server_big_r33_b64u:R(t.server_big_r33_b64u,`ecdsaPrepareResponse.server_big_r33_b64u`,33),signing_worker_rerandomization_contribution32_b64u:R(t.signing_worker_rerandomization_contribution32_b64u,`ecdsaPrepareResponse.signing_worker_rerandomization_contribution32_b64u`,32),signature_scheme:Tt(t.signature_scheme,`ecdsaPrepareResponse.signature_scheme`),prepared_at_ms:F(t.prepared_at_ms,`ecdsaPrepareResponse.prepared_at_ms`),expires_at_ms:F(t.expires_at_ms,`ecdsaPrepareResponse.expires_at_ms`)}}async function Un(e,t){let n=Q(e),r=Hn(t);if(!Cn(r.scope,n.scope))throw Error(`ecdsaPrepareResponse.scope does not match request`);if(r.request_id!==n.request_id)throw Error(`ecdsaPrepareResponse.request_id does not match request`);if(r.server_presignature_id!==n.client_presignature_id)throw Error(`ecdsaPrepareResponse.server_presignature_id does not match request`);if(!q(r.signing_digest,en(n.signing_digest_b64u)))throw Error(`ecdsaPrepareResponse.signing_digest does not match request`);if(r.expires_at_ms!==n.expires_at_ms)throw Error(`ecdsaPrepareResponse.expires_at_ms does not match request`);if(!q(r.request_digest,await Dn(n)))throw Error(`ecdsaPrepareResponse.request_digest does not match request`);return r}function Wn(e){let t=d(e,`ecdsaSigningResponse`);return j(t,`ecdsaSigningResponse`,[`scope`,`request_id`,`request_digest`,`signing_digest`,`signature_scheme`,`signature65_b64u`]),{scope:Z(t.scope),request_id:M(t.request_id,`ecdsaSigningResponse.request_id`),request_digest:V(t.request_digest,`ecdsaSigningResponse.request_digest`),signing_digest:V(t.signing_digest,`ecdsaSigningResponse.signing_digest`),signature_scheme:Tt(t.signature_scheme,`ecdsaSigningResponse.signature_scheme`),signature65_b64u:R(t.signature65_b64u,`ecdsaSigningResponse.signature65_b64u`,65)}}async function Gn(e,t){let n=$(e),r=Wn(t);if(!Cn(r.scope,n.scope))throw Error(`ecdsaSigningResponse.scope does not match request`);if(r.request_id!==n.request_id)throw Error(`ecdsaSigningResponse.request_id does not match request`);if(!q(r.signing_digest,en(n.signing_digest_b64u)))throw Error(`ecdsaSigningResponse.signing_digest does not match request`);if(!q(r.request_digest,await kn(n)))throw Error(`ecdsaSigningResponse.request_digest does not match request`);return r}const Kn=new TextEncoder;function qn(e){let t=0;for(let n of e)t+=n.length;let n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function Jn(e,t){if(!Number.isSafeInteger(e)||e<0||e>4294967295)throw Error(`${t} must be a non-negative u32`);return Uint8Array.from([e>>>24&255,e>>>16&255,e>>>8&255,e&255])}function Yn(e,t){if(!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);let n=BigInt(e),r=new Uint8Array(8);for(let e=7;e>=0;--e)r[e]=Number(n&255n),n>>=8n;return r}function Xn(e,t){return qn([Jn(e.length,`${t}.length`),e])}function Zn(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);return Xn(Kn.encode(e),t)}function Qn(e,t){try{let t=h(de(e));if(t.length!==32)throw Error(`must decode to 32 bytes`);return t}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}function $n(e,t){try{let t=h(e);if(t.length===0||m(t)!==e)throw Error(`must be canonical base64url`);return t}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}export{Ze as $,Ut as A,x as At,hn as B,It as C,De as Ct,Jt as D,we as Dt,Rn as E,Ee as Et,jn as F,S as Ft,on as G,Kt as H,Nn as I,fe as It,Gt as J,K,kn as L,Nt as M,v as Mt,Ft as N,he as Nt,Zt as O,Se as Ot,Ht as P,me as Pt,Be as Q,Dn as R,G as S,Oe as St,gt as T,Te as Tt,Cn as U,nn as V,an as W,Je as X,W as Y,Ke as Z,$t as _,Le as _t,Zn as a,nt as at,Z as b,Ne as bt,ct as c,He as ct,ut as d,ze as dt,Ye as et,dt as f,Pe as ft,_t as g,Me as gt,Fn as h,Re as ht,$n as i,D as it,Wt as j,y as jt,Qt as k,xe as kt,ft as l,Ve as lt,Bn as m,je as mt,Xn as n,k as nt,Jn as o,rt as ot,st as p,Ae as pt,rn as q,Qn as r,O as rt,Yn as s,et as st,qn as t,Xe as tt,lt as u,ot as ut,Un as v,Fe as vt,Ln as w,Ce as wt,An as x,ke as xt,Gn as y,Ie as yt,xn as z};
+import{A as e,D as t,E as n,M as r,N as i,S as a,b as o,c as s,g as c,k as l,o as u}from"./domainIds-t1lp25yU.js";import{S as d,c as ee,r as f,t as p}from"./digests-BIaE0DMd.js";import{i as m,r as h}from"./base64-BmKR3UqU.js";import{J as g,X as te,i as ne,n as re}from"./activeWalletSession-HAOgRKzn.js";import{d as ie,g as ae,h as oe,m as se,n as ce,u as le}from"./capabilityKinds-Cafn86Y1.js";import{n as ue,r as de}from"./canonicalPrimitives-DKeS3M40.js";function fe(e,t){let n=ee(e,t);if(!/^x25519:[0-9a-f]{64}$/.test(n))throw Error(`${t} must use x25519:<64 lowercase hex chars> encoding`);return n}function pe(e,t,n){let r=Object.keys(e).sort(),i=[...t].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${n} has invalid fields`)}function _(e,t){if(typeof e!=`string`||e.trim()!==e||!e)throw Error(`${t} is required`);if(!/^[\x20-\x7e]+$/.test(e))throw Error(`${t} must be printable ASCII`);return e}function v(e){let t=d(e,`authorization`);switch(t.kind){case`reusable_wallet_session`:return pe(t,[`kind`,`wallet_session_id`],`authorization`),{kind:`reusable_wallet_session`,wallet_session_id:_(t.wallet_session_id,`authorization.wallet_session_id`)};case`operation_step_up`:return pe(t,[`kind`],`authorization`),{kind:`operation_step_up`};default:throw Error(`authorization.kind is not supported`)}}function y(e){let t=d(e,`material_activation`);if(pe(t,[`kind`,`activation_id`,`capability`,`material_owner`,`key_binding`,`lifecycle_binding`,`signing_worker`],`material_activation`),t.kind!==`mpc_material_activation_ref`)throw Error(`material_activation.kind is not supported`);return{kind:`mpc_material_activation_ref`,activation_id:_(t.activation_id,`material_activation.activation_id`),capability:_(t.capability,`material_activation.capability`),material_owner:_(t.material_owner,`material_activation.material_owner`),key_binding:_(t.key_binding,`material_activation.key_binding`),lifecycle_binding:_(t.lifecycle_binding,`material_activation.lifecycle_binding`),signing_worker:_(t.signing_worker,`material_activation.signing_worker`)}}function me(e){return y({kind:e.kind,activation_id:e.activationId,capability:e.capability,material_owner:e.materialOwner,key_binding:e.keyBinding,lifecycle_binding:e.lifecycleBinding,signing_worker:e.signingWorker})}function he(e){let t=y(e),n=c({kind:t.kind,activationId:t.activation_id,capability:t.capability,materialOwner:t.material_owner,keyBinding:t.key_binding,lifecycleBinding:t.lifecycle_binding,signingWorker:t.signing_worker});if(!n.ok)throw Error(`material_activation is invalid: ${n.error.message}`);return n.value}function ge(e){return new TextEncoder().encode(e)}function b(e,t){let n=ge(t),r=n.length>>>0;e.push(r>>>24&255,r>>>16&255,r>>>8&255,r&255),e.push(...n)}function _e(e){let t=v(e),n=[];switch(b(n,t.kind),t.kind){case`reusable_wallet_session`:b(n,t.wallet_session_id);break;case`operation_step_up`:break}return new Uint8Array(n)}function x(e){let t=y(e),n=[];return b(n,t.kind),b(n,t.activation_id),b(n,t.capability),b(n,t.material_owner),b(n,t.key_binding),b(n,t.lifecycle_binding),b(n,t.signing_worker),new Uint8Array(n)}function S(e,t){return e.kind===t.kind&&e.activation_id===t.activation_id&&e.capability===t.capability&&e.material_owner===t.material_owner&&e.key_binding===t.key_binding&&e.lifecycle_binding===t.lifecycle_binding&&e.signing_worker===t.signing_worker}function ve(e,t){if(typeof e!=`string`)throw Error(`EVM-family signing key slot id requires ${t}`);let n=e.trim();if(!n)throw Error(`EVM-family signing key slot id requires ${t}`);return n}function C(e){return encodeURIComponent(ve(e,`non-empty components`))}function ye(e){let t=e.split(`:`);return t.length===5&&t[0]===`wallet-key`&&t[1]===`evm-family`&&t.slice(2).every(e=>e.length>0)}function be(t){let n=e(t);return n.ok?ye(String(n.value))?{ok:!0,value:String(n.value)}:{ok:!1,error:{code:`invalid`,message:`EVM-family signing key slot id must be wallet-key:evm-family:<walletId>:<signingRootId>:<signingRootVersion>`}}:n}function xe(e,t=`evmFamilySigningKeySlotId`){let n=be(e);if(n.ok)return n.value;throw n.error.code===`missing`?Error(`${t} is required`):Error(`${t} must be an EVM-family signing key slot id`)}function Se(e){return xe([`wallet-key`,`evm-family`,C(e.walletId),C(e.signingRootId),C(e.signingRootVersion)].join(`:`))}function Ce(e){let t=e.trim(),n=h(t);if(n.length!==33||m(n)!==t)throw Error(`ECDSA client root public key must be canonical base64url for 33 bytes`);return t}function w(e,t){let n=String(e??``).trim();if(!n)throw Error(`${t} is required`);return n}function we(e){return w(e,`ecdsaThresholdKeyId`)}function Te(e){return w(e,`signingRootId`)}function Ee(e){return w(e,`signingRootVersion`)}async function De(e){let t=Se(e);return`ederivation-relayer-${m(await f(p({version:`threshold_ecdsa_derivation_relayer_key_id_v1`,schemeId:`threshold-secp256k1-ecdsa-2p-v1`,walletId:e.walletId,evmFamilySigningKeySlotId:t})))}`}function T(e,t){if(typeof e!=`string`||e.trim()!==e||e.length===0)throw Error(`${t} must be a non-empty canonical string`);return e}function E(e,t,n){if(typeof e!=`string`||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be unpadded base64url`);let r;try{r=h(e)}catch{throw Error(`${t} must be valid base64url`)}if(r.length===0||n!==null&&r.length!==n||m(r)!==e)throw Error(`${t} has an invalid canonical byte length`);return e}function Oe(e){return T(e,`ECDSA signer id`)}function ke(e){return T(e,`ECDSA server generation`)}function Ae(e){return T(e,`ECDSA manifest id`)}function je(e){if(!Number.isSafeInteger(e)||Number(e)<1)throw Error(`ECDSA manifest revision must be a positive safe integer`);return e}function Me(e){return E(e,`ECDSA ciphertext digest`,32)}function Ne(e){return E(e,`ECDSA pending ciphertext digest`,32)}function Pe(e){return E(e,`ECDSA activation digest`,32)}function Fe(e){return T(e,`ECDSA lifecycle id`)}function Ie(e){return T(e,`ECDSA material sealing key id`)}function Le(e){return E(e,`ECDSA AES-GCM IV`,12)}function Re(e){return E(e,`ECDSA ciphertext`,null)}function ze(e){if(typeof e!=`string`||e.trim()!==e)throw Error(`ECDSA server activation request must be canonical JSON`);let t;try{t=JSON.parse(e)}catch{throw Error(`ECDSA server activation request must be canonical JSON`)}if(typeof t!=`object`||!t||Array.isArray(t)||p(t)!==e)throw Error(`ECDSA server activation request must be a canonical JSON object`);return e}function Be(e){return{walletId:e.walletId,bindingId:e.walletAuthMethodId,factor:{kind:`voiceid`,deviceKeyId:e.deviceKeyId},verifier:{kind:`device_signature`}}}function D(e){return e.factor.kind===`voiceid`}function O(e){return e.factor.kind===`passkey`}function k(e){return e.factor.kind===`email_otp`}function Ve(e,t){return e.walletId!==t.walletId||e.bindingId!==t.bindingId?!1:O(e)?O(t)?e.factor.credentialIdB64u===t.factor.credentialIdB64u&&e.verifier.rpId===t.verifier.rpId:!1:k(e)?k(t)?e.factor.provider===t.factor.provider&&e.factor.providerUserId===t.factor.providerUserId&&e.verifier.emailHashHex===t.verifier.emailHashHex:!1:D(e)?D(t)&&e.factor.deviceKeyId===t.factor.deviceKeyId:!1}function He(e){if(!e||typeof e!=`object`||Array.isArray(e))return null;let r=e,i=Object.keys(r);if(i.length!==4||!i.every(e=>[`kind`,`walletId`,`authorityDigest`,`walletAuthMethodId`].includes(e))||r.kind!==`wallet_auth_authority_ref`)return null;let a=l(r.walletId),o=t(r.authorityDigest),s=n(r.walletAuthMethodId);return!a.ok||!o.ok||!s.ok?null:{kind:`wallet_auth_authority_ref`,walletId:a.value,authorityDigest:o.value,walletAuthMethodId:s.value}}function Ue(e){let t=String(e||``).trim().toLowerCase();return t===`google`||t===`email`?t:null}function A(e,t){if(e.ok)return e.value;throw Error(t)}function We(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function Ge(e,t){for(let n of t)if(We(e,n))return!0;return!1}function Ke(e){let t=A(l(e.walletId),`Passkey wallet auth authority requires walletId`),a=A(i(e.rpId),`Passkey wallet auth authority requires rpId`),o=A(r(e.credentialIdB64u),`Passkey wallet auth authority requires credentialIdB64u`),s=A(n(`passkey:${a}:${o}`),`Passkey wallet auth authority requires bindingId`);return{walletId:t,factor:{kind:`passkey`,credentialIdB64u:o},verifier:{kind:`webauthn`,rpId:a},bindingId:s}}function qe(e){let t=Ue(e.provider);if(!t)throw Error(`Email OTP factor identity requires provider`);return{kind:`email_otp`,provider:t,providerUserId:A(s(e.providerUserId),`Email OTP factor identity requires providerUserId`)}}function Je(e){let t=A(l(e.walletId),`Email OTP wallet auth authority requires walletId`),r=qe(e),i=String(e.emailHashHex||``).trim();if(!i)throw Error(`Email OTP wallet auth authority requires emailHashHex`);let a=A(n(`email_otp:${t}:${i}`),`Email OTP wallet auth authority requires bindingId`);return{walletId:t,factor:r,verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:i},bindingId:a}}function Ye(e){return e.factor.provider}function Xe(e){return e.factor.providerUserId}function Ze(e){return e.verifier.emailHashHex}function Qe(e){let t=e.factor;if(!t||typeof t!=`object`||Array.isArray(t))return null;let a=e.verifier;if(!a||typeof a!=`object`||Array.isArray(a))return null;let o=t,s=a,c=String(o.kind||``).trim().toLowerCase(),u=String(s.kind||``).trim().toLowerCase();if(c!==`passkey`||u!==`webauthn`)return null;try{if(Ge(e,[`kind`,`rpId`,`credentialIdB64u`,`provider`,`providerUserId`]))return null;let t=l(e.walletId),a=i(s.rpId),c=r(o.credentialIdB64u),u=n(e.bindingId);return!t.ok||!a.ok||!c.ok||!u.ok?null:{walletId:t.value,factor:{kind:`passkey`,credentialIdB64u:c.value},verifier:{kind:`webauthn`,rpId:a.value},bindingId:u.value}}catch{return null}}function $e(e){let t=e.factor;if(!t||typeof t!=`object`||Array.isArray(t))return null;let r=e.verifier;if(!r||typeof r!=`object`||Array.isArray(r))return null;let i=t,a=r,o=String(i.kind||``).trim().toLowerCase(),c=String(a.kind||``).trim().toLowerCase();if(o!==`email_otp`||c!==`email_otp_wallet_auth_method`)return null;try{if(Ge(e,[`kind`,`rpId`,`credentialIdB64u`,`provider`,`providerUserId`]))return null;let t=l(e.walletId),r=Ue(i.provider),o=s(i.providerUserId),c=String(a.emailHashHex||``).trim(),u=n(e.bindingId);return!t.ok||!r||!o.ok||!c||!u.ok?null:{walletId:t.value,factor:{kind:`email_otp`,provider:r,providerUserId:o.value},verifier:{kind:`email_otp_wallet_auth_method`,emailHashHex:c},bindingId:u.value}}catch{return null}}function et(e){if(!e||typeof e!=`object`||Array.isArray(e))return null;let t=e;return Qe(t)||$e(t)||tt(t)}function tt(e){try{let t=d(e,`device authority`);g(t,[`walletId`,`bindingId`,`factor`,`verifier`],`device authority`);let r=d(t.factor,`device factor`),i=d(t.verifier,`device verifier`);if(g(r,[`kind`,`deviceKeyId`],`device factor`),g(i,[`kind`],`device verifier`),r.kind!==`voiceid`||i.kind!==`device_signature`)return null;let a=l(t.walletId),o=n(t.bindingId);return!a.ok||!o.ok?null:Be({walletId:a.value,walletAuthMethodId:o.value,deviceKeyId:de(r.deviceKeyId)})}catch{return null}}function nt(e){return!e||typeof e!=`object`||Array.isArray(e)?null:$e(e)}function rt(e){return!e||typeof e!=`object`||Array.isArray(e)?null:Qe(e)}function it(e){return`seams:wallet-authority-binding:v1|${p(e.authority)}`}async function at(e){return A(t(m(await f(it(e)))),`Wallet authority binding digest must be non-empty`)}async function ot(e){return{kind:`wallet_auth_authority_ref`,walletId:e.authority.walletId,authorityDigest:await at({authority:e.authority}),walletAuthMethodId:e.authority.bindingId}}const st=5*6e4,ct=`/router-ab/ecdsa-derivation/export`,lt=`/router-ab/ecdsa-derivation/presignature-pool/fill/init`,ut=`/router-ab/ecdsa-derivation/presignature-pool/fill/step`,dt=`/router-ab/ecdsa-derivation/session/activate`,ft=`/router-ab/ecdsa-derivation/operation-step-up`,pt=[1,2];function mt(e,t){if(e===`reusable_wallet_session`||e===`verified_step_up`)return e;throw Error(`${t} must be reusable_wallet_session or verified_step_up`)}function ht(e){let t=d(e,`operationStepUpAuthorizationResponse.export_topology`);j(t,`operationStepUpAuthorizationResponse.export_topology`,[`signer_set`,`deriver_recipient_keys`,`router_id`]);let n=kt(t.signer_set,`operationStepUpAuthorizationResponse.export_topology.signer_set`),r=Mt(t.deriver_recipient_keys,`operationStepUpAuthorizationResponse.export_topology.deriver_recipient_keys`);if(r.deriver_a.key_epoch!==n.signer_a.key_epoch||r.deriver_b.key_epoch!==n.signer_b.key_epoch)throw Error(`operationStepUpAuthorizationResponse.export_topology recipient key epochs do not match signer_set`);return{signer_set:n,deriver_recipient_keys:r,router_id:M(t.router_id,`operationStepUpAuthorizationResponse.export_topology.router_id`)}}function gt(e){let t=d(e,`operationStepUpAuthorizationResponse`),n=zn(t.operation_kind);if(j(t,`operationStepUpAuthorizationResponse`,[`ok`,`kind`,`authorization`,`expires_at_ms`,`operation_kind`,...n===`evm.export_key`?[`export_topology`]:[]]),t.ok!==!0||t.kind!==`verified_step_up`)throw Error(`operationStepUpAuthorizationResponse is invalid`);let r=d(t.authorization,`operationStepUpAuthorizationResponse.authorization`);if(j(r,`operationStepUpAuthorizationResponse.authorization`,[`kind`,`evidence_set_digest`,`unseal`]),r.kind!==`operation_step_up`)throw Error(`operationStepUpAuthorizationResponse.authorization.kind is invalid`);let i=F(t.expires_at_ms,`operationStepUpAuthorizationResponse.expires_at_ms`);if(i<=Date.now())throw Error(`operationStepUpAuthorizationResponse.expires_at_ms is expired`);let a=d(r.unseal,`operationStepUpAuthorizationResponse.authorization.unseal`),o=M(a.kind,`operationStepUpAuthorizationResponse.authorization.unseal.kind`),s;switch(o){case`not_requested`:j(a,`operationStepUpAuthorizationResponse.authorization.unseal`,[`kind`]),s={kind:`not_requested`};break;case`email_otp_grant`:j(a,`operationStepUpAuthorizationResponse.authorization.unseal`,[`kind`,`grant`,`challenge_id`]),s={kind:`email_otp_grant`,grant:M(a.grant,`operationStepUpAuthorizationResponse.authorization.unseal.grant`),challenge_id:M(a.challenge_id,`operationStepUpAuthorizationResponse.authorization.unseal.challenge_id`)};break;default:throw Error(`operationStepUpAuthorizationResponse.authorization.unseal.kind is invalid`)}let c={ok:!0,kind:`verified_step_up`,authorization:{kind:`operation_step_up`,evidence_set_digest:de(r.evidence_set_digest),unseal:s},expires_at_ms:i};return n===`evm.sign_transaction`?{...c,operation_kind:`evm.sign_transaction`}:{...c,operation_kind:`evm.export_key`,export_topology:ht(t.export_topology)}}async function _t(e){return m(await f(p({domain:`router-ab-ecdsa-operation-step-up/challenge/v1`,operation:Rn(e)})))}function j(e,t,n){let r=new Set(n);for(let n of Object.keys(e))if(!r.has(n))throw Error(`${t}.${n} is not a supported field`)}function M(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);let n=e.trim();if(!n)throw Error(`${t} is required`);if(!/^[\x20-\x7e]+$/.test(n))throw Error(`${t} must be printable ASCII`);return n}function N(e,t){let n=o(M(e,t));if(!n.ok)throw Error(`${t} is invalid`);return n.value}function P(e,t){let n=a(M(e,t));if(!n.ok)throw Error(`${t} is invalid`);return n.value}function vt(e,t){let n=le(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function yt(e,t){let n=se(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function bt(e,t){let n=oe(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function xt(e,t){let n=ie(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function F(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe integer`);return e}function I(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} must be a positive safe-integer counter`);return e}function L(e,t){if(typeof e!=`number`||!Number.isFinite(e))throw Error(`${t} must be a finite number`);let n=Math.floor(e);if(n!==e||n<0||n>4294967295)throw Error(`${t} must be a u32 integer`);return n}function St(e,t){if(typeof e!=`number`||!Number.isFinite(e))throw Error(`${t} must be a finite number`);let n=Math.floor(e);if(n!==e||n<0||n>255)throw Error(`${t} must be a byte`);return n}function R(e,t,n){let r=M(e,t);if(!/^[A-Za-z0-9_-]+$/.test(r))throw Error(`${t} must be unpadded base64url`);let i;try{i=h(r)}catch{throw Error(`${t} must be valid base64url`)}if(i.length!==n)throw Error(`${t} must decode to ${n} bytes`);return r}function z(e,t){let n=R(e,t,33),r=h(n);if(r[0]!==2&&r[0]!==3)throw Error(`${t} must be a compressed secp256k1 public key`);return n}function Ct(e,t){let n=M(e,t);if(!/^[A-Za-z0-9_-]+$/.test(n))throw Error(`${t} must be unpadded base64url`);let r;try{r=h(n)}catch{throw Error(`${t} must be valid base64url`)}if(r.length===0)throw Error(`${t} must decode to non-empty bytes`);return n}function wt(e,t){let n=M(e,t);if(!/^x25519:[0-9a-f]{64}$/.test(n))throw Error(`${t} must use x25519:<64 lowercase hex chars> encoding`);return n}function B(e,t,n){if(!(e instanceof Uint8Array))throw Error(`${t} must be a Uint8Array`);if(e.length!==n)throw Error(`${t} must contain ${n} bytes`);return e}function Tt(e,t){let n=M(e,t);if(n!==`ecdsa_secp256k1_recoverable_v1`)throw Error(`${t} must be ecdsa_secp256k1_recoverable_v1`);return n}function V(e,t){let n=d(e,t);if(j(n,t,[`bytes`]),!Array.isArray(n.bytes))throw Error(`${t}.bytes must be an array`);if(n.bytes.length!==32)throw Error(`${t}.bytes must contain 32 bytes`);return{bytes:n.bytes.map((e,n)=>St(e,`${t}.bytes[${n}]`))}}function H(e){let t=d(e,`scope.context`);j(t,`scope.context`,[`application_binding_digest_b64u`]);let n=h(M(t.application_binding_digest_b64u,`scope.context.application_binding_digest_b64u`));if(n.length!==32)throw Error(`scope.context.application_binding_digest_b64u must decode to 32 bytes`);return{application_binding_digest_b64u:m(n)}}function U(e){let t=d(e,`scope.public_identity`);return j(t,`scope.public_identity`,[`context_binding_b64u`,`derivation_client_share_public_key33_b64u`,`server_public_key33_b64u`,`threshold_public_key33_b64u`,`ethereum_address20_b64u`,`client_share_retry_counter`,`server_share_retry_counter`]),{context_binding_b64u:R(t.context_binding_b64u,`scope.public_identity.context_binding_b64u`,32),derivation_client_share_public_key33_b64u:z(t.derivation_client_share_public_key33_b64u,`scope.public_identity.derivation_client_share_public_key33_b64u`),server_public_key33_b64u:z(t.server_public_key33_b64u,`scope.public_identity.server_public_key33_b64u`),threshold_public_key33_b64u:z(t.threshold_public_key33_b64u,`scope.public_identity.threshold_public_key33_b64u`),ethereum_address20_b64u:R(t.ethereum_address20_b64u,`scope.public_identity.ethereum_address20_b64u`,20),client_share_retry_counter:L(t.client_share_retry_counter,`scope.public_identity.client_share_retry_counter`),server_share_retry_counter:L(t.server_share_retry_counter,`scope.public_identity.server_share_retry_counter`)}}function Et(e){return Dt(e,`scope.signing_worker`)}function Dt(e,t){let n=d(e,t);return j(n,t,[`server_id`,`key_epoch`,`recipient_encryption_key`]),{server_id:M(n.server_id,`${t}.server_id`),key_epoch:M(n.key_epoch,`${t}.key_epoch`),recipient_encryption_key:fe(n.recipient_encryption_key,`${t}.recipient_encryption_key`)}}function Ot(e,t,n){let r=d(e,t);if(j(r,t,[`role`,`signer_id`,`key_epoch`]),M(r.role,`${t}.role`)!==n)throw Error(`${t}.role must be ${n}`);return{role:n,signer_id:M(r.signer_id,`${t}.signer_id`),key_epoch:M(r.key_epoch,`${t}.key_epoch`)}}function kt(e,t){let n=d(e,t);j(n,t,[`signer_set_id`,`policy`,`signer_a`,`signer_b`,`selected_server`]);let r=M(n.policy,`${t}.policy`);if(r!==`all_2`)throw Error(`${t}.policy must be all_2`);let i=Ot(n.signer_a,`${t}.signer_a`,`signer_a`),a=Ot(n.signer_b,`${t}.signer_b`,`signer_b`);if(i.signer_id===a.signer_id)throw Error(`${t} requires distinct signer ids`);return{signer_set_id:M(n.signer_set_id,`${t}.signer_set_id`),policy:r,signer_a:i,signer_b:a,selected_server:Dt(n.selected_server,`${t}.selected_server`)}}function At(e){let t=`registration.lifecycle`,n=d(e,t);if(j(n,t,[`lifecycle_id`,`work_kind`,`primitive_request_kind`,`root_share_epoch`,`account_id`,`session_id`,`signer_set_id`,`selected_server_id`]),n.work_kind!==`registration_prepare`)throw Error(`${t}.work_kind must be registration_prepare`);if(n.primitive_request_kind!==`registration`)throw Error(`${t}.primitive_request_kind must be registration`);return{lifecycle_id:M(n.lifecycle_id,`${t}.lifecycle_id`),work_kind:`registration_prepare`,primitive_request_kind:`registration`,root_share_epoch:N(n.root_share_epoch,`${t}.root_share_epoch`),account_id:M(n.account_id,`${t}.account_id`),session_id:M(n.session_id,`${t}.session_id`),signer_set_id:M(n.signer_set_id,`${t}.signer_set_id`),selected_server_id:M(n.selected_server_id,`${t}.selected_server_id`)}}function jt(e,t,n){let r=d(e,t);if(j(r,t,[`role`,`key_epoch`,`public_key`]),r.role!==n)throw Error(`${t}.role must be ${n}`);return{role:n,key_epoch:M(r.key_epoch,`${t}.key_epoch`),public_key:fe(r.public_key,`${t}.public_key`)}}function Mt(e,t=`registration.deriver_recipient_keys`){let n=d(e,t);return j(n,t,[`deriver_a`,`deriver_b`]),{deriver_a:jt(n.deriver_a,`${t}.deriver_a`,`signer_a`),deriver_b:jt(n.deriver_b,`${t}.deriver_b`,`signer_b`)}}function Nt(e){let t=`registration`,n=d(e,t);if(j(n,t,[`registration_purpose`,`context`,`lifecycle`,`signer_set`,`router_id`,`client_id`,`replay_nonce`,`expires_at_ms`,`deriver_recipient_keys`]),n.registration_purpose!==`wallet_registration`&&n.registration_purpose!==`wallet_add_signer`)throw Error(`${t}.registration_purpose is invalid`);let r=At(n.lifecycle),i=kt(n.signer_set,`${t}.signer_set`);if(r.signer_set_id!==i.signer_set_id)throw Error(`${t}.lifecycle signer set does not match signer_set`);if(r.selected_server_id!==i.selected_server.server_id)throw Error(`${t}.lifecycle selected server does not match signer_set`);let a=Mt(n.deriver_recipient_keys);if(a.deriver_a.key_epoch!==i.signer_a.key_epoch)throw Error(`${t}.deriver_a recipient key epoch does not match signer_set`);if(a.deriver_b.key_epoch!==i.signer_b.key_epoch)throw Error(`${t}.deriver_b recipient key epoch does not match signer_set`);return{registration_purpose:n.registration_purpose,context:H(n.context),lifecycle:r,signer_set:i,router_id:M(n.router_id,`${t}.router_id`),client_id:M(n.client_id,`${t}.client_id`),replay_nonce:M(n.replay_nonce,`${t}.replay_nonce`),expires_at_ms:F(n.expires_at_ms,`${t}.expires_at_ms`),deriver_recipient_keys:a}}function Pt(e,t){let n=d(e,t);if(j(n,t,[`kind`,`transcriptDigestB64u`,`payloadB64u`]),n.kind!==`recipient_proof_bundle`)throw Error(`${t}.kind must be recipient_proof_bundle`);return{kind:`recipient_proof_bundle`,transcriptDigestB64u:R(n.transcriptDigestB64u,`${t}.transcriptDigestB64u`,32),payloadB64u:Ct(n.payloadB64u,`${t}.payloadB64u`)}}function Ft(e){let t=`registrationForwarded`,n=d(e,t);if(j(n,t,[`result`,`response`]),n.result!==`forwarded`)throw Error(`${t}.result must be forwarded`);return{result:`forwarded`,response:Vt(n.response,`${t}.response`)}}function It(e){return Lt(e,Rt)}function Lt(e,t){let n=`explicitExportForwarded`,r=d(e,n);if(j(r,n,[`result`,`response`,`signing_worker_export`]),r.result!==`forwarded`)throw Error(`${n}.result must be forwarded`);return{result:`forwarded`,response:Vt(r.response,`${n}.response`),signing_worker_export:t(r.signing_worker_export)}}function Rt(e){return Bt(e,y)}function zt(e,t,n){let r=d(e,n);j(r,n,[`wallet_id`,`key_handle`,`ecdsa_threshold_key_id`,`signing_root_id`,`signing_root_version`,`activation_epoch`,`signing_worker_id`,`context_binding_b64u`,`threshold_public_key33_b64u`,`export_request_digest_b64u`,`export_authorization_digest_b64u`,`export_nonce`,`authorization_kind`,`authorization_id`,`material_activation`,`lifecycle_id`,`recipient_identity`,`recipient_public_key`,`expires_at_ms`]);let i=t(r.material_activation);if(i.material_owner!==r.wallet_id||i.signing_worker!==r.signing_worker_id)throw Error(`${n}.material_activation is not bound to wallet and worker`);return{wallet_id:M(r.wallet_id,`${n}.wallet_id`),key_handle:M(r.key_handle,`${n}.key_handle`),ecdsa_threshold_key_id:M(r.ecdsa_threshold_key_id,`${n}.ecdsa_threshold_key_id`),signing_root_id:M(r.signing_root_id,`${n}.signing_root_id`),signing_root_version:M(r.signing_root_version,`${n}.signing_root_version`),activation_epoch:N(r.activation_epoch,`${n}.activation_epoch`),signing_worker_id:M(r.signing_worker_id,`${n}.signing_worker_id`),context_binding_b64u:R(r.context_binding_b64u,`${n}.context_binding_b64u`,32),threshold_public_key33_b64u:z(r.threshold_public_key33_b64u,`${n}.threshold_public_key33_b64u`),export_request_digest_b64u:R(r.export_request_digest_b64u,`${n}.export_request_digest_b64u`,32),export_authorization_digest_b64u:R(r.export_authorization_digest_b64u,`${n}.export_authorization_digest_b64u`,32),export_nonce:M(r.export_nonce,`${n}.export_nonce`),authorization_kind:mt(r.authorization_kind,`${n}.authorization_kind`),authorization_id:M(r.authorization_id,`${n}.authorization_id`),material_activation:i,lifecycle_id:M(r.lifecycle_id,`${n}.lifecycle_id`),recipient_identity:M(r.recipient_identity,`${n}.recipient_identity`),recipient_public_key:wt(r.recipient_public_key,`${n}.recipient_public_key`),expires_at_ms:F(r.expires_at_ms,`${n}.expires_at_ms`)}}function Bt(e,t){let n=`signingWorkerExportShare`,r=d(e,n);if(j(r,n,[`version`,`algorithm`,`binding`,`ciphertext_and_tag`]),r.version!==`router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1`)throw Error(`${n}.version is invalid`);if(r.algorithm!==`hpke_x25519_hkdf_sha256_aes256gcm_v1`)throw Error(`${n}.algorithm is invalid`);if(!Array.isArray(r.ciphertext_and_tag)||r.ciphertext_and_tag.length<=48)throw Error(`${n}.ciphertext_and_tag is invalid`);return{version:`router-ab-ecdsa-derivation/signing-worker-export-share-envelope/v1`,algorithm:`hpke_x25519_hkdf_sha256_aes256gcm_v1`,binding:zt(r.binding,t,`${n}.binding`),ciphertext_and_tag:r.ciphertext_and_tag.map((e,t)=>St(e,`${n}.ciphertext_and_tag[${t}]`))}}function Vt(e,t){let n=d(e,t);j(n,t,[`bundles`]);let r=`${t}.bundles`,i=d(n.bundles,r);return j(i,r,[`signerA`,`signerB`]),{bundles:{signerA:Pt(i.signerA,`${r}.signerA`),signerB:Pt(i.signerB,`${r}.signerB`)}}}function Ht(e){let t=`registrationActivation.publicFacts`,n=d(e,t);if(j(n,t,[`registrationRequestDigestB64u`,`proofTranscriptDigestB64u`,`contextBinding32B64u`,`derivationClientSharePublicKey33B64u`,`clientShareRetryCounter`,`participantId`]),n.participantId!==1)throw Error(`${t}.participantId must be 1`);return{registrationRequestDigestB64u:R(n.registrationRequestDigestB64u,`${t}.registrationRequestDigestB64u`,32),proofTranscriptDigestB64u:R(n.proofTranscriptDigestB64u,`${t}.proofTranscriptDigestB64u`,32),contextBinding32B64u:R(n.contextBinding32B64u,`${t}.contextBinding32B64u`,32),derivationClientSharePublicKey33B64u:z(n.derivationClientSharePublicKey33B64u,`${t}.derivationClientSharePublicKey33B64u`),clientShareRetryCounter:L(n.clientShareRetryCounter,`${t}.clientShareRetryCounter`),participantId:1}}function Ut(e){let t=`registrationActivationReceipt`,n=d(e,t);j(n,t,[`activation_correlation_id`,`activation_request_digest`,`server_generation`,`ecdsa_activation`,`lifecycle_id`,`transcript_digest`]);let r=`${t}.ecdsa_activation`,i=d(n.ecdsa_activation,r);j(i,r,[`context`,`public_identity`,`signing_worker`,`material_activation`,`activation_epoch`,`activation_digest_b64u`,`activated_at_ms`]);let a=Dt(i.signing_worker,`${r}.signing_worker`),o=y(i.material_activation);if(o.signing_worker!==a.server_id)throw Error(`${r}.material_activation.signing_worker does not match signing_worker`);let s=R(i.activation_digest_b64u,`${r}.activation_digest_b64u`,32),c=V(n.transcript_digest,`${t}.transcript_digest`);return{activation_correlation_id:ue(n.activation_correlation_id),activation_request_digest:V(n.activation_request_digest,`${t}.activation_request_digest`),server_generation:ke(n.server_generation),ecdsa_activation:{context:H(i.context),public_identity:U(i.public_identity),signing_worker:a,material_activation:o,activation_epoch:N(i.activation_epoch,`${r}.activation_epoch`),activation_digest_b64u:s,activated_at_ms:F(i.activated_at_ms,`${r}.activated_at_ms`)},lifecycle_id:M(n.lifecycle_id,`${t}.lifecycle_id`),transcript_digest:c}}function Wt(e){return Ut(e)}function W(e,t){return e.server_id===t.server_id&&e.key_epoch===t.key_epoch&&e.recipient_encryption_key===t.recipient_encryption_key}function Gt(e,t){return e.registrationRequestDigestB64u===t.registrationRequestDigestB64u&&e.proofTranscriptDigestB64u===t.proofTranscriptDigestB64u&&e.contextBinding32B64u===t.contextBinding32B64u&&e.derivationClientSharePublicKey33B64u===t.derivationClientSharePublicKey33B64u&&e.clientShareRetryCounter===t.clientShareRetryCounter&&e.participantId===t.participantId}function Kt(e,t){return e.signer_set_id===t.signer_set_id&&e.policy===t.policy&&e.signer_a.role===t.signer_a.role&&e.signer_a.signer_id===t.signer_a.signer_id&&e.signer_a.key_epoch===t.signer_a.key_epoch&&e.signer_b.role===t.signer_b.role&&e.signer_b.signer_id===t.signer_b.signer_id&&e.signer_b.key_epoch===t.signer_b.key_epoch&&W(e.selected_server,t.selected_server)}function G(e){let t=`ecdsaPublicCapability`,n=d(e,t);if(j(n,t,[`kind`,`context`,`public_identity`,`material_activation`,`signer_set`,`deriver_recipient_keys`,`router_id`,`client_id`,`activation_epoch`,`registration_request_digest_b64u`,`proof_transcript_digest_b64u`]),n.kind!==`router_ab_ecdsa_derivation_public_capability_v1`)throw Error(`${t}.kind is invalid`);let r=kt(n.signer_set,`${t}.signer_set`),i=Mt(n.deriver_recipient_keys,`${t}.deriver_recipient_keys`);if(i.deriver_a.key_epoch!==r.signer_a.key_epoch||i.deriver_b.key_epoch!==r.signer_b.key_epoch)throw Error(`${t} Deriver recipient key epochs do not match signer_set`);return{kind:`router_ab_ecdsa_derivation_public_capability_v1`,context:H(n.context),public_identity:U(n.public_identity),material_activation:y(n.material_activation),signer_set:r,deriver_recipient_keys:i,router_id:M(n.router_id,`${t}.router_id`),client_id:M(n.client_id,`${t}.client_id`),activation_epoch:N(n.activation_epoch,`${t}.activation_epoch`),registration_request_digest_b64u:R(n.registration_request_digest_b64u,`${t}.registration_request_digest_b64u`,32),proof_transcript_digest_b64u:R(n.proof_transcript_digest_b64u,`${t}.proof_transcript_digest_b64u`,32)}}function qt(e){let t=`postRegistrationSessionActivation.session_policy`,n=d(e,t);return j(n,t,[`threshold_session_id`,`wallet_session_mint_id`,`ttl_ms`,`remaining_uses`,`runtime_policy_scope`]),{threshold_session_id:P(n.threshold_session_id,`${t}.threshold_session_id`),wallet_session_mint_id:Yt(n.wallet_session_mint_id,`${t}.wallet_session_mint_id`),ttl_ms:I(n.ttl_ms,`${t}.ttl_ms`),remaining_uses:I(n.remaining_uses,`${t}.remaining_uses`),runtime_policy_scope:te(n.runtime_policy_scope)}}function Jt(e){let t=`postRegistrationSessionActivationPolicy`,n=d(e,t);if(j(n,t,[`kind`,`key_handle`,`session_policy`]),n.kind!==`router_ab_ecdsa_post_registration_session_activation_policy_v1`)throw Error(`${t}.kind is invalid`);return{kind:`router_ab_ecdsa_post_registration_session_activation_policy_v1`,key_handle:M(n.key_handle,`${t}.key_handle`),session_policy:qt(n.session_policy)}}function Yt(e,t){let n=ae(e);if(!n.ok)throw Error(`${t} is invalid`);return n.value}function K(e,t){return e.context_binding_b64u===t.context_binding_b64u&&e.derivation_client_share_public_key33_b64u===t.derivation_client_share_public_key33_b64u&&e.server_public_key33_b64u===t.server_public_key33_b64u&&e.threshold_public_key33_b64u===t.threshold_public_key33_b64u&&e.ethereum_address20_b64u===t.ethereum_address20_b64u&&e.client_share_retry_counter===t.client_share_retry_counter&&e.server_share_retry_counter===t.server_share_retry_counter}function Xt(e,t){for(let n of e.capabilitySubjects)if(!(n.kind!==`sign`||n.keyFamily!==`ecdsa_secp256k1`))return S(t.material_activation,me(n.materialActivation));return!1}function Zt(e){let t=`postRegistrationSessionActivation`,n=d(e,t);if(j(n,t,[`kind`,`public_capability`,`session_policy`]),n.kind!==`router_ab_ecdsa_post_registration_session_activation_v1`)throw Error(`${t}.kind is invalid`);return{kind:`router_ab_ecdsa_post_registration_session_activation_v1`,public_capability:G(n.public_capability),session_policy:qt(n.session_policy)}}function Qt(e){let t=`postRegistrationSessionActivated`,n=d(e,t);if(j(n,t,[`kind`,`public_capability`,`session`,`normal_signing`]),n.kind!==`router_ab_ecdsa_post_registration_session_activated_v1`)throw Error(`${t}.kind is invalid`);let r=G(n.public_capability),i=d(n.session,`${t}.session`);j(i,`${t}.session`,[`authorization_session_id`,`authorization_id`,`threshold_session_id`,`wallet_session_id`,`quota_id`,`expires_at_ms`,`remaining_uses`,`wallet_session`,`operation_credential`]);let a=jn(n.normal_signing),o=yt(i.authorization_id,`${t}.session.authorization_id`),s=bt(i.wallet_session_id,`${t}.session.wallet_session_id`),c=F(i.expires_at_ms,`${t}.session.expires_at_ms`),l=re(i.wallet_session),u=ne(i.operation_credential);if(!K(r.public_identity,a.scope.public_identity)||r.context.application_binding_digest_b64u!==a.scope.context.application_binding_digest_b64u||a.scope.activation_epoch!==r.activation_epoch||!W(a.scope.signing_worker,r.signer_set.selected_server)||l.authorizationId!==o||l.walletId!==r.client_id||l.expiresAtMs!==c||!Xt(l,r)||u.walletSessionId!==s)throw Error(`${t} exact Wallet Session does not match the activated capability`);return{kind:`router_ab_ecdsa_post_registration_session_activated_v1`,public_capability:r,session:{authorization_session_id:vt(i.authorization_session_id,`${t}.session.authorization_session_id`),authorization_id:o,threshold_session_id:P(i.threshold_session_id,`${t}.session.threshold_session_id`),wallet_session_id:s,quota_id:xt(i.quota_id,`${t}.session.quota_id`),expires_at_ms:c,remaining_uses:I(i.remaining_uses,`${t}.session.remaining_uses`),wallet_session:l,operation_credential:u},normal_signing:a}}function $t(e){let t=`credentialFreeSessionActivated`,n=d(e,t);if(j(n,t,[`kind`,`public_capability`,`session`,`normal_signing`]),n.kind!==`router_ab_ecdsa_credential_free_session_activated_v1`)throw Error(`${t}.kind is invalid`);let r=G(n.public_capability),i=d(n.session,`${t}.session`);j(i,`${t}.session`,[`authorization_session_id`,`authorization_id`,`threshold_session_id`,`wallet_session_id`,`quota_id`,`expires_at_ms`,`remaining_uses`]);let a=jn(n.normal_signing);if(!K(r.public_identity,a.scope.public_identity)||r.context.application_binding_digest_b64u!==a.scope.context.application_binding_digest_b64u||a.scope.activation_epoch!==r.activation_epoch||!W(a.scope.signing_worker,r.signer_set.selected_server))throw Error(`${t} normal-signing state does not match public capability`);return{kind:`router_ab_ecdsa_credential_free_session_activated_v1`,public_capability:r,session:{authorization_session_id:vt(i.authorization_session_id,`${t}.session.authorization_session_id`),authorization_id:yt(i.authorization_id,`${t}.session.authorization_id`),threshold_session_id:P(i.threshold_session_id,`${t}.session.threshold_session_id`),wallet_session_id:bt(i.wallet_session_id,`${t}.session.wallet_session_id`),quota_id:xt(i.quota_id,`${t}.session.quota_id`),expires_at_ms:F(i.expires_at_ms,`${t}.session.expires_at_ms`),remaining_uses:I(i.remaining_uses,`${t}.session.remaining_uses`)},normal_signing:a}}function en(e,t=`signing_digest_b64u`){return{bytes:Array.from(h(R(e,t,32)))}}function q(e,t){return e.bytes.length===32&&t.bytes.length===32&&e.bytes.every((e,n)=>e===t.bytes[n])}function tn(e,t){return e.bytes.length===t.bytes.length&&e.bytes.every((e,n)=>e===t.bytes[n])}function nn(e,t){return e.deriver_a.role===t.deriver_a.role&&e.deriver_a.key_epoch===t.deriver_a.key_epoch&&e.deriver_a.public_key===t.deriver_a.public_key&&e.deriver_b.role===t.deriver_b.role&&e.deriver_b.key_epoch===t.deriver_b.key_epoch&&e.deriver_b.public_key===t.deriver_b.public_key}function rn(e,t){let n=e.ecdsa_activation,r=t.ecdsa_activation;return e.activation_correlation_id===t.activation_correlation_id&&tn(e.activation_request_digest,t.activation_request_digest)&&e.server_generation===t.server_generation&&e.lifecycle_id===t.lifecycle_id&&tn(e.transcript_digest,t.transcript_digest)&&n.context.application_binding_digest_b64u===r.context.application_binding_digest_b64u&&K(n.public_identity,r.public_identity)&&W(n.signing_worker,r.signing_worker)&&S(n.material_activation,r.material_activation)&&n.activation_epoch===r.activation_epoch&&n.activation_digest_b64u===r.activation_digest_b64u&&n.activated_at_ms===r.activated_at_ms}function an(e,t){let n=e.scope,r=t.scope;return e.kind===t.kind&&n.wallet_id===r.wallet_id&&n.ecdsa_threshold_key_id===r.ecdsa_threshold_key_id&&n.signing_root_id===r.signing_root_id&&n.signing_root_version===r.signing_root_version&&n.context.application_binding_digest_b64u===r.context.application_binding_digest_b64u&&K(n.public_identity,r.public_identity)&&S(n.material_activation,r.material_activation)&&W(n.signing_worker,r.signing_worker)&&n.activation_epoch===r.activation_epoch}function on(e,t){return e.kind===t.kind&&e.context.application_binding_digest_b64u===t.context.application_binding_digest_b64u&&K(e.public_identity,t.public_identity)&&S(e.material_activation,t.material_activation)&&Kt(e.signer_set,t.signer_set)&&nn(e.deriver_recipient_keys,t.deriver_recipient_keys)&&e.router_id===t.router_id&&e.client_id===t.client_id&&e.activation_epoch===t.activation_epoch&&e.registration_request_digest_b64u===t.registration_request_digest_b64u&&e.proof_transcript_digest_b64u===t.proof_transcript_digest_b64u}function J(e){return new TextEncoder().encode(M(e,`canonical string`))}function sn(e){let t=e.reduce((e,t)=>e+t.length,0),n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function Y(e,t){for(let n of t)e.push(n)}function cn(e,t){Y(e,h(t.lane_digest_b64u)),Y(e,h(t.intent_digest_b64u)),Y(e,h(t.display_digest_b64u))}function ln(e,t){if(!Number.isInteger(t)||t<0||t>65535)throw Error(`canonical u16 must be an integer between 0 and 65535`);e.push(t>>>8&255,t&255)}function un(e,t){if(!Number.isInteger(t)||t<0||t>4294967295)throw Error(`canonical u32 must be an integer between 0 and 4294967295`);e.push(t>>>24&255,t>>>16&255,t>>>8&255,t&255)}function dn(e,t){if(!Number.isSafeInteger(t)||t<0)throw Error(`canonical u64 must be a non-negative safe integer`);let n=BigInt(t);for(let t=56;t>=0;t-=8)e.push(Number(n>>BigInt(t)&255n))}function X(e,t){un(e,t.length),Y(e,t)}function fn(e,t){let n=J(t);ln(e,n.length),Y(e,n)}function pn(e,t){X(e,J(t.server_id)),X(e,J(t.key_epoch)),X(e,J(t.recipient_encryption_key))}async function mn(e){let t=globalThis.crypto?.subtle;if(!t)throw Error(`crypto.subtle is required for Router A/B ECDSA derivation request digest binding`);let n=new ArrayBuffer(e.byteLength);return new Uint8Array(n).set(e),new Uint8Array(await t.digest(`SHA-256`,n))}async function hn(e){let t=B(e,`clientRerandomizationContribution32`,32);return await mn(sn([J(`router-ab-ecdsa-derivation/client-rerandomization-commitment/v1`),t]))}function gn(e){let t=H(e),n=[];Y(n,J(`router-ab-ecdsa-derivation/context/v1`)),fn(n,`router-ab-ecdsa-derivation-v1`),fn(n,`secp256k1`),Y(n,h(t.application_binding_digest_b64u)),n.push(pt.length);for(let e of pt)ln(n,e);return new Uint8Array(n)}function _n(e){let t=[];return Y(t,J(`router-ab-ecdsa-derivation/role-local/context-binding/v1`)),t.push(1),t.push(1),ln(t,e.length),Y(t,e),new Uint8Array(t)}async function vn(e){return wn(_n(gn(e)))}function yn(e){let t=U(e),n=[];return X(n,J(`router-ab-ecdsa-derivation/public-identity/v1`)),X(n,J(t.context_binding_b64u)),X(n,J(t.derivation_client_share_public_key33_b64u)),X(n,J(t.server_public_key33_b64u)),X(n,J(t.threshold_public_key33_b64u)),X(n,J(t.ethereum_address20_b64u)),un(n,t.client_share_retry_counter),un(n,t.server_share_retry_counter),new Uint8Array(n)}function bn(e){let t=Z(e),n=[];return X(n,J(`router-ab-ecdsa-derivation/normal-signing-scope/v1`)),X(n,J(t.wallet_id)),X(n,J(t.ecdsa_threshold_key_id)),X(n,J(t.signing_root_id)),X(n,J(t.signing_root_version)),X(n,gn(t.context)),X(n,yn(t.public_identity)),n.push(...x(t.material_activation)),pn(n,t.signing_worker),X(n,J(t.activation_epoch)),new Uint8Array(n)}function xn(e){return bn(e)}function Sn(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function Cn(e,t){try{return Sn(xn(e),xn(t))}catch{return!1}}async function wn(e){return{bytes:Array.from(await mn(e))}}async function Tn(e){let t=Z(e),n=await vn(t.context);if(!q(en(t.public_identity.context_binding_b64u,`scope.public_identity.context_binding_b64u`),n))throw Error(`scope.public_identity.context_binding_b64u does not match scope.context`);return t}function En(e){let t=Q(e),n=[];return X(n,J(`router-ab-ecdsa-derivation/normal-signing-request/v1`)),X(n,bn(t.scope)),X(n,J(t.request_id)),X(n,J(t.operation_id)),cn(n,t.operation_digests),n.push(..._e(t.authorization)),n.push(...x(t.material_activation)),X(n,J(t.client_presignature_id)),dn(n,t.expires_at_ms),Y(n,h(t.signing_digest_b64u)),X(n,h(t.client_rerandomization_commitment32_b64u)),new Uint8Array(n)}async function Dn(e){let t=Q(e);return await Tn(t.scope),wn(En(t))}function On(e){let t=$(e),n=[];return X(n,J(`router-ab-ecdsa-derivation/normal-signing-finalize-request/v1`)),X(n,bn(t.scope)),X(n,J(t.request_id)),X(n,J(t.operation_id)),cn(n,t.operation_digests),n.push(..._e(t.authorization)),n.push(...x(t.material_activation)),dn(n,t.expires_at_ms),Y(n,h(t.signing_digest_b64u)),X(n,J(t.server_presignature_id)),X(n,h(t.client_signature_share32_b64u)),X(n,h(t.client_rerandomization_contribution32_b64u)),new Uint8Array(n)}async function kn(e){let t=$(e);return await Tn(t.scope),wn(On(t))}function Z(e){let t=d(e,`scope`);return j(t,`scope`,[`wallet_id`,`ecdsa_threshold_key_id`,`signing_root_id`,`signing_root_version`,`context`,`public_identity`,`material_activation`,`signing_worker`,`activation_epoch`]),{wallet_id:M(t.wallet_id,`scope.wallet_id`),ecdsa_threshold_key_id:M(t.ecdsa_threshold_key_id,`scope.ecdsa_threshold_key_id`),signing_root_id:M(t.signing_root_id,`scope.signing_root_id`),signing_root_version:M(t.signing_root_version,`scope.signing_root_version`),context:H(t.context),public_identity:U(t.public_identity),material_activation:y(t.material_activation),signing_worker:Et(t.signing_worker),activation_epoch:N(t.activation_epoch,`scope.activation_epoch`)}}function An(e){if(e==null)return null;let t=d(e,`routerAbEcdsaDerivationNormalSigning`);if(j(t,`routerAbEcdsaDerivationNormalSigning`,[`kind`,`scope`]),M(t.kind,`routerAbEcdsaDerivationNormalSigning.kind`)!==`router_ab_ecdsa_derivation_normal_signing_v1`)throw Error(`routerAbEcdsaDerivationNormalSigning.kind is not supported`);return{kind:`router_ab_ecdsa_derivation_normal_signing_v1`,scope:Z(t.scope)}}function jn(e){let t=An(e);if(!t)throw Error(`Router A/B ECDSA derivation normal-signing state is required`);return t}function Mn(e){let t=u([M(e.ecdsaThresholdKeyId,`ecdsaThresholdKeyId`),M(e.signingRootId,`signingRootId`),M(e.signingRootVersion,`signingRootVersion`),N(e.activationEpoch,`activationEpoch`)].join(`:`));if(!t.ok)throw Error(`activeStateId ${t.error.message}`);return t.value}function Nn(e){return Mn({ecdsaThresholdKeyId:e.scope.ecdsa_threshold_key_id,signingRootId:e.scope.signing_root_id,signingRootVersion:e.scope.signing_root_version,activationEpoch:e.scope.activation_epoch})}function Pn(e,t){let n=d(e,t);return j(n,t,[`lane_digest_b64u`,`intent_digest_b64u`,`display_digest_b64u`]),{lane_digest_b64u:R(n.lane_digest_b64u,`${t}.lane_digest_b64u`,32),intent_digest_b64u:R(n.intent_digest_b64u,`${t}.intent_digest_b64u`,32),display_digest_b64u:R(n.display_digest_b64u,`${t}.display_digest_b64u`,32)}}function Fn(e){return Q({scope:e.scope,request_id:e.requestId,operation_id:e.operationId,operation_digests:e.operationDigests,authorization:e.authorization,material_activation:e.materialActivation,client_presignature_id:e.clientPresignatureId,expires_at_ms:e.expiresAtMs,signing_digest_b64u:m(B(e.signingDigest32,`signingDigest32`,32)),client_rerandomization_commitment32_b64u:m(B(e.clientRerandomizationCommitment32,`clientRerandomizationCommitment32`,32))})}function Q(e){let t=d(e,`ecdsaSigningRequest`);j(t,`ecdsaSigningRequest`,[`scope`,`request_id`,`operation_id`,`operation_digests`,`authorization`,`material_activation`,`client_presignature_id`,`expires_at_ms`,`signing_digest_b64u`,`client_rerandomization_commitment32_b64u`]);let n={scope:Z(t.scope),request_id:M(t.request_id,`ecdsaSigningRequest.request_id`),operation_id:M(t.operation_id,`ecdsaSigningRequest.operation_id`),operation_digests:Pn(t.operation_digests,`ecdsaSigningRequest.operation_digests`),authorization:v(t.authorization),material_activation:y(t.material_activation),client_presignature_id:M(t.client_presignature_id,`ecdsaSigningRequest.client_presignature_id`),expires_at_ms:F(t.expires_at_ms,`ecdsaSigningRequest.expires_at_ms`),signing_digest_b64u:R(t.signing_digest_b64u,`ecdsaSigningRequest.signing_digest_b64u`,32),client_rerandomization_commitment32_b64u:R(t.client_rerandomization_commitment32_b64u,`ecdsaSigningRequest.client_rerandomization_commitment32_b64u`,32)};if(n.operation_digests.intent_digest_b64u!==n.signing_digest_b64u)throw Error(`ecdsaSigningRequest intent digest must equal the admitted signing digest`);return n}function In(e){let t=d(e,`webauthn_authentication`);j(t,`webauthn_authentication`,[`id`,`rawId`,`type`,`authenticatorAttachment`,`response`,`clientExtensionResults`]);let n=d(t.response,`webauthn_authentication.response`);if(j(n,`webauthn_authentication.response`,[`clientDataJSON`,`authenticatorData`,`signature`,`userHandle`]),t.clientExtensionResults!==null)throw Error(`webauthn_authentication.clientExtensionResults must be redacted`);let r=t.authenticatorAttachment===null?null:M(t.authenticatorAttachment,`webauthn_authentication.authenticatorAttachment`),i=n.userHandle===null?null:M(n.userHandle,`webauthn_authentication.response.userHandle`);return{id:M(t.id,`webauthn_authentication.id`),rawId:M(t.rawId,`webauthn_authentication.rawId`),type:M(t.type,`webauthn_authentication.type`),authenticatorAttachment:r,response:{clientDataJSON:M(n.clientDataJSON,`webauthn_authentication.response.clientDataJSON`),authenticatorData:M(n.authenticatorData,`webauthn_authentication.response.authenticatorData`),signature:M(n.signature,`webauthn_authentication.response.signature`),userHandle:i},clientExtensionResults:null}}function Ln(e){let t=d(e,`operationStepUpAuthorizationRequest`);if(j(t,`operationStepUpAuthorizationRequest`,[`kind`,`operation`,`proof`]),t.kind!==`router_ab_ecdsa_operation_step_up_v1`)throw Error(`operationStepUpAuthorizationRequest.kind must be router_ab_ecdsa_operation_step_up_v1`);let n=Rn(t.operation),r=d(t.proof,`operationStepUpAuthorizationRequest.proof`),i=et(r.authority),a;switch(r.kind){case`passkey`:if(j(r,`operationStepUpAuthorizationRequest.proof`,[`kind`,`authority`,`webauthn_authentication`]),!i||!O(i))throw Error(`operationStepUpAuthorizationRequest.proof requires an exact passkey authority`);a={kind:`passkey`,authority:i,webauthn_authentication:In(r.webauthn_authentication)};break;case`email_otp`:if(j(r,`operationStepUpAuthorizationRequest.proof`,[`kind`,`authority`,`challenge_id`,`otp_code`]),!i||!k(i))throw Error(`operationStepUpAuthorizationRequest.proof requires an exact Email OTP authority`);a={kind:`email_otp`,authority:i,challenge_id:M(r.challenge_id,`operationStepUpAuthorizationRequest.proof.challenge_id`),otp_code:M(r.otp_code,`operationStepUpAuthorizationRequest.proof.otp_code`)};break;default:throw Error(`operationStepUpAuthorizationRequest.proof.kind is invalid`)}return{kind:`router_ab_ecdsa_operation_step_up_v1`,operation:n,proof:a}}function Rn(e){let t=d(e,`ecdsaOperationStepUpPreparation`);if(j(t,`operationStepUpGrantRequest.operation`,[`wallet_id`,`operation_kind`,`operation_id`,`operation_digests`,`material_activation`,`normal_signing_scope`,`signing_worker_id`,`key_handle`,`relayer_key_id`,`participant_ids`,`expires_at_ms`]),!Array.isArray(t.participant_ids)||t.participant_ids.length!==2||!t.participant_ids.every(e=>Number.isSafeInteger(e)&&e>0))throw Error(`operationStepUpGrantRequest.operation.participant_ids must contain two positive integers`);return{wallet_id:M(t.wallet_id,`operationStepUpGrantRequest.operation.wallet_id`),operation_kind:zn(t.operation_kind),operation_id:M(t.operation_id,`operationStepUpGrantRequest.operation.operation_id`),operation_digests:Pn(t.operation_digests,`operationStepUpGrantRequest.operation.operation_digests`),material_activation:y(t.material_activation),normal_signing_scope:Z(t.normal_signing_scope),signing_worker_id:M(t.signing_worker_id,`operationStepUpGrantRequest.operation.signing_worker_id`),key_handle:M(t.key_handle,`operationStepUpGrantRequest.operation.key_handle`),relayer_key_id:M(t.relayer_key_id,`operationStepUpGrantRequest.operation.relayer_key_id`),participant_ids:[Number(t.participant_ids[0]),Number(t.participant_ids[1])],expires_at_ms:F(t.expires_at_ms,`operationStepUpGrantRequest.operation.expires_at_ms`)}}function zn(e){switch(e){case ce.signTransaction:case ce.exportKey:return e;default:throw Error(`operationStepUpGrantRequest.operation.operation_kind must be evm.sign_transaction or evm.export_key`)}}function Bn(e){return $({scope:e.scope,request_id:e.requestId,operation_id:e.operationId,operation_digests:e.operationDigests,authorization:e.authorization,material_activation:e.materialActivation,expires_at_ms:e.expiresAtMs,signing_digest_b64u:m(B(e.signingDigest32,`signingDigest32`,32)),server_presignature_id:e.serverPresignatureId,client_signature_share32_b64u:m(B(e.clientSignatureShare32,`clientSignatureShare32`,32)),client_rerandomization_contribution32_b64u:m(B(e.clientRerandomizationContribution32,`clientRerandomizationContribution32`,32))})}function $(e){let t=d(e,`ecdsaFinalizeCoreRequest`);return j(t,`ecdsaFinalizeCoreRequest`,[`scope`,`request_id`,`operation_id`,`operation_digests`,`authorization`,`material_activation`,`expires_at_ms`,`signing_digest_b64u`,`server_presignature_id`,`client_signature_share32_b64u`,`client_rerandomization_contribution32_b64u`]),Vn(t)}function Vn(e){let t={scope:Z(e.scope),request_id:M(e.request_id,`ecdsaFinalizeRequest.request_id`),operation_id:M(e.operation_id,`ecdsaFinalizeRequest.operation_id`),operation_digests:Pn(e.operation_digests,`ecdsaFinalizeRequest.operation_digests`),authorization:v(e.authorization),material_activation:y(e.material_activation),expires_at_ms:F(e.expires_at_ms,`ecdsaFinalizeRequest.expires_at_ms`),signing_digest_b64u:R(e.signing_digest_b64u,`ecdsaFinalizeRequest.signing_digest_b64u`,32),server_presignature_id:M(e.server_presignature_id,`ecdsaFinalizeRequest.server_presignature_id`),client_signature_share32_b64u:R(e.client_signature_share32_b64u,`ecdsaFinalizeRequest.client_signature_share32_b64u`,32),client_rerandomization_contribution32_b64u:R(e.client_rerandomization_contribution32_b64u,`ecdsaFinalizeRequest.client_rerandomization_contribution32_b64u`,32)};if(t.operation_digests.intent_digest_b64u!==t.signing_digest_b64u)throw Error(`ecdsaFinalizeRequest intent digest must equal the admitted signing digest`);return t}function Hn(e){let t=d(e,`ecdsaPrepareResponse`);return j(t,`ecdsaPrepareResponse`,[`scope`,`request_id`,`request_digest`,`signing_digest`,`server_presignature_id`,`server_big_r33_b64u`,`signing_worker_rerandomization_contribution32_b64u`,`signature_scheme`,`prepared_at_ms`,`expires_at_ms`]),{scope:Z(t.scope),request_id:M(t.request_id,`ecdsaPrepareResponse.request_id`),request_digest:V(t.request_digest,`ecdsaPrepareResponse.request_digest`),signing_digest:V(t.signing_digest,`ecdsaPrepareResponse.signing_digest`),server_presignature_id:M(t.server_presignature_id,`ecdsaPrepareResponse.server_presignature_id`),server_big_r33_b64u:R(t.server_big_r33_b64u,`ecdsaPrepareResponse.server_big_r33_b64u`,33),signing_worker_rerandomization_contribution32_b64u:R(t.signing_worker_rerandomization_contribution32_b64u,`ecdsaPrepareResponse.signing_worker_rerandomization_contribution32_b64u`,32),signature_scheme:Tt(t.signature_scheme,`ecdsaPrepareResponse.signature_scheme`),prepared_at_ms:F(t.prepared_at_ms,`ecdsaPrepareResponse.prepared_at_ms`),expires_at_ms:F(t.expires_at_ms,`ecdsaPrepareResponse.expires_at_ms`)}}async function Un(e,t){let n=Q(e),r=Hn(t);if(!Cn(r.scope,n.scope))throw Error(`ecdsaPrepareResponse.scope does not match request`);if(r.request_id!==n.request_id)throw Error(`ecdsaPrepareResponse.request_id does not match request`);if(r.server_presignature_id!==n.client_presignature_id)throw Error(`ecdsaPrepareResponse.server_presignature_id does not match request`);if(!q(r.signing_digest,en(n.signing_digest_b64u)))throw Error(`ecdsaPrepareResponse.signing_digest does not match request`);if(r.expires_at_ms!==n.expires_at_ms)throw Error(`ecdsaPrepareResponse.expires_at_ms does not match request`);if(!q(r.request_digest,await Dn(n)))throw Error(`ecdsaPrepareResponse.request_digest does not match request`);return r}function Wn(e){let t=d(e,`ecdsaSigningResponse`);return j(t,`ecdsaSigningResponse`,[`scope`,`request_id`,`request_digest`,`signing_digest`,`signature_scheme`,`signature65_b64u`]),{scope:Z(t.scope),request_id:M(t.request_id,`ecdsaSigningResponse.request_id`),request_digest:V(t.request_digest,`ecdsaSigningResponse.request_digest`),signing_digest:V(t.signing_digest,`ecdsaSigningResponse.signing_digest`),signature_scheme:Tt(t.signature_scheme,`ecdsaSigningResponse.signature_scheme`),signature65_b64u:R(t.signature65_b64u,`ecdsaSigningResponse.signature65_b64u`,65)}}async function Gn(e,t){let n=$(e),r=Wn(t);if(!Cn(r.scope,n.scope))throw Error(`ecdsaSigningResponse.scope does not match request`);if(r.request_id!==n.request_id)throw Error(`ecdsaSigningResponse.request_id does not match request`);if(!q(r.signing_digest,en(n.signing_digest_b64u)))throw Error(`ecdsaSigningResponse.signing_digest does not match request`);if(!q(r.request_digest,await kn(n)))throw Error(`ecdsaSigningResponse.request_digest does not match request`);return r}const Kn=new TextEncoder;function qn(e){let t=0;for(let n of e)t+=n.length;let n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function Jn(e,t){if(!Number.isSafeInteger(e)||e<0||e>4294967295)throw Error(`${t} must be a non-negative u32`);return Uint8Array.from([e>>>24&255,e>>>16&255,e>>>8&255,e&255])}function Yn(e,t){if(!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative safe integer`);let n=BigInt(e),r=new Uint8Array(8);for(let e=7;e>=0;--e)r[e]=Number(n&255n),n>>=8n;return r}function Xn(e,t){return qn([Jn(e.length,`${t}.length`),e])}function Zn(e,t){if(typeof e!=`string`)throw Error(`${t} must be a string`);return Xn(Kn.encode(e),t)}function Qn(e,t){try{let t=h(de(e));if(t.length!==32)throw Error(`must decode to 32 bytes`);return t}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}function $n(e,t){try{let t=h(e);if(t.length===0||m(t)!==e)throw Error(`must be canonical base64url`);return t}catch(e){throw Error(`${t} ${e instanceof Error?e.message:`is invalid`}`)}}export{Ze as $,Ut as A,x as At,hn as B,It as C,De as Ct,Jt as D,we as Dt,Rn as E,Ee as Et,jn as F,S as Ft,on as G,Kt as H,Nn as I,fe as It,Gt as J,K,kn as L,Nt as M,v as Mt,Ft as N,he as Nt,Zt as O,Se as Ot,Ht as P,me as Pt,Be as Q,Dn as R,G as S,Oe as St,gt as T,Te as Tt,Cn as U,nn as V,an as W,Je as X,W as Y,Ke as Z,$t as _,Le as _t,Zn as a,nt as at,Z as b,Ne as bt,ct as c,He as ct,ut as d,ze as dt,Ye as et,dt as f,Pe as ft,_t as g,Me as gt,Fn as h,Re as ht,$n as i,D as it,Wt as j,y as jt,Qt as k,xe as kt,ft as l,Ve as lt,Bn as m,je as mt,Xn as n,k as nt,Jn as o,rt as ot,st as p,Ae as pt,rn as q,Qn as r,O as rt,Yn as s,et as st,qn as t,Xe as tt,lt as u,ot as ut,Un as v,Fe as vt,Ln as w,Ce as wt,An as x,ke as xt,Gn as y,Ie as yt,xn as z};

package/dist/public/sdk/{display-CUWg48tD.js → display-8NGPOhQT.js}

@@ -1 +1 @@
-import{n as e}from"./normalization-B3i1-rPQ.js";import{_ as t,g as n,h as r,m as i}from"./signingFlow-Bd1X0e-1.js";function a(e){try{return JSON.stringify(e,(e,t)=>typeof t==`bigint`?t.toString():t,2)}catch{return String(e)}}function o(e,t,n){let r=String(t??``).trim();if(r)return{label:e,value:r,...typeof n==`string`&&n.trim()?{copyValue:n}:{}}}function s(t){let n=e(t.input);if(n!==`0x`&&!(!Array.isArray(t.abi)||t.abi.length===0))return{dataHex:n,abi:t.abi}}function c(a){let{rootId:c,call:l,tx:u}=a,d=String(l.to||``).trim(),f=e(String(l.input||`0x`));if(f===`0x`)return;let p=t(f),m=n(p,d)||`contract function`,h=i(u.gasLimit),g=o(`Data`,r(f),f);g&&(g.renderAs=`file-content`,g.hideLabel=!0,g.hideChevron=!0);let _=[g,o(`Value (wei)`,l.value.toString()),o(`Valid Before`,u.validBefore==null?void 0:u.validBefore.toString()),o(`Valid After`,u.validAfter==null?void 0:u.validAfter.toString())].filter(Boolean),v={id:`${c}.call`,kind:`generic.contractCall`,label:`Calling ${m} using ${h} gas`,to:d,value:l.value.toString(),selector:p,fields:_},y=s({input:f,abi:l.abi});return y&&(v.abiDecodeHint=y),v}function l(n){let{call:r,callIndex:i,callCount:a,tx:o}=n,s=`tempo.tx.${i}`,l=String(r.to||``).trim(),u=a>1?`Transaction ${i+1} to contract`:`Transaction to contract`,d=c({rootId:s,call:r,tx:o});return{id:s,kind:`tempo.eip2718`,label:u,txTypeHex:`0x76`,txTypeName:`TempoTransaction`,to:l,selector:t(e(String(r.input||`0x`))),...d?{children:[d]}:{}}}function u(e){if(e.kind!==`tempoTransaction`)return[{id:`tempo.raw`,kind:`raw.fallback`,label:`Unsupported Tempo Payload`,raw:a(e)}];let t=Array.isArray(e.tx.calls)?e.tx.calls:[];return t.length?t.map((n,r)=>l({call:n,callIndex:r,callCount:t.length,tx:e.tx})):[{id:`tempo.raw`,kind:`raw.fallback`,label:`Tempo Payload Missing Calls`,raw:a(e)}]}function d(e){let t=u(e.request),n=BigInt(0);if(e.request.kind===`tempoTransaction`)for(let t of e.request.tx.calls||[])n+=BigInt(t.value||0);return{chain:`tempo`,chainId:e.request.kind===`tempoTransaction`?e.request.tx.chainId:void 0,intentDigest:e.intentDigest,signerAccount:e.signerAccount,title:e.title||`Tempo Transaction`,subtitle:e.subtitle,operations:t,...n>0n?{totals:{nativeValue:n.toString(),nativeSymbol:`wei`}}:{}}}export{d as t};
+import{n as e}from"./normalization-B3i1-rPQ.js";import{_ as t,g as n,h as r,m as i}from"./signingFlow-DTP4D19E.js";function a(e){try{return JSON.stringify(e,(e,t)=>typeof t==`bigint`?t.toString():t,2)}catch{return String(e)}}function o(e,t,n){let r=String(t??``).trim();if(r)return{label:e,value:r,...typeof n==`string`&&n.trim()?{copyValue:n}:{}}}function s(t){let n=e(t.input);if(n!==`0x`&&!(!Array.isArray(t.abi)||t.abi.length===0))return{dataHex:n,abi:t.abi}}function c(a){let{rootId:c,call:l,tx:u}=a,d=String(l.to||``).trim(),f=e(String(l.input||`0x`));if(f===`0x`)return;let p=t(f),m=n(p,d)||`contract function`,h=i(u.gasLimit),g=o(`Data`,r(f),f);g&&(g.renderAs=`file-content`,g.hideLabel=!0,g.hideChevron=!0);let _=[g,o(`Value (wei)`,l.value.toString()),o(`Valid Before`,u.validBefore==null?void 0:u.validBefore.toString()),o(`Valid After`,u.validAfter==null?void 0:u.validAfter.toString())].filter(Boolean),v={id:`${c}.call`,kind:`generic.contractCall`,label:`Calling ${m} using ${h} gas`,to:d,value:l.value.toString(),selector:p,fields:_},y=s({input:f,abi:l.abi});return y&&(v.abiDecodeHint=y),v}function l(n){let{call:r,callIndex:i,callCount:a,tx:o}=n,s=`tempo.tx.${i}`,l=String(r.to||``).trim(),u=a>1?`Transaction ${i+1} to contract`:`Transaction to contract`,d=c({rootId:s,call:r,tx:o});return{id:s,kind:`tempo.eip2718`,label:u,txTypeHex:`0x76`,txTypeName:`TempoTransaction`,to:l,selector:t(e(String(r.input||`0x`))),...d?{children:[d]}:{}}}function u(e){if(e.kind!==`tempoTransaction`)return[{id:`tempo.raw`,kind:`raw.fallback`,label:`Unsupported Tempo Payload`,raw:a(e)}];let t=Array.isArray(e.tx.calls)?e.tx.calls:[];return t.length?t.map((n,r)=>l({call:n,callIndex:r,callCount:t.length,tx:e.tx})):[{id:`tempo.raw`,kind:`raw.fallback`,label:`Tempo Payload Missing Calls`,raw:a(e)}]}function d(e){let t=u(e.request),n=BigInt(0);if(e.request.kind===`tempoTransaction`)for(let t of e.request.tx.calls||[])n+=BigInt(t.value||0);return{chain:`tempo`,chainId:e.request.kind===`tempoTransaction`?e.request.tx.chainId:void 0,intentDigest:e.intentDigest,signerAccount:e.signerAccount,title:e.title||`Tempo Transaction`,subtitle:e.subtitle,operations:t,...n>0n?{totals:{nativeValue:n.toString(),nativeSymbol:`wei`}}:{}}}export{d as t};