@seams/wallet 0.6.1 → 0.7.1

package/dist/esm/sdk/evmFamilyEcdsaIdentity-_kuKSW35.js

@@ -1,1385 +0,0 @@
-import { D as parseMpcSigningWorkerRef, F as parseWalletAuthMethodId, H as parseWebAuthnRpId, M as parseThresholdEd25519SessionId, R as parseWalletId, T as parseMpcMaterialActivationRef, f as hasWhitespaceOrControlCharacters, g as parseEmailOtpChallengeId, j as parseThresholdEcdsaSessionId } from "./normalize-BephcEIF.js";
-import { _ as isImplicitNearAccountId, b as parseNearAccountId, v as parseImplicitNearAccountId, y as parseNamedNearAccountId } from "./validation-BphUDXs7.js";
-import { i as base64UrlEncode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
-import { A as alphabetizeStringify, I as parseDigestB64u, M as sha256BytesUtf8, m as nearEd25519SigningKeyIdFromString } from "./registrationIntent-DwAIMQYh.js";
-import { a as thresholdEcdsaChainTargetFromRequest, c as toWalletId, l as walletIdFromWalletProfile, o as thresholdEcdsaChainTargetKey } from "./ecdsaChainTarget-BOTPGIU_.js";
-import { n as SIGNER_AUTH_METHODS } from "./signerDomain-DDLiwuYS.js";
-import { c as deriveEvmFamilySigningKeySlotId$1, r as normalizeThresholdEd25519ParticipantIds, s as signingRootScopeFromRuntimePolicyScope, u as parseDigestField, v as rejectUnknownFields$1, y as requireRecord$2 } from "./participants-Bcnsa_ip.js";
-import { d as parseMpcWalletSigningQuotaId, h as parseWalletSessionId } from "./capabilityKinds-jwCEaqBU.js";
-//#region ../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.ts
-const THRESHOLD_SECP256K1_ECDSA_2P_V1_SCHEME_ID = "threshold-secp256k1-ecdsa-2p-v1";
-function ecdsaClientRootPublicKey33B64uFromString(value) {
-	const normalized = value.trim();
-	const bytes = base64UrlDecode(normalized);
-	if (bytes.length !== 33 || base64UrlEncode(bytes) !== normalized) throw new Error("ECDSA client root public key must be canonical base64url for 33 bytes");
-	return normalized;
-}
-function requireSdkBindingFactString(value, field) {
-	const normalized = String(value ?? "").trim();
-	if (!normalized) throw new Error(`${field} is required`);
-	return normalized;
-}
-function parseSdkEcdsaDerivationThresholdKeyId(value) {
-	return requireSdkBindingFactString(value, "ecdsaThresholdKeyId");
-}
-function parseSdkEcdsaDerivationSigningRootId(value) {
-	return requireSdkBindingFactString(value, "signingRootId");
-}
-function parseSdkEcdsaDerivationSigningRootVersion(value) {
-	return requireSdkBindingFactString(value, "signingRootVersion");
-}
-async function computeEcdsaDerivationRoleLocalRelayerKeyId(input) {
-	const evmFamilySigningKeySlotId = deriveEvmFamilySigningKeySlotId$1(input);
-	return `ederivation-relayer-${base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-		version: "threshold_ecdsa_derivation_relayer_key_id_v1",
-		schemeId: THRESHOLD_SECP256K1_ECDSA_2P_V1_SCHEME_ID,
-		walletId: input.walletId,
-		evmFamilySigningKeySlotId
-	})))}`;
-}
-//#endregion
-//#region ../shared-ts/src/utils/ecdsaCapabilityActivation.ts
-function parseNonEmptyString(value, label) {
-	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} must be a non-empty canonical string`);
-	return value;
-}
-function parseCanonicalBase64Url(value, label, byteLength) {
-	if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(`${label} must be unpadded base64url`);
-	let bytes;
-	try {
-		bytes = base64UrlDecode(value);
-	} catch {
-		throw new Error(`${label} must be valid base64url`);
-	}
-	if (bytes.length === 0 || byteLength !== null && bytes.length !== byteLength || base64UrlEncode(bytes) !== value) throw new Error(`${label} has an invalid canonical byte length`);
-	return value;
-}
-function parseEvmFamilyEcdsaSignerId(value) {
-	return parseNonEmptyString(value, "ECDSA signer id");
-}
-function parseEcdsaServerGeneration(value) {
-	return parseNonEmptyString(value, "ECDSA server generation");
-}
-function parseEcdsaCapabilityManifestId(value) {
-	return parseNonEmptyString(value, "ECDSA manifest id");
-}
-function parseEcdsaCapabilityManifestRevision(value) {
-	if (!Number.isSafeInteger(value) || Number(value) < 1) throw new Error("ECDSA manifest revision must be a positive safe integer");
-	return value;
-}
-function parseEcdsaCiphertextDigest(value) {
-	return parseCanonicalBase64Url(value, "ECDSA ciphertext digest", 32);
-}
-function parseEcdsaPendingCiphertextDigest(value) {
-	return parseCanonicalBase64Url(value, "ECDSA pending ciphertext digest", 32);
-}
-function parseEcdsaActivationDigest(value) {
-	return parseCanonicalBase64Url(value, "ECDSA activation digest", 32);
-}
-function parseEcdsaLifecycleId(value) {
-	return parseNonEmptyString(value, "ECDSA lifecycle id");
-}
-function parseEcdsaMaterialSealingKeyId(value) {
-	return parseNonEmptyString(value, "ECDSA material sealing key id");
-}
-function parseEcdsaIv12B64u(value) {
-	return parseCanonicalBase64Url(value, "ECDSA AES-GCM IV", 12);
-}
-function parseEcdsaCiphertextB64u(value) {
-	return parseCanonicalBase64Url(value, "ECDSA ciphertext", null);
-}
-function parseCanonicalEcdsaServerActivationRequest(value) {
-	if (typeof value !== "string" || value.trim() !== value) throw new Error("ECDSA server activation request must be canonical JSON");
-	let parsed;
-	try {
-		parsed = JSON.parse(value);
-	} catch {
-		throw new Error("ECDSA server activation request must be canonical JSON");
-	}
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed) || alphabetizeStringify(parsed) !== value) throw new Error("ECDSA server activation request must be a canonical JSON object");
-	return value;
-}
-//#endregion
-//#region ../shared-ts/src/utils/walletCapabilityBindings.ts
-function objectRecord(raw) {
-	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
-	return raw;
-}
-function trimString(raw) {
-	return typeof raw === "string" ? raw.trim() : "";
-}
-function parseStringField(raw, fieldName) {
-	const value = trimString(raw);
-	if (!value) return {
-		ok: false,
-		error: {
-			code: "missing",
-			message: `${fieldName} is required`
-		}
-	};
-	return {
-		ok: true,
-		value
-	};
-}
-function parseSignerSlot(raw) {
-	const signerSlot = typeof raw === "number" ? raw : Number(raw);
-	if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) return {
-		ok: false,
-		error: {
-			code: "invalid",
-			message: "signerSlot must be an integer >= 1"
-		}
-	};
-	return {
-		ok: true,
-		value: signerSlot
-	};
-}
-function missingObject(typeName) {
-	return {
-		ok: false,
-		error: {
-			code: "invalid",
-			message: `${typeName} must be an object`
-		}
-	};
-}
-function parseRpId(raw) {
-	const parsed = parseWebAuthnRpId(raw);
-	if (!parsed.ok) return {
-		ok: false,
-		error: parsed.error
-	};
-	return {
-		ok: true,
-		value: parsed.value
-	};
-}
-function walletIdentityFromRaw(raw) {
-	const record = objectRecord(raw);
-	if (!record) return missingObject("WalletIdentity");
-	const parsed = parseWalletId(record.walletId);
-	if (!parsed.ok) return {
-		ok: false,
-		error: parsed.error
-	};
-	return {
-		ok: true,
-		value: { walletId: parsed.value }
-	};
-}
-function buildWalletIdentity(args) {
-	return { walletId: args.walletId };
-}
-function passkeyAuthScopeFromRaw(raw) {
-	const record = objectRecord(raw);
-	if (!record) return missingObject("PasskeyAuthScope");
-	const wallet = walletIdentityFromRaw(record.wallet);
-	if (!wallet.ok) return wallet;
-	const rpId = parseRpId(record.rpId);
-	if (!rpId.ok) return rpId;
-	return {
-		ok: true,
-		value: {
-			wallet: wallet.value,
-			rpId: rpId.value
-		}
-	};
-}
-function buildPasskeyAuthScope(args) {
-	return {
-		wallet: args.wallet,
-		rpId: args.rpId
-	};
-}
-function buildPasskeyWalletAuthMethodBinding(args) {
-	const credentialIdB64u = trimString(args.credentialIdB64u);
-	if (!credentialIdB64u) throw new Error("credentialIdB64u is required");
-	return {
-		kind: "passkey",
-		walletAuthMethodId: args.walletAuthMethodId,
-		scope: args.scope,
-		credentialIdB64u
-	};
-}
-function buildEmailOtpWalletAuthMethodBinding(args) {
-	const emailHashHex = trimString(args.emailHashHex);
-	const registrationAuthorityId = trimString(args.registrationAuthorityId);
-	if (!emailHashHex) throw new Error("emailHashHex is required");
-	if (!registrationAuthorityId) throw new Error("registrationAuthorityId is required");
-	return {
-		kind: "email_otp",
-		walletAuthMethodId: args.walletAuthMethodId,
-		wallet: args.wallet,
-		emailHashHex,
-		registrationAuthorityId
-	};
-}
-function walletAuthMethodBindingFromRaw(raw) {
-	const record = objectRecord(raw);
-	if (!record) return missingObject("WalletAuthMethodBinding");
-	const kind = trimString(record.kind);
-	const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
-	if (!walletAuthMethodId.ok) return {
-		ok: false,
-		error: walletAuthMethodId.error
-	};
-	if (kind === "passkey") {
-		const scope = passkeyAuthScopeFromRaw(record.scope);
-		if (!scope.ok) return scope;
-		const credentialIdB64u = parseStringField(record.credentialIdB64u, "credentialIdB64u");
-		if (!credentialIdB64u.ok) return credentialIdB64u;
-		return {
-			ok: true,
-			value: buildPasskeyWalletAuthMethodBinding({
-				walletAuthMethodId: walletAuthMethodId.value,
-				scope: scope.value,
-				credentialIdB64u: credentialIdB64u.value
-			})
-		};
-	}
-	if (kind === "email_otp") {
-		if ("rpId" in record && trimString(record.rpId)) return {
-			ok: false,
-			error: {
-				code: "invalid",
-				message: "Email OTP auth-method binding must not include rpId"
-			}
-		};
-		const wallet = walletIdentityFromRaw(record.wallet);
-		if (!wallet.ok) return wallet;
-		const emailHashHex = parseStringField(record.emailHashHex, "emailHashHex");
-		if (!emailHashHex.ok) return emailHashHex;
-		const registrationAuthorityId = parseStringField(record.registrationAuthorityId, "registrationAuthorityId");
-		if (!registrationAuthorityId.ok) return registrationAuthorityId;
-		return {
-			ok: true,
-			value: buildEmailOtpWalletAuthMethodBinding({
-				walletAuthMethodId: walletAuthMethodId.value,
-				wallet: wallet.value,
-				emailHashHex: emailHashHex.value,
-				registrationAuthorityId: registrationAuthorityId.value
-			})
-		};
-	}
-	return {
-		ok: false,
-		error: {
-			code: "invalid",
-			message: "WalletAuthMethodBinding kind is invalid"
-		}
-	};
-}
-function buildImplicitNearAccountBinding(args) {
-	return {
-		kind: "implicit_near_account",
-		wallet: args.wallet,
-		nearAccountId: args.nearAccountId
-	};
-}
-function buildNamedNearAccountBinding(args) {
-	return {
-		kind: "named_near_account",
-		wallet: args.wallet,
-		nearAccountId: args.nearAccountId
-	};
-}
-function nearAccountBindingFromRaw(raw) {
-	const record = objectRecord(raw);
-	if (!record) return missingObject("NearAccountBinding");
-	const wallet = walletIdentityFromRaw(record.wallet);
-	if (!wallet.ok) return wallet;
-	const kind = trimString(record.kind);
-	if (kind === "implicit_near_account") {
-		const nearAccountId = parseImplicitNearAccountId(record.nearAccountId);
-		if (!nearAccountId.ok) return {
-			ok: false,
-			error: {
-				code: nearAccountId.code,
-				message: nearAccountId.message
-			}
-		};
-		return {
-			ok: true,
-			value: buildImplicitNearAccountBinding({
-				wallet: wallet.value,
-				nearAccountId: nearAccountId.value
-			})
-		};
-	}
-	if (kind === "named_near_account") {
-		const nearAccountId = parseNamedNearAccountId(record.nearAccountId);
-		if (!nearAccountId.ok) return {
-			ok: false,
-			error: {
-				code: nearAccountId.code,
-				message: nearAccountId.message
-			}
-		};
-		return {
-			ok: true,
-			value: buildNamedNearAccountBinding({
-				wallet: wallet.value,
-				nearAccountId: nearAccountId.value
-			})
-		};
-	}
-	return {
-		ok: false,
-		error: {
-			code: "invalid",
-			message: "NearAccountBinding kind is invalid"
-		}
-	};
-}
-function buildNearEd25519SignerBinding(args) {
-	const signerSlot = parseSignerSlot(args.signerSlot);
-	if (!signerSlot.ok) throw new Error(signerSlot.error.message);
-	return {
-		kind: "near_ed25519_signer",
-		account: args.account,
-		nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-		signerSlot: signerSlot.value
-	};
-}
-function nearEd25519SignerBindingFromRaw(raw) {
-	const record = objectRecord(raw);
-	if (!record) return missingObject("NearEd25519SignerBinding");
-	const account = nearAccountBindingFromRaw(record.account);
-	if (!account.ok) return account;
-	const keyScopeRaw = parseStringField(record.nearEd25519SigningKeyId, "nearEd25519SigningKeyId");
-	if (!keyScopeRaw.ok) return keyScopeRaw;
-	const signerSlot = parseSignerSlot(record.signerSlot);
-	if (!signerSlot.ok) return signerSlot;
-	return {
-		ok: true,
-		value: buildNearEd25519SignerBinding({
-			account: account.value,
-			nearEd25519SigningKeyId: nearEd25519SigningKeyIdFromString(keyScopeRaw.value),
-			signerSlot: signerSlot.value
-		})
-	};
-}
-//#endregion
-//#region ../shared-ts/src/utils/thresholdEcdsaKeyHandle.ts
-function parseThresholdEcdsaKeyHandle(value) {
-	const normalized = typeof value === "string" ? value.trim() : "";
-	if (!normalized.startsWith("ederivation-key-")) throw new Error("Threshold ECDSA key handle is invalid");
-	return normalized;
-}
-function requiredString$1(value, field) {
-	const normalized = String(value ?? "").trim();
-	if (!normalized) throw new Error(`[threshold-ecdsa-key-handle] ${field} is required`);
-	return normalized;
-}
-function normalizedSigningRootVersion(value) {
-	return String(value ?? "").trim() || "default";
-}
-async function deriveThresholdEcdsaKeyHandle(input) {
-	return `ederivation-key-${base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-		domain: "seams.threshold_ecdsa.key_handle.v1",
-		ecdsaThresholdKeyId: requiredString$1(input.ecdsaThresholdKeyId, "ecdsaThresholdKeyId"),
-		signingRootId: requiredString$1(input.signingRootId, "signingRootId"),
-		signingRootVersion: normalizedSigningRootVersion(input.signingRootVersion)
-	})))}`;
-}
-//#endregion
-//#region ../shared-ts/src/signing-lanes/participants.ts
-function missing(field) {
-	return {
-		code: "missing",
-		message: `${field} is required`
-	};
-}
-function invalid(field, reason) {
-	return {
-		code: "invalid",
-		message: `${field} ${reason}`
-	};
-}
-function parseIdentityId(raw, field) {
-	if (raw === void 0 || raw === null) return {
-		ok: false,
-		error: missing(field)
-	};
-	if (typeof raw !== "string") return {
-		ok: false,
-		error: invalid(field, "must be a string")
-	};
-	const value = raw.trim();
-	if (!value) return {
-		ok: false,
-		error: missing(field)
-	};
-	if (hasWhitespaceOrControlCharacters(value)) return {
-		ok: false,
-		error: invalid(field, "must not contain whitespace or control characters")
-	};
-	return {
-		ok: true,
-		value
-	};
-}
-function parseHpkePublicKey(raw, field) {
-	if (raw === void 0 || raw === null) return {
-		ok: false,
-		error: missing(field)
-	};
-	if (typeof raw !== "string" || raw.length === 0) return {
-		ok: false,
-		error: invalid(field, "must be non-empty base64url")
-	};
-	try {
-		const bytes = base64UrlDecode(raw);
-		if (bytes.length === 0 || base64UrlEncode(bytes) !== raw) return {
-			ok: false,
-			error: invalid(field, "must be canonical unpadded base64url")
-		};
-	} catch {
-		return {
-			ok: false,
-			error: invalid(field, "must be canonical unpadded base64url")
-		};
-	}
-	return {
-		ok: true,
-		value: raw
-	};
-}
-function parseDigest(raw, field, brand) {
-	if (raw === void 0 || raw === null) return {
-		ok: false,
-		error: missing(field)
-	};
-	try {
-		return {
-			ok: true,
-			value: brand(parseDigestB64u(raw))
-		};
-	} catch {
-		return {
-			ok: false,
-			error: invalid(field, "must be canonical base64url for 32 bytes")
-		};
-	}
-}
-function brandLaneCustodyDigest(value) {
-	return value;
-}
-function brandRecipientDigest(value) {
-	return value;
-}
-function brandParticipantDigest(value) {
-	return value;
-}
-function requireRecord$1(raw, label) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${label} must be an object`);
-	return raw;
-}
-function rejectUnknownFields(record, fields, label) {
-	const allowed = new Set(fields);
-	for (const field of Object.keys(record)) if (!allowed.has(field)) throw new Error(`${label}.${field} is not supported`);
-	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
-}
-function parseLaneHolderParticipantId(raw) {
-	return parseIdentityId(raw, "laneHolderParticipantId");
-}
-function parseSigningWorkerParticipantId(raw) {
-	return parseIdentityId(raw, "signingWorkerParticipantId");
-}
-function parseSigningWorkerRecipientKeyId(raw) {
-	return parseIdentityId(raw, "signingWorkerRecipientKeyId");
-}
-function parseLaneHolderCustodyBindingId(raw) {
-	return parseIdentityId(raw, "laneHolderCustodyBindingId");
-}
-function parseLaneParticipantBindingDigestB64u(raw) {
-	return parseDigest(raw, "participantBindingDigestB64u", brandParticipantDigest);
-}
-function parseLaneCustodyBindingDigestB64u(raw) {
-	return parseDigest(raw, "custodyBindingDigestB64u", brandLaneCustodyDigest);
-}
-function parseSigningWorkerRecipientKeyDigestB64u(raw) {
-	return parseDigest(raw, "hpkePublicKeyDigestB64u", brandRecipientDigest);
-}
-function buildLaneHolderCustodyIdentityV1(args) {
-	return {
-		kind: "lane_holder_custody_identity_v1",
-		custodyBindingId: args.custodyBindingId,
-		custodyBindingDigestB64u: args.custodyBindingDigestB64u
-	};
-}
-function buildSigningWorkerRecipientIdentityV1(args) {
-	return {
-		kind: "signing_worker_recipient_identity_v1",
-		recipientKeyId: args.recipientKeyId,
-		hpkePublicKeyB64u: args.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: args.hpkePublicKeyDigestB64u
-	};
-}
-function parseLaneHolderCustodyIdentityV1(raw, label = "laneHolderCustodyIdentity") {
-	const record = requireRecord$1(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"custodyBindingId",
-		"custodyBindingDigestB64u"
-	], label);
-	if (record.kind !== "lane_holder_custody_identity_v1") throw new Error(`${label}.kind is invalid`);
-	const custodyBindingId = parseLaneHolderCustodyBindingId(record.custodyBindingId);
-	if (!custodyBindingId.ok) throw new Error(`${label}.${custodyBindingId.error.message}`);
-	const custodyBindingDigestB64u = parseLaneCustodyBindingDigestB64u(record.custodyBindingDigestB64u);
-	if (!custodyBindingDigestB64u.ok) throw new Error(`${label}.${custodyBindingDigestB64u.error.message}`);
-	return buildLaneHolderCustodyIdentityV1({
-		custodyBindingId: custodyBindingId.value,
-		custodyBindingDigestB64u: custodyBindingDigestB64u.value
-	});
-}
-function parseSigningWorkerRecipientIdentityV1(raw, label = "signingWorkerRecipientIdentity") {
-	const record = requireRecord$1(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"recipientKeyId",
-		"hpkePublicKeyB64u",
-		"hpkePublicKeyDigestB64u"
-	], label);
-	if (record.kind !== "signing_worker_recipient_identity_v1") throw new Error(`${label}.kind is invalid`);
-	const recipientKeyId = parseSigningWorkerRecipientKeyId(record.recipientKeyId);
-	if (!recipientKeyId.ok) throw new Error(`${label}.${recipientKeyId.error.message}`);
-	const hpkePublicKeyB64u = parseHpkePublicKey(record.hpkePublicKeyB64u, `${label}.hpkePublicKeyB64u`);
-	if (!hpkePublicKeyB64u.ok) throw new Error(hpkePublicKeyB64u.error.message);
-	const hpkePublicKeyDigestB64u = parseSigningWorkerRecipientKeyDigestB64u(record.hpkePublicKeyDigestB64u);
-	if (!hpkePublicKeyDigestB64u.ok) throw new Error(`${label}.${hpkePublicKeyDigestB64u.error.message}`);
-	return buildSigningWorkerRecipientIdentityV1({
-		recipientKeyId: recipientKeyId.value,
-		hpkePublicKeyB64u: hpkePublicKeyB64u.value,
-		hpkePublicKeyDigestB64u: hpkePublicKeyDigestB64u.value
-	});
-}
-function buildLaneHolderParticipantRecordV1(args) {
-	return {
-		kind: "lane_holder_participant_v1",
-		participantId: args.participantId,
-		custodyBindingId: args.custody.custodyBindingId,
-		custodyBindingDigestB64u: args.custody.custodyBindingDigestB64u,
-		hpkePublicKeyB64u: args.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: args.hpkePublicKeyDigestB64u,
-		participantBindingDigestB64u: args.participantBindingDigestB64u
-	};
-}
-function buildSigningWorkerParticipantRecordV1(args) {
-	return {
-		kind: "signing_worker_participant_v1",
-		participantId: args.participantId,
-		recipientKeyId: args.recipient.recipientKeyId,
-		hpkePublicKeyB64u: args.recipient.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: args.recipient.hpkePublicKeyDigestB64u,
-		participantBindingDigestB64u: args.participantBindingDigestB64u
-	};
-}
-function parseLaneHolderParticipantRecordV1(raw, label = "laneHolderParticipant") {
-	const record = requireRecord$1(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"participantId",
-		"custodyBindingId",
-		"custodyBindingDigestB64u",
-		"hpkePublicKeyB64u",
-		"hpkePublicKeyDigestB64u",
-		"participantBindingDigestB64u"
-	], label);
-	if (record.kind !== "lane_holder_participant_v1") throw new Error(`${label}.kind is invalid`);
-	const participantId = parseLaneHolderParticipantId(record.participantId);
-	if (!participantId.ok) throw new Error(`${label}.${participantId.error.message}`);
-	const custody = parseLaneHolderCustodyIdentityV1({
-		kind: "lane_holder_custody_identity_v1",
-		custodyBindingId: record.custodyBindingId,
-		custodyBindingDigestB64u: record.custodyBindingDigestB64u
-	}, `${label}.custody`);
-	const hpkePublicKeyB64u = parseHpkePublicKey(record.hpkePublicKeyB64u, `${label}.hpkePublicKeyB64u`);
-	if (!hpkePublicKeyB64u.ok) throw new Error(hpkePublicKeyB64u.error.message);
-	const hpkePublicKeyDigestB64u = parseSigningWorkerRecipientKeyDigestB64u(record.hpkePublicKeyDigestB64u);
-	if (!hpkePublicKeyDigestB64u.ok) throw new Error(`${label}.${hpkePublicKeyDigestB64u.error.message}`);
-	const participantBindingDigestB64u = parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u);
-	if (!participantBindingDigestB64u.ok) throw new Error(`${label}.${participantBindingDigestB64u.error.message}`);
-	return buildLaneHolderParticipantRecordV1({
-		participantId: participantId.value,
-		custody,
-		hpkePublicKeyB64u: hpkePublicKeyB64u.value,
-		hpkePublicKeyDigestB64u: hpkePublicKeyDigestB64u.value,
-		participantBindingDigestB64u: participantBindingDigestB64u.value
-	});
-}
-function parseSigningWorkerParticipantRecordV1(raw, label = "signingWorkerParticipant") {
-	const record = requireRecord$1(raw, label);
-	rejectUnknownFields(record, [
-		"kind",
-		"participantId",
-		"recipientKeyId",
-		"hpkePublicKeyB64u",
-		"hpkePublicKeyDigestB64u",
-		"participantBindingDigestB64u"
-	], label);
-	if (record.kind !== "signing_worker_participant_v1") throw new Error(`${label}.kind is invalid`);
-	const participantId = parseSigningWorkerParticipantId(record.participantId);
-	if (!participantId.ok) throw new Error(`${label}.${participantId.error.message}`);
-	const recipient = parseSigningWorkerRecipientIdentityV1({
-		kind: "signing_worker_recipient_identity_v1",
-		recipientKeyId: record.recipientKeyId,
-		hpkePublicKeyB64u: record.hpkePublicKeyB64u,
-		hpkePublicKeyDigestB64u: record.hpkePublicKeyDigestB64u
-	}, `${label}.recipient`);
-	const participantBindingDigestB64u = parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u);
-	if (!participantBindingDigestB64u.ok) throw new Error(`${label}.${participantBindingDigestB64u.error.message}`);
-	return buildSigningWorkerParticipantRecordV1({
-		participantId: participantId.value,
-		recipient,
-		participantBindingDigestB64u: participantBindingDigestB64u.value
-	});
-}
-//#endregion
-//#region ../shared-ts/src/signing-lanes/ownerContinuity.ts
-const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
-	"kind",
-	"signerId",
-	"participantIds",
-	"signingWorkerId",
-	"custodyKeyManifestDigestB64u",
-	"sourceIdentityDigestB64u"
-];
-function requireResult(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
-/** Parse the owner signer identity without widening it into a generic string. */
-function parseWalletSignerId(raw, label = "walletSignerId") {
-	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
-	const value = raw.trim();
-	if (!value) throw new Error(`${label} is required`);
-	if (hasWhitespaceOrControlCharacters(value)) throw new Error(`${label} must not contain whitespace or control characters`);
-	return value;
-}
-function parseParticipantId(raw, label) {
-	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw new Error(`${label} must be a positive safe integer`);
-	return raw;
-}
-function parseParticipantIds(raw, label) {
-	if (!Array.isArray(raw) || raw.length !== 2) throw new Error(`${label} must contain exactly two participant ids`);
-	const first = parseParticipantId(raw[0], `${label}[0]`);
-	const second = parseParticipantId(raw[1], `${label}[1]`);
-	if (first === second) throw new Error(`${label} must contain distinct participant ids`);
-	return [first, second];
-}
-function buildOwnerLaneParticipantContinuityV1(args) {
-	const participantIds = parseParticipantIds(args.participantIds, "participantIds");
-	return {
-		kind: "owner_lane_participant_continuity_v1",
-		signerId: parseWalletSignerId(args.signerId),
-		participantIds,
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
-		custodyKeyManifestDigestB64u: parseDigestField(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
-		sourceIdentityDigestB64u: parseDigestField(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
-	};
-}
-function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantContinuity") {
-	const record = requireRecord$2(raw, label);
-	rejectUnknownFields$1(record, OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS, label);
-	if (record.kind !== "owner_lane_participant_continuity_v1") throw new Error(`${label}.kind must be owner_lane_participant_continuity_v1`);
-	return buildOwnerLaneParticipantContinuityV1({
-		signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
-		participantIds: parseParticipantIds(record.participantIds, `${label}.participantIds`),
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
-		custodyKeyManifestDigestB64u: parseDigestField(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
-		sourceIdentityDigestB64u: parseDigestField(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
-	});
-}
-new TextEncoder();
-//#endregion
-//#region src/core/signingEngine/session/identity/exactSigningLaneIdentity.ts
-function assertNeverExactLane(value) {
-	throw new Error(`[SigningSession] unsupported exact signing lane branch: ${String(value)}`);
-}
-function requireRecord(value, field) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`[SigningSession] ${field} must be an object`);
-	return value;
-}
-function requireString(value, field) {
-	const normalized = String(value ?? "").trim();
-	if (!normalized) throw new Error(`[SigningSession] ${field} is required`);
-	return normalized;
-}
-function rejectPresent(record, fields, branch) {
-	for (const field of fields) if (record[field] !== void 0) throw new Error(`[SigningSession] ${branch} exact lane cannot include ${field}`);
-}
-function parseSigningLaneAuthBinding(value) {
-	const auth = requireRecord(value, "exact lane auth");
-	switch (auth.kind) {
-		case "passkey": return {
-			kind: "passkey",
-			rpId: toRpId(auth.rpId),
-			credentialIdB64u: requireString(auth.credentialIdB64u, "credentialIdB64u")
-		};
-		case "email_otp": return {
-			kind: "email_otp",
-			providerSubjectId: requireString(auth.providerSubjectId, "providerSubjectId")
-		};
-		default: throw new Error("[SigningSession] exact lane auth kind is unsupported");
-	}
-}
-function parseExactLaneChainTarget(value) {
-	const target = requireRecord(value, "ECDSA exact lane chainTarget");
-	const parsed = thresholdEcdsaChainTargetFromRequest({
-		kind: target.kind,
-		namespace: target.namespace,
-		chainId: target.chainId,
-		networkSlug: target.networkSlug
-	});
-	if (target.key != null && String(target.key) !== thresholdEcdsaChainTargetKey(parsed)) throw new Error("[SigningSession] exact ECDSA lane chain target key mismatch");
-	return parsed;
-}
-function parseEvmFamilyEcdsaKeyIdentity(value) {
-	const key = requireRecord(value, "ECDSA exact lane key identity");
-	if (key.keyScope !== "evm-family") throw new Error("[SigningSession] exact ECDSA lane keyScope must be evm-family");
-	return buildBaseEvmFamilyEcdsaKeyIdentity({
-		walletId: key.walletId,
-		ecdsaThresholdKeyId: key.ecdsaThresholdKeyId,
-		signingRootId: key.signingRootId,
-		signingRootVersion: key.signingRootVersion,
-		participantIds: key.participantIds,
-		thresholdOwnerAddress: key.thresholdOwnerAddress
-	});
-}
-function parseExactLaneMaterialActivation(value) {
-	const parsed = parseMpcMaterialActivationRef(value);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-function nearAccountBindingForIdentity(args) {
-	const parsedNearAccountId = parseNearAccountId(args.nearAccountId);
-	if (!parsedNearAccountId.ok) throw new Error(`[SigningSession] invalid exact Ed25519 NEAR account: ${parsedNearAccountId.message}`);
-	const wallet = buildWalletIdentity({ walletId: toWalletId(args.walletId) });
-	if (isImplicitNearAccountId(parsedNearAccountId.value)) return buildImplicitNearAccountBinding({
-		wallet,
-		nearAccountId: parsedNearAccountId.value
-	});
-	return buildNamedNearAccountBinding({
-		wallet,
-		nearAccountId: parsedNearAccountId.value
-	});
-}
-function nearEd25519SignerBindingFromBoundaryFields(input) {
-	const signerSlot = Number(input.signerSlot);
-	if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) throw new Error("[SigningSession] exact Ed25519 signer requires signerSlot >= 1");
-	return buildNearEd25519SignerBinding({
-		account: nearAccountBindingForIdentity({
-			walletId: input.walletId,
-			nearAccountId: input.nearAccountId
-		}),
-		nearEd25519SigningKeyId: input.nearEd25519SigningKeyId,
-		signerSlot
-	});
-}
-function buildEvmFamilyEcdsaSignerBinding(args) {
-	if (String(args.key.walletId) !== String(args.walletId)) throw new Error("[SigningSession] exact ECDSA lane identity wallet mismatch");
-	const materialActivation = parseExactLaneMaterialActivation(args.materialActivation);
-	if (String(materialActivation.materialOwner) !== String(args.walletId)) throw new Error("[SigningSession] exact ECDSA lane material owner mismatch");
-	return {
-		kind: "evm_family_ecdsa_signer",
-		walletId: toWalletId(args.walletId),
-		chainTarget: args.chainTarget,
-		keyHandle: args.keyHandle,
-		key: args.key,
-		materialActivation
-	};
-}
-function parseEvmFamilyEcdsaSignerBinding(value) {
-	const signer = requireRecord(value, "ECDSA exact lane signer");
-	if (signer.kind !== "evm_family_ecdsa_signer") throw new Error("[SigningSession] expected EVM-family ECDSA signer");
-	const chainTarget = parseExactLaneChainTarget(signer.chainTarget);
-	const key = parseEvmFamilyEcdsaKeyIdentity(signer.key);
-	return buildEvmFamilyEcdsaSignerBinding({
-		walletId: toWalletId(signer.walletId),
-		chainTarget,
-		keyHandle: toEvmFamilyEcdsaKeyHandle(signer.keyHandle),
-		key,
-		materialActivation: parseExactLaneMaterialActivation(signer.materialActivation)
-	});
-}
-function canonicalChainTarget(target) {
-	if (target.kind === "evm") return {
-		key: thresholdEcdsaChainTargetKey(target),
-		kind: "evm",
-		namespace: "eip155",
-		chainId: target.chainId
-	};
-	return {
-		key: thresholdEcdsaChainTargetKey(target),
-		kind: "tempo",
-		chainId: target.chainId
-	};
-}
-function canonicalKeyIdentity(key) {
-	return {
-		walletId: String(key.walletId),
-		keyScope: key.keyScope,
-		ecdsaThresholdKeyId: String(key.ecdsaThresholdKeyId),
-		signingRootId: String(key.signingRootId),
-		signingRootVersion: String(key.signingRootVersion),
-		participantIds: [...key.participantIds].map((id) => Number(id)),
-		thresholdOwnerAddress: String(key.thresholdOwnerAddress).toLowerCase()
-	};
-}
-function canonicalAuthBinding(auth) {
-	switch (auth.kind) {
-		case "passkey": return {
-			kind: "passkey",
-			rpId: String(auth.rpId),
-			credentialIdB64u: String(auth.credentialIdB64u)
-		};
-		case "email_otp": return {
-			kind: "email_otp",
-			providerSubjectId: String(auth.providerSubjectId)
-		};
-		default: return assertNeverExactLane(auth);
-	}
-}
-function canonicalSigner(signer) {
-	return {
-		kind: "evm_family_ecdsa_signer",
-		walletId: String(signer.walletId),
-		keyHandle: String(signer.keyHandle),
-		chainTarget: canonicalChainTarget(signer.chainTarget),
-		key: canonicalKeyIdentity(signer.key),
-		materialActivation: {
-			kind: signer.materialActivation.kind,
-			activationId: String(signer.materialActivation.activationId),
-			capability: String(signer.materialActivation.capability),
-			materialOwner: String(signer.materialActivation.materialOwner),
-			keyBinding: String(signer.materialActivation.keyBinding),
-			lifecycleBinding: String(signer.materialActivation.lifecycleBinding),
-			signingWorker: String(signer.materialActivation.signingWorker)
-		}
-	};
-}
-function canonicalExactSigningLaneIdentity(identity) {
-	if (isExactEcdsaSigningLaneIdentity(identity)) return {
-		kind: "exact_signing_lane",
-		signer: canonicalSigner(identity.signer),
-		auth: canonicalAuthBinding(identity.auth)
-	};
-	return {
-		kind: "exact_signing_lane",
-		signer: {
-			kind: "near_ed25519_signer",
-			account: {
-				kind: identity.signer.account.kind,
-				walletId: String(identity.signer.account.wallet.walletId),
-				nearAccountId: String(identity.signer.account.nearAccountId)
-			},
-			nearEd25519SigningKeyId: String(identity.signer.nearEd25519SigningKeyId),
-			signerSlot: Number(identity.signer.signerSlot)
-		},
-		auth: canonicalAuthBinding(identity.auth),
-		walletSessionId: String(identity.walletSessionId),
-		quotaId: String(identity.quotaId),
-		thresholdSessionId: String(identity.thresholdSessionId)
-	};
-}
-function exactSigningLaneIdentityKey(identity) {
-	return alphabetizeStringify(canonicalExactSigningLaneIdentity(identity));
-}
-function exactEd25519SigningLaneIdentity(lane) {
-	return {
-		kind: "exact_signing_lane",
-		signer: lane.signer,
-		auth: lane.auth,
-		walletSessionId: SigningSessionIds.walletSession(lane.walletSessionId),
-		quotaId: SigningSessionIds.walletSessionQuota(lane.quotaId),
-		thresholdSessionId: SigningSessionIds.thresholdEd25519Session(lane.thresholdSessionId)
-	};
-}
-function exactEd25519ExportMaterialIdentity(lane) {
-	return {
-		kind: "exact_ed25519_export_material",
-		signer: lane.signer,
-		auth: lane.auth,
-		thresholdSessionId: SigningSessionIds.thresholdEd25519Session(lane.thresholdSessionId)
-	};
-}
-function exactEcdsaSigningLaneIdentity(lane) {
-	return {
-		kind: "exact_signing_lane",
-		signer: lane.signer,
-		auth: lane.auth
-	};
-}
-function exactSigningLaneIdentityFromSelectedLane(lane) {
-	return lane.identity;
-}
-function exactEd25519SigningLaneIdentityFromSelectedLane(lane) {
-	return lane.identity;
-}
-function exactEcdsaSigningLaneIdentityFromSelectedLane(lane) {
-	return lane.identity;
-}
-function parseExactEd25519ExportMaterialIdentity(value) {
-	const lane = requireRecord(value, "exact Ed25519 export material identity");
-	if (lane.kind !== "exact_ed25519_export_material") throw new Error("[SigningSession] expected exact Ed25519 export material identity");
-	rejectPresent(lane, [
-		"walletSessionId",
-		"quotaId",
-		"walletId",
-		"nearAccountId",
-		"nearEd25519SigningKeyId",
-		"chainTarget",
-		"keyHandle",
-		"key",
-		"curve",
-		"chainFamily",
-		"accountId",
-		"subjectId",
-		"authMethod",
-		"authorization"
-	], "nested");
-	const signer = nearEd25519SignerBindingFromRaw(requireRecord(lane.signer, "exact Ed25519 export material signer"));
-	if (!signer.ok) throw new Error(signer.error.message);
-	return exactEd25519ExportMaterialIdentity({
-		signer: signer.value,
-		auth: parseSigningLaneAuthBinding(lane.auth),
-		thresholdSessionId: lane.thresholdSessionId
-	});
-}
-function parseExactEcdsaSigningLaneIdentity(value) {
-	const identity = parseExactSigningLaneIdentity(value);
-	if (isExactEcdsaSigningLaneIdentity(identity)) return identity;
-	throw new Error("[SigningSession] expected exact ECDSA lane identity");
-}
-function parseExactSigningLaneIdentity(value) {
-	const lane = requireRecord(value, "exact signing lane identity");
-	if (lane.kind !== "exact_signing_lane") throw new Error("[SigningSession] expected exact signing lane identity");
-	rejectPresent(lane, [
-		"walletId",
-		"nearAccountId",
-		"nearEd25519SigningKeyId",
-		"chainTarget",
-		"keyHandle",
-		"key",
-		"curve",
-		"chainFamily",
-		"accountId",
-		"subjectId",
-		"authMethod",
-		"authorization"
-	], "nested");
-	const signerRecord = requireRecord(lane.signer, "exact lane signer");
-	const auth = parseSigningLaneAuthBinding(lane.auth);
-	switch (signerRecord.kind) {
-		case "near_ed25519_signer": {
-			const signer = nearEd25519SignerBindingFromRaw(signerRecord);
-			if (!signer.ok) throw new Error(signer.error.message);
-			return exactEd25519SigningLaneIdentity({
-				signer: signer.value,
-				auth,
-				walletSessionId: lane.walletSessionId,
-				quotaId: lane.quotaId,
-				thresholdSessionId: lane.thresholdSessionId
-			});
-		}
-		case "evm_family_ecdsa_signer": return exactEcdsaSigningLaneIdentity({
-			signer: parseEvmFamilyEcdsaSignerBinding(signerRecord),
-			auth
-		});
-		default: throw new Error("[SigningSession] exact signing lane signer kind is unsupported");
-	}
-}
-function isExactEcdsaSigningLaneIdentity(identity) {
-	return identity.signer.kind === "evm_family_ecdsa_signer";
-}
-function exactSigningLaneWalletId(identity) {
-	switch (identity.signer.kind) {
-		case "near_ed25519_signer": return identity.signer.account.wallet.walletId;
-		case "evm_family_ecdsa_signer": return identity.signer.walletId;
-		default: return assertNeverExactLane(identity.signer);
-	}
-}
-function requireEvmFamilyEcdsaSigner(identity, context) {
-	if (identity.signer.kind !== "evm_family_ecdsa_signer") throw new Error(`[SigningSession] ${context} requires an EVM-family ECDSA signer`);
-	return identity.signer;
-}
-function requireNearEd25519Signer(identity, context) {
-	if (identity.signer.kind !== "near_ed25519_signer") throw new Error(`[SigningSession] ${context} requires a NEAR Ed25519 signer`);
-	return identity.signer;
-}
-function nearProtocolProjectionFromExactLane(identity, context = "NEAR protocol projection") {
-	const signer = requireNearEd25519Signer(identity, context);
-	return {
-		walletId: signer.account.wallet.walletId,
-		nearAccountId: signer.account.nearAccountId,
-		nearEd25519SigningKeyId: signer.nearEd25519SigningKeyId,
-		signerSlot: signer.signerSlot
-	};
-}
-function exactSigningLaneIdentityMatches(left, right) {
-	return exactSigningLaneIdentityKey(left) === exactSigningLaneIdentityKey(right);
-}
-//#endregion
-//#region src/core/signingEngine/session/identity/signingLaneAuthBinding.ts
-function signingLaneAuthMethod(auth) {
-	switch (auth.kind) {
-		case SIGNER_AUTH_METHODS.passkey: return SIGNER_AUTH_METHODS.passkey;
-		case SIGNER_AUTH_METHODS.emailOtp: return SIGNER_AUTH_METHODS.emailOtp;
-	}
-	throw new Error("[SigningSession] unsupported signing lane auth binding");
-}
-function requireSigningLaneAuthKeyPart(value, label) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`[SigningSession] ${label} is required for signing lane authority`);
-	return normalized;
-}
-function signingLaneAuthBindingKey(auth) {
-	switch (auth.kind) {
-		case SIGNER_AUTH_METHODS.passkey: return [
-			SIGNER_AUTH_METHODS.passkey,
-			requireSigningLaneAuthKeyPart(String(auth.rpId), "passkey rpId"),
-			requireSigningLaneAuthKeyPart(auth.credentialIdB64u, "passkey credential")
-		].join(":");
-		case SIGNER_AUTH_METHODS.emailOtp: return [SIGNER_AUTH_METHODS.emailOtp, requireSigningLaneAuthKeyPart(auth.providerSubjectId, "Email OTP provider subject")].join(":");
-	}
-	throw new Error("[SigningSession] unsupported signing lane auth binding");
-}
-//#endregion
-//#region src/core/signingEngine/session/operationState/types.ts
-const SigningOperationIntent = { TransactionSign: "transaction_sign" };
-const SigningKeyRefIntentKind = {
-	Cached: "cached",
-	Reauth: "reauth"
-};
-const SigningSessionPlanKind = {
-	WarmSession: "warm_session",
-	EmailOtpReauth: "email_otp_reauth",
-	PasskeyReauth: "passkey_reauth",
-	NotReady: "not_ready",
-	OperationStepUp: "operation_step_up"
-};
-function toRequiredBrandedString(value, label) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`[SigningSession] ${label} is required`);
-	return normalized;
-}
-function requireDomainId(result, label) {
-	if (!result.ok) throw new Error(`[SigningSession] ${result.error.message || `${label} is required`}`);
-	return result.value;
-}
-function requireAuthorizationId(result, label) {
-	if (!result.ok) throw new Error(`[SigningSession] ${result.error.message || `${label} is required`}`);
-	return result.value;
-}
-const SigningSessionIds = {
-	walletSession(value) {
-		return requireAuthorizationId(parseWalletSessionId(value), "walletSessionId");
-	},
-	walletSessionQuota(value) {
-		return requireAuthorizationId(parseMpcWalletSigningQuotaId(value), "quotaId");
-	},
-	thresholdEd25519Session(value) {
-		return requireDomainId(parseThresholdEd25519SessionId(value), "thresholdEd25519SessionId");
-	},
-	thresholdEcdsaSession(value) {
-		return requireDomainId(parseThresholdEcdsaSessionId(value), "thresholdEcdsaSessionId");
-	},
-	emailOtpChallenge(value) {
-		return requireDomainId(parseEmailOtpChallengeId(value), "emailOtpChallengeId");
-	},
-	signingOperation(value) {
-		return toRequiredBrandedString(value, "signingOperationId");
-	},
-	signingOperationFingerprint(value) {
-		return toRequiredBrandedString(value, "signingOperationFingerprint");
-	}
-};
-function summarizeSigningLane(lane) {
-	const signer = lane.identity.signer;
-	const summary = {
-		authMethod: signingLaneAuthMethod(lane.auth),
-		curve: lane.curve,
-		keyKind: lane.keyKind,
-		chainFamily: lane.chainFamily,
-		sessionOrigin: lane.sessionOrigin,
-		storageSource: lane.storageSource,
-		retention: lane.retention
-	};
-	switch (signer.kind) {
-		case "evm_family_ecdsa_signer": return {
-			...summary,
-			curve: "ecdsa",
-			walletId: signer.walletId
-		};
-		case "near_ed25519_signer": return {
-			...summary,
-			curve: "ed25519",
-			walletId: signer.account.wallet.walletId,
-			nearAccountId: signer.account.nearAccountId,
-			nearEd25519SigningKeyId: signer.nearEd25519SigningKeyId
-		};
-	}
-}
-function summarizeSigningSessionPlan(plan) {
-	return {
-		kind: plan.kind,
-		lane: summarizeSigningLane(plan.lane)
-	};
-}
-//#endregion
-//#region src/core/signingEngine/session/identity/evmFamilyEcdsaIdentity.ts
-function requiredString(value, field) {
-	const normalized = String(value ?? "").trim();
-	if (!normalized) throw new Error(`[evm-family-ecdsa] ${field} is required`);
-	return normalized;
-}
-function normalizeRpId(value) {
-	return requiredString(value, "rpId");
-}
-function deriveEvmFamilySigningKeySlotId(input) {
-	return deriveEvmFamilySigningKeySlotId$1({
-		walletId: toWalletId(input.walletId),
-		signingRootId: normalizeSigningRootId(input.signingRootId),
-		signingRootVersion: normalizeSigningRootVersion(input.signingRootVersion)
-	});
-}
-function normalizeEcdsaThresholdKeyId(value) {
-	return requiredString(value, "ecdsaThresholdKeyId");
-}
-function normalizeSigningRootId(value) {
-	return requiredString(value, "signingRootId");
-}
-function normalizeSigningRootVersion(value) {
-	return String(value ?? "").trim() || "default";
-}
-function normalizeThresholdOwnerAddress(value) {
-	const normalized = String(value ?? "").trim().toLowerCase();
-	if (!/^0x[0-9a-f]{40}$/.test(normalized)) throw new Error("[evm-family-ecdsa] thresholdOwnerAddress must be an EVM address");
-	return normalized;
-}
-function toThresholdOwnerAddress(value) {
-	return normalizeThresholdOwnerAddress(value);
-}
-function toRpId(value) {
-	return normalizeRpId(value);
-}
-function toEvmFamilyEcdsaKeyHandle(value) {
-	return requiredString(value, "keyHandle");
-}
-function resolveThresholdEcdsaKeyIdFromRecord(args) {
-	return normalizeEcdsaThresholdKeyId(String(args.record.ecdsaThresholdKeyId ?? "").trim());
-}
-function parseThresholdSigningRootBinding(input) {
-	return {
-		signingRootId: normalizeSigningRootId(input.signingRootId),
-		signingRootVersion: normalizeSigningRootVersion(input.signingRootVersion)
-	};
-}
-function resolveThresholdSigningRootBindingFromRecord(args) {
-	return parseThresholdSigningRootBinding({
-		signingRootId: args.record.signingRootId,
-		signingRootVersion: args.record.signingRootVersion
-	});
-}
-function resolveThresholdSigningRootBindingFromRuntimePolicyScope(args) {
-	const scopeBinding = signingRootScopeFromRuntimePolicyScope(args.runtimePolicyScope);
-	return parseThresholdSigningRootBinding({
-		signingRootId: scopeBinding.signingRootId,
-		signingRootVersion: scopeBinding.signingRootVersion
-	});
-}
-function toThresholdEcdsaPublicKeyB64u(value) {
-	const normalized = requiredString(value, "thresholdEcdsaPublicKeyB64u");
-	let bytes;
-	try {
-		bytes = base64UrlDecode(normalized);
-	} catch {
-		throw new Error("[evm-family-ecdsa] thresholdEcdsaPublicKeyB64u must be base64url");
-	}
-	if (bytes.length !== 33) throw new Error("[evm-family-ecdsa] thresholdEcdsaPublicKeyB64u must decode to 33 bytes");
-	return normalized;
-}
-function toParticipantId(value) {
-	const normalized = Math.floor(Number(value));
-	if (!Number.isSafeInteger(normalized) || normalized < 1 || normalized > 65535) throw new Error("[evm-family-ecdsa] participantId must be a positive safe integer");
-	return normalized;
-}
-function normalizeParticipantIds(value) {
-	const participantIds = normalizeThresholdEd25519ParticipantIds(value);
-	if (!participantIds?.length) throw new Error("[evm-family-ecdsa] participantIds are required");
-	return participantIds.map(toParticipantId);
-}
-function participantIdKey(participantIds) {
-	return participantIds.map((id) => String(Number(id))).join(",");
-}
-function fnv1a32Hex(input) {
-	let hash = 2166136261;
-	for (let index = 0; index < input.length; index += 1) {
-		hash ^= input.charCodeAt(index);
-		hash = Math.imul(hash, 16777619) >>> 0;
-	}
-	return hash.toString(16).padStart(8, "0");
-}
-function buildNormalizedEvmFamilyEcdsaKeyIdentity(input) {
-	return {
-		walletId: input.walletId,
-		keyScope: "evm-family",
-		ecdsaThresholdKeyId: normalizeEcdsaThresholdKeyId(input.ecdsaThresholdKeyId),
-		signingRootId: normalizeSigningRootId(input.signingRootId),
-		signingRootVersion: normalizeSigningRootVersion(input.signingRootVersion),
-		participantIds: normalizeParticipantIds(input.participantIds),
-		thresholdOwnerAddress: normalizeThresholdOwnerAddress(input.thresholdOwnerAddress)
-	};
-}
-function buildBaseEvmFamilyEcdsaKeyIdentity(input) {
-	return buildNormalizedEvmFamilyEcdsaKeyIdentity({
-		walletId: toWalletId(input.walletId),
-		ecdsaThresholdKeyId: input.ecdsaThresholdKeyId,
-		signingRootId: input.signingRootId,
-		signingRootVersion: input.signingRootVersion,
-		participantIds: input.participantIds,
-		thresholdOwnerAddress: input.thresholdOwnerAddress
-	});
-}
-function deriveBaseEcdsaSubjectIdFromWalletId(walletId) {
-	return walletIdFromWalletProfile({ walletId: toWalletId(walletId) });
-}
-async function deriveEvmFamilyEcdsaKeyHandle(input) {
-	return await deriveThresholdEcdsaKeyHandle(input);
-}
-function buildVerifiedEcdsaPublicFacts(input) {
-	return {
-		kind: "verified_ecdsa_public_facts",
-		keyHandle: input.keyHandle,
-		publicKeyB64u: toThresholdEcdsaPublicKeyB64u(input.publicKeyB64u),
-		participantIds: normalizeParticipantIds(input.participantIds),
-		thresholdOwnerAddress: normalizeThresholdOwnerAddress(input.thresholdOwnerAddress)
-	};
-}
-function evmFamilyEcdsaWalletKeyToIdentity(walletKey) {
-	return {
-		walletId: walletKey.walletId,
-		keyScope: walletKey.keyFacts.keyScope,
-		ecdsaThresholdKeyId: walletKey.keyFacts.ecdsaThresholdKeyId,
-		signingRootId: walletKey.keyFacts.signingRootId,
-		signingRootVersion: walletKey.keyFacts.signingRootVersion,
-		participantIds: walletKey.keyFacts.participantIds,
-		thresholdOwnerAddress: walletKey.keyFacts.thresholdOwnerAddress
-	};
-}
-function buildEvmFamilyEcdsaWalletKey(input) {
-	const keyHandle = toEvmFamilyEcdsaKeyHandle(input.keyHandle);
-	const keyIdentity = buildBaseEvmFamilyEcdsaKeyIdentity(input);
-	const publicFacts = buildVerifiedEcdsaPublicFacts({
-		keyHandle,
-		publicKeyB64u: input.thresholdEcdsaPublicKeyB64u,
-		participantIds: keyIdentity.participantIds,
-		thresholdOwnerAddress: keyIdentity.thresholdOwnerAddress
-	});
-	return {
-		kind: "evm_family_ecdsa_wallet_key",
-		walletId: keyIdentity.walletId,
-		keyHandle,
-		chainTarget: input.chainTarget,
-		keyFacts: {
-			kind: "evm_family_ecdsa_key_facts",
-			keyScope: keyIdentity.keyScope,
-			ecdsaThresholdKeyId: keyIdentity.ecdsaThresholdKeyId,
-			signingRootId: keyIdentity.signingRootId,
-			signingRootVersion: keyIdentity.signingRootVersion,
-			participantIds: publicFacts.participantIds,
-			thresholdOwnerAddress: publicFacts.thresholdOwnerAddress,
-			thresholdEcdsaPublicKeyB64u: publicFacts.publicKeyB64u
-		}
-	};
-}
-function assertMatchingVerifiedEcdsaPublicFacts(args) {
-	const mismatches = [];
-	if (String(args.expected.keyHandle) !== String(args.actual.keyHandle)) mismatches.push("keyHandle");
-	if (String(args.expected.publicKeyB64u) !== String(args.actual.publicKeyB64u)) mismatches.push("publicKeyB64u");
-	if (participantIdKey(args.expected.participantIds) !== participantIdKey(args.actual.participantIds)) mismatches.push("participantIds");
-	if (String(args.expected.thresholdOwnerAddress) !== String(args.actual.thresholdOwnerAddress)) mismatches.push("thresholdOwnerAddress");
-	if (mismatches.length) throw new Error(`[evm-family-ecdsa] ${args.context} public facts mismatch: ${mismatches.join(", ")}`);
-}
-function buildPasskeyEcdsaAuthBinding(args) {
-	return {
-		kind: "passkey_ecdsa_auth_binding",
-		authMethod: SIGNER_AUTH_METHODS.passkey,
-		rpId: normalizeRpId(args.rpId),
-		credentialIdB64u: requiredString(args.credentialIdB64u, "credentialIdB64u")
-	};
-}
-function buildResolvedEvmFamilyEcdsaKey(input) {
-	return {
-		kind: "resolved_evm_family_ecdsa_key",
-		walletId: toWalletId(input.walletId),
-		publicFacts: input.publicFacts,
-		authBinding: input.authBinding
-	};
-}
-function buildHydratedEcdsaSignerMaterial(input) {
-	return {
-		kind: "hydrated_ecdsa_signer_material",
-		walletId: input.walletId,
-		materialActivation: input.materialActivation,
-		publicFacts: input.publicFacts,
-		chainTarget: input.chainTarget,
-		transport: input.transport,
-		clientShare: input.clientShare,
-		routerAbEcdsaDerivationNormalSigning: input.routerAbEcdsaDerivationNormalSigning
-	};
-}
-function buildEvmFamilyEcdsaSessionLanePolicy(input) {
-	const ttlMs = Math.floor(Number(input.ttlMs));
-	const remainingUses = Math.floor(Number(input.remainingUses));
-	if (!Number.isFinite(ttlMs) || ttlMs <= 0) throw new Error("[evm-family-ecdsa] ttlMs must be a positive finite value");
-	if (!Number.isFinite(remainingUses) || remainingUses <= 0) throw new Error("[evm-family-ecdsa] remainingUses must be a positive finite value");
-	return {
-		chainTarget: input.chainTarget,
-		thresholdSessionId: SigningSessionIds.thresholdEcdsaSession(input.thresholdSessionId),
-		ttlMs,
-		remainingUses,
-		runtimePolicyScope: input.runtimePolicyScope
-	};
-}
-function buildEvmFamilyEcdsaRecoveredMaterialLanePolicy(input) {
-	const ttlMs = Math.floor(Number(input.ttlMs));
-	const remainingUses = Math.floor(Number(input.remainingUses));
-	if (!Number.isFinite(ttlMs) || ttlMs <= 0) throw new Error("[evm-family-ecdsa] ttlMs must be a positive finite value");
-	if (!Number.isFinite(remainingUses) || remainingUses <= 0) throw new Error("[evm-family-ecdsa] remainingUses must be a positive finite value");
-	return {
-		chainTarget: input.chainTarget,
-		thresholdSessionId: SigningSessionIds.thresholdEcdsaSession(input.thresholdSessionId),
-		ttlMs,
-		remainingUses,
-		runtimePolicyScope: input.runtimePolicyScope
-	};
-}
-function deriveEvmFamilyKeyFingerprint(key) {
-	return `evmfam-ecdsa:${fnv1a32Hex(alphabetizeStringify({
-		version: "evm_family_ecdsa_key_fingerprint_v2",
-		walletId: String(key.walletId),
-		baseEcdsaSubjectId: String(deriveBaseEcdsaSubjectIdFromWalletId(key.walletId)),
-		keyScope: key.keyScope,
-		ecdsaThresholdKeyId: String(key.ecdsaThresholdKeyId),
-		signingRootId: String(key.signingRootId),
-		signingRootVersion: String(key.signingRootVersion),
-		participantIds: key.participantIds.map((id) => Number(id)),
-		thresholdOwnerAddress: String(key.thresholdOwnerAddress)
-	}))}`;
-}
-function deriveEvmFamilyKeyFingerprintFromPublicFacts(input) {
-	return `evmfam-ecdsa:${fnv1a32Hex(alphabetizeStringify({
-		version: "evm_family_ecdsa_public_facts_fingerprint_v1",
-		walletId: String(toWalletId(input.walletId)),
-		keyHandle: String(input.publicFacts.keyHandle),
-		publicKeyB64u: String(input.publicFacts.publicKeyB64u),
-		participantIds: input.publicFacts.participantIds.map((id) => Number(id)),
-		thresholdOwnerAddress: String(input.publicFacts.thresholdOwnerAddress)
-	}))}`;
-}
-//#endregion
-export { buildEmailOtpWalletAuthMethodBinding as $, signingLaneAuthBindingKey as A, exactSigningLaneIdentityMatches as B, toThresholdOwnerAddress as C, SigningSessionPlanKind as D, SigningSessionIds as E, exactEd25519ExportMaterialIdentity as F, parseExactEcdsaSigningLaneIdentity as G, isExactEcdsaSigningLaneIdentity as H, exactEd25519SigningLaneIdentity as I, parseOwnerLaneParticipantContinuityV1 as J, parseExactEd25519ExportMaterialIdentity as K, exactEd25519SigningLaneIdentityFromSelectedLane as L, buildEvmFamilyEcdsaSignerBinding as M, exactEcdsaSigningLaneIdentity as N, summarizeSigningLane as O, exactEcdsaSigningLaneIdentityFromSelectedLane as P, parseThresholdEcdsaKeyHandle as Q, exactSigningLaneIdentityFromSelectedLane as R, toThresholdEcdsaPublicKeyB64u as S, parseSdkEcdsaDerivationThresholdKeyId as St, SigningOperationIntent as T, nearEd25519SignerBindingFromBoundaryFields as U, exactSigningLaneWalletId as V, nearProtocolProjectionFromExactLane as W, parseLaneParticipantBindingDigestB64u as X, parseLaneHolderParticipantRecordV1 as Y, parseSigningWorkerParticipantRecordV1 as Z, resolveThresholdSigningRootBindingFromRecord as _, parseEvmFamilyEcdsaSignerId as _t, buildEvmFamilyEcdsaWalletKey as a, walletAuthMethodBindingFromRaw as at, toParticipantId as b, parseSdkEcdsaDerivationSigningRootId as bt, buildResolvedEvmFamilyEcdsaKey as c, parseEcdsaCapabilityManifestId as ct, deriveEvmFamilyKeyFingerprint as d, parseEcdsaCiphertextDigest as dt, buildPasskeyAuthScope as et, deriveEvmFamilyKeyFingerprintFromPublicFacts as f, parseEcdsaIv12B64u as ft, resolveThresholdEcdsaKeyIdFromRecord as g, parseEcdsaServerGeneration as gt, parseThresholdSigningRootBinding as h, parseEcdsaPendingCiphertextDigest as ht, buildEvmFamilyEcdsaSessionLanePolicy as i, parseRpId as it, signingLaneAuthMethod as j, summarizeSigningSessionPlan as k, buildVerifiedEcdsaPublicFacts as l, parseEcdsaCapabilityManifestRevision as lt, evmFamilyEcdsaWalletKeyToIdentity as m, parseEcdsaMaterialSealingKeyId as mt, buildBaseEvmFamilyEcdsaKeyIdentity as n, buildWalletIdentity as nt, buildHydratedEcdsaSignerMaterial as o, parseCanonicalEcdsaServerActivationRequest as ot, deriveEvmFamilySigningKeySlotId as p, parseEcdsaLifecycleId as pt, requireEvmFamilyEcdsaSigner as q, buildEvmFamilyEcdsaRecoveredMaterialLanePolicy as r, nearAccountBindingFromRaw as rt, buildPasskeyEcdsaAuthBinding as s, parseEcdsaActivationDigest as st, assertMatchingVerifiedEcdsaPublicFacts as t, buildPasskeyWalletAuthMethodBinding as tt, deriveEvmFamilyEcdsaKeyHandle as u, parseEcdsaCiphertextB64u as ut, resolveThresholdSigningRootBindingFromRuntimePolicyScope as v, computeEcdsaDerivationRoleLocalRelayerKeyId as vt, SigningKeyRefIntentKind as w, toRpId as x, parseSdkEcdsaDerivationSigningRootVersion as xt, toEvmFamilyEcdsaKeyHandle as y, ecdsaClientRootPublicKey33B64uFromString as yt, exactSigningLaneIdentityKey as z };