@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/sdk/walletCustodyEcdsaContinuity-B7xi7nwh.js

@@ -0,0 +1 @@
+import{A as e,B as t,D as n,F as r,M as i,O as a,S as o,T as s,g as c,h as l,i as u,j as d,k as f,n as p,o as m,r as h,s as g,w as _}from"./domainIds-GDzjOs6i.js";import{_ as v,h as y,m as b}from"./validation-dC1-_uyG.js";import{i as x,r as S}from"./base64-ojm5DKcF.js";import{r as C}from"./secureRandomId-CTdlJ5Mx.js";import{P as ee,h as te,o as ne,x as re}from"./sessionPolicy-CNVK7nJ6.js";import{$ as ie,$t as ae,A as oe,B as se,E as ce,Et as le,F as ue,Mt as de,Q as fe,St as pe,Tt as me,U as he,V as ge,Z as _e,at as ve,bt as ye,ct as be,dt as xe,gt as Se,ht as Ce,j as we,jt as Te,kt as Ee,lt as De,mt as Oe,nn as ke,nt as Ae,pt as je,rn as Me,rt as Ne,st as Pe,tn as w,tt as Fe,ut as Ie,v as Le,yt as Re}from"./ecdsaPresignLifecycle-CQnCxSlq.js";import{d as ze,h as Be,l as Ve,m as He}from"./capabilityKinds-XaXXiD2B.js";import{f as Ue,h as We,m as Ge,p as Ke}from"./chains-yAls2d9X.js";import{a as qe,i as Je,n as Ye,r as T}from"./canonicalPrimitives-MPGET2cl.js";import{a as Xe,c as Ze}from"./ecdsaChainTarget-CRcRR78w.js";import{r as Qe}from"./signerDomain-BhUTzDmF.js";import{l as $e}from"./registrationIntent-DV1GYZ3K.js";import{b as E,d as et,g as tt,p as nt,v as rt,y as D}from"./passkey-custody-LP4UTFbn.js";import{a as it,i as at,n as ot,r as O,t as k}from"./normalization-BGPR6osg.js";import{B as st,L as ct,M as lt,N as ut,P as dt,R as ft,z as pt}from"./accountLifecycle-EyfYPnuT.js";import{t as mt}from"./accountIds-C3Ihsd2c.js";import{Jt as ht,Mt as gt,Xt as _t,Y as vt,Yt as yt,b as bt,dn as xt,en as St,l as Ct,ln as wt,on as Tt,sn as Et,x as Dt,y as Ot}from"./evmFamilyEcdsaIdentity-Br3iFdQx.js";import{T as kt,a as At,c as jt,i as Mt,m as Nt,o as Pt,r as Ft,u as It,w as Lt}from"./walletAuthority-CoWSeqvQ.js";import{i as Rt,o as zt}from"./registrationIds-BIel5S0i.js";import{a as Bt,d as Vt,n as Ht,r as Ut,s as Wt,t as Gt,u as Kt}from"./keyMaterialBrands-uVZHfAh3.js";import{v as qt}from"./sdkSentEvents-_RGAEeld.js";import{t as Jt}from"./signerSlot-BQ1g5JNV.js";import{f as Yt,u as Xt}from"./wallet-recovery-CcDZ1hMH.js";import{C as Zt,_ as Qt,a as $t,b as en,c as tn,d as nn,f as rn,g as an,h as on,i as sn,l as cn,m as ln,n as un,o as dn,p as fn,r as pn,s as mn,t as hn,u as gn,v as _n}from"./ecdsaCapabilityManifest-CHFu-QrV.js";import{i as vn,n as yn,r as bn}from"./ecdsaPresignPoolIdentity-Ci-ovDlv.js";import{_ as xn,b as A,u as Sn,v as Cn}from"./nonceLaneKeys-BBYi4g51.js";import{i as wn,n as Tn}from"./profileAccountProjection-DHCaMtOu.js";function En(e){return Ue({domain:`seams/wallet/ordinary-authority-material-seal-aad/v1`,authorityId:String(e.authorityId),walletId:String(e.walletId),walletAuthMethodId:String(e.walletAuthMethodId),packageSetDigestB64u:String(e.packageSetDigestB64u),targetFactor:e.targetFactor,keyFamily:e.keyFamily,materialActivation:e.materialActivation})}function Dn(e){let t=v(e,`linked signer material record`);if(t.kind!==`wallet_authority_linked_signer_material_v1`)throw Error(`linked signer material record kind is invalid`);if(t.keyFamily!==`ed25519`&&t.keyFamily!==`ecdsa_secp256k1`)throw Error(`linked signer material keyFamily is invalid`);let r=[`kind`,`authorityId`,`walletAuthMethodId`,`activationId`,`keyFamily`,`materialActivation`,`sealedMaterialB64u`,`sealedMaterialDigestB64u`,`packageSetDigestB64u`,`targetFactor`,`publicFacts`];Pn(t,t.keyFamily===`ecdsa_secp256k1`?[...r,`ecdsaThresholdKeyId`]:r,`linked signer material record`);let i=Nn(n(t.authorityId),`authorityId`),a=Nn(s(t.walletAuthMethodId),`walletAuthMethodId`),o=Nn(l(t.materialActivation),`materialActivation`),c=y(t.activationId,`activationId`,`must be a non-empty canonical string`);if(o.activationId!==c)throw Error(`linked signer material activationId does not match materialActivation`);let u=Mn(t.sealedMaterialB64u,`sealedMaterialB64u`),d=T(t.sealedMaterialDigestB64u),f=T(t.packageSetDigestB64u),p=kn(t.targetFactor);if(p.walletAuthMethodId!==a)throw Error(`linked signer material target factor auth method differs from record`);if(t.keyFamily===`ed25519`){let e=An(t.publicFacts,o);return{kind:`wallet_authority_linked_signer_material_v1`,authorityId:i,walletAuthMethodId:a,activationId:o.activationId,keyFamily:`ed25519`,materialActivation:o,sealedMaterialB64u:u,sealedMaterialDigestB64u:d,packageSetDigestB64u:f,targetFactor:p,publicFacts:e}}let m=Wt(t.ecdsaThresholdKeyId),h=jn(t.publicFacts,o);if(h.ecdsaThresholdKeyId!==m)throw Error(`linked signer material ECDSA threshold key id differs from public facts`);return{kind:`wallet_authority_linked_signer_material_v1`,authorityId:i,walletAuthMethodId:a,activationId:o.activationId,keyFamily:`ecdsa_secp256k1`,ecdsaThresholdKeyId:m,materialActivation:o,sealedMaterialB64u:u,sealedMaterialDigestB64u:d,packageSetDigestB64u:f,targetFactor:p,publicFacts:h}}async function On(e){let t=e.record;if(t.authorityId!==e.expected.authorityId||t.walletAuthMethodId!==e.expected.walletAuthMethodId||t.keyFamily!==e.expected.keyFamily||!h(t.materialActivation,e.expected.materialActivation))return{kind:`wallet_authority_linked_signer_material_open_failed_v1`,reason:`identity_mismatch`};if(!Fn(t.targetFactor,e.expected.targetFactor))return{kind:`wallet_authority_linked_signer_material_open_failed_v1`,reason:`target_factor_mismatch`};if(t.packageSetDigestB64u!==e.expected.packageSetDigestB64u)return{kind:`wallet_authority_linked_signer_material_open_failed_v1`,reason:`package_digest_mismatch`};if(e.factorSecret.byteLength!==32)return{kind:`wallet_authority_linked_signer_material_open_failed_v1`,reason:`factor_secret_invalid`};let n;try{n=S(t.sealedMaterialB64u)}catch{return{kind:`wallet_authority_linked_signer_material_open_failed_v1`,reason:`sealed_material_invalid`}}if(n.length<29)return n.fill(0),{kind:`wallet_authority_linked_signer_material_open_failed_v1`,reason:`sealed_material_invalid`};if(await qe(n)!==t.sealedMaterialDigestB64u)return n.fill(0),{kind:`wallet_authority_linked_signer_material_open_failed_v1`,reason:`sealed_material_digest_mismatch`};let r=new TextEncoder,i=r.encode(En(e.expected)),a=await Ke(i),o=n.slice(0,12),s=n.slice(12);try{let n=await globalThis.crypto.subtle.importKey(`raw`,e.factorSecret,{name:`HKDF`},!1,[`deriveKey`]),c=await globalThis.crypto.subtle.deriveKey({name:`HKDF`,hash:`SHA-256`,salt:a,info:r.encode(`seams/wallet/ordinary-authority-material-seal/v1`)},n,{name:`AES-GCM`,length:256},!1,[`decrypt`]),l=new Uint8Array(await globalThis.crypto.subtle.decrypt({name:`AES-GCM`,iv:o,additionalData:i},c,s));return t.keyFamily===`ed25519`?{kind:`opened_wallet_authority_linked_signer_material_v1`,authorityId:t.authorityId,walletAuthMethodId:t.walletAuthMethodId,keyFamily:`ed25519`,materialActivation:t.materialActivation,publicFacts:t.publicFacts,material:l}:{kind:`opened_wallet_authority_linked_signer_material_v1`,authorityId:t.authorityId,walletAuthMethodId:t.walletAuthMethodId,keyFamily:`ecdsa_secp256k1`,materialActivation:t.materialActivation,publicFacts:t.publicFacts,material:l}}catch{return{kind:`wallet_authority_linked_signer_material_open_failed_v1`,reason:`sealed_material_authentication_failed`}}finally{n.fill(0),i.fill(0),a.fill(0),o.fill(0),s.fill(0)}}function kn(e){let t=v(e,`linked signer material target factor`);if(t.kind===`passkey`)return Pn(t,[`kind`,`walletAuthMethodId`,`verificationDigestB64u`,`rpId`,`credentialIdB64u`],`linked signer material passkey target factor`),{kind:`passkey`,walletAuthMethodId:Nn(s(t.walletAuthMethodId),`targetFactor.walletAuthMethodId`),verificationDigestB64u:T(t.verificationDigestB64u),rpId:Nn(i(t.rpId),`targetFactor.rpId`),credentialIdB64u:Mn(Nn(d(t.credentialIdB64u),`targetFactor.credentialIdB64u`),`targetFactor.credentialIdB64u`)};if(t.kind===`email_otp`){Pn(t,[`kind`,`walletAuthMethodId`,`verificationDigestB64u`,`emailHashHex`,`registrationAuthorityId`],`linked signer material email target factor`);let e=y(t.emailHashHex,`targetFactor.emailHashHex`,`must be a non-empty canonical string`);if(!/^[0-9a-f]{64}$/.test(e))throw Error(`targetFactor.emailHashHex is invalid`);return{kind:`email_otp`,walletAuthMethodId:Nn(s(t.walletAuthMethodId),`targetFactor.walletAuthMethodId`),verificationDigestB64u:T(t.verificationDigestB64u),emailHashHex:e,registrationAuthorityId:y(t.registrationAuthorityId,`targetFactor.registrationAuthorityId`,`must be a non-empty canonical string`)}}throw Error(`linked signer material target factor kind is invalid`)}function An(e,t){let n=v(e,`linked signer material Ed25519 public facts`);if(Pn(n,[`keyFamily`,`participantIds`,`targetBinding`,`applicationBinding`,`activationReceipt`],`linked signer material Ed25519 public facts`),n.keyFamily!==`ed25519`)throw Error(`linked signer material Ed25519 public facts family is invalid`);let r=ht(n.activationReceipt),i=_t(n.targetBinding),a=yt(n.applicationBinding);if(!h(t,me(r.material_activation)))throw Error(`linked signer material Ed25519 receipt activation differs`);return{keyFamily:`ed25519`,participantIds:St(n.participantIds),targetBinding:i,applicationBinding:a,activationReceipt:r}}function jn(e,t){let n=v(e,`linked signer material ECDSA public facts`);if(Pn(n,[`keyFamily`,`ecdsaThresholdKeyId`,`activationReceipt`],`linked signer material ECDSA public facts`),n.keyFamily!==`ecdsa_secp256k1`)throw Error(`linked signer material ECDSA public facts family is invalid`);let r=gt(n.activationReceipt);if(!h(t,r.binding.target.activation))throw Error(`linked signer material ECDSA receipt activation differs`);return{keyFamily:`ecdsa_secp256k1`,ecdsaThresholdKeyId:Wt(n.ecdsaThresholdKeyId),activationReceipt:r}}function Mn(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be canonical non-empty base64url`);let n=S(e);if(n.length===0||x(n)!==e)throw n.fill(0),Error(`${t} must be canonical non-empty base64url`);return n.fill(0),e}function Nn(e,t){if(!e.ok)throw Error(`${t}: ${e.error.message}`);return e.value}function Pn(e,t,n){let r=Object.keys(e);if(r.length!==t.length||t.some(e=>!r.includes(e)))throw Error(`${n} fields are invalid`)}function Fn(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`?e.walletAuthMethodId===t.walletAuthMethodId&&e.verificationDigestB64u===t.verificationDigestB64u&&e.rpId===t.rpId&&e.credentialIdB64u===t.credentialIdB64u:!1;case`email_otp`:return t.kind===`email_otp`?e.walletAuthMethodId===t.walletAuthMethodId&&e.verificationDigestB64u===t.verificationDigestB64u&&e.emailHashHex===t.emailHashHex&&e.registrationAuthorityId===t.registrationAuthorityId:!1;default:return In(e)}}function In(e){throw Error(`unsupported linked authority material target factor: ${String(e)}`)}function Ln(e){return e.kind===`evm`?`evm:eip155:${e.chainId}`:`tempo:${e.chainId}`}function Rn(e){return e.kind===`evm`?{kind:`evm`,namespace:`eip155`,chainId:e.chainId,...e.networkSlug?{networkSlug:e.networkSlug}:{}}:{kind:`tempo`,chainId:e.chainId,...e.networkSlug?{networkSlug:e.networkSlug}:{}}}function zn(e){let t=e.keyTargets.map(e=>({keyHandle:e.keyHandle,chainTarget:Rn(e.chainTarget),targetKey:Ln(e.chainTarget)})).sort((e,t)=>{let n=`${e.keyHandle}:${e.targetKey}`,r=`${t.keyHandle}:${t.targetKey}`;return n.localeCompare(r)});return Ue({version:`wallet-ecdsa-key-facts-inventory:v1`,walletId:e.walletId,rpId:e.rpId,keyTargets:t,...e.runtimePolicyScope?{runtimePolicyScope:e.runtimePolicyScope}:{},serverNonceB64u:e.serverNonceB64u})}async function Bn(e){return x(await Ge(zn(e)))}const Vn=`x-seams-trace-id`,Hn=/^[0-9a-f]{32}$/;function Un(e){return e==null||e===``?{ok:!1,reason:`missing`,message:`Router trace ID is missing`}:typeof e!=`string`||!Hn.test(e)?{ok:!1,reason:`invalid`,message:`Router trace ID must be 32 lowercase hexadecimal characters`}:{ok:!0,value:{kind:`router_ab_trace_context_v1`,value:e}}}function Wn(){let e=new Uint8Array(16);globalThis.crypto.getRandomValues(e);let t=``;for(let n of e)t+=n.toString(16).padStart(2,`0`);return{kind:`router_ab_trace_context_v1`,value:t}}var j=class extends Error{constructor(e){super(e.message),this.name=`SignerLifecycleError`,this.code=e.code,this.details=e.details||{}}};function Gn(e,n){let r=t(e);if(!r)throw new j({code:`signer_lifecycle_invalid_input`,message:`${n} is required`,details:{label:n}});return r}function Kn(e,t){if(e==null)return;let n=r(e);if(n==null||!Number.isSafeInteger(n)||n<1)throw new j({code:`signer_lifecycle_invalid_input`,message:`${t} must be an integer >= 1`,details:{label:t,value:e}});return n}function qn(e,t){let n=Kn(e,t);if(n==null)throw new j({code:`signer_lifecycle_invalid_input`,message:`${t} is required`,details:{label:t}});return n}function Jn(e){for(let t=1;t<1e3;t+=1)if(!e.has(t))return t;throw new j({code:`signer_lifecycle_no_available_slot`,message:`No available account signer slot`})}function Yn(e){let t=e.metadata?.signerMaterialFingerprint;return typeof t==`string`?t.trim():``}function Xn(e){let t=Gn(e.expectedFingerprint,`activationPolicy.materialFingerprint`),n=Yn(e.existingSigner);if(!n)throw new j({code:`signer_lifecycle_missing_material_fingerprint`,message:`Existing signer ${e.existingSigner.signerId} is missing signer material fingerprint`,details:{signerId:e.existingSigner.signerId}});if(n!==t)throw new j({code:`signer_lifecycle_material_mismatch`,message:`Existing signer material mismatch for ${e.existingSigner.signerId}`,details:{signerId:e.existingSigner.signerId,expectedFingerprint:t,existingFingerprint:n}})}function Zn(e){let t=Gn(e.signer.signerId,`signerId`),n=Gn(e.signer.signerKind,`signerKind`);Gn(e.signer.signerAuthMethod,`signerAuthMethod`),Gn(e.signer.signerSource,`signerSource`);let r=Array.isArray(e.activeSigners)?e.activeSigners:[],i=r.find(e=>e.signerId===t),a=Kn(e.preferredSlot,`preferredSlot`);if(e.activationPolicy.mode===`reuse_existing`){if(Gn(e.activationPolicy.signerId,`activationPolicy.signerId`),e.activationPolicy.signerId!==t)throw new j({code:`signer_lifecycle_invalid_input`,message:`reuse_existing activation policy signerId must match signer.signerId`,details:{policySignerId:e.activationPolicy.signerId,signerId:t}});Gn(e.activationPolicy.materialFingerprint,`activationPolicy.materialFingerprint`)}if(e.activationPolicy.mode===`replace_slot`||e.activationPolicy.mode===`replace_profile_chain_kind`){if(e.activationPolicy.replacedSignerKind!==n)throw new j({code:`signer_lifecycle_invalid_input`,message:`replacement activation policy signer kind must match signer.signerKind`,details:{signerKind:n,replacedSignerKind:e.activationPolicy.replacedSignerKind}});Gn(e.activationPolicy.revocationReason,`activationPolicy.revocationReason`)}if(i)return e.activationPolicy.mode===`reuse_existing`&&Xn({existingSigner:i,expectedFingerprint:e.activationPolicy.materialFingerprint}),{signerSlot:qn(i.signerSlot,`signerSlot`)};if(e.activationPolicy.mode===`reuse_existing`){let e=r.find(e=>e.signerKind===n);if(e)throw new j({code:`signer_lifecycle_duplicate_registration`,message:`Duplicate account registration for ${n}: existing signer ${e.signerId} differs from ${t}`,details:{signerKind:n,signerId:t,conflictingSignerId:e.signerId}})}if(e.activationPolicy.mode===`fail_if_occupied`){let t=qn(e.activationPolicy.signerSlot,`signerSlot`),n=r.find(e=>e.signerSlot===t);if(n)throw new j({code:`signer_lifecycle_slot_occupied`,message:`Active signer slot ${t} is already occupied`,details:{signerSlot:t,occupantSignerId:n.signerId}});return{signerSlot:t}}if(e.activationPolicy.mode===`replace_slot`||e.activationPolicy.mode===`replace_profile_chain_kind`)return{signerSlot:qn(e.activationPolicy.signerSlot,`signerSlot`)};let o=new Set(r.map(e=>e.signerSlot));return{signerSlot:a&&!o.has(a)?a:Jn(o)}}function Qn(e){if(typeof e!=`object`||!e)return null;let t=typeof e.profileId==`string`?String(e.profileId).trim():``;if(!t)return null;let n=Number(e.activeSignerSlot);if(!Number.isSafeInteger(n)||n<1)return null;let r=at(e.scope);return r==null?{profileId:t,activeSignerSlot:n}:{profileId:t,activeSignerSlot:n,scope:r}}function $n(e){return{kind:e.kind,registrationCeremonyId:e.registrationCeremonyId,idempotencyKey:e.idempotencyKey,walletId:e.walletId,walletAuthMethodId:e.walletAuthMethodId,signedSetup:e.signedSetup,auth:e.auth,createdAtMs:e.createdAtMs,updatedAtMs:e.updatedAtMs}}function er(e,t){if(t.application_binding.wallet_id!==e.walletId)throw Error(`NEAR continuation wallet mismatch`);return{...$n(e),operation:`near_provisioning`,signerPlanKind:e.signerPlanKind,phase:`planned`,admissionRequest:t,baseCustodyCommit:e.localMaterial.custodyCommit}}function tr(e,t,n){try{let r=Br(JSON.parse(e),[`executeRequestJson`,`applicationBindingDigestB64u`,`nonceB64u`,`ciphertextB64u`]);if(!r)return!1;let i=M(r.get(`executeRequestJson`));if(!i||!M(r.get(`applicationBindingDigestB64u`))||!M(r.get(`nonceB64u`))||!M(r.get(`ciphertextB64u`)))return!1;let a=Et(JSON.parse(i));return a.ok&&xt(a.value.binding,t.binding)&&t.binding.lifecycle.lifecycle_id===n.scope.lifecycle_id&&t.binding.lifecycle.account_id===n.scope.account_id}catch{return!1}}function nr(e,t,n){if(!tr(n,t,e.admissionRequest))throw Error(`Invalid NEAR registration execution checkpoint`);return{...$n(e),operation:`near_provisioning`,signerPlanKind:e.signerPlanKind,phase:`execution_prepared`,admissionRequest:e.admissionRequest,baseCustodyCommit:e.baseCustodyCommit,admissionReceipt:t,checkpointJson:n,updatedAtMs:Math.max(Date.now(),e.updatedAtMs)}}const rr=`pending_wallet_registration_commit_v1:`;function ir(e){return`${rr}${e.registrationCeremonyId}:${e.operation}`}function ar(e){let t=ur(e);return{key:ir({registrationCeremonyId:t.registration_ceremony_id,operation:t.operation}),value:t}}function or(e){let t=Br(e,[`key`,`value`]);if(!t)return null;let n=t.get(`key`);if(typeof n!=`string`||!n.startsWith(rr))return null;let r=dr(t.get(`value`));return r&&ir({registrationCeremonyId:r.registration_ceremony_id,operation:r.operation})===n?r:null}async function sr(e){let t=Hr(e,`value`),n=Br(Hr(t,`record`),[`kind`,`operation`,`signerPlanKind`,`registrationCeremonyId`,`idempotencyKey`,`walletId`,`walletAuthMethodId`,`signedSetup`,`auth`,`createdAtMs`,`updatedAtMs`,`localMaterial`]);if(!n||n.get(`operation`)!==`registration_activate`||n.get(`signerPlanKind`)!==`near_ed25519_and_evm_family_ecdsa`)return null;let r=yr(n.get(`localMaterial`));if(!r||!Sr(r))return null;let i=fr({...Object.fromEntries(n),localMaterial:{keyFamilies:[`ecdsa_secp256k1`],custodyCommit:r.custodyCommit,ecdsa:r.ecdsa}});if(!i||i.operation!==`registration_activate`||Hr(e,`key`)!==ir(i)||Hr(t,`wallet_id`)!==i.walletId||Hr(t,`wallet_auth_method_id`)!==i.walletAuthMethodId||Hr(t,`registration_ceremony_id`)!==i.registrationCeremonyId||Hr(t,`operation`)!==i.operation||Hr(t,`updated_at_ms`)!==i.updatedAtMs)return null;let a=r.ed25519.activationReference,o=await We([`wallet-registration-near-provisioning`,i.registrationCeremonyId,a.lifecycle_id,a.session_id.map(cr).join(``)].join(`:`)),s=fr({...$n(i),operation:`near_provisioning`,phase:`joined`,signerPlanKind:i.signerPlanKind,idempotencyKey:`wallet-registration-near-provisioning:${o}`,localMaterial:{keyFamilies:[`ed25519`],custodyCommit:r.ed25519.custodyCommit,ed25519:{activationReference:a,localMaterial:r.ed25519.localMaterial,metadata:r.ed25519.metadata}}});return!s||s.operation!==`near_provisioning`||s.phase!==`joined`?null:{original:e,activation:i,near:s}}function cr(e){return e.toString(16).padStart(2,`0`)}function lr(e){return e}function ur(e){let t=lr(e);return{registration_ceremony_id:t.registrationCeremonyId,operation:t.operation,wallet_id:t.walletId,wallet_auth_method_id:t.walletAuthMethodId,updated_at_ms:t.updatedAtMs,record:t}}function dr(e){let t=Br(e,[`registration_ceremony_id`,`operation`,`wallet_id`,`wallet_auth_method_id`,`updated_at_ms`,`record`]);if(!t)return null;let n=fr(t.get(`record`));return!n||t.get(`registration_ceremony_id`)!==n.registrationCeremonyId||t.get(`operation`)!==n.operation||t.get(`wallet_id`)!==n.walletId||t.get(`wallet_auth_method_id`)!==n.walletAuthMethodId||t.get(`updated_at_ms`)!==n.updatedAtMs?null:{registration_ceremony_id:n.registrationCeremonyId,operation:n.operation,wallet_id:n.walletId,wallet_auth_method_id:n.walletAuthMethodId,updated_at_ms:n.updatedAtMs,record:n}}function fr(e){let t=Vr(e,[`kind`,`operation`,`signerPlanKind`,`registrationCeremonyId`,`idempotencyKey`,`walletId`,`walletAuthMethodId`,`signedSetup`,`auth`,`localMaterial`,`phase`,`admissionRequest`,`admissionReceipt`,`baseCustodyCommit`,`checkpointJson`,`completion`,`createdAtMs`,`updatedAtMs`]);if(!t||t.get(`kind`)!==`pending_wallet_registration_commit_v1`||t.has(`completion`)&&t.get(`phase`)!==`joined`)return null;let n=mr(t.get(`operation`)),r=hr(t.get(`signerPlanKind`)),i=M(t.get(`registrationCeremonyId`)),o=M(t.get(`idempotencyKey`)),c=M(t.get(`signedSetup`)),l=a(t.get(`walletId`)),u=s(t.get(`walletAuthMethodId`)),d=zr(gr(),t.get(`auth`)),f=yr(t.get(`localMaterial`)),p=Rr(t.get(`createdAtMs`)),m=Rr(t.get(`updatedAtMs`));if(n!==`registration_activate`&&n!==`near_provisioning`||r===null||i===null||o===null||c===null||!l.ok||!u.ok||!d||p===null||m===null||m<p)return null;let h={kind:`pending_wallet_registration_commit_v1`,registrationCeremonyId:i,idempotencyKey:o,walletId:l.value,walletAuthMethodId:u.value,signedSetup:c,auth:d,createdAtMs:p,updatedAtMs:m},g=t.get(`phase`);if(n===`near_provisioning`&&(g===`planned`||g===`execution_prepared`)){let e=wt(t.get(`admissionRequest`)),i=Ar(t.get(`baseCustodyCommit`));if(r!==`near_ed25519_and_evm_family_ecdsa`||t.has(`localMaterial`)||!e.ok||e.value.application_binding.wallet_id!==l.value||!i||i.keySet!==`evm_family_ecdsa_v1`||i.walletId!==l.value||!i.establishedCustody)return null;if(g===`planned`)return t.has(`admissionReceipt`)||t.has(`checkpointJson`)?null:{...h,operation:n,signerPlanKind:r,phase:g,admissionRequest:e.value,baseCustodyCommit:{...i,keySet:`evm_family_ecdsa_v1`}};let a=Tt(t.get(`admissionReceipt`)),o=M(t.get(`checkpointJson`));return!a.ok||!o||!tr(o,a.value,e.value)?null:{...h,operation:n,signerPlanKind:r,phase:g,admissionRequest:e.value,baseCustodyCommit:{...i,keySet:`evm_family_ecdsa_v1`},admissionReceipt:a.value,checkpointJson:o}}if(!f||f.custodyCommit.walletId!==l.value||t.has(`admissionRequest`)||t.has(`admissionReceipt`)||t.has(`baseCustodyCommit`)||t.has(`checkpointJson`)||Sr(f)&&f.ed25519.custodyCommit.walletId!==l.value)return null;if(n===`registration_activate`)return g===void 0?r===`near_ed25519`?br(f)?{kind:`pending_wallet_registration_commit_v1`,operation:n,signerPlanKind:r,registrationCeremonyId:i,idempotencyKey:o,walletId:l.value,walletAuthMethodId:u.value,signedSetup:c,auth:d,localMaterial:f,createdAtMs:p,updatedAtMs:m}:null:xr(f)?{kind:`pending_wallet_registration_commit_v1`,operation:n,signerPlanKind:r,registrationCeremonyId:i,idempotencyKey:o,walletId:l.value,walletAuthMethodId:u.value,signedSetup:c,auth:d,localMaterial:f,createdAtMs:p,updatedAtMs:m}:null:null;if(n===`near_provisioning`){if(g!==void 0&&g!==`joined`||r!==`near_ed25519`&&r!==`near_ed25519_and_evm_family_ecdsa`||!br(f))return null;let e={kind:`sealed_material`},a=t.get(`completion`);if(a!==void 0){let t=Vr(a,[`kind`,`prepared`]);if(!t)return null;switch(t.get(`kind`)){case`sealed_material`:if(t.has(`prepared`))return null;break;case`encrypted_checkpoint`:{let n=t.get(`prepared`);if(Hr(n,`phase`)!==`execution_prepared`)return null;let a=fr(n);if(!a||a.phase!==`execution_prepared`||a.registrationCeremonyId!==i||a.walletId!==l.value||a.walletAuthMethodId!==u.value||a.signedSetup!==c||r!==a.signerPlanKind)return null;e={kind:`encrypted_checkpoint`,prepared:a};break}default:return null}}return{kind:`pending_wallet_registration_commit_v1`,operation:n,phase:`joined`,completion:e,signerPlanKind:r,registrationCeremonyId:i,idempotencyKey:o,walletId:l.value,walletAuthMethodId:u.value,signedSetup:c,auth:d,localMaterial:f,createdAtMs:p,updatedAtMs:m}}return null}function pr(e,t){if(e.operation!==t.operation||e.walletId!==t.walletId||e.walletAuthMethodId!==t.walletAuthMethodId||t.authority.walletId!==e.walletId||t.authority.bindingId!==e.walletAuthMethodId)throw Error(`pending wallet registration commit identity does not match projection`);if(e.auth.kind===`passkey`){if(!fe(t.authority)||t.authority.factor.credentialIdB64u!==e.auth.credentialIdB64u||t.authority.verifier.rpId!==e.auth.rpId)throw Error(`pending passkey registration authority does not match projection`);return}if(!_e(t.authority))throw Error(`pending Email OTP registration authority does not match projection`);if(t.authority.factor.providerUserId!==e.auth.providerSubject||t.authority.verifier.emailHashHex.length===0)throw Error(`pending Email OTP registration factor does not match projection`)}function mr(e){return e===`registration_activate`||e===`near_provisioning`?e:null}function hr(e){return e===`near_ed25519`||e===`evm_family_ecdsa`||e===`near_ed25519_and_evm_family_ecdsa`?e:null}function gr(){return Me(`kind`,[w({kind:ae(`passkey`),rpId:ke(i),credentialIdB64u:ke(d),transports:N(_r)}),w({kind:ae(`email_otp`),email:ke(_),registrationAuthorityId:ke(m),providerSubject:ke(g),enrollment:vr()})])}function _r(e){let t=Ur(e);if(!t)return null;let n=[],r=new Set;for(let e of t){let t=M(e);if(t===null||r.has(t))return null;r.add(t),n.push(t)}return n}function vr(){let e=N(M);return w({enrollmentSealKeyVersion:e,serverSealedFactorCiphertextB64u:e,clientUnlockPublicKeyB64u:e,unlockKeyVersion:e})}function yr(e){let t=Ur(Hr(e,`keyFamilies`));if(!t)return null;if(t.length===1&&t[0]===`ecdsa_secp256k1`){let t=Br(e,[`keyFamilies`,`custodyCommit`,`ecdsa`]);if(!t)return null;let n=Ar(t.get(`custodyCommit`)),r=zr(Dr(),t.get(`ecdsa`));return n&&jr(n,`evm_family_ecdsa_v1`)&&r?{keyFamilies:[`ecdsa_secp256k1`],custodyCommit:n,ecdsa:r}:null}if(t.length===1&&t[0]===`ed25519`){let t=Br(e,[`keyFamilies`,`custodyCommit`,`ed25519`]);if(!t)return null;let n=Ar(t.get(`custodyCommit`)),r=zr(wr(),t.get(`ed25519`));return n&&jr(n,`near_ed25519_v1`)&&r?{keyFamilies:[`ed25519`],custodyCommit:n,ed25519:r}:null}if(t.length===2&&t[0]===`ed25519`&&t[1]===`ecdsa_secp256k1`){let t=Br(e,[`keyFamilies`,`custodyCommit`,`ed25519`,`ecdsa`]);if(!t)return null;let n=Ar(t.get(`custodyCommit`)),r=zr(Tr(),t.get(`ed25519`)),i=zr(Dr(),t.get(`ecdsa`));return n&&jr(n,`evm_family_ecdsa_v1`)&&r&&i?{keyFamilies:[`ed25519`,`ecdsa_secp256k1`],custodyCommit:n,ed25519:r,ecdsa:i}:null}return null}function br(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`}function xr(e){return e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`}function Sr(e){return e.keyFamilies.length===2&&e.keyFamilies[0]===`ed25519`&&e.keyFamilies[1]===`ecdsa_secp256k1`}function Cr(){let e=N(M);return{activationReference:kr(),localMaterial:w({b64u:e,nonceB64u:e,applicationBindingDigestB64u:e}),metadata:Er()}}function wr(){return w(Cr())}function Tr(){return w({...Cr(),custodyCommit:N(e=>{let t=Ar(e);return t&&jr(t,`near_ed25519_v1`)?t:null})})}function Er(){let e=N(M);return w({materialActivation:ke(l),registeredPublicKeyB64u:e,signingWorkerVerifyingShareB64u:e,stateEpoch:N(Lr),signingWorkerId:e,participantIds:(e,t)=>{let n=Ur(e);if(!n||n.length!==2||n.some(e=>Rr(e)===null))throw Error(`${t} is invalid`);return[Number(n[0]),Number(n[1])]},nearEd25519SigningKeyId:e,signerSlot:N(Rr)})}function Dr(){return w({activationJournalId:Ye,clientActivation:oe,activationRequestDigestB64u:T})}function Or(){let e=N(M),t=(e,t)=>{if(!Number.isSafeInteger(e)||Number(e)<0)throw Error(`${t} is invalid`);return Number(e)};return w({contextBinding32B64u:e,derivationClientSharePublicKey33B64u:e,clientVerifyingShare33B64u:e,relayerPublicKey33B64u:e,groupPublicKey33B64u:e,ethereumAddress:e,clientShareRetryCounter:t,relayerShareRetryCounter:t})}function kr(){return w({kind:ae(`router_ab_ed25519_yao_activation_reference_v1`),lifecycle_id:N(M),session_id:(e,t)=>{let n=Ur(e);if(!n||n.length!==32)throw Error(`${t} is invalid`);let r=[];for(let e of n){if(typeof e!=`number`||!Number.isInteger(e)||e<0||e>255)throw Error(`${t} is invalid`);r.push(e)}return r}})}function Ar(e){let t=Vr(e,[`walletId`,`keySet`,`keyManifestDigestB64u`,`establishedCustody`,`recoveryBackupAcknowledged`,`recoveryReplacementEnvelope`,`registeredPublicKeyB64u`,`clientRootPublicKey33B64u`,`ecdsaPublicFacts`]);if(!t||!t.has(`walletId`)||!t.has(`keySet`)||!t.has(`keyManifestDigestB64u`))return null;let n=M(t.get(`walletId`)),r=M(t.get(`keySet`)),i=M(t.get(`keyManifestDigestB64u`));if(!n||!r||!i||r!==`near_ed25519_v1`&&r!==`evm_family_ecdsa_v1`)return null;let a=t.get(`recoveryBackupAcknowledged`);if(a!==void 0&&a!==!0)return null;let o=t.get(`establishedCustody`),s=o===void 0?void 0:Mr(o);if(o!==void 0&&!s)return null;let c=t.get(`recoveryReplacementEnvelope`),l=c===void 0?void 0:zr(Fr(),c);if(c!==void 0&&!l)return null;let u=t.get(`registeredPublicKeyB64u`),d=u===void 0?void 0:M(u);if(u!==void 0&&!d)return null;let f=t.get(`clientRootPublicKey33B64u`),p=f===void 0?void 0:M(f);if(f!==void 0&&!p)return null;let m=t.get(`ecdsaPublicFacts`),h=m===void 0?void 0:zr(Or(),m);return m!==void 0&&!h?null:{walletId:n,keySet:r,keyManifestDigestB64u:i,...s?{establishedCustody:s}:{},...a===!0?{recoveryBackupAcknowledged:!0}:{},...l?{recoveryReplacementEnvelope:l}:{},...d?{registeredPublicKeyB64u:d}:{},...p?{clientRootPublicKey33B64u:p}:{},...h?{ecdsaPublicFacts:h}:{}}}function jr(e,t){return e.keySet===t}function Mr(e){let t=[`envelopeId`,`envelopeBindingJson`,`envelopeNonceB64u`,`sealedCustodySecretB64u`,`envelopeAadHashB64u`,`envelopeCiphertextDigestB64u`,`recoveryManifestKekWraps`,`recoveryCodeLocators`,`recoveryEntryNonceB64u`,`recoveryEntryCiphertextB64u`,`recoveryEntryAadHashB64u`],n=Vr(e,t);if(!n||t.some(e=>e!==`recoveryCodeLocators`&&!n.has(e)))return null;let r=[M(n.get(`envelopeId`)),M(n.get(`envelopeBindingJson`)),M(n.get(`envelopeNonceB64u`)),M(n.get(`sealedCustodySecretB64u`)),M(n.get(`envelopeAadHashB64u`)),M(n.get(`envelopeCiphertextDigestB64u`)),M(n.get(`recoveryEntryNonceB64u`)),M(n.get(`recoveryEntryCiphertextB64u`)),M(n.get(`recoveryEntryAadHashB64u`))];if(r.some(e=>e===null))return null;let i=Ur(n.get(`recoveryManifestKekWraps`));if(!i)return null;let a=i.map(e=>zr(Nr(),e));if(a.some(e=>e===null))return null;let o=a.filter(Ir),s;if(n.has(`recoveryCodeLocators`)){let e=Ur(n.get(`recoveryCodeLocators`));if(!e)return null;let t=e.map(e=>zr(Pr(),e));if(t.some(e=>e===null))return null;s=t.filter(Ir)}return{envelopeId:r[0],envelopeBindingJson:r[1],envelopeNonceB64u:r[2],sealedCustodySecretB64u:r[3],envelopeAadHashB64u:r[4],envelopeCiphertextDigestB64u:r[5],recoveryManifestKekWraps:o,...s?{recoveryCodeLocators:s}:{},recoveryEntryNonceB64u:r[6],recoveryEntryCiphertextB64u:r[7],recoveryEntryAadHashB64u:r[8]}}function Nr(){let e=N(M);return w({recoveryKeyId:e,nonceB64u:e,ciphertextB64u:e,aadHashB64u:e})}function Pr(){let e=N(M);return w({locatorB64u:e,recoveryKeyId:e})}function Fr(){let e=N(M);return w({envelopeId:e,envelopeBindingJson:e,envelopeNonceB64u:e,sealedCustodySecretB64u:e,envelopeAadHashB64u:e,envelopeCiphertextDigestB64u:e})}function Ir(e){return e!==null}function M(e){return typeof e==`string`&&e.length>0&&e.trim()===e&&!p(e)?e:null}function Lr(e){let t=M(e);return t&&/^[1-9][0-9]*$/u.test(t)?t:null}function Rr(e){return Number.isSafeInteger(e)&&Number(e)>0?Number(e):null}function zr(e,t){try{return e(t,`journal`)}catch{return null}}function N(e){return(t,n)=>{let r=e(t);if(r===null)throw Error(`${n} is invalid`);return r}}function Br(e,t){let n=Vr(e,t);return n&&n.size===t.length?n:null}function Vr(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=Object.keys(e);if(n.some(e=>!t.includes(e)))return null;let r=new Map;for(let t of n)r.set(t,Reflect.get(e,t));return r}function Hr(e,t){if(!(typeof e!=`object`||!e||Array.isArray(e)))return Reflect.get(e,t)}function Ur(e){return Array.isArray(e)?e:null}function Wr(e,t){return e.kind===t.kind&&e.signer.kind===t.signer.kind&&e.signer.keyFamily===t.signer.keyFamily&&e.signer.walletId===t.signer.walletId&&e.signer.walletKeyId===t.signer.walletKeyId&&e.signer.registeredPublicKeyB64u===t.signer.registeredPublicKeyB64u&&h(e.materialActivation,t.materialActivation)}function Gr(e,t){return e.kind===t.kind&&e.signer.kind===t.signer.kind&&e.signer.keyFamily===t.signer.keyFamily&&e.signer.walletId===t.signer.walletId&&e.signer.walletKeyId===t.signer.walletKeyId&&e.signer.thresholdPublicKey33B64u===t.signer.thresholdPublicKey33B64u&&e.signer.evmAddress===t.signer.evmAddress&&h(e.materialActivation,t.materialActivation)}const Kr=`pending_wallet_recovery_commit_v1`,qr=`${Kr}:`,Jr=[`version`,`kind`,`storeVersion`,`walletId`,`recoveryOperationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`authority`,`authMethod`,`target`],Yr=[`version`,`walletAuthMethodId`,`walletId`,`walletAuthorityId`,`kind`,`status`,`createdAtMs`,`updatedAtMs`,`rpId`,`credentialIdB64u`,`credentialPublicKeyB64u`,`counter`,`activatedAtMs`],Xr=[`version`,`walletAuthMethodId`,`walletId`,`walletAuthorityId`,`kind`,`status`,`createdAtMs`,`updatedAtMs`,`emailHashHex`,`registrationAuthorityId`,`activatedAtMs`],Zr=[`kind`,`rpId`,`credentialIdB64u`],Qr=[`kind`,`providerSubject`,`emailHashHex`,`registrationAuthorityId`,`enrollment`],$r=[`kind`,`provider`,`providerSubject`,`emailHashHex`,`registrationAuthorityId`,`enrollment`],ei=[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`];function ti(e,t){return e.recoveryOperationId===t.recoveryOperationId&&e.walletId===t.walletId&&e.reservationId===t.reservationId&&e.targetDeviceId===t.targetDeviceId&&e.targetAuthorityId===t.targetAuthorityId&&e.targetWalletAuthMethodId===t.targetWalletAuthMethodId&&e.target.kind===t.target.kind&&(e.target.kind===`passkey`?t.target.kind===`passkey`&&e.target.rpId===t.target.rpId&&e.target.credentialIdB64u===t.target.credentialIdB64u:t.target.kind===`google_email_otp`&&e.target.providerSubject===t.target.providerSubject&&e.target.emailHashHex===t.target.emailHashHex&&e.target.registrationAuthorityId===t.target.registrationAuthorityId&&e.target.enrollment.enrollmentId===t.target.enrollment.enrollmentId&&e.target.enrollment.enrollmentSealKeyVersion===t.target.enrollment.enrollmentSealKeyVersion)&&e.createdAtMs===t.createdAtMs}function ni(e){return`${qr}${String(e)}`}function P(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=Object.keys(e);if(n.length!==t.length||n.some(e=>!t.includes(e)))return null;let r=new Map;for(let t of n)r.set(t,Reflect.get(e,t));return r}function ri(e,t){if(!(typeof e!=`object`||!e||Array.isArray(e)))return Reflect.get(e,t)}function ii(e){return typeof e!=`string`||e.length===0||e.trim()!==e?null:e}function ai(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>0?e:null}function oi(e){try{return Yt(e)}catch{return null}}function si(e){return typeof CryptoKey<`u`&&e instanceof CryptoKey&&e.type===`secret`&&e.extractable===!1&&e.algorithm.name===`AES-GCM`&&e.usages.includes(`encrypt`)&&e.usages.includes(`decrypt`)}function ci(e){let t=P(e,[`kind`,`key`,`iv`,`ciphertext`]);if(!t)return null;let n=t.get(`key`),r=t.get(`iv`),i=t.get(`ciphertext`);return t.get(`kind`)!==`wallet_recovery_encrypted_material_v1`||!si(n)||!(r instanceof Uint8Array)||r.byteLength!==12||!(i instanceof Uint8Array)||i.byteLength===0?null:{kind:`wallet_recovery_encrypted_material_v1`,key:n,iv:r,ciphertext:i}}function li(e){let t=P(e,[`kind`,`enrollmentId`,`enrollmentSealKeyVersion`]);if(!t||t.get(`kind`)!==`email_otp_enrollment_reference_v1`)return null;let n=ii(t.get(`enrollmentId`)),r=ii(t.get(`enrollmentSealKeyVersion`));return!n||!r?null:{kind:`email_otp_enrollment_reference_v1`,enrollmentId:n,enrollmentSealKeyVersion:r}}function ui(e){let t=ri(e,`kind`);if(t===`passkey`){let t=P(e,Zr);if(!t)return null;let n=i(t.get(`rpId`)),r=d(t.get(`credentialIdB64u`));return n.ok&&r.ok?{kind:`passkey`,rpId:n.value,credentialIdB64u:r.value}:null}if(t!==`google_email_otp`)return null;let n=P(e,Qr);if(!n)return null;let r=n.get(`emailHashHex`);if(typeof r!=`string`||!/^[0-9a-f]{64}$/.test(r))return null;let a=g(n.get(`providerSubject`)),o=ii(n.get(`registrationAuthorityId`)),s=li(n.get(`enrollment`));return a.ok&&o&&s?{kind:`google_email_otp`,providerSubject:a.value,emailHashHex:r,registrationAuthorityId:o,enrollment:s}:null}function di(e){return e.target.kind===`passkey`?{kind:`passkey`,walletId:e.walletId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,rpId:e.target.rpId,credentialIdB64u:e.target.credentialIdB64u}:{kind:`google_email_otp`,walletId:e.walletId,recoveryOperationId:e.recoveryOperationId,targetDeviceId:e.targetDeviceId,targetAuthorityId:e.targetAuthorityId,targetWalletAuthMethodId:e.targetWalletAuthMethodId,providerSubject:e.target.providerSubject,emailHashHex:e.target.emailHashHex,registrationAuthorityId:e.target.registrationAuthorityId,enrollment:e.target.enrollment}}async function fi(t){let r=[`kind`,`version`,`stage`,`recoveryOperationId`,`walletId`,`reservationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`target`,`localMaterial`,`createdAtMs`,`updatedAtMs`],i=ri(t,`stage`),o=i===`server_promoted`?[...r,`projection`]:i===`awaiting_server_promotion`?r:null;if(!o)return null;let c=P(t,o);if(!c||c.get(`kind`)!==Kr||c.get(`version`)!==1)return null;let l=e(c.get(`recoveryOperationId`)),u=a(c.get(`walletId`)),d=oi(c.get(`reservationId`)),f=Ve(c.get(`targetDeviceId`)),p=n(c.get(`targetAuthorityId`)),m=s(c.get(`targetWalletAuthMethodId`)),h=ui(c.get(`target`)),g=ci(c.get(`localMaterial`)),_=ai(c.get(`createdAtMs`)),v=ai(c.get(`updatedAtMs`));if(!l.ok||!u.ok||!d||!f.ok||!p.ok||!m.ok||!h||!g||_===null||v===null||v<_)return null;if(i===`awaiting_server_promotion`)return{kind:Kr,version:1,stage:i,recoveryOperationId:l.value,walletId:u.value,reservationId:d,targetDeviceId:f.value,targetAuthorityId:p.value,targetWalletAuthMethodId:m.value,target:h,localMaterial:g,createdAtMs:_,updatedAtMs:v};let y={kind:Kr,version:1,recoveryOperationId:l.value,walletId:u.value,reservationId:d,targetDeviceId:f.value,targetAuthorityId:p.value,targetWalletAuthMethodId:m.value,target:h,localMaterial:g,createdAtMs:_,updatedAtMs:v},b;try{b=await Xt(c.get(`projection`),di(y))}catch{return null}return b.kind===h.kind&&(b.kind===`passkey`&&h.kind===`passkey`||b.kind===`google_email_otp`&&h.kind===`google_email_otp`)?{kind:Kr,version:1,stage:`server_promoted`,recoveryOperationId:y.recoveryOperationId,walletId:y.walletId,reservationId:y.reservationId,targetDeviceId:y.targetDeviceId,targetAuthorityId:y.targetAuthorityId,targetWalletAuthMethodId:y.targetWalletAuthMethodId,target:h,localMaterial:y.localMaterial,createdAtMs:y.createdAtMs,updatedAtMs:y.updatedAtMs,projection:b}:null}async function pi(e){let t=await fi(e);if(!t)throw Error(`pending wallet recovery commit is invalid`);return t}async function mi(e){let t=await pi(e),n={recovery_operation_id:t.recoveryOperationId,stage:t.stage,wallet_id:t.walletId,target_authority_id:t.targetAuthorityId,target_wallet_auth_method_id:t.targetWalletAuthMethodId,updated_at_ms:t.updatedAtMs,record:t};return{key:ni(t.recoveryOperationId),value:n}}async function hi(e){let t=P(e,[`key`,`value`]);if(!t)return null;let n=t.get(`key`);if(typeof n!=`string`||!n.startsWith(qr))return null;let r=P(t.get(`value`),[`recovery_operation_id`,`stage`,`wallet_id`,`target_authority_id`,`target_wallet_auth_method_id`,`updated_at_ms`,`record`]);if(!r)return null;let i=await fi(r.get(`record`));return!i||n!==ni(i.recoveryOperationId)||r.get(`recovery_operation_id`)!==i.recoveryOperationId||r.get(`stage`)!==i.stage||r.get(`wallet_id`)!==i.walletId||r.get(`target_authority_id`)!==i.targetAuthorityId||r.get(`target_wallet_auth_method_id`)!==i.targetWalletAuthMethodId||r.get(`updated_at_ms`)!==i.updatedAtMs?null:{recovery_operation_id:i.recoveryOperationId,stage:i.stage,wallet_id:i.walletId,target_authority_id:i.targetAuthorityId,target_wallet_auth_method_id:i.targetWalletAuthMethodId,updated_at_ms:i.updatedAtMs,record:i}}function gi(e,t){if(e.byteLength!==t.byteLength)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function _i(e,t){return e.kind===t.kind&&gi(e.iv,t.iv)&&gi(e.ciphertext,t.ciphertext)}function vi(e,t){let n=P(e,ei);return n!==null&&n.get(`kind`)===t.kind&&n.get(`enrollmentId`)===t.enrollmentId&&n.get(`enrollmentSealKeyVersion`)===t.enrollmentSealKeyVersion}function yi(e,t,n){let r=P(e,Zr);return r!==null&&r.get(`kind`)===`passkey`&&r.get(`rpId`)===t&&r.get(`credentialIdB64u`)===n}function bi(e,t){if(t.kind===`passkey`)return yi(e,t.rpId,t.credentialIdB64u);let n=P(e,Qr);return n!==null&&n.get(`kind`)===t.kind&&n.get(`providerSubject`)===t.providerSubject&&n.get(`emailHashHex`)===t.emailHashHex&&n.get(`registrationAuthorityId`)===t.registrationAuthorityId&&vi(n.get(`enrollment`),t.enrollment)}function xi(e,t){if(t.kind===`passkey`)return yi(e,t.rpId,t.credentialIdB64u);let n=P(e,$r);return n!==null&&n.get(`kind`)===t.kind&&n.get(`provider`)===`google`&&n.get(`providerSubject`)===t.providerSubject&&n.get(`emailHashHex`)===t.emailHashHex&&n.get(`registrationAuthorityId`)===t.registrationAuthorityId&&vi(n.get(`enrollment`),t.enrollment)}function Si(e,t){let n=P(e,t.kind===`passkey`?Yr:Xr);if(!n||n.get(`version`)!==t.version||n.get(`walletAuthMethodId`)!==t.walletAuthMethodId||n.get(`walletId`)!==t.walletId||n.get(`walletAuthorityId`)!==t.walletAuthorityId||n.get(`status`)!==t.status||n.get(`createdAtMs`)!==t.createdAtMs||n.get(`updatedAtMs`)!==t.updatedAtMs||n.get(`activatedAtMs`)!==t.activatedAtMs)return!1;if(t.kind===`passkey`){if(n.get(`kind`)!==t.kind||n.get(`rpId`)!==t.rpId||n.get(`credentialIdB64u`)!==t.credentialIdB64u||n.get(`credentialPublicKeyB64u`)!==t.credentialPublicKeyB64u||n.get(`counter`)!==t.counter)return!1}else if(n.get(`kind`)!==t.kind||n.get(`emailHashHex`)!==t.emailHashHex||n.get(`registrationAuthorityId`)!==t.registrationAuthorityId)return!1;let r=Lt(e);return r!==null&&kt(r,t)}function Ci(e,t){let n=P(e,Jr);if(n===null||n.get(`version`)!==t.version||n.get(`kind`)!==t.kind||n.get(`storeVersion`)!==t.storeVersion||n.get(`walletId`)!==t.walletId||n.get(`recoveryOperationId`)!==t.recoveryOperationId||n.get(`targetDeviceId`)!==t.targetDeviceId||n.get(`targetAuthorityId`)!==t.targetAuthorityId||n.get(`targetWalletAuthMethodId`)!==t.targetWalletAuthMethodId)return!1;let r=It(n.get(`authority`));return!r.ok||r.value.state!==`active`||!Pt(r.value)?!1:wi(r.value,t.authority)&&Si(n.get(`authMethod`),t.authMethod)&&xi(n.get(`target`),t.target)}function wi(e,t){return e.kind===t.kind&&e.authorityId===t.authorityId&&e.walletId===t.walletId&&e.principal.kind===t.principal.kind&&e.principal.deviceId===t.principal.deviceId&&e.provenance.kind===t.provenance.kind&&e.provenance.recoveryOperationId===t.provenance.recoveryOperationId&&e.provenance.continuityAuthorityId===t.provenance.continuityAuthorityId&&Ti(e.permissions,t.permissions)&&Ei(e.signerActivations,t.signerActivations)&&e.signerActivationSetDigestB64u===t.signerActivationSetDigestB64u&&e.authorityDigestB64u===t.authorityDigestB64u&&e.revocationEpoch===t.revocationEpoch&&e.createdAtMs===t.createdAtMs&&e.updatedAtMs===t.updatedAtMs&&e.state===t.state&&e.activatedAtMs===t.activatedAtMs}function Ti(e,t){if(e.length!==t.length)return!1;for(let n=0;n<e.length;n+=1)if(e[n]!==t[n])return!1;return!0}function Ei(e,t){if(e.kind!==t.kind||e.keyFamilies.length!==t.keyFamilies.length||e.keyFamilies.some((e,n)=>e!==t.keyFamilies[n]))return!1;if(e.keyFamilies.length===1){let n=e.keyFamilies[0];switch(n){case`ed25519`:return t.keyFamilies[0]===`ed25519`&&e.ed25519!==void 0&&t.ed25519!==void 0&&Wr(e.ed25519,t.ed25519);case`ecdsa_secp256k1`:return t.keyFamilies[0]===`ecdsa_secp256k1`&&e.ecdsa!==void 0&&t.ecdsa!==void 0&&Gr(e.ecdsa,t.ecdsa);default:return Di(n)}}return e.keyFamilies.length!==2||e.keyFamilies[0]!==`ed25519`||e.keyFamilies[1]!==`ecdsa_secp256k1`||t.keyFamilies.length!==2||t.keyFamilies[0]!==`ed25519`||t.keyFamilies[1]!==`ecdsa_secp256k1`||e.ed25519===void 0||t.ed25519===void 0||e.ecdsa===void 0||t.ecdsa===void 0?!1:Wr(e.ed25519,t.ed25519)&&Gr(e.ecdsa,t.ecdsa)}function Di(e){throw Error(`unsupported pending recovery signer family: ${String(e)}`)}function Oi(e,t){if(e.get(`kind`)!==t.kind||e.get(`version`)!==t.version||e.get(`stage`)!==t.stage||e.get(`recoveryOperationId`)!==t.recoveryOperationId||e.get(`walletId`)!==t.walletId||e.get(`reservationId`)!==t.reservationId||e.get(`targetDeviceId`)!==t.targetDeviceId||e.get(`targetAuthorityId`)!==t.targetAuthorityId||e.get(`targetWalletAuthMethodId`)!==t.targetWalletAuthMethodId||e.get(`createdAtMs`)!==t.createdAtMs||e.get(`updatedAtMs`)!==t.updatedAtMs)return!1;let n=ci(e.get(`localMaterial`));if(n===null||!_i(n,t.localMaterial)||!bi(e.get(`target`),t.target))return!1;switch(t.stage){case`awaiting_server_promotion`:return!0;case`server_promoted`:return Ci(e.get(`projection`),t.projection);default:return ki(t)}}function ki(e){throw Error(`unsupported pending wallet recovery branch`)}function Ai(e,t){let n=P(e,[`key`,`value`]);if(!n||n.get(`key`)!==t.key)return!1;let r=P(n.get(`value`),[`recovery_operation_id`,`stage`,`wallet_id`,`target_authority_id`,`target_wallet_auth_method_id`,`updated_at_ms`,`record`]);if(!r)return!1;let i=t.value;if(r.get(`recovery_operation_id`)!==i.recovery_operation_id||r.get(`stage`)!==i.stage||r.get(`wallet_id`)!==i.wallet_id||r.get(`target_authority_id`)!==i.target_authority_id||r.get(`target_wallet_auth_method_id`)!==i.target_wallet_auth_method_id||r.get(`updated_at_ms`)!==i.updated_at_ms)return!1;let a=i.record,o=[`kind`,`version`,`stage`,`recoveryOperationId`,`walletId`,`reservationId`,`targetDeviceId`,`targetAuthorityId`,`targetWalletAuthMethodId`,`target`,`localMaterial`,`createdAtMs`,`updatedAtMs`],s=a.stage===`server_promoted`?[...o,`projection`]:o,c=P(r.get(`record`),s);return c!==null&&Oi(c,a)}var ji=class extends Error{constructor(e){super(e),this.kind=`upgrade_required`,this.code=`upgrade_required`,this.name=`WalletSessionAuthorizationUpgradeRequiredError`}};const F=E.walletSessionAuthorizations;function Mi(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=Object.keys(e);if(n.length!==t.length||n.some(e=>!t.includes(e)))return null;let r=new Map;for(let t of n)r.set(t,Reflect.get(e,t));return r}function Ni(e,t){if(!(typeof e!=`object`||!e||Array.isArray(e)))return Reflect.get(e,t)}function Pi(e){switch(e){case`expired`:case`exhausted`:case`replaced`:case`wallet_locked`:case`invalidated`:return e;default:return null}}const Fi=[`kind`,`walletId`,`authorityId`,`authMethodId`,`authorizationId`,`quotaId`,`authorityDigestB64u`,`authorityRevocationEpoch`,`capabilitySubjects`,`issuedAtMs`,`expiresAtMs`],Ii=[...Fi,`retiredAtMs`,`retirementReason`],Li=[`record_version`,`wallet_session_id`,`authorization_id`,`wallet_id`,`wallet_authority_id`,`wallet_auth_method_id`,`authority_digest_b64u`,`authority_revocation_epoch`,`status`,`issued_at_ms`,`expires_at_ms`,`record`,`operation_credential`],Ri=/^wallet_session_authorization_v([0-9]+)$/;function zi(e){if(typeof e!=`string`)return null;let t=Ri.exec(e);if(!t)return null;let n=Number(t[1]);return Number.isSafeInteger(n)?n:null}function Bi(e){let t=typeof e==`object`&&!!e&&!Array.isArray(e)&&Object.prototype.hasOwnProperty.call(e,`record_version`),n=zi(Ni(e,`record_version`)),r=t?null:zi(Ni(Ni(e,`record`),`recordVersion`)),i=n??r;return i===null?{kind:`unknown`}:i>=3&&i<6?{kind:`legacy`,version:i}:t&&i===6?{kind:`current`,version:i}:t&&i>6?{kind:`future`,version:i}:{kind:`unknown`}}function Vi(e,t){if(Bi(e).kind!==`future`||Ni(e,`wallet_id`)!==t.walletId)return!1;let n=Ni(e,`wallet_authority_id`),r=Ni(e,`wallet_auth_method_id`);return typeof n!=`string`||typeof r!=`string`?!0:n===t.authorityId&&r===t.authMethodId}function Hi(e){return typeof e==`number`&&Number.isSafeInteger(e)&&e>=0}function Ui(e){let t=Ni(e,`wallet_session_id`);if(typeof t!=`string`)throw Error(`Stored Wallet Session authorization key is invalid`);return t}async function Wi(e){try{await e.done}catch{}}function Gi(e,t){return e.objectStore(F)}function Ki(e,t){return{db:e,tx:t,store:Gi.bind(null,t)}}function qi(e){switch(e.kind){case`sign`:case`export_keys`:return`${e.kind}:${e.keyFamily}:${e.materialActivation.activationId}`;case`link_devices`:case`revoke_devices`:return e.kind;default:return Ji(e)}}function Ji(e){throw Error(`Unknown Wallet Capability subject: ${String(e)}`)}function Yi(e){let t=Ni(e,`kind`);if(t===`sign`||t===`export_keys`){let n=Mi(e,[`kind`,`keyFamily`,`materialActivation`]);if(!n)return null;let r=n.get(`keyFamily`);if(r!==`ed25519`&&r!==`ecdsa_secp256k1`)return null;let i=l(n.get(`materialActivation`));return i.ok?{kind:t,keyFamily:r,materialActivation:i.value}:null}return(t===`link_devices`||t===`revoke_devices`)&&Mi(e,[`kind`])?{kind:t}:null}function Xi(e){if(!Array.isArray(e)||e.length===0)return null;let t=[];for(let n of e){let e=Yi(n);if(!e)return null;t.push(e)}let n=new Set;for(let e of t){let t=qi(e);if(n.has(t))return null;n.add(t)}let[r,...i]=t;return r?[r,...i]:null}function Zi(e){let t=Ni(e,`kind`),r=t===`active_wallet_session_v1`?Mi(e,Fi):t===`retired_wallet_session_v1`?Mi(e,Ii):null;if(!r)return null;let i=a(r.get(`walletId`)),o=n(r.get(`authorityId`)),c=s(r.get(`authMethodId`)),l=He(r.get(`authorizationId`)),u=ze(r.get(`quotaId`));if(!i.ok||!o.ok||!c.ok||!l.ok||!u.ok)return null;let d;try{d=T(r.get(`authorityDigestB64u`))}catch{return null}let f=Xi(r.get(`capabilitySubjects`)),p=r.get(`authorityRevocationEpoch`),m=r.get(`issuedAtMs`),h=r.get(`expiresAtMs`);if(!f||!Hi(p)||!Hi(m)||!Hi(h)||h<=m)return null;let g={walletId:i.value,authorityId:o.value,authMethodId:c.value,authorizationId:l.value,quotaId:u.value,authorityDigestB64u:d,authorityRevocationEpoch:p,capabilitySubjects:f,issuedAtMs:m,expiresAtMs:h};if(t===`active_wallet_session_v1`)return{kind:`active_wallet_session_v1`,walletId:g.walletId,authorityId:g.authorityId,authMethodId:g.authMethodId,authorizationId:g.authorizationId,quotaId:g.quotaId,authorityDigestB64u:g.authorityDigestB64u,authorityRevocationEpoch:g.authorityRevocationEpoch,capabilitySubjects:g.capabilitySubjects,issuedAtMs:g.issuedAtMs,expiresAtMs:g.expiresAtMs};if(t===`retired_wallet_session_v1`){let e=r.get(`retiredAtMs`);if(!Hi(e)||e<g.issuedAtMs)return null;let t=Pi(r.get(`retirementReason`));return!t||t===`expired`&&e<g.expiresAtMs?null:{kind:`retired_wallet_session_v1`,walletId:g.walletId,authorityId:g.authorityId,authMethodId:g.authMethodId,authorizationId:g.authorizationId,quotaId:g.quotaId,authorityDigestB64u:g.authorityDigestB64u,authorityRevocationEpoch:g.authorityRevocationEpoch,capabilitySubjects:g.capabilitySubjects,issuedAtMs:g.issuedAtMs,expiresAtMs:g.expiresAtMs,retiredAtMs:e,retirementReason:t}}return null}function Qi(e){if(!Hi(e.retiredAtMs))throw Error(`Retired Wallet Session v1 time is invalid`);let t=Zi({kind:`retired_wallet_session_v1`,walletId:e.active.walletId,authorityId:e.active.authorityId,authMethodId:e.active.authMethodId,authorizationId:e.active.authorizationId,quotaId:e.active.quotaId,authorityDigestB64u:e.active.authorityDigestB64u,authorityRevocationEpoch:e.active.authorityRevocationEpoch,capabilitySubjects:e.active.capabilitySubjects,issuedAtMs:e.active.issuedAtMs,expiresAtMs:e.active.expiresAtMs,retiredAtMs:e.retiredAtMs,retirementReason:e.reason});if(!t||t.kind!==`retired_wallet_session_v1`)throw Error(`Retired Wallet Session v1 is invalid`);return t}function $i(e,t){let n=Zi(e);if(!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let r;try{r=Te(t)}catch{throw Error(`Wallet Session operation credential is invalid`)}let i={record_version:`wallet_session_authorization_v6`,wallet_session_id:r.walletSessionId,authorization_id:n.authorizationId,wallet_id:n.walletId,wallet_authority_id:n.authorityId,wallet_auth_method_id:n.authMethodId,authority_digest_b64u:n.authorityDigestB64u,authority_revocation_epoch:n.authorityRevocationEpoch,status:`active`,issued_at_ms:n.issuedAtMs,expires_at_ms:n.expiresAtMs,record:{kind:n.kind,walletId:n.walletId,authorityId:n.authorityId,authMethodId:n.authMethodId,authorizationId:n.authorizationId,walletSessionId:r.walletSessionId,quotaId:n.quotaId,authorityDigestB64u:n.authorityDigestB64u,authorityRevocationEpoch:n.authorityRevocationEpoch,capabilitySubjects:n.capabilitySubjects,issuedAtMs:n.issuedAtMs,expiresAtMs:n.expiresAtMs},operation_credential:r};if(!ea(i))throw Error(`Wallet Session authorization v6 is invalid`);return i}function ea(e){let t=Mi(e,Li);if(!t||t.get(`record_version`)!==`wallet_session_authorization_v6`||t.get(`status`)!==`active`)return null;let n=Be(t.get(`wallet_session_id`)),r=He(t.get(`authorization_id`));if(!n.ok||!r.ok)return null;let i;try{i=Te(t.get(`operation_credential`))}catch{return null}if(n.value!==i.walletSessionId)return null;let a=Mi(t.get(`record`),[...Fi,`walletSessionId`]);if(!a)return null;let o=Be(a.get(`walletSessionId`));if(!o.ok||o.value!==n.value)return null;let s=Zi({kind:a.get(`kind`),walletId:a.get(`walletId`),authorityId:a.get(`authorityId`),authMethodId:a.get(`authMethodId`),authorizationId:a.get(`authorizationId`),quotaId:a.get(`quotaId`),authorityDigestB64u:a.get(`authorityDigestB64u`),authorityRevocationEpoch:a.get(`authorityRevocationEpoch`),capabilitySubjects:a.get(`capabilitySubjects`),issuedAtMs:a.get(`issuedAtMs`),expiresAtMs:a.get(`expiresAtMs`)});return!s||s.kind!==`active_wallet_session_v1`||t.get(`wallet_id`)!==s.walletId||t.get(`wallet_authority_id`)!==s.authorityId||t.get(`wallet_auth_method_id`)!==s.authMethodId||t.get(`authority_digest_b64u`)!==s.authorityDigestB64u||t.get(`authority_revocation_epoch`)!==s.authorityRevocationEpoch||t.get(`issued_at_ms`)!==s.issuedAtMs||t.get(`expires_at_ms`)!==s.expiresAtMs||r.value!==s.authorizationId?null:{record:s,operationCredential:i,physicalKey:n.value}}async function ta(e){let t=Zi(e.active);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=Te(e.operationCredential),r=$i(t,n),i=e.ctx.store(F),a=await i.index(D.walletId).getAll(t.walletId);for(let e of a){let r=Bi(e);if(r.kind===`future`)continue;if(r.kind===`legacy`){await i.delete(Ui(e));continue}if(r.kind!==`current`)throw Error(`Stored Wallet Session authorization row is corrupt`);let a=ea(e);if(!a)throw Error(`Stored Wallet Session authorization v6 is corrupt`);let o=a.record;if(!(o.kind!==`active_wallet_session_v1`||o.authorityId!==t.authorityId||o.authMethodId!==t.authMethodId)){if(o.authorizationId===t.authorizationId&&a.operationCredential.walletSessionId===n.walletSessionId){if(a.operationCredential.token!==n.token)throw Error(`Stored Wallet Session conflicts with the issued operation credential`);continue}await i.delete(a.physicalKey)}}return await i.put(r),t}async function na(e){let t=e.ctx.store(F),n=await t.index(D.walletId).getAll(e.walletId),r=null,i=!1;for(let a of n){if(Vi(a,e)){i=!0;continue}let n=Bi(a);if(n.kind===`legacy`){await t.delete(Ui(a));continue}if(n.kind!==`current`)return{kind:`corrupt`};let o=ea(a);if(!o)return{kind:`corrupt`};if(!(o.record.walletId!==e.walletId||o.record.authorityId!==e.authorityId||o.record.authMethodId!==e.authMethodId)){if(r)return{kind:`corrupt`};r=o}}return i?{kind:`upgrade_required`}:r?{kind:`found`,...r}:{kind:`missing`}}const ra=new class{constructor(e=tt){this.manager=e}async writeExactWithOperationCredential(e){let t=Zi(e.record);if(!t||t.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session v1 is invalid`);let n=Te(e.operationCredential);return await this.replaceExactActive({active:t,operationCredential:n}),t}async refreshExactWithOperationCredential(e){let t=Zi(e.expected),n=Zi(e.record);if(!t||t.kind!==`active_wallet_session_v1`||!n||n.kind!==`active_wallet_session_v1`)throw Error(`Active Wallet Session refresh is invalid`);for(let e of Fi)if(!(e===`kind`||e===`capabilitySubjects`)&&t[e]!==n[e])throw Error(`Wallet Session refresh changed its exact identity`);let r=Te(e.operationCredential),i=$i(n,r),a=(await this.manager.getDB()).transaction(F,`readwrite`),o=a.objectStore(F);try{let e=await o.get(r.walletSessionId);if(e===void 0)return await a.done,`superseded`;let n=ea(e);if(!n)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return!Ee(n.record,t)||n.operationCredential.token!==r.token?(await a.done,`superseded`):(await o.put(i),await a.done,`updated`)}catch(e){try{a.abort()}catch{}throw await Wi(a),e}}async readExact(e){let t=(await this.manager.getDB()).transaction(F,`readwrite`),n=t.objectStore(F);try{let r=await n.get(e);if(r===void 0)return await t.done,null;switch(Bi(r).kind){case`future`:throw new ji(`Wallet Session authorization requires a newer client`);case`legacy`:return await n.delete(Ui(r)),await t.done,null;case`current`:break;case`unknown`:throw Error(`Stored Wallet Session authorization v6 is corrupt`)}let i=ea(r);if(!i)throw Error(`Stored Wallet Session authorization v6 is corrupt`);return await t.done,i.record}catch(e){try{t.abort()}catch{}throw await Wi(t),e}}async readExactWithOperationCredential(e){let t=await this.readExactActiveForWallet(e);switch(t.kind){case`found`:case`missing`:case`upgrade_required`:return t;case`corrupt`:throw Error(`Stored Wallet Session authorization v6 is corrupt`);case`persistence_unavailable`:throw Error(`Wallet Session authorization persistence is unavailable`)}}async readExactActiveForWallet(e){try{let t=await this.manager.getDB(),n=t.transaction(F,`readwrite`);try{let r=await na({ctx:Ki(t,n),...e});if(r.kind===`corrupt`){try{n.abort()}catch{}return await Wi(n),r}return await n.done,r}catch{try{n.abort()}catch{}return await Wi(n),{kind:`persistence_unavailable`}}}catch{return{kind:`persistence_unavailable`}}}async retireExactActiveForWallet(e){if(!Hi(e.retiredAtMs))throw Error(`Wallet Session v1 retirement time is invalid`);let t=(await this.manager.getDB()).transaction(F,`readwrite`),n=t.objectStore(F),r=[];try{let i=await n.index(D.walletId).getAll(e.walletId);for(let a of i){let i=Bi(a);if(i.kind===`future`)continue;if(i.kind===`legacy`){await n.delete(Ui(a));continue}if(i.kind!==`current`)continue;let o=ea(a);if(!o)throw t.abort(),Error(`Stored Wallet Session authorization v6 is corrupt`);let s=o.record;if(s.kind!==`active_wallet_session_v1`)continue;let c=Qi({active:s,reason:e.reason,retiredAtMs:e.retiredAtMs});await n.delete(o.physicalKey),r.push(c)}return await t.done,r}catch(e){try{t.abort()}catch{}throw await Wi(t),e}}async replaceExactActive(e){let t=await this.manager.getDB(),n=t.transaction(F,`readwrite`);try{let r=await ta({ctx:Ki(t,n),active:e.active,operationCredential:e.operationCredential});return await n.done,r}catch(e){try{n.abort()}catch{}throw await Wi(n),e}}async clearWallet(e){let t=await this.manager.getDB(),n=await t.getAllKeysFromIndex(F,D.walletId,e);if(n.length===0)return;let r=t.transaction(F,`readwrite`),i=r.objectStore(F);for(let e of n)await i.delete(e);await r.done}async clearAll(){await(await this.manager.getDB()).clear(F)}},ia=`ecdsa_current_capability_manifest_v2`,aa=`ecdsa_role_local_material_v2`,oa=`ecdsa_activation_commit_journal_v1`,sa=`ecdsa_material_sealing_key_v1`,ca=E.ecdsaCapabilityManifests,la=E.ecdsaCurrentCapabilityManifests,I=E.ecdsaRoleLocalMaterial,L=E.ecdsaActivationCommitJournals,R=E.ecdsaMaterialSealingKeys,z=E.ecdsaClientPresignatures;function B(e,t,n){let r=Object.keys(e).sort(),i=[...n].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${t} has unexpected fields`)}function ua(e){let t=Ae(e.authority);if(!t)throw Error(`ECDSA capability selector authority is invalid`);return{capability:en(u(e.capability)),authority:t}}function da(e){return{capability:e.capability,authority:e.authority}}function fa(e){return da(e.candidate.activationBinding.signer)}function pa(e){return da(e.signer)}function ma(e){return[String(e.capability),String(e.authority.walletId),String(e.authority.authorityDigest)]}function ha(e){return{capability_ref:e.capability,wallet_id:e.authority.walletId,authority_digest:e.authority.authorityDigest,wallet_auth_method_id:e.authority.walletAuthMethodId}}function ga(e){return Ae({kind:`wallet_auth_authority_ref`,walletId:e.wallet_id,authorityDigest:e.authority_digest,walletAuthMethodId:e.wallet_auth_method_id})}function _a(e,t){return e.kind===t.kind&&e.walletId===t.walletId&&e.authorityDigest===t.authorityDigest&&e.walletAuthMethodId===t.walletAuthMethodId}function va(e,t){let n=ma(e),r=ma(t);return n[0]===r[0]&&n[1]===r[1]&&n[2]===r[2]}function ya(e,t){return e.length===t.length&&e.every((e,n)=>e===t[n])}function ba(e,t){return e.orgId===t.orgId&&e.projectId===t.projectId&&e.envId===t.envId&&e.signingRootVersion===t.signingRootVersion}function xa(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`evm`:return t.kind===`evm`&&e.namespace===t.namespace&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;case`tempo`:return t.kind===`tempo`&&e.chainId===t.chainId&&e.networkSlug===t.networkSlug;default:return V(e)}}function Sa(e,t){return e.kind===t.kind&&e.targetMemberships.length===t.targetMemberships.length&&e.targetMemberships.every((e,n)=>xa(e,t.targetMemberships[n]))}function Ca(e,t){return e.kind===t.kind&&e.keyHandle===t.keyHandle&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.clientVerifyingPublicKey33B64u===t.clientVerifyingPublicKey33B64u&&ya(e.participantIds,t.participantIds)&&e.relayerKeyId===t.relayerKeyId}function wa(e,t){return e.walletId===t.walletId&&xa(e.chainTarget,t.chainTarget)&&e.keyHandle===t.keyHandle&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId&&e.signingRootId===t.signingRootId&&e.signingRootVersion===t.signingRootVersion&&e.applicationBindingDigestB64u===t.applicationBindingDigestB64u&&e.clientParticipantId===t.clientParticipantId&&e.relayerParticipantId===t.relayerParticipantId&&ya(e.participantIds,t.participantIds)&&e.contextBinding32B64u===t.contextBinding32B64u&&e.derivationClientSharePublicKey33B64u===t.derivationClientSharePublicKey33B64u&&e.relayerPublicKey33B64u===t.relayerPublicKey33B64u&&e.groupPublicKey33B64u===t.groupPublicKey33B64u&&e.ethereumAddress===t.ethereumAddress&&ge(e.publicCapability,t.publicCapability)}function Ta(e,t){return e.kind===t.kind&&e.keyHandle===t.keyHandle&&e.publicKeyB64u===t.publicKeyB64u&&ya(e.participantIds,t.participantIds)&&e.thresholdOwnerAddress===t.thresholdOwnerAddress}function Ea(e,t){return e.manifestId===t.manifestId&&e.manifestRevision===t.manifestRevision}function Da(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`no_current_manifest`:return!0;case`exact_manifest`:return t.kind===`exact_manifest`&&e.manifestId===t.manifestId&&e.manifestRevision===t.manifestRevision;default:return V(e)}}function Oa(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`no_current_generation`:return!0;case`exact_generation`:return t.kind===`exact_generation`&&e.serverGeneration===t.serverGeneration;default:return V(e)}}function ka(e,t){return e.kind===t.kind&&e.capability===t.capability&&e.signerId===t.signerId&&e.walletId===t.walletId&&_a(e.authority,t.authority)&&Sa(e.scope,t.scope)&&e.materialOwner===t.materialOwner&&e.signingRootId===t.signingRootId&&e.signingRootVersion===t.signingRootVersion}function Aa(e,t){return ka(e,t)&&Ta(e.registeredPublicFacts,t.registeredPublicFacts)}function ja(e,t){return e.kind===t.kind&&e.sealingKeyId===t.sealingKeyId&&e.iv12B64u===t.iv12B64u&&e.ciphertextB64u===t.ciphertextB64u&&e.ciphertextDigest===t.ciphertextDigest}function Ma(e,t){return e.kind===t.kind&&Ea(e.targetManifest,t.targetManifest)&&ka(e.signer,t.signer)&&Ca(e.roleLocalBinding,t.roleLocalBinding)&&e.bindingDigest===t.bindingDigest&&e.durableMaterialRef===t.durableMaterialRef}function Na(e,t){return e.kind===t.kind&&e.correlationId===t.correlationId&&e.activationRequestDigest===t.activationRequestDigest&&e.serverGeneration===t.serverGeneration&&Pa(e.serverActivationReceipt,t.serverActivationReceipt)}function Pa(e,t){return e.kind===t.kind&&e.lifecycleId===t.lifecycleId&&e.activationDigest===t.activationDigest&&e.activatedAt===t.activatedAt&&he(e.protocolReceipt,t.protocolReceipt)}function Fa(e,t){return e.kind===t.kind&&e.correlationId===t.correlationId&&Oa(e.expectedGeneration,t.expectedGeneration)&&e.requestDigest===t.requestDigest&&e.canonicalRequest===t.canonicalRequest}function Ia(e,t){return e.kind===t.kind&&Ma(e.activationBinding,t.activationBinding)&&ja(e.encryptedPending,t.encryptedPending)}function La(e,t){if(e.kind!==t.kind||!(e.journalId===t.journalId&&Da(e.expectedManifest,t.expectedManifest)&&Fa(e.activationCommand,t.activationCommand)&&Ia(e.candidate,t.candidate)&&e.createdAt===t.createdAt))return!1;switch(e.kind){case`activation_prepared`:return!0;case`server_activation_committed`:return t.kind===`server_activation_committed`&&Na(e.serverActivation,t.serverActivation);default:return V(e)}}function Ra(e,t){return e.kind===t.kind&&h(e.materialActivation,t.materialActivation)&&se(e.routerAbEcdsaDerivationNormalSigning,t.routerAbEcdsaDerivationNormalSigning)&&wa(e.roleLocalPublicFacts,t.roleLocalPublicFacts)&&Ca(e.roleLocalBinding,t.roleLocalBinding)&&e.durableMaterialRef===t.durableMaterialRef&&e.bindingDigest===t.bindingDigest&&e.lifecycleId===t.lifecycleId&&e.ciphertextDigest===t.ciphertextDigest&&e.activationDigest===t.activationDigest&&e.activatedAt===t.activatedAt&&ba(e.runtimePolicyScope,t.runtimePolicyScope)}function za(e,t){return e.kind===t.kind&&h(e.materialActivation,t.materialActivation)&&Na(e.serverActivation,t.serverActivation)&&e.retention===t.retention}function Ba(e,t){return e.kind===t.kind&&Ea(e.identity,t.identity)&&Aa(e.signer,t.signer)&&za(e.activation,t.activation)&&Ra(e.durableMaterial,t.durableMaterial)&&e.committedAt===t.committedAt}function Va(e,t){try{let n=v(t.serverActivationReceipt,`ECDSA server activation receipt`);return t.kind===e.kind&&Ye(t.correlationId)===e.correlationId&&T(t.activationRequestDigest)===e.activationRequestDigest&&Ce(t.serverGeneration)===e.serverGeneration&&n.kind===e.serverActivationReceipt.kind&&n.lifecycleId===String(e.serverActivationReceipt.lifecycleId)&&n.activationDigest===String(e.serverActivationReceipt.activationDigest)&&Je(n.activatedAt)===e.serverActivationReceipt.activatedAt&&he(ce(n.protocolReceipt),e.serverActivationReceipt.protocolReceipt)}catch{return!1}}function Ha(e){let t=fn({activationBinding:e.preparation.activationBinding,encryptedPending:e.encryptedPending});return Ua({...e.preparation,candidate:t})}function Ua(e){let t={journalId:e.journalId,candidate:e.candidate,requestDigest:e.requestDigest,canonicalRequest:e.canonicalRequest,createdAt:e.createdAt};switch(e.expectedManifest.kind){case`no_current_manifest`:if(e.expectedGeneration.kind!==`no_current_generation`)throw Error(`Initial ECDSA activation cannot expect a server generation`);return ln({...t,expectedManifest:e.expectedManifest,expectedGeneration:e.expectedGeneration});case`exact_manifest`:if(e.expectedGeneration.kind!==`exact_generation`)throw Error(`Replacement ECDSA activation requires an exact server generation`);return ln({...t,expectedManifest:e.expectedManifest,expectedGeneration:e.expectedGeneration});default:return V(e.expectedManifest)}}function Wa(e,t){if(typeof e!=`string`||e.length===0||!/^[A-Za-z0-9_-]+$/.test(e))throw Error(`${t} must be non-empty unpadded base64url`);let n=S(e);if(n.length===0||x(n)!==e)throw n.fill(0),Error(`${t} must be canonical base64url`);return n}function Ga(e){return new TextEncoder().encode(Ue(e))}async function Ka(){return await crypto.subtle.generateKey({name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}async function qa(e){let t=Wa(e.stateBlobB64u,`ECDSA state blob`),n=crypto.getRandomValues(new Uint8Array(12)),r=Ga(e.aadProjection);try{let i=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:n,additionalData:r},e.key,t));try{return{iv12B64u:xe(x(n)),ciphertextB64u:De(x(i)),digestB64u:x(await Ke(i))}}finally{i.fill(0)}}finally{t.fill(0),r.fill(0)}}async function Ja(e){let t=S(e);try{return x(await Ke(t))}finally{t.fill(0)}}async function Ya(e){let t=S(e.iv12B64u),n=S(e.ciphertextB64u),r=Ga(e.aadProjection),i=null;try{if(i=new Uint8Array(await crypto.subtle.decrypt({name:`AES-GCM`,iv:t,additionalData:r},e.key,n)),i.length===0)throw Error(`decrypted ECDSA state blob must not be empty`);return x(i)}finally{t.fill(0),n.fill(0),r.fill(0),i?.fill(0)}}function Xa(e){let t=v(e,`ECDSA manifest identity`);return B(t,`ECDSA manifest identity`,[`manifestId`,`manifestRevision`]),$t({manifestId:Pe(t.manifestId),manifestRevision:be(t.manifestRevision)})}function Za(e){let t=v(e,`ECDSA manifest expectation`);switch(t.kind){case`no_current_manifest`:return B(t,`ECDSA no-current manifest expectation`,[`kind`]),nn();case`exact_manifest`:return B(t,`ECDSA exact manifest expectation`,[`kind`,`manifestId`,`manifestRevision`]),cn($t({manifestId:Pe(t.manifestId),manifestRevision:be(t.manifestRevision)}));default:throw Error(`ECDSA manifest expectation kind is invalid`)}}function Qa(e){let t=v(e,`ECDSA capability target`);switch(t.kind){case`evm`:return B(t,`ECDSA EVM capability target`,[`kind`,`namespace`,`chainId`,`networkSlug`]),Xe({kind:t.kind,namespace:t.namespace,chainId:t.chainId,networkSlug:t.networkSlug});case`tempo`:return B(t,`ECDSA Tempo capability target`,[`kind`,`chainId`,`networkSlug`]),Xe({kind:t.kind,chainId:t.chainId,networkSlug:t.networkSlug});default:throw Error(`ECDSA capability target kind is invalid`)}}function $a(e){let t=v(e,`ECDSA capability scope`);if(B(t,`ECDSA capability scope`,[`kind`,`targetMemberships`]),t.kind!==`evm_family`)throw Error(`ECDSA capability scope kind is invalid`);let n=b(t.targetMemberships,`ECDSA capability target memberships`),r=[];for(let e of n)r.push(Qa(e));let[i,...a]=r;if(!i)throw Error(`ECDSA capability scope requires at least one target`);return sn({targetMemberships:[i,...a]})}function eo(e){let t=v(e,`ECDSA role-local material binding`);if(B(t,`ECDSA role-local material binding`,[`kind`,`keyHandle`,`ecdsaThresholdKeyId`,`clientVerifyingPublicKey33B64u`,`participantIds`,`relayerKeyId`]),t.kind!==`ecdsa_role_local_material_binding`)throw Error(`ECDSA role-local material binding kind is invalid`);let n=b(t.participantIds,`ECDSA role-local participant ids`),r=[];for(let e of n)r.push(bt(e));let[i,...a]=r;if(!i)throw Error(`ECDSA role-local material requires at least one participant`);return dn({keyHandle:Kt(t.keyHandle),ecdsaThresholdKeyId:Wt(t.ecdsaThresholdKeyId),clientVerifyingPublicKey33B64u:Gt(t.clientVerifyingPublicKey33B64u),participantIds:[i,...a],relayerKeyId:Vt(t.relayerKeyId)})}function to(e){let t=v(e,`prepared ECDSA signer`);if(B(t,`prepared ECDSA signer`,[`kind`,`capability`,`signerId`,`walletId`,`authority`,`scope`,`materialOwner`,`signingRootId`,`signingRootVersion`]),t.kind!==`prepared_evm_family_signer`)throw Error(`prepared ECDSA signer kind is invalid`);let n=Ae(t.authority);if(!n)throw Error(`prepared ECDSA signer authority is invalid`);if(String(t.walletId)!==String(n.walletId))throw Error(`prepared ECDSA signer wallet does not match its authority`);return on({capability:en(u(t.capability)),signerId:Se(t.signerId),authority:n,scope:$a(t.scope),materialOwner:en(c(t.materialOwner)),signingRootId:Re(t.signingRootId),signingRootVersion:ye(t.signingRootVersion)})}function no(e){let t=v(e,`encrypted ECDSA pending candidate`);if(B(t,`encrypted ECDSA pending candidate`,[`kind`,`sealingKeyId`,`iv12B64u`,`ciphertextB64u`,`ciphertextDigest`]),t.kind!==`encrypted_ecdsa_pending_candidate`)throw Error(`encrypted ECDSA pending candidate kind is invalid`);return tn({sealingKeyId:je(t.sealingKeyId),iv12B64u:xe(t.iv12B64u),ciphertextB64u:De(t.ciphertextB64u),ciphertextDigest:Oe(t.ciphertextDigest)})}function ro(e){let t=v(e,`ECDSA activation binding`);if(B(t,`ECDSA activation binding`,[`kind`,`targetManifest`,`signer`,`roleLocalBinding`,`bindingDigest`,`durableMaterialRef`]),t.kind!==`ecdsa_activation_binding`)throw Error(`ECDSA activation binding kind is invalid`);return pn({targetManifest:Xa(t.targetManifest),signer:to(t.signer),roleLocalBinding:eo(t.roleLocalBinding),bindingDigest:Ht(t.bindingDigest),durableMaterialRef:Ut(t.durableMaterialRef)})}function io(e){let t=v(e,`prepared ECDSA activation candidate`);if(B(t,`prepared ECDSA activation candidate`,[`kind`,`activationBinding`,`encryptedPending`]),t.kind!==`prepared_ecdsa_activation_candidate`)throw Error(`prepared ECDSA activation candidate kind is invalid`);return fn({activationBinding:ro(t.activationBinding),encryptedPending:no(t.encryptedPending)})}function ao(e){let t=v(e,`ECDSA server generation expectation`);switch(t.kind){case`no_current_generation`:return B(t,`ECDSA no-current server generation expectation`,[`kind`]),rn();case`exact_generation`:return B(t,`ECDSA exact server generation expectation`,[`kind`,`serverGeneration`]),gn(Ce(t.serverGeneration));default:throw Error(`ECDSA server generation expectation kind is invalid`)}}function oo(e){let t=v(e,`prepared ECDSA activation journal`);if(B(t,`prepared ECDSA activation journal`,[`kind`,`journalId`,`expectedManifest`,`activationCommand`,`candidate`,`createdAt`]),t.kind!==`activation_prepared`)throw Error(`prepared ECDSA activation journal kind is invalid`);let n=v(t.activationCommand,`ECDSA activation command`);if(B(n,`ECDSA activation command`,[`kind`,`correlationId`,`expectedGeneration`,`requestDigest`,`canonicalRequest`]),n.kind!==`ecdsa_server_activation_command`)throw Error(`ECDSA activation command kind is invalid`);let r=Ye(t.journalId);if(Ye(n.correlationId)!==r)throw Error(`ECDSA activation command correlation does not match its journal`);let i=Za(t.expectedManifest),a=ao(n.expectedGeneration),o={journalId:r,candidate:io(t.candidate),requestDigest:T(n.requestDigest),canonicalRequest:ve(n.canonicalRequest),createdAt:Je(t.createdAt)};switch(i.kind){case`no_current_manifest`:if(a.kind!==`no_current_generation`)throw Error(`initial ECDSA journal has an exact server generation`);return ln({...o,expectedManifest:i,expectedGeneration:a});case`exact_manifest`:if(a.kind!==`exact_generation`)throw Error(`replacement ECDSA journal is missing its exact server generation`);return ln({...o,expectedManifest:i,expectedGeneration:a})}return V(i)}function so(e){return{kind:`activation_prepared`,journalId:e.journalId,expectedManifest:e.expectedManifest,activationCommand:e.activationCommand,candidate:e.candidate,createdAt:e.createdAt}}function co(e){return e.kind===`activation_prepared`?e:Ua({journalId:e.journalId,expectedManifest:e.expectedManifest,expectedGeneration:e.activationCommand.expectedGeneration,candidate:e.candidate,requestDigest:e.activationCommand.requestDigest,canonicalRequest:e.activationCommand.canonicalRequest,createdAt:e.createdAt})}function lo(e){let t=v(e,`server-committed ECDSA activation journal`);if(B(t,`server-committed ECDSA activation journal`,[`kind`,`journalId`,`expectedManifest`,`activationCommand`,`candidate`,`createdAt`,`serverActivation`]),t.kind!==`server_activation_committed`)throw Error(`server-committed ECDSA activation journal kind is invalid`);let n=oo(so(t)),r=uo(t.serverActivation),i=Qt({preparedJournal:n,serverCommit:r.serverCommit});if(!Va(i.serverActivation,r.record))throw Error(`ECDSA server activation commit fields are inconsistent`);return i}function uo(e){let t=v(e,`ECDSA server activation commit`);if(B(t,`ECDSA server activation commit`,[`kind`,`correlationId`,`activationRequestDigest`,`serverGeneration`,`serverActivationReceipt`]),t.kind!==`ecdsa_server_activation_commit`)throw Error(`ECDSA server activation commit kind is invalid`);let n=v(t.serverActivationReceipt,`ECDSA server activation receipt`);if(B(n,`ECDSA server activation receipt`,[`kind`,`lifecycleId`,`activationDigest`,`activatedAt`,`protocolReceipt`]),n.kind!==`ecdsa_server_activation_receipt`)throw Error(`ECDSA server activation receipt kind is invalid`);return{record:t,serverCommit:{correlationId:Ye(t.correlationId),activationRequestDigest:T(t.activationRequestDigest),serverGeneration:Ce(t.serverGeneration),protocolReceipt:n.protocolReceipt}}}function fo(e){let t=v(e,`ECDSA activation journal`);switch(t.kind){case`activation_prepared`:return oo(t);case`server_activation_committed`:return lo(t);default:throw Error(`ECDSA activation journal kind is invalid`)}}function po(e){let t=v(e,`registered ECDSA public facts`);if(B(t,`registered ECDSA public facts`,[`kind`,`keyHandle`,`publicKeyB64u`,`participantIds`,`thresholdOwnerAddress`]),t.kind!==`verified_ecdsa_public_facts`)throw Error(`registered ECDSA public facts kind is invalid`);return Ct({keyHandle:Ot(t.keyHandle),publicKeyB64u:t.publicKeyB64u,participantIds:b(t.participantIds,`registered ECDSA participant ids`),thresholdOwnerAddress:t.thresholdOwnerAddress})}function mo(e){let t=v(e,`active ECDSA manifest proof`);B(t,`active ECDSA manifest proof`,[`activation_binding`,`server_activation`,`registered_public_facts`,`role_local_public_facts`,`router_ab_ecdsa_derivation_normal_signing`,`runtime_policy_scope`,`ciphertext_digest`,`committed_at`]);let n=ro(t.activation_binding),r=uo(t.server_activation),i=mn({activationBinding:n,serverCommit:r.serverCommit});if(!Va(i,r.record))throw Error(`ECDSA server activation commit fields are inconsistent`);let a=un({activationBinding:n,serverActivation:i,routerAbEcdsaDerivationNormalSigning:we(t.router_ab_ecdsa_derivation_normal_signing),roleLocalPublicFacts:Zt(t.role_local_public_facts),ciphertextDigest:Ie(t.ciphertext_digest),runtimePolicyScope:te(t.runtime_policy_scope)}),o=Je(t.committed_at);return{activationBinding:n,serverActivation:i,durableMaterial:a,activeManifest:hn({activationBinding:n,serverActivation:i,registeredPublicFacts:po(t.registered_public_facts),durableMaterial:a,committedAt:o}),committedAt:o}}function ho(e){let t=v(e,`ECDSA capability manifest row`),n=[`record_version`,`manifest_id`,`manifest_revision`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`manifest_state`,`active_proof`];switch(t.manifest_state){case`active`:{B(t,`active ECDSA capability manifest row`,n);let e=mo(t.active_proof),r=pa(e.activeManifest);return go(t,e.activeManifest,r),{state:`active`,selector:r,manifest:e.activeManifest,activeProof:e}}case`replaced`:{B(t,`replaced ECDSA capability manifest row`,[...n,`replacement_proof`]);let e=mo(t.active_proof),r=mo(t.replacement_proof),i=an({activeManifest:e.activeManifest,replacementManifest:r.activeManifest}),a=pa(e.activeManifest);return go(t,e.activeManifest,a),{state:`replaced`,selector:a,manifest:i,activeProof:e,replacementProof:r}}default:throw Error(`ECDSA capability manifest row state is invalid`)}}function go(e,t,n){if(e.record_version!==`ecdsa_capability_manifest_v3`||Pe(e.manifest_id)!==t.identity.manifestId||be(e.manifest_revision)!==t.identity.manifestRevision||String(e.capability_ref)!==String(n.capability)||String(e.wallet_id)!==String(n.authority.walletId)||String(e.authority_digest)!==String(n.authority.authorityDigest))throw Error(`ECDSA capability manifest row identity is inconsistent`)}function _o(e){return{record_version:ia,...ha(pa(e)),manifest_id:e.identity.manifestId,manifest_revision:e.identity.manifestRevision}}function vo(e){let t=v(e,`current ECDSA capability pointer`);if(B(t,`current ECDSA capability pointer`,[`record_version`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`manifest_id`,`manifest_revision`]),t.record_version!==ia)throw Error(`current ECDSA capability pointer version is invalid`);let n=ga(t);if(!n)throw Error(`current ECDSA capability pointer authority is invalid`);return{selector:{capability:en(u(t.capability_ref)),authority:n},manifestId:Pe(t.manifest_id),manifestRevision:be(t.manifest_revision)}}function yo(e,t){return{record_version:aa,durable_material_ref:e.binding.durableMaterialRef,binding_digest:e.binding.bindingDigest,...ha(pa(t)),sealing_key_id:e.sealingKeyId,iv:e.iv12B64u,ciphertext:e.ciphertextB64u}}function bo(e){let t=v(e,`ECDSA role-local material row`);if(B(t,`ECDSA role-local material row`,[`record_version`,`durable_material_ref`,`binding_digest`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`sealing_key_id`,`iv`,`ciphertext`]),t.record_version!==aa)throw Error(`ECDSA role-local material row version is invalid`);let n=ga(t);if(!n)throw Error(`ECDSA role-local material authority is invalid`);return{durableMaterialRef:Ut(t.durable_material_ref),bindingDigest:Ht(t.binding_digest),selector:{capability:en(u(t.capability_ref)),authority:n}}}function xo(e,t){let n=v(e,`ECDSA role-local material row`),r=bo(n),i=_n({binding:t.durableMaterial,sealingKeyId:je(n.sealing_key_id),iv12B64u:xe(n.iv),ciphertextB64u:De(n.ciphertext)});if(r.durableMaterialRef!==i.binding.durableMaterialRef||r.bindingDigest!==i.binding.bindingDigest||!va(r.selector,pa(t.activeManifest)))throw Error(`ECDSA role-local material row binding is inconsistent`);return i}function So(e,t){return e.binding.durableMaterialRef===t.durableMaterial.durableMaterialRef&&e.binding.bindingDigest===t.durableMaterial.bindingDigest&&e.binding.lifecycleId===t.durableMaterial.lifecycleId&&e.binding.ciphertextDigest===t.durableMaterial.ciphertextDigest&&e.binding.activationDigest===t.durableMaterial.activationDigest&&e.binding.activatedAt===t.durableMaterial.activatedAt&&h(e.binding.materialActivation,t.durableMaterial.materialActivation)&&Ca(e.binding.roleLocalBinding,t.durableMaterial.roleLocalBinding)}function Co(e){return{record_version:oa,journal_id:e.journalId,...ha(fa(e)),journal:e}}function wo(e){let t=v(e,`ECDSA activation commit journal row`);if(B(t,`ECDSA activation commit journal row`,[`record_version`,`journal_id`,`capability_ref`,`wallet_id`,`authority_digest`,`wallet_auth_method_id`,`journal`]),t.record_version!==oa)throw Error(`ECDSA activation commit journal row version is invalid`);let n=fo(t.journal),r=fa(n);if(Ye(t.journal_id)!==n.journalId||String(t.capability_ref)!==String(r.capability)||String(t.wallet_id)!==String(r.authority.walletId)||String(t.authority_digest)!==String(r.authority.authorityDigest))throw Error(`ECDSA activation commit journal row identity is inconsistent`);return{journal:n,selector:r}}function To(e){return typeof CryptoKey>`u`||!(e instanceof CryptoKey)||e.type!==`secret`||e.extractable||e.algorithm.name!==`AES-GCM`?!1:e.usages.includes(`encrypt`)&&e.usages.includes(`decrypt`)}function Eo(e,t){return{record_version:sa,key_id:e,key:t}}function Do(e){let t=v(e,`ECDSA material sealing key row`);if(B(t,`ECDSA material sealing key row`,[`record_version`,`key_id`,`key`]),t.record_version!==sa)throw Error(`ECDSA material sealing key row version is invalid`);if(!To(t.key))throw Error(`ECDSA material sealing key must be a non-extractable AES-GCM key`);return{keyId:je(t.key_id),key:t.key}}function V(e){throw Error(`Unexpected ECDSA persistence branch: ${String(e)}`)}function Oo(e,t,n){let r=e.binding.routerAbEcdsaDerivationNormalSigning.scope,i=le(e.binding.materialActivation);return r.wallet_id===t.walletId&&x(ue(r))===t.signingScopeB64u&&x(pe(i))===t.materialActivationB64u&&r.signing_worker.key_epoch===t.keyEpoch&&r.activation_epoch===t.activationEpoch&&i.activation_id===t.materialActivationId&&i.capability===t.capability&&i.key_binding===t.keyBinding&&i.material_owner===t.walletId&&e.binding.durableMaterialRef===n.durableMaterialRef&&e.binding.bindingDigest===n.bindingDigest&&h(e.binding.materialActivation,n.materialActivation)}function ko(e,t){return e.materialActivation.activationId===t.materialActivationId&&e.materialActivation.capability===t.capability&&e.materialActivation.keyBinding===t.keyBinding&&e.materialActivation.materialOwner===t.walletId}function Ao(e){if(typeof e!=`string`||!/^ecdsa-client-presignature-[A-Za-z0-9_-]+$/.test(e))throw Error(`ECDSA durable presignature record id is invalid`);return e}function jo(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<=0)throw Error(`${t} is invalid`);return e}function Mo(e){if(!e||typeof e!=`object`||!(`record_id`in e))return null;let t=e.record_id;return typeof t==`string`?t:null}function No(){return typeof IDBTransaction<`u`&&`durability`in IDBTransaction.prototype}async function Po(e,t=1/0){let n=0;for(;e&&n<t;)await e.delete(),n+=1,e=await e.continue();return n}async function Fo(e,t,n){return await Po(await e.store(z).index(D.walletExpiresAt).openCursor(IDBKeyRange.bound([t,0],[t,n])),32)}async function Io(e,t,n){await Fo(e,t.walletId,n);let r=e.store(z),i=await r.index(D.poolIdentityKey).getAll(yn(t)),a=[];for(let e of i)try{let t=Ro(e);t.expires_at_ms<=n?await r.delete(t.record_id):a.push(t)}catch{let t=Mo(e);t&&await r.delete(t)}return a}function Lo(e){return{domain:`seams/ecdsa-client-presignature/v1`,version:1,pool_identity:e.poolIdentity,durable_material_ref:e.durableMaterialRef,presignature_id:e.presignatureId,group_public_key33_b64u:e.groupPublicKey33B64u,big_r33_b64u:e.bigR33B64u,created_at_ms:e.createdAtMs,expires_at_ms:e.expiresAtMs,sealing_key_id:e.sealingKeyId}}function Ro(e){let t=v(e,`ECDSA durable presignature row`);if(B(t,`ECDSA durable presignature row`,[`kind`,`record_id`,`pool_identity`,`pool_identity_key`,`wallet_id`,`material_activation_id`,`durable_material_ref`,`presignature_id`,`group_public_key33_b64u`,`big_r33_b64u`,`created_at_ms`,`expires_at_ms`,`sealed`]),t.kind!==`sealed_available_client_presignature_v1`)throw Error(`ECDSA durable presignature row kind is invalid`);let n=v(t.pool_identity,`ECDSA durable presignature pool identity`);B(n,`ECDSA durable presignature pool identity`,[`activationEpoch`,`capability`,`keyBinding`,`keyEpoch`,`materialActivationB64u`,`materialActivationId`,`pairRole`,`protocolId`,`relayerUrl`,`signingScopeB64u`,`walletId`]);let r=vn(n),i=Ao(t.record_id),a=String(t.pool_identity_key??``);if(a!==yn(r))throw Error(`ECDSA durable presignature pool identity index is inconsistent`);let o=String(t.wallet_id??``).trim(),s=String(t.material_activation_id??``).trim();if(!o||o!==r.walletId)throw Error(`ECDSA durable presignature wallet binding is inconsistent`);if(!s||s!==r.materialActivationId)throw Error(`ECDSA durable presignature activation binding is inconsistent`);let c=Bt(t.durable_material_ref);if(!ko(c,r))throw Error(`ECDSA durable presignature material binding is inconsistent`);let l=String(t.presignature_id??``).trim();if(!l)throw Error(`ECDSA durable presignature id is invalid`);let u=Gt(t.group_public_key33_b64u),d=Gt(t.big_r33_b64u),f=jo(t.created_at_ms,`created_at_ms`),p=jo(t.expires_at_ms,`expires_at_ms`);if(f>Date.now()+3e5)throw Error(`ECDSA durable presignature creation timestamp is in the future`);if(p<=f)throw Error(`ECDSA durable presignature expiry must follow creation`);if(p-f>7776e6)throw Error(`ECDSA durable presignature lifetime exceeds the maximum`);let m=v(t.sealed,`ECDSA durable presignature sealed payload`);if(B(m,`ECDSA durable presignature sealed payload`,[`kind`,`sealing_key_id`,`iv12_b64u`,`ciphertext_b64u`,`ciphertext_digest_b64u`]),m.kind!==`ecdsa_activation_aes_gcm_v1`)throw Error(`ECDSA durable presignature sealing kind is invalid`);return{kind:`sealed_available_client_presignature_v1`,record_id:i,pool_identity:r,pool_identity_key:a,wallet_id:o,material_activation_id:s,durable_material_ref:c,presignature_id:l,group_public_key33_b64u:u,big_r33_b64u:d,created_at_ms:f,expires_at_ms:p,sealed:{kind:`ecdsa_activation_aes_gcm_v1`,sealing_key_id:je(m.sealing_key_id),iv12_b64u:xe(m.iv12_b64u),ciphertext_b64u:De(m.ciphertext_b64u),ciphertext_digest_b64u:Ie(m.ciphertext_digest_b64u)}}}function zo(e){return{kind:`sealed_available_client_presignature_v1`,recordId:e.record_id,poolIdentity:e.pool_identity,durableMaterialRef:e.durable_material_ref,presignatureId:e.presignature_id,groupPublicKey33B64u:e.group_public_key33_b64u,bigR33B64u:e.big_r33_b64u,createdAtMs:e.created_at_ms,expiresAtMs:e.expires_at_ms,sealingKeyId:e.sealed.sealing_key_id}}async function Bo(e){let t=crypto.getRandomValues(new Uint8Array(12)),n=Ga(Lo(e.metadata));try{let r=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:t,additionalData:n},e.key,e.plaintext97));try{let e=x(r);return{iv12B64u:xe(x(t)),ciphertextB64u:De(e),ciphertextDigestB64u:Ie(x(await Ke(r)))}}finally{r.fill(0)}}finally{t.fill(0),n.fill(0),e.plaintext97.fill(0)}}async function Vo(e){let t=S(e.sealed.iv12_b64u),n=S(e.sealed.ciphertext_b64u),r=Ga(Lo(e.metadata)),i=null;try{if(x(await Ke(n))!==e.sealed.ciphertext_digest_b64u)throw Error(`ECDSA durable presignature ciphertext digest mismatch`);if(i=new Uint8Array(await crypto.subtle.decrypt({name:`AES-GCM`,iv:t,additionalData:r},e.key,n)),i.length!==97)throw Error(`ECDSA durable presignature plaintext length is invalid`);return i.slice()}finally{t.fill(0),n.fill(0),r.fill(0),i?.fill(0)}}async function Ho(e,t,n){let r=e.store(z),i=await r.index(D.walletMaterialActivationId).getAll([t,n]);for(let e of i){let t=Mo(e);t&&await r.delete(t)}}async function H(e,t,n){return T(x(await Ge(Ue({category:e,...ha(t),detail:n}))))}async function Uo(e,t){return{kind:`exact_record_conflict`,conflictDigest:await H(`journal_constraint_conflict`,e,U(t))}}function Wo(){return Ye(C(`ecdsa-persistence-retry`,16,`ECDSA persistence retry correlations`))}function U(e){return e instanceof Error?e.message:String(e)}function Go(e){return e instanceof DOMException&&e.name===`ConstraintError`}async function Ko(e,t){return await e.store(la).index(D.walletId).getAll(t)}async function qo(e){return await e.store(L).getAll()}async function Jo(e,t){return await e.store(ca).index(D.capabilityWalletAuthorityState).getAll([...ma(t),`active`])}function Yo(e,t){return h(e.manifest.activation.materialActivation,t)&&h(e.manifest.durableMaterial.materialActivation,t)&&h(e.material.binding.materialActivation,t)}function Xo(e){switch(e.kind){case`missing`:case`retired`:return{kind:`missing`};case`exact_binding_mismatch`:return{kind:`binding_mismatch`};case`exact_record_conflict`:case`corrupt`:return{kind:`corrupt`};case`persistence_unavailable`:return{kind:`persistence_unavailable`}}return V(e)}async function Zo(e,t){let n=await e.store(la).get(ma(t));if(n===void 0)return await Qo(e,t);let r;try{r=vo(n)}catch(e){return{kind:`corrupt`,detail:U(e)}}if(!va(r.selector,t))return{kind:`exact_binding_mismatch`,detail:`current ECDSA pointer belongs to a different exact authority`};let i=await e.store(ca).get(r.manifestId);if(i===void 0)return{kind:`exact_record_conflict`,detail:`current ECDSA pointer references a missing manifest`};let a;try{a=ho(i)}catch(e){return{kind:`corrupt`,detail:U(e)}}if(!va(a.selector,t))return{kind:`exact_binding_mismatch`,detail:`current ECDSA manifest belongs to a different exact authority`};if(a.manifest.identity.manifestId!==r.manifestId||a.manifest.identity.manifestRevision!==r.manifestRevision)return{kind:`exact_record_conflict`,detail:`current ECDSA pointer does not match its manifest identity`};if(a.state===`replaced`)return{kind:`retired`,manifest:a.manifest};let o=await Jo(e,t);if(o.length!==1)return{kind:`exact_record_conflict`,detail:`exact ECDSA authority has multiple current manifests`};let s;try{s=ho(o[0])}catch(e){return{kind:`corrupt`,detail:U(e)}}if(s.state!==`active`||s.manifest.identity.manifestId!==r.manifestId)return{kind:`exact_record_conflict`,detail:`exact ECDSA current index disagrees with its pointer`};let c=await e.store(I).get(a.manifest.durableMaterial.durableMaterialRef);if(c===void 0)return{kind:`missing`,subject:`material`,detail:`active ECDSA manifest is missing its ready material`};let l;try{l=xo(c,a.activeProof)}catch(e){return{kind:`corrupt`,detail:U(e)}}if(!So(l,a.manifest))return{kind:`exact_binding_mismatch`,detail:`active ECDSA material does not match its manifest`};let u=await e.store(R).get(l.sealingKeyId);if(u===void 0)return{kind:`missing`,subject:`material`,detail:`active ECDSA material is missing its sealing key`};try{if(Do(u).keyId!==l.sealingKeyId)return{kind:`exact_binding_mismatch`,detail:`active ECDSA material sealing key id does not match`}}catch(e){return{kind:`corrupt`,detail:U(e)}}return await Ja(l.ciphertextB64u)===l.binding.ciphertextDigest?{kind:`active`,manifest:a.manifest,material:l}:{kind:`corrupt`,detail:`active ECDSA material ciphertext digest is invalid`}}async function Qo(e,t){let n=await e.store(ca).index(D.capabilityWallet).getAll([String(t.capability),String(t.authority.walletId)]);if(n.length===0)return{kind:`missing`,subject:`capability`,detail:`no ECDSA capability manifest exists`};let r=!1,i=!1,a=!1;for(let e of n){let n;try{n=ho(e)}catch(e){return{kind:`corrupt`,detail:U(e)}}if(va(n.selector,t)){i=!0;continue}r=!0,n.selector.authority.walletAuthMethodId===t.authority.walletAuthMethodId&&(a=!0)}return i?{kind:`exact_record_conflict`,detail:`exact ECDSA authority has manifest history without a current pointer`}:a?{kind:`exact_binding_mismatch`,detail:`ECDSA capability exists for this method under a different authority digest`}:r?{kind:`missing`,subject:`capability`,detail:`no ECDSA capability manifest exists for this exact authority`}:{kind:`missing`,subject:`capability`,detail:`no exact ECDSA capability manifest exists`}}function $o(e,t,n){let r=t.activationBinding;return _a(e.signer.authority,r.signer.authority)&&Sa(e.signer.scope,r.signer.scope)&&e.signer.walletId===r.signer.walletId&&e.signer.capability===r.signer.capability&&e.signer.materialOwner===r.signer.materialOwner&&e.signer.signingRootId===r.signer.signingRootId&&e.signer.signingRootVersion===r.signer.signingRootVersion&&Ta(e.signer.registeredPublicFacts,t.registeredPublicFacts)&&Na(e.activation.serverActivation,n)&&h(e.activation.materialActivation,me(n.serverActivationReceipt.protocolReceipt.ecdsa_activation.material_activation))&&e.durableMaterial.bindingDigest===r.bindingDigest&&e.durableMaterial.durableMaterialRef===r.durableMaterialRef&&Ca(e.durableMaterial.roleLocalBinding,r.roleLocalBinding)&&wa(e.durableMaterial.roleLocalPublicFacts,t.roleLocalPublicFacts)&&se(e.durableMaterial.routerAbEcdsaDerivationNormalSigning,t.routerAbEcdsaDerivationNormalSigning)&&ba(e.durableMaterial.runtimePolicyScope,te(t.runtimePolicyScope))}var W=class extends Error{constructor(e,t){super(t),this.name=`FinalizationControlError`,this.kind=e}};function es(e){return{target_manifest:e.targetManifest,signer:{capability:e.signer.capability,signer_id:e.signer.signerId,wallet_id:e.signer.walletId,authority:e.signer.authority,scope:e.signer.scope,material_owner:e.signer.materialOwner,signing_root_id:e.signer.signingRootId,signing_root_version:e.signer.signingRootVersion},role_local_binding:e.roleLocalBinding,binding_digest:e.bindingDigest,durable_material_ref:e.durableMaterialRef}}function ts(e){return`activationBinding`in e?{version:1,stage:`activation_prepared`,journal_id:e.journalId,expected_manifest:e.expectedManifest,activation_command:{kind:`ecdsa_server_activation_command`,correlationId:e.journalId,expectedGeneration:e.expectedGeneration,requestDigest:e.requestDigest,canonicalRequest:e.canonicalRequest},activation_binding:es(e.activationBinding),created_at:e.createdAt}:{version:1,stage:`activation_prepared`,journal_id:e.journalId,expected_manifest:e.expectedManifest,activation_command:e.activationCommand,activation_binding:es(e.candidate.activationBinding),created_at:e.createdAt}}function ns(e){return e.kind===`server_activation_committed`?rs(e.candidate.activationBinding,e.serverActivation):rs({targetManifest:e.identity,signer:e.signer,roleLocalBinding:e.durableMaterial.roleLocalBinding,bindingDigest:e.durableMaterial.bindingDigest,durableMaterialRef:e.durableMaterial.durableMaterialRef},e.activation.serverActivation)}function rs(e,t){return{version:1,stage:`activation_ready`,activation_binding:es(e),server_activation:t}}function is(e){return{activation_binding:e.activationBinding,server_activation:e.serverActivation,registered_public_facts:e.activeManifest.signer.registeredPublicFacts,role_local_public_facts:e.durableMaterial.roleLocalPublicFacts,router_ab_ecdsa_derivation_normal_signing:e.durableMaterial.routerAbEcdsaDerivationNormalSigning,runtime_policy_scope:e.durableMaterial.runtimePolicyScope,ciphertext_digest:e.durableMaterial.ciphertextDigest,committed_at:e.activeManifest.committedAt}}function as(e,t){return{record_version:`ecdsa_capability_manifest_v3`,manifest_id:e.activeManifest.identity.manifestId,manifest_revision:e.activeManifest.identity.manifestRevision,...ha(pa(e.activeManifest)),manifest_state:t}}function os(e){return{...as(e,`active`),active_proof:is(e)}}function ss(e,t){return{...as(e,`replaced`),active_proof:is(e),replacement_proof:is(t)}}async function cs(e){let t=mn({activationBinding:e.activationBinding,serverCommit:e.serverCommit}),n=je(C(`ecdsa-material-sealing-key`,32,`ECDSA material sealing key identities`)),r=await Ka(),i=await qa({key:r,stateBlobB64u:e.readyStateBlobB64u,aadProjection:rs(e.activationBinding,t)}),a=un({activationBinding:e.activationBinding,serverActivation:t,routerAbEcdsaDerivationNormalSigning:e.routerAbEcdsaDerivationNormalSigning,roleLocalPublicFacts:e.roleLocalPublicFacts,ciphertextDigest:Ie(i.digestB64u),runtimePolicyScope:e.runtimePolicyScope}),o=_n({binding:a,sealingKeyId:n,iv12B64u:i.iv12B64u,ciphertextB64u:i.ciphertextB64u}),s=hn({activationBinding:e.activationBinding,serverActivation:t,registeredPublicFacts:e.registeredPublicFacts,durableMaterial:a,committedAt:e.committedAt});return{activationBinding:e.activationBinding,serverActivation:t,sealingKey:r,readyMaterial:o,activeManifest:s,roleLocalMaterialRef:{kind:`ecdsa_role_local_persisted_material_ref_v1`,durableMaterialRef:o.binding.durableMaterialRef,bindingDigest:o.binding.bindingDigest,materialActivation:o.binding.materialActivation}}}async function ls(e,t){let n=pa(t.activeManifest),r=e.store(la),i=await r.get(ma(n)),a=await Jo(e,n);if(i!==void 0||a.length!==0)throw new W(`exact_record_conflict`,`ECDSA custody import found an existing active manifest`);let o={activationBinding:t.activationBinding,serverActivation:t.serverActivation,durableMaterial:t.readyMaterial.binding,activeManifest:t.activeManifest,committedAt:t.activeManifest.committedAt};await e.store(R).add(Eo(t.readyMaterial.sealingKeyId,t.sealingKey)),await e.store(I).add(yo(t.readyMaterial,t.activeManifest)),await e.store(ca).add(os(o)),await r.put(_o(t.activeManifest))}function us(e){let t=mo(is({activationBinding:e.committedJournal.candidate.activationBinding,serverActivation:e.committedJournal.serverActivation,durableMaterial:e.readyMaterial.binding,activeManifest:e.activeManifest,committedAt:e.activeManifest.committedAt}));if(!Ba(t.activeManifest,e.activeManifest)||!Ra(t.durableMaterial,e.readyMaterial.binding))throw Error(`ECDSA finalization input does not describe one exact active manifest`);return t}function ds(e,t,n){switch(e.kind){case`no_current_manifest`:if(t!==void 0)throw new W(`exact_record_conflict`,`initial ECDSA activation found an existing current pointer`);return null;case`exact_manifest`:{if(t===void 0)throw new W(`exact_record_conflict`,`replacement ECDSA activation is missing its expected current pointer`);let r;try{r=vo(t)}catch(e){throw new W(`corrupt`,U(e))}if(!va(r.selector,n)||r.manifestId!==e.manifestId||r.manifestRevision!==e.manifestRevision)throw new W(`exact_record_conflict`,`replacement ECDSA activation pointer CAS did not match`);return r}}return V(e)}async function fs(e,t){let n=t.store(L),r=await n.get(e.journalId);if(r===void 0)return{kind:`missing`};let i;try{i=wo(r)}catch{return{kind:`corrupt`}}if(i.journal.journalId!==e.journalId)return{kind:`corrupt`};switch(i.journal.kind){case`server_activation_committed`:return{kind:`server_activation_committed`};case`activation_prepared`:return La(i.journal,e)?(await t.store(R).delete(i.journal.candidate.encryptedPending.sealingKeyId),await n.delete(i.journal.journalId),{kind:`cancelled`}):{kind:`exact_record_conflict`}}return V(i.journal)}function ps(e,t){return e.runTransaction([ca,la,I,R],`readwrite`,e=>ls(e,t))}async function ms(e,t,n){let r=mn({activationBinding:t.activationBinding,serverCommit:t.serverCommit}),i=da(t.activationBinding.signer),a=await e.lookup(i);if(a.kind===`active`)return $o(a.manifest,t,r)?{kind:`committed`,manifest:a.manifest,material:a.material}:{kind:`exact_record_conflict`,selector:i,conflictDigest:await H(`custody_import_conflict`,i,`ECDSA custody import conflicts with the active manifest`)};try{let e=await cs(t);return await n(e),{kind:`committed`,manifest:e.activeManifest,material:e.readyMaterial}}catch(n){if(n instanceof W||Go(n)){let a=await e.lookup(i);return a.kind===`active`&&$o(a.manifest,t,r)?{kind:`committed`,manifest:a.manifest,material:a.material}:{kind:`exact_record_conflict`,selector:i,conflictDigest:await H(`custody_import_conflict`,i,U(n))}}return{kind:`corrupt`,selector:i,corruptionDigest:await H(`custody_import_corrupt`,i,U(n))}}}var hs=class{constructor(e=tt){this.manager=e}async admitClientPresignature(e){if(!No())return{kind:`persistence_unavailable`};let t=vn(e.poolIdentity),n=Bt(e.durableMaterialRef);if(!ko(n,t)||e.groupPublicKey33.length!==33||e.bigR33.length!==33)return{kind:`persistence_unavailable`};let r=jo(e.createdAtMs,`createdAtMs`),i=jo(e.expiresAtMs,`expiresAtMs`);if(r>Date.now()+3e5||i<=r||i>r+7776e6)return{kind:`persistence_unavailable`};let a=String(e.presignatureId||``).trim();if(!a||e.plaintext97.length!==97)return{kind:`persistence_unavailable`};let o;try{o=await this.lookupByMaterialRef(n)}catch{return{kind:`persistence_unavailable`}}if(o.kind!==`active`||!Oo(o.material,t,n))return{kind:`persistence_unavailable`};let s;try{s=await this.readMaterialSealingKey(o.material.sealingKeyId)}catch{return{kind:`persistence_unavailable`}}if(!s)return{kind:`persistence_unavailable`};let c=Ao(C(`ecdsa-client-presignature`,32,`ECDSA durable presignature record`)),l=Gt(x(e.groupPublicKey33)),u=Gt(x(e.bigR33)),d={kind:`sealed_available_client_presignature_v1`,recordId:c,poolIdentity:t,durableMaterialRef:n,presignatureId:a,groupPublicKey33B64u:l,bigR33B64u:u,createdAtMs:r,expiresAtMs:i,sealingKeyId:o.material.sealingKeyId},f;try{f=await Bo({key:s,plaintext97:e.plaintext97,metadata:d})}catch{return e.plaintext97.fill(0),{kind:`persistence_unavailable`}}let p={kind:`sealed_available_client_presignature_v1`,record_id:c,pool_identity:t,pool_identity_key:yn(t),wallet_id:t.walletId,material_activation_id:t.materialActivationId,durable_material_ref:n,presignature_id:a,group_public_key33_b64u:l,big_r33_b64u:u,created_at_ms:r,expires_at_ms:i,sealed:{kind:`ecdsa_activation_aes_gcm_v1`,sealing_key_id:o.material.sealingKeyId,iv12_b64u:f.iv12B64u,ciphertext_b64u:f.ciphertextB64u,ciphertext_digest_b64u:f.ciphertextDigestB64u}};try{let e=await this.manager.runTransaction([z,I],`readwrite`,async e=>{if((await Io(e,t,Date.now())).length>=5)return{kind:`capacity_full`};let r=await e.store(I).get(n.durableMaterialRef);if(r===void 0)return{kind:`persistence_unavailable`};try{let e=bo(r),i=v(r,`ECDSA role-local material row`);if(e.durableMaterialRef!==n.durableMaterialRef||e.bindingDigest!==n.bindingDigest||e.selector.capability!==o.manifest.signer.capability||String(e.selector.authority.walletId)!==t.walletId||je(i.sealing_key_id)!==o.material.sealingKeyId)return{kind:`persistence_unavailable`}}catch{return{kind:`persistence_unavailable`}}return await e.store(z).put(p),{kind:`stored`}},{durability:`strict`});return e.kind===`stored`?{kind:`stored`,metadata:d}:e}catch{return{kind:`persistence_ambiguous`}}}async listAvailableClientPresignatures(e){if(!No())return[];let t=vn(e),n=Date.now();try{return await this.manager.runTransaction([z],`readwrite`,async e=>(await Io(e,t,n)).map(zo).sort((e,t)=>e.createdAtMs-t.createdAtMs))}catch{return[]}}async takeClientPresignature(e){if(!No())return{kind:`persistence_unavailable`};let t=Ao(e.recordId),n=vn(e.poolIdentity),r;try{let e=await this.manager.runTransaction([z],`readwrite`,async e=>{let r=e.store(z),i=await r.get(t);if(i===void 0)return{kind:`claimed_elsewhere`};let a;try{a=Ro(i)}catch{let e=Mo(i);return e&&await r.delete(e),{kind:`corrupt`}}return bn(a.pool_identity,n)?a.expires_at_ms<=Date.now()?(await r.delete(t),{kind:`expired`}):(await r.delete(t),{kind:`claimed`,row:a}):(await r.delete(t),{kind:`binding_rejected`})},{durability:`strict`});if(e.kind!==`claimed`)return{kind:e.kind};r=e.row}catch{return{kind:`persistence_unavailable`}}let i;try{i=await this.lookupByMaterialRef(r.durable_material_ref)}catch{return{kind:`persistence_unavailable`}}if(i.kind!==`active`||!Oo(i.material,n,r.durable_material_ref)||i.material.sealingKeyId!==r.sealed.sealing_key_id)return{kind:`binding_rejected`};let a;try{a=await this.readMaterialSealingKey(r.sealed.sealing_key_id)}catch{return{kind:`persistence_unavailable`}}if(!a)return{kind:`corrupt`};let o=zo(r);try{return{kind:`opened`,metadata:o,plaintext97:await Vo({key:a,metadata:o,sealed:r.sealed})}}catch{return{kind:`corrupt`}}}async deleteClientPresignature(e){let t=Ao(e.recordId),n=vn(e.poolIdentity);await this.manager.runTransaction([z],`readwrite`,async e=>{let r=e.store(z),i=await r.get(t);i!==void 0&&bn(Ro(i).pool_identity,n)&&await r.delete(t)})}async deleteClientPresignatures(e){return await this.manager.runTransaction([z],`readwrite`,async t=>{let n=t.store(z),r=0;switch(e.kind){case`wallet`:{let t=String(e.walletId).trim();if(!t)throw Error(`ECDSA durable presignature wallet id is required`);r=await Po(await n.index(D.walletId).openCursor(t));break}case`all`:r=await Po(await n.openCursor());break}return r})}async listActiveWalletCapabilitySubjects(e){let t=a(e);if(!t.ok)return{kind:`invalid_current_state`};let n;try{n=await this.manager.runTransaction([la],`readonly`,e=>Ko(e,t.value))}catch{return{kind:`persistence_unavailable`}}let r=[];try{for(let e of n){let n=vo(e);n.selector.authority.walletId===t.value&&r.push(n.selector)}}catch{return{kind:`invalid_current_state`}}let i=[];for(let e of r){let t=await this.lookup(e);if(t.kind===`persistence_unavailable`)return{kind:`persistence_unavailable`};if(t.kind!==`active`)return{kind:`invalid_current_state`};i.push({capability:t.manifest.signer.capability,authority:t.manifest.signer.authority,ecdsaThresholdKeyId:t.manifest.durableMaterial.roleLocalBinding.ecdsaThresholdKeyId})}return{kind:`resolved`,subjects:i}}async listWalletActivationJournalSelectors(e){let t=a(e);if(!t.ok)return{kind:`invalid_current_state`};let n;try{n=await this.manager.runTransaction([L],`readonly`,qo)}catch{return{kind:`persistence_unavailable`}}let r=[];try{for(let e of n){let n=wo(e).journal.candidate.activationBinding.signer;n.authority.walletId===t.value&&r.push(da(n))}}catch{return{kind:`invalid_current_state`}}return{kind:`resolved`,selectors:r}}async prepareActivation(e){let t=da(e.activationBinding.signer);try{let t=je(C(`ecdsa-material-key`,32,`ECDSA activation material sealing key`)),n=await Ka(),r=await qa({key:n,stateBlobB64u:e.pendingPayloadB64u,aadProjection:ts(e)}),i=Ha({preparation:e,encryptedPending:tn({sealingKeyId:t,iv12B64u:r.iv12B64u,ciphertextB64u:r.ciphertextB64u,ciphertextDigest:Oe(r.digestB64u)})});return await this.manager.runTransaction([R,L],`readwrite`,async e=>{await e.store(R).add(Eo(t,n)),await e.store(L).add(Co(i))}),{kind:`stored`,journal:i}}catch(e){return Go(e)?await Uo(t,e):e instanceof DOMException&&e.name===`OperationError`?{kind:`corrupt`,corruptionDigest:await H(`journal_encryption_failed`,t,U(e))}:e instanceof Error&&!(e instanceof DOMException)?{kind:`corrupt`,corruptionDigest:await H(`journal_preparation_invalid`,t,e.message)}:{kind:`persistence_unavailable`,retryCorrelation:Wo()}}}async recordServerActivation(e){let t;try{t=Qt(e)}catch(t){return{kind:`corrupt`,corruptionDigest:await H(`server_activation_commit_corrupt`,fa(e.preparedJournal),U(t))}}return await this.putActivationJournal(t)}async putActivationJournal(e){let t;try{if(t=lo(e),await Ja(t.candidate.encryptedPending.ciphertextB64u)!==t.candidate.encryptedPending.ciphertextDigest)throw Error(`ECDSA pending material ciphertext digest is invalid`)}catch(t){return{kind:`corrupt`,corruptionDigest:await H(`journal_input_corrupt`,fa(e),U(t))}}let n=fa(t);try{let e=await this.readMaterialSealingKey(t.candidate.encryptedPending.sealingKeyId);if(!e)throw new W(`corrupt`,`ECDSA activation journal references a missing sealing key`);return await Ya({key:e,iv12B64u:t.candidate.encryptedPending.iv12B64u,ciphertextB64u:t.candidate.encryptedPending.ciphertextB64u,aadProjection:ts(t)}),await this.manager.runTransaction([R,L],`readwrite`,async e=>{let r=await e.store(R).get(t.candidate.encryptedPending.sealingKeyId);if(r===void 0)throw new W(`corrupt`,`ECDSA activation journal references a missing sealing key`);try{Do(r)}catch(e){throw new W(`corrupt`,U(e))}let i=e.store(L),a=await i.get(t.journalId);if(a===void 0)throw new W(`exact_record_conflict`,`ECDSA committed activation is missing its prepared journal`);let o;try{o=wo(a)}catch(e){throw new W(`corrupt`,U(e))}if(!va(o.selector,n)||o.journal.kind===`activation_prepared`&&!La(o.journal,co(t))||o.journal.kind===`server_activation_committed`&&!La(o.journal,t))throw new W(`exact_record_conflict`,`ECDSA activation journal conflicts with its existing correlation`);await i.put(Co(t))}),{kind:`stored`,journal:t}}catch(e){if(e instanceof W){let t=await H(e.kind===`corrupt`?`journal_corrupt`:`journal_conflict`,n,e.message);return e.kind===`corrupt`?{kind:`corrupt`,corruptionDigest:t}:{kind:`exact_record_conflict`,conflictDigest:t}}return Go(e)?await Uo(n,e):e instanceof DOMException&&e.name===`OperationError`?{kind:`corrupt`,corruptionDigest:await H(`journal_ciphertext_corrupt`,n,U(e))}:{kind:`persistence_unavailable`,retryCorrelation:Wo()}}}async readActivationJournal(e){let t=Ye(e);try{let e=await this.manager.runTransaction([L],`readonly`,async e=>await e.store(L).get(t));if(e===void 0)return{kind:`missing`};try{let n=wo(e);return n.journal.journalId===t?{kind:`found`,journal:n.journal}:{kind:`corrupt`}}catch{return{kind:`corrupt`}}}catch{return{kind:`persistence_unavailable`}}}async discoverActivationJournal(e){let t;try{t=ua(e)}catch{return{kind:`corrupt`}}try{let e=await this.manager.runTransaction([L],`readonly`,async e=>await e.store(L).index(D.capabilityWalletAuthority).get(ma(t)));if(e===void 0)return{kind:`missing`};try{let n=wo(e);return va(n.selector,t)?{kind:`found`,journal:n.journal}:{kind:`corrupt`}}catch{return{kind:`corrupt`}}}catch{return{kind:`persistence_unavailable`}}}async cancelPreparedActivation(e){try{return await this.manager.runTransaction([R,L],`readwrite`,fs.bind(void 0,e))}catch{return{kind:`persistence_unavailable`}}}async openPreparedActivation(e){let t=await this.readActivationJournal(e);if(t.kind!==`found`)return t;let n=t.journal.candidate.encryptedPending;try{if(await Ja(n.ciphertextB64u)!==n.ciphertextDigest)return{kind:`corrupt`};let e=await this.readMaterialSealingKey(n.sealingKeyId);return e?{kind:`found`,journal:t.journal,pendingPayloadB64u:await Ya({key:e,iv12B64u:n.iv12B64u,ciphertextB64u:n.ciphertextB64u,aadProjection:ts(t.journal)})}:{kind:`corrupt`}}catch{return{kind:`corrupt`}}}async lookup(e){let t=ua(e),n;try{n=await this.manager.runTransaction([ca,la,I,R],`readonly`,async e=>await Zo(e,t))}catch{return{kind:`persistence_unavailable`,selector:t,retryCorrelation:Wo()}}switch(n.kind){case`active`:return n;case`retired`:return n;case`missing`:return{kind:`missing`,selector:t,subject:n.subject};case`exact_binding_mismatch`:return{kind:`exact_binding_mismatch`,selector:t,failureDigest:await H(n.kind,t,n.detail)};case`exact_record_conflict`:return{kind:`exact_record_conflict`,selector:t,conflictDigest:await H(n.kind,t,n.detail)};case`corrupt`:return{kind:`corrupt`,selector:t,corruptionDigest:await H(n.kind,t,n.detail)}}return V(n)}async lookupByMaterialActivation(e){let t=a(e.walletId),n=l(e.materialActivation),r=n.ok?n.value.capability:e.materialActivation.capability;if(!t.ok||!n.ok)return{kind:`corrupt`,capability:r};let i=t.value,o=n.value,s;try{s=await this.manager.runTransaction([la],`readonly`,async e=>await Ko(e,i))}catch{return{kind:`persistence_unavailable`,capability:r}}let c=[];try{for(let e of s){let t=vo(e);t.selector.authority.walletId===i&&c.push(t.selector)}}catch{return{kind:`corrupt`,capability:r}}if(c.length===0)return{kind:`missing`,subject:`capability`,capability:r};let u=[];for(let e of c){let t=await this.lookup(e);switch(t.kind){case`active`:Yo(t,o)&&u.push(t);break;case`retired`:break;case`missing`:return{kind:`missing`,subject:t.subject,capability:r};case`exact_binding_mismatch`:case`exact_record_conflict`:case`corrupt`:case`persistence_unavailable`:return{kind:t.kind,capability:r}}}let d=e.authority;if(d){let e=u.filter(e=>_a(e.manifest.signer.authority,d));return e.length>1?{kind:`exact_record_conflict`,capability:r}:e[0]??{kind:`exact_binding_mismatch`,capability:r}}return u.length>1?{kind:`ambiguous_authority`,capability:r,authorities:u.map(e=>e.manifest.signer.authority)}:u[0]??{kind:`exact_binding_mismatch`,capability:r}}async openActiveMaterial(e){let t=ua(e),n=await this.lookup(t);return n.kind===`active`?await this.openActiveMaterialLookup(n):n}async lookupByMaterialRef(e){let t=Bt(e),n=t.materialActivation.capability,r;try{r=await this.manager.runTransaction([I],`readonly`,async e=>await e.store(I).get(t.durableMaterialRef))}catch{return{kind:`persistence_unavailable`,capability:n}}if(r===void 0)return await this.lookupMissingMaterialByRef(t);let i;try{i=bo(r)}catch{return{kind:`corrupt`,capability:n}}if(i.durableMaterialRef!==t.durableMaterialRef||i.bindingDigest!==t.bindingDigest)return{kind:`exact_binding_mismatch`,capability:n};let a=await this.lookup(i.selector);switch(a.kind){case`active`:return a.manifest.durableMaterial.durableMaterialRef!==t.durableMaterialRef||a.manifest.durableMaterial.bindingDigest!==t.bindingDigest||!Yo(a,t.materialActivation)?{kind:`exact_binding_mismatch`,capability:n}:a;case`retired`:return a;case`missing`:return{kind:`missing`,subject:a.subject,capability:n};case`exact_binding_mismatch`:case`exact_record_conflict`:case`corrupt`:case`persistence_unavailable`:return{kind:a.kind,capability:n}}return V(a)}async lookupMissingMaterialByRef(e){let t=e.materialActivation.capability,n;try{n=await this.manager.runTransaction([ca],`readonly`,async e=>await e.store(ca).getAll())}catch{return{kind:`persistence_unavailable`,capability:t}}let r=[],i=!1;for(let a of n){let n;try{n=ho(a)}catch{return{kind:`corrupt`,capability:t}}let o=n.activeProof.durableMaterial;if(o.durableMaterialRef===e.durableMaterialRef){if(o.bindingDigest!==e.bindingDigest||!h(o.materialActivation,e.materialActivation)){i=!0;continue}r.push(n)}}if(r.length>1)return{kind:`exact_record_conflict`,capability:t};let[a]=r;return a?a.state===`replaced`?{kind:`retired`,manifest:a.manifest}:{kind:`missing`,subject:`material`,capability:t}:i?{kind:`exact_binding_mismatch`,capability:t}:{kind:`missing`,subject:`material`,capability:t}}async openActiveMaterialLookup(e){let t=pa(e.manifest);try{if(await Ja(e.material.ciphertextB64u)!==e.material.binding.ciphertextDigest)throw Error(`active ECDSA material ciphertext digest is invalid`);let t=await this.readMaterialSealingKey(e.material.sealingKeyId);if(!t)throw Error(`active ECDSA material sealing key is missing`);return{kind:`active`,manifest:e.manifest,readyStateBlobB64u:await Ya({key:t,iv12B64u:e.material.iv12B64u,ciphertextB64u:e.material.ciphertextB64u,aadProjection:ns(e.manifest)})}}catch(e){return{kind:`corrupt`,selector:t,corruptionDigest:await H(`active_material_open_corrupt`,t,U(e))}}}async openActiveMaterialByRef(e){let t;try{t=await this.lookupByMaterialRef(e)}catch{return{kind:`corrupt`}}if(t.kind!==`active`)return Xo(t);let n=await this.openActiveMaterialLookup(t);return n.kind===`active`?n:Xo(n)}async sealAndFinalizeActivation(e){let t=fa(e.committedJournal);try{let t=lo(e.committedJournal),n=t.candidate.encryptedPending.sealingKeyId,r=await this.readMaterialSealingKey(n);if(!r)throw Error(`ECDSA activation material sealing key is missing`);let i=await qa({key:r,stateBlobB64u:e.readyStateBlobB64u,aadProjection:ns(t)}),a=un({activationBinding:t.candidate.activationBinding,serverActivation:t.serverActivation,routerAbEcdsaDerivationNormalSigning:e.routerAbEcdsaDerivationNormalSigning,roleLocalPublicFacts:Zt(e.roleLocalPublicFacts),ciphertextDigest:Ie(i.digestB64u),runtimePolicyScope:e.runtimePolicyScope}),o=_n({binding:a,sealingKeyId:n,iv12B64u:i.iv12B64u,ciphertextB64u:i.ciphertextB64u}),s=hn({activationBinding:t.candidate.activationBinding,serverActivation:t.serverActivation,registeredPublicFacts:e.registeredPublicFacts,durableMaterial:a,committedAt:e.committedAt});return await this.finalizeActivation({committedJournal:t,readyMaterial:o,activeManifest:s})}catch(e){return{kind:`corrupt`,selector:t,corruptionDigest:await H(`activation_seal_corrupt`,t,U(e))}}}async importCommittedWalletCustodyActivation(e){return await ms(this,e,e=>ps(this.manager,e))}async persistPreparedWalletCustodyEcdsaContinuity(e){await ps(this.manager,e)}async readMaterialSealingKey(e){let t=je(e),n=await this.manager.runTransaction([R],`readonly`,async e=>await e.store(R).get(t));if(n===void 0)return null;let r=Do(n);if(r.keyId!==t)throw Error(`ECDSA material sealing key row identity is inconsistent`);return r.key}async finalizeActivation(e){let t;try{t=us(e)}catch(t){let n=fa(e.committedJournal);return{kind:`corrupt`,selector:n,corruptionDigest:await H(`finalization_input_corrupt`,n,U(t))}}let n=pa(t.activeManifest);try{if(await Ja(e.readyMaterial.ciphertextB64u)!==e.readyMaterial.binding.ciphertextDigest)throw new W(`corrupt`,`ECDSA ready material ciphertext digest is invalid`);let r=await this.readMaterialSealingKey(e.readyMaterial.sealingKeyId);if(!r)throw new W(`corrupt`,`ECDSA ready material sealing key is missing`);return await Ya({key:r,iv12B64u:e.readyMaterial.iv12B64u,ciphertextB64u:e.readyMaterial.ciphertextB64u,aadProjection:ns(e.committedJournal)}),await this.manager.runTransaction([ca,la,I,L,R,z],`readwrite`,async r=>{await gs(r,e,t,n)}),{kind:`committed`,manifest:t.activeManifest,material:e.readyMaterial}}catch(e){if(e instanceof W){let t=await H(e.kind===`corrupt`?`finalization_corrupt`:`finalization_conflict`,n,e.message);return e.kind===`corrupt`?{kind:`corrupt`,selector:n,corruptionDigest:t}:{kind:`exact_record_conflict`,selector:n,conflictDigest:t}}return Go(e)?{kind:`exact_record_conflict`,selector:n,conflictDigest:await H(`finalization_constraint_conflict`,n,U(e))}:{kind:`persistence_unavailable`,selector:n,retryCorrelation:Wo()}}}};async function gs(e,t,n,r){let i=e.store(L),a=await i.get(t.committedJournal.journalId);if(a===void 0)throw new W(`exact_record_conflict`,`ECDSA finalization is missing its durable activation journal`);let o;try{o=wo(a)}catch(e){throw new W(`corrupt`,U(e))}if(o.journal.kind!==`server_activation_committed`||!va(o.selector,r)||!La(o.journal,t.committedJournal))throw new W(`exact_record_conflict`,`ECDSA finalization journal does not match its committed activation`);let s=await e.store(R).get(t.readyMaterial.sealingKeyId);if(s===void 0)throw new W(`corrupt`,`ECDSA finalization is missing its material sealing key`);try{Do(s)}catch(e){throw new W(`corrupt`,U(e))}let c=e.store(la),l=await c.get(ma(r)),u=t.committedJournal.expectedManifest,d=ds(u,l,r),f=await Jo(e,r),p=null,m=null;if(d===null){if(f.length!==0)throw new W(`exact_record_conflict`,`initial ECDSA activation found an unpointed active manifest`)}else{if(f.length!==1)throw new W(`exact_record_conflict`,`replacement ECDSA activation found conflicting current manifests`);let n;try{n=ho(f[0])}catch(e){throw new W(`corrupt`,U(e))}if(n.state!==`active`||n.manifest.identity.manifestId!==d.manifestId)throw new W(`exact_record_conflict`,`replacement ECDSA activation current manifest does not match its pointer`);if(t.committedJournal.activationCommand.expectedGeneration.kind!==`exact_generation`||n.activeProof.serverActivation.serverGeneration!==t.committedJournal.activationCommand.expectedGeneration.serverGeneration)throw new W(`exact_record_conflict`,`replacement ECDSA activation server generation CAS did not match`);let r=await e.store(I).get(n.manifest.durableMaterial.durableMaterialRef);if(r===void 0)throw new W(`corrupt`,`replacement ECDSA activation is missing prior material`);try{let e=xo(r,n.activeProof);if(!So(e,n.manifest))throw Error(`prior ECDSA material does not match its active manifest`);if(e.sealingKeyId===t.readyMaterial.sealingKeyId)throw Error(`replacement ECDSA activation must use a fresh material sealing key`);m=e.sealingKeyId}catch(e){throw new W(`corrupt`,U(e))}p=n.activeProof}let h=e.store(ca),g=e.store(I);if(p){if(!m)throw new W(`corrupt`,`replacement ECDSA activation is missing its prior sealing key identity`);await Ho(e,String(p.durableMaterial.materialActivation.materialOwner),String(p.durableMaterial.materialActivation.activationId)),await h.put(ss(p,n)),await g.delete(p.durableMaterial.durableMaterialRef),await e.store(R).delete(m)}await g.add(yo(t.readyMaterial,n.activeManifest)),await h.add(os(n)),await c.put(_o(n.activeManifest)),await i.delete(t.committedJournal.journalId)}const _s=`ed25519_yao_public_capability_references_v1`,vs=`ed25519_yao_public_capability_lanes_v1`,ys=`ed25519YaoPublicCapabilityReferencesV1`,bs=`ed25519YaoPublicCapabilityLanesV1`;async function xs(e,t){let n={walletId:t.walletId,nearAccountId:t.nearAccountId,thresholdSessionId:t.thresholdSessionId,runtimePolicyScope:t.runtimePolicyScope,materialActivation:t.materialActivation};await e.upsert(n),await e.upsertLane(t)}function Ss(e,t,n){let r=Object.keys(e).sort(),i=[...t].sort();if(r.length!==i.length||r.some((e,t)=>e!==i[t]))throw Error(`${n} contains unexpected fields`)}function Cs(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<0)throw Error(`${t} must be a non-negative integer`);return e}function ws(e,t){if(typeof e!=`number`||!Number.isSafeInteger(e)||e<1)throw Error(`${t} must be a positive integer`);return e}function Ts(e,t){let n=v(e,t),r=y(n.kind,`${t}.kind`,`must be a non-empty normalized string`);switch(r){case`passkey`:return Ss(n,[`kind`,`rpId`,`credentialIdB64u`],t),{kind:r,rpId:Dt(y(n.rpId,`${t}.rpId`,`must be a non-empty normalized string`)),credentialIdB64u:y(n.credentialIdB64u,`${t}.credentialIdB64u`,`must be a non-empty normalized string`)};case`email_otp`:return Ss(n,[`kind`,`providerSubjectId`],t),{kind:r,providerSubjectId:y(n.providerSubjectId,`${t}.providerSubjectId`,`must be a non-empty normalized string`)};default:throw Error(`${t}.kind is invalid`)}}function Es(e,t){let n=v(e,t);Ss(n,[`walletId`,`nearAccountId`,`thresholdSessionId`,`runtimePolicyScope`,`materialActivation`],t);let r=l(n.materialActivation);if(!r.ok)throw Error(`${t}.materialActivation is invalid: ${r.error.message}`);let i=o(n.thresholdSessionId);if(!i.ok)throw Error(`${t}.thresholdSessionId is invalid`);let a=ne(n.runtimePolicyScope);if(!a)throw Error(`${t}.runtimePolicyScope is invalid`);return{walletId:Ze(y(n.walletId,`${t}.walletId`,`must be a non-empty normalized string`)),nearAccountId:mt(y(n.nearAccountId,`${t}.nearAccountId`,`must be a non-empty normalized string`)),thresholdSessionId:i.value,runtimePolicyScope:a,materialActivation:r.value}}function Ds(e,t){let n=v(e,t),r=Ts(n.auth,`${t}.auth`);Ss(n,[`walletId`,`nearAccountId`,`thresholdSessionId`,`runtimePolicyScope`,`materialActivation`,`auth`,`nearEd25519SigningKeyId`,`signerSlot`,...r.kind===`email_otp`?[`remainingUses`,`expiresAtMs`]:[]],t);let i=Es({walletId:n.walletId,nearAccountId:n.nearAccountId,thresholdSessionId:n.thresholdSessionId,runtimePolicyScope:n.runtimePolicyScope,materialActivation:n.materialActivation},t),a=Jt(n.signerSlot);if(a===null)throw Error(`${t}.signerSlot is invalid`);let o={...i,nearEd25519SigningKeyId:Rt(y(n.nearEd25519SigningKeyId,`${t}.nearEd25519SigningKeyId`,`must be a non-empty normalized string`)),signerSlot:a};switch(r.kind){case`email_otp`:return{...o,auth:r,remainingUses:Cs(n.remainingUses,`${t}.remainingUses`),expiresAtMs:ws(n.expiresAtMs,`${t}.expiresAtMs`)};case`passkey`:return{...o,auth:r};default:throw Error(`${t}.auth is invalid`)}}function Os(e){let t=v(e,`Ed25519 Yao public capability references`);if(Ss(t,[`kind`,`identities`],`Ed25519 Yao public capability references`),t.kind!==_s)throw Error(`Ed25519 Yao public capability references kind is invalid`);if(!Array.isArray(t.identities))throw Error(`Ed25519 Yao public capability identities must be an array`);if(t.identities.length>64)throw Error(`Ed25519 Yao public capability reference capacity is exceeded`);let n=t.identities.map((e,t)=>Es(e,`Ed25519 Yao public capability identity ${t}`));if(new Set(n.map(Ms)).size!==n.length)throw Error(`Ed25519 Yao public capability references contain duplicate identities`);return{kind:_s,identities:n}}function ks(e){let t=v(e,`Ed25519 Yao public capability lanes`);if(Ss(t,[`kind`,`lanes`],`Ed25519 Yao public capability lanes`),t.kind!==vs)throw Error(`Ed25519 Yao public capability lanes kind is invalid`);if(!Array.isArray(t.lanes))throw Error(`Ed25519 Yao public capability lanes must be an array`);if(t.lanes.length>64)throw Error(`Ed25519 Yao public capability lane capacity is exceeded`);let n=t.lanes.map((e,t)=>Ds(e,`Ed25519 Yao public capability lane ${t}`));if(new Set(n.map(Ms)).size!==n.length)throw Error(`Ed25519 Yao public capability lanes contain duplicate identities`);return{kind:vs,lanes:n}}function As(){return{kind:_s,identities:[]}}function js(){return{kind:vs,lanes:[]}}function Ms(e){let t=e.materialActivation;return JSON.stringify([String(e.walletId),String(e.nearAccountId),t.activationId,t.capability,t.materialOwner,t.keyBinding,t.lifecycleBinding,t.signingWorker])}function Ns(e){return Es(e,`Ed25519 Yao public capability identity`)}function Ps(e){return Ds(e,`Ed25519 Yao public capability lane`)}async function Fs(e,t){let n=await e.get(ys);if(n!==void 0&&n.key!==ys)throw Error(`Ed25519 Yao public capability reference app-state key is inconsistent`);let r=n===void 0?As():Os(n.value),i=Ns(t),a=r.identities.filter(e=>String(e.walletId)!==String(i.walletId)||String(e.nearAccountId)!==String(i.nearAccountId));if(a.length>=64)throw Error(`Ed25519 Yao public capability reference capacity is exhausted`);await e.put({key:ys,value:Os({kind:_s,identities:[...a,i]})})}var Is=class{constructor(e){this.appState=e}async readProjection(){if(this.appState.isDisabled())return As();let e=await this.appState.getAppState(ys);return e==null?As():Os(e)}async writeProjection(e){this.appState.isDisabled()||await this.appState.setAppState(ys,Os(e))}async readLaneProjection(){if(this.appState.isDisabled())return js();let e=await this.appState.getAppState(bs);return e==null?js():ks(e)}async writeLaneProjection(e){this.appState.isDisabled()||await this.appState.setAppState(bs,ks(e))}async upsert(e){let t=Ns(e),n=(await this.readProjection()).identities.filter(e=>String(e.walletId)!==String(t.walletId)||String(e.nearAccountId)!==String(t.nearAccountId));if(n.length>=64)throw Error(`Ed25519 Yao public capability reference capacity is exhausted`);await this.writeProjection({kind:_s,identities:[...n,t]})}async remove(e){let t=Ms(e),n=await this.readProjection();await this.writeProjection({kind:_s,identities:n.identities.filter(e=>Ms(e)!==t)})}async list(){return(await this.readProjection()).identities.map(Ns)}async upsertLane(e){let t=Ps(e),n=(await this.readLaneProjection()).lanes.filter(e=>String(e.walletId)!==String(t.walletId)||String(e.nearAccountId)!==String(t.nearAccountId));if(n.length>=64)throw Error(`Ed25519 Yao public capability lane capacity is exhausted`);await this.writeLaneProjection({kind:vs,lanes:[...n,t]})}async removeLane(e){let t=Ms(e),n=await this.readLaneProjection();await this.writeLaneProjection({kind:vs,lanes:n.lanes.filter(e=>Ms(e)!==t)})}async listLanes(){return(await this.readLaneProjection()).lanes.map(Ps)}};async function Ls(e,t){let n=String(t||``).trim();if(!n)return null;let r=new Set;for(let t of await new Is(e).listLanes()){if(t.auth.kind!==`email_otp`||String(t.walletId)!==n)continue;let e=String(t.auth.providerSubjectId||``).trim();e&&r.add(e)}return r.size===1?[...r][0]??null:null}function G(e){throw Error(`Unhandled wallet auth method branch: ${String(e)}`)}function Rs(e,t){if(t.binding.kind!==`ed25519_yao_client_root_v1`)return!1;switch(e.kind){case`passkey`:return t.factor.kind===`passkey`&&t.factor.rpId===e.rpId&&t.factor.credentialIdB64u===e.credentialIdB64u&&t.binding.targetFactor.kind===`passkey_prf`;case`email_otp`:return t.factor.kind===`email_otp`&&t.binding.targetFactor.kind===`email_otp`;default:return G(e)}}function zs(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=Reflect.get(e,`key`);return typeof t!=`string`||t.length===0?null:{key:t,value:Reflect.get(e,`value`)}}function Bs(e){return`local-authority/pending-profile-projection/v1/${e}`}function Vs(e,t){return{kind:`wallet_selection_v1`,walletId:e.authority.walletId,walletAuthMethodId:e.authMethod.walletAuthMethodId,lockGeneration:t?.record.lockGeneration??0,lockState:t?.record.lockState??`unlocked`,updatedAtMs:e.receipt.installedAtMs}}function Hs(e,t){if(e.operation!==t.operation||e.registrationCeremonyId!==t.registrationCeremonyId||e.idempotencyKey!==t.idempotencyKey||e.walletId!==t.walletId||e.walletAuthMethodId!==t.walletAuthMethodId)throw Error(`pending wallet registration commit does not match the request`)}function Us(e){let t=It(e.authority),n=Lt(e.authMethod);if(!t.ok||t.value.state!==`active`||!n||n.status!==`active`||t.value.provenance.kind!==`wallet_registration`||n.walletId!==t.value.walletId||n.walletAuthorityId!==t.value.authorityId)throw Error(`founding wallet authority records are invalid`);return{authority:t.value,authMethod:n}}async function Ws(e){let t=e.pending,n=e.foundingAuthority.authMethod,r=e.registration.initialAuthMethod;if(Hs(t,e.request),pr(t,{operation:e.request.operation,walletId:e.request.walletId,walletAuthMethodId:e.request.walletAuthMethodId,authority:e.authority}),n.walletId!==t.walletId||n.walletAuthMethodId!==t.walletAuthMethodId||r.walletId!==t.walletId||r.status!==`active`||r.localStatus!==`synced`||r.kind!==t.auth.kind||n.kind!==t.auth.kind||!e.registration.profiles.some(e=>e.profileId===t.walletId)||e.registration.lastProfileState.profileId!==t.walletId)throw Error(`registration finalize batch does not match the pending wallet`);let i=new Set(e.registration.profiles.map(e=>e.profileId));for(let n of e.registration.profiles)if(n.passkeyCredential&&(t.auth.kind!==`passkey`||n.passkeyCredential.rawId!==t.auth.credentialIdB64u))throw Error(`registration profile credential does not match the pending commit`);for(let t of e.registration.signerActivations)if(!i.has(t.account.profileId))throw Error(`registration signer account is outside the publication profiles`);for(let t of e.registration.keyMaterials)if(!i.has(t.profileId))throw Error(`registration key material is outside the publication profiles`);switch(t.auth.kind){case`passkey`:if(!fe(e.authority)||r.kind!==`passkey`||n.kind!==`passkey`||r.rpId!==t.auth.rpId||r.credentialIdB64u!==t.auth.credentialIdB64u||n.rpId!==t.auth.rpId||n.credentialIdB64u!==t.auth.credentialIdB64u||r.credentialPublicKeyB64u!==n.credentialPublicKeyB64u)throw Error(`registration passkey records do not match the pending commit`);for(let n of e.registration.authenticators)if(!i.has(n.profileId)||n.credentialId!==t.auth.credentialIdB64u||x(n.credentialPublicKey)!==r.credentialPublicKeyB64u)throw Error(`registration passkey authenticator does not match the pending commit`);return;case`email_otp`:{if(r.kind!==`email_otp`||n.kind!==`email_otp`)throw Error(`registration Email OTP method records are invalid`);let i=ie(r.authority);if(!i||!_e(e.authority))throw Error(`registration Email OTP authority records are invalid`);let a=await We(t.auth.email);if(r.registrationAuthorityId!==t.auth.registrationAuthorityId||n.registrationAuthorityId!==t.auth.registrationAuthorityId||r.emailHashHex!==a||n.emailHashHex!==a||e.authority.verifier.emailHashHex!==a||i.factor.providerUserId!==t.auth.providerSubject||i.factor.provider!==e.authority.factor.provider||!Ne(i,e.authority)||e.registration.authenticators.length!==0)throw Error(`registration Email OTP records do not match the pending commit`);return}}}function Gs(e){let t=e.pending.projection;if(!Kl(e.authority,t.authority)||!Jl(e.authMethod,t.authMethod))throw Error(`recovery publication records do not match the committed projection`);let n=e.registration.initialAuthMethod,r=e.registration.profiles;if(n.status!==`active`||n.localStatus!==`synced`||n.walletId!==t.walletId||!r.some(e=>e.profileId===t.walletId)||e.registration.lastProfileState.profileId!==t.walletId||!Number.isSafeInteger(e.registration.lastProfileState.activeSignerSlot)||e.registration.lastProfileState.activeSignerSlot<1)throw Error(`recovery profile publication does not match the committed projection`);let i=new Set(r.map(e=>e.profileId));for(let e of r)if(e.passkeyCredential&&(t.kind!==`passkey`||e.passkeyCredential.rawId!==t.target.credentialIdB64u))throw Error(`recovery profile credential does not match the committed projection`);for(let t of e.registration.signerActivations)if(!i.has(t.account.profileId))throw Error(`recovery signer account is outside the publication profiles`);for(let t of e.registration.keyMaterials)if(!i.has(t.profileId))throw Error(`recovery key material is outside the publication profiles`);if(t.kind===`passkey`){if(n.kind!==`passkey`)throw Error(`recovery passkey publication method branch is invalid`);if(n.rpId!==t.target.rpId||n.credentialIdB64u!==t.target.credentialIdB64u||n.credentialPublicKeyB64u!==t.authMethod.credentialPublicKeyB64u||!e.registration.authenticators.some(e=>e.profileId===t.walletId&&e.credentialId===t.target.credentialIdB64u&&x(e.credentialPublicKey)===t.authMethod.credentialPublicKeyB64u))throw Error(`recovery passkey publication does not match the committed projection`);return}if(n.kind!==`email_otp`)throw Error(`recovery Email OTP publication method branch is invalid`);if(n.emailHashHex!==t.target.emailHashHex||n.registrationAuthorityId!==t.target.registrationAuthorityId||e.registration.authenticators.length!==0||r.some(e=>e.passkeyCredential!==void 0))throw Error(`recovery Email OTP publication does not match the committed projection`);let a=ie(n.authority);if(!a||a.walletId!==t.walletId||a.factor.provider!==`google`||a.factor.providerUserId!==t.target.providerSubject||a.verifier.emailHashHex!==t.target.emailHashHex)throw Error(`recovery Email OTP factor does not match the committed projection`)}function Ks(e){switch(e.operation){case`near_provisioning`:return!0;case`registration_activate`:return e.signerPlanKind!==`near_ed25519`}}function qs(e){if(e.incoming.walletId!==e.existing.walletId||e.incoming.authorityId!==e.existing.authorityId||e.incoming.authMethodId!==e.existing.authMethodId||e.incoming.authorizationId!==e.existing.authorizationId||e.incoming.quotaId!==e.existing.quotaId||e.incoming.issuedAtMs!==e.existing.issuedAtMs||e.incoming.expiresAtMs!==e.existing.expiresAtMs||e.incoming.expiresAtMs<=Date.now()||e.incoming.authorityRevocationEpoch!==e.existing.authorityRevocationEpoch||!de(e.existing,e.incoming))throw Error(`Credential-free registration projection changed immutable session identity`)}const Js=`lastProfileState`,Ys=[E.appState,E.wallets,E.walletAuthMethods,E.walletSigners,E.nearAccountProjections,E.signerOpsOutbox,E.keyMaterial],Xs=[E.appState,E.wallets,E.walletAuthMethods,E.walletAuthorities,E.walletSelections,E.walletSigners,E.nearAccountProjections,E.signerOpsOutbox,E.keyMaterial,E.walletSessionAuthorizations,E.ecdsaCapabilityManifests,E.ecdsaCurrentCapabilityManifests,E.ecdsaRoleLocalMaterial,E.ecdsaMaterialSealingKeys],Zs=[E.appState,E.wallets,E.walletAuthMethods,E.walletAuthorities,E.walletSelections,E.walletSigners,E.nearAccountProjections,E.signerOpsOutbox,E.keyMaterial,E.ecdsaCapabilityManifests,E.ecdsaCurrentCapabilityManifests,E.ecdsaRoleLocalMaterial,E.ecdsaMaterialSealingKeys,E.ecdsaClientPresignatures],Qs=`local`;function $s(e){let t=i(e);if(!t.ok)throw Error(t.error.message);return t.value}var ec=class extends Error{constructor(e,t,n){super(t),this.name=`SeamsWalletDBConstraintError`,this.code=e,this.details=n}};function tc(e){return new Promise(t=>setTimeout(t,e))}function nc(e){let t=new Uint8Array(16);return crypto.getRandomValues(t),`${e}-${Array.from(t,e=>e.toString(16).padStart(2,`0`)).join(``)}`}function rc(e){return e.family===`near`?e.walletId:e.accountId}function ic(e){return e.family===`near`?e.nearAccountId:``}function ac(e){let n=t(e.leaseId||``),r=t(e.laneKey||``),i=t(rc(e)||``),a=t(ic(e)||``);if(!n||!r||!i)throw Error(`[SeamsWalletDB] nonce lease requires leaseId, laneKey, and wallet identity`);return{lease_id:n,lane_key:r,wallet_id:i,...a?{near_account_id:a}:{},state:e.state,expires_at_ms:Math.floor(Number(e.expiresAtMs)),record:e}}function K(e){return typeof e==`string`&&e.length>0&&e.trim()===e?e:null}function oc(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=K(Reflect.get(e,`lock_key`)),n=K(Reflect.get(e,`owner_id`)),r=K(Reflect.get(e,`fencing_token`)),i=Reflect.get(e,`acquired_at_ms`),a=Reflect.get(e,`expires_at_ms`),o=Reflect.get(e,`updated_at_ms`);return!t||!n||!r||!Number.isSafeInteger(i)||i<0||!Number.isSafeInteger(a)||a<0||!Number.isSafeInteger(o)||o<0?null:{lock_key:t,owner_id:n,fencing_token:r,acquired_at_ms:i,expires_at_ms:a,updated_at_ms:o}}function sc(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;try{return Xe({kind:Reflect.get(e,`kind`),namespace:Reflect.get(e,`namespace`),chainId:Reflect.get(e,`chainId`),networkSlug:Reflect.get(e,`networkSlug`)})}catch{return null}}function cc(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=Reflect.get(e,`v`),n=K(Reflect.get(e,`leaseId`)),r=K(Reflect.get(e,`laneKey`)),i=K(Reflect.get(e,`networkKey`)),a=K(Reflect.get(e,`nonce`)),o=K(Reflect.get(e,`operationId`)),s=K(Reflect.get(e,`operationFingerprint`)),c=Reflect.get(e,`reservedAtMs`),l=Reflect.get(e,`expiresAtMs`),u=Reflect.get(e,`updatedAtMs`),d=Reflect.get(e,`state`);if(t!==1||!n||!r||!i||!a||!o||!s||!Number.isSafeInteger(c)||!Number.isSafeInteger(l)||!Number.isSafeInteger(u)||d!==`reserved`&&d!==`signed`&&d!==`broadcast_accepted`)return null;let f=Reflect.get(e,`txHash`);if(d===`broadcast_accepted`&&!K(f)||d!==`broadcast_accepted`&&f!==void 0)return null;let p=Reflect.get(e,`runtimeId`),m=Reflect.get(e,`fencingToken`),h=Reflect.get(e,`batchId`),g=Reflect.get(e,`txIndex`);if(p!==void 0&&!K(p)||m!==void 0&&!K(m)||h!==void 0&&!K(h)||g!==void 0&&!Number.isSafeInteger(g))return null;let _=Reflect.get(e,`family`);if(_===`near`){let t=K(Reflect.get(e,`walletId`)),_=K(Reflect.get(e,`nearAccountId`)),v=K(Reflect.get(e,`publicKey`));return!t||!_||!v?null:{v:1,leaseId:n,laneKey:r,networkKey:i,nonce:a,operationId:o,operationFingerprint:s,reservedAtMs:c,expiresAtMs:l,updatedAtMs:u,family:`near`,walletId:t,nearAccountId:_,publicKey:v,state:d,...p===void 0?{}:{runtimeId:p},...m===void 0?{}:{fencingToken:m},...h===void 0?{}:{batchId:h},...g===void 0?{}:{txIndex:g},...d===`broadcast_accepted`?{txHash:f}:{}}}if(_!==`evm`)return null;let v=sc(Reflect.get(e,`chainTarget`)),y=K(Reflect.get(e,`sender`)),b=K(Reflect.get(e,`accountId`));if(!v||!y||!b)return null;let x=Reflect.get(e,`nonceKey`);return x!==void 0&&!K(x)?null:{v:1,leaseId:n,laneKey:r,networkKey:i,nonce:a,operationId:o,operationFingerprint:s,reservedAtMs:c,expiresAtMs:l,updatedAtMs:u,family:`evm`,chainTarget:v,sender:y,accountId:b,state:d,...p===void 0?{}:{runtimeId:p},...m===void 0?{}:{fencingToken:m},...h===void 0?{}:{batchId:h},...g===void 0?{}:{txIndex:g},...x===void 0?{}:{nonceKey:x},...d===`broadcast_accepted`?{txHash:f}:{}}}function lc(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=cc(Reflect.get(e,`record`));return!t||Reflect.get(e,`lease_id`)!==t.leaseId||Reflect.get(e,`lane_key`)!==t.laneKey||Reflect.get(e,`wallet_id`)!==rc(t)||(Reflect.get(e,`near_account_id`)||``)!==ic(t)||Reflect.get(e,`state`)!==t.state||Reflect.get(e,`expires_at_ms`)!==Math.floor(Number(t.expiresAtMs))?null:t}function uc(e){return IDBKeyRange.upperBound(e)}async function dc(e){let t=await e.store.index(e.indexName).openCursor(e.key);for(;t;)await t.delete(),t=await t.continue()}function fc(e){let t=at(e);return t?`${Js}::${t}`:Js}function pc(e){return`${e.chainIdKey}\0${e.accountAddress}`}function mc(e){return[e.chainIdKey,e.accountAddress,e.signerId].join(`\0`)}function hc(e){return[e.chainIdKey,e.accountAddress].join(`\0`)}function gc(e){if(typeof e!=`object`||!e||Array.isArray(e))return``;let n=t(Reflect.get(e,`kind`)||``),r=Number(Reflect.get(e,`chainId`));return!Number.isSafeInteger(r)||r<=0?``:n===`evm`?t(Reflect.get(e,`namespace`)||``)===`eip155`?it({kind:`evm`,namespace:`eip155`,chainId:r,networkSlug:t(Reflect.get(e,`networkSlug`)||``)}):``:n===`tempo`?it({kind:`tempo`,chainId:r,networkSlug:t(Reflect.get(e,`networkSlug`)||``)}):``}function _c(e){if(e.signerKind===Qe.thresholdEcdsa){let n=e.metadata||{},r=t(n.keyHandle||``),i=t(n.ecdsaThresholdKeyId||``),a=k(n.thresholdOwnerAddress||``),o=gc(n.chainTarget);if(!r||!i||!a||!o)throw Error(`[SeamsWalletDB] threshold ECDSA signer requires keyHandle, ecdsaThresholdKeyId, thresholdOwnerAddress, and chainTarget`);return{chainTargetKey:o,keyHandle:r,ecdsaThresholdKeyId:i,thresholdOwnerAddress:a}}let n=Number(e.signerSlot);if(!Number.isSafeInteger(n)||n<1)throw Error(`[SeamsWalletDB] Ed25519 signer requires a positive signerSlot`);let r=t(e.metadata?.nearEd25519SigningKeyId||``);if(!r)throw Error(`[SeamsWalletDB] Ed25519 signer requires nearEd25519SigningKeyId`);return{chainTargetKey:hc({chainIdKey:e.chainIdKey,accountAddress:e.accountAddress}),nearSignerSlot:n,nearEd25519SigningKeyId:r}}function vc(e){return e.accountModel===`near-native`||e.chainIdKey.startsWith(`near:`)}function q(e,t,n){return new ec(e,t,n)}function yc(e,n){let r=t(e.profileId||``);if(!r)throw Error(`[SeamsWalletDB] profileId is required`);let i=Date.now(),a=e.passkeyCredential?.rawId?e.passkeyCredential:n?.passkeyCredential,o=n?.nearProvisioning?.status===`near_ready`&&e.nearProvisioning?.status!==`near_ready`?n.nearProvisioning:e.nearProvisioning??n?.nearProvisioning,s={profileId:r,defaultSignerSlot:e.defaultSignerSlot??n?.defaultSignerSlot??1,...a?{passkeyCredential:a}:{},preferences:e.preferences??n?.preferences,...o?{nearProvisioning:o}:{},createdAt:n?.createdAt??i,updatedAt:i};return{wallet_id:r,rp_id:Qs,status:`active`,created_at:s.createdAt,updated_at:s.updatedAt,record:s}}function bc(e){return{wallet_id:e.profileId,rp_id:Qs,status:`active`,created_at:e.createdAt,updated_at:e.updatedAt,record:e}}function xc(e,t){return e===void 0||t===void 0?e===t:e.id===t.id&&e.rawId===t.rawId}function Sc(e,t){return e===void 0||t===void 0?e===t:e.useRelayer===t.useRelayer&&e.useNetwork===t.useNetwork&&e.confirmationConfig.uiMode===t.confirmationConfig.uiMode&&e.confirmationConfig.behavior===t.confirmationConfig.behavior&&e.confirmationConfig.autoProceedDelay===t.confirmationConfig.autoProceedDelay}function Cc(e,t){if(e===void 0||t===void 0)return e===t;if(e.status!==t.status||e.updatedAtMs!==t.updatedAtMs)return!1;switch(e.status){case`near_pending`:case`near_provisioning`:return!0;case`near_ready`:return t.status===`near_ready`&&e.nearAccountId===t.nearAccountId;case`near_failed_retryable`:return t.status===`near_failed_retryable`&&e.error===t.error&&e.errorCode===t.errorCode;default:return G(e)}}function wc(e,t){return e.profileId===t.profileId&&e.defaultSignerSlot===t.defaultSignerSlot&&xc(e.passkeyCredential,t.passkeyCredential)&&Sc(e.preferences,t.preferences)&&Cc(e.nearProvisioning,t.nearProvisioning)&&e.createdAt===t.createdAt&&e.updatedAt===t.updatedAt}function Tc(e,t){return e.wallet_id===t.wallet_id&&e.rp_id===t.rp_id&&e.status===t.status&&e.created_at===t.created_at&&e.updated_at===t.updated_at&&wc(e.record,t.record)}function Ec(e,t){return e===void 0||t===void 0?e===t:e.length===t.length?e.every((e,n)=>e===t[n]):!1}function Dc(e,t){return e.profileId===t.profileId&&e.signerSlot===t.signerSlot&&e.credentialId===t.credentialId&&Il(e.credentialPublicKey,t.credentialPublicKey)&&Ec(e.transports,t.transports)&&e.name===t.name&&e.registered===t.registered&&e.syncedAt===t.syncedAt}function Oc(e,t){if(e.version!==t.version||e.kind!==t.kind||e.status!==t.status||e.localStatus!==t.localStatus||e.walletId!==t.walletId||e.createdAtMs!==t.createdAtMs||e.updatedAtMs!==t.updatedAtMs)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId&&e.credentialIdB64u===t.credentialIdB64u&&e.credentialPublicKeyB64u===t.credentialPublicKeyB64u&&e.counter===t.counter;case`email_otp`:return t.kind===`email_otp`&&e.emailHashHex===t.emailHashHex&&e.registrationAuthorityId===t.registrationAuthorityId&&Ne(e.authority,t.authority);default:return G(e)}}function kc(e,t){if(e.wallet_auth_method_id!==t.wallet_auth_method_id||e.wallet_id!==t.wallet_id||e.kind!==t.kind||e.auth_method!==t.auth_method||e.rp_id!==t.rp_id||e.auth_identifier_key!==t.auth_identifier_key||e.status!==t.status||e.updated_at!==t.updated_at||!Oc(e.record,t.record))return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.credential_id_b64u===t.credential_id_b64u&&e.credential_public_key_b64u===t.credential_public_key_b64u&&e.signer_slot===t.signer_slot&&Dc(e.authenticator,t.authenticator);case`email_otp`:return t.kind===`email_otp`&&e.email_hash_hex===t.email_hash_hex&&e.challenge_id===t.challenge_id;default:return G(e)}}function Ac(e){return e===void 0?{kind:`account_signer_rollback_metadata_absent_v1`}:{kind:`account_signer_rollback_metadata_json_v1`,json:JSON.stringify(e)}}function jc(e,t){switch(t.kind){case`account_signer_rollback_metadata_absent_v1`:return e===void 0;case`account_signer_rollback_metadata_json_v1`:return e!==void 0&&JSON.stringify(e)===t.json;default:return G(t)}}function Mc(e){return e===void 0?{kind:`key_material_rollback_payload_absent_v1`}:{kind:`key_material_rollback_payload_json_v1`,json:JSON.stringify(e)}}function Nc(e,t){switch(t.kind){case`key_material_rollback_payload_absent_v1`:return e===void 0;case`key_material_rollback_payload_json_v1`:return e!==void 0&&JSON.stringify(e)===t.json;default:return G(t)}}function Pc(e,t,n){return e.profileId===t.profileId&&e.chainIdKey===t.chainIdKey&&e.accountAddress===t.accountAddress&&e.signerId===t.signerId&&e.signerSlot===t.signerSlot&&e.signerType===t.signerType&&e.signerKind===t.signerKind&&e.signerAuthMethod===t.signerAuthMethod&&e.signerSource===t.signerSource&&e.status===t.status&&e.addedAt===t.addedAt&&e.updatedAt===t.updatedAt&&e.removedAt===t.removedAt&&e.revocationReason===t.revocationReason&&jc(e.metadata,n)}function Fc(e,t,n){return e.profileId===t.profileId&&e.signerSlot===t.signerSlot&&e.chainIdKey===t.chainIdKey&&e.accountAddress===t.accountAddress&&e.keyKind===t.keyKind&&e.algorithm===t.algorithm&&e.publicKey===t.publicKey&&e.signerId===t.signerId&&e.wrapKeySalt===t.wrapKeySalt&&Nc(e.payload,n)&&Ic(e.payloadEnvelope,t.payloadEnvelope)&&e.timestamp===t.timestamp&&e.schemaVersion===t.schemaVersion}function Ic(e,t){return e===void 0||t===void 0?e===t:e.encVersion===t.encVersion&&e.alg===t.alg&&e.nonce===t.nonce&&e.ciphertext===t.ciphertext&&e.tag===t.tag&&e.aad.profileId===t.aad.profileId&&e.aad.signerSlot===t.aad.signerSlot&&e.aad.chainIdKey===t.aad.chainIdKey&&e.aad.accountAddress===t.aad.accountAddress&&e.aad.keyKind===t.aad.keyKind&&e.aad.schemaVersion===t.aad.schemaVersion&&e.aad.signerId===t.aad.signerId}function Lc(e,t){return e.profileId===t.profileId&&e.activeSignerSlot===t.activeSignerSlot&&e.scope===t.scope}function Rc(e){if(e===void 0)return;if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=Reflect.get(e,`useRelayer`),n=Reflect.get(e,`useNetwork`),r=Reflect.get(e,`confirmationConfig`);if(typeof t!=`boolean`||n!==`testnet`&&n!==`mainnet`||typeof r!=`object`||!r||Array.isArray(r))return null;let i=Reflect.get(r,`uiMode`),a=Reflect.get(r,`behavior`),o=Reflect.get(r,`autoProceedDelay`),s=o===void 0?void 0:typeof o==`number`&&Number.isSafeInteger(o)&&o>=0?o:null;return i!==`none`&&i!==`modal`&&i!==`drawer`||a!==`requireClick`&&a!==`skipClick`||s===null?null:{useRelayer:t,useNetwork:n,confirmationConfig:{uiMode:i,behavior:a,...s===void 0?{}:{autoProceedDelay:s}}}}function zc(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=Reflect.get(e,`profileId`),n=a(t),r=Reflect.get(e,`defaultSignerSlot`),i=Reflect.get(e,`createdAt`),o=Reflect.get(e,`updatedAt`);if(!n.ok||n.value!==t||!Number.isSafeInteger(r)||Number(r)<1||!Number.isSafeInteger(i)||Number(i)<0||!Number.isSafeInteger(o)||Number(o)<0)return null;let s=Reflect.get(e,`passkeyCredential`),c;if(s!==void 0){if(typeof s!=`object`||!s||Array.isArray(s))return null;let e=Reflect.get(s,`id`),t=Reflect.get(s,`rawId`);if(typeof e!=`string`||typeof t!=`string`||!e||!t||e.trim()!==e||t.trim()!==t)return null;c={id:e,rawId:t}}let l=Rc(Reflect.get(e,`preferences`));if(l===null)return null;let u=Reflect.get(e,`nearProvisioning`),d;if(u!==void 0){let e=qt(u);if(e===null)return null;d=e}return{profileId:n.value,defaultSignerSlot:Number(r),...c===void 0?{}:{passkeyCredential:c},...l===void 0?{}:{preferences:l},...d===void 0?{}:{nearProvisioning:d},createdAt:Number(i),updatedAt:Number(o)}}function J(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=zc(Reflect.get(e,`record`));return!t||Reflect.get(e,`wallet_id`)!==t.profileId||Reflect.get(e,`created_at`)!==t.createdAt||Reflect.get(e,`updated_at`)!==t.updatedAt?null:t}function Bc(e){if(typeof e!=`object`||!e||Array.isArray(e)||Reflect.get(e,`kind`)!==`local_authority_pending_profile_projection_v1`)return null;let t=Vc(Reflect.get(e,`profile`)),n=Reflect.get(e,`authenticator`),r=Reflect.get(e,`localAuthMethod`),i=n===null?null:al(n),a=r===null?null:al(r);if(!t||n!==null&&(!i||i.kind!==`passkey`||i.status!==`active`)||r!==null&&(!a||a.kind!==`email_otp`||a.status!==`active`))return null;let o=Reflect.get(e,`authorityId`),s=Reflect.get(e,`walletId`),c=Reflect.get(e,`authMethodId`);return typeof o!=`string`||typeof s!=`string`||typeof c!=`string`||!o||!s||!c||o.trim()!==o||s.trim()!==s||c.trim()!==c||t.wallet_id!==s||i!==null&&i.wallet_id!==s||a!==null&&a.wallet_id!==s?null:{kind:`local_authority_pending_profile_projection_v1`,authorityId:o,walletId:s,authMethodId:c,profile:t,authenticator:i?.kind===`passkey`?i:null,localAuthMethod:a?.kind===`email_otp`?a:null}}function Vc(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=Reflect.get(e,`status`),n=Reflect.get(e,`rp_id`);if(t!==`active`||typeof n!=`string`)return null;let r=J(e);return!r||Reflect.get(e,`wallet_id`)!==r.profileId?null:{wallet_id:r.profileId,rp_id:n,status:`active`,created_at:r.createdAt,updated_at:r.updatedAt,record:r}}function Hc(e){switch(e.kind){case`passkey`:return t(e.credentialIdB64u||``);case`email_otp`:return t(e.emailHashHex||``);default:{let t=e;throw Error(`[SeamsWalletDB] Unsupported auth-method binding: ${String(t)}`)}}}function Uc(e){return e.kind===`passkey`?[t(e.walletId||``),e.kind,t(e.rpId||``),Hc(e)].join(`\0`):[t(e.walletId||``),e.kind,Hc(e)].join(`\0`)}function Wc(e){if(e.version!==`wallet_auth_method_v1`)throw Error(`[SeamsWalletDB] auth-method binding version is invalid`);let n=t(e.walletId||``),r=e.kind===`passkey`?t(e.rpId||``):``,i=Hc(e),a=Math.floor(Number(e.createdAtMs)),o=Math.floor(Number(e.updatedAtMs));if(!n||!i||e.kind===`passkey`&&!r)throw Error(`[SeamsWalletDB] auth-method binding requires walletId and branch identity`);if(e.status!==`active`&&e.status!==`revoked`)throw Error(`[SeamsWalletDB] auth-method binding status is invalid`);if(e.localStatus!==`synced`&&e.localStatus!==`pending`)throw Error(`[SeamsWalletDB] auth-method binding localStatus is invalid`);if(!Number.isSafeInteger(a))throw Error(`[SeamsWalletDB] auth-method binding createdAtMs is invalid`);if(!Number.isSafeInteger(o))throw Error(`[SeamsWalletDB] auth-method binding updatedAtMs is invalid`);if(e.kind===`passkey`){if(e.emailHashHex!=null)throw Error(`[SeamsWalletDB] passkey auth-method binding has Email OTP fields`);if(!t(e.credentialPublicKeyB64u||``))throw Error(`[SeamsWalletDB] passkey auth-method binding requires credential public key`);if(!Number.isSafeInteger(e.counter)||e.counter<0)throw Error(`[SeamsWalletDB] passkey auth-method binding counter is invalid`)}if(e.kind===`email_otp`){if(e.credentialIdB64u!=null||e.credentialPublicKeyB64u!=null||e.counter!=null||e.rpId!=null)throw Error(`[SeamsWalletDB] Email OTP auth-method binding has passkey fields`);if(!t(e.registrationAuthorityId||``))throw Error(`[SeamsWalletDB] Email OTP auth-method binding requires registrationAuthorityId`);if(!e.authority)throw Error(`[SeamsWalletDB] Email OTP auth-method binding requires authority`);let n=ie(e.authority);if(!n||n.walletId!==e.walletId||n.verifier.emailHashHex!==e.emailHashHex||!Ne(n,e.authority))throw Error(`[SeamsWalletDB] Email OTP auth-method authority binding is invalid`)}return{wallet_auth_method_id:Uc(e),wallet_id:n,kind:e.kind,auth_method:e.kind,rp_id:r,auth_identifier_key:i,status:e.status,updated_at:o,record:e}}function Gc(e){return new Date(e).toISOString()}function Kc(e,t){let n=Date.parse(e);return Number.isSafeInteger(n)?n:t}function qc(e){let n=t(e.profileId||``),r=t(e.credentialId||``),i=Number(e.signerSlot);if(!n||!r)throw Error(`[SeamsWalletDB] profileId and credentialId are required for authenticators`);if(!Number.isSafeInteger(i)||i<1)throw Error(`[SeamsWalletDB] authenticator signerSlot must be an integer >= 1`);let a=e.credentialPublicKey;if(!(a instanceof Uint8Array)||a.byteLength===0)throw Error(`[SeamsWalletDB] authenticator credentialPublicKey must be a non-empty Uint8Array`);return{profileId:n,signerSlot:i,credentialId:r,credentialPublicKey:a,...Array.isArray(e.transports)?{transports:e.transports}:{},...e.name?{name:String(e.name)}:{},registered:t(e.registered||``),syncedAt:t(e.syncedAt||``)}}function Jc(e,t){let n=Number(t);if(!Number.isSafeInteger(n)||n<1)throw Error(`[SeamsWalletDB] passkey auth-method signerSlot must be an integer >= 1`);return qc({profileId:e.walletId,signerSlot:n,credentialId:e.credentialIdB64u,credentialPublicKey:S(e.credentialPublicKeyB64u),registered:Gc(e.createdAtMs),syncedAt:Gc(e.updatedAtMs)})}function Yc(e,t){let n=qc(e),r=x(n.credentialPublicKey);if(t){if(t.walletId!==n.profileId)throw Error(`[SeamsWalletDB] passkey auth-method walletId does not match authenticator profileId`);if(t.credentialIdB64u!==n.credentialId)throw Error(`[SeamsWalletDB] passkey auth-method credentialId does not match authenticator credentialId`);if(t.credentialPublicKeyB64u!==r)throw Error(`[SeamsWalletDB] passkey auth-method public key does not match authenticator public key`);return t}let i=Date.now();return{version:`wallet_auth_method_v1`,kind:`passkey`,status:`active`,localStatus:`synced`,walletId:zt(n.profileId),rpId:$s(Qs),credentialIdB64u:n.credentialId,credentialPublicKeyB64u:r,counter:0,createdAtMs:Kc(n.registered,i),updatedAtMs:Kc(n.syncedAt,i)}}function Xc(e){let t=Wc(e.binding),n=qc(e.authenticator),r=x(n.credentialPublicKey);if(t.kind!==`passkey`)throw Error(`[SeamsWalletDB] passkey auth-method row requires a passkey binding`);if(n.profileId!==t.wallet_id)throw Error(`[SeamsWalletDB] passkey auth-method authenticator profileId mismatch`);if(n.credentialId!==e.binding.credentialIdB64u)throw Error(`[SeamsWalletDB] passkey auth-method authenticator credentialId mismatch`);if(r!==e.binding.credentialPublicKeyB64u)throw Error(`[SeamsWalletDB] passkey auth-method authenticator public key mismatch`);return{...t,kind:`passkey`,auth_method:`passkey`,record:e.binding,credential_id_b64u:e.binding.credentialIdB64u,credential_public_key_b64u:e.binding.credentialPublicKeyB64u,signer_slot:n.signerSlot,authenticator:n}}function Zc(e){let t=Wc(e);if(t.kind!==`email_otp`)throw Error(`[SeamsWalletDB] Email OTP auth-method row requires an Email OTP binding`);return{...t,kind:`email_otp`,auth_method:`email_otp`,record:e,email_hash_hex:e.emailHashHex,challenge_id:e.registrationAuthorityId}}function Qc(e,t){switch(e.kind){case`passkey`:return Xc({binding:e,authenticator:Jc(e,t)});case`email_otp`:return Zc(e);default:{let t=e;throw Error(`[SeamsWalletDB] Unsupported auth-method row: ${String(t)}`)}}}function $c(e,t){let n=qc(e);return Xc({binding:Yc(n,t?.record),authenticator:n})}function el(e){if(e.profile.wallet_id!==e.walletId||e.authenticator!==null&&e.authenticator.wallet_id!==e.walletId||e.localAuthMethod!==null&&e.localAuthMethod.wallet_id!==e.walletId)throw Error(`local authority profile projection identity does not match installation`);if(e.authenticator?.wallet_auth_method_id===e.authMethodId||e.localAuthMethod?.wallet_auth_method_id===e.authMethodId)throw Error(`local authority profile projection collides with the V2 auth-method key`);return{kind:`local_authority_pending_profile_projection_v1`,authorityId:e.authorityId,walletId:e.walletId,authMethodId:e.authMethodId,profile:e.profile,authenticator:e.authenticator,localAuthMethod:e.localAuthMethod}}function tl(e,t){return e.authorityId===t.authorityId&&e.walletId===t.walletId&&e.authMethodId===t.authMethodId&&Tc(e.profile,t.profile)&&(e.authenticator===null?t.authenticator===null:t.authenticator!==null&&kc(e.authenticator,t.authenticator))&&(e.localAuthMethod===null?t.localAuthMethod===null:t.localAuthMethod!==null&&kc(e.localAuthMethod,t.localAuthMethod))}function nl(e,t){return e.authorityId===t.authority.authorityId&&e.walletId===t.authority.walletId&&e.authMethodId===t.authMethod.walletAuthMethodId&&e.profile.record.profileId===t.profile.profileId&&e.profile.record.defaultSignerSlot===(t.profile.defaultSignerSlot??1)&&(t.profile.passkeyCredential===void 0||e.profile.record.passkeyCredential?.id===t.profile.passkeyCredential.id&&e.profile.record.passkeyCredential.rawId===t.profile.passkeyCredential.rawId)&&(t.profile.preferences===void 0||Sc(e.profile.record.preferences,t.profile.preferences))&&(t.authenticator===null?e.authenticator===null:e.authenticator!==null&&Dc(e.authenticator.authenticator,t.authenticator))&&(t.localAuthMethod===null?e.localAuthMethod===null:e.localAuthMethod!==null&&Oc(e.localAuthMethod.record,t.localAuthMethod))}function rl(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=K(Reflect.get(e,`profileId`)),n=Reflect.get(e,`signerSlot`),r=K(Reflect.get(e,`credentialId`)),i=Reflect.get(e,`credentialPublicKey`),a=K(Reflect.get(e,`registered`)),o=K(Reflect.get(e,`syncedAt`));if(!t||!Number.isSafeInteger(n)||n<1||!r||!(i instanceof Uint8Array)||i.byteLength===0||!a||!o)return null;let s=Reflect.get(e,`transports`),c=Reflect.get(e,`name`);return s!==void 0&&(!Array.isArray(s)||s.some(e=>typeof e!=`string`))||c!==void 0&&typeof c!=`string`?null:{profileId:t,signerSlot:Number(n),credentialId:r,credentialPublicKey:new Uint8Array(i),...s===void 0?{}:{transports:[...s]},...c===void 0?{}:{name:c},registered:a,syncedAt:o}}function il(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=Reflect.get(e,`version`),n=Reflect.get(e,`kind`),r=Reflect.get(e,`status`),o=Reflect.get(e,`localStatus`),s=Reflect.get(e,`walletId`),c=a(s),l=Reflect.get(e,`createdAtMs`),u=Reflect.get(e,`updatedAtMs`);if(t!==`wallet_auth_method_v1`||n!==`passkey`&&n!==`email_otp`||r!==`active`&&r!==`revoked`||o!==`synced`&&o!==`pending`||!c.ok||c.value!==s||!Number.isSafeInteger(l)||Number(l)<0||!Number.isSafeInteger(u)||Number(u)<0)return null;if(n===`passkey`){let t=Reflect.get(e,`rpId`),n=i(t),a=Reflect.get(e,`credentialIdB64u`),s=d(a),f=Reflect.get(e,`credentialPublicKeyB64u`),p=Reflect.get(e,`counter`);return!n.ok||n.value!==t||!s.ok||s.value!==a||typeof f!=`string`||!f||!Number.isSafeInteger(p)||Number(p)<0?null:{version:`wallet_auth_method_v1`,kind:`passkey`,status:r,localStatus:o,walletId:c.value,rpId:n.value,credentialIdB64u:s.value,credentialPublicKeyB64u:f,counter:Number(p),createdAtMs:Number(l),updatedAtMs:Number(u)}}let f=K(Reflect.get(e,`emailHashHex`)),p=K(Reflect.get(e,`registrationAuthorityId`)),m=ie(Reflect.get(e,`authority`));return!f||!p||!m||m.walletId!==c.value||m.verifier.emailHashHex!==f?null:{version:`wallet_auth_method_v1`,kind:`email_otp`,status:r,localStatus:o,walletId:c.value,emailHashHex:f,registrationAuthorityId:p,authority:m,createdAtMs:Number(l),updatedAtMs:Number(u)}}function al(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=il(Reflect.get(e,`record`));if(!t)return null;let n;try{if(t.kind===`passkey`){let r=rl(Reflect.get(e,`authenticator`));if(!r)return null;n=Xc({binding:t,authenticator:r})}else if(t.kind===`email_otp`)n=Zc(t);else return null}catch{return null}if(Reflect.get(e,`wallet_auth_method_id`)!==n.wallet_auth_method_id||Reflect.get(e,`wallet_id`)!==n.wallet_id||Reflect.get(e,`kind`)!==n.kind||Reflect.get(e,`auth_method`)!==n.auth_method||n.kind===`passkey`&&Reflect.get(e,`rp_id`)!==n.rp_id||Reflect.get(e,`auth_identifier_key`)!==n.auth_identifier_key||Reflect.get(e,`status`)!==n.status||Reflect.get(e,`updated_at`)!==n.updated_at)return null;if(n.kind===`passkey`){if(Reflect.get(e,`credential_id_b64u`)!==n.credential_id_b64u||Reflect.get(e,`credential_public_key_b64u`)!==n.credential_public_key_b64u||Reflect.get(e,`signer_slot`)!==n.signer_slot)return null}else if(Reflect.get(e,`email_hash_hex`)!==n.email_hash_hex||Reflect.get(e,`challenge_id`)!==n.challenge_id)return null;return n}function ol(e){let t=al(e);return t?t.record:null}function sl(e){let t=al(e);return!t||t.kind!==`passkey`||t.status!==`active`?null:t.authenticator}function cl(e,t){if(Object.keys(e).length!==t.length)return!1;for(let n of t)if(!Object.prototype.hasOwnProperty.call(e,n))return!1;return!0}function Y(e,t){if(!e.ok)throw Error(`${t}: ${e.error.message}`);return e.value}function ll(e,t){if(typeof e!=`string`||e.length===0||e.trim()!==e)throw Error(`${t} must be a non-empty canonical string`);return e}function ul(e,t){if(!Number.isSafeInteger(e)||Number(e)<0)throw Error(`${t} must be a non-negative safe integer`);return Number(e)}function dl(e){return e!==void 0}function fl(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=It(Reflect.get(e,`record`));if(!t.ok)return null;let n=t.value;return Reflect.get(e,`authority_id`)!==n.authorityId||Reflect.get(e,`wallet_id`)!==n.walletId||Reflect.get(e,`state`)!==n.state||Reflect.get(e,`device_id`)!==n.principal.deviceId||Reflect.get(e,`updated_at`)!==n.updatedAtMs?null:{authority_id:n.authorityId,wallet_id:n.walletId,state:n.state,device_id:n.principal.deviceId,updated_at:n.updatedAtMs,record:n}}function pl(e){return{authority_id:e.authorityId,wallet_id:e.walletId,state:e.state,device_id:e.principal.deviceId,updated_at:e.updatedAtMs,record:e}}function ml(e){switch(e.kind){case`passkey`:return{version:`wallet_auth_method_local_presentation_v1`,kind:`passkey`};case`email_otp`:return{version:`wallet_auth_method_local_presentation_v1`,kind:`email_otp`,email:{kind:`unavailable`}};default:throw Error(`Wallet auth-method presentation kind is invalid`)}}function hl(e,t){if(e===void 0)return ml(t);if(typeof e!=`object`||!e||Array.isArray(e)||Reflect.get(e,`version`)!==`wallet_auth_method_local_presentation_v1`||Reflect.get(e,`kind`)!==t.kind)return null;switch(t.kind){case`passkey`:return cl(e,[`version`,`kind`])?{version:`wallet_auth_method_local_presentation_v1`,kind:`passkey`}:null;case`email_otp`:{if(!cl(e,[`version`,`kind`,`email`]))return null;let t=Reflect.get(e,`email`);if(typeof t!=`object`||!t||Array.isArray(t))return null;switch(Reflect.get(t,`kind`)){case`unavailable`:return cl(t,[`kind`])?{version:`wallet_auth_method_local_presentation_v1`,kind:`email_otp`,email:{kind:`unavailable`}}:null;case`verified`:{if(!cl(t,[`kind`,`address`]))return null;let e=_(Reflect.get(t,`address`));return e.ok?{version:`wallet_auth_method_local_presentation_v1`,kind:`email_otp`,email:{kind:`verified`,address:e.value}}:null}default:return null}}default:return null}}function X(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=Lt(Reflect.get(e,`record`));if(!t)return null;let n=hl(Reflect.get(e,`presentation`),t);return!n||Reflect.get(e,`wallet_auth_method_id`)!==t.walletAuthMethodId||Reflect.get(e,`wallet_id`)!==t.walletId||Reflect.get(e,`wallet_authority_id`)!==t.walletAuthorityId||Reflect.get(e,`kind`)!==t.kind||Reflect.get(e,`status`)!==t.status||Reflect.get(e,`updated_at`)!==t.updatedAtMs?null:gl(xl(t,n))}function gl(e){switch(e.kind){case`passkey`:return{wallet_auth_method_id:e.record.walletAuthMethodId,wallet_id:e.record.walletId,wallet_authority_id:e.record.walletAuthorityId,kind:`passkey`,status:e.record.status,updated_at:e.record.updatedAtMs,presentation:e.presentation,record:e.record};case`email_otp`:return{wallet_auth_method_id:e.record.walletAuthMethodId,wallet_id:e.record.walletId,wallet_authority_id:e.record.walletAuthorityId,kind:`email_otp`,status:e.record.status,updated_at:e.record.updatedAtMs,presentation:e.presentation,record:e.record};default:throw Error(`Wallet auth-method projection kind is invalid`)}}function _l(e,t){let n=new Set;for(let r of t){let t=al(r)?.record;if(!t||t.kind!==`email_otp`||t.emailHashHex!==e.emailHashHex||t.authority.bindingId!==e.walletAuthMethodId)continue;let i=_(t.authority.factor.providerUserId);i.ok&&n.add(String(i.value))}if(n.size!==1)return null;let r=_([...n][0]);return r.ok?{version:`wallet_auth_method_local_presentation_v1`,kind:`email_otp`,email:{kind:`verified`,address:r.value}}:null}function vl(e,t,n){switch(e.kind){case`passkey`:return ml(e);case`email_otp`:return _l(e,t)??(n?.kind===`email_otp`&&n.email.kind===`verified`?n:ml(e));default:throw Error(`Wallet auth-method presentation kind is invalid`)}}function yl(e,t){return e.kind===t.kind?e.kind===`passkey`&&t.kind===`passkey`?!0:e.kind!==`email_otp`||t.kind!==`email_otp`||e.email.kind!==t.email.kind?!1:e.email.kind===`unavailable`&&t.email.kind===`unavailable`?!0:e.email.kind===`verified`&&t.email.kind===`verified`&&e.email.address===t.email.address:!1}function bl(e){return typeof e==`object`&&!!e&&!Array.isArray(e)&&Reflect.get(e,`presentation`)!==void 0}function xl(e,t){switch(e.kind){case`passkey`:if(t.kind!==`passkey`)throw Error(`Passkey auth method has non-passkey local presentation`);return{kind:`passkey`,record:e,presentation:t};case`email_otp`:if(t.kind!==`email_otp`)throw Error(`Email OTP auth method has non-email local presentation`);return{kind:`email_otp`,record:e,presentation:t};default:throw Error(`Wallet auth-method projection kind is invalid`)}}async function Sl(e,t){let n=X(await e.get(t.walletAuthMethodId));return gl(xl(t,vl(t,await e.index(D.walletId).getAll(t.walletId),n?.presentation??null)))}function Cl(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`signer material record must be an object`);let t=Reflect.get(e,`kind`),r=Reflect.get(e,`keyFamily`);if(t===`wallet_authority_linked_signer_material_v1`)return Dn(e);if(t!==`wallet_authority_signer_material_v1`)throw Error(`signer material record kind is invalid`);if(r!==`ed25519`&&r!==`ecdsa_secp256k1`)throw Error(`signer material keyFamily is invalid`);let i=[`kind`,`authorityId`,`walletAuthMethodId`,`activationId`,`keyFamily`,`materialActivation`,`sealedMaterialB64u`,`sealedMaterialDigestB64u`];if(!cl(e,r===`ecdsa_secp256k1`?[...i,`ecdsaThresholdKeyId`]:i))throw Error(`signer material record fields are invalid`);let a=Y(n(Reflect.get(e,`authorityId`)),`authorityId`),o=Y(s(Reflect.get(e,`walletAuthMethodId`)),`walletAuthMethodId`),c=Y(l(Reflect.get(e,`materialActivation`)),`materialActivation`),u=ll(Reflect.get(e,`activationId`),`activationId`),d=ll(Reflect.get(e,`sealedMaterialB64u`),`sealedMaterialB64u`),f=T(Reflect.get(e,`sealedMaterialDigestB64u`));if(c.activationId!==u)throw Error(`signer material activationId does not match materialActivation`);return r===`ed25519`?{kind:`wallet_authority_signer_material_v1`,authorityId:a,walletAuthMethodId:o,activationId:c.activationId,keyFamily:`ed25519`,materialActivation:c,sealedMaterialB64u:d,sealedMaterialDigestB64u:f}:{kind:`wallet_authority_signer_material_v1`,authorityId:a,walletAuthMethodId:o,activationId:c.activationId,keyFamily:`ecdsa_secp256k1`,ecdsaThresholdKeyId:Wt(Reflect.get(e,`ecdsaThresholdKeyId`)),materialActivation:c,sealedMaterialB64u:d,sealedMaterialDigestB64u:f}}function wl(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;try{let t=Cl(Reflect.get(e,`record`));return Reflect.get(e,`wallet_authority_id`)!==t.authorityId||Reflect.get(e,`wallet_auth_method_id`)!==t.walletAuthMethodId||Reflect.get(e,`activation_id`)!==t.activationId||Reflect.get(e,`key_family`)!==t.keyFamily||Reflect.get(e,`ecdsa_threshold_key_id`)!==(t.keyFamily===`ecdsa_secp256k1`?t.ecdsaThresholdKeyId:void 0)||Reflect.get(e,`sealed_material_b64u`)!==t.sealedMaterialB64u||Reflect.get(e,`sealed_material_digest_b64u`)!==t.sealedMaterialDigestB64u?null:{wallet_authority_id:t.authorityId,wallet_auth_method_id:t.walletAuthMethodId,activation_id:t.activationId,key_family:t.keyFamily,ecdsa_threshold_key_id:t.keyFamily===`ecdsa_secp256k1`?t.ecdsaThresholdKeyId:void 0,sealed_material_b64u:t.sealedMaterialB64u,sealed_material_digest_b64u:t.sealedMaterialDigestB64u,record:t}}catch{return null}}function Tl(e){return{wallet_authority_id:e.authorityId,wallet_auth_method_id:e.walletAuthMethodId,activation_id:e.activationId,key_family:e.keyFamily,ecdsa_threshold_key_id:e.keyFamily===`ecdsa_secp256k1`?e.ecdsaThresholdKeyId:void 0,sealed_material_b64u:e.sealedMaterialB64u,sealed_material_digest_b64u:e.sealedMaterialDigestB64u,record:e}}function El(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`export root record must be an object`);if(!cl(e,[`kind`,`authorityId`,`walletAuthMethodId`,`walletKeyId`,`envelope`]))throw Error(`export root record fields are invalid`);if(Reflect.get(e,`kind`)!==`wallet_authority_export_root_v1`)throw Error(`export root record kind is invalid`);let t=Y(f(Reflect.get(e,`walletKeyId`)),`walletKeyId`),r=et(Reflect.get(e,`envelope`));if(r.binding.kind!==`ed25519_yao_client_root_v1`||r.binding.walletKeyId!==t)throw Error(`export root envelope does not match walletKeyId`);return{kind:`wallet_authority_export_root_v1`,authorityId:Y(n(Reflect.get(e,`authorityId`)),`authorityId`),walletAuthMethodId:Y(s(Reflect.get(e,`walletAuthMethodId`)),`walletAuthMethodId`),walletKeyId:t,envelope:r}}function Dl(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;try{let t=El(Reflect.get(e,`record`));return Reflect.get(e,`wallet_authority_id`)!==t.authorityId||Reflect.get(e,`wallet_auth_method_id`)!==t.walletAuthMethodId||Reflect.get(e,`wallet_key_id`)!==t.walletKeyId||Reflect.get(e,`sealed_root_b64u`)!==t.envelope.sealedCustodySecretB64u||Reflect.get(e,`sealed_root_digest_b64u`)!==t.envelope.ciphertextDigestB64u?null:{wallet_authority_id:t.authorityId,wallet_auth_method_id:t.walletAuthMethodId,wallet_key_id:t.walletKeyId,sealed_root_b64u:t.envelope.sealedCustodySecretB64u,sealed_root_digest_b64u:t.envelope.ciphertextDigestB64u,record:t}}catch{return null}}function Ol(e){return{wallet_authority_id:e.authorityId,wallet_auth_method_id:e.walletAuthMethodId,wallet_key_id:e.walletKeyId,sealed_root_b64u:e.envelope.sealedCustodySecretB64u,sealed_root_digest_b64u:e.envelope.ciphertextDigestB64u,record:e}}function kl(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;try{let t=vt(Reflect.get(e,`record`));return Reflect.get(e,`authority_id`)!==t.authorityId||Reflect.get(e,`wallet_id`)!==t.walletId||Reflect.get(e,`wallet_auth_method_id`)!==t.authMethodId||Reflect.get(e,`device_id`)!==t.deviceId||Reflect.get(e,`package_set_digest_b64u`)!==t.packageSetDigestB64u||Reflect.get(e,`installed_at_ms`)!==t.installedAtMs?null:{authority_id:t.authorityId,wallet_id:t.walletId,wallet_auth_method_id:t.authMethodId,device_id:t.deviceId,package_set_digest_b64u:t.packageSetDigestB64u,installed_at_ms:t.installedAtMs,record:t}}catch{return null}}function Al(e){return{authority_id:e.authorityId,wallet_id:e.walletId,wallet_auth_method_id:e.authMethodId,device_id:e.deviceId,package_set_digest_b64u:e.packageSetDigestB64u,installed_at_ms:e.installedAtMs,record:e}}function jl(e){if(typeof e!=`object`||!e||Array.isArray(e))throw Error(`wallet selection record must be an object`);if(!cl(e,[`kind`,`walletId`,`walletAuthMethodId`,`lockGeneration`,`lockState`,`updatedAtMs`]))throw Error(`wallet selection record fields are invalid`);if(Reflect.get(e,`kind`)!==`wallet_selection_v1`)throw Error(`wallet selection record kind is invalid`);let t=Reflect.get(e,`lockState`);if(t!==`locked`&&t!==`unlocked`)throw Error(`wallet selection lockState is invalid`);return{kind:`wallet_selection_v1`,walletId:Y(a(Reflect.get(e,`walletId`)),`walletId`),walletAuthMethodId:Y(s(Reflect.get(e,`walletAuthMethodId`)),`walletAuthMethodId`),lockGeneration:ul(Reflect.get(e,`lockGeneration`),`lockGeneration`),lockState:t,updatedAtMs:ul(Reflect.get(e,`updatedAtMs`),`updatedAtMs`)}}function Z(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;try{let t=jl(Reflect.get(e,`record`));return Reflect.get(e,`wallet_id`)!==t.walletId||Reflect.get(e,`wallet_auth_method_id`)!==t.walletAuthMethodId||Reflect.get(e,`lock_generation`)!==t.lockGeneration||Reflect.get(e,`lock_state`)!==t.lockState||Reflect.get(e,`updated_at_ms`)!==t.updatedAtMs?null:{wallet_id:t.walletId,wallet_auth_method_id:t.walletAuthMethodId,lock_generation:t.lockGeneration,lock_state:t.lockState,updated_at_ms:t.updatedAtMs,record:t}}catch{return null}}function Ml(e){return{wallet_id:e.walletId,wallet_auth_method_id:e.walletAuthMethodId,lock_generation:e.lockGeneration,lock_state:e.lockState,updated_at_ms:e.updatedAtMs,record:e}}function Nl(e){if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`&&e.ed25519)return[{keyFamily:`ed25519`,materialActivation:e.ed25519.materialActivation}];if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ecdsa_secp256k1`&&e.ecdsa)return[{keyFamily:`ecdsa_secp256k1`,materialActivation:e.ecdsa.materialActivation}];if(e.keyFamilies.length===2&&e.ed25519&&e.ecdsa)return[{keyFamily:`ed25519`,materialActivation:e.ed25519.materialActivation},{keyFamily:`ecdsa_secp256k1`,materialActivation:e.ecdsa.materialActivation}];throw Error(`wallet signer activation families are invalid`)}function Pl(e){if(e.keyFamilies.length===1&&e.keyFamilies[0]===`ed25519`||e.keyFamilies.length===2)return e.ed25519?e.ed25519.signer.walletKeyId:null;throw Error(`wallet signer activation families are invalid`)}function Fl(e){return e.keyFamilies.length===2||e.keyFamilies[0]===`ed25519`}function Il(e,t){if(e.byteLength!==t.byteLength)return!1;for(let n=0;n<e.byteLength;n+=1)if(e[n]!==t[n])return!1;return!0}function Ll(e,t){if(e.kind!==t.kind||e.walletAuthMethodId!==t.walletAuthMethodId||e.verificationDigestB64u!==t.verificationDigestB64u)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId&&e.credentialIdB64u===t.credentialIdB64u;case`email_otp`:return t.kind===`email_otp`&&e.emailHashHex===t.emailHashHex&&e.registrationAuthorityId===t.registrationAuthorityId;default:return G(e)}}function Rl(e,t){if(t.kind!==e.kind||e.authorityId!==t.authorityId||e.walletAuthMethodId!==t.walletAuthMethodId||e.activationId!==t.activationId||!h(e.materialActivation,t.materialActivation)||e.sealedMaterialB64u!==t.sealedMaterialB64u||e.sealedMaterialDigestB64u!==t.sealedMaterialDigestB64u||e.packageSetDigestB64u!==t.packageSetDigestB64u||!Ll(e.targetFactor,t.targetFactor))return!1;switch(e.keyFamily){case`ed25519`:return t.keyFamily===`ed25519`;case`ecdsa_secp256k1`:return t.keyFamily===`ecdsa_secp256k1`&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId;default:return G(e)}}function zl(e,t){if(e.state!==t.state)return!1;switch(e.state){case`active`:return t.state===`active`&&e.activatedAtMs===t.activatedAtMs;case`retired`:return t.state===`retired`&&e.activatedAtMs===t.activatedAtMs&&e.retiredAtMs===t.retiredAtMs;case`revoked`:return t.state===`revoked`&&e.activatedAtMs===t.activatedAtMs&&e.revokedAtMs===t.revokedAtMs;default:return G(e)}}function Bl(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId&&e.credentialIdB64u===t.credentialIdB64u&&e.kekVersion===t.kekVersion;case`email_otp`:return t.kind===`email_otp`&&e.enrollmentId===t.enrollmentId&&e.enrollmentSealKeyVersion===t.enrollmentSealKeyVersion&&e.kekVersion===t.kekVersion;default:return G(e)}}function Vl(e,t){return e.kind!==t.kind||e.envelopeId!==t.envelopeId||e.walletId!==t.walletId||!nt(e.ownership,t.ownership)||e.envelopeVersion!==t.envelopeVersion||e.envelopeRevision!==t.envelopeRevision||e.nonceB64u!==t.nonceB64u||e.sealedCustodySecretB64u!==t.sealedCustodySecretB64u||e.ciphertextDigestB64u!==t.ciphertextDigestB64u||e.aadHashB64u!==t.aadHashB64u||!zl(e.lifecycle,t.lifecycle)||e.createdAtMs!==t.createdAtMs||e.updatedAtMs!==t.updatedAtMs?!1:e.binding.kind===`ed25519_yao_client_root_v1`&&t.binding.kind===`ed25519_yao_client_root_v1`&&e.binding.linkSessionId===t.binding.linkSessionId&&e.binding.walletKeyId===t.binding.walletKeyId&&e.binding.targetFactor.kind===t.binding.targetFactor.kind&&e.binding.applicationBindingDigestB64u===t.binding.applicationBindingDigestB64u&&e.binding.registeredPublicKeyB64u===t.binding.registeredPublicKeyB64u&&e.binding.enrollmentId===t.binding.enrollmentId&&e.binding.deviceId===t.binding.deviceId&&e.binding.revocationEpoch===t.binding.revocationEpoch&&Bl(e.factor,t.factor)}function Hl(e,t){return Il(Ft(e),Ft(t))}function Ul(e,t){return ee({kind:`delegated_wallet_authority_v1`,permissions:e.permissions},{kind:`delegated_wallet_authority_v1`,permissions:t.permissions})}function Wl(e,t){if(e.kind!==t.kind)return!1;switch(e.kind){case`wallet_registration`:return!0;case`device_link`:return t.kind===`device_link`&&e.enrollmentId===t.enrollmentId&&e.sourceAuthorityId===t.sourceAuthorityId&&e.linkSessionId===t.linkSessionId;case`wallet_recovery`:return t.kind===`wallet_recovery`&&e.recoveryOperationId===t.recoveryOperationId&&e.continuityAuthorityId===t.continuityAuthorityId;default:return G(e)}}function Gl(e,t){if(e.state!==t.state)return!1;switch(e.state){case`pending_local_install`:return t.state===`pending_local_install`&&e.localInstallPackageSetDigestB64u===t.localInstallPackageSetDigestB64u;case`active`:return t.state===`active`&&e.activatedAtMs===t.activatedAtMs;case`revoked`:return t.state===`revoked`&&e.activatedAtMs===t.activatedAtMs&&e.revokedAtMs===t.revokedAtMs}return G(e)}function Kl(e,t){return e.kind===t.kind&&e.authorityId===t.authorityId&&e.walletId===t.walletId&&e.principal.kind===t.principal.kind&&e.principal.deviceId===t.principal.deviceId&&Wl(e.provenance,t.provenance)&&Ul(e,t)&&Gl(e,t)&&e.revocationEpoch===t.revocationEpoch&&e.createdAtMs===t.createdAtMs&&e.updatedAtMs===t.updatedAtMs&&e.signerActivationSetDigestB64u===t.signerActivationSetDigestB64u&&e.authorityDigestB64u===t.authorityDigestB64u&&Hl(e.signerActivations,t.signerActivations)}function ql(e,t){return e.kind===t.kind&&e.authorityId===t.authorityId&&e.walletId===t.walletId&&e.principal.kind===t.principal.kind&&e.principal.deviceId===t.principal.deviceId&&Wl(e.provenance,t.provenance)&&Ul(e,t)&&Hl(e.signerActivations,t.signerActivations)&&e.signerActivationSetDigestB64u===t.signerActivationSetDigestB64u&&e.revocationEpoch===t.revocationEpoch&&e.createdAtMs===t.createdAtMs}function Jl(e,t){if(e.version!==t.version||e.walletAuthMethodId!==t.walletAuthMethodId||e.walletId!==t.walletId||e.walletAuthorityId!==t.walletAuthorityId||e.createdAtMs!==t.createdAtMs||e.updatedAtMs!==t.updatedAtMs||e.kind!==t.kind||e.status!==t.status)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId&&e.credentialIdB64u===t.credentialIdB64u&&e.credentialPublicKeyB64u===t.credentialPublicKeyB64u&&e.counter===t.counter&&(e.status===`pending_local_install`||e.activatedAtMs===t.activatedAtMs)&&(e.status!==`revoked`||e.revokedAtMs===t.revokedAtMs);case`email_otp`:return t.kind===`email_otp`&&e.emailHashHex===t.emailHashHex&&e.registrationAuthorityId===t.registrationAuthorityId&&(e.status===`pending_local_install`||e.activatedAtMs===t.activatedAtMs)&&(e.status!==`revoked`||e.revokedAtMs===t.revokedAtMs)}return G(e)}function Yl(e,t){if(e.version!==t.version||e.walletAuthMethodId!==t.walletAuthMethodId||e.walletId!==t.walletId||e.walletAuthorityId!==t.walletAuthorityId||e.kind!==t.kind||e.createdAtMs!==t.createdAtMs)return!1;switch(e.kind){case`passkey`:return t.kind===`passkey`&&e.rpId===t.rpId&&e.credentialIdB64u===t.credentialIdB64u&&e.credentialPublicKeyB64u===t.credentialPublicKeyB64u&&e.counter===t.counter;case`email_otp`:return t.kind===`email_otp`&&e.emailHashHex===t.emailHashHex&&e.registrationAuthorityId===t.registrationAuthorityId}return G(e)}function Xl(e,t){switch(e.kind){case`wallet_authority_signer_material_v1`:if(t.kind!==e.kind||e.authorityId!==t.authorityId||e.walletAuthMethodId!==t.walletAuthMethodId||e.activationId!==t.activationId||!h(e.materialActivation,t.materialActivation)||e.sealedMaterialB64u!==t.sealedMaterialB64u||e.sealedMaterialDigestB64u!==t.sealedMaterialDigestB64u)return!1;switch(e.keyFamily){case`ed25519`:return t.keyFamily===`ed25519`;case`ecdsa_secp256k1`:return t.keyFamily===`ecdsa_secp256k1`&&e.ecdsaThresholdKeyId===t.ecdsaThresholdKeyId;default:return G(e)}case`wallet_authority_linked_signer_material_v1`:return t.kind===`wallet_authority_linked_signer_material_v1`&&Rl(e,t);default:return G(e)}}function Zl(e,t){return e.kind===t.kind&&e.authorityId===t.authorityId&&e.walletAuthMethodId===t.walletAuthMethodId&&e.walletKeyId===t.walletKeyId&&Vl(e.envelope,t.envelope)}function Ql(e,t){return e.kind===t.kind&&e.authorityId===t.authorityId&&e.walletId===t.walletId&&e.authMethodId===t.authMethodId&&e.deviceId===t.deviceId&&e.packageSetDigestB64u===t.packageSetDigestB64u&&Hl(e.installedActivationRefs,t.installedActivationRefs)&&e.installedRecordSetDigestB64u===t.installedRecordSetDigestB64u&&e.targetFactorVerificationDigestB64u===t.targetFactorVerificationDigestB64u&&e.installedAtMs===t.installedAtMs}function $l(e,t){if(e.kind!==t.kind||e.walletId!==t.walletId||e.authorityId!==t.authorityId||e.authMethodId!==t.authMethodId||e.authorizationId!==t.authorizationId||e.quotaId!==t.quotaId||e.authorityDigestB64u!==t.authorityDigestB64u||e.authorityRevocationEpoch!==t.authorityRevocationEpoch||e.issuedAtMs!==t.issuedAtMs||e.expiresAtMs!==t.expiresAtMs||e.capabilitySubjects.length!==t.capabilitySubjects.length)return!1;for(let n=0;n<e.capabilitySubjects.length;n+=1){let r=e.capabilitySubjects[n],i=t.capabilitySubjects[n];if(r.kind!==i.kind)return!1;if(r.kind===`link_devices`||r.kind===`revoke_devices`){if(i.kind!==r.kind)return!1;continue}if(i.kind!==r.kind||r.keyFamily!==i.keyFamily||!h(r.materialActivation,i.materialActivation))return!1}return!0}function eu(e){return e instanceof Error?e.message:`local authority installation input is invalid`}function tu(e){let t=Zc(e.localAuthMethod);if(t.status!==`active`||t.record.localStatus!==`synced`)throw Error(`local Email OTP auth method must be active and synced`);if(t.record.walletId!==e.authority.walletId||t.record.emailHashHex!==e.authMethod.emailHashHex||t.record.registrationAuthorityId!==e.authMethod.registrationAuthorityId||t.record.authority.walletId!==e.authority.walletId||t.record.authority.bindingId!==e.authMethod.walletAuthMethodId)throw Error(`local Email OTP auth method does not match authMethod`);return t.record}function nu(e){try{let n=Y(It(e.authority),`authority`);if(n.state!==`pending_local_install`)throw Error(`authority must be pending_local_install`);let r=Lt(e.authMethod);if(!r||r.status!==`pending_local_install`)throw Error(`authMethod must be a pending_local_install V2 record`);let i=t(e.profile.profileId||``);if(!i||i!==String(n.walletId))throw Error(`profile identity does not match authority`);let a=e.profile.defaultSignerSlot===void 0?1:ul(e.profile.defaultSignerSlot,`profile.defaultSignerSlot`);if(a<1)throw Error(`profile.defaultSignerSlot must be a positive safe integer`);let o={profileId:i,defaultSignerSlot:a,...e.profile.passkeyCredential?{passkeyCredential:e.profile.passkeyCredential}:{},...e.profile.preferences?{preferences:e.profile.preferences}:{},...e.profile.nearProvisioning?{nearProvisioning:e.profile.nearProvisioning}:{}},s=e.authenticator===null?null:qc(e.authenticator),c=null;if(r.kind===`passkey`){if(e.localAuthMethod!==null)throw Error(`Passkey installation cannot include a local Email OTP auth method`);let t=o.passkeyCredential;if(!t||t.id!==r.credentialIdB64u||t.rawId!==r.credentialIdB64u)throw Error(`profile passkey credential does not match authMethod`);if(!s||s.profileId!==i||s.signerSlot!==a||s.credentialId!==r.credentialIdB64u||x(s.credentialPublicKey)!==r.credentialPublicKeyB64u)throw Error(`profile authenticator does not match authMethod`)}else{if(s!==null||o.passkeyCredential!==void 0)throw Error(`Email OTP installation cannot include passkey profile records`);if(e.localAuthMethod===null)throw Error(`Email OTP installation requires a local auth method`);c=tu({localAuthMethod:e.localAuthMethod,authority:n,authMethod:r})}if(!Array.isArray(e.signerMaterials))throw Error(`signerMaterials must be an array`);let l=[];for(let t of e.signerMaterials)l.push(Cl(t));let u=e.exportRoot===null?null:El(e.exportRoot),d=vt(e.receipt),f=ul(e.expectedLockGeneration,`expectedLockGeneration`);if(r.walletId!==n.walletId||r.walletAuthorityId!==n.authorityId||d.walletId!==n.walletId||d.authorityId!==n.authorityId||d.authMethodId!==r.walletAuthMethodId||d.deviceId!==n.principal.deviceId||d.packageSetDigestB64u!==n.localInstallPackageSetDigestB64u)throw Error(`authority, authMethod, and receipt identities do not match`);if(!Hl(d.installedActivationRefs,n.signerActivations))throw Error(`receipt signer activations do not match authority`);let p=Nl(n.signerActivations);if(l.length!==p.length)throw Error(`signer material records do not match authority signer families`);for(let e=0;e<p.length;e+=1){let t=l[e],i=p[e];if(t.authorityId!==n.authorityId||t.walletAuthMethodId!==r.walletAuthMethodId||t.keyFamily!==i.keyFamily||!h(t.materialActivation,i.materialActivation))throw Error(`signer material record does not match authority activation`)}if((Fl(n.signerActivations)&&n.permissions.includes(`export_keys`))!==(u!==null))throw Error(`Ed25519 export root presence does not match authority permissions`);if(u){let e=Pl(n.signerActivations);if(e===null||u.authorityId!==n.authorityId||u.walletAuthMethodId!==r.walletAuthMethodId||u.walletKeyId!==e||u.envelope.walletId!==n.walletId||u.envelope.binding.kind!==`ed25519_yao_client_root_v1`||u.envelope.binding.walletKeyId!==e||u.envelope.binding.registeredPublicKeyB64u!==n.signerActivations.ed25519?.signer.registeredPublicKeyB64u||n.principal.kind!==`owner_device`||String(u.envelope.binding.deviceId)!==String(n.principal.deviceId)||u.envelope.lifecycle.state!==`active`||!Rs(r,u.envelope))throw Error(`export root does not match the Ed25519 authority activation`)}return{ok:!0,value:{authority:n,authMethod:r,profile:o,authenticator:s,localAuthMethod:c,signerMaterials:l,exportRoot:u,receipt:d,expectedLockGeneration:f}}}catch(e){return{ok:!1,error:eu(e)}}}function ru(e){return[`passkey`,e.rp_id,e.credential_id_b64u].join(`\0`)}function iu(e){let t=e.authenticators.map(e=>qc(e)),n=new Map,r=new Map;if(e.initialAuthMethod.kind===`passkey`){let i=t.find(t=>t.profileId===e.initialAuthMethod.walletId&&t.credentialId===e.initialAuthMethod.credentialIdB64u);if(!i)throw Error(`[SeamsWalletDB] passkey registration finalize requires matching authenticator material`);let a=Xc({binding:e.initialAuthMethod,authenticator:i});n.set(a.wallet_auth_method_id,a),r.set(ru(a),a)}else{let t=Zc(e.initialAuthMethod);n.set(t.wallet_auth_method_id,t)}for(let i of t){if(e.initialAuthMethod.kind===`passkey`&&i.profileId===e.initialAuthMethod.walletId&&i.credentialId===e.initialAuthMethod.credentialIdB64u){let t=Xc({binding:e.initialAuthMethod,authenticator:i});n.set(t.wallet_auth_method_id,t),r.set(ru(t),t);continue}let t=$c(i),a=ru(t),o=r.get(a);if(o){if(o.credential_public_key_b64u!==t.credential_public_key_b64u)throw Error(`[SeamsWalletDB] duplicate passkey credential has conflicting public key`);o.wallet_auth_method_id===t.wallet_auth_method_id&&(n.set(t.wallet_auth_method_id,t),r.set(a,t));continue}n.set(t.wallet_auth_method_id,t),r.set(a,t)}return[...n.values()]}function au(e,n){let r=t(e.profileId||``),i=O(e.chainIdKey),a=k(e.accountAddress),o=ot(e.accountModel);if(!r||!i||!a)throw Error(`[SeamsWalletDB] profileId, chainIdKey, and accountAddress are required`);if(!o)throw Error(`[SeamsWalletDB] accountModel is required`);let s=Date.now(),c={profileId:r,chainIdKey:i,accountAddress:a,accountModel:o,isPrimary:e.isPrimary??n?.isPrimary??!1,createdAt:n?.createdAt??s,updatedAt:s};return{wallet_id:r,near_account_id:pc({chainIdKey:i,accountAddress:a}),signer_slot:0,profile_id:r,chain_id_key:i,account_address:a,account_model:o,is_primary:!!c.isPrimary,updated_at:c.updatedAt,record:c}}function ou(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=K(Reflect.get(e,`profileId`)),n=O(Reflect.get(e,`chainIdKey`)),r=k(Reflect.get(e,`accountAddress`)),i=ot(Reflect.get(e,`accountModel`)),a=Reflect.get(e,`createdAt`),o=Reflect.get(e,`updatedAt`),s=Reflect.get(e,`isPrimary`);return!t||!n||!r||!i||!Number.isSafeInteger(a)||Number(a)<0||!Number.isSafeInteger(o)||Number(o)<0||s!==void 0&&typeof s!=`boolean`?null:{profileId:t,chainIdKey:n,accountAddress:r,accountModel:i,...s===void 0?{}:{isPrimary:s},createdAt:Number(a),updatedAt:Number(o)}}function su(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=ou(Reflect.get(e,`record`));return!t||Reflect.get(e,`wallet_id`)!==t.profileId||Reflect.get(e,`profile_id`)!==t.profileId||Reflect.get(e,`chain_id_key`)!==t.chainIdKey||Reflect.get(e,`account_address`)!==t.accountAddress||Reflect.get(e,`account_model`)!==t.accountModel||Reflect.get(e,`is_primary`)!==!!t.isPrimary||Reflect.get(e,`updated_at`)!==t.updatedAt||Reflect.get(e,`near_account_id`)!==pc({chainIdKey:t.chainIdKey,accountAddress:t.accountAddress})?null:t}function cu(e){let n=t(e.profileId||``),r=O(e.chainIdKey),i=k(e.accountAddress),a=t(e.signerId||``),o=t(e.signerKind||``);if(!n||!r||!i||!a||!o)throw Error(`[SeamsWalletDB] signer requires profileId, chainIdKey, accountAddress, signerId, and signerKind`);let s=_c({...e,profileId:n,chainIdKey:r,accountAddress:i,signerId:a}),c=e.status===`active`;return{wallet_signer_id:mc({chainIdKey:r,accountAddress:i,signerId:a}),wallet_id:n,kind:o,chain_target_key:s.chainTargetKey,...c&&s.nearSignerSlot!=null?{near_signer_slot:s.nearSignerSlot}:{},...c&&s.nearEd25519SigningKeyId?{near_ed25519_signing_key_id:s.nearEd25519SigningKeyId}:{},...c&&s.keyHandle?{key_handle:s.keyHandle}:{},...c&&s.ecdsaThresholdKeyId?{ecdsa_threshold_key_id:s.ecdsaThresholdKeyId}:{},...c&&s.thresholdOwnerAddress?{threshold_owner_address:s.thresholdOwnerAddress}:{},status:e.status,updated_at:e.updatedAt,record:{...e,profileId:n,chainIdKey:r,accountAddress:i,signerId:a}}}function lu(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=K(Reflect.get(e,`profileId`)),n=O(Reflect.get(e,`chainIdKey`)),r=k(Reflect.get(e,`accountAddress`)),i=K(Reflect.get(e,`signerId`)),a=Reflect.get(e,`signerSlot`),o=K(Reflect.get(e,`signerType`)),s=Reflect.get(e,`signerKind`),c=Reflect.get(e,`signerAuthMethod`),l=Reflect.get(e,`signerSource`),u=Reflect.get(e,`status`),d=Reflect.get(e,`addedAt`),f=Reflect.get(e,`updatedAt`);if(!t||!n||!r||!i||!Number.isSafeInteger(a)||Number(a)<1||!o||s!==Qe.thresholdEd25519&&s!==Qe.thresholdEcdsa||c!==`passkey`&&c!==`email_otp`||l!==`passkey_registration`&&l!==`email_otp_registration`&&l!==`self_hosted_import`||u!==`active`&&u!==`pending`&&u!==`revoked`||!Number.isSafeInteger(d)||Number(d)<0||!Number.isSafeInteger(f)||Number(f)<0)return null;let p=Reflect.get(e,`metadata`),m;if(p!==void 0){if(typeof p!=`object`||!p||Array.isArray(p))return null;m={};for(let e of Object.keys(p))m[e]=Reflect.get(p,e)}let h=Reflect.get(e,`removedAt`),g=Reflect.get(e,`revocationReason`);return h!==void 0&&(!Number.isSafeInteger(h)||Number(h)<0)||g!==void 0&&typeof g!=`string`?null:{profileId:t,chainIdKey:n,accountAddress:r,signerId:i,signerSlot:Number(a),signerType:o,signerKind:s,signerAuthMethod:c,signerSource:l,status:u,addedAt:Number(d),updatedAt:Number(f),...h===void 0?{}:{removedAt:Number(h)},...g===void 0?{}:{revocationReason:g},...m===void 0?{}:{metadata:m}}}function Q(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=lu(Reflect.get(e,`record`));if(!t||Reflect.get(e,`wallet_signer_id`)!==mc({chainIdKey:t.chainIdKey,accountAddress:t.accountAddress,signerId:t.signerId})||Reflect.get(e,`wallet_id`)!==t.profileId||Reflect.get(e,`kind`)!==t.signerKind)return null;let n;try{n=_c(t)}catch{return null}let r=t.status===`active`;if(t.signerKind===Qe.thresholdEd25519){let t=Reflect.get(e,`chain_target_key`),i=Reflect.get(e,`near_signer_slot`),a=Reflect.get(e,`near_ed25519_signing_key_id`);if(t!==void 0&&t!==n.chainTargetKey||r&&i!==n.nearSignerSlot||!r&&i!==void 0&&i!==n.nearSignerSlot||r&&a!==n.nearEd25519SigningKeyId||!r&&a!==void 0&&a!==n.nearEd25519SigningKeyId)return null}else if(r&&Reflect.get(e,`chain_target_key`)!==n.chainTargetKey)return null;else if(!r&&Reflect.get(e,`chain_target_key`)!==void 0&&Reflect.get(e,`chain_target_key`)!==n.chainTargetKey)return null;let i=Reflect.get(e,`key_handle`),a=Reflect.get(e,`ecdsa_threshold_key_id`),o=Reflect.get(e,`threshold_owner_address`);return r&&i!==n.keyHandle||!r&&i!==void 0&&i!==n.keyHandle||r&&a!==n.ecdsaThresholdKeyId||!r&&a!==void 0&&a!==n.ecdsaThresholdKeyId||r&&o!==n.thresholdOwnerAddress||!r&&o!==void 0&&o!==n.thresholdOwnerAddress||Reflect.get(e,`status`)!==t.status||Reflect.get(e,`updated_at`)!==t.updatedAt?null:t}async function uu(e){let n=e.nextRow;if(n.kind!==Qe.thresholdEcdsa||n.status===`revoked`||!n.key_handle||!n.ecdsa_threshold_key_id)return;let r=await e.store.index(D.walletId).getAll(n.wallet_id),i=new Set;for(let e of r){if(typeof e!=`object`||!e||Array.isArray(e)||!Q(e))continue;let r=t(Reflect.get(e,`wallet_signer_id`)||``);!r||r===n.wallet_signer_id||Reflect.get(e,`kind`)!==n.kind||Reflect.get(e,`chain_target_key`)!==n.chain_target_key||(Reflect.get(e,`key_handle`)===n.key_handle||Reflect.get(e,`ecdsa_threshold_key_id`)===n.ecdsa_threshold_key_id)&&i.add(r)}for(let t of i)await e.store.delete(t)}function du(e){let n=t(e.opId||``),r=t(e.idempotencyKey||``),i=O(e.chainIdKey),a=k(e.accountAddress),o=t(e.signerId||``);if(!n||!r||!i||!a||!o)throw Error(`[SeamsWalletDB] signer op requires opId, idempotencyKey, chainIdKey, accountAddress, and signerId`);return{op_id:n,idempotency_key:r,status:e.status,next_attempt_at:e.nextAttemptAt,wallet_id:t(String(e.payload?.profileId||``)),chain_target_key:hc({chainIdKey:i,accountAddress:a}),updated_at:e.updatedAt,record:{...e,opId:n,idempotencyKey:r,chainIdKey:i,accountAddress:a,signerId:o}}}function fu(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=K(Reflect.get(e,`opId`)),n=K(Reflect.get(e,`idempotencyKey`)),r=K(Reflect.get(e,`opType`)),i=O(Reflect.get(e,`chainIdKey`)),a=k(Reflect.get(e,`accountAddress`)),o=K(Reflect.get(e,`signerId`)),s=Reflect.get(e,`status`),c=Reflect.get(e,`attemptCount`),l=Reflect.get(e,`nextAttemptAt`),u=Reflect.get(e,`createdAt`),d=Reflect.get(e,`updatedAt`);if(!t||!n||!r||!i||!a||!o||s!==`queued`&&s!==`submitted`&&s!==`confirmed`&&s!==`failed`&&s!==`dead-letter`||!Number.isSafeInteger(c)||Number(c)<0||!Number.isSafeInteger(l)||Number(l)<0||!Number.isSafeInteger(u)||Number(u)<0||!Number.isSafeInteger(d)||Number(d)<0)return null;let f=Reflect.get(e,`payload`),p=pt(f);if(f!==void 0&&(typeof f!=`object`||!f||Array.isArray(f)))return null;let m=Reflect.get(e,`lastError`),h=Reflect.get(e,`txHash`);return m!==void 0&&typeof m!=`string`||h!==void 0&&typeof h!=`string`?null:{opId:t,idempotencyKey:n,opType:r,chainIdKey:i,accountAddress:a,signerId:o,status:s,attemptCount:Number(c),nextAttemptAt:Number(l),createdAt:Number(u),updatedAt:Number(d),...p===void 0?{}:{payload:p},...m===void 0?{}:{lastError:m},...h===void 0?{}:{txHash:h}}}function pu(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=fu(Reflect.get(e,`record`));if(!n||Reflect.get(e,`op_id`)!==n.opId||Reflect.get(e,`idempotency_key`)!==n.idempotencyKey||Reflect.get(e,`status`)!==n.status||Reflect.get(e,`next_attempt_at`)!==n.nextAttemptAt||Reflect.get(e,`chain_target_key`)!==hc({chainIdKey:n.chainIdKey,accountAddress:n.accountAddress}))return null;let r=t(String(n.payload&&Reflect.get(n.payload,`profileId`)?Reflect.get(n.payload,`profileId`):``));return Reflect.get(e,`wallet_id`)!==r||Reflect.get(e,`updated_at`)!==n.updatedAt?null:n}function mu(e){return[e.walletSignerId,e.keyKind].join(`\0`)}function hu(e){return mc({chainIdKey:e.chainIdKey,accountAddress:e.accountAddress,signerId:e.signerId})}function gu(e){let n=t(e.profileId||``),r=t(e.signerId||``),i=t(e.wrapKeySalt||``),a=t(e.chainIdKey||``).toLowerCase(),o=k(e.accountAddress),s=t(e.keyKind||``),c=t(e.algorithm||``),l=t(e.publicKey||``);if(!n)throw Error(`[SeamsWalletDB] Missing profileId for key material record`);if(!Number.isSafeInteger(e.signerSlot)||e.signerSlot<1)throw Error(`[SeamsWalletDB] Invalid signerSlot for key material record`);if(!a)throw Error(`[SeamsWalletDB] Missing chainIdKey for key material record`);if(!o)throw Error(`[SeamsWalletDB] Missing accountAddress for key material record`);if(!r)throw Error(`[SeamsWalletDB] Missing signerId for key material record`);if(!s)throw Error(`[SeamsWalletDB] Missing keyKind for key material record`);if(!c)throw Error(`[SeamsWalletDB] Missing algorithm for key material record`);if(!l)throw Error(`[SeamsWalletDB] Missing publicKey for key material record`);if(typeof e.timestamp!=`number`)throw Error(`[SeamsWalletDB] Missing timestamp for key material record`);if(!Number.isSafeInteger(e.schemaVersion)||e.schemaVersion<1)throw Error(`[SeamsWalletDB] Invalid schemaVersion for key material record`);let u=ct({profileId:n,signerSlot:e.signerSlot,chainIdKey:a,accountAddress:o,keyKind:s,schemaVersion:e.schemaVersion,signerId:r}),d=ft(e.payloadEnvelope,u,`${n}/${e.signerSlot}/${a}/${s}`),f=pt(e.payload),p={profileId:n,signerSlot:e.signerSlot,chainIdKey:a,accountAddress:o,keyKind:s,algorithm:c,publicKey:l,signerId:r,...i?{wrapKeySalt:i}:{},...f?{payload:f}:{},...d?{payloadEnvelope:d}:{},timestamp:e.timestamp,schemaVersion:e.schemaVersion},m=hu(p),h=hc({chainIdKey:a,accountAddress:o});return{key_material_id:mu({walletSignerId:m,keyKind:s}),wallet_id:n,wallet_signer_id:m,chain_target_key:h,key_handle:r,public_key:l,updated_at:e.timestamp,record:p}}function _u(e){return[t(e.profileId||``),O(e.chainIdKey),k(e.accountAddress),t(e.signerId||``),String(Number(e.signerSlot))].join(`\0`)}function vu(e){let t=new Set(e.signers.map(e=>_u({profileId:e.profileId,chainIdKey:e.chainIdKey,accountAddress:e.accountAddress,signerId:e.signerId,signerSlot:e.signerSlot}))),n=new Set(e.keyMaterials.filter(e=>e.keyKind===`threshold_share_v1`).map(e=>_u({profileId:e.profileId,chainIdKey:e.chainIdKey,accountAddress:e.accountAddress,signerId:e.signerId,signerSlot:e.signerSlot}))),r=e.signers.find(e=>e.status===`active`&&!n.has(_u({profileId:e.profileId,chainIdKey:e.chainIdKey,accountAddress:e.accountAddress,signerId:e.signerId,signerSlot:e.signerSlot})));if(r)throw Error(`[SeamsWalletDB] active signer ${r.signerId} requires matching threshold key material`);let i=e.keyMaterials.find(e=>e.keyKind===`threshold_share_v1`&&!t.has(_u({profileId:e.profileId,chainIdKey:e.chainIdKey,accountAddress:e.accountAddress,signerId:e.signerId,signerSlot:e.signerSlot})));if(i)throw Error(`[SeamsWalletDB] threshold key material for signer ${i.signerId} has no matching signer activation`)}function yu(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let t=K(Reflect.get(e,`profileId`)),n=Reflect.get(e,`signerSlot`),r=O(Reflect.get(e,`chainIdKey`)),i=k(Reflect.get(e,`accountAddress`)),a=K(Reflect.get(e,`keyKind`)),o=K(Reflect.get(e,`algorithm`)),s=K(Reflect.get(e,`publicKey`)),c=K(Reflect.get(e,`signerId`)),l=Reflect.get(e,`timestamp`),u=Reflect.get(e,`schemaVersion`);if(!t||!Number.isSafeInteger(n)||Number(n)<1||!r||!i||!a||!o||!s||!c||typeof l!=`number`||!Number.isSafeInteger(u)||Number(u)<1)return null;let d=Reflect.get(e,`wrapKeySalt`);if(d!==void 0&&typeof d!=`string`)return null;let f=Reflect.get(e,`payload`),p=pt(f);if(f!==void 0&&(typeof f!=`object`||!f||Array.isArray(f)))return null;let m=ct({profileId:t,signerSlot:Number(n),chainIdKey:r,accountAddress:i,keyKind:a,schemaVersion:Number(u),signerId:c}),h;try{h=ft(Reflect.get(e,`payloadEnvelope`),m,`${t}/${n}/${r}/${a}`)}catch{return null}return{profileId:t,signerSlot:Number(n),chainIdKey:r,accountAddress:i,keyKind:a,algorithm:o,publicKey:s,signerId:c,...d===void 0?{}:{wrapKeySalt:d},...p===void 0?{}:{payload:p},...h===void 0?{}:{payloadEnvelope:h},timestamp:l,schemaVersion:Number(u)}}function bu(e){if(typeof e!=`object`||!e||Array.isArray(e))return null;let n=yu(Reflect.get(e,`record`));return!n||Reflect.get(e,`key_material_id`)!==mu({walletSignerId:hu(n),keyKind:n.keyKind})||Reflect.get(e,`wallet_id`)!==n.profileId||Reflect.get(e,`wallet_signer_id`)!==hu(n)||Reflect.get(e,`chain_target_key`)!==hc({chainIdKey:n.chainIdKey,accountAddress:n.accountAddress})||Reflect.get(e,`key_handle`)!==t(n.signerId||``)||Reflect.get(e,`public_key`)!==n.publicKey||Reflect.get(e,`updated_at`)!==n.timestamp?null:n}function xu(e){return _u({profileId:e.profileId,chainIdKey:e.chainIdKey,accountAddress:e.accountAddress,signerId:e.signerId,signerSlot:e.signerSlot})}function Su(e){return _u({profileId:e.profileId,chainIdKey:e.chainIdKey,accountAddress:e.accountAddress,signerId:e.signerId,signerSlot:e.signerSlot})}function Cu(e){let n=new Set;for(let r of e.signers){let e=t(r.profileId||``);e&&n.add(e)}for(let r of e.keyMaterials){let e=t(r.profileId||``);e&&n.add(e)}return[...n]}async function wu(e,t){let n=e.store(E.walletSigners),r=[];for(let e of t){let t=await n.index(D.walletId).getAll(e);for(let e of t){let t=Q(e);t?.status===`active`&&r.push(t)}}return r}async function Tu(e,t){let n=e.store(E.keyMaterial),r=[];for(let e of t){let t=await n.index(D.walletId).getAll(e);for(let e of t){let t=bu(e);t?.keyKind===`threshold_share_v1`&&r.push(t)}}return r}function Eu(e){let t=new Map;for(let n of e.existing)t.set(mu({walletSignerId:hu(n),keyKind:n.keyKind}),n);for(let n of e.incoming)t.set(mu({walletSignerId:hu(n),keyKind:n.keyKind}),n);return[...t.values()]}async function Du(e){let t=Cu({signers:e.signers,keyMaterials:e.keyMaterials});if(t.length===0)return;let n=await wu(e.ctx,t),r=new Set(n.map(xu));vu({signers:n,keyMaterials:Eu({existing:(await Tu(e.ctx,t)).filter(e=>r.has(Su(e))),incoming:e.keyMaterials})})}function Ou(e){if(e.keyKind!==`threshold_share_v1`||e.algorithm!==`ed25519`)return!0;let n=e.payload||{};return!!t(n.relayerKeyId||``)&&!!t(n.keyVersion||``)}function ku(e){let t=new Set(e.activeSigners.map(xu));return e.matches.filter(e=>t.has(Su(e))).find(Ou)||e.matches.find(Ou)||[...e.matches].sort((e,t)=>t.timestamp-e.timestamp)[0]||null}var Au=class{constructor(e){this.manager=e}async installLocalAuthority(e){let t=nu(e);return t.ok?await Nt(t.value.authority)?this.manager.runTransaction([E.appState,E.wallets,E.walletAuthMethods,E.walletAuthorities,E.walletAuthoritySignerMaterials,E.walletAuthorityExportRoots,E.walletAuthorityInstallationReceipts,E.walletSelections],`readwrite`,this.installLocalAuthorityInTransaction.bind(this,t.value)):{kind:`integrity_error`,reason:`authority digest does not match canonical encoding`}:{kind:`integrity_error`,reason:t.error}}async finalizeLocalAuthorityActivation(e){let t=It(e.authority);if(!t.ok||t.value.state!==`active`)throw Error(`active WalletAuthorityV1 is invalid`);let n=Lt(e.authMethod);if(!n||n.status!==`active`)throw Error(`active WalletAuthMethodRecordV2 is invalid`);let r=ea($i(e.walletSession,e.operationCredential))?.record??null;if(!r)throw Error(`active Wallet Session is invalid`);let i=ul(e.expectedLockGeneration,`expectedLockGeneration`);if(n.walletId!==t.value.walletId||n.walletAuthorityId!==t.value.authorityId||r.walletId!==t.value.walletId||r.authorityId!==t.value.authorityId||r.authMethodId!==n.walletAuthMethodId||r.authorityDigestB64u!==t.value.authorityDigestB64u||r.authorityRevocationEpoch!==t.value.revocationEpoch)throw Error(`active authority, auth method, and Wallet Session identities differ`);return await this.manager.runTransaction([E.appState,E.wallets,E.walletAuthorities,E.walletAuthMethods,E.walletAuthorityInstallationReceipts,E.walletSelections,E.walletSessionAuthorizations],`readwrite`,this.finalizeLocalAuthorityActivationInTransaction.bind(this,{authority:t.value,authMethod:n,walletSession:r,operationCredential:e.operationCredential,expectedLockGeneration:i}))}async publishLocalAuthorityActivation(e){let t=It(e.authority);if(!t.ok||t.value.state!==`active`)throw Error(`active WalletAuthorityV1 is invalid`);let n=Lt(e.authMethod);if(!n||n.status!==`active`)throw Error(`active WalletAuthMethodRecordV2 is invalid`);let r=ul(e.expectedLockGeneration,`expectedLockGeneration`);if(n.walletId!==t.value.walletId||n.walletAuthorityId!==t.value.authorityId)throw Error(`active authority and auth method identities differ`);if(!await Nt(t.value))throw Error(`active WalletAuthorityV1 digest is invalid`);return await this.manager.runTransaction([E.appState,E.wallets,E.walletAuthorities,E.walletAuthMethods,E.walletAuthorityInstallationReceipts,E.walletSelections],`readwrite`,this.publishLocalAuthorityActivationInTransaction.bind(this,{authority:t.value,authMethod:n,expectedLockGeneration:r}))}async advanceWalletLockGeneration(e){let t=Y(a(e.walletId),`walletId`),n=ul(e.lockedAtMs,`lockedAtMs`);return this.manager.runTransaction([E.walletSelections],`readwrite`,this.advanceWalletLockGenerationInTransaction.bind(this,{walletId:t,lockedAtMs:n}))}async markWalletSelectionUnlocked(e){let t=Y(a(e.walletId),`walletId`),n=Y(s(e.walletAuthMethodId),`walletAuthMethodId`),r=ul(e.unlockedAtMs,`unlockedAtMs`);await this.manager.runTransaction([E.walletSelections,E.walletAuthMethods],`readwrite`,this.markWalletSelectionUnlockedInTransaction.bind(this,{walletId:t,walletAuthMethodId:n,unlockedAtMs:r}))}async persistRecoveredWalletAuthority(e){let t=Y(It(e.authority),`authority`),n=Lt(e.authMethod),r=ul(e.recoveredAtMs,`recoveredAtMs`);if(t.state!==`active`||!Pt(t)||!n||n.status!==`active`||n.walletId!==t.walletId||n.walletAuthorityId!==t.authorityId)throw Error(`recovered Wallet Authority projection is invalid`);if(!await Nt(t))throw Error(`recovered Wallet Authority digest is invalid`);await this.manager.runTransaction([E.walletAuthorities,E.walletSelections,E.walletAuthMethods],`readwrite`,this.persistRecoveredWalletAuthorityInTransaction.bind(this,{authority:t,authMethod:n,recoveredAtMs:r}))}async getLocalAuthorityInstallationReceipt(e){let t=n(e);return t.ok&&kl(await(await this.manager.getDB()).get(E.walletAuthorityInstallationReceipts,t.value))?.record||null}async finalizeLocalAuthorityActivationInTransaction(e,t){let n=t.store(E.appState),r=t.store(E.walletAuthorities),i=t.store(E.walletAuthMethods),a=t.store(E.walletAuthorityInstallationReceipts),o=t.store(E.walletSelections),s=t.store(E.walletSessionAuthorizations),c=await r.get(e.authority.authorityId),l=await i.get(e.authMethod.walletAuthMethodId),u=await a.get(e.authority.authorityId),d=await s.get(e.operationCredential.walletSessionId),f=await n.get(Bs(e.authority.authorityId)),p=f===void 0?null:Bc(f.value);if(f!==void 0&&!p)throw Error(`local authority profile projection is missing or corrupt`);let m=c===void 0?null:fl(c),h=l===void 0?null:X(l),g=u===void 0?null:kl(u),_=d===void 0?null:ea(d),v=_?.record??null;if(!g)throw Error(`local authority installation receipt is missing or corrupt`);if(g.record.authorityId!==e.authority.authorityId||g.record.walletId!==e.authority.walletId||g.record.authMethodId!==e.authMethod.walletAuthMethodId||!Hl(g.record.installedActivationRefs,e.authority.signerActivations))throw Error(`local authority installation receipt does not match active authority`);if(!m||!h)throw Error(`pending local authority records are missing`);if(m.record.state===`active`){if(!Kl(m.record,e.authority)||h.record.status!==`active`||!Jl(h.record,e.authMethod))throw Error(`active local authority replay conflicts with supplied records`);if(p&&await this.publishPendingLocalAuthorityProfileProjectionInTransaction(e.authority,e.authMethod,p,t),!v){let t=await o.get(e.authority.walletId);if(t===void 0)throw Error(`wallet selection is missing`);let n=Z(t);if(!n||n.wallet_id!==e.authority.walletId)throw Error(`wallet selection is corrupt`);return n.lock_generation===e.expectedLockGeneration?n.record.lockState===`locked`?{kind:`wallet_locked`,lockGeneration:n.lock_generation}:(await s.put($i(e.walletSession,e.operationCredential)),await o.put(Ml({kind:`wallet_selection_v1`,walletId:n.record.walletId,walletAuthMethodId:e.authMethod.walletAuthMethodId,lockGeneration:n.record.lockGeneration,lockState:`unlocked`,updatedAtMs:e.walletSession.issuedAtMs})),{kind:`finalized`}):{kind:`stale_lock_generation`,expectedLockGeneration:e.expectedLockGeneration,actualLockGeneration:n.lock_generation}}if(v.kind!==`active_wallet_session_v1`||!$l(v,e.walletSession)||_?.operationCredential.token!==e.operationCredential.token)throw Error(`active local authority replay conflicts with supplied Wallet Session`);return await s.put($i(e.walletSession,e.operationCredential)),{kind:`finalized`}}if(m.record.state!==`pending_local_install`||h.record.status!==`pending_local_install`||!ql(m.record,e.authority)||!Yl(h.record,e.authMethod))throw Error(`local authority records are not the expected pending installation`);if(v&&v.kind!==`active_wallet_session_v1`)throw Error(`Wallet Session authorization is not active`);if(v?.kind===`active_wallet_session_v1`&&(!$l(v,e.walletSession)||_?.operationCredential.token!==e.operationCredential.token))throw Error(`Wallet Session authorization conflicts with finalization`);let y=await o.get(e.authority.walletId);if(y===void 0)throw Error(`wallet selection is missing`);let b=Z(y);if(!b||b.wallet_id!==e.authority.walletId)throw Error(`wallet selection is corrupt`);if(b.lock_generation!==e.expectedLockGeneration)return{kind:`stale_lock_generation`,expectedLockGeneration:e.expectedLockGeneration,actualLockGeneration:b.lock_generation};if(b.record.lockState===`locked`)return{kind:`wallet_locked`,lockGeneration:b.lock_generation};if(!p)throw Error(`local authority profile projection is missing or corrupt`);return await this.publishPendingLocalAuthorityProfileProjectionInTransaction(e.authority,e.authMethod,p,t),await r.put(pl(e.authority)),await i.put(await Sl(i,e.authMethod)),await s.put($i(e.walletSession,e.operationCredential)),await o.put(Ml({kind:`wallet_selection_v1`,walletId:b.record.walletId,walletAuthMethodId:e.authMethod.walletAuthMethodId,lockGeneration:b.record.lockGeneration,lockState:`unlocked`,updatedAtMs:e.walletSession.issuedAtMs})),{kind:`finalized`}}async publishPendingLocalAuthorityProfileProjectionInTransaction(e,t,n,r){if(n.authorityId!==e.authorityId||n.walletId!==e.walletId||n.authMethodId!==t.walletAuthMethodId)throw Error(`local authority profile projection identity does not match activation`);if(n.authenticator?.wallet_auth_method_id===t.walletAuthMethodId||n.localAuthMethod?.wallet_auth_method_id===t.walletAuthMethodId)throw Error(`local authority profile projection collides with the V2 auth-method key`);let i=r.store(E.wallets),a=r.store(E.walletAuthMethods),o=await i.get(n.profile.wallet_id),s=o===void 0?null:Vc(o);if(o!==void 0&&!s)throw Error(`stored wallet profile is corrupt during authority publication`);if(s&&!Tc(s,n.profile))throw Error(`stored wallet profile changed during authority publication`);await i.put(n.profile);for(let e of[n.authenticator,n.localAuthMethod]){if(!e)continue;let t=await a.get(e.wallet_auth_method_id);if(t!==void 0){let n=al(t);if(!n||!kc(n,e))throw Error(`stored local auth method changed during authority publication`)}await a.put(e)}await a.put(await Sl(a,t)),await r.store(E.appState).delete(Bs(e.authorityId))}async publishLocalAuthorityActivationInTransaction(e,t){let n=await t.store(E.appState).get(Bs(e.authority.authorityId)),r=n===void 0?null:Bc(n.value);if(n!==void 0&&!r)throw Error(`local authority profile projection is missing or corrupt`);let i=await t.store(E.walletAuthorities).get(e.authority.authorityId),a=await t.store(E.walletAuthMethods).get(e.authMethod.walletAuthMethodId),o=await t.store(E.walletAuthorityInstallationReceipts).get(e.authority.authorityId),s=i===void 0?null:fl(i),c=a===void 0?null:X(a),l=o===void 0?null:kl(o);if(!s||!c||!l)throw Error(`local authority publication prerequisites are missing`);if(l.record.authorityId!==e.authority.authorityId||l.record.walletId!==e.authority.walletId||l.record.authMethodId!==e.authMethod.walletAuthMethodId||!Hl(l.record.installedActivationRefs,e.authority.signerActivations))throw Error(`local authority installation receipt does not match publication`);if(s.record.state===`active`){if(!Kl(s.record,e.authority)||c.record.status!==`active`||!Jl(c.record,e.authMethod))throw Error(`active local authority publication conflicts with stored records`);return r&&await this.publishPendingLocalAuthorityProfileProjectionInTransaction(e.authority,e.authMethod,r,t),{kind:`published`}}if(s.record.state!==`pending_local_install`||c.record.status!==`pending_local_install`||!ql(s.record,e.authority)||!Yl(c.record,e.authMethod))throw Error(`local authority records are not the expected pending installation`);let u=await t.store(E.walletSelections).get(e.authority.walletId);if(u===void 0)throw Error(`wallet selection is missing`);let d=Z(u);if(!d||d.wallet_id!==e.authority.walletId)throw Error(`wallet selection is corrupt`);if(d.lock_generation!==e.expectedLockGeneration)return{kind:`stale_lock_generation`,expectedLockGeneration:e.expectedLockGeneration,actualLockGeneration:d.lock_generation};if(d.record.lockState===`locked`)return{kind:`wallet_locked`,lockGeneration:d.lock_generation};if(!r)throw Error(`local authority profile projection is missing or corrupt`);return await this.publishPendingLocalAuthorityProfileProjectionInTransaction(e.authority,e.authMethod,r,t),await t.store(E.walletAuthorities).put(pl(e.authority)),{kind:`published`}}async advanceWalletLockGenerationInTransaction(e,t){let n=t.store(E.walletSelections),r=await n.get(e.walletId);if(r===void 0)throw Error(`wallet selection is missing`);let i=Z(r);if(!i||i.wallet_id!==e.walletId)throw Error(`wallet selection is corrupt`);if(i.record.lockGeneration>=2**53-1)throw Error(`wallet lock generation cannot advance`);let a=i.record.lockGeneration+1;return await n.put(Ml({kind:`wallet_selection_v1`,walletId:i.record.walletId,walletAuthMethodId:i.record.walletAuthMethodId,lockGeneration:a,lockState:`locked`,updatedAtMs:e.lockedAtMs})),a}async assertSelectionMoveBetweenAuthorityMembers(e,t){let n=t.store(E.walletAuthMethods),r=await n.get(e.fromWalletAuthMethodId),i=await n.get(e.toWalletAuthMethodId),a=r===void 0?null:X(r),o=i===void 0?null:X(i);if(!a||!o||o.record.status!==`active`||o.record.walletId!==e.walletId||a.record.walletId!==e.walletId||a.record.walletAuthorityId!==o.record.walletAuthorityId)throw Error(`wallet selection is missing or corrupt`)}async markWalletSelectionUnlockedInTransaction(e,t){let n=t.store(E.walletSelections),r=await n.get(e.walletId),i=r===void 0?null:Z(r);if(!i||i.wallet_id!==e.walletId)throw Error(`wallet selection is missing or corrupt`);i.record.walletAuthMethodId!==e.walletAuthMethodId&&await this.assertSelectionMoveBetweenAuthorityMembers({walletId:e.walletId,fromWalletAuthMethodId:i.record.walletAuthMethodId,toWalletAuthMethodId:e.walletAuthMethodId},t),await n.put(Ml({kind:`wallet_selection_v1`,walletId:i.record.walletId,walletAuthMethodId:e.walletAuthMethodId,lockGeneration:i.record.lockGeneration,lockState:`unlocked`,updatedAtMs:e.unlockedAtMs}))}async persistRecoveredWalletAuthorityInTransaction(e,t){let n=t.store(E.walletAuthorities),r=await n.get(e.authority.authorityId),i=r===void 0?null:fl(r)?.record;if(r!==void 0&&!i)throw Error(`local Wallet Authority is corrupt`);if(i&&!Kl(i,e.authority))throw Error(`recovered Wallet Authority conflicts with local authority`);await n.put(pl(e.authority));let a=t.store(E.walletAuthMethods);await a.put(await Sl(a,e.authMethod));let o=t.store(E.walletSelections),s=await o.get(e.authority.walletId),c=s===void 0?null:Z(s);if(s!==void 0&&!c)throw Error(`recovered wallet selection is corrupt`);await o.put(Ml({kind:`wallet_selection_v1`,walletId:e.authority.walletId,walletAuthMethodId:e.authMethod.walletAuthMethodId,lockGeneration:c?.record.lockGeneration??0,lockState:`locked`,updatedAtMs:e.recoveredAtMs}))}async installLocalAuthorityInTransaction(e,t){let n=t.store(E.appState),r=await t.store(E.wallets).get(e.profile.profileId),i=r===void 0?null:J(r);if(r!==void 0&&!i)return{kind:`integrity_error`,reason:`wallet profile row is invalid`};let a=t.store(E.walletAuthMethods),o=e.authenticator?$c(e.authenticator):null,s=e.localAuthMethod?Qc(e.localAuthMethod,e.profile.defaultSignerSlot??1):null,c=o?await a.get(o.wallet_auth_method_id):void 0,l=c===void 0?null:al(c),u=e.authenticator?$c(e.authenticator,l?.kind===`passkey`?l:void 0):null,d=s?await a.get(s.wallet_auth_method_id):void 0,f=d===void 0?null:al(d),p=t.store(E.walletSelections),m=await p.get(e.authority.walletId),h=m===void 0?null:Z(m);if(m!==void 0&&(!h||h.wallet_id!==e.authority.walletId))return{kind:`integrity_error`,reason:`wallet selection row is invalid`};if(h&&h.lock_generation!==e.expectedLockGeneration)return{kind:`stale_lock_generation`,expectedLockGeneration:e.expectedLockGeneration,actualLockGeneration:h.lock_generation};if(!h&&e.expectedLockGeneration!==0)return{kind:`integrity_error`,reason:`initial wallet selection requires lock generation zero`};let g=t.store(E.walletAuthorities),_=t.store(E.walletAuthMethods),v=t.store(E.walletAuthoritySignerMaterials),y=t.store(E.walletAuthorityExportRoots),b=t.store(E.walletAuthorityInstallationReceipts),x=Bs(e.authority.authorityId),S=await n.get(x),C=S===void 0?null:Bc(S.value);if(S!==void 0&&!C)return{kind:`integrity_error`,reason:`local authority profile projection is missing or corrupt`};let ee=C??el({authorityId:e.authority.authorityId,walletId:e.authority.walletId,authMethodId:e.authMethod.walletAuthMethodId,profile:yc(e.profile,i||void 0),authenticator:u,localAuthMethod:s?.kind===`email_otp`?s:null}),te=await g.get(e.authority.authorityId),ne=await _.get(e.authMethod.walletAuthMethodId),re=[];for(let t of e.signerMaterials)re.push(await v.get([t.authorityId,t.walletAuthMethodId,t.activationId]));let ie=e.exportRoot?await y.get([e.exportRoot.authorityId,e.exportRoot.walletAuthMethodId,e.exportRoot.walletKeyId]):void 0,ae=await b.get(e.receipt.authorityId),oe=te===void 0?null:fl(te),se=ne===void 0?null:X(ne),ce=[];for(let e=0;e<re.length;e+=1){let t=re[e];ce.push(t===void 0?null:wl(t)?.record||null)}let le=ie===void 0?null:Dl(ie)?.record||null,ue=ae===void 0?null:kl(ae)?.record||null;if(C&&!nl(C,e))return{kind:`integrity_error`,reason:`local authority profile projection conflicts with replay`};let de=te!==void 0||ne!==void 0||re.some(dl)||ie!==void 0||ae!==void 0||S!==void 0,fe=te!==void 0&&ne!==void 0&&re.every(dl)&&(e.exportRoot===null?ie===void 0:ie!==void 0)&&ae!==void 0;if(de){if(!h||!fe||!oe||!se||!ue||!C||!tl(C,ee))return{kind:`integrity_error`,reason:`local authority replay is incomplete or malformed`};if(!Kl(oe.record,e.authority)||!Jl(se.record,e.authMethod)||!Ql(ue,e.receipt))return{kind:`integrity_error`,reason:`local authority replay conflicts with stored records`};if(i&&!wc(i,C.profile.record)||C.authenticator&&l!==null&&!kc(l,C.authenticator)||C.localAuthMethod&&f!==null&&!kc(f,C.localAuthMethod))return{kind:`integrity_error`,reason:`stored local profile projection conflicts with replay`};for(let t=0;t<e.signerMaterials.length;t+=1){let n=ce[t];if(!n||!Xl(n,e.signerMaterials[t]))return{kind:`integrity_error`,reason:`stored signer material conflicts with replay`}}return e.exportRoot&&(!le||!Zl(le,e.exportRoot))?{kind:`integrity_error`,reason:`stored export root conflicts with replay`}:(await p.put(Ml(Vs(e,h))),{kind:`idempotent_replay`,receipt:ue})}await n.put({key:x,value:ee}),await g.put(pl(e.authority)),await _.put(await Sl(_,e.authMethod));for(let t of e.signerMaterials)await v.put(Tl(t));return e.exportRoot&&await y.put(Ol(e.exportRoot)),await b.put(Al(e.receipt)),await p.put(Ml(Vs(e,h))),{kind:`installed`,receipt:e.receipt}}async getWalletAuthority(e){let t=n(e);if(!t.ok)return null;let r=fl(await(await this.manager.getDB()).get(E.walletAuthorities,t.value));return!r||!await Nt(r.record)?null:r.record}async persistFoundingWalletAuthority(e){let t=Us(e);await this.manager.runTransaction([E.appState,E.walletAuthorities,E.walletAuthMethods,E.wallets,E.walletSelections],`readwrite`,this.persistFoundingWalletAuthorityInTransaction.bind(this,t,`activate`))}async persistFoundingWalletAuthorityInTransaction(e,t,n){if(t===`preserve`){let t=Z(await n.store(E.walletSelections).get(e.authority.walletId));if(!t||t.record.lockState!==`unlocked`||t.record.walletAuthMethodId!==e.authMethod.walletAuthMethodId)throw Error(`Deferred registration publication was interrupted by wallet lock`)}await n.store(E.walletAuthorities).put(pl(e.authority));let r=n.store(E.walletAuthMethods);await r.put(await Sl(r,e.authMethod)),t!==`preserve`&&await n.store(E.walletSelections).put(Ml({kind:`wallet_selection_v1`,walletId:e.authority.walletId,walletAuthMethodId:e.authMethod.walletAuthMethodId,lockGeneration:0,lockState:`unlocked`,updatedAtMs:e.authMethod.activatedAtMs}))}async getWalletAuthMethodV2(e){let t=s(e);return t.ok&&X(await(await this.manager.getDB()).get(E.walletAuthMethods,t.value))?.record||null}async listWalletSelections(){return(await(await this.manager.getDB()).transaction(E.walletSelections,`readonly`).store.getAll()).flatMap(e=>{let t=Z(e);return t?[t.record]:[]})}async listWalletSelectionWalletIds(){return(await(await this.manager.getDB()).transaction(E.walletSelections,`readonly`).store.getAllKeys()).flatMap(e=>{let t=a(e);return t.ok?[t.value]:[]})}async listWalletAuthMethodsV2ForWallet(e){let n=t(e||``);return n?(await(await this.manager.getDB()).transaction(E.walletAuthMethods,`readonly`).store.index(D.walletId).getAll(n)).flatMap(e=>{let t=X(e);return t?[t.record]:[]}):[]}async listLocalWalletAuthMethodProjectionsV2ForWallet(e){let n=t(e||``);return n?await this.manager.runTransaction([E.walletAuthMethods],`readwrite`,async e=>{let t=e.store(E.walletAuthMethods),r=await t.index(D.walletId).getAll(n),i=[];for(let e of r){let n=X(e);if(!n)continue;let a=vl(n.record,r,n.presentation);(!bl(e)||!yl(n.presentation,a))&&await t.put(gl(xl(n.record,a))),i.push(xl(n.record,a))}return i}):[]}async retainVerifiedEmailOtpLocalPresentation(e){let t=await We(String(e.emailAddress));return await this.manager.runTransaction([E.walletAuthMethods],`readwrite`,async n=>{let r=n.store(E.walletAuthMethods),i=X(await r.get(e.walletAuthMethodId));if(!i)return{kind:`not_retained`,reason:`missing_auth_method`};if(i.record.walletId!==e.walletId)return{kind:`not_retained`,reason:`wallet_mismatch`};if(i.record.kind!==`email_otp`)return{kind:`not_retained`,reason:`auth_method_not_email_otp`};if(i.record.emailHashHex!==t)return{kind:`not_retained`,reason:`email_hash_mismatch`};let a={version:`wallet_auth_method_local_presentation_v1`,kind:`email_otp`,email:{kind:`verified`,address:e.emailAddress}};return await r.put(gl({kind:`email_otp`,record:i.record,presentation:a})),{kind:`retained`,projection:{kind:`email_otp`,record:i.record,presentation:a}}})}async resolveSelectedWalletAuthority(e){return await this.resolveWalletAuthorityForSelection(e,null)}async resolveWalletAuthorityForMethod(e,t){let n=s(t);return n.ok?await this.resolveWalletAuthorityForSelection(e,n.value):{kind:`integrity_error`,reason:`walletAuthMethodId is invalid`}}async resolveWalletAuthorityForSelection(e,t){let n=a(e);return n.ok?this.manager.runTransaction([E.walletSelections,E.walletAuthMethods,E.walletAuthorities,E.walletAuthoritySignerMaterials,E.walletAuthorityExportRoots],`readonly`,e=>this.resolveSelectedWalletAuthorityInTransaction(n.value,e,t)):{kind:`integrity_error`,reason:`walletId is invalid`}}async resolveSelectedWalletAuthorityInTransaction(e,t,n=null){let r=await t.store(E.walletSelections).get(e);if(r===void 0)return{kind:`missing_selection`};let i=Z(r);if(!i||i.wallet_id!==e)return{kind:`integrity_error`,reason:`wallet selection row is invalid`};let a=n??i.record.walletAuthMethodId,o=await t.store(E.walletAuthMethods).get(String(a));if(o===void 0)return{kind:`missing_auth_method`,walletAuthMethodId:a};let s=X(o);if(!s||s.wallet_id!==e)return{kind:`integrity_error`,reason:`selected V2 auth method row is invalid`};let c=await t.store(E.walletAuthorities).get(s.wallet_authority_id);if(c===void 0)return{kind:`missing_authority`,walletAuthorityId:s.record.walletAuthorityId};let l=fl(c);if(!l||l.wallet_id!==e)return{kind:`integrity_error`,reason:`selected wallet authority row is invalid`};if(l.authority_id!==s.wallet_authority_id)return{kind:`integrity_error`,reason:`auth method authority reference does not resolve exactly`};if(l.record.provenance.kind===`wallet_registration`||l.record.provenance.kind===`wallet_recovery`)return await Nt(l.record)?{kind:`resolved`,selection:i.record,authMethod:s.record,authority:l.record,signerMaterials:[],exportRoot:null}:{kind:`integrity_error`,reason:`selected wallet authority digest is invalid`};let u=t.store(E.walletAuthoritySignerMaterials),d=[],f;try{f=Nl(l.record.signerActivations)}catch{return{kind:`integrity_error`,reason:`selected authority signer activations are invalid`}}for(let e of f){let t=await u.get([l.record.authorityId,s.record.walletAuthMethodId,e.materialActivation.activationId]);if(t===void 0)return{kind:`integrity_error`,reason:`selected signer material row is missing`};let n=wl(t);if(!n||n.wallet_authority_id!==l.record.authorityId||n.wallet_auth_method_id!==s.record.walletAuthMethodId||n.activation_id!==e.materialActivation.activationId||n.key_family!==e.keyFamily||!h(n.record.materialActivation,e.materialActivation))return{kind:`integrity_error`,reason:`selected signer material row is invalid`};d.push(n.record)}let p=await t.store(E.walletAuthorityExportRoots).index(D.walletAuthorityAuthMethodId).getAll([l.record.authorityId,s.record.walletAuthMethodId]),m=Fl(l.record.signerActivations)&&l.record.permissions.includes(`export_keys`);if(p.length!==(m?1:0))return{kind:`integrity_error`,reason:`selected authority export-root cardinality is invalid`};let g=null;if(m){let t=Dl(p[0]),n=Pl(l.record.signerActivations);if(!t||n===null||t.wallet_authority_id!==l.record.authorityId||t.wallet_auth_method_id!==s.record.walletAuthMethodId||t.record.walletKeyId!==n||t.record.envelope.walletId!==e||t.record.envelope.binding.kind!==`ed25519_yao_client_root_v1`||t.record.envelope.binding.walletKeyId!==n||t.record.envelope.binding.registeredPublicKeyB64u!==l.record.signerActivations.ed25519?.signer.registeredPublicKeyB64u||l.record.principal.kind!==`owner_device`||String(t.record.envelope.binding.deviceId)!==String(l.record.principal.deviceId)||t.record.envelope.lifecycle.state!==`active`||!Rs(s.record,t.record.envelope))return{kind:`integrity_error`,reason:`selected authority export root is invalid`};g=t.record}return await Nt(l.record)?{kind:`resolved`,selection:i.record,authMethod:s.record,authority:l.record,signerMaterials:d,exportRoot:g}:{kind:`integrity_error`,reason:`selected wallet authority digest is invalid`}}async getAppState(e){let n=t(e||``);if(n)return(await(await this.manager.getDB()).get(E.appState,n))?.value}async listAppStateEntriesByPrefix(e){let n=t(e||``);return n?(await(await this.manager.getDB()).getAll(E.appState)).flatMap(e=>{let t=zs(e);return t&&t.key.startsWith(n)?[t]:[]}):[]}async setAppState(e,n){let r=t(e||``);r&&await this.manager.runTransaction([E.appState],`readwrite`,async e=>{await e.store(E.appState).put({key:r,value:n})})}async putPendingWalletRegistrationCommits(e){let t=e.map(ar);await this.manager.runTransaction([E.appState],`readwrite`,async e=>{let n=e.store(E.appState);for(let e of t){if(await n.get(e.key))throw Error(`Registration checkpoint already exists`);await n.put(e)}})}async advancePendingNearRegistration(e){let t=e.expected,n=e.next;if(t.registrationCeremonyId!==n.registrationCeremonyId||t.walletId!==n.walletId||t.walletAuthMethodId!==n.walletAuthMethodId||t.signedSetup!==n.signedSetup||t.signerPlanKind!==n.signerPlanKind||t.createdAtMs!==n.createdAtMs||n.updatedAtMs<t.updatedAtMs||JSON.stringify(t.auth)!==JSON.stringify(n.auth)||!(t.phase===`planned`&&n.phase===`execution_prepared`||t.phase===`execution_prepared`&&n.phase===`joined`))throw Error(`Invalid NEAR registration checkpoint transition`);if(t.phase===`planned`&&n.phase===`execution_prepared`&&(t.idempotencyKey!==n.idempotencyKey||JSON.stringify(t.admissionRequest)!==JSON.stringify(n.admissionRequest)||JSON.stringify(t.baseCustodyCommit)!==JSON.stringify(n.baseCustodyCommit)))throw Error(`NEAR preparation changed its immutable request`);if(t.phase===`execution_prepared`&&n.phase===`joined`&&(n.completion.kind!==`encrypted_checkpoint`||JSON.stringify(n.completion.prepared)!==JSON.stringify(t)))throw Error(`Joined NEAR must retain its exact encrypted completion checkpoint`);let r=ar(t),i=ar(n);await this.manager.runTransaction([E.appState],`readwrite`,async e=>{let n=e.store(E.appState),a=or(await n.get(r.key));if(!a||JSON.stringify(a.record)!==JSON.stringify(t))throw Error(`NEAR registration checkpoint changed concurrently`);await n.put(i)})}async putPendingWalletRegistrationCommit(e){let t=ar(e);await this.manager.runTransaction([E.appState],`readwrite`,async e=>{await e.store(E.appState).put(t)})}async migratePendingMixedRegistrationRows(){let e=await(await this.manager.getDB()).getAll(E.appState),t=await Promise.all(e.map(sr));await this.manager.runTransaction([E.appState],`readwrite`,async e=>{let n=e.store(E.appState);for(let e of t){if(!e)continue;let t=ar(e.activation);if(JSON.stringify(await n.get(t.key))!==JSON.stringify(e.original))continue;let r=ar(e.near),i=await n.get(r.key);if(i&&JSON.stringify(i)!==JSON.stringify(r))throw Error(`Conflicting NEAR continuation during registration migration`);await n.put(r),await n.put(t)}})}async getPendingWalletRegistrationCommit(e){await this.migratePendingMixedRegistrationRows();let n=t(e.registrationCeremonyId||``);return n&&or(await(await this.manager.getDB()).get(E.appState,ir({registrationCeremonyId:n,operation:e.operation})))?.record||null}async listPendingWalletRegistrationCommits(){return await this.migratePendingMixedRegistrationRows(),(await(await this.manager.getDB()).getAll(E.appState)).flatMap(e=>{let t=or(e);return t?[t.record]:[]})}async deletePendingWalletRegistrationCommit(e){let n=t(e.registrationCeremonyId||``);n&&await this.manager.runTransaction([E.appState],`readwrite`,async t=>{await t.store(E.appState).delete(ir({registrationCeremonyId:n,operation:e.operation}))})}async adoptAddedEcdsaSignerAuthority(e){let t=It(e.authority);if(!t.ok||t.value.state!==`active`||!await Nt(t.value))throw Error(`Added ECDSA signer authority is invalid`);let n=t.value,r=n.signerActivations.ecdsa;if(!r||!h(r.materialActivation,e.materialActivation))throw Error(`Added ECDSA signer authority does not carry the activated signer`);await this.manager.runTransaction([E.walletAuthorities],`readwrite`,async e=>{let t=e.store(E.walletAuthorities),r=fl(await t.get(n.authorityId));if(!r||r.record.state!==`active`)throw Error(`Added ECDSA signer has no active local authority to extend`);if(r.record.authorityDigestB64u!==n.authorityDigestB64u){if(!jt(r.record,n))throw Error(`Added ECDSA signer authority is not an extension of the local authority`);await t.put(pl(n))}})}async replaceExactActiveWalletSessionFromStatus(e){return await this.manager.runTransaction([E.walletAuthorities,E.walletSessionAuthorizations,E.walletSelections],`readwrite`,this.replaceExactActiveWalletSessionFromStatusInTransaction.bind(this,e))}async replaceExactActiveWalletSessionFromStatusInTransaction(e,t){let n=fl(await t.store(E.walletAuthorities).get(e.active.authorityId)),r=Z(await t.store(E.walletSelections).get(e.active.walletId));return!n||n.record.state!==`active`||n.record.walletId!==e.active.walletId||n.record.authorityDigestB64u!==e.active.authorityDigestB64u||n.record.revocationEpoch!==e.active.authorityRevocationEpoch||!r||r.record.lockState!==`unlocked`||r.record.walletAuthMethodId!==e.active.authMethodId?{kind:`superseded`}:(await ta({ctx:t,active:e.active,operationCredential:e.operationCredential}),{kind:`replaced`})}async reconcilePendingNearRegistrationAuthority(e){let t=await this.getWalletAuthority(e.walletSession.authorityId);if(!t||t.state!==`active`||!At(t))return;let n=await this.listPendingWalletRegistrationCommits();for(let r of n){if(r.operation!==`near_provisioning`||r.phase!==`joined`||r.signerPlanKind!==`near_ed25519_and_evm_family_ecdsa`||r.walletId!==e.walletSession.walletId||r.walletAuthMethodId!==e.walletSession.authMethodId)continue;let n=r.localMaterial.ed25519.metadata,i=await Mt({authority:t,ed25519:{kind:`wallet_ed25519_signer_activation_v1`,signer:{kind:`exact_administered_ed25519_signer_v1`,keyFamily:`ed25519`,walletId:r.walletId,walletKeyId:Y(f(`wallet-key:ed25519:${r.walletId}:${n.nearEd25519SigningKeyId}`),`NEAR wallet key`),registeredPublicKeyB64u:re(n.registeredPublicKeyB64u)},materialActivation:n.materialActivation},now:Date.now()});if(!(i.authorityDigestB64u!==e.walletSession.authorityDigestB64u||i.revocationEpoch!==e.walletSession.authorityRevocationEpoch)){await this.manager.runTransaction([E.appState,E.walletAuthorities,E.walletSessionAuthorizations,E.walletSelections],`readwrite`,this.reconcilePendingNearRegistrationAuthorityInTransaction.bind(this,{pending:r,authority:i,previousDigest:t.authorityDigestB64u,walletSession:e.walletSession,operationCredential:e.operationCredential}));return}}}async reconcilePendingNearRegistrationAuthorityInTransaction(e,t){let n=await na({ctx:t,walletId:e.pending.walletId,authorityId:e.authority.authorityId,authMethodId:e.pending.walletAuthMethodId}),r=Z(await t.store(E.walletSelections).get(e.pending.walletId)),i=fl(await t.store(E.walletAuthorities).get(e.authority.authorityId)),a=or(await t.store(E.appState).get(ir(e.pending)));if(n.kind!==`found`||n.operationCredential.token!==e.operationCredential.token||!r||r.record.lockState!==`unlocked`||r.record.walletAuthMethodId!==e.pending.walletAuthMethodId||!i||i.record.state!==`active`||i.record.authorityDigestB64u!==e.previousDigest&&i.record.authorityDigestB64u!==e.authority.authorityDigestB64u||!a||JSON.stringify(a.record)!==JSON.stringify(e.pending))throw Error(`NEAR authority reconciliation was superseded`);qs({incoming:e.walletSession,existing:n.record}),await t.store(E.walletAuthorities).put(pl(e.authority)),await ta({ctx:t,active:e.walletSession,operationCredential:n.operationCredential})}async completePendingNearRegistration(e){await this.manager.runTransaction([E.appState,E.wallets,E.walletSessionAuthorizations,E.walletSelections],`readwrite`,this.completePendingNearRegistrationInTransaction.bind(this,e))}async completePendingNearRegistrationInTransaction(e,t){let n=await na({ctx:t,walletId:e.pending.walletId,authorityId:e.walletSession.authorityId,authMethodId:e.pending.walletAuthMethodId});if(n.kind!==`found`||n.operationCredential.token!==e.operationCredential.token||n.record.authorityDigestB64u!==e.walletSession.authorityDigestB64u)throw Error(`NEAR readiness requires the current Wallet Session`);qs({incoming:e.walletSession,existing:n.record});let r=Z(await t.store(E.walletSelections).get(e.pending.walletId));if(!r||r.record.lockState!==`unlocked`||r.record.walletAuthMethodId!==e.pending.walletAuthMethodId)throw Error(`NEAR readiness was interrupted by a wallet lock or selection change`);let i=ir(e.pending),a=or(await t.store(E.appState).get(i));if(!a||JSON.stringify(a.record)!==JSON.stringify(e.pending))throw Error(`NEAR readiness journal changed concurrently`);let o=J(await t.store(E.wallets).get(e.pending.walletId));if(!o)throw Error(`NEAR readiness requires its committed wallet`);await t.store(E.wallets).put(yc({profileId:o.profileId,nearProvisioning:{status:`near_ready`,nearAccountId:e.nearAccountId,updatedAtMs:Date.now()}},o)),await t.store(E.appState).delete(i)}async putPendingWalletRecoveryCommit(e){let t=await mi(e);await this.manager.runTransaction([E.appState],`readwrite`,async e=>{await e.store(E.appState).put(t)})}async advancePendingWalletRecoveryCommit(e){let t=await pi(e.awaiting),n=await pi(e.promoted);if(t.stage!==`awaiting_server_promotion`||n.stage!==`server_promoted`||!ti(t,n))throw Error(`pending wallet recovery promotion changed its immutable identity`);let r=await mi(t),i=await mi(n);return this.manager.runTransaction([E.appState],`readwrite`,async e=>{let t=e.store(E.appState),a=await t.get(r.key);if(Ai(a,r))return await t.put(i),n;if(Ai(a,i))return n;throw Error(`stored pending wallet recovery commit does not match the expected stage`)})}async getPendingWalletRecoveryCommit(t){let n=Y(e(t),`recoveryOperationId`);return(await hi(await(await this.manager.getDB()).get(E.appState,ni(n))))?.record??null}async listPendingWalletRecoveryCommits(){let e=await this.manager.getDB();return(await Promise.all((await e.getAll(E.appState)).map(hi))).flatMap(e=>e?[e.record]:[])}async deletePendingWalletRecoveryCommit(t){let n=Y(e(t),`recoveryOperationId`);await this.manager.runTransaction([E.appState],`readwrite`,async e=>{await e.store(E.appState).delete(ni(n))})}async getProfile(e){let n=t(e||``);return n?J(await(await this.manager.getDB()).get(E.wallets,n)):null}async getWalletPreferences(e){return(await this.getProfile(e))?.preferences||{}}async listProfiles(e){let t=await this.manager.getDB(),n=Number.isSafeInteger(e?.limit)&&Number(e?.limit)>0?Number(e?.limit):void 0;return(n?await t.getAll(E.wallets,void 0,n):await t.getAll(E.wallets)).flatMap(e=>{let t=J(e);return t?[t]:[]})}async upsertProfile(e){let n=t(e.profileId||``);if(!n)throw Error(`[SeamsWalletDB] profileId is required`);let r=null;if(await this.manager.runTransaction([E.wallets],`readwrite`,async t=>{let i=t.store(E.wallets),a=yc(e,J(await i.get(n))||void 0);r=a.record,await i.put(a)}),!r)throw Error(`[SeamsWalletDB] profile write did not complete`);return r}async upsertWalletAuthMethod(e){let t=Wc(e),n=null;if(await this.manager.runTransaction([E.wallets,E.walletAuthMethods],`readwrite`,async r=>{let i=J(await r.store(E.wallets).get(t.wallet_id));if(!i)throw q(`MISSING_PROFILE`,`Cannot upsert auth-method binding for unknown wallet: ${t.wallet_id}`,{profileId:t.wallet_id,authIdentifierKey:t.auth_identifier_key});let a=r.store(E.walletAuthMethods),o=al(await a.get(t.wallet_auth_method_id)),s=e.kind===`passkey`&&o?.kind===`passkey`?Xc({binding:e,authenticator:o.authenticator}):Qc(e,i.defaultSignerSlot);await a.put(s),n=s.record}),!n)throw Error(`[SeamsWalletDB] auth-method write did not complete`);return n}async upsertWalletAuthMethodV2(e){let t=Lt(e);if(!t)throw Error(`[SeamsWalletDB] auth-method V2 record is invalid`);await this.manager.runTransaction([E.wallets,E.walletAuthMethods],`readwrite`,async e=>{if(!J(await e.store(E.wallets).get(t.walletId)))throw q(`MISSING_PROFILE`,`Cannot upsert auth-method V2 binding for unknown wallet: ${String(t.walletId)}`,{profileId:String(t.walletId)});let n=e.store(E.walletAuthMethods);await n.put(await Sl(n,t))})}async getWalletAuthMethod(e){let n=e.kind,r=t(e.rpId||``),i=t(e.authIdentifierKey||``);if(!r||!i)return null;let a=(await(await this.manager.getDB()).transaction(E.walletAuthMethods,`readonly`).store.index(D.kindRpIdAuthIdentifier).getAll([n,r,i])).flatMap(e=>{let t=ol(e);return t?[t]:[]});return a.length===1?a[0]:null}async listWalletAuthMethodsForWallet(e){let n=t(e||``);return n?(await(await this.manager.getDB()).transaction(E.walletAuthMethods,`readonly`).store.index(D.walletId).getAll(n)).flatMap(e=>{let t=ol(e);return t?[t]:[]}):[]}async upsertChainAccount(e){let n=t(e.profileId||``),r=O(e.chainIdKey),i=k(e.accountAddress);if(!n||!r||!i)throw Error(`[SeamsWalletDB] profileId, chainIdKey, and accountAddress are required`);let a=null;if(await this.manager.runTransaction([E.wallets,E.nearAccountProjections],`readwrite`,async t=>{if(!J(await t.store(E.wallets).get(n)))throw Error(`[SeamsWalletDB] Cannot upsert chain account for unknown profile: ${n}`);let o=t.store(E.nearAccountProjections),s=pc({chainIdKey:r,accountAddress:i}),c=au(e,su(await o.get([n,s,0]))||void 0);if(a=c.record,c.record.isPrimary){let e=await o.index(D.profileId).getAll(n);for(let t of e||[]){let e=su(t);!e||e.chainIdKey!==r||!e.isPrimary||e.accountAddress!==i&&await o.put(au({profileId:e.profileId,chainIdKey:e.chainIdKey,accountAddress:e.accountAddress,accountModel:e.accountModel,isPrimary:!1},e))}}await o.put(c)}),!a)throw Error(`[SeamsWalletDB] chain-account write did not complete`);return a}async listChainAccountsByProfile(e){let n=t(e||``);if(!n)return[];let r=(await this.manager.getDB()).transaction(E.nearAccountProjections,`readonly`),i=await r.store.index(D.profileId).getAll(n);return await r.done,i.flatMap(e=>{let t=su(e);return t?[t]:[]})}async listChainAccountsByProfileAndChain(e,t){let n=O(t);return n?(await this.listChainAccountsByProfile(e)).filter(e=>e.chainIdKey===n):[]}async getChainAccount(e){let n=t(e.profileId||``),r=O(e.chainIdKey),i=k(e.accountAddress);return!n||!r||!i?null:su(await(await this.manager.getDB()).get(E.nearAccountProjections,[n,pc({chainIdKey:r,accountAddress:i}),0]))}async resolveProfileAccountContext(e){let t=O(e.chainIdKey),n=k(e.accountAddress);if(!t||!n)return null;let r=(await(await this.manager.getDB()).getAll(E.nearAccountProjections)).flatMap(e=>{let t=su(e);return t?[t]:[]}).find(e=>e.chainIdKey===t&&e.accountAddress===n);return r?.profileId?{profileId:r.profileId,accountRef:{chainIdKey:t,accountAddress:n}}:null}async listChainAccountsByChain(e){let t=O(e);return t?(await(await this.manager.getDB()).getAll(E.nearAccountProjections)).flatMap(e=>{let n=su(e);return n&&n.chainIdKey===t?[n]:[]}):[]}buildAccountSignerRecord(e){let n=e.status===`revoked`?e.removedAt??e.existing?.removedAt??e.now:void 0;return{profileId:e.profileId,chainIdKey:e.chainIdKey,accountAddress:e.accountAddress,signerId:e.signerId,signerSlot:e.signerSlot,signerType:e.signerType,signerKind:e.signerKind,signerAuthMethod:e.signerAuthMethod,signerSource:e.signerSource,status:e.status,addedAt:e.existing?.addedAt??e.now,updatedAt:e.now,...n==null?{}:{removedAt:n},...e.revocationReason?{revocationReason:t(e.revocationReason)}:e.existing?.revocationReason?{revocationReason:e.existing.revocationReason}:{},...e.metadata==null?e.existing?.metadata==null?{}:{metadata:e.existing.metadata}:{metadata:e.metadata}}}assertSignerWriteInvariants(e){let{next:n}=e;if(n.status!==`revoked`&&(!n.signerKind||!n.signerAuthMethod||!n.signerSource))throw q(`MISSING_SIGNER_KIND`,`Active and pending account signers require signerKind, signerAuthMethod, and signerSource`,{chainIdKey:n.chainIdKey,accountAddress:n.accountAddress,signerId:n.signerId,status:n.status});if(n.status===`revoked`&&n.removedAt==null)throw q(`REVOKED_SIGNER_REQUIRES_REMOVED_AT`,`Revoked signer ${n.signerId} must include removedAt`,{chainIdKey:n.chainIdKey,accountAddress:n.accountAddress,signerId:n.signerId});if(n.status===`active`){let t=e.activeSigners.find(e=>e.signerId!==n.signerId&&e.signerSlot===n.signerSlot);if(t)throw q(`DUPLICATE_ACTIVE_SIGNER_SLOT`,`Active signer slot ${n.signerSlot} is already used for ${n.chainIdKey}/${n.accountAddress}`,{chainIdKey:n.chainIdKey,accountAddress:n.accountAddress,signerId:n.signerId,signerSlot:n.signerSlot,conflictingSignerId:t.signerId})}if(e.existingStatus&&e.existingStatus!==n.status&&!{pending:new Set([`pending`,`active`,`revoked`]),active:new Set([`active`,`revoked`]),revoked:new Set([`revoked`])}[e.existingStatus]?.has(n.status))throw q(`INVALID_SIGNER_STATUS_TRANSITION`,`Invalid signer status transition ${e.existingStatus} -> ${n.status}`,{chainIdKey:n.chainIdKey,accountAddress:n.accountAddress,signerId:n.signerId,previousStatus:e.existingStatus,nextStatus:n.status});if(n.status===`active`&&String(n.signerKind||``)===`threshold-ecdsa`){let e=n.metadata||{};if(!t(e.keyHandle))throw q(`INVALID_SIGNER_METADATA`,`Active threshold ECDSA signer requires metadata.keyHandle`,{chainIdKey:n.chainIdKey,accountAddress:n.accountAddress,signerId:n.signerId});if(!t(e.ecdsaThresholdKeyId))throw q(`INVALID_SIGNER_METADATA`,`Active threshold ECDSA signer requires metadata.ecdsaThresholdKeyId`,{chainIdKey:n.chainIdKey,accountAddress:n.accountAddress,signerId:n.signerId});let r=k(e.thresholdOwnerAddress);if(!r||r!==n.accountAddress)throw q(`INVALID_SIGNER_METADATA`,`Active threshold ECDSA signer requires metadata.thresholdOwnerAddress matching accountAddress`,{chainIdKey:n.chainIdKey,accountAddress:n.accountAddress,signerId:n.signerId});let i=gc(e.chainTarget);if(!i)throw q(`INVALID_SIGNER_METADATA`,`Active threshold ECDSA signer requires metadata.chainTarget`,{chainIdKey:n.chainIdKey,accountAddress:n.accountAddress,signerId:n.signerId});if(i!==n.chainIdKey)throw q(`INVALID_SIGNER_METADATA`,`Active threshold ECDSA signer metadata.chainTarget must match chainIdKey`,{chainIdKey:n.chainIdKey,chainTargetKey:i,accountAddress:n.accountAddress,signerId:n.signerId})}}async enqueueSignerOperationInTransaction(e,n){let r=t(n.opId||``),i=t(n.idempotencyKey||``),a=O(n.chainIdKey),o=k(n.accountAddress),s=t(n.signerId||``);if(!r||!i||!a||!o||!s)throw Error(`[SeamsWalletDB] opId, idempotencyKey, chainIdKey, accountAddress, and signerId are required`);let c=pu(await e.get(r));if(!c){let t=pu(await e.index(D.idempotencyKey).get(i));if(t)return t}let l=Date.now(),u={opId:r,idempotencyKey:i,opType:n.opType,chainIdKey:a,accountAddress:o,signerId:s,payload:n.payload??c?.payload,status:n.status??c?.status??`queued`,attemptCount:n.attemptCount??c?.attemptCount??0,nextAttemptAt:n.nextAttemptAt??c?.nextAttemptAt??l,lastError:n.lastError??c?.lastError,txHash:n.txHash??c?.txHash,createdAt:c?.createdAt??l,updatedAt:l};return await e.put(du(u)),u}async activateAccountSignerInTransaction(e,n){let r=t(n.account.profileId||``),i=O(n.account.chainIdKey),a=k(n.account.accountAddress),o=ot(n.account.accountModel),s=t(n.signer.signerId||``),c=n.signer.signerKind,l=n.signer.signerAuthMethod,u=n.signer.signerSource;if(!r||!i||!a||!o||!s||!c||!l||!u)throw Error(`[SeamsWalletDB] profileId, chainIdKey, accountAddress, accountModel, signerId, signerKind, signerAuthMethod, and signerSource are required`);let d=e.store(E.walletSigners);if(!J(await e.store(E.wallets).get(r)))throw q(`MISSING_PROFILE`,`Cannot upsert signer without profile row: ${r}`,{profileId:r,chainIdKey:i,accountAddress:a,signerId:s});if(vc({accountModel:o,chainIdKey:i})){let t=e.store(E.nearAccountProjections),s=su(await t.get([r,pc({chainIdKey:i,accountAddress:a}),0])),c=au({profileId:r,chainIdKey:i,accountAddress:a,accountModel:o,isPrimary:n.selectAsActive===!0?!0:s?.isPrimary??!0},s||void 0);await t.put(c)}let f=(await d.index(D.status).getAll(`active`)).flatMap(e=>{let t=Q(e);return t?[t]:[]}),p=f.flatMap(e=>e.chainIdKey===i&&e.accountAddress===a?[e]:[]),m=Zn({activeSigners:p,signer:{signerId:s,signerKind:c,signerAuthMethod:l,signerSource:u},activationPolicy:n.activationPolicy,...n.preferredSlot==null?{}:{preferredSlot:n.preferredSlot}}),h=Date.now();await this.revokeSignersForReplacement({signerStore:d,allActiveSigners:f,accountActiveSigners:p,profileId:r,chainIdKey:i,accountModel:o,signerId:s,activationPolicy:n.activationPolicy,now:h});let g=this.activeSignersAfterReplacement({allActiveSigners:f,accountActiveSigners:p,profileId:r,chainIdKey:i,signerId:s,activationPolicy:n.activationPolicy}),_=Q(await d.get(mc({chainIdKey:i,accountAddress:a,signerId:s})));if(_&&_.profileId!==r)throw q(`CHAIN_ACCOUNT_PROFILE_MISMATCH`,`Signer row belongs to a different profile for ${i}/${a}/${s}`,{expectedProfileId:r,existingProfileId:_.profileId});let v=this.buildAccountSignerRecord({profileId:r,chainIdKey:i,accountAddress:a,signerId:s,signerSlot:m.signerSlot,signerType:n.signer.signerType,signerKind:c,signerAuthMethod:l,signerSource:u,status:`active`,existing:_||void 0,now:h,...n.signer.metadata?{metadata:n.signer.metadata}:{}});this.assertSignerWriteInvariants({next:v,accountModel:o,existingStatus:_?.status,activeSigners:g});let y=cu(v);if(await uu({store:d,nextRow:y}),await d.put(y),(n.selectAsActive??!0)&&await e.store(E.appState).put({key:fc(),value:{profileId:r,activeSignerSlot:m.signerSlot}}),n.mutation?.routeThroughOutbox??!1){let r=t(n.mutation?.opId||``)||nc(`add-signer`),i=t(n.mutation?.idempotencyKey||``)||`add-signer:${v.chainIdKey}:${v.accountAddress}:${v.signerId}:${v.signerSlot}`;await this.enqueueSignerOperationInTransaction(e.store(E.signerOpsOutbox),{opId:r,idempotencyKey:i,opType:`add-signer`,chainIdKey:v.chainIdKey,accountAddress:v.accountAddress,signerId:v.signerId,payload:this.signerOutboxPayload(v,n.mutation),status:n.mutation?.outboxStatus||`queued`})}return{signer:v,signerSlot:m.signerSlot}}activeSignersAfterReplacement(e){let t=new Set;for(let n of this.signersRetiredByActivationPolicy(e))t.add(n.signerId);if(t.size===0)return e.accountActiveSigners;let n=[];for(let r of e.accountActiveSigners)t.has(r.signerId)||n.push(r);return n}signersRetiredByActivationPolicy(e){let t=[];switch(e.activationPolicy.mode){case`replace_slot`:for(let n of e.accountActiveSigners)n.signerSlot===e.activationPolicy.signerSlot&&n.signerId!==e.signerId&&t.push(n);return t;case`replace_profile_chain_kind`:for(let n of e.allActiveSigners)n.profileId===e.profileId&&n.chainIdKey===e.chainIdKey&&n.signerKind===e.activationPolicy.replacedSignerKind&&n.signerId!==e.signerId&&t.push(n);return t;default:return t}}async revokeSignersForReplacement(e){let n=this.signersRetiredByActivationPolicy(e);if(n.length===0)return;let r=t(e.activationPolicy.mode===`replace_slot`||e.activationPolicy.mode===`replace_profile_chain_kind`?e.activationPolicy.revocationReason:``);for(let t of n){let n=this.buildAccountSignerRecord({...t,status:`revoked`,existing:t,now:e.now,removedAt:e.now,revocationReason:r});this.assertSignerWriteInvariants({next:n,accountModel:e.accountModel,existingStatus:t.status,activeSigners:e.accountActiveSigners}),await e.signerStore.put(cu(n))}}async activateAccountSigner(e){let t=null;if(await this.manager.runTransaction([E.appState,E.wallets,E.wallets,E.nearAccountProjections,E.walletSigners,E.appState,E.signerOpsOutbox],`readwrite`,async n=>{t=await this.activateAccountSignerInTransaction(n,e)}),!t)throw Error(`[SeamsWalletDB] signer activation did not complete`);return t}async stageAccountSigner(e){return this.writePreparedAccountSigner({account:e.account,signer:e.signer,status:`pending`,signerSlot:e.signer.signerSlot,mutation:e.mutation})}async writePreparedAccountSigner(e){let n=t(e.account.profileId||``),r=O(e.account.chainIdKey),i=k(e.account.accountAddress),a=ot(e.account.accountModel),o=t(e.signer.signerId||``),s=Number(e.signerSlot),c=e.signer.signerKind,l=e.signer.signerAuthMethod,u=e.signer.signerSource;if(!n||!r||!i||!a||!o||!c||!l||!u)throw Error(`[SeamsWalletDB] profileId, chainIdKey, accountAddress, accountModel, signerId, signerKind, signerAuthMethod, and signerSource are required`);if(!Number.isSafeInteger(s)||s<1)throw Error(`[SeamsWalletDB] signerSlot must be an integer >= 1`);let d=null;if(await this.manager.runTransaction([E.wallets,E.nearAccountProjections,E.walletSigners,E.signerOpsOutbox],`readwrite`,async f=>{if(!J(await f.store(E.wallets).get(n)))throw q(`MISSING_PROFILE`,`Cannot upsert signer without profile row: ${n}`,{profileId:n,chainIdKey:r,accountAddress:i,signerId:o});let p=f.store(E.nearAccountProjections),m=su(await p.get([n,pc({chainIdKey:r,accountAddress:i}),0])),h=au({profileId:n,chainIdKey:r,accountAddress:i,accountModel:a,isPrimary:m?.isPrimary},m||void 0);await p.put(h);let g=f.store(E.walletSigners),_=Q(await g.get(mc({chainIdKey:r,accountAddress:i,signerId:o})));if(_&&_.profileId!==n)throw q(`CHAIN_ACCOUNT_PROFILE_MISMATCH`,`Signer row belongs to a different profile for ${r}/${i}/${o}`,{expectedProfileId:n,existingProfileId:_.profileId});let v=(await g.index(D.status).getAll(`active`)).flatMap(e=>{let t=Q(e);return t&&t.chainIdKey===r&&t.accountAddress===i?[t]:[]}),y=Date.now(),b=this.buildAccountSignerRecord({profileId:n,chainIdKey:r,accountAddress:i,signerId:o,signerSlot:s,signerType:e.signer.signerType,signerKind:c,signerAuthMethod:l,signerSource:u,status:e.status,existing:_||void 0,now:y,...e.signer.metadata?{metadata:e.signer.metadata}:{}});this.assertSignerWriteInvariants({next:b,accountModel:a,existingStatus:_?.status,activeSigners:v});let x=cu(b);if(await uu({store:g,nextRow:x}),await g.put(x),e.mutation?.routeThroughOutbox??!1){let n=t(e.mutation?.opId||``)||nc(`add-signer`),r=t(e.mutation?.idempotencyKey||``)||`add-signer:${b.chainIdKey}:${b.accountAddress}:${b.signerId}:${b.signerSlot}`;await this.enqueueSignerOperationInTransaction(f.store(E.signerOpsOutbox),{opId:n,idempotencyKey:r,opType:`add-signer`,chainIdKey:b.chainIdKey,accountAddress:b.accountAddress,signerId:b.signerId,payload:this.signerOutboxPayload(b,e.mutation),status:e.mutation?.outboxStatus||`queued`})}d={signer:b,signerSlot:s}}),!d)throw Error(`[SeamsWalletDB] signer write did not complete`);return d}signerOutboxPayload(e,t){return{profileId:e.profileId,signerSlot:e.signerSlot,signerType:e.signerType,signerKind:e.signerKind,signerAuthMethod:e.signerAuthMethod,signerSource:e.signerSource,...e.metadata?{signerMetadata:e.metadata}:{},...t?.outboxPayload?t.outboxPayload:{}}}async listAccountSigners(e){let t=O(e.chainIdKey),n=k(e.accountAddress);if(!t||!n)return[];let r=await this.manager.getDB();return(e.status?await r.transaction(E.walletSigners,`readonly`).store.index(D.status).getAll(e.status):await r.getAll(E.walletSigners)).flatMap(e=>{let r=Q(e);return r&&r.chainIdKey===t&&r.accountAddress===n?[r]:[]})}async listAccountSignersByProfile(e){let n=t(e.profileId||``);return n?(await(await this.manager.getDB()).transaction(E.walletSigners,`readonly`).store.index(D.walletId).getAll(n)).flatMap(t=>{let n=Q(t);return n&&(!e.status||n.status===e.status)?[n]:[]}):[]}async listActiveWalletSigners(e){let n=t(e.walletId||``);if(!n)return[];let r=e.signerFamily===`ecdsa`?Qe.thresholdEcdsa:Qe.thresholdEd25519,i=[n],a=(await this.getProfile(n))?.nearProvisioning;a?.status===`near_ready`&&a.nearAccountId&&i.push(String(st(mt(a.nearAccountId))));let o=[],s=new Set;for(let e of i){let i=await this.listAccountSignersByProfile({profileId:e,status:`active`});for(let e of i){if(e.signerKind!==r)continue;let i=t(String(e.metadata?.walletId??``));if(i&&i!==n)continue;let a=`${e.chainIdKey}/${e.accountAddress}/${e.signerId}`;s.has(a)||(s.add(a),o.push(e))}}return o}async getActiveWalletSignerForChainTarget(e){let n=t(e.walletId||``);if(!n)return null;let r=it(e.chainTarget),i=(await this.listActiveWalletSigners({walletId:n,signerFamily:`ecdsa`})).filter(e=>e.chainIdKey===r);if(i.length>1)throw Error(`[SeamsWalletDB] ambiguous active ECDSA wallet signer for ${n}/${r}`);return i[0]||null}async getAccountSigner(e){let n=O(e.chainIdKey),r=k(e.accountAddress),i=t(e.signerId||``);return!n||!r||!i?null:Q(await(await this.manager.getDB()).get(E.walletSigners,mc({chainIdKey:n,accountAddress:r,signerId:i})))}async setAccountSignerStatus(e){let n=await this.getAccountSigner(e);if(!n)return null;let r=await this.getChainAccount({profileId:n.profileId,chainIdKey:n.chainIdKey,accountAddress:n.accountAddress});if(!r)throw q(`MISSING_CHAIN_ACCOUNT`,`Cannot update signer status without chain account row: ${n.profileId}/${n.chainIdKey}/${n.accountAddress}`,{profileId:n.profileId,chainIdKey:n.chainIdKey,accountAddress:n.accountAddress,signerId:n.signerId});let i=null;return await this.manager.runTransaction([E.walletSigners,E.signerOpsOutbox],`readwrite`,async a=>{let o=a.store(E.walletSigners),s=(await o.index(D.status).getAll(`active`)).flatMap(e=>{let t=Q(e);return t&&t.chainIdKey===n.chainIdKey&&t.accountAddress===n.accountAddress?[t]:[]}),c=this.buildAccountSignerRecord({...n,status:e.status,existing:n,now:Date.now(),...e.removedAt==null?{}:{removedAt:e.removedAt},...e.revocationReason?{revocationReason:e.revocationReason}:{}});if(this.assertSignerWriteInvariants({next:c,accountModel:r.accountModel,existingStatus:n.status,activeSigners:s}),await o.put(cu(c)),e.mutation?.routeThroughOutbox??!0){let n=e.status===`revoked`?`revoke-signer`:`add-signer`,r=t(e.mutation?.opId||``)||nc(n),i=t(e.mutation?.idempotencyKey||``)||`signer-status:${e.status}:${c.chainIdKey}:${c.accountAddress}:${c.signerId}`;await this.enqueueSignerOperationInTransaction(a.store(E.signerOpsOutbox),{opId:r,idempotencyKey:i,opType:n,chainIdKey:c.chainIdKey,accountAddress:c.accountAddress,signerId:c.signerId,payload:{profileId:c.profileId,signerSlot:c.signerSlot,status:c.status,...c.removedAt==null?{}:{removedAt:c.removedAt},...c.revocationReason?{revocationReason:c.revocationReason}:{},...e.mutation?.outboxPayload?e.mutation.outboxPayload:{}},status:e.mutation?.outboxStatus||`queued`})}i=c}),i}async enqueueSignerOperation(e){let t=null;if(await this.manager.runTransaction([E.signerOpsOutbox],`readwrite`,async n=>{t=await this.enqueueSignerOperationInTransaction(n.store(E.signerOpsOutbox),e)}),!t)throw Error(`[SeamsWalletDB] signer op enqueue did not complete`);return t}async listSignerOperations(e){let t=e?.statuses&&e.statuses.length>0?e.statuses:[`queued`,`submitted`,`failed`],n=typeof e?.dueBefore==`number`?e.dueBefore:Date.now(),r=Number.isFinite(n)?n:2**53-1,i=Number.isSafeInteger(e?.limit)&&Number(e?.limit)>0?Number(e?.limit):100,a=await this.manager.getDB(),o=[];for(let e of t){let t=a.transaction(E.signerOpsOutbox,`readonly`),n=await t.store.index(D.statusNextAttemptAt).getAll(IDBKeyRange.bound([e,-(2**53-1)],[e,r]));await t.done,o.push(...(n||[]).flatMap(e=>{let t=pu(e);return t?[t]:[]}))}return o.sort((e,t)=>{let n=(e.nextAttemptAt||0)-(t.nextAttemptAt||0);return n===0?String(e.opId||``).localeCompare(String(t.opId||``)):n}),o.slice(0,i)}async setSignerOperationStatus(e){let n=t(e.opId||``);if(!n)return null;let r=null;return await this.manager.runTransaction([E.signerOpsOutbox],`readwrite`,async t=>{let i=t.store(E.signerOpsOutbox),a=pu(await i.get(n));if(!a)return;let o=Number.isFinite(e.attemptDelta)?Number(e.attemptDelta):0,s=Math.max(0,(a.attemptCount||0)+o),c={...a,status:e.status,attemptCount:s,nextAttemptAt:typeof e.nextAttemptAt==`number`?e.nextAttemptAt:a.nextAttemptAt,...e.lastError===null?{lastError:void 0}:typeof e.lastError==`string`?{lastError:e.lastError}:{lastError:a.lastError},...e.txHash===null?{txHash:void 0}:typeof e.txHash==`string`?{txHash:e.txHash}:{txHash:a.txHash},updatedAt:Date.now()};await i.put(du(c)),r=c}),r}async getProfileContinuitySnapshot(e){let t=await this.getProfile(e);return t?{profile:t,chainAccounts:await this.listChainAccountsByProfile(t.profileId),accountSigners:await this.listAccountSignersByProfile({profileId:t.profileId})}:null}async listProfileAuthenticators(e){let n=t(e||``);if(!n)return[];let r=(await this.manager.getDB()).transaction(E.walletAuthMethods,`readonly`),i=await r.store.index(D.walletIdKind).getAll([n,`passkey`]);return await r.done,i.flatMap(e=>{let t=sl(e);return t?[t]:[]})}async listWalletPasskeyAuthenticators(e){let t=await this.listProfileAuthenticators(e),n=(await this.getProfile(e))?.nearProvisioning;if(n?.status!==`near_ready`||!n.nearAccountId)return t;let r=String(st(mt(n.nearAccountId)));if(r===e)return t;let i=await this.listProfileAuthenticators(r),a=new Set(t.map(e=>e.credentialId));return[...t,...i.filter(e=>!a.has(e.credentialId))]}async getWalletPasskeyAuthenticator(e){let n=t(e.credentialId||``);return n?(await this.listWalletPasskeyAuthenticators(e.walletId)).find(e=>e.credentialId===n)??null:null}async upsertProfileAuthenticator(e){let t=qc(e);await this.manager.runTransaction([E.wallets,E.walletAuthMethods],`readwrite`,async e=>{if(!J(await e.store(E.wallets).get(t.profileId)))throw q(`MISSING_PROFILE`,`Cannot upsert authenticator for unknown profile: ${t.profileId}`,{profileId:t.profileId,credentialId:t.credentialId});let n=e.store(E.walletAuthMethods),r=al(await n.index(D.passkeyRpIdCredentialId).get([`passkey`,Qs,t.credentialId])),i=$c(t,r?.kind===`passkey`?r:void 0);await n.put(i)})}async getProfileAuthenticatorByCredentialId(e,n){let r=t(e||``),i=t(n||``);if(!r||!i)return null;let a=sl(await(await this.manager.getDB()).transaction(E.walletAuthMethods,`readonly`).store.index(D.passkeyRpIdCredentialId).get([`passkey`,Qs,i]));return a?.profileId===r?a:null}async persistWalletRegistrationFinalize(e){return this.manager.runTransaction(Ys,`readwrite`,this.persistWalletRegistrationFinalizeInTransaction.bind(this,e))}async publishPendingWalletRegistrationCommit(e){return await this.publishPendingWalletRegistrationCommitWithDisposition(e,!0)}async publishPendingWalletRegistrationCommitAndRetain(e){return await this.publishPendingWalletRegistrationCommitWithDisposition(e,!1)}async publishPendingWalletRegistrationCommitWithDisposition(e,t){let n=lr(e.pending),r=Fe(e.authority);if(!r)throw Error(`registration wallet auth authority is invalid`);let i=Us(e.foundingAuthority);await Ws({request:e.request,pending:n,authority:r,foundingAuthority:i,registration:e.registration});let a=e.walletSessionPublication.walletSession;if(a.walletId!==n.walletId||a.authorityId!==i.authority.authorityId||a.authMethodId!==n.walletAuthMethodId||a.authorityDigestB64u!==i.authority.authorityDigestB64u||a.authorityRevocationEpoch!==i.authority.revocationEpoch)throw Error(`registration Wallet Session identity does not match the pending wallet`);return this.manager.runTransaction(Xs,`readwrite`,this.publishPendingWalletRegistrationCommitInTransaction.bind(this,{request:e.request,pending:n,authority:r,foundingAuthority:i,registration:e.registration,ecdsaContinuity:e.ecdsaContinuity,walletSessionPublication:e.walletSessionPublication,deletePending:t}))}async publishPendingWalletRecoveryCommit(e){let t=await pi(e.pending);if(t.stage!==`server_promoted`)throw Error(`pending wallet recovery commit is not server-promoted`);let n=Y(It(e.authority),`authority`);if(n.state!==`active`||!Pt(n))throw Error(`recovered Wallet Authority projection is invalid`);let r=Lt(e.authMethod);if(!r||r.status!==`active`)throw Error(`recovered Wallet Auth Method projection is invalid`);if(!await Nt(n))throw Error(`recovered Wallet Authority digest is invalid`);let i={pending:t,authority:n,authMethod:r,registration:e.registration,ecdsaContinuity:e.ecdsaContinuity,ed25519PublicCapabilityReferences:e.ed25519PublicCapabilityReferences};Gs(i);let a=await mi(t);return this.manager.runTransaction(Zs,`readwrite`,this.publishPendingWalletRecoveryCommitInTransaction.bind(this,{...i,pendingRow:a}))}async publishPendingWalletRegistrationCommitInTransaction(e,t){let n=ir({registrationCeremonyId:e.request.registrationCeremonyId,operation:e.request.operation}),r=or(await t.store(E.appState).get(n)),i=r?.record;if(i&&Hs(i,e.request),!r||!i||r?.registration_ceremony_id!==e.request.registrationCeremonyId||r.operation!==e.request.operation||r.wallet_id!==e.request.walletId||r.wallet_auth_method_id!==e.request.walletAuthMethodId||r.updated_at_ms!==e.pending.updatedAtMs||i.idempotencyKey!==e.pending.idempotencyKey||i.signerPlanKind!==e.pending.signerPlanKind)throw Error(`stored pending wallet registration commit does not match the expected row`);let a=!1;if(e.walletSessionPublication.kind===`issued`)await ta({ctx:t,active:e.walletSessionPublication.walletSession,operationCredential:e.walletSessionPublication.operationCredential});else{let n=await na({ctx:t,walletId:e.pending.walletId,authorityId:e.foundingAuthority.authority.authorityId,authMethodId:e.pending.walletAuthMethodId});if(n.kind!==`found`)throw Error(`Credential-free registration projection has no exact local Wallet Session`);qs({incoming:e.walletSessionPublication.walletSession,existing:n.record}),await ta({ctx:t,active:e.walletSessionPublication.walletSession,operationCredential:n.operationCredential}),a=!0}let o=await this.persistWalletRegistrationFinalizeInTransaction(e.registration,t);await this.persistFoundingWalletAuthorityInTransaction(e.foundingAuthority,e.walletSessionPublication.kind===`credential_free_projection`?`preserve`:`activate`,t);for(let n of e.ecdsaContinuity)await ls(t,n);return e.deletePending&&(e.walletSessionPublication.kind===`issued`?Ks(e.pending):a)&&await t.store(E.appState).delete(n),o}async publishPendingWalletRecoveryCommitInTransaction(e,t){if(!Ai(await t.store(E.appState).get(e.pendingRow.key),e.pendingRow))throw Error(`stored pending wallet recovery commit does not match the expected row`);let n=await this.persistWalletRegistrationFinalizeInTransaction(e.registration,t);await this.persistRecoveredWalletAuthorityInTransaction({authority:e.authority,authMethod:e.authMethod,recoveredAtMs:e.pending.updatedAtMs},t),await dc({store:t.store(E.ecdsaClientPresignatures),indexName:D.walletId,key:IDBKeyRange.only(String(e.authority.walletId))});for(let n of e.ecdsaContinuity)await ls(t,n);let r=t.store(E.appState);for(let t of e.ed25519PublicCapabilityReferences)await Fs(r,t);return await t.store(E.appState).delete(e.pendingRow.key),n}async persistWalletRegistrationFinalizeInTransaction(e,n){let r=iu(e),i=e.keyMaterials.map(e=>gu(e)),a=[],o=n.store(E.wallets);for(let n of e.profiles){let e=t(n.profileId||``);if(!e)throw Error(`[SeamsWalletDB] profileId is required`);let r=J(await o.get(e))||void 0;await o.put(yc(n,r))}let s=n.store(E.walletAuthMethods);for(let e of r){if(!J(await o.get(e.wallet_id)))throw q(`MISSING_PROFILE`,`Cannot upsert auth method for unknown wallet: ${e.wallet_id}`,{profileId:e.wallet_id,authIdentifierKey:e.auth_identifier_key});await s.put(e)}for(let t of e.signerActivations)a.push(await this.activateAccountSignerInTransaction(n,t));await Du({ctx:n,signers:a.map(e=>e.signer),keyMaterials:e.keyMaterials});let c=n.store(E.keyMaterial);for(let e of i)await c.put(e);return e.lastProfileState&&await n.store(E.appState).put({key:fc(e.lastProfileState.scope),value:{profileId:e.lastProfileState.profileId,activeSignerSlot:e.lastProfileState.activeSignerSlot,...e.lastProfileState.scope?{scope:at(e.lastProfileState.scope)}:{}}}),{signerActivations:a}}async persistWalletSignerFinalize(e){let n=e.keyMaterials.map(e=>gu(e)),r=[],i=[],a=null;return await this.manager.runTransaction([E.appState,E.wallets,E.walletSigners,E.nearAccountProjections,E.signerOpsOutbox,E.keyMaterial],`readwrite`,async o=>{let s=o.store(E.wallets);if(e.lastProfileState){let t=o.store(E.appState),n=fc(e.lastProfileState.scope),r=zs(await t.get(n));a={key:n,committed:{profileId:e.lastProfileState.profileId,activeSignerSlot:e.lastProfileState.activeSignerSlot,...e.lastProfileState.scope?{scope:at(e.lastProfileState.scope)}:{}},previousPresent:r!==null,previousValue:r?.value}}for(let n of e.profiles){let e=t(n.profileId||``);if(!e)throw Error(`[SeamsWalletDB] profileId is required`);let r=J(await s.get(e)),a=yc(n,r||void 0);await s.put(a),i.push({committed:a.record,previous:r})}for(let t of e.signerActivations)r.push(await this.activateAccountSignerInTransaction(o,t));await Du({ctx:o,signers:r.map(e=>e.signer),keyMaterials:e.keyMaterials});let c=o.store(E.keyMaterial);for(let e of n)await c.put(e);if(e.lastProfileState){let e=o.store(E.appState);if(!a)throw Error(`[SeamsWalletDB] last profile rollback state was not captured`);await e.put({key:a.key,value:a.committed})}}),{signerActivations:r,rollbackReceipt:{kind:`wallet_signer_finalize_rollback_v1`,profiles:i,signers:r.map(e=>({committed:e.signer,metadataBaseline:Ac(e.signer.metadata)})),keyMaterials:n.map(e=>({committed:e.record,payloadBaseline:Mc(e.record.payload)})),lastProfileState:a}}}async rollbackWalletSignerFinalize(e){if(e.kind!==`wallet_signer_finalize_rollback_v1`)throw Error(`[SeamsWalletDB] invalid wallet signer rollback receipt`);await this.manager.runTransaction([E.appState,E.wallets,E.walletSigners,E.keyMaterial],`readwrite`,async t=>{let n=t.store(E.wallets),r=t.store(E.walletSigners),i=t.store(E.keyMaterial),a=t.store(E.appState);for(let t of e.profiles){let e=J(await n.get(t.committed.profileId));if(e===null||!wc(e,t.committed))throw Error(`[SeamsWalletDB] wallet signer rollback profile changed`)}for(let t of e.signers){let e=t.committed,n=mc({chainIdKey:e.chainIdKey,accountAddress:e.accountAddress,signerId:e.signerId}),i=Q(await r.get(n));if(i===null||!Pc(i,e,t.metadataBaseline))throw Error(`[SeamsWalletDB] wallet signer rollback signer changed`)}for(let t of e.keyMaterials){let e=t.committed,n=mu({walletSignerId:hu(e),keyKind:e.keyKind}),r=bu(await i.get(n));if(r===null||!Fc(r,e,t.payloadBaseline))throw Error(`[SeamsWalletDB] wallet signer rollback key material changed`)}if(e.lastProfileState){let t=Qn(zs(await a.get(e.lastProfileState.key))?.value);if(t===null||!Lc(t,e.lastProfileState.committed))throw Error(`[SeamsWalletDB] wallet signer rollback selection changed`)}for(let t of e.signers){let e=t.committed;await r.delete(mc({chainIdKey:e.chainIdKey,accountAddress:e.accountAddress,signerId:e.signerId}))}for(let t of e.keyMaterials){let e=t.committed;await i.delete(mu({walletSignerId:hu(e),keyKind:e.keyKind}))}for(let t of e.profiles)t.previous?await n.put(bc(t.previous)):await n.delete(t.committed.profileId);e.lastProfileState&&(e.lastProfileState.previousPresent?await a.put({key:e.lastProfileState.key,value:e.lastProfileState.previousValue}):await a.delete(e.lastProfileState.key))})}async clearProfileAuthenticators(e){let n=t(e||``);n&&await this.manager.runTransaction([E.walletAuthMethods],`readwrite`,async e=>{let t=await e.store(E.walletAuthMethods).index(D.walletIdKind).openCursor(IDBKeyRange.only([n,`passkey`]));for(;t;)await t.delete(),t=await t.continue()})}async selectProfileAuthenticatorsForPrompt(e){let n=t(e.profileId||``),r=Array.isArray(e.authenticators)?e.authenticators:[];if(!n||r.length<=1)return{authenticatorsForPrompt:r};let i=await this.getLastProfileState().catch(()=>null);if(!i)return{authenticatorsForPrompt:r};let a=Number(i.activeSignerSlot),o=r.filter(e=>e.signerSlot===a),s=t(o[0]?.credentialId||r[0]?.credentialId||``),c=s?r.filter(e=>e.credentialId===s):[],l=c.length>0?c:o.length>0?o:r,u=t(e.selectedCredentialRawId||``),d=t(e.accountLabel||n);return{authenticatorsForPrompt:l,wrongPasskeyError:u&&s&&u!==s?`You have multiple passkeys for account ${d}, but used a different passkey than the most recently logged-in one. Please use the passkey for the most recently active signer.`:void 0}}async updatePreferences(e){let n=t(e.profileId||``);if(!n)return null;let r=null;return await this.manager.runTransaction([E.wallets],`readwrite`,async t=>{let i=t.store(E.wallets),a=J(await i.get(n));if(!a)return;r={...a.preferences||{},...e.preferences};let o=yc({profileId:a.profileId,defaultSignerSlot:a.defaultSignerSlot,preferences:r,...a.passkeyCredential?{passkeyCredential:a.passkeyCredential}:{}},a);await i.put(o)}),r}async updateWalletPreferences(e){let n=t(e.walletId||``);return n?await this.updatePreferences({profileId:n,preferences:e.preferences}):null}async deleteProfileData(e,n){let r=t(e||``);r&&await this.manager.runTransaction([E.appState,E.wallets,E.walletAuthMethods,E.walletSigners,E.nearAccountProjections,E.signerOpsOutbox,E.keyMaterial,E.ecdsaClientPresignatures],`readwrite`,async e=>{let t=e.store(E.appState);Qn((await t.get(fc()))?.value)?.profileId===r&&await t.put({key:fc(),value:null});let i=fc(n);i!==fc()&&Qn((await t.get(i))?.value)?.profileId===r&&await t.put({key:i,value:null}),await e.store(E.wallets).delete(r),await dc({store:e.store(E.walletAuthMethods),indexName:D.walletId,key:IDBKeyRange.only(r)}),await dc({store:e.store(E.walletSigners),indexName:D.walletId,key:IDBKeyRange.only(r)}),await dc({store:e.store(E.nearAccountProjections),indexName:D.profileId,key:IDBKeyRange.only(r)}),await dc({store:e.store(E.signerOpsOutbox),indexName:D.walletId,key:IDBKeyRange.only(r)}),await dc({store:e.store(E.keyMaterial),indexName:D.walletId,key:IDBKeyRange.only(r)}),await dc({store:e.store(E.ecdsaClientPresignatures),indexName:D.walletId,key:IDBKeyRange.only(r)})})}async getLastProfileState(e){let t=fc(e);return Qn(await this.getAppState(t).catch(()=>void 0))}async setLastProfileState(e,t){let n=fc(t),r=e?Qn(e):null;if(e&&!r)throw Error(`[SeamsWalletDB] invalid last profile state`);await this.setAppState(n,r)}async setLastProfileStateForProfile(e,n,r){let i=t(e||``),a=Number(n);if(!i)throw Error(`[SeamsWalletDB] profileId is required`);if(!Number.isSafeInteger(a)||a<1)throw Error(`[SeamsWalletDB] activeSignerSlot must be an integer >= 1`);let o=at(r);await this.setLastProfileState({profileId:i,activeSignerSlot:a,...o?{scope:o}:{}},o)}async clearLastProfileSelection(e){await this.setLastProfileState(null,e)}async storeKeyMaterial(e){let t=gu(e);await this.manager.runTransaction([E.keyMaterial],`readwrite`,async e=>{await e.store(E.keyMaterial).put(t)})}async getKeyMaterial(e,n,r,i){let a=t(e||``),o=t(r||``).toLowerCase(),s=t(i||``);if(!a||!o||!s)return null;let c=null;return await this.manager.runTransaction([E.keyMaterial,E.walletSigners],`readonly`,async e=>{let t=(await e.store(E.keyMaterial).index(D.walletId).getAll(a)).flatMap(e=>{let t=bu(e);return t&&t.signerSlot===n&&t.chainIdKey===o&&t.keyKind===s?[t]:[]});if(t.length===0){c=null;return}c=ku({matches:t,activeSigners:(await e.store(E.walletSigners).index(D.walletId).getAll(a)).flatMap(e=>{let t=Q(e);return t?.status===`active`&&t.signerSlot===n&&t.chainIdKey===o?[t]:[]})})}),c}async listKeyMaterialByProfile(e,n){let r=t(e||``),i=t(n||``).toLowerCase();if(!r)return[];let a=(await this.manager.getDB()).transaction(E.keyMaterial,`readonly`),o=await a.store.index(D.walletId).getAll(r);await a.done;let s=o.flatMap(e=>{let t=bu(e);return t?[t]:[]});return i?s.filter(e=>e.chainIdKey===i):s}async listKeyMaterialByProfileAndSignerSlot(e,t,n){return!Number.isSafeInteger(t)||t<1?[]:(await this.listKeyMaterialByProfile(e,n)).filter(e=>e.signerSlot===t)}async deleteKeyMaterial(e,n,r,i){let a=t(e||``),o=t(r||``).toLowerCase(),s=t(i||``);!a||!o||!s||!Number.isSafeInteger(n)||n<1||await this.manager.runTransaction([E.keyMaterial],`readwrite`,async e=>{let t=e.store(E.keyMaterial),r=await t.index(D.walletId).getAll(a);for(let e of r){let r=bu(e);r&&r.signerSlot===n&&r.chainIdKey===o&&r.keyKind===s&&await t.delete(mu({walletSignerId:hu(r),keyKind:r.keyKind}))}})}async readNonceLaneLeaseRecords(e){let n=t(e||``);if(!n)return[];let r=(await this.manager.getDB()).transaction(E.nonceLaneLeases,`readonly`),i=await r.store.index(D.laneKey).getAll(n);return await r.done,i.flatMap(e=>{let t=lc(e);return t?[t]:[]})}async listNonceLaneLeaseRecords(e){let n=t(e?.walletId||``),r=(await this.manager.getDB()).transaction(E.nonceLaneLeases,`readonly`),i=n?await r.store.index(D.walletId).getAll(n):await r.store.getAll();return await r.done,i.flatMap(e=>{let t=lc(e);return t?[t]:[]})}async upsertNonceLaneLeaseRecord(e){let t=ac(e);await this.manager.runTransaction([E.nonceLaneLeases],`readwrite`,async e=>{await e.store(E.nonceLaneLeases).put(t)})}async removeNonceLaneLeaseRecord(e){let n=t(e.leaseId||``);n&&await this.manager.runTransaction([E.nonceLaneLeases],`readwrite`,async e=>{await e.store(E.nonceLaneLeases).delete(n)})}async clearNonceLaneLeaseRecordsForWallet(e){let n=t(e||``);n&&await this.manager.runTransaction([E.nonceLaneLeases],`readwrite`,async e=>{let t=e.store(E.nonceLaneLeases),r=await t.index(D.walletId).getAll(n);for(let e of r){let n=lc(e);n&&n.state!==`broadcast_accepted`&&await t.delete(n.leaseId)}})}async clearAllNonceLaneLeaseRecords(){await this.manager.runTransaction([E.nonceLaneLeases],`readwrite`,async e=>{await e.store(E.nonceLaneLeases).clear()})}async pruneExpiredNonceLaneLeaseRecords(e){let t=Math.floor(Number(e));Number.isSafeInteger(t)&&await this.manager.runTransaction([E.nonceLaneLeases],`readwrite`,async e=>{let n=e.store(E.nonceLaneLeases),r=await n.index(D.expiresAtMs).getAll(uc(t));for(let e of r){let t=lc(e);t&&t.state!==`broadcast_accepted`&&await n.delete(t.leaseId)}})}async withNonceLaneCoordinationLock(e,n){let r=t(e.lockKey||``),i=t(e.ownerId||``);if(!r||!i)throw Error(`[SeamsWalletDB] nonce lane lock requires lockKey and ownerId`);let a=Math.max(1,Math.floor(Number(e.ttlMs)||5e3)),o=Math.max(1,Math.floor(Number(e.waitTimeoutMs)||3e3)),s=nc(`nonce-lane-lock`),c=Date.now()+o,l=async()=>{let e=!1;return await this.manager.runTransaction([E.nonceLaneLocks],`readwrite`,async t=>{let n=t.store(E.nonceLaneLocks),o=Date.now(),c=oc(await n.get(r));if(c&&c.expires_at_ms>o)return;let l={lock_key:r,owner_id:i,fencing_token:s,acquired_at_ms:o,expires_at_ms:o+a,updated_at_ms:o};await n.put(l),e=!0}),e};for(;!await l();){if(Date.now()>=c){let e=Error(`[SeamsWalletDB] durable nonce lane lock timed out`);throw e.code=`durable_lock_timeout`,e}await tc(25)}try{return await n()}finally{await this.manager.runTransaction([E.nonceLaneLocks],`readwrite`,async e=>{let t=e.store(E.nonceLaneLocks);oc(await t.get(r))?.fencing_token===s&&await t.delete(r)}).catch(()=>void 0)}}};const ju=new Set(Object.values(Qe));var Mu=class{constructor(e){this.eventListeners=new Set,this._initialized=!1,this.lastUserScope=null,this.seamsWalletDB=e?.seamsWalletDB||tt,this.seamsWalletRepositories=new Au(this.seamsWalletDB),this.registrationSetupRepository=new $e(this.seamsWalletDB)}async initialize(){if(!this._initialized)try{if(this.seamsWalletDB.isDisabled()){this._initialized=!0;return}await this.seamsWalletRepositories.getAppState(`_init_check`);try{await this.repairSignerMutationSagas({limit:64})}catch(e){console.warn(`IndexedDB saga repair failed during initialize:`,e)}try{await this.reconcileLocalSignerState({limitProfiles:64,logIssues:!0})}catch(e){console.warn(`IndexedDB local signer reconciliation failed during initialize:`,e)}this._initialized=!0}catch(e){console.warn(`Failed to initialize IndexedDB databases:`,e)}}get isInitialized(){return this._initialized}isDisabled(){return this.seamsWalletDB.isDisabled()}onChange(e){return this.eventListeners.add(e),()=>{this.eventListeners.delete(e)}}emitEvent(e){for(let t of this.eventListeners)try{t(e)}catch(e){console.warn(`[UnifiedIndexedDBManager]: Error in event listener:`,e)}}async getAppState(e){return this.seamsWalletRepositories.getAppState(e)}async listAppStateEntriesByPrefix(e){return this.seamsWalletRepositories.listAppStateEntriesByPrefix(e)}async setAppState(e,t){return this.seamsWalletRepositories.setAppState(e,t)}async putPendingWalletRegistrationCommits(e){return this.seamsWalletRepositories.putPendingWalletRegistrationCommits(e)}async advancePendingNearRegistration(e){return this.seamsWalletRepositories.advancePendingNearRegistration(e)}async putPendingWalletRegistrationCommit(e){return this.seamsWalletRepositories.putPendingWalletRegistrationCommit(e)}async getPendingWalletRegistrationCommit(e){return this.seamsWalletRepositories.getPendingWalletRegistrationCommit(e)}async listPendingWalletRegistrationCommits(){return this.seamsWalletRepositories.listPendingWalletRegistrationCommits()}async deletePendingWalletRegistrationCommit(e){return this.seamsWalletRepositories.deletePendingWalletRegistrationCommit(e)}async putPendingWalletRecoveryCommit(e){return this.seamsWalletRepositories.putPendingWalletRecoveryCommit(e)}async advancePendingWalletRecoveryCommit(e){return this.seamsWalletRepositories.advancePendingWalletRecoveryCommit(e)}async getPendingWalletRecoveryCommit(e){return this.seamsWalletRepositories.getPendingWalletRecoveryCommit(e)}async listPendingWalletRecoveryCommits(){return this.seamsWalletRepositories.listPendingWalletRecoveryCommits()}async deletePendingWalletRecoveryCommit(e){return this.seamsWalletRepositories.deletePendingWalletRecoveryCommit(e)}setLastUserScope(e){this.lastUserScope=at(e)}getLastUserScope(){return this.lastUserScope}async getLastProfileState(){return this.seamsWalletRepositories.getLastProfileState(this.lastUserScope)}async setLastProfileState(e){return this.seamsWalletRepositories.setLastProfileState(e,this.lastUserScope)}async setLastProfileStateForProfile(e,t){return this.seamsWalletRepositories.setLastProfileStateForProfile(e,t,this.lastUserScope)}async clearLastProfileSelection(){return this.seamsWalletRepositories.clearLastProfileSelection(this.lastUserScope)}async readNonceLaneLeaseRecords(e){return this.seamsWalletRepositories.readNonceLaneLeaseRecords(e)}async listNonceLaneLeaseRecords(e){return this.seamsWalletRepositories.listNonceLaneLeaseRecords(e)}async upsertNonceLaneLeaseRecord(e){return this.seamsWalletRepositories.upsertNonceLaneLeaseRecord(e)}async removeNonceLaneLeaseRecord(e){return this.seamsWalletRepositories.removeNonceLaneLeaseRecord(e)}async clearNonceLaneLeaseRecordsForWallet(e){return this.seamsWalletRepositories.clearNonceLaneLeaseRecordsForWallet(e)}async clearAllNonceLaneLeaseRecords(){return this.seamsWalletRepositories.clearAllNonceLaneLeaseRecords()}async pruneExpiredNonceLaneLeaseRecords(e){return this.seamsWalletRepositories.pruneExpiredNonceLaneLeaseRecords(e)}async withNonceLaneCoordinationLock(e,t){return this.seamsWalletRepositories.withNonceLaneCoordinationLock(e,t)}async getProfile(e){return this.seamsWalletRepositories.getProfile(e)}async getWalletPreferences(e){return await this.seamsWalletRepositories.getWalletPreferences(e)}async listProfiles(e){return this.seamsWalletRepositories.listProfiles(e)}async upsertProfile(e){return this.seamsWalletRepositories.upsertProfile(e)}async upsertChainAccount(e){return this.seamsWalletRepositories.upsertChainAccount(e)}async listChainAccountsByProfile(e){return this.seamsWalletRepositories.listChainAccountsByProfile(e)}async listChainAccountsByProfileAndChain(e,t){return this.seamsWalletRepositories.listChainAccountsByProfileAndChain(e,t)}async listChainAccountsByChain(e){return this.seamsWalletRepositories.listChainAccountsByChain(e)}async getChainAccount(e){return this.seamsWalletRepositories.getChainAccount(e)}async resolveProfileAccountContext(e){return this.seamsWalletRepositories.resolveProfileAccountContext(e)}async getProfileContinuitySnapshot(e){return this.seamsWalletRepositories.getProfileContinuitySnapshot(e)}async activateAccountSigner(e){return this.seamsWalletRepositories.activateAccountSigner(e)}async stageAccountSigner(e){return this.seamsWalletRepositories.stageAccountSigner(e)}async listAccountSigners(e){return this.seamsWalletRepositories.listAccountSigners(e)}async listAccountSignersByProfile(e){return this.seamsWalletRepositories.listAccountSignersByProfile(e)}async listActiveWalletSigners(e){return this.seamsWalletRepositories.listActiveWalletSigners(e)}async getActiveWalletSignerForChainTarget(e){return this.seamsWalletRepositories.getActiveWalletSignerForChainTarget(e)}async getAccountSigner(e){return this.seamsWalletRepositories.getAccountSigner(e)}async setAccountSignerStatus(e){return this.seamsWalletRepositories.setAccountSignerStatus(e)}async enqueueSignerOperation(e){return this.seamsWalletRepositories.enqueueSignerOperation(e)}async listSignerOperations(e){return this.seamsWalletRepositories.listSignerOperations(e)}async setSignerOperationStatus(e){return this.seamsWalletRepositories.setSignerOperationStatus(e)}async listProfileAuthenticators(e){return this.seamsWalletRepositories.listProfileAuthenticators(e)}async listWalletPasskeyAuthenticators(e){return this.seamsWalletRepositories.listWalletPasskeyAuthenticators(e)}async upsertProfileAuthenticator(e){return this.seamsWalletRepositories.upsertProfileAuthenticator(e)}async getProfileAuthenticatorByCredentialId(e,t){return this.seamsWalletRepositories.getProfileAuthenticatorByCredentialId(e,t)}async getWalletPasskeyAuthenticator(e){return this.seamsWalletRepositories.getWalletPasskeyAuthenticator(e)}async upsertWalletAuthMethod(e){return this.seamsWalletRepositories.upsertWalletAuthMethod(e)}async upsertWalletAuthMethodV2(e){await this.seamsWalletRepositories.upsertWalletAuthMethodV2(e)}async listWalletAuthMethodsForWallet(e){return this.seamsWalletRepositories.listWalletAuthMethodsForWallet(e)}async listWalletAuthMethodsV2ForWallet(e){return this.seamsWalletRepositories.listWalletAuthMethodsV2ForWallet(e)}async listLocalWalletAuthMethodProjectionsV2ForWallet(e){return this.seamsWalletRepositories.listLocalWalletAuthMethodProjectionsV2ForWallet(e)}async retainVerifiedEmailOtpLocalPresentation(e){return this.seamsWalletRepositories.retainVerifiedEmailOtpLocalPresentation(e)}async installLocalAuthority(e){return this.seamsWalletRepositories.installLocalAuthority(e)}async finalizeLocalAuthorityActivation(e){return this.seamsWalletRepositories.finalizeLocalAuthorityActivation(e)}async publishLocalAuthorityActivation(e){return this.seamsWalletRepositories.publishLocalAuthorityActivation(e)}async advanceWalletLockGeneration(e){return this.seamsWalletRepositories.advanceWalletLockGeneration(e)}async markWalletSelectionUnlocked(e){await this.seamsWalletRepositories.markWalletSelectionUnlocked(e)}async persistRecoveredWalletAuthority(e){await this.seamsWalletRepositories.persistRecoveredWalletAuthority(e)}async getLocalAuthorityInstallationReceipt(e){return this.seamsWalletRepositories.getLocalAuthorityInstallationReceipt(e)}async getWalletAuthority(e){return this.seamsWalletRepositories.getWalletAuthority(e)}async persistFoundingWalletAuthority(e){await this.seamsWalletRepositories.persistFoundingWalletAuthority(e)}async getWalletAuthMethodV2(e){return this.seamsWalletRepositories.getWalletAuthMethodV2(e)}async listWalletSelections(){return this.seamsWalletRepositories.listWalletSelections()}async listWalletSelectionWalletIds(){return this.seamsWalletRepositories.listWalletSelectionWalletIds()}async resolveSelectedWalletAuthority(e){return this.seamsWalletRepositories.resolveSelectedWalletAuthority(e)}async resolveWalletAuthorityForMethod(e,t){return this.seamsWalletRepositories.resolveWalletAuthorityForMethod(e,t)}async persistWalletRegistrationFinalize(e){return this.seamsWalletRepositories.persistWalletRegistrationFinalize(e)}async publishPendingWalletRegistrationCommit(e){let t=await this.seamsWalletRepositories.publishPendingWalletRegistrationCommit(e);try{await this.registrationSetupRepository.complete(e.pending)}catch(e){console.warn(`Wallet registration committed; setup journal cleanup remains pending`,e)}return t}async publishPendingWalletRegistrationCommitAndRetain(e){return this.seamsWalletRepositories.publishPendingWalletRegistrationCommitAndRetain(e)}async adoptAddedEcdsaSignerAuthority(e){await this.seamsWalletRepositories.adoptAddedEcdsaSignerAuthority(e)}async replaceExactActiveWalletSessionFromStatus(e){return await this.seamsWalletRepositories.replaceExactActiveWalletSessionFromStatus(e)}async reconcilePendingNearRegistrationAuthority(e){await this.seamsWalletRepositories.reconcilePendingNearRegistrationAuthority(e)}async completePendingNearRegistration(e){await this.seamsWalletRepositories.completePendingNearRegistration(e)}async publishPendingWalletRecoveryCommit(e){return this.seamsWalletRepositories.publishPendingWalletRecoveryCommit(e)}async persistWalletSignerFinalize(e){return this.seamsWalletRepositories.persistWalletSignerFinalize(e)}async rollbackWalletSignerFinalize(e){return this.seamsWalletRepositories.rollbackWalletSignerFinalize(e)}async clearProfileAuthenticators(e){return this.seamsWalletRepositories.clearProfileAuthenticators(e)}async selectProfileAuthenticatorsForPrompt(e){return this.seamsWalletRepositories.selectProfileAuthenticatorsForPrompt(e)}async updatePreferences(e){let n=await this.seamsWalletRepositories.updatePreferences(e),r=t(e.eventAccountId||``);n&&r&&this.emitEvent({type:`preferences-updated`,accountId:r,data:{preferences:n}})}async updateWalletPreferences(e){let t=await this.seamsWalletRepositories.updateWalletPreferences(e);t&&this.emitEvent({type:`preferences-updated`,accountId:e.walletId,data:{preferences:t}})}async deleteProfileData(e,n){await this.seamsWalletRepositories.deleteProfileData(e,this.lastUserScope);let r=t(n?.eventAccountId||``);r&&this.emitEvent({type:`user-deleted`,accountId:r})}async storeKeyMaterial(e){return this.seamsWalletRepositories.storeKeyMaterial(e)}async getKeyMaterial(e,t,n,r){return this.seamsWalletRepositories.getKeyMaterial(e,t,n,r)}async deleteKeyMaterial(e,t,n,r){return this.seamsWalletRepositories.deleteKeyMaterial(e,t,n,r)}async listKeyMaterialByProfile(e,t){return this.seamsWalletRepositories.listKeyMaterialByProfile(e,t)}async reconcileLocalSignerState(e){let n=typeof e?.now==`number`?e.now:Date.now(),r=Number.isSafeInteger(e?.stalePendingSignerMs)&&Number(e?.stalePendingSignerMs)>0?Number(e?.stalePendingSignerMs):864e5,i=t(e?.profileId||``),a=i?await this.getProfile(i).then(e=>e?[e]:[]):await this.listProfiles({limit:e?.limitProfiles}),o={scannedProfiles:0,scannedSigners:0,scannedKeyMaterials:0,issues:[],repairs:[]},s=e=>{o.issues.push(e)};for(let e of a){o.scannedProfiles+=1;let t=await this.listAccountSignersByProfile({profileId:e.profileId}),i=await this.seamsWalletRepositories.listKeyMaterialByProfile(e.profileId);o.scannedSigners+=t.length,o.scannedKeyMaterials+=i.length;let a=new Map,c=new Set;for(let e of t){if(e.status!==`active`)continue;let t=[e.chainIdKey,e.accountAddress,String(e.signerSlot)].join(`\0`);c.add(t);let n=a.get(t)||[];n.push(e),a.set(t,n)}for(let[t,n]of a.entries()){if(n.length<=1)continue;let[r,i,a]=t.split(`\0`);s({code:`duplicate_active_signer_slot`,profileId:e.profileId,chainIdKey:r,accountAddress:i,signerSlot:Number(a),message:`Multiple active signers share slot ${a} for ${r}/${i}`})}for(let a of t)a.status===`pending`&&n-Number(a.addedAt||0)>r&&s({code:`stale_pending_signer`,profileId:e.profileId,chainIdKey:a.chainIdKey,accountAddress:a.accountAddress,signerId:a.signerId,signerSlot:a.signerSlot,message:`Pending signer ${a.signerId} has been pending longer than ${r}ms`}),a.status===`active`&&ju.has(String(a.signerKind||``))&&i.filter(e=>e.chainIdKey===a.chainIdKey&&e.signerSlot===a.signerSlot&&e.keyKind===`threshold_share_v1`).length===0&&s({code:`active_signer_missing_key_material`,profileId:e.profileId,chainIdKey:a.chainIdKey,accountAddress:a.accountAddress,signerId:a.signerId,signerSlot:a.signerSlot,message:`Active ${a.signerKind} signer ${a.signerId} has no threshold key material`});for(let n of i){let r=[n.chainIdKey,n.payloadEnvelope?.aad?.accountAddress||``,String(n.signerSlot)].join(`\0`);c.has(r)||t.some(e=>e.status===`active`&&e.chainIdKey===n.chainIdKey&&e.signerSlot===n.signerSlot)||s({code:`key_material_without_active_signer`,profileId:e.profileId,chainIdKey:n.chainIdKey,signerSlot:n.signerSlot,keyKind:n.keyKind,message:`Key material ${n.keyKind} at slot ${n.signerSlot} has no active signer`})}}return e?.logIssues&&o.issues.length>0&&console.warn(`[IndexedDB] local signer reconciliation found issues`,{issueCount:o.issues.length,issues:o.issues.slice(0,20)}),o}computeSignerOpRetryDelayMs(e){let t=Math.max(1,Math.min(e,8));return Math.min(5*6e4,5e3*2**(t-1))}async repairSignerMutationSagas(e){return await this.repairSignerMutationSagasWithRuntime(e)}async repairSignerMutationSagasWithRuntime(e){let n=typeof e?.now==`number`?e.now:Date.now(),r=Number.isSafeInteger(e?.limit)&&Number(e?.limit)>0?Number(e?.limit):100,i={scanned:0,confirmed:0,failed:0,deadLettered:0},a=await this.listSignerOperations({statuses:[`queued`,`submitted`,`failed`],dueBefore:n,limit:r});for(let e of a){i.scanned+=1;let r=e.payload||{},a=await this.getAccountSigner({chainIdKey:e.chainIdKey,accountAddress:e.accountAddress,signerId:e.signerId}),o=t(a?.profileId||r.profileId||``),s=Number(r.signerSlot??a?.signerSlot),c=Number.isSafeInteger(s)&&s>=1?s:null,l=async t=>{let r=(e.attemptCount||0)+1;await this.setSignerOperationStatus({opId:e.opId,status:`failed`,attemptDelta:1,lastError:t,nextAttemptAt:n+this.computeSignerOpRetryDelayMs(r)}),i.failed+=1},u=async t=>{await this.setSignerOperationStatus({opId:e.opId,status:`dead-letter`,lastError:t,nextAttemptAt:n}),i.deadLettered+=1},d=async()=>{await this.setSignerOperationStatus({opId:e.opId,status:`confirmed`,lastError:null,nextAttemptAt:n}),i.confirmed+=1};try{if(e.opType===`add-signer`||e.opType===`activate-recovery-signer`){if(!a){await u(`Missing signer row for add-signer operation`);continue}if(a.status===`revoked`){await u(`Cannot activate a revoked signer; create a new signer record`);continue}if(!o||c==null){await u(`Missing profileId/signerSlot metadata for add-signer operation`);continue}if(!await this.getChainAccount({profileId:a.profileId,chainIdKey:e.chainIdKey,accountAddress:e.accountAddress})){await u(`Missing chain account row for add-signer operation`);continue}if((await this.seamsWalletRepositories.listKeyMaterialByProfileAndSignerSlot(o,c,e.chainIdKey)).length===0){await l(`Missing key material for signer operation`);continue}await d();continue}if(e.opType===`revoke-signer`){if(a&&(a.status!==`revoked`&&await this.setAccountSignerStatus({chainIdKey:e.chainIdKey,accountAddress:e.accountAddress,signerId:e.signerId,status:`revoked`,removedAt:n,mutation:{routeThroughOutbox:!1}}),o&&c!=null)){let t=await this.seamsWalletRepositories.listKeyMaterialByProfileAndSignerSlot(o,c,e.chainIdKey);for(let e of t)await this.seamsWalletRepositories.deleteKeyMaterial(e.profileId,e.signerSlot,e.chainIdKey,e.keyKind)}await d();continue}await u(`Unsupported signer operation type: ${String(e.opType||``)}`)}catch(e){await l(String(e?.message||e||`Unknown saga repair error`))}}return i}};function Nu(e){if(!e||typeof e!=`object`||Array.isArray(e))return Vu({},``,``,``);let t=e,n=$(t.leaseId),r=$(t.laneKey),i=$(t.family),a=$(t.networkKey),o=$(t.accountId),s=$(t.nearAccountId);if(t.v!==1)return Vu(t,r,n,i);let c=Uu(t.nonce),l=Lu(t),u=$(t.operationId),d=$(t.operationFingerprint),f=Wu(t.reservedAtMs),p=Wu(t.expiresAtMs),m=Wu(t.updatedAtMs);return!n||!r||i!==`evm`&&i!==`near`||!a||c==null||!l||!u||!d||f==null||p==null||m==null?Vu(t,r,n,i):i===`evm`?Pu({obj:t,leaseId:n,laneKey:r,networkKey:a,accountId:o,nearAccountId:s,nonce:c,lifecycle:l,operationId:u,operationFingerprint:d,reservedAtMs:f,expiresAtMs:p,updatedAtMs:m}):Fu({obj:t,leaseId:n,laneKey:r,networkKey:a,accountId:o,nearAccountId:s,nonce:c,lifecycle:l,operationId:u,operationFingerprint:d,reservedAtMs:f,expiresAtMs:p,updatedAtMs:m})}function Pu(e){let t=Bu(e.obj.chainTarget),n=Hu(e.obj.sender),r=Ru(e.lifecycle),i=e.obj.nonceKey===void 0||e.obj.nonceKey===null?void 0:Uu(e.obj.nonceKey);if(!t||!e.accountId||!n||!r||i===null)return Vu(e.obj,e.laneKey,e.leaseId,`evm`);let a={...Iu(e,r),family:`evm`,chainTarget:t,accountId:Ze(e.accountId),sender:n};i!==void 0&&(a.nonceKey=i);let o={family:`evm`,chainTarget:a.chainTarget,subjectId:a.accountId,sender:a.sender};return a.nonceKey!=null&&(o.nonceKey=a.nonceKey),{ok:!0,parsed:{record:a,lane:o,canonicalLaneKey:Sn(o),nonce:a.nonce}}}function Fu(e){let t=$(e.obj.publicKey),n=$(e.obj.walletId);if(!e.nearAccountId||!n||!t)return Vu(e.obj,e.laneKey,e.leaseId,`near`);let r={...Iu(e,e.lifecycle),family:`near`,walletId:n,nearAccountId:e.nearAccountId,publicKey:t},i={family:`near`,networkKey:r.networkKey,walletId:r.walletId,nearAccountId:r.nearAccountId,publicKey:r.publicKey};return{ok:!0,parsed:{record:r,lane:i,canonicalLaneKey:Sn(i),nonce:r.nonce}}}function Iu(e,t){let n={v:1,leaseId:e.leaseId,laneKey:e.laneKey,networkKey:e.networkKey,nonce:e.nonce,operationId:e.operationId,operationFingerprint:e.operationFingerprint,reservedAtMs:e.reservedAtMs,expiresAtMs:e.expiresAtMs,updatedAtMs:e.updatedAtMs},r=$(e.obj.runtimeId);r&&(n.runtimeId=r);let i=$(e.obj.fencingToken);i&&(n.fencingToken=i);let a=$(e.obj.batchId);a&&(n.batchId=a);let o=e.obj.txIndex==null?null:Wu(e.obj.txIndex);switch(o!=null&&(n.txIndex=o),t.state){case A.Reserved:case A.Signed:return{...n,state:t.state};case A.BroadcastAccepted:return{...n,state:A.BroadcastAccepted,txHash:t.txHash}}}function Lu(e){if(e.state===A.Reserved)return e.txHash===void 0?{state:A.Reserved}:null;if(e.state===A.Signed)return e.txHash===void 0?{state:A.Signed}:null;if(e.state===A.BroadcastAccepted){let t=$(e.txHash);return t?{state:A.BroadcastAccepted,txHash:t}:{state:A.Signed}}return null}function Ru(e){if(e.state!==A.BroadcastAccepted)return e;let t=zu(e.txHash);return t?{state:A.BroadcastAccepted,txHash:t}:{state:A.Signed}}function zu(e){let t=$(e).toLowerCase();return/^0x[0-9a-f]{64}$/.test(t)?t:null}function Bu(e){try{return Xe(e&&typeof e==`object`&&!Array.isArray(e)?e:{})}catch{return null}}function Vu(e,t,n,r){let i={reason:xn.MalformedDurableRecord,fallback:Cn.None};(r===`evm`||r===`near`)&&(i.laneFamily=r);let a=$(e.networkKey);a&&(i.networkKey=a);let o=$(e.walletId)||$(e.accountId);return o&&(i.accountId=o),{ok:!1,laneKey:t,leaseId:n,degradation:i}}function Hu(e){let t=$(e).toLowerCase();return/^0x[0-9a-f]{40}$/.test(t)?t:null}function $(e){return typeof e==`string`?e.trim():``}function Uu(e){return typeof e!=`string`||!/^\d+$/.test(e)?null:BigInt(e)}function Wu(e){if(typeof e==`number`)return Number.isSafeInteger(e)?e:null;if(typeof e!=`string`||!/^\d+$/.test(e))return null;let t=Number(e);return Number.isSafeInteger(t)?t:null}function Gu(e){return{readLane:async t=>(await e.indexedDB.readNonceLaneLeaseRecords(t)).flatMap(e=>{let t=Nu(e);return t.ok?[t.parsed]:[]}),readAll:async t=>(await e.indexedDB.listNonceLaneLeaseRecords(t)).flatMap(e=>{let t=Nu(e);return t.ok?[t.parsed]:[]}),readAllForRecovery:async t=>(await e.indexedDB.listNonceLaneLeaseRecords(t)).map(e=>Nu(e)),upsert:async t=>{if(t.family===`evm`){await e.indexedDB.upsertNonceLaneLeaseRecord(qu(t));return}await e.indexedDB.upsertNonceLaneLeaseRecord(Ju(t))},remove:async t=>{await e.indexedDB.removeNonceLaneLeaseRecord({leaseId:t.leaseId})},clearForWallet:async t=>{await e.indexedDB.clearNonceLaneLeaseRecordsForWallet(t)},clearAll:async()=>{await e.indexedDB.clearAllNonceLaneLeaseRecords()},pruneExpired:async t=>{await e.indexedDB.pruneExpiredNonceLaneLeaseRecords(t)},withLock:async(t,n)=>await e.indexedDB.withNonceLaneCoordinationLock({lockKey:t.lockKey,ownerId:t.ownerId,...t.ttlMs==null?{}:{ttlMs:t.ttlMs},...t.waitTimeoutMs==null?{}:{waitTimeoutMs:t.waitTimeoutMs}},n)}}function Ku(e){return{...e.runtimeId?{runtimeId:e.runtimeId}:{},...e.fencingToken?{fencingToken:e.fencingToken}:{},...e.batchId?{batchId:e.batchId}:{},...typeof e.txIndex==`number`&&Number.isSafeInteger(e.txIndex)?{txIndex:e.txIndex}:{}}}function qu(e){let t={v:1,laneKey:e.laneKey,leaseId:e.leaseId,networkKey:e.networkKey,nonce:e.nonce.toString(),operationId:e.operationId,operationFingerprint:e.operationFingerprint,reservedAtMs:e.reservedAtMs,expiresAtMs:e.expiresAtMs,updatedAtMs:e.updatedAtMs,family:`evm`,chainTarget:e.chainTarget,accountId:e.accountId,sender:e.sender,...e.nonceKey==null?{}:{nonceKey:e.nonceKey.toString()},...Ku(e)};switch(e.state){case`reserved`:case`signed`:return{...t,state:e.state};case`broadcast_accepted`:return{...t,state:`broadcast_accepted`,txHash:e.txHash}}}function Ju(e){let t={v:1,laneKey:e.laneKey,leaseId:e.leaseId,networkKey:e.networkKey,nonce:e.nonce.toString(),operationId:e.operationId,operationFingerprint:e.operationFingerprint,reservedAtMs:e.reservedAtMs,expiresAtMs:e.expiresAtMs,updatedAtMs:e.updatedAtMs,family:`near`,walletId:e.walletId,nearAccountId:e.nearAccountId,publicKey:e.publicKey,...Ku(e)};switch(e.state){case`reserved`:case`signed`:return{...t,state:e.state};case`broadcast_accepted`:return{...t,state:`broadcast_accepted`,txHash:e.txHash}}}const Yu={app:{walletDbName:rt,disabled:!1},wallet:{walletDbName:rt,disabled:!1},disabled:{walletDbName:rt,disabled:!0}};let Xu=null;function Zu(e){let t=e?.mode,n=Yu[t];if(!n)throw Error(`[IndexedDBManager] Unknown IndexedDBMode: ${String(t)}`);return Xu?(Xu.walletDbName===n.walletDbName&&Xu.disabled===n.disabled||console.warn(`[IndexedDBManager] configureIndexedDB called multiple times; ignoring subsequent configuration`,{configured:Xu,requested:n}),{walletDbName:Xu.walletDbName}):(Xu={mode:t,...n},tt.setDbName(n.walletDbName),tt.setDisabled(n.disabled),{walletDbName:Xu.walletDbName})}const Qu=new Mu({seamsWalletDB:tt});async function $u(e,n){let r=t(n.explicitProfileId||``),i=t(n.explicitChainIdKey||``).toLowerCase(),a=t(n.explicitAccountAddress||``).toLowerCase();if(r||i||a){if(!r||!i||!a)throw Error(`IndexedDBManager: profileId, chainIdKey, and accountAddress are required for explicit key target writes`);let o=n.accountRefs.find(e=>t(e.chainIdKey||``).toLowerCase()===i);if(o){let t=await e.resolveProfileAccountContext(o).catch(()=>null);if(t?.profileId&&String(t.profileId).trim()!==r)throw Error(`IndexedDBManager: Explicit key target (${r}, ${i}, ${o.accountAddress}) mismatches mapped profile ${String(t.profileId).trim()}`)}return{profileId:r,chainIdKey:i,accountAddress:a}}let o=await Tn(e,n.accountRefs);return o?.profileId?{profileId:o.profileId,chainIdKey:o.accountRef.chainIdKey,accountAddress:o.accountRef.accountAddress}:null}async function ed(e){let t=await $u(e.deps.clientDB,{accountRefs:e.accountRefs});return!t?.profileId||!t.chainIdKey?null:e.deps.keyMaterialStore.getKeyMaterial(t.profileId,e.signerSlot,t.chainIdKey,e.keyKind)}async function td(e,n){if(!Number.isSafeInteger(n.signerSlot)||n.signerSlot<1)throw Error(`IndexedDBManager: Invalid signerSlot for key write`);let r=t(n.keyKind||``);if(!r)throw Error(`IndexedDBManager: Missing keyKind for key write`);let i=t(n.algorithm||``).toLowerCase();if(!i)throw Error(`IndexedDBManager: Missing algorithm for key write`);let a=t(n.publicKey||``);if(!a)throw Error(`IndexedDBManager: Missing publicKey for key write`);let o=t(n.signerId||``);if(!o)throw Error(`IndexedDBManager: Missing signerId for key write`);let s=await $u(e.clientDB,n);if(!s?.profileId||!s.chainIdKey||!s.accountAddress)throw Error(`IndexedDBManager: Missing profile/account mapping for key write. Persist profile/account first or pass explicit profileId + chainIdKey.`);let c=Number.isSafeInteger(n.schemaVersion)&&typeof n.schemaVersion==`number`&&n.schemaVersion>=1?n.schemaVersion:1,l={profileId:s.profileId,signerSlot:n.signerSlot,chainIdKey:s.chainIdKey,accountAddress:s.accountAddress,keyKind:r,algorithm:i,publicKey:a,signerId:o,timestamp:typeof n.timestamp==`number`?n.timestamp:Date.now(),schemaVersion:c},u=t(n.wrapKeySalt||``);u&&(l.wrapKeySalt=u),n.payload&&(l.payload=n.payload),await e.keyMaterialStore.storeKeyMaterial(l)}async function nd(e){let t=await $u(e.store,{accountRefs:wn(e.binding.nearAccountId)});if(!t)throw Error(`Wallet custody Ed25519 material requires a persisted wallet profile`);await e.store.storeKeyMaterial(dt({target:t,...e}))}async function rd(e){let t=await $u(e.store,{accountRefs:wn(e.nearAccountId)});t&&await e.store.deleteKeyMaterial(t.profileId,e.signerSlot,t.chainIdKey,lt)}async function id(e){let t=await ed({deps:{clientDB:e.store,keyMaterialStore:e.store},accountRefs:wn(e.nearAccountId),signerSlot:e.signerSlot,keyKind:lt});if(!t)return{kind:`absent`};let n=t.payloadEnvelope;if(!n?.ciphertext||!n.nonce)return{kind:`unusable`,reason:`cached custody material has no sealed payload`};if(n.alg!==`chacha20poly1305-hkdf-sha256-wallet-custody-seed-v1`)return{kind:`unusable`,reason:`cached custody material was sealed under another key`};let r=t.payload?.binding;if(!r||typeof r!=`object`)return{kind:`unusable`,reason:`cached custody material has no binding`};let i=r;if(i.kind!==`wallet_custody_ed25519_active_client_v1`)return{kind:`unusable`,reason:`cached custody material is not a wallet custody record`};try{ut(i)}catch(e){return{kind:`unusable`,reason:e instanceof Error?e.message:`cached custody binding is incomplete`}}let a=String(e.expectedRegisteredPublicKeyB64u||``).trim();return a&&a!==String(i.registeredPublicKeyB64u||``).trim()?{kind:`unusable`,reason:`cached custody material is for another key set`}:{kind:`found`,material:{binding:i,sealed:{ciphertextB64u:n.ciphertext,nonceB64u:n.nonce}}}}function ad(e){let t=Ae(e.authority);if(!t||String(t.walletId)!==String(e.walletId))throw Error(`ECDSA custody import authority is invalid`);let n=Le(e.publicCapability),r=ce(e.activationReceipt),i=me(r.ecdsa_activation.material_activation);if(!h(i,me(n.material_activation)))throw Error(`ECDSA custody continuity changed the material activation`);let a=[bt(e.participantIds[0]),bt(e.participantIds[1])],o=dn({keyHandle:Kt(e.keyHandle),ecdsaThresholdKeyId:Wt(e.ecdsaThresholdKeyId),clientVerifyingPublicKey33B64u:Gt(e.publicFacts.derivationClientSharePublicKey33B64u),participantIds:a,relayerKeyId:Vt(e.relayerKeyId)}),s=on({capability:i.capability,signerId:Se(C(`ecdsa-signer`,32,`ECDSA custody signer identities`)),authority:t,scope:sn({targetMemberships:e.chainTargets}),materialOwner:i.materialOwner,signingRootId:Re(e.signingRootId),signingRootVersion:ye(e.signingRootVersion)}),c=pn({targetManifest:$t({manifestId:Pe(C(`ecdsa-manifest`,32,`ECDSA custody manifest identities`)),manifestRevision:be(1)}),signer:s,roleLocalBinding:o,bindingDigest:Ht(e.publicFacts.contextBinding32B64u),durableMaterialRef:Ut(C(`ecdsa-role-local-material`,32,`ECDSA custody material identities`))}),l=e.publicFacts.ethereumAddress,u=Ct({keyHandle:Ot(e.keyHandle),publicKeyB64u:e.publicFacts.groupPublicKey33B64u,participantIds:a,thresholdOwnerAddress:l}),d=Zt({walletId:t.walletId,chainTarget:e.chainTargets[0],keyHandle:o.keyHandle,ecdsaThresholdKeyId:o.ecdsaThresholdKeyId,signingRootId:s.signingRootId,signingRootVersion:s.signingRootVersion,applicationBindingDigestB64u:n.context.application_binding_digest_b64u,clientParticipantId:a[0],relayerParticipantId:a[1],participantIds:a,contextBinding32B64u:e.publicFacts.contextBinding32B64u,derivationClientSharePublicKey33B64u:e.publicFacts.derivationClientSharePublicKey33B64u,relayerPublicKey33B64u:e.publicFacts.relayerPublicKey33B64u,groupPublicKey33B64u:e.publicFacts.groupPublicKey33B64u,ethereumAddress:l,publicCapability:n}),f={kind:`router_ab_ecdsa_derivation_normal_signing_v1`,scope:{wallet_id:String(t.walletId),ecdsa_threshold_key_id:String(o.ecdsaThresholdKeyId),signing_root_id:String(s.signingRootId),signing_root_version:String(s.signingRootVersion),context:r.ecdsa_activation.context,public_identity:r.ecdsa_activation.public_identity,material_activation:r.ecdsa_activation.material_activation,signing_worker:r.ecdsa_activation.signing_worker,activation_epoch:r.ecdsa_activation.activation_epoch}};return{activationBinding:c,serverCommit:{correlationId:r.activation_correlation_id,activationRequestDigest:T(x(Uint8Array.from(r.activation_request_digest.bytes))),serverGeneration:r.server_generation,protocolReceipt:r},readyStateBlobB64u:e.readyStateBlobB64u,registeredPublicFacts:u,roleLocalPublicFacts:d,routerAbEcdsaDerivationNormalSigning:f,runtimePolicyScope:te(e.runtimePolicyScope),committedAt:Je(new Date(r.ecdsa_activation.activated_at_ms).toISOString())}}async function od(e){return cs(ad(e))}async function sd(e){return await ms(e.store,ad(e),t=>e.store.persistPreparedWalletCustodyEcdsaContinuity(t))}async function cd(e){let t=new Au(tt);for(let n of e.walletAuthMethodIds){let r=await t.getWalletAuthMethodV2(String(n));if(!r||r.status!==`active`||r.walletId!==e.walletId||r.walletAuthorityId!==e.walletAuthorityId)throw Error(`ECDSA custody continuity method ${String(n)} is not an active member of the wallet authority`)}}async function ld(e){if(e.targetAuthority.walletId!==e.walletId||e.targetAuthority.walletAuthMethodId===e.sourceWalletAuthMethodId)throw Error(`ECDSA custody continuity target is invalid`);await cd({walletId:e.walletId,walletAuthorityId:e.walletAuthorityId,walletAuthMethodIds:[e.sourceWalletAuthMethodId,e.targetAuthority.walletAuthMethodId]});let t=new hs,n=await t.listActiveWalletCapabilitySubjects(e.walletId);if(n.kind!==`resolved`)throw Error(`ECDSA custody continuity inventory is ${n.kind}`);if(n.subjects.length===0)return;let r=n.subjects.filter(t=>t.authority.walletAuthMethodId===e.sourceWalletAuthMethodId);if(r.length===0)throw Error(`ECDSA custody continuity found no active capability for source method ${String(e.sourceWalletAuthMethodId)} among [${n.subjects.map(e=>String(e.authority.walletAuthMethodId)).join(`, `)}]`);for(let n of r){let r=await t.lookup(n);if(r.kind!==`active`)throw Error(`ECDSA custody continuity source is ${r.kind}`);let i={capability:n.capability,authority:e.targetAuthority},a=await t.lookup(i);if(a.kind===`active`){let e=a.manifest.durableMaterial,t=r.manifest.durableMaterial;if(e.activationDigest!==t.activationDigest||e.bindingDigest!==t.bindingDigest||e.roleLocalBinding.ecdsaThresholdKeyId!==t.roleLocalBinding.ecdsaThresholdKeyId||!Ca(e.roleLocalBinding,t.roleLocalBinding)||!wa(e.roleLocalPublicFacts,t.roleLocalPublicFacts)||!Ta(a.manifest.signer.registeredPublicFacts,r.manifest.signer.registeredPublicFacts))throw Error(`ECDSA custody continuity target conflicts with source material`);continue}if(a.kind!==`missing`)throw Error(`ECDSA custody continuity target is ${a.kind}`);let o=await t.openActiveMaterialLookup(r);if(o.kind!==`active`)throw Error(`ECDSA custody continuity material is ${o.kind}`);let s=o.manifest,c=s.durableMaterial.roleLocalPublicFacts,l=await sd({store:t,authority:e.targetAuthority,chainTargets:s.signer.scope.targetMemberships,walletId:String(e.walletId),keyHandle:c.keyHandle,ecdsaThresholdKeyId:String(c.ecdsaThresholdKeyId),signingRootId:String(c.signingRootId),signingRootVersion:String(c.signingRootVersion),relayerKeyId:String(s.durableMaterial.roleLocalBinding.relayerKeyId),participantIds:c.participantIds,publicCapability:c.publicCapability,activationReceipt:s.activation.serverActivation.serverActivationReceipt.protocolReceipt,runtimePolicyScope:s.durableMaterial.runtimePolicyScope,readyStateBlobB64u:o.readyStateBlobB64u,publicFacts:{contextBinding32B64u:c.contextBinding32B64u,derivationClientSharePublicKey33B64u:c.derivationClientSharePublicKey33B64u,clientVerifyingShare33B64u:c.publicCapability.public_identity.derivation_client_share_public_key33_b64u,relayerPublicKey33B64u:c.relayerPublicKey33B64u,groupPublicKey33B64u:c.groupPublicKey33B64u,ethereumAddress:c.ethereumAddress,clientShareRetryCounter:c.publicCapability.public_identity.client_share_retry_counter,relayerShareRetryCounter:c.publicCapability.public_identity.server_share_retry_counter}});if(l.kind!==`committed`)throw Error(`ECDSA custody continuity import is ${l.kind}`)}}export{Ln as A,fr as C,Wn as D,Vn as E,Dn as M,Un as O,pr as S,nr as T,Sa as _,id as a,ra as b,$u as c,Zu as d,Gu as f,hs as g,Ls as h,rd as i,On as j,Bn as k,td as l,xs as m,sd as n,nd as o,Is as p,od as r,ed as s,ld as t,Qu as u,ba as v,er as w,ti as x,ji as y};