@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/sdk/walletAuthority-BQBxgUBn.js

@@ -1,1251 +0,0 @@
-import { A as parseWalletRecoveryOperationId, D as parseWalletAuthorityId, M as parseWebAuthnRpId, O as parseWalletId, T as parseWalletAuthMethodId, h as parseMpcMaterialActivationRef, j as parseWebAuthnCredentialIdB64u, k as parseWalletKeyId, l as parseLinkDeviceSessionId, u as parseLinkedDeviceEnrollmentId } from "./domainIds-lcrFg6Sa.js";
-import { _ as requireRecord } from "./validation-gat4LEKm.js";
-import { i as base64UrlEncode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
-import { P as rejectUnknownFields, T as parseSecp256k1CompressedPublicKeyB64u, b as parseEd25519PublicKeyB64u, j as parseDelegatedWalletPermissionSetV1 } from "./sessionPolicy-CHiilOAB.js";
-import { l as parseDeviceId } from "./capabilityKinds-hvYqa6S_.js";
-import { f as alphabetizeStringify, p as sha256Bytes } from "./chains-BMh3btVo.js";
-import { o as sha256Utf8DigestB64u, r as parseDigestB64u } from "./canonicalPrimitives-BTHWz80v.js";
-import { s as inspectRawObject, u as trimString } from "./registrationIds-DLSdEKSv.js";
-//#region ../shared-ts/src/device-linking/delegatedActivationPlan.ts
-const MANIFEST_FIELDS = [
-	"kind",
-	"keyFamilies",
-	"signers"
-];
-const ED25519_SIGNER_FIELDS = [
-	"kind",
-	"keyFamily",
-	"walletId",
-	"walletKeyId",
-	"registeredPublicKeyB64u"
-];
-const ECDSA_SIGNER_FIELDS = [
-	"kind",
-	"keyFamily",
-	"walletId",
-	"walletKeyId",
-	"thresholdPublicKey33B64u",
-	"evmAddress"
-];
-function buildExactAdministeredSignerManifestV1(signers) {
-	if (signers.length === 0) throw new Error("exact administered signer manifest must contain at least one active family");
-	let walletId;
-	let ed25519;
-	let ecdsa;
-	const seenWalletKeyIds = /* @__PURE__ */ new Set();
-	for (const signer of signers) {
-		if (walletId !== void 0 && walletId !== signer.walletId) throw new Error("exact administered signer manifest must use one wallet identity");
-		walletId = signer.walletId;
-		if (seenWalletKeyIds.has(signer.walletKeyId)) throw new Error(`exact administered signer manifest repeats wallet key ${signer.walletKeyId}`);
-		seenWalletKeyIds.add(signer.walletKeyId);
-		switch (signer.keyFamily) {
-			case "ed25519":
-				if (ed25519 !== void 0) throw new Error("exact administered signer manifest repeats the ed25519 family");
-				if (signer.kind !== "exact_administered_ed25519_signer_v1") throw new Error("exact administered signer manifest has an invalid Ed25519 signer");
-				ed25519 = signer;
-				break;
-			case "ecdsa_secp256k1":
-				if (ecdsa !== void 0) throw new Error("exact administered signer manifest repeats the ecdsa family");
-				if (signer.kind !== "exact_administered_ecdsa_signer_v1") throw new Error("exact administered signer manifest has an invalid ECDSA signer");
-				ecdsa = signer;
-				break;
-		}
-	}
-	if (ed25519 !== void 0 && ecdsa !== void 0) return {
-		kind: "exact_administered_signer_manifest_v1",
-		keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-		signers: [ed25519, ecdsa]
-	};
-	if (ed25519 !== void 0) return {
-		kind: "exact_administered_signer_manifest_v1",
-		keyFamilies: ["ed25519"],
-		signers: [ed25519]
-	};
-	if (ecdsa !== void 0) return {
-		kind: "exact_administered_signer_manifest_v1",
-		keyFamilies: ["ecdsa_secp256k1"],
-		signers: [ecdsa]
-	};
-	throw new Error("exact administered signer manifest must contain a supported family");
-}
-function parseExactAdministeredSignerManifestV1(raw) {
-	const record = exactRecord$1(raw, MANIFEST_FIELDS, "ExactAdministeredSignerManifestV1");
-	if (record.kind !== "exact_administered_signer_manifest_v1") throw new Error("ExactAdministeredSignerManifestV1.kind is invalid");
-	const keyFamilies = parseManifestFamilies(record.keyFamilies);
-	if (!Array.isArray(record.signers)) throw new Error("ExactAdministeredSignerManifestV1.signers must be an array");
-	const signers = [];
-	for (let index = 0; index < record.signers.length; index += 1) signers.push(parseExactAdministeredSignerV1(record.signers[index], `signers[${index}]`));
-	const manifest = buildExactAdministeredSignerManifestV1(signers);
-	if (!sameManifestFamilies(keyFamilies, manifest.keyFamilies)) throw new Error("ExactAdministeredSignerManifestV1.keyFamilies do not match signers");
-	return manifest;
-}
-function parseExactAdministeredSignerV1(raw, label) {
-	const record = requireRecord(raw, label);
-	switch (record.keyFamily) {
-		case "ed25519":
-			rejectUnknownFields(record, ED25519_SIGNER_FIELDS, label);
-			if (record.kind !== "exact_administered_ed25519_signer_v1") throw new Error(`${label}.kind is invalid for Ed25519`);
-			return {
-				kind: "exact_administered_ed25519_signer_v1",
-				keyFamily: "ed25519",
-				walletId: requireParsed$1(parseWalletId(record.walletId), `${label}.walletId`),
-				walletKeyId: requireParsed$1(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
-				registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, `${label}.registeredPublicKeyB64u`)
-			};
-		case "ecdsa_secp256k1":
-			rejectUnknownFields(record, ECDSA_SIGNER_FIELDS, label);
-			if (record.kind !== "exact_administered_ecdsa_signer_v1") throw new Error(`${label}.kind is invalid for ECDSA`);
-			return {
-				kind: "exact_administered_ecdsa_signer_v1",
-				keyFamily: "ecdsa_secp256k1",
-				walletId: requireParsed$1(parseWalletId(record.walletId), `${label}.walletId`),
-				walletKeyId: requireParsed$1(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
-				thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.thresholdPublicKey33B64u, `${label}.thresholdPublicKey33B64u`),
-				evmAddress: parseEvmAddress(record.evmAddress, `${label}.evmAddress`)
-			};
-		default: throw new Error(`${label}.keyFamily is unsupported`);
-	}
-}
-function parseManifestFamilies(raw) {
-	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 2) throw new Error("ExactAdministeredSignerManifestV1.keyFamilies must be non-empty");
-	if (raw.length === 1 && raw[0] === "ed25519") return ["ed25519"];
-	if (raw.length === 1 && raw[0] === "ecdsa_secp256k1") return ["ecdsa_secp256k1"];
-	if (raw.length === 2 && raw[0] === "ed25519" && raw[1] === "ecdsa_secp256k1") return ["ed25519", "ecdsa_secp256k1"];
-	throw new Error("ExactAdministeredSignerManifestV1.keyFamilies must be canonical and duplicate-free");
-}
-function sameManifestFamilies(left, right) {
-	if (left.length !== right.length) return false;
-	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
-	return true;
-}
-function parseEvmAddress(raw, label) {
-	if (typeof raw !== "string" || !/^0x[0-9a-fA-F]{40}$/.test(raw)) throw new Error(`${label} must be a 20-byte hexadecimal EVM address`);
-	return raw;
-}
-function exactRecord$1(raw, fields, label) {
-	const record = requireRecord(raw, label);
-	rejectUnknownFields(record, fields, label);
-	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
-	return record;
-}
-function requireParsed$1(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
-//#endregion
-//#region ../shared-ts/src/utils/walletAuthMethodRecord.ts
-async function computeWalletAuthMethodRevokeOperationFingerprintV1(input) {
-	return sha256Utf8DigestB64u(alphabetizeStringify({
-		version: "wallet_auth_method_revoke_operation_v1",
-		walletId: String(input.walletId),
-		targetWalletAuthMethodId: String(input.targetWalletAuthMethodId),
-		requestedAtMs: input.requestedAtMs
-	}));
-}
-function sameWalletAuthMethodRecordV2(left, right) {
-	if (left.version !== right.version || left.walletAuthMethodId !== right.walletAuthMethodId || left.walletId !== right.walletId || left.walletAuthorityId !== right.walletAuthorityId || left.status !== right.status || left.createdAtMs !== right.createdAtMs || left.updatedAtMs !== right.updatedAtMs) return false;
-	switch (left.kind) {
-		case "passkey":
-			if (right.kind !== "passkey") return false;
-			if (left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u && left.credentialPublicKeyB64u === right.credentialPublicKeyB64u && left.counter === right.counter) break;
-			return false;
-		case "email_otp":
-			if (right.kind !== "email_otp") return false;
-			if (left.emailHashHex === right.emailHashHex && left.registrationAuthorityId === right.registrationAuthorityId) break;
-			return false;
-		default: return assertNeverWalletAuthMethodRecordV2(left, "wallet auth method kind");
-	}
-	switch (left.status) {
-		case "pending_local_install": return right.status === "pending_local_install";
-		case "active": return right.status === "active" && left.activatedAtMs === right.activatedAtMs;
-		case "revoked": return right.status === "revoked" && left.activatedAtMs === right.activatedAtMs && left.revokedAtMs === right.revokedAtMs;
-		default: return assertNeverWalletAuthMethodRecordV2(left, "wallet auth method lifecycle");
-	}
-}
-function assertNeverWalletAuthMethodRecordV2(value, label) {
-	throw new Error(`${label} branch is unsupported: ${String(value)}`);
-}
-function buildWalletAuthMethodRecordV2(input) {
-	validateWalletAuthMethodRecordV2(input);
-	if (input.kind === "passkey") switch (input.status) {
-		case "pending_local_install": return {
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.walletAuthMethodId,
-			walletId: input.walletId,
-			walletAuthorityId: input.walletAuthorityId,
-			kind: "passkey",
-			status: "pending_local_install",
-			rpId: input.rpId,
-			credentialIdB64u: input.credentialIdB64u,
-			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
-			counter: input.counter,
-			createdAtMs: input.createdAtMs,
-			updatedAtMs: input.updatedAtMs
-		};
-		case "active": return {
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.walletAuthMethodId,
-			walletId: input.walletId,
-			walletAuthorityId: input.walletAuthorityId,
-			kind: "passkey",
-			status: "active",
-			rpId: input.rpId,
-			credentialIdB64u: input.credentialIdB64u,
-			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
-			counter: input.counter,
-			createdAtMs: input.createdAtMs,
-			updatedAtMs: input.updatedAtMs,
-			activatedAtMs: input.activatedAtMs
-		};
-		case "revoked": return {
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.walletAuthMethodId,
-			walletId: input.walletId,
-			walletAuthorityId: input.walletAuthorityId,
-			kind: "passkey",
-			status: "revoked",
-			rpId: input.rpId,
-			credentialIdB64u: input.credentialIdB64u,
-			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
-			counter: input.counter,
-			createdAtMs: input.createdAtMs,
-			updatedAtMs: input.updatedAtMs,
-			activatedAtMs: input.activatedAtMs,
-			revokedAtMs: input.revokedAtMs
-		};
-	}
-	switch (input.status) {
-		case "pending_local_install": return {
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.walletAuthMethodId,
-			walletId: input.walletId,
-			walletAuthorityId: input.walletAuthorityId,
-			kind: "email_otp",
-			status: "pending_local_install",
-			emailHashHex: input.emailHashHex,
-			registrationAuthorityId: input.registrationAuthorityId,
-			createdAtMs: input.createdAtMs,
-			updatedAtMs: input.updatedAtMs
-		};
-		case "active": return {
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.walletAuthMethodId,
-			walletId: input.walletId,
-			walletAuthorityId: input.walletAuthorityId,
-			kind: "email_otp",
-			status: "active",
-			emailHashHex: input.emailHashHex,
-			registrationAuthorityId: input.registrationAuthorityId,
-			createdAtMs: input.createdAtMs,
-			updatedAtMs: input.updatedAtMs,
-			activatedAtMs: input.activatedAtMs
-		};
-		case "revoked": return {
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.walletAuthMethodId,
-			walletId: input.walletId,
-			walletAuthorityId: input.walletAuthorityId,
-			kind: "email_otp",
-			status: "revoked",
-			emailHashHex: input.emailHashHex,
-			registrationAuthorityId: input.registrationAuthorityId,
-			createdAtMs: input.createdAtMs,
-			updatedAtMs: input.updatedAtMs,
-			activatedAtMs: input.activatedAtMs,
-			revokedAtMs: input.revokedAtMs
-		};
-	}
-}
-function parseWalletAuthMethodRecordV2(raw) {
-	const record = inspectRawObject(raw);
-	if (!record || !("version" in record) || !("kind" in record) || !("status" in record)) return null;
-	const version = trimString(record.version);
-	const kind = trimString(record.kind);
-	const status = trimString(record.status);
-	if (version !== "wallet_auth_method_v2" || kind !== "passkey" && kind !== "email_otp") return null;
-	try {
-		const common = parseWalletAuthMethodRecordV2Common(record);
-		if (kind === "passkey") {
-			if (!("rpId" in record) || !("credentialIdB64u" in record) || !("credentialPublicKeyB64u" in record) || !("counter" in record)) return null;
-			exactWalletAuthMethodV2Fields(record, "passkey", status);
-			const rpId = parseWebAuthnRpId(record.rpId);
-			const credentialIdB64u = parseWebAuthnCredentialIdB64u(record.credentialIdB64u);
-			if (!rpId.ok || !credentialIdB64u.ok || typeof record.credentialPublicKeyB64u !== "string" || !record.credentialPublicKeyB64u.trim() || Object.prototype.hasOwnProperty.call(record, "emailHashHex") || Object.prototype.hasOwnProperty.call(record, "registrationAuthorityId")) return null;
-			return buildParsedPasskeyWalletAuthMethodRecordV2({
-				common,
-				lifecycle: parseWalletAuthMethodLifecycle(record),
-				rpId: rpId.value,
-				credentialIdB64u: credentialIdB64u.value,
-				credentialPublicKeyB64u: record.credentialPublicKeyB64u,
-				counter: parseNonNegativeInteger(record.counter)
-			});
-		}
-		if (!("emailHashHex" in record) || !("registrationAuthorityId" in record)) return null;
-		exactWalletAuthMethodV2Fields(record, "email_otp", status);
-		const emailHashHex = trimString(record.emailHashHex);
-		const registrationAuthorityId = trimString(record.registrationAuthorityId);
-		if (!emailHashHex || !registrationAuthorityId || Object.prototype.hasOwnProperty.call(record, "rpId") || Object.prototype.hasOwnProperty.call(record, "credentialIdB64u") || Object.prototype.hasOwnProperty.call(record, "credentialPublicKeyB64u") || Object.prototype.hasOwnProperty.call(record, "counter")) return null;
-		return buildParsedEmailOtpWalletAuthMethodRecordV2({
-			common,
-			lifecycle: parseWalletAuthMethodLifecycle(record),
-			emailHashHex,
-			registrationAuthorityId
-		});
-	} catch {
-		return null;
-	}
-}
-function parseWalletAuthMethodRecordV2Common(raw) {
-	if (!("walletAuthMethodId" in raw) || !("walletId" in raw) || !("walletAuthorityId" in raw) || !("createdAtMs" in raw) || !("updatedAtMs" in raw)) throw new Error("wallet auth method common fields are required");
-	return {
-		version: "wallet_auth_method_v2",
-		walletAuthMethodId: parseWalletAuthMethodIdRequired(raw.walletAuthMethodId),
-		walletId: parseWalletIdRequired(raw.walletId),
-		walletAuthorityId: parseWalletAuthorityIdRequired(raw.walletAuthorityId),
-		createdAtMs: parseNonNegativeInteger(raw.createdAtMs),
-		updatedAtMs: parseNonNegativeInteger(raw.updatedAtMs)
-	};
-}
-function validateWalletAuthMethodRecordV2(value) {
-	if (value.version !== "wallet_auth_method_v2") throw new Error("wallet auth method record version is unsupported");
-	if (!value.walletAuthMethodId || !value.walletId || !value.walletAuthorityId) throw new Error("wallet auth method record identities are required");
-	if (!Number.isSafeInteger(value.createdAtMs) || value.createdAtMs < 0) throw new Error("wallet auth method createdAtMs must be a non-negative safe integer");
-	if (!Number.isSafeInteger(value.updatedAtMs) || value.updatedAtMs < value.createdAtMs) throw new Error("wallet auth method updatedAtMs must follow createdAtMs");
-	if (value.kind === "passkey") {
-		if (!value.rpId || !value.credentialIdB64u || !value.credentialPublicKeyB64u.trim()) throw new Error("passkey wallet auth method fields are required");
-		if (!Number.isSafeInteger(value.counter) || value.counter < 0) throw new Error("passkey authenticator counter must be non-negative");
-	} else if (!value.emailHashHex.trim() || !value.registrationAuthorityId.trim()) throw new Error("email OTP wallet auth method fields are required");
-	switch (value.status) {
-		case "pending_local_install": return;
-		case "active":
-			validateNonNegativeInteger(value.activatedAtMs, "activatedAtMs");
-			return;
-		case "revoked":
-			validateNonNegativeInteger(value.activatedAtMs, "activatedAtMs");
-			validateNonNegativeInteger(value.revokedAtMs, "revokedAtMs");
-			if (value.revokedAtMs < value.activatedAtMs) throw new Error("revokedAtMs cannot precede activatedAtMs");
-			return;
-	}
-}
-function parseWalletAuthMethodLifecycle(raw) {
-	if (!("status" in raw)) throw new Error("wallet auth method status is required");
-	switch (raw.status) {
-		case "pending_local_install": return { status: "pending_local_install" };
-		case "active":
-			if (!("activatedAtMs" in raw)) throw new Error("wallet auth method activatedAtMs is required");
-			return {
-				status: "active",
-				activatedAtMs: parseNonNegativeInteger(raw.activatedAtMs)
-			};
-		case "revoked":
-			if (!("activatedAtMs" in raw) || !("revokedAtMs" in raw)) throw new Error("wallet auth method revocation timestamps are required");
-			return {
-				status: "revoked",
-				activatedAtMs: parseNonNegativeInteger(raw.activatedAtMs),
-				revokedAtMs: parseNonNegativeInteger(raw.revokedAtMs)
-			};
-		default: throw new Error("wallet auth method status is unsupported");
-	}
-}
-function exactWalletAuthMethodV2Fields(raw, kind, status) {
-	const fields = [
-		"version",
-		"walletAuthMethodId",
-		"walletId",
-		"walletAuthorityId",
-		"kind",
-		"status",
-		"createdAtMs",
-		"updatedAtMs"
-	];
-	if (kind === "passkey") fields.push("rpId", "credentialIdB64u", "credentialPublicKeyB64u", "counter");
-	else fields.push("emailHashHex", "registrationAuthorityId");
-	if (status === "active") fields.push("activatedAtMs");
-	if (status === "revoked") fields.push("activatedAtMs", "revokedAtMs");
-	if (status !== "pending_local_install" && status !== "active" && status !== "revoked") throw new Error("wallet auth method status is unsupported");
-	const expected = new Set(fields);
-	const actual = Object.keys(raw);
-	if (actual.length !== fields.length) throw new Error("wallet auth method record has invalid fields");
-	for (const field of actual) if (!expected.has(field)) throw new Error(`wallet auth method field ${field} is invalid`);
-}
-function buildParsedPasskeyWalletAuthMethodRecordV2(input) {
-	switch (input.lifecycle.status) {
-		case "pending_local_install": return {
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.common.walletAuthMethodId,
-			walletId: input.common.walletId,
-			walletAuthorityId: input.common.walletAuthorityId,
-			kind: "passkey",
-			status: "pending_local_install",
-			createdAtMs: input.common.createdAtMs,
-			updatedAtMs: input.common.updatedAtMs,
-			rpId: input.rpId,
-			credentialIdB64u: input.credentialIdB64u,
-			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
-			counter: input.counter
-		};
-		case "active": return {
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.common.walletAuthMethodId,
-			walletId: input.common.walletId,
-			walletAuthorityId: input.common.walletAuthorityId,
-			kind: "passkey",
-			status: "active",
-			createdAtMs: input.common.createdAtMs,
-			updatedAtMs: input.common.updatedAtMs,
-			rpId: input.rpId,
-			credentialIdB64u: input.credentialIdB64u,
-			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
-			counter: input.counter,
-			activatedAtMs: input.lifecycle.activatedAtMs
-		};
-		case "revoked": return {
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.common.walletAuthMethodId,
-			walletId: input.common.walletId,
-			walletAuthorityId: input.common.walletAuthorityId,
-			kind: "passkey",
-			status: "revoked",
-			createdAtMs: input.common.createdAtMs,
-			updatedAtMs: input.common.updatedAtMs,
-			rpId: input.rpId,
-			credentialIdB64u: input.credentialIdB64u,
-			credentialPublicKeyB64u: input.credentialPublicKeyB64u,
-			counter: input.counter,
-			activatedAtMs: input.lifecycle.activatedAtMs,
-			revokedAtMs: input.lifecycle.revokedAtMs
-		};
-	}
-}
-function buildParsedEmailOtpWalletAuthMethodRecordV2(input) {
-	switch (input.lifecycle.status) {
-		case "pending_local_install": return {
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.common.walletAuthMethodId,
-			walletId: input.common.walletId,
-			walletAuthorityId: input.common.walletAuthorityId,
-			kind: "email_otp",
-			status: "pending_local_install",
-			createdAtMs: input.common.createdAtMs,
-			updatedAtMs: input.common.updatedAtMs,
-			emailHashHex: input.emailHashHex,
-			registrationAuthorityId: input.registrationAuthorityId
-		};
-		case "active": return {
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.common.walletAuthMethodId,
-			walletId: input.common.walletId,
-			walletAuthorityId: input.common.walletAuthorityId,
-			kind: "email_otp",
-			status: "active",
-			createdAtMs: input.common.createdAtMs,
-			updatedAtMs: input.common.updatedAtMs,
-			emailHashHex: input.emailHashHex,
-			registrationAuthorityId: input.registrationAuthorityId,
-			activatedAtMs: input.lifecycle.activatedAtMs
-		};
-		case "revoked": return {
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.common.walletAuthMethodId,
-			walletId: input.common.walletId,
-			walletAuthorityId: input.common.walletAuthorityId,
-			kind: "email_otp",
-			status: "revoked",
-			createdAtMs: input.common.createdAtMs,
-			updatedAtMs: input.common.updatedAtMs,
-			emailHashHex: input.emailHashHex,
-			registrationAuthorityId: input.registrationAuthorityId,
-			activatedAtMs: input.lifecycle.activatedAtMs,
-			revokedAtMs: input.lifecycle.revokedAtMs
-		};
-	}
-}
-function parseWalletAuthMethodIdRequired(raw) {
-	const parsed = parseWalletAuthMethodId(raw);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-function parseWalletIdRequired(raw) {
-	const parsed = parseWalletId(raw);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-function parseWalletAuthorityIdRequired(raw) {
-	const parsed = parseWalletAuthorityId(raw);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-function parseNonNegativeInteger(raw) {
-	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw new Error("value must be a non-negative safe integer");
-	return raw;
-}
-function validateNonNegativeInteger(raw, label) {
-	if (!Number.isSafeInteger(raw) || raw < 0) throw new Error(`${label} must be a non-negative safe integer`);
-}
-//#endregion
-//#region ../shared-ts/src/utils/digestEncoding.ts
-const TEXT_ENCODER = new TextEncoder();
-function concat(parts) {
-	let length = 0;
-	for (const part of parts) length += part.length;
-	const output = new Uint8Array(length);
-	let offset = 0;
-	for (const part of parts) {
-		output.set(part, offset);
-		offset += part.length;
-	}
-	return output;
-}
-function u32(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0 || value > 4294967295) throw new Error(`${label} must be a non-negative u32`);
-	return Uint8Array.from([
-		value >>> 24 & 255,
-		value >>> 16 & 255,
-		value >>> 8 & 255,
-		value & 255
-	]);
-}
-function u64(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	let remaining = BigInt(value);
-	const output = new Uint8Array(8);
-	for (let index = 7; index >= 0; index -= 1) {
-		output[index] = Number(remaining & 255n);
-		remaining >>= 8n;
-	}
-	return output;
-}
-function lp32(value, label) {
-	return concat([u32(value.length, `${label}.length`), value]);
-}
-function text(value, label) {
-	if (typeof value !== "string") throw new Error(`${label} must be a string`);
-	return lp32(TEXT_ENCODER.encode(value), label);
-}
-function rawDigest(value, label) {
-	try {
-		const decoded = base64UrlDecode(parseDigestB64u(value));
-		if (decoded.length !== 32) throw new Error("must decode to 32 bytes");
-		return decoded;
-	} catch (error) {
-		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
-	}
-}
-function rawPublicKey(value, label) {
-	try {
-		const decoded = base64UrlDecode(value);
-		if (decoded.length === 0 || base64UrlEncode(decoded) !== value) throw new Error("must be canonical base64url");
-		return decoded;
-	} catch (error) {
-		throw new Error(`${label} ${error instanceof Error ? error.message : "is invalid"}`);
-	}
-}
-//#endregion
-//#region ../shared-ts/src/authorization/walletAuthority.ts
-const SIGNER_ACTIVATION_SET_DOMAIN = "seams/wallet-signer-activation-set/v1";
-const WALLET_AUTHORITY_DOMAIN = "seams/wallet-authority/v1";
-function isCombinedWalletSignerActivationSetV1(value) {
-	return isBothFamilyActivationSet(value);
-}
-function isActiveEcdsaWalletAuthorityV1(value) {
-	return isEcdsaOnlyActivationSet(value.signerActivations);
-}
-function isActiveEd25519WalletAuthorityV1(value) {
-	return isEd25519OnlyActivationSet(value.signerActivations);
-}
-function isActiveRecoveredWalletAuthorityV1(value) {
-	return value.provenance.kind === "wallet_recovery";
-}
-function buildWalletEd25519SignerActivationV1(input) {
-	return {
-		kind: "wallet_ed25519_signer_activation_v1",
-		signer: input.signer,
-		materialActivation: input.materialActivation
-	};
-}
-function buildWalletEcdsaSignerActivationV1(input) {
-	return {
-		kind: "wallet_ecdsa_signer_activation_v1",
-		signer: input.signer,
-		materialActivation: input.materialActivation
-	};
-}
-function buildWalletSignerActivationSetV1(input) {
-	const manifest = parseExactAdministeredSignerManifestV1(input.manifest);
-	const materials = normalizeWalletSignerActivationMaterials(input.materialActivations);
-	if (!sameFamilies(manifest.keyFamilies, materials.keyFamilies)) throw new Error("wallet signer activation materials must match the signer manifest families");
-	if (isEd25519OnlyManifest(manifest)) {
-		if (!isEd25519OnlyMaterials(materials)) throw new Error("Ed25519 signer activation requires one Ed25519 material activation");
-		return {
-			kind: "wallet_signer_activation_set_v1",
-			keyFamilies: ["ed25519"],
-			ed25519: buildWalletEd25519SignerActivationV1({
-				signer: manifest.signers[0],
-				materialActivation: materials.ed25519
-			})
-		};
-	}
-	if (isEcdsaOnlyManifest(manifest)) {
-		if (!isEcdsaOnlyMaterials(materials)) throw new Error("ECDSA signer activation requires one ECDSA material activation");
-		return {
-			kind: "wallet_signer_activation_set_v1",
-			keyFamilies: ["ecdsa_secp256k1"],
-			ecdsa: buildWalletEcdsaSignerActivationV1({
-				signer: manifest.signers[0],
-				materialActivation: materials.ecdsa
-			})
-		};
-	}
-	if (!isBothFamilyManifest(manifest) || !isBothFamilyMaterials(materials)) throw new Error("wallet signer activation set has unsupported families");
-	if (materials.ed25519.activationId === materials.ecdsa.activationId) throw new Error("wallet signer activation references must be distinct");
-	return {
-		kind: "wallet_signer_activation_set_v1",
-		keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-		ed25519: buildWalletEd25519SignerActivationV1({
-			signer: manifest.signers[0],
-			materialActivation: materials.ed25519
-		}),
-		ecdsa: buildWalletEcdsaSignerActivationV1({
-			signer: manifest.signers[1],
-			materialActivation: materials.ecdsa
-		})
-	};
-}
-function parseWalletSignerActivationSetV1(raw) {
-	try {
-		const record = requireRecord(raw, "WalletSignerActivationSetV1");
-		if (record.kind !== "wallet_signer_activation_set_v1") return invalidResult("wallet signer activation set kind is unsupported");
-		if (!Object.prototype.hasOwnProperty.call(record, "keyFamilies")) return invalidResult("WalletSignerActivationSetV1.keyFamilies is required");
-		const families = parseFamilies(record.keyFamilies, "WalletSignerActivationSetV1.keyFamilies");
-		if (families.length === 1 && families[0] === "ed25519") {
-			exactFields(record, [
-				"kind",
-				"keyFamilies",
-				"ed25519"
-			], "WalletSignerActivationSetV1");
-			return {
-				ok: true,
-				value: {
-					kind: "wallet_signer_activation_set_v1",
-					keyFamilies: ["ed25519"],
-					ed25519: parseEd25519Activation(record.ed25519, "ed25519")
-				}
-			};
-		}
-		if (families.length === 1 && families[0] === "ecdsa_secp256k1") {
-			exactFields(record, [
-				"kind",
-				"keyFamilies",
-				"ecdsa"
-			], "WalletSignerActivationSetV1");
-			return {
-				ok: true,
-				value: {
-					kind: "wallet_signer_activation_set_v1",
-					keyFamilies: ["ecdsa_secp256k1"],
-					ecdsa: parseEcdsaActivation(record.ecdsa, "ecdsa")
-				}
-			};
-		}
-		exactFields(record, [
-			"kind",
-			"keyFamilies",
-			"ed25519",
-			"ecdsa"
-		], "WalletSignerActivationSetV1");
-		const ed25519 = parseEd25519Activation(record.ed25519, "ed25519");
-		const ecdsa = parseEcdsaActivation(record.ecdsa, "ecdsa");
-		if (ed25519.materialActivation.activationId === ecdsa.materialActivation.activationId) return invalidResult("wallet signer activation references must be distinct");
-		return {
-			ok: true,
-			value: {
-				kind: "wallet_signer_activation_set_v1",
-				keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-				ed25519,
-				ecdsa
-			}
-		};
-	} catch (error) {
-		return invalidResult(errorMessage(error, "wallet signer activation set is invalid"));
-	}
-}
-function encodeWalletSignerActivationSetV1(value) {
-	const parts = [
-		text(SIGNER_ACTIVATION_SET_DOMAIN, "domain"),
-		text(value.kind, "kind"),
-		u32(value.keyFamilies.length, "keyFamilies")
-	];
-	for (const family of value.keyFamilies) parts.push(text(family, "keyFamilies.item"));
-	if (isEd25519OnlyActivationSet(value) || isBothFamilyActivationSet(value)) parts.push(lp32(encodeEd25519Activation(value.ed25519), "ed25519"));
-	if (isEcdsaOnlyActivationSet(value) || isBothFamilyActivationSet(value)) parts.push(lp32(encodeEcdsaActivation(value.ecdsa), "ecdsa"));
-	return concat(parts);
-}
-async function computeWalletSignerActivationSetDigestB64u(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeWalletSignerActivationSetV1(value))));
-}
-/** The fields every lifecycle state carries, copied in record order. */
-function walletAuthorityCommonFields(input) {
-	return {
-		kind: "wallet_authority_v1",
-		authorityId: input.authorityId,
-		walletId: input.walletId,
-		principal: input.principal,
-		provenance: input.provenance,
-		permissions: input.permissions,
-		signerActivations: input.signerActivations,
-		signerActivationSetDigestB64u: input.signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authorityDigestB64u,
-		revocationEpoch: input.revocationEpoch,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs
-	};
-}
-function buildPendingWalletAuthorityV1(input) {
-	validateWalletAuthorityV1(input);
-	return {
-		...walletAuthorityCommonFields(input),
-		state: "pending_local_install",
-		localInstallPackageSetDigestB64u: input.localInstallPackageSetDigestB64u
-	};
-}
-function buildActiveWalletAuthorityV1(input) {
-	validateWalletAuthorityV1(input);
-	return {
-		...walletAuthorityCommonFields(input),
-		state: "active",
-		activatedAtMs: input.activatedAtMs
-	};
-}
-async function replaceActiveWalletAuthorityEd25519MaterialActivationV1(input) {
-	const current = input.authority.signerActivations;
-	if (!current.ed25519) throw new Error("active Wallet Authority has no Ed25519 material activation to replace");
-	const signerActivations = current.ecdsa ? buildWalletSignerActivationSetV1({
-		manifest: buildExactAdministeredSignerManifestV1([current.ed25519.signer, current.ecdsa.signer]),
-		materialActivations: {
-			keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-			ed25519: input.materialActivation,
-			ecdsa: current.ecdsa.materialActivation
-		}
-	}) : buildWalletSignerActivationSetV1({
-		manifest: buildExactAdministeredSignerManifestV1([current.ed25519.signer]),
-		materialActivations: {
-			keyFamilies: ["ed25519"],
-			ed25519: input.materialActivation
-		}
-	});
-	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
-	const draft = {
-		kind: input.authority.kind,
-		authorityId: input.authority.authorityId,
-		walletId: input.authority.walletId,
-		principal: input.authority.principal,
-		provenance: input.authority.provenance,
-		permissions: input.authority.permissions,
-		signerActivations,
-		signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authority.authorityDigestB64u,
-		revocationEpoch: input.authority.revocationEpoch,
-		createdAtMs: input.authority.createdAtMs,
-		updatedAtMs: Math.max(input.authority.updatedAtMs, input.updatedAtMs),
-		state: "active",
-		activatedAtMs: input.authority.activatedAtMs
-	};
-	return buildActiveWalletAuthorityV1({
-		...draft,
-		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft)
-	});
-}
-function buildActiveCombinedWalletAuthorityV1(input) {
-	validateWalletAuthorityV1(input);
-	return {
-		...walletAuthorityCommonFields(input),
-		state: "active",
-		activatedAtMs: input.activatedAtMs
-	};
-}
-function buildRevokedWalletAuthorityV1(input) {
-	validateWalletAuthorityV1(input);
-	return {
-		...walletAuthorityCommonFields(input),
-		state: "revoked",
-		activatedAtMs: input.activatedAtMs,
-		revokedAtMs: input.revokedAtMs
-	};
-}
-/** The record fields every lifecycle state has, in canonical order; each state adds its own. */
-const WALLET_AUTHORITY_FIELDS = [
-	"kind",
-	"authorityId",
-	"walletId",
-	"principal",
-	"provenance",
-	"permissions",
-	"signerActivations",
-	"signerActivationSetDigestB64u",
-	"authorityDigestB64u",
-	"revocationEpoch",
-	"createdAtMs",
-	"updatedAtMs",
-	"state"
-];
-function parseWalletAuthorityV1(raw) {
-	try {
-		const record = requireRecord(raw, "WalletAuthorityV1");
-		const common = parseWalletAuthorityCommon(record);
-		switch (record.state) {
-			case "pending_local_install":
-				exactFields(record, [...WALLET_AUTHORITY_FIELDS, "localInstallPackageSetDigestB64u"], "WalletAuthorityV1");
-				return {
-					ok: true,
-					value: buildPendingWalletAuthorityV1({
-						kind: "wallet_authority_v1",
-						...common,
-						state: "pending_local_install",
-						localInstallPackageSetDigestB64u: parseDigestField(record.localInstallPackageSetDigestB64u, "localInstallPackageSetDigestB64u")
-					})
-				};
-			case "active":
-				exactFields(record, [...WALLET_AUTHORITY_FIELDS, "activatedAtMs"], "WalletAuthorityV1");
-				return {
-					ok: true,
-					value: buildActiveWalletAuthorityV1({
-						kind: "wallet_authority_v1",
-						...common,
-						state: "active",
-						activatedAtMs: parseSafeInteger(record.activatedAtMs, "activatedAtMs")
-					})
-				};
-			case "revoked":
-				exactFields(record, [
-					...WALLET_AUTHORITY_FIELDS,
-					"activatedAtMs",
-					"revokedAtMs"
-				], "WalletAuthorityV1");
-				return {
-					ok: true,
-					value: buildRevokedWalletAuthorityV1({
-						kind: "wallet_authority_v1",
-						...common,
-						state: "revoked",
-						activatedAtMs: parseSafeInteger(record.activatedAtMs, "activatedAtMs"),
-						revokedAtMs: parseSafeInteger(record.revokedAtMs, "revokedAtMs")
-					})
-				};
-			default: return invalidResult("WalletAuthorityV1.state is unsupported");
-		}
-	} catch (error) {
-		return invalidResult(errorMessage(error, "wallet authority is invalid"));
-	}
-}
-function encodeWalletAuthorityV1(value) {
-	return concat([
-		text(WALLET_AUTHORITY_DOMAIN, "domain"),
-		text(value.kind, "kind"),
-		text(value.authorityId, "authorityId"),
-		text(value.walletId, "walletId"),
-		lp32(encodePrincipal(value.principal), "principal"),
-		lp32(encodeProvenance(value.provenance), "provenance"),
-		lp32(encodePermissions(value.permissions), "permissions"),
-		rawDigest(value.signerActivationSetDigestB64u, "signerActivationSetDigestB64u"),
-		text(value.state, "state"),
-		u64(value.revocationEpoch, "revocationEpoch")
-	]);
-}
-async function computeWalletAuthorityDigestB64u(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeWalletAuthorityV1(value))));
-}
-async function walletAuthorityDigestsMatchV1(value) {
-	if (await computeWalletSignerActivationSetDigestB64u(value.signerActivations) !== value.signerActivationSetDigestB64u) return false;
-	return await computeWalletAuthorityDigestB64u(value) === value.authorityDigestB64u;
-}
-/**
-* True when both authorities' stored digests verify and agree. The authority digest does not
-* cover the timestamps, so those must agree too.
-*/
-async function sameVerifiedActiveWalletAuthorityV1(left, right) {
-	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
-	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
-}
-function parseWalletAuthorityCommon(record) {
-	if (record.kind !== "wallet_authority_v1") throw new Error("WalletAuthorityV1.kind is unsupported");
-	const authorityId = requireParsed(parseWalletAuthorityId(record.authorityId), "authorityId");
-	const walletId = requireParsed(parseWalletId(record.walletId), "walletId");
-	const principal = parsePrincipal(record.principal);
-	const provenance = parseProvenance(record.provenance);
-	const permissions = requireParsed(parseDelegatedWalletPermissionSetV1(record.permissions), "permissions");
-	const signerActivations = requireParsed(parseWalletSignerActivationSetV1(record.signerActivations), "signerActivations");
-	const signerActivationSetDigestB64u = parseDigestField(record.signerActivationSetDigestB64u, "signerActivationSetDigestB64u");
-	const authorityDigestB64u = parseDigestField(record.authorityDigestB64u, "authorityDigestB64u");
-	const revocationEpoch = parseSafeInteger(record.revocationEpoch, "revocationEpoch");
-	const createdAtMs = parseSafeInteger(record.createdAtMs, "createdAtMs");
-	const updatedAtMs = parseSafeInteger(record.updatedAtMs, "updatedAtMs");
-	validateSignerActivationsForWallet(signerActivations, walletId);
-	return {
-		authorityId,
-		walletId,
-		principal,
-		provenance,
-		permissions,
-		signerActivations,
-		signerActivationSetDigestB64u,
-		authorityDigestB64u,
-		revocationEpoch,
-		createdAtMs,
-		updatedAtMs
-	};
-}
-function validateWalletAuthorityV1(value) {
-	if (value.kind !== "wallet_authority_v1") throw new Error("wallet authority kind is unsupported");
-	if (!Number.isSafeInteger(value.revocationEpoch) || value.revocationEpoch < 0) throw new Error("wallet authority revocationEpoch must be a non-negative safe integer");
-	validateTimestamp(value.createdAtMs, "createdAtMs");
-	validateTimestamp(value.updatedAtMs, "updatedAtMs");
-	if (value.updatedAtMs < value.createdAtMs) throw new Error("wallet authority updatedAtMs cannot precede createdAtMs");
-	parseDigestField(value.signerActivationSetDigestB64u, "signerActivationSetDigestB64u");
-	parseDigestField(value.authorityDigestB64u, "authorityDigestB64u");
-	validateSignerActivationsForWallet(value.signerActivations, value.walletId);
-	validateProvenance(value.provenance);
-	switch (value.state) {
-		case "pending_local_install":
-			parseDigestField(value.localInstallPackageSetDigestB64u, "localInstallPackageSetDigestB64u");
-			break;
-		case "active":
-			validateTimestamp(value.activatedAtMs, "activatedAtMs");
-			break;
-		case "revoked":
-			validateTimestamp(value.activatedAtMs, "activatedAtMs");
-			validateTimestamp(value.revokedAtMs, "revokedAtMs");
-			if (value.revokedAtMs < value.activatedAtMs) throw new Error("revokedAtMs cannot precede activatedAtMs");
-			break;
-	}
-}
-function parsePrincipal(raw) {
-	const record = exactRecord(raw, ["kind", "deviceId"], "WalletAuthorityPrincipalV1");
-	if (record.kind !== "owner_device") throw new Error("wallet authority principal kind is unsupported");
-	return {
-		kind: "owner_device",
-		deviceId: requireParsed(parseDeviceId(record.deviceId), "deviceId")
-	};
-}
-function parseProvenance(raw) {
-	const record = requireRecord(raw, "WalletAuthorityProvenanceV1");
-	switch (record.kind) {
-		case "wallet_registration":
-			exactFields(record, ["kind"], "WalletAuthorityProvenanceV1");
-			return { kind: "wallet_registration" };
-		case "device_link":
-			exactFields(record, [
-				"kind",
-				"enrollmentId",
-				"sourceAuthorityId",
-				"linkSessionId"
-			], "WalletAuthorityProvenanceV1");
-			return {
-				kind: "device_link",
-				enrollmentId: requireParsed(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
-				sourceAuthorityId: requireParsed(parseWalletAuthorityId(record.sourceAuthorityId), "sourceAuthorityId"),
-				linkSessionId: requireParsed(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId")
-			};
-		case "wallet_recovery":
-			exactFields(record, [
-				"kind",
-				"recoveryOperationId",
-				"continuityAuthorityId"
-			], "WalletAuthorityProvenanceV1");
-			return {
-				kind: "wallet_recovery",
-				recoveryOperationId: requireParsed(parseWalletRecoveryOperationId(record.recoveryOperationId), "recoveryOperationId"),
-				continuityAuthorityId: requireParsed(parseWalletAuthorityId(record.continuityAuthorityId), "continuityAuthorityId")
-			};
-		default: throw new Error("wallet authority provenance kind is unsupported");
-	}
-}
-function validateProvenance(value) {
-	switch (value.kind) {
-		case "wallet_registration": return;
-		case "device_link":
-			if (!value.enrollmentId || !value.sourceAuthorityId || !value.linkSessionId) throw new Error("device-link provenance requires every audit identity");
-			return;
-		case "wallet_recovery":
-			if (!value.recoveryOperationId || !value.continuityAuthorityId) throw new Error("wallet-recovery provenance requires every audit identity");
-			return;
-	}
-	assertNever(value, "wallet authority provenance");
-}
-function validateSignerActivationsForWallet(value, walletId) {
-	if (isEd25519OnlyActivationSet(value)) {
-		if (value.ed25519.signer.walletId !== walletId) throw new Error("Ed25519 signer activation uses a different wallet id");
-		return;
-	}
-	if (isEcdsaOnlyActivationSet(value)) {
-		if (value.ecdsa.signer.walletId !== walletId) throw new Error("ECDSA signer activation uses a different wallet id");
-		return;
-	}
-	if (isBothFamilyActivationSet(value)) {
-		if (value.ed25519.signer.walletId !== walletId || value.ecdsa.signer.walletId !== walletId) throw new Error("signer activations must use the authority wallet id");
-		return;
-	}
-	throw new Error("wallet signer activation families are unsupported");
-}
-function parseEd25519Activation(raw, label) {
-	const record = exactRecord(raw, [
-		"kind",
-		"signer",
-		"materialActivation"
-	], label);
-	if (record.kind !== "wallet_ed25519_signer_activation_v1") throw new Error(`${label}.kind is invalid`);
-	const manifest = parseManifestForSigner(record.signer, "ed25519", `${label}.signer`);
-	if (!isEd25519OnlyManifest(manifest)) throw new Error(`${label}.signer is not Ed25519`);
-	return buildWalletEd25519SignerActivationV1({
-		signer: manifest.signers[0],
-		materialActivation: requireParsed(parseMpcMaterialActivationRef(record.materialActivation), `${label}.materialActivation`)
-	});
-}
-function parseEcdsaActivation(raw, label) {
-	const record = exactRecord(raw, [
-		"kind",
-		"signer",
-		"materialActivation"
-	], label);
-	if (record.kind !== "wallet_ecdsa_signer_activation_v1") throw new Error(`${label}.kind is invalid`);
-	const manifest = parseManifestForSigner(record.signer, "ecdsa_secp256k1", `${label}.signer`);
-	if (!isEcdsaOnlyManifest(manifest)) throw new Error(`${label}.signer is not ECDSA`);
-	return buildWalletEcdsaSignerActivationV1({
-		signer: manifest.signers[0],
-		materialActivation: requireParsed(parseMpcMaterialActivationRef(record.materialActivation), `${label}.materialActivation`)
-	});
-}
-function parseManifestForSigner(raw, family, _label) {
-	return parseExactAdministeredSignerManifestV1({
-		kind: "exact_administered_signer_manifest_v1",
-		keyFamilies: [family],
-		signers: [raw]
-	});
-}
-function encodeEd25519Activation(value) {
-	return concat([
-		text(value.kind, "ed25519.kind"),
-		lp32(encodeEd25519Signer(value.signer), "ed25519.signer"),
-		lp32(encodeMaterialActivation(value.materialActivation), "ed25519.materialActivation")
-	]);
-}
-function encodeEcdsaActivation(value) {
-	return concat([
-		text(value.kind, "ecdsa.kind"),
-		lp32(encodeEcdsaSigner(value.signer), "ecdsa.signer"),
-		lp32(encodeMaterialActivation(value.materialActivation), "ecdsa.materialActivation")
-	]);
-}
-function encodeEd25519Signer(value) {
-	return concat([
-		text(value.kind, "ed25519.signer.kind"),
-		text(value.keyFamily, "ed25519.signer.keyFamily"),
-		text(value.walletId, "ed25519.signer.walletId"),
-		text(value.walletKeyId, "ed25519.signer.walletKeyId"),
-		lp32(rawPublicKey(value.registeredPublicKeyB64u, "ed25519.signer.registeredPublicKeyB64u"), "ed25519.signer.registeredPublicKeyB64u")
-	]);
-}
-function encodeEcdsaSigner(value) {
-	return concat([
-		text(value.kind, "ecdsa.signer.kind"),
-		text(value.keyFamily, "ecdsa.signer.keyFamily"),
-		text(value.walletId, "ecdsa.signer.walletId"),
-		text(value.walletKeyId, "ecdsa.signer.walletKeyId"),
-		lp32(rawPublicKey(value.thresholdPublicKey33B64u, "ecdsa.signer.thresholdPublicKey33B64u"), "ecdsa.signer.thresholdPublicKey33B64u"),
-		text(value.evmAddress, "ecdsa.signer.evmAddress")
-	]);
-}
-function encodeMaterialActivation(value) {
-	return concat([
-		text(value.kind, "materialActivation.kind"),
-		text(value.activationId, "materialActivation.activationId"),
-		text(value.capability, "materialActivation.capability"),
-		text(value.materialOwner, "materialActivation.materialOwner"),
-		text(value.keyBinding, "materialActivation.keyBinding"),
-		text(value.lifecycleBinding, "materialActivation.lifecycleBinding"),
-		text(value.signingWorker, "materialActivation.signingWorker")
-	]);
-}
-function encodePrincipal(value) {
-	return concat([text(value.kind, "principal.kind"), text(value.deviceId, "principal.deviceId")]);
-}
-function encodeProvenance(value) {
-	switch (value.kind) {
-		case "wallet_registration": return text(value.kind, "provenance.kind");
-		case "device_link": return concat([
-			text(value.kind, "provenance.kind"),
-			text(value.enrollmentId, "provenance.enrollmentId"),
-			text(value.sourceAuthorityId, "provenance.sourceAuthorityId"),
-			text(value.linkSessionId, "provenance.linkSessionId")
-		]);
-		case "wallet_recovery": return concat([
-			text(value.kind, "provenance.kind"),
-			text(value.recoveryOperationId, "provenance.recoveryOperationId"),
-			text(value.continuityAuthorityId, "provenance.continuityAuthorityId")
-		]);
-	}
-	return assertNever(value, "wallet authority provenance");
-}
-function encodePermissions(value) {
-	const parts = [u32(value.length, "permissions")];
-	for (const permission of value) parts.push(lp32(text(permission, "permissions.item"), "permissions.item"));
-	return concat(parts);
-}
-function exactRecord(value, fields, label) {
-	const record = requireRecord(value, label);
-	exactFields(record, fields, label);
-	return record;
-}
-function exactFields(record, fields, label) {
-	const expected = new Set(fields);
-	const actual = Object.keys(record);
-	if (actual.length !== fields.length) throw new Error(`${label} contains unexpected fields`);
-	for (const field of actual) if (!expected.has(field)) throw new Error(`${label}.${field} is not allowed`);
-	for (const field of fields) if (!Object.prototype.hasOwnProperty.call(record, field)) throw new Error(`${label}.${field} is required`);
-}
-function parseFamilies(raw, label) {
-	if (!Array.isArray(raw)) throw new Error(`${label} must be an array`);
-	if (raw.length === 1 && raw[0] === "ed25519") return ["ed25519"];
-	if (raw.length === 1 && raw[0] === "ecdsa_secp256k1") return ["ecdsa_secp256k1"];
-	if (raw.length === 2 && raw[0] === "ed25519" && raw[1] === "ecdsa_secp256k1") return ["ed25519", "ecdsa_secp256k1"];
-	throw new Error(`${label} must use canonical family order`);
-}
-function sameFamilies(left, right) {
-	if (left.length !== right.length) return false;
-	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
-	return true;
-}
-function isEd25519OnlyManifest(value) {
-	return value.keyFamilies.length === 1 && value.keyFamilies[0] === "ed25519";
-}
-function isEcdsaOnlyManifest(value) {
-	return value.keyFamilies.length === 1 && value.keyFamilies[0] === "ecdsa_secp256k1";
-}
-function isBothFamilyManifest(value) {
-	return value.keyFamilies.length === 2;
-}
-function isEd25519OnlyMaterials(value) {
-	return value.keyFamilies.length === 1 && value.keyFamilies[0] === "ed25519";
-}
-function isEcdsaOnlyMaterials(value) {
-	return value.keyFamilies.length === 1 && value.keyFamilies[0] === "ecdsa_secp256k1";
-}
-function isBothFamilyMaterials(value) {
-	return value.keyFamilies.length === 2;
-}
-function normalizeWalletSignerActivationMaterials(value) {
-	if (isEd25519OnlyMaterials(value)) return {
-		keyFamilies: ["ed25519"],
-		ed25519: requireParsed(parseMpcMaterialActivationRef(value.ed25519), "materialActivations.ed25519")
-	};
-	if (isEcdsaOnlyMaterials(value)) return {
-		keyFamilies: ["ecdsa_secp256k1"],
-		ecdsa: requireParsed(parseMpcMaterialActivationRef(value.ecdsa), "materialActivations.ecdsa")
-	};
-	if (isBothFamilyMaterials(value)) return {
-		keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-		ed25519: requireParsed(parseMpcMaterialActivationRef(value.ed25519), "materialActivations.ed25519"),
-		ecdsa: requireParsed(parseMpcMaterialActivationRef(value.ecdsa), "materialActivations.ecdsa")
-	};
-	throw new Error("wallet signer activation materials are unsupported");
-}
-function isEd25519OnlyActivationSet(value) {
-	return value.keyFamilies.length === 1 && value.keyFamilies[0] === "ed25519";
-}
-function isEcdsaOnlyActivationSet(value) {
-	return value.keyFamilies.length === 1 && value.keyFamilies[0] === "ecdsa_secp256k1";
-}
-function isBothFamilyActivationSet(value) {
-	return value.keyFamilies.length === 2;
-}
-function parseDigestField(raw, label) {
-	try {
-		return parseDigestB64u(raw);
-	} catch (error) {
-		throw new Error(`${label} ${errorMessage(error, "is invalid")}`);
-	}
-}
-function parseSafeInteger(raw, label) {
-	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	return raw;
-}
-function validateTimestamp(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
-}
-function requireParsed(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
-function invalidResult(message) {
-	return {
-		ok: false,
-		error: {
-			code: "invalid",
-			message
-		}
-	};
-}
-function errorMessage(error, fallback) {
-	return error instanceof Error ? error.message : fallback;
-}
-function assertNever(value, label) {
-	throw new Error(`${label} branch is unsupported: ${String(value)}`);
-}
-/**
-* Re-seals an authority around its new combined signer activations. Both digests are
-* recomputed; identity, provenance, permissions and lifecycle stay as they were.
-*/
-async function withCombinedSignerActivations(authority, signerActivations, now) {
-	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
-	const draft = {
-		kind: "wallet_authority_v1",
-		authorityId: authority.authorityId,
-		walletId: authority.walletId,
-		principal: authority.principal,
-		provenance: authority.provenance,
-		permissions: authority.permissions,
-		signerActivations,
-		signerActivationSetDigestB64u,
-		authorityDigestB64u: authority.authorityDigestB64u,
-		revocationEpoch: authority.revocationEpoch,
-		createdAtMs: authority.createdAtMs,
-		updatedAtMs: Math.max(authority.updatedAtMs, now),
-		state: "active",
-		activatedAtMs: authority.activatedAtMs
-	};
-	return buildActiveCombinedWalletAuthorityV1({
-		...draft,
-		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft)
-	});
-}
-async function extendEcdsaWalletAuthorityWithEd25519(input) {
-	if (input.ed25519.signer.walletId !== input.authority.walletId) throw new Error("NEAR signer belongs to a different wallet authority");
-	const existingEcdsa = input.authority.signerActivations.ecdsa;
-	const ed25519Signer = input.ed25519.signer;
-	const signerActivationsCandidate = buildWalletSignerActivationSetV1({
-		manifest: buildExactAdministeredSignerManifestV1([ed25519Signer, existingEcdsa.signer]),
-		materialActivations: {
-			keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-			ed25519: input.ed25519.materialActivation,
-			ecdsa: existingEcdsa.materialActivation
-		}
-	});
-	if (!isCombinedWalletSignerActivationSetV1(signerActivationsCandidate)) throw new Error("Deferred Ed25519 activation did not produce a combined signer activation set");
-	return withCombinedSignerActivations(input.authority, signerActivationsCandidate, input.now);
-}
-/** `next` keeps everything of `previous` that an added signer must not change. */
-function keepsWalletAuthorityApartFromSigners(previous, next) {
-	return previous.authorityId === next.authorityId && previous.walletId === next.walletId && previous.revocationEpoch === next.revocationEpoch && previous.createdAtMs === next.createdAtMs && previous.activatedAtMs === next.activatedAtMs && base64UrlEncode(encodePrincipal(previous.principal)) === base64UrlEncode(encodePrincipal(next.principal)) && base64UrlEncode(encodeProvenance(previous.provenance)) === base64UrlEncode(encodeProvenance(next.provenance)) && base64UrlEncode(encodePermissions(previous.permissions)) === base64UrlEncode(encodePermissions(next.permissions));
-}
-/**
-* Whether `next` is `previous` with an added ECDSA signer and nothing else
-* changed. Both projections have already passed digest validation.
-*/
-function isEcdsaExtensionOfEd25519WalletAuthority(previous, next) {
-	return isActiveEd25519WalletAuthorityV1(previous) && isCombinedWalletSignerActivationSetV1(next.signerActivations) && keepsWalletAuthorityApartFromSigners(previous, next) && base64UrlEncode(encodeEd25519Activation(previous.signerActivations.ed25519)) === base64UrlEncode(encodeEd25519Activation(next.signerActivations.ed25519));
-}
-/** Both projections have already passed digest validation at their boundaries. */
-function isEd25519ExtensionOfEcdsaWalletAuthority(previous, next) {
-	return isActiveEcdsaWalletAuthorityV1(previous) && isCombinedWalletSignerActivationSetV1(next.signerActivations) && previous.provenance.kind === "wallet_registration" && keepsWalletAuthorityApartFromSigners(previous, next) && base64UrlEncode(encodeEcdsaActivation(previous.signerActivations.ecdsa)) === base64UrlEncode(encodeEcdsaActivation(next.signerActivations.ecdsa));
-}
-//#endregion
-export { computeWalletAuthMethodRevokeOperationFingerprintV1 as C, parseExactAdministeredSignerManifestV1 as E, buildWalletAuthMethodRecordV2 as S, sameWalletAuthMethodRecordV2 as T, rawDigest as _, isActiveEcdsaWalletAuthorityV1 as a, u32 as b, isEcdsaExtensionOfEd25519WalletAuthority as c, parseWalletSignerActivationSetV1 as d, replaceActiveWalletAuthorityEd25519MaterialActivationV1 as f, lp32 as g, concat as h, extendEcdsaWalletAuthorityWithEd25519 as i, isEd25519ExtensionOfEcdsaWalletAuthority as l, walletAuthorityDigestsMatchV1 as m, computeWalletSignerActivationSetDigestB64u as n, isActiveRecoveredWalletAuthorityV1 as o, sameVerifiedActiveWalletAuthorityV1 as p, encodeWalletSignerActivationSetV1 as r, isCombinedWalletSignerActivationSetV1 as s, computeWalletAuthorityDigestB64u as t, parseWalletAuthorityV1 as u, rawPublicKey as v, parseWalletAuthMethodRecordV2 as w, u64 as x, text as y };