@seams/wallet 0.6.2 → 0.7.1

package/dist/{public/sdk/sessionPolicy-B4FsPuk2.js → esm/sdk/walletAuthority-BQBxgUBn.js}

@@ -1,127 +1,11 @@
-import { B as parseWalletRecoveryOperationId, L as parseWalletAuthorityId, R as parseWalletId, T as parseMpcMaterialActivationRef, b as parseLinkedDeviceEnrollmentId, y as parseLinkDeviceSessionId, z as parseWalletKeyId } from "./normalize-BephcEIF.js";
+import { A as parseWalletRecoveryOperationId, D as parseWalletAuthorityId, M as parseWebAuthnRpId, O as parseWalletId, T as parseWalletAuthMethodId, h as parseMpcMaterialActivationRef, j as parseWebAuthnCredentialIdB64u, k as parseWalletKeyId, l as parseLinkDeviceSessionId, u as parseLinkedDeviceEnrollmentId } from "./domainIds-lcrFg6Sa.js";
+import { _ as requireRecord } from "./validation-gat4LEKm.js";
 import { i as base64UrlEncode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
-import { r as secureRandomId } from "./secureRandomId-BORsmdS4.js";
-import { A as alphabetizeStringify, I as parseDigestB64u, M as sha256BytesUtf8, j as sha256Bytes } from "./registrationIntent-DwAIMQYh.js";
-import { d as parseEd25519PublicKeyB64u, g as parseSecp256k1CompressedPublicKeyB64u, o as normalizeRuntimePolicyScope, r as normalizeThresholdEd25519ParticipantIds, v as rejectUnknownFields, y as requireRecord$1 } from "./participants-Bcnsa_ip.js";
-import { l as parseDeviceId } from "./capabilityKinds-jwCEaqBU.js";
-//#region ../shared-ts/src/authorization/delegatedAuthority.ts
-const FULL_OWNER_PERMISSIONS = Object.freeze([
-	"export_keys",
-	"link_devices",
-	"revoke_devices",
-	"sign"
-]);
-Object.freeze(["sign"]);
-const DELEGATED_WALLET_PERMISSION_VALUE_SET = new Set([
-	"export_keys",
-	"link_devices",
-	"revoke_devices",
-	"sign"
-]);
-const canonicalPermissionSetBrand = Symbol("canonicalPermissionSetBrand");
-var CanonicalDelegatedWalletPermissionSetProof = class CanonicalDelegatedWalletPermissionSetProof extends Array {
-	constructor(permissions) {
-		super(...permissions);
-		this[canonicalPermissionSetBrand] = true;
-		Object.freeze(this);
-	}
-	static create(permissions) {
-		return new CanonicalDelegatedWalletPermissionSetProof(permissions);
-	}
-	static get [Symbol.species]() {
-		return Array;
-	}
-};
-function isDelegatedWalletPermissionV1(value) {
-	return typeof value === "string" && DELEGATED_WALLET_PERMISSION_VALUE_SET.has(value);
-}
-function parseDelegatedWalletPermissionSetV1(raw) {
-	if (!Array.isArray(raw)) return invalidPermissionResult(raw == null ? "delegated wallet permissions are required" : "delegated wallet permissions must be an array");
-	if (raw.length === 0) return invalidPermissionResult("delegated wallet permissions must be non-empty");
-	const permissions = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const value of raw) {
-		if (!isDelegatedWalletPermissionV1(value)) return invalidPermissionResult("delegated wallet permission is unsupported");
-		if (seen.has(value)) return invalidPermissionResult(`delegated wallet permission ${value} is duplicated`);
-		seen.add(value);
-		permissions.push(value);
-	}
-	permissions.sort(compareDelegatedWalletPermissions);
-	return {
-		ok: true,
-		value: CanonicalDelegatedWalletPermissionSetProof.create(toNonEmptyPermissionTuple(permissions))
-	};
-}
-function buildDelegatedWalletAuthorityV1(input) {
-	return {
-		kind: "delegated_wallet_authority_v1",
-		permissions: input.permissions
-	};
-}
-function parseDelegatedWalletAuthorityV1(raw) {
-	if (!isExactAuthorityRecord(raw)) return invalidAuthorityResult("delegated wallet authority must contain exactly kind and permissions");
-	if (raw.kind !== "delegated_wallet_authority_v1") return invalidAuthorityResult("delegated wallet authority kind is unsupported");
-	const permissions = parseDelegatedWalletPermissionSetV1(raw.permissions);
-	if (!permissions.ok) return permissions;
-	return {
-		ok: true,
-		value: buildDelegatedWalletAuthorityV1({ permissions: permissions.value })
-	};
-}
-function buildFullOwnerPermissionsV1() {
-	return buildPresetPermissionSet(FULL_OWNER_PERMISSIONS);
-}
-function buildFullOwnerDelegatedWalletAuthorityV1() {
-	return buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() });
-}
-function hasDelegatedWalletPermissionV1(authority, permission) {
-	return authority.permissions.includes(permission);
-}
-function delegatedWalletPermissionNamesV1(authority) {
-	return Object.freeze([...authority.permissions]);
-}
-function sameDelegatedWalletAuthorityV1(left, right) {
-	if (left.kind !== right.kind || left.permissions.length !== right.permissions.length) return false;
-	for (let index = 0; index < left.permissions.length; index += 1) if (left.permissions[index] !== right.permissions[index]) return false;
-	return true;
-}
-function buildPresetPermissionSet(permissions) {
-	const parsed = parseDelegatedWalletPermissionSetV1(permissions);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-function compareDelegatedWalletPermissions(left, right) {
-	return left < right ? -1 : left > right ? 1 : 0;
-}
-function toNonEmptyPermissionTuple(permissions) {
-	const [first, ...remaining] = permissions;
-	if (!first) throw new Error("delegated wallet permissions must be non-empty");
-	return [first, ...remaining];
-}
-function isExactAuthorityRecord(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	const keys = Object.keys(value);
-	return keys.length === 2 && keys.includes("kind") && keys.includes("permissions");
-}
-function invalidPermissionResult(message) {
-	return {
-		ok: false,
-		error: {
-			code: "invalid",
-			message
-		}
-	};
-}
-function invalidAuthorityResult(message) {
-	return {
-		ok: false,
-		error: {
-			code: "invalid",
-			message
-		}
-	};
-}
-//#endregion
+import { P as rejectUnknownFields, T as parseSecp256k1CompressedPublicKeyB64u, b as parseEd25519PublicKeyB64u, j as parseDelegatedWalletPermissionSetV1 } from "./sessionPolicy-CHiilOAB.js";
+import { l as parseDeviceId } from "./capabilityKinds-hvYqa6S_.js";
+import { f as alphabetizeStringify, p as sha256Bytes } from "./chains-BMh3btVo.js";
+import { o as sha256Utf8DigestB64u, r as parseDigestB64u } from "./canonicalPrimitives-BTHWz80v.js";
+import { s as inspectRawObject, u as trimString } from "./registrationIds-DLSdEKSv.js";
 //#region ../shared-ts/src/device-linking/delegatedActivationPlan.ts
 const MANIFEST_FIELDS = [
 	"kind",
@@ -196,7 +80,7 @@ function parseExactAdministeredSignerManifestV1(raw) {
 	return manifest;
 }
 function parseExactAdministeredSignerV1(raw, label) {
-	const record = requireRecord$1(raw, label);
+	const record = requireRecord(raw, label);
 	switch (record.keyFamily) {
 		case "ed25519":
 			rejectUnknownFields(record, ED25519_SIGNER_FIELDS, label);
@@ -239,7 +123,7 @@ function parseEvmAddress(raw, label) {
 	return raw;
 }
 function exactRecord$1(raw, fields, label) {
-	const record = requireRecord$1(raw, label);
+	const record = requireRecord(raw, label);
 	rejectUnknownFields(record, fields, label);
 	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
 	return record;
@@ -249,16 +133,426 @@ function requireParsed$1(parsed, label) {
 	return parsed.value;
 }
 //#endregion
+//#region ../shared-ts/src/utils/walletAuthMethodRecord.ts
+async function computeWalletAuthMethodRevokeOperationFingerprintV1(input) {
+	return sha256Utf8DigestB64u(alphabetizeStringify({
+		version: "wallet_auth_method_revoke_operation_v1",
+		walletId: String(input.walletId),
+		targetWalletAuthMethodId: String(input.targetWalletAuthMethodId),
+		requestedAtMs: input.requestedAtMs
+	}));
+}
+function sameWalletAuthMethodRecordV2(left, right) {
+	if (left.version !== right.version || left.walletAuthMethodId !== right.walletAuthMethodId || left.walletId !== right.walletId || left.walletAuthorityId !== right.walletAuthorityId || left.status !== right.status || left.createdAtMs !== right.createdAtMs || left.updatedAtMs !== right.updatedAtMs) return false;
+	switch (left.kind) {
+		case "passkey":
+			if (right.kind !== "passkey") return false;
+			if (left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u && left.credentialPublicKeyB64u === right.credentialPublicKeyB64u && left.counter === right.counter) break;
+			return false;
+		case "email_otp":
+			if (right.kind !== "email_otp") return false;
+			if (left.emailHashHex === right.emailHashHex && left.registrationAuthorityId === right.registrationAuthorityId) break;
+			return false;
+		default: return assertNeverWalletAuthMethodRecordV2(left, "wallet auth method kind");
+	}
+	switch (left.status) {
+		case "pending_local_install": return right.status === "pending_local_install";
+		case "active": return right.status === "active" && left.activatedAtMs === right.activatedAtMs;
+		case "revoked": return right.status === "revoked" && left.activatedAtMs === right.activatedAtMs && left.revokedAtMs === right.revokedAtMs;
+		default: return assertNeverWalletAuthMethodRecordV2(left, "wallet auth method lifecycle");
+	}
+}
+function assertNeverWalletAuthMethodRecordV2(value, label) {
+	throw new Error(`${label} branch is unsupported: ${String(value)}`);
+}
+function buildWalletAuthMethodRecordV2(input) {
+	validateWalletAuthMethodRecordV2(input);
+	if (input.kind === "passkey") switch (input.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "passkey",
+			status: "pending_local_install",
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "passkey",
+			status: "active",
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "passkey",
+			status: "revoked",
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs,
+			revokedAtMs: input.revokedAtMs
+		};
+	}
+	switch (input.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "email_otp",
+			status: "pending_local_install",
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "email_otp",
+			status: "active",
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.walletAuthMethodId,
+			walletId: input.walletId,
+			walletAuthorityId: input.walletAuthorityId,
+			kind: "email_otp",
+			status: "revoked",
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			createdAtMs: input.createdAtMs,
+			updatedAtMs: input.updatedAtMs,
+			activatedAtMs: input.activatedAtMs,
+			revokedAtMs: input.revokedAtMs
+		};
+	}
+}
+function parseWalletAuthMethodRecordV2(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("version" in record) || !("kind" in record) || !("status" in record)) return null;
+	const version = trimString(record.version);
+	const kind = trimString(record.kind);
+	const status = trimString(record.status);
+	if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp") return null;
+	try {
+		const common = parseWalletAuthMethodRecordV2Common(record);
+		if (kind === "passkey") {
+			if (!("rpId" in record) || !("credentialIdB64u" in record) || !("credentialPublicKeyB64u" in record) || !("counter" in record)) return null;
+			exactWalletAuthMethodV2Fields(record, "passkey", status);
+			const rpId = parseWebAuthnRpId(record.rpId);
+			const credentialIdB64u = parseWebAuthnCredentialIdB64u(record.credentialIdB64u);
+			if (!rpId.ok || !credentialIdB64u.ok || typeof record.credentialPublicKeyB64u !== "string" || !record.credentialPublicKeyB64u.trim() || Object.prototype.hasOwnProperty.call(record, "emailHashHex") || Object.prototype.hasOwnProperty.call(record, "registrationAuthorityId")) return null;
+			return buildParsedPasskeyWalletAuthMethodRecordV2({
+				common,
+				lifecycle: parseWalletAuthMethodLifecycle(record),
+				rpId: rpId.value,
+				credentialIdB64u: credentialIdB64u.value,
+				credentialPublicKeyB64u: record.credentialPublicKeyB64u,
+				counter: parseNonNegativeInteger(record.counter)
+			});
+		}
+		if (!("emailHashHex" in record) || !("registrationAuthorityId" in record)) return null;
+		exactWalletAuthMethodV2Fields(record, "email_otp", status);
+		const emailHashHex = trimString(record.emailHashHex);
+		const registrationAuthorityId = trimString(record.registrationAuthorityId);
+		if (!emailHashHex || !registrationAuthorityId || Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "credentialIdB64u") || Object.prototype.hasOwnProperty.call(record, "credentialPublicKeyB64u") || Object.prototype.hasOwnProperty.call(record, "counter")) return null;
+		return buildParsedEmailOtpWalletAuthMethodRecordV2({
+			common,
+			lifecycle: parseWalletAuthMethodLifecycle(record),
+			emailHashHex,
+			registrationAuthorityId
+		});
+	} catch {
+		return null;
+	}
+}
+function parseWalletAuthMethodRecordV2Common(raw) {
+	if (!("walletAuthMethodId" in raw) || !("walletId" in raw) || !("walletAuthorityId" in raw) || !("createdAtMs" in raw) || !("updatedAtMs" in raw)) throw new Error("wallet auth method common fields are required");
+	return {
+		version: "wallet_auth_method_v2",
+		walletAuthMethodId: parseWalletAuthMethodIdRequired(raw.walletAuthMethodId),
+		walletId: parseWalletIdRequired(raw.walletId),
+		walletAuthorityId: parseWalletAuthorityIdRequired(raw.walletAuthorityId),
+		createdAtMs: parseNonNegativeInteger(raw.createdAtMs),
+		updatedAtMs: parseNonNegativeInteger(raw.updatedAtMs)
+	};
+}
+function validateWalletAuthMethodRecordV2(value) {
+	if (value.version !== "wallet_auth_method_v2") throw new Error("wallet auth method record version is unsupported");
+	if (!value.walletAuthMethodId || !value.walletId || !value.walletAuthorityId) throw new Error("wallet auth method record identities are required");
+	if (!Number.isSafeInteger(value.createdAtMs) || value.createdAtMs < 0) throw new Error("wallet auth method createdAtMs must be a non-negative safe integer");
+	if (!Number.isSafeInteger(value.updatedAtMs) || value.updatedAtMs < value.createdAtMs) throw new Error("wallet auth method updatedAtMs must follow createdAtMs");
+	if (value.kind === "passkey") {
+		if (!value.rpId || !value.credentialIdB64u || !value.credentialPublicKeyB64u.trim()) throw new Error("passkey wallet auth method fields are required");
+		if (!Number.isSafeInteger(value.counter) || value.counter < 0) throw new Error("passkey authenticator counter must be non-negative");
+	} else if (!value.emailHashHex.trim() || !value.registrationAuthorityId.trim()) throw new Error("email OTP wallet auth method fields are required");
+	switch (value.status) {
+		case "pending_local_install": return;
+		case "active":
+			validateNonNegativeInteger(value.activatedAtMs, "activatedAtMs");
+			return;
+		case "revoked":
+			validateNonNegativeInteger(value.activatedAtMs, "activatedAtMs");
+			validateNonNegativeInteger(value.revokedAtMs, "revokedAtMs");
+			if (value.revokedAtMs < value.activatedAtMs) throw new Error("revokedAtMs cannot precede activatedAtMs");
+			return;
+	}
+}
+function parseWalletAuthMethodLifecycle(raw) {
+	if (!("status" in raw)) throw new Error("wallet auth method status is required");
+	switch (raw.status) {
+		case "pending_local_install": return { status: "pending_local_install" };
+		case "active":
+			if (!("activatedAtMs" in raw)) throw new Error("wallet auth method activatedAtMs is required");
+			return {
+				status: "active",
+				activatedAtMs: parseNonNegativeInteger(raw.activatedAtMs)
+			};
+		case "revoked":
+			if (!("activatedAtMs" in raw) || !("revokedAtMs" in raw)) throw new Error("wallet auth method revocation timestamps are required");
+			return {
+				status: "revoked",
+				activatedAtMs: parseNonNegativeInteger(raw.activatedAtMs),
+				revokedAtMs: parseNonNegativeInteger(raw.revokedAtMs)
+			};
+		default: throw new Error("wallet auth method status is unsupported");
+	}
+}
+function exactWalletAuthMethodV2Fields(raw, kind, status) {
+	const fields = [
+		"version",
+		"walletAuthMethodId",
+		"walletId",
+		"walletAuthorityId",
+		"kind",
+		"status",
+		"createdAtMs",
+		"updatedAtMs"
+	];
+	if (kind === "passkey") fields.push("rpId", "credentialIdB64u", "credentialPublicKeyB64u", "counter");
+	else fields.push("emailHashHex", "registrationAuthorityId");
+	if (status === "active") fields.push("activatedAtMs");
+	if (status === "revoked") fields.push("activatedAtMs", "revokedAtMs");
+	if (status !== "pending_local_install" && status !== "active" && status !== "revoked") throw new Error("wallet auth method status is unsupported");
+	const expected = new Set(fields);
+	const actual = Object.keys(raw);
+	if (actual.length !== fields.length) throw new Error("wallet auth method record has invalid fields");
+	for (const field of actual) if (!expected.has(field)) throw new Error(`wallet auth method field ${field} is invalid`);
+}
+function buildParsedPasskeyWalletAuthMethodRecordV2(input) {
+	switch (input.lifecycle.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "passkey",
+			status: "pending_local_install",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "passkey",
+			status: "active",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			activatedAtMs: input.lifecycle.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "passkey",
+			status: "revoked",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			rpId: input.rpId,
+			credentialIdB64u: input.credentialIdB64u,
+			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
+			counter: input.counter,
+			activatedAtMs: input.lifecycle.activatedAtMs,
+			revokedAtMs: input.lifecycle.revokedAtMs
+		};
+	}
+}
+function buildParsedEmailOtpWalletAuthMethodRecordV2(input) {
+	switch (input.lifecycle.status) {
+		case "pending_local_install": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "email_otp",
+			status: "pending_local_install",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId
+		};
+		case "active": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "email_otp",
+			status: "active",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			activatedAtMs: input.lifecycle.activatedAtMs
+		};
+		case "revoked": return {
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.common.walletAuthMethodId,
+			walletId: input.common.walletId,
+			walletAuthorityId: input.common.walletAuthorityId,
+			kind: "email_otp",
+			status: "revoked",
+			createdAtMs: input.common.createdAtMs,
+			updatedAtMs: input.common.updatedAtMs,
+			emailHashHex: input.emailHashHex,
+			registrationAuthorityId: input.registrationAuthorityId,
+			activatedAtMs: input.lifecycle.activatedAtMs,
+			revokedAtMs: input.lifecycle.revokedAtMs
+		};
+	}
+}
+function parseWalletAuthMethodIdRequired(raw) {
+	const parsed = parseWalletAuthMethodId(raw);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseWalletIdRequired(raw) {
+	const parsed = parseWalletId(raw);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseWalletAuthorityIdRequired(raw) {
+	const parsed = parseWalletAuthorityId(raw);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function parseNonNegativeInteger(raw) {
+	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw new Error("value must be a non-negative safe integer");
+	return raw;
+}
+function validateNonNegativeInteger(raw, label) {
+	if (!Number.isSafeInteger(raw) || raw < 0) throw new Error(`${label} must be a non-negative safe integer`);
+}
+//#endregion
+//#region ../shared-ts/src/utils/digestEncoding.ts
+const TEXT_ENCODER = new TextEncoder();
+function concat(parts) {
+	let length = 0;
+	for (const part of parts) length += part.length;
+	const output = new Uint8Array(length);
+	let offset = 0;
+	for (const part of parts) {
+		output.set(part, offset);
+		offset += part.length;
+	}
+	return output;
+}
+function u32(value, label) {
+	if (!Number.isSafeInteger(value) || value < 0 || value > 4294967295) throw new Error(`${label} must be a non-negative u32`);
+	return Uint8Array.from([
+		value >>> 24 & 255,
+		value >>> 16 & 255,
+		value >>> 8 & 255,
+		value & 255
+	]);
+}
+function u64(value, label) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
+	let remaining = BigInt(value);
+	const output = new Uint8Array(8);
+	for (let index = 7; index >= 0; index -= 1) {
+		output[index] = Number(remaining & 255n);
+		remaining >>= 8n;
+	}
+	return output;
+}
+function lp32(value, label) {
+	return concat([u32(value.length, `${label}.length`), value]);
+}
+function text(value, label) {
+	if (typeof value !== "string") throw new Error(`${label} must be a string`);
+	return lp32(TEXT_ENCODER.encode(value), label);
+}
+function rawDigest(value, label) {
+	try {
+		const decoded = base64UrlDecode(parseDigestB64u(value));
+		if (decoded.length !== 32) throw new Error("must decode to 32 bytes");
+		return decoded;
+	} catch (error) {
+		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
+	}
+}
+function rawPublicKey(value, label) {
+	try {
+		const decoded = base64UrlDecode(value);
+		if (decoded.length === 0 || base64UrlEncode(decoded) !== value) throw new Error("must be canonical base64url");
+		return decoded;
+	} catch (error) {
+		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
+	}
+}
+//#endregion
 //#region ../shared-ts/src/authorization/walletAuthority.ts
 const SIGNER_ACTIVATION_SET_DOMAIN = "seams/wallet-signer-activation-set/v1";
 const WALLET_AUTHORITY_DOMAIN = "seams/wallet-authority/v1";
-const TEXT_ENCODER = new TextEncoder();
 function isCombinedWalletSignerActivationSetV1(value) {
 	return isBothFamilyActivationSet(value);
 }
 function isActiveEcdsaWalletAuthorityV1(value) {
 	return isEcdsaOnlyActivationSet(value.signerActivations);
 }
+function isActiveEd25519WalletAuthorityV1(value) {
+	return isEd25519OnlyActivationSet(value.signerActivations);
+}
 function isActiveRecoveredWalletAuthorityV1(value) {
 	return value.provenance.kind === "wallet_recovery";
 }
@@ -389,8 +683,8 @@ function encodeWalletSignerActivationSetV1(value) {
 async function computeWalletSignerActivationSetDigestB64u(value) {
 	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeWalletSignerActivationSetV1(value))));
 }
-function buildPendingWalletAuthorityV1(input) {
-	validateWalletAuthorityV1(input);
+/** The fields every lifecycle state carries, copied in record order. */
+function walletAuthorityCommonFields(input) {
 	return {
 		kind: "wallet_authority_v1",
 		authorityId: input.authorityId,
@@ -403,7 +697,13 @@ function buildPendingWalletAuthorityV1(input) {
 		authorityDigestB64u: input.authorityDigestB64u,
 		revocationEpoch: input.revocationEpoch,
 		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
+		updatedAtMs: input.updatedAtMs
+	};
+}
+function buildPendingWalletAuthorityV1(input) {
+	validateWalletAuthorityV1(input);
+	return {
+		...walletAuthorityCommonFields(input),
 		state: "pending_local_install",
 		localInstallPackageSetDigestB64u: input.localInstallPackageSetDigestB64u
 	};
@@ -411,18 +711,7 @@ function buildPendingWalletAuthorityV1(input) {
 function buildActiveWalletAuthorityV1(input) {
 	validateWalletAuthorityV1(input);
 	return {
-		kind: "wallet_authority_v1",
-		authorityId: input.authorityId,
-		walletId: input.walletId,
-		principal: input.principal,
-		provenance: input.provenance,
-		permissions: input.permissions,
-		signerActivations: input.signerActivations,
-		signerActivationSetDigestB64u: input.signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authorityDigestB64u,
-		revocationEpoch: input.revocationEpoch,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
+		...walletAuthorityCommonFields(input),
 		state: "active",
 		activatedAtMs: input.activatedAtMs
 	};
@@ -462,37 +751,14 @@ async function replaceActiveWalletAuthorityEd25519MaterialActivationV1(input) {
 		activatedAtMs: input.authority.activatedAtMs
 	};
 	return buildActiveWalletAuthorityV1({
-		kind: draft.kind,
-		authorityId: draft.authorityId,
-		walletId: draft.walletId,
-		principal: draft.principal,
-		provenance: draft.provenance,
-		permissions: draft.permissions,
-		signerActivations: draft.signerActivations,
-		signerActivationSetDigestB64u: draft.signerActivationSetDigestB64u,
-		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft),
-		revocationEpoch: draft.revocationEpoch,
-		createdAtMs: draft.createdAtMs,
-		updatedAtMs: draft.updatedAtMs,
-		state: draft.state,
-		activatedAtMs: draft.activatedAtMs
+		...draft,
+		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft)
 	});
 }
 function buildActiveCombinedWalletAuthorityV1(input) {
 	validateWalletAuthorityV1(input);
 	return {
-		kind: "wallet_authority_v1",
-		authorityId: input.authorityId,
-		walletId: input.walletId,
-		principal: input.principal,
-		provenance: input.provenance,
-		permissions: input.permissions,
-		signerActivations: input.signerActivations,
-		signerActivationSetDigestB64u: input.signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authorityDigestB64u,
-		revocationEpoch: input.revocationEpoch,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
+		...walletAuthorityCommonFields(input),
 		state: "active",
 		activatedAtMs: input.activatedAtMs
 	};
@@ -500,115 +766,58 @@ function buildActiveCombinedWalletAuthorityV1(input) {
 function buildRevokedWalletAuthorityV1(input) {
 	validateWalletAuthorityV1(input);
 	return {
-		kind: "wallet_authority_v1",
-		authorityId: input.authorityId,
-		walletId: input.walletId,
-		principal: input.principal,
-		provenance: input.provenance,
-		permissions: input.permissions,
-		signerActivations: input.signerActivations,
-		signerActivationSetDigestB64u: input.signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authorityDigestB64u,
-		revocationEpoch: input.revocationEpoch,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
+		...walletAuthorityCommonFields(input),
 		state: "revoked",
 		activatedAtMs: input.activatedAtMs,
 		revokedAtMs: input.revokedAtMs
 	};
 }
+/** The record fields every lifecycle state has, in canonical order; each state adds its own. */
+const WALLET_AUTHORITY_FIELDS = [
+	"kind",
+	"authorityId",
+	"walletId",
+	"principal",
+	"provenance",
+	"permissions",
+	"signerActivations",
+	"signerActivationSetDigestB64u",
+	"authorityDigestB64u",
+	"revocationEpoch",
+	"createdAtMs",
+	"updatedAtMs",
+	"state"
+];
 function parseWalletAuthorityV1(raw) {
 	try {
 		const record = requireRecord(raw, "WalletAuthorityV1");
 		const common = parseWalletAuthorityCommon(record);
 		switch (record.state) {
 			case "pending_local_install":
-				exactFields(record, [
-					"kind",
-					"authorityId",
-					"walletId",
-					"principal",
-					"provenance",
-					"permissions",
-					"signerActivations",
-					"signerActivationSetDigestB64u",
-					"authorityDigestB64u",
-					"revocationEpoch",
-					"createdAtMs",
-					"updatedAtMs",
-					"state",
-					"localInstallPackageSetDigestB64u"
-				], "WalletAuthorityV1");
+				exactFields(record, [...WALLET_AUTHORITY_FIELDS, "localInstallPackageSetDigestB64u"], "WalletAuthorityV1");
 				return {
 					ok: true,
 					value: buildPendingWalletAuthorityV1({
 						kind: "wallet_authority_v1",
-						authorityId: common.authorityId,
-						walletId: common.walletId,
-						principal: common.principal,
-						provenance: common.provenance,
-						permissions: common.permissions,
-						signerActivations: common.signerActivations,
-						signerActivationSetDigestB64u: common.signerActivationSetDigestB64u,
-						authorityDigestB64u: common.authorityDigestB64u,
-						revocationEpoch: common.revocationEpoch,
-						createdAtMs: common.createdAtMs,
-						updatedAtMs: common.updatedAtMs,
+						...common,
 						state: "pending_local_install",
 						localInstallPackageSetDigestB64u: parseDigestField(record.localInstallPackageSetDigestB64u, "localInstallPackageSetDigestB64u")
 					})
 				};
 			case "active":
-				exactFields(record, [
-					"kind",
-					"authorityId",
-					"walletId",
-					"principal",
-					"provenance",
-					"permissions",
-					"signerActivations",
-					"signerActivationSetDigestB64u",
-					"authorityDigestB64u",
-					"revocationEpoch",
-					"createdAtMs",
-					"updatedAtMs",
-					"state",
-					"activatedAtMs"
-				], "WalletAuthorityV1");
+				exactFields(record, [...WALLET_AUTHORITY_FIELDS, "activatedAtMs"], "WalletAuthorityV1");
 				return {
 					ok: true,
 					value: buildActiveWalletAuthorityV1({
 						kind: "wallet_authority_v1",
-						authorityId: common.authorityId,
-						walletId: common.walletId,
-						principal: common.principal,
-						provenance: common.provenance,
-						permissions: common.permissions,
-						signerActivations: common.signerActivations,
-						signerActivationSetDigestB64u: common.signerActivationSetDigestB64u,
-						authorityDigestB64u: common.authorityDigestB64u,
-						revocationEpoch: common.revocationEpoch,
-						createdAtMs: common.createdAtMs,
-						updatedAtMs: common.updatedAtMs,
+						...common,
 						state: "active",
 						activatedAtMs: parseSafeInteger(record.activatedAtMs, "activatedAtMs")
 					})
 				};
 			case "revoked":
 				exactFields(record, [
-					"kind",
-					"authorityId",
-					"walletId",
-					"principal",
-					"provenance",
-					"permissions",
-					"signerActivations",
-					"signerActivationSetDigestB64u",
-					"authorityDigestB64u",
-					"revocationEpoch",
-					"createdAtMs",
-					"updatedAtMs",
-					"state",
+					...WALLET_AUTHORITY_FIELDS,
 					"activatedAtMs",
 					"revokedAtMs"
 				], "WalletAuthorityV1");
@@ -616,17 +825,7 @@ function parseWalletAuthorityV1(raw) {
 					ok: true,
 					value: buildRevokedWalletAuthorityV1({
 						kind: "wallet_authority_v1",
-						authorityId: common.authorityId,
-						walletId: common.walletId,
-						principal: common.principal,
-						provenance: common.provenance,
-						permissions: common.permissions,
-						signerActivations: common.signerActivations,
-						signerActivationSetDigestB64u: common.signerActivationSetDigestB64u,
-						authorityDigestB64u: common.authorityDigestB64u,
-						revocationEpoch: common.revocationEpoch,
-						createdAtMs: common.createdAtMs,
-						updatedAtMs: common.updatedAtMs,
+						...common,
 						state: "revoked",
 						activatedAtMs: parseSafeInteger(record.activatedAtMs, "activatedAtMs"),
 						revokedAtMs: parseSafeInteger(record.revokedAtMs, "revokedAtMs")
@@ -659,6 +858,14 @@ async function walletAuthorityDigestsMatchV1(value) {
 	if (await computeWalletSignerActivationSetDigestB64u(value.signerActivations) !== value.signerActivationSetDigestB64u) return false;
 	return await computeWalletAuthorityDigestB64u(value) === value.authorityDigestB64u;
 }
+/**
+* True when both authorities' stored digests verify and agree. The authority digest does not
+* cover the timestamps, so those must agree too.
+*/
+async function sameVerifiedActiveWalletAuthorityV1(left, right) {
+	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
+	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
+}
 function parseWalletAuthorityCommon(record) {
 	if (record.kind !== "wallet_authority_v1") throw new Error("WalletAuthorityV1.kind is unsupported");
 	const authorityId = requireParsed(parseWalletAuthorityId(record.authorityId), "authorityId");
@@ -807,7 +1014,7 @@ function parseEcdsaActivation(raw, label) {
 		materialActivation: requireParsed(parseMpcMaterialActivationRef(record.materialActivation), `${label}.materialActivation`)
 	});
 }
-function parseManifestForSigner(raw, family, label) {
+function parseManifestForSigner(raw, family, _label) {
 	return parseExactAdministeredSignerManifestV1({
 		kind: "exact_administered_signer_manifest_v1",
 		keyFamilies: [family],
@@ -883,10 +1090,6 @@ function encodePermissions(value) {
 	for (const permission of value) parts.push(lp32(text(permission, "permissions.item"), "permissions.item"));
 	return concat(parts);
 }
-function requireRecord(value, label) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
 function exactRecord(value, fields, label) {
 	const record = requireRecord(value, label);
 	exactFields(record, fields, label);
@@ -961,59 +1164,6 @@ function parseDigestField(raw, label) {
 		throw new Error(`${label} ${errorMessage(error, "is invalid")}`);
 	}
 }
-function rawDigest(value, label) {
-	try {
-		return base64UrlDecode(parseDigestB64u(value));
-	} catch (error) {
-		throw new Error(`${label} ${errorMessage(error, "is invalid")}`);
-	}
-}
-function rawPublicKey(value, label) {
-	try {
-		const decoded = base64UrlDecode(value);
-		if (decoded.length === 0 || base64UrlEncode(decoded) !== value) throw new Error("must be canonical base64url");
-		return decoded;
-	} catch (error) {
-		throw new Error(`${label} ${errorMessage(error, "is invalid")}`);
-	}
-}
-function concat(parts) {
-	let length = 0;
-	for (const part of parts) length += part.length;
-	const output = new Uint8Array(length);
-	let offset = 0;
-	for (const part of parts) {
-		output.set(part, offset);
-		offset += part.length;
-	}
-	return output;
-}
-function u32(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0 || value > 4294967295) throw new Error(`${label} must be a non-negative u32`);
-	return Uint8Array.from([
-		value >>> 24 & 255,
-		value >>> 16 & 255,
-		value >>> 8 & 255,
-		value & 255
-	]);
-}
-function u64(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	let remaining = BigInt(value);
-	const output = new Uint8Array(8);
-	for (let index = 7; index >= 0; index -= 1) {
-		output[index] = Number(remaining & 255n);
-		remaining >>= 8n;
-	}
-	return output;
-}
-function lp32(value, label) {
-	return concat([u32(value.length, `${label}.length`), value]);
-}
-function text(value, label) {
-	if (typeof value !== "string") throw new Error(`${label} must be a string`);
-	return lp32(TEXT_ENCODER.encode(value), label);
-}
 function parseSafeInteger(raw, label) {
 	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw new Error(`${label} must be a non-negative safe integer`);
 	return raw;
@@ -1040,6 +1190,33 @@ function errorMessage(error, fallback) {
 function assertNever(value, label) {
 	throw new Error(`${label} branch is unsupported: ${String(value)}`);
 }
+/**
+* Re-seals an authority around its new combined signer activations. Both digests are
+* recomputed; identity, provenance, permissions and lifecycle stay as they were.
+*/
+async function withCombinedSignerActivations(authority, signerActivations, now) {
+	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
+	const draft = {
+		kind: "wallet_authority_v1",
+		authorityId: authority.authorityId,
+		walletId: authority.walletId,
+		principal: authority.principal,
+		provenance: authority.provenance,
+		permissions: authority.permissions,
+		signerActivations,
+		signerActivationSetDigestB64u,
+		authorityDigestB64u: authority.authorityDigestB64u,
+		revocationEpoch: authority.revocationEpoch,
+		createdAtMs: authority.createdAtMs,
+		updatedAtMs: Math.max(authority.updatedAtMs, now),
+		state: "active",
+		activatedAtMs: authority.activatedAtMs
+	};
+	return buildActiveCombinedWalletAuthorityV1({
+		...draft,
+		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft)
+	});
+}
 async function extendEcdsaWalletAuthorityWithEd25519(input) {
 	if (input.ed25519.signer.walletId !== input.authority.walletId) throw new Error("NEAR signer belongs to a different wallet authority");
 	const existingEcdsa = input.authority.signerActivations.ecdsa;
@@ -1053,138 +1230,22 @@ async function extendEcdsaWalletAuthorityWithEd25519(input) {
 		}
 	});
 	if (!isCombinedWalletSignerActivationSetV1(signerActivationsCandidate)) throw new Error("Deferred Ed25519 activation did not produce a combined signer activation set");
-	const signerActivations = signerActivationsCandidate;
-	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
-	const draft = {
-		kind: "wallet_authority_v1",
-		authorityId: input.authority.authorityId,
-		walletId: input.authority.walletId,
-		principal: input.authority.principal,
-		provenance: input.authority.provenance,
-		permissions: input.authority.permissions,
-		signerActivations,
-		signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authority.authorityDigestB64u,
-		revocationEpoch: input.authority.revocationEpoch,
-		createdAtMs: input.authority.createdAtMs,
-		updatedAtMs: Math.max(input.authority.updatedAtMs, input.now),
-		state: "active",
-		activatedAtMs: input.authority.activatedAtMs
-	};
-	return buildActiveCombinedWalletAuthorityV1({
-		kind: draft.kind,
-		authorityId: draft.authorityId,
-		walletId: draft.walletId,
-		principal: draft.principal,
-		provenance: draft.provenance,
-		permissions: draft.permissions,
-		signerActivations: draft.signerActivations,
-		signerActivationSetDigestB64u: draft.signerActivationSetDigestB64u,
-		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft),
-		revocationEpoch: draft.revocationEpoch,
-		createdAtMs: draft.createdAtMs,
-		updatedAtMs: draft.updatedAtMs,
-		state: draft.state,
-		activatedAtMs: draft.activatedAtMs
-	});
-}
-/** Both projections have already passed digest validation at their boundaries. */
-function isEd25519ExtensionOfEcdsaWalletAuthority(previous, next) {
-	return isActiveEcdsaWalletAuthorityV1(previous) && isCombinedWalletSignerActivationSetV1(next.signerActivations) && previous.provenance.kind === "wallet_registration" && previous.authorityId === next.authorityId && previous.walletId === next.walletId && previous.revocationEpoch === next.revocationEpoch && previous.createdAtMs === next.createdAtMs && previous.activatedAtMs === next.activatedAtMs && base64UrlEncode(encodePrincipal(previous.principal)) === base64UrlEncode(encodePrincipal(next.principal)) && base64UrlEncode(encodeProvenance(previous.provenance)) === base64UrlEncode(encodeProvenance(next.provenance)) && base64UrlEncode(encodePermissions(previous.permissions)) === base64UrlEncode(encodePermissions(next.permissions)) && base64UrlEncode(encodeEcdsaActivation(previous.signerActivations.ecdsa)) === base64UrlEncode(encodeEcdsaActivation(next.signerActivations.ecdsa));
+	return withCombinedSignerActivations(input.authority, signerActivationsCandidate, input.now);
 }
-//#endregion
-//#region ../shared-ts/src/utils/theme.ts
-function coerceThemeMode(input) {
-	return input === "light" || input === "dark" ? input : void 0;
+/** `next` keeps everything of `previous` that an added signer must not change. */
+function keepsWalletAuthorityApartFromSigners(previous, next) {
+	return previous.authorityId === next.authorityId && previous.walletId === next.walletId && previous.revocationEpoch === next.revocationEpoch && previous.createdAtMs === next.createdAtMs && previous.activatedAtMs === next.activatedAtMs && base64UrlEncode(encodePrincipal(previous.principal)) === base64UrlEncode(encodePrincipal(next.principal)) && base64UrlEncode(encodeProvenance(previous.provenance)) === base64UrlEncode(encodeProvenance(next.provenance)) && base64UrlEncode(encodePermissions(previous.permissions)) === base64UrlEncode(encodePermissions(next.permissions));
 }
-//#endregion
-//#region ../shared-ts/src/threshold/sessionPolicy.ts
-const DEFAULT_WALLET_SESSION_TTL_MS = 1440 * 6e4;
-const MAX_WALLET_SESSION_TTL_MS = 720 * 60 * 6e4;
-const MAX_WALLET_SESSION_REMAINING_USES = 1e6;
-//#endregion
-//#region src/core/signingEngine/threshold/sessionPolicy.ts
-const THRESHOLD_SESSION_POLICY_VERSION = "threshold_session_v1";
-function normalizeThresholdRuntimePolicyScope(value) {
-	try {
-		return normalizeRuntimePolicyScope(value);
-	} catch {
-		return;
-	}
+/**
+* Whether `next` is `previous` with an added ECDSA signer and nothing else
+* changed. Both projections have already passed digest validation.
+*/
+function isEcdsaExtensionOfEd25519WalletAuthority(previous, next) {
+	return isActiveEd25519WalletAuthorityV1(previous) && isCombinedWalletSignerActivationSetV1(next.signerActivations) && keepsWalletAuthorityApartFromSigners(previous, next) && base64UrlEncode(encodeEd25519Activation(previous.signerActivations.ed25519)) === base64UrlEncode(encodeEd25519Activation(next.signerActivations.ed25519));
 }
-const THRESHOLD_SESSION_POLICY_MAX_TTL_MS = MAX_WALLET_SESSION_TTL_MS;
-const THRESHOLD_SESSION_POLICY_MAX_USES = MAX_WALLET_SESSION_REMAINING_USES;
-const DEFAULT_THRESHOLD_SESSION_TTL_MS = DEFAULT_WALLET_SESSION_TTL_MS;
-const DEFAULT_THRESHOLD_SESSION_POLICY = {
-	ttlMs: DEFAULT_THRESHOLD_SESSION_TTL_MS,
-	remainingUses: 3
-};
-const DEFAULT_UNLOCK_REMAINING_USES = 3;
-function parsePositiveSessionUses(value, fieldName) {
-	const remainingUses = Math.floor(Number(value) || 0);
-	if (!Number.isFinite(remainingUses) || remainingUses <= 0) throw new Error(`[ThresholdSessionPolicy] ${fieldName} must be a positive integer`);
-	return remainingUses;
-}
-function resolveWalletUnlockSessionUsesFromRequestedUses(args) {
-	const normalized = Math.floor(Number(args.requestedRemainingUses) || 0);
-	if (!Number.isFinite(normalized) || normalized <= 0) return null;
-	return Math.min(normalized, DEFAULT_UNLOCK_REMAINING_USES);
-}
-function clampThresholdSessionPolicy(input) {
-	const ttlMs = Math.max(0, Math.floor(Number(input.ttlMs) || 0));
-	const remainingUses = Math.max(0, Math.floor(Number(input.remainingUses) || 0));
-	return {
-		ttlMs: Math.min(ttlMs, THRESHOLD_SESSION_POLICY_MAX_TTL_MS),
-		remainingUses: Math.min(remainingUses, THRESHOLD_SESSION_POLICY_MAX_USES)
-	};
-}
-function generateThresholdSessionId() {
-	return secureRandomId("tsess", 32, "threshold session IDs");
-}
-async function computeEd25519SessionPolicyDigest32(policy) {
-	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(policy)));
-}
-async function buildEd25519SessionPolicy(params) {
-	return buildExactEd25519SessionPolicy({
-		nearAccountId: params.nearAccountId,
-		nearEd25519SigningKeyId: params.nearEd25519SigningKeyId,
-		authority: params.authority.authority,
-		relayerKeyId: params.relayerKeyId,
-		runtimePolicyScope: params.runtimePolicyScope,
-		routerAbNormalSigning: params.routerAbNormalSigning,
-		participantIds: params.participantIds,
-		thresholdSessionId: params.thresholdSessionId,
-		ttlMs: params.ttlMs,
-		remainingUses: params.remainingUses
-	});
-}
-async function buildExactEd25519SessionPolicy(params) {
-	const thresholdSessionId = params.thresholdSessionId || generateThresholdSessionId();
-	const { ttlMs, remainingUses } = clampThresholdSessionPolicy({
-		ttlMs: params.ttlMs ?? DEFAULT_THRESHOLD_SESSION_POLICY.ttlMs,
-		remainingUses: params.remainingUses ?? DEFAULT_THRESHOLD_SESSION_POLICY.remainingUses
-	});
-	const participantIds = normalizeThresholdEd25519ParticipantIds(params.participantIds);
-	const runtimePolicyScope = normalizeThresholdRuntimePolicyScope(params.runtimePolicyScope);
-	const policy = {
-		version: THRESHOLD_SESSION_POLICY_VERSION,
-		nearAccountId: params.nearAccountId,
-		nearEd25519SigningKeyId: params.nearEd25519SigningKeyId,
-		authority: params.authority,
-		relayerKeyId: params.relayerKeyId,
-		thresholdSessionId,
-		...runtimePolicyScope ? { runtimePolicyScope } : {},
-		routerAbNormalSigning: params.routerAbNormalSigning,
-		...participantIds ? { participantIds } : {},
-		ttlMs,
-		remainingUses
-	};
-	const sessionPolicyDigest32 = await computeEd25519SessionPolicyDigest32(policy);
-	return {
-		policy,
-		policyJson: JSON.stringify(policy),
-		sessionPolicyDigest32
-	};
+/** Both projections have already passed digest validation at their boundaries. */
+function isEd25519ExtensionOfEcdsaWalletAuthority(previous, next) {
+	return isActiveEcdsaWalletAuthorityV1(previous) && isCombinedWalletSignerActivationSetV1(next.signerActivations) && previous.provenance.kind === "wallet_registration" && keepsWalletAuthorityApartFromSigners(previous, next) && base64UrlEncode(encodeEcdsaActivation(previous.signerActivations.ecdsa)) === base64UrlEncode(encodeEcdsaActivation(next.signerActivations.ecdsa));
 }
 //#endregion
-export { buildFullOwnerDelegatedWalletAuthorityV1 as C, sameDelegatedWalletAuthorityV1 as D, parseDelegatedWalletAuthorityV1 as E, parseExactAdministeredSignerManifestV1 as S, hasDelegatedWalletPermissionV1 as T, isEd25519ExtensionOfEcdsaWalletAuthority as _, clampThresholdSessionPolicy as a, replaceActiveWalletAuthorityEd25519MaterialActivationV1 as b, resolveWalletUnlockSessionUsesFromRequestedUses as c, computeWalletSignerActivationSetDigestB64u as d, encodeWalletSignerActivationSetV1 as f, isCombinedWalletSignerActivationSetV1 as g, isActiveRecoveredWalletAuthorityV1 as h, buildEd25519SessionPolicy as i, coerceThemeMode as l, isActiveEcdsaWalletAuthorityV1 as m, DEFAULT_THRESHOLD_SESSION_TTL_MS as n, normalizeThresholdRuntimePolicyScope as o, extendEcdsaWalletAuthorityWithEd25519 as p, DEFAULT_UNLOCK_REMAINING_USES as r, parsePositiveSessionUses as s, DEFAULT_THRESHOLD_SESSION_POLICY as t, computeWalletAuthorityDigestB64u as u, parseWalletAuthorityV1 as v, delegatedWalletPermissionNamesV1 as w, walletAuthorityDigestsMatchV1 as x, parseWalletSignerActivationSetV1 as y };
+export { computeWalletAuthMethodRevokeOperationFingerprintV1 as C, parseExactAdministeredSignerManifestV1 as E, buildWalletAuthMethodRecordV2 as S, sameWalletAuthMethodRecordV2 as T, rawDigest as _, isActiveEcdsaWalletAuthorityV1 as a, u32 as b, isEcdsaExtensionOfEd25519WalletAuthority as c, parseWalletSignerActivationSetV1 as d, replaceActiveWalletAuthorityEd25519MaterialActivationV1 as f, lp32 as g, concat as h, extendEcdsaWalletAuthorityWithEd25519 as i, isEd25519ExtensionOfEcdsaWalletAuthority as l, walletAuthorityDigestsMatchV1 as m, computeWalletSignerActivationSetDigestB64u as n, isActiveRecoveredWalletAuthorityV1 as o, sameVerifiedActiveWalletAuthorityV1 as p, encodeWalletSignerActivationSetV1 as r, isCombinedWalletSignerActivationSetV1 as s, computeWalletAuthorityDigestB64u as t, parseWalletAuthorityV1 as u, rawPublicKey as v, parseWalletAuthMethodRecordV2 as w, u64 as x, text as y };