@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/react/shared-ts/src/authorization/walletAuthority.js

@@ -1,719 +0,0 @@
-import { base64UrlEncode } from "../utils/base64.js";
-import { requireRecord } from "../utils/validation.js";
-import { sha256Bytes } from "../utils/digests.js";
-import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationRef, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId } from "../utils/domainIds.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { parseDeviceId } from "./capabilityKinds.js";
-import { parseDelegatedWalletPermissionSetV1 } from "./delegatedAuthority.js";
-import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
-import { buildExactAdministeredSignerManifestV1, parseExactAdministeredSignerManifestV1 } from "../device-linking/delegatedActivationPlan.js";
-//#region ../shared-ts/src/authorization/walletAuthority.ts
-const SIGNER_ACTIVATION_SET_DOMAIN = "seams/wallet-signer-activation-set/v1";
-const WALLET_AUTHORITY_DOMAIN = "seams/wallet-authority/v1";
-function isCombinedWalletSignerActivationSetV1(value) {
-	return isBothFamilyActivationSet(value);
-}
-function isActiveEcdsaWalletAuthorityV1(value) {
-	return isEcdsaOnlyActivationSet(value.signerActivations);
-}
-function isActiveEd25519WalletAuthorityV1(value) {
-	return isEd25519OnlyActivationSet(value.signerActivations);
-}
-function isActiveRecoveredWalletAuthorityV1(value) {
-	return value.provenance.kind === "wallet_recovery";
-}
-function buildWalletEd25519SignerActivationV1(input) {
-	return {
-		kind: "wallet_ed25519_signer_activation_v1",
-		signer: input.signer,
-		materialActivation: input.materialActivation
-	};
-}
-function buildWalletEcdsaSignerActivationV1(input) {
-	return {
-		kind: "wallet_ecdsa_signer_activation_v1",
-		signer: input.signer,
-		materialActivation: input.materialActivation
-	};
-}
-function buildWalletSignerActivationSetV1(input) {
-	const manifest = parseExactAdministeredSignerManifestV1(input.manifest);
-	const materials = normalizeWalletSignerActivationMaterials(input.materialActivations);
-	if (!sameFamilies(manifest.keyFamilies, materials.keyFamilies)) throw new Error("wallet signer activation materials must match the signer manifest families");
-	if (isEd25519OnlyManifest(manifest)) {
-		if (!isEd25519OnlyMaterials(materials)) throw new Error("Ed25519 signer activation requires one Ed25519 material activation");
-		return {
-			kind: "wallet_signer_activation_set_v1",
-			keyFamilies: ["ed25519"],
-			ed25519: buildWalletEd25519SignerActivationV1({
-				signer: manifest.signers[0],
-				materialActivation: materials.ed25519
-			})
-		};
-	}
-	if (isEcdsaOnlyManifest(manifest)) {
-		if (!isEcdsaOnlyMaterials(materials)) throw new Error("ECDSA signer activation requires one ECDSA material activation");
-		return {
-			kind: "wallet_signer_activation_set_v1",
-			keyFamilies: ["ecdsa_secp256k1"],
-			ecdsa: buildWalletEcdsaSignerActivationV1({
-				signer: manifest.signers[0],
-				materialActivation: materials.ecdsa
-			})
-		};
-	}
-	if (!isBothFamilyManifest(manifest) || !isBothFamilyMaterials(materials)) throw new Error("wallet signer activation set has unsupported families");
-	if (materials.ed25519.activationId === materials.ecdsa.activationId) throw new Error("wallet signer activation references must be distinct");
-	return {
-		kind: "wallet_signer_activation_set_v1",
-		keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-		ed25519: buildWalletEd25519SignerActivationV1({
-			signer: manifest.signers[0],
-			materialActivation: materials.ed25519
-		}),
-		ecdsa: buildWalletEcdsaSignerActivationV1({
-			signer: manifest.signers[1],
-			materialActivation: materials.ecdsa
-		})
-	};
-}
-function parseWalletSignerActivationSetV1(raw) {
-	try {
-		const record = requireRecord(raw, "WalletSignerActivationSetV1");
-		if (record.kind !== "wallet_signer_activation_set_v1") return invalidResult("wallet signer activation set kind is unsupported");
-		if (!Object.prototype.hasOwnProperty.call(record, "keyFamilies")) return invalidResult("WalletSignerActivationSetV1.keyFamilies is required");
-		const families = parseFamilies(record.keyFamilies, "WalletSignerActivationSetV1.keyFamilies");
-		if (families.length === 1 && families[0] === "ed25519") {
-			exactFields(record, [
-				"kind",
-				"keyFamilies",
-				"ed25519"
-			], "WalletSignerActivationSetV1");
-			return {
-				ok: true,
-				value: {
-					kind: "wallet_signer_activation_set_v1",
-					keyFamilies: ["ed25519"],
-					ed25519: parseEd25519Activation(record.ed25519, "ed25519")
-				}
-			};
-		}
-		if (families.length === 1 && families[0] === "ecdsa_secp256k1") {
-			exactFields(record, [
-				"kind",
-				"keyFamilies",
-				"ecdsa"
-			], "WalletSignerActivationSetV1");
-			return {
-				ok: true,
-				value: {
-					kind: "wallet_signer_activation_set_v1",
-					keyFamilies: ["ecdsa_secp256k1"],
-					ecdsa: parseEcdsaActivation(record.ecdsa, "ecdsa")
-				}
-			};
-		}
-		exactFields(record, [
-			"kind",
-			"keyFamilies",
-			"ed25519",
-			"ecdsa"
-		], "WalletSignerActivationSetV1");
-		const ed25519 = parseEd25519Activation(record.ed25519, "ed25519");
-		const ecdsa = parseEcdsaActivation(record.ecdsa, "ecdsa");
-		if (ed25519.materialActivation.activationId === ecdsa.materialActivation.activationId) return invalidResult("wallet signer activation references must be distinct");
-		return {
-			ok: true,
-			value: {
-				kind: "wallet_signer_activation_set_v1",
-				keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-				ed25519,
-				ecdsa
-			}
-		};
-	} catch (error) {
-		return invalidResult(errorMessage(error, "wallet signer activation set is invalid"));
-	}
-}
-function encodeWalletSignerActivationSetV1(value) {
-	const parts = [
-		text(SIGNER_ACTIVATION_SET_DOMAIN, "domain"),
-		text(value.kind, "kind"),
-		u32(value.keyFamilies.length, "keyFamilies")
-	];
-	for (const family of value.keyFamilies) parts.push(text(family, "keyFamilies.item"));
-	if (isEd25519OnlyActivationSet(value) || isBothFamilyActivationSet(value)) parts.push(lp32(encodeEd25519Activation(value.ed25519), "ed25519"));
-	if (isEcdsaOnlyActivationSet(value) || isBothFamilyActivationSet(value)) parts.push(lp32(encodeEcdsaActivation(value.ecdsa), "ecdsa"));
-	return concat(parts);
-}
-async function computeWalletSignerActivationSetDigestB64u(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeWalletSignerActivationSetV1(value))));
-}
-/** The fields every lifecycle state carries, copied in record order. */
-function walletAuthorityCommonFields(input) {
-	return {
-		kind: "wallet_authority_v1",
-		authorityId: input.authorityId,
-		walletId: input.walletId,
-		principal: input.principal,
-		provenance: input.provenance,
-		permissions: input.permissions,
-		signerActivations: input.signerActivations,
-		signerActivationSetDigestB64u: input.signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authorityDigestB64u,
-		revocationEpoch: input.revocationEpoch,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs
-	};
-}
-function buildPendingWalletAuthorityV1(input) {
-	validateWalletAuthorityV1(input);
-	return {
-		...walletAuthorityCommonFields(input),
-		state: "pending_local_install",
-		localInstallPackageSetDigestB64u: input.localInstallPackageSetDigestB64u
-	};
-}
-function buildActiveWalletAuthorityV1(input) {
-	validateWalletAuthorityV1(input);
-	return {
-		...walletAuthorityCommonFields(input),
-		state: "active",
-		activatedAtMs: input.activatedAtMs
-	};
-}
-async function replaceActiveWalletAuthorityEd25519MaterialActivationV1(input) {
-	const current = input.authority.signerActivations;
-	if (!current.ed25519) throw new Error("active Wallet Authority has no Ed25519 material activation to replace");
-	const signerActivations = current.ecdsa ? buildWalletSignerActivationSetV1({
-		manifest: buildExactAdministeredSignerManifestV1([current.ed25519.signer, current.ecdsa.signer]),
-		materialActivations: {
-			keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-			ed25519: input.materialActivation,
-			ecdsa: current.ecdsa.materialActivation
-		}
-	}) : buildWalletSignerActivationSetV1({
-		manifest: buildExactAdministeredSignerManifestV1([current.ed25519.signer]),
-		materialActivations: {
-			keyFamilies: ["ed25519"],
-			ed25519: input.materialActivation
-		}
-	});
-	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
-	const draft = {
-		kind: input.authority.kind,
-		authorityId: input.authority.authorityId,
-		walletId: input.authority.walletId,
-		principal: input.authority.principal,
-		provenance: input.authority.provenance,
-		permissions: input.authority.permissions,
-		signerActivations,
-		signerActivationSetDigestB64u,
-		authorityDigestB64u: input.authority.authorityDigestB64u,
-		revocationEpoch: input.authority.revocationEpoch,
-		createdAtMs: input.authority.createdAtMs,
-		updatedAtMs: Math.max(input.authority.updatedAtMs, input.updatedAtMs),
-		state: "active",
-		activatedAtMs: input.authority.activatedAtMs
-	};
-	return buildActiveWalletAuthorityV1({
-		...draft,
-		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft)
-	});
-}
-function buildActiveCombinedWalletAuthorityV1(input) {
-	validateWalletAuthorityV1(input);
-	return {
-		...walletAuthorityCommonFields(input),
-		state: "active",
-		activatedAtMs: input.activatedAtMs
-	};
-}
-function buildRevokedWalletAuthorityV1(input) {
-	validateWalletAuthorityV1(input);
-	return {
-		...walletAuthorityCommonFields(input),
-		state: "revoked",
-		activatedAtMs: input.activatedAtMs,
-		revokedAtMs: input.revokedAtMs
-	};
-}
-/** The record fields every lifecycle state has, in canonical order; each state adds its own. */
-const WALLET_AUTHORITY_FIELDS = [
-	"kind",
-	"authorityId",
-	"walletId",
-	"principal",
-	"provenance",
-	"permissions",
-	"signerActivations",
-	"signerActivationSetDigestB64u",
-	"authorityDigestB64u",
-	"revocationEpoch",
-	"createdAtMs",
-	"updatedAtMs",
-	"state"
-];
-function parseWalletAuthorityV1(raw) {
-	try {
-		const record = requireRecord(raw, "WalletAuthorityV1");
-		const common = parseWalletAuthorityCommon(record);
-		switch (record.state) {
-			case "pending_local_install":
-				exactFields(record, [...WALLET_AUTHORITY_FIELDS, "localInstallPackageSetDigestB64u"], "WalletAuthorityV1");
-				return {
-					ok: true,
-					value: buildPendingWalletAuthorityV1({
-						kind: "wallet_authority_v1",
-						...common,
-						state: "pending_local_install",
-						localInstallPackageSetDigestB64u: parseDigestField(record.localInstallPackageSetDigestB64u, "localInstallPackageSetDigestB64u")
-					})
-				};
-			case "active":
-				exactFields(record, [...WALLET_AUTHORITY_FIELDS, "activatedAtMs"], "WalletAuthorityV1");
-				return {
-					ok: true,
-					value: buildActiveWalletAuthorityV1({
-						kind: "wallet_authority_v1",
-						...common,
-						state: "active",
-						activatedAtMs: parseSafeInteger(record.activatedAtMs, "activatedAtMs")
-					})
-				};
-			case "revoked":
-				exactFields(record, [
-					...WALLET_AUTHORITY_FIELDS,
-					"activatedAtMs",
-					"revokedAtMs"
-				], "WalletAuthorityV1");
-				return {
-					ok: true,
-					value: buildRevokedWalletAuthorityV1({
-						kind: "wallet_authority_v1",
-						...common,
-						state: "revoked",
-						activatedAtMs: parseSafeInteger(record.activatedAtMs, "activatedAtMs"),
-						revokedAtMs: parseSafeInteger(record.revokedAtMs, "revokedAtMs")
-					})
-				};
-			default: return invalidResult("WalletAuthorityV1.state is unsupported");
-		}
-	} catch (error) {
-		return invalidResult(errorMessage(error, "wallet authority is invalid"));
-	}
-}
-function encodeWalletAuthorityV1(value) {
-	return concat([
-		text(WALLET_AUTHORITY_DOMAIN, "domain"),
-		text(value.kind, "kind"),
-		text(value.authorityId, "authorityId"),
-		text(value.walletId, "walletId"),
-		lp32(encodePrincipal(value.principal), "principal"),
-		lp32(encodeProvenance(value.provenance), "provenance"),
-		lp32(encodePermissions(value.permissions), "permissions"),
-		rawDigest(value.signerActivationSetDigestB64u, "signerActivationSetDigestB64u"),
-		text(value.state, "state"),
-		u64(value.revocationEpoch, "revocationEpoch")
-	]);
-}
-async function computeWalletAuthorityDigestB64u(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeWalletAuthorityV1(value))));
-}
-async function walletAuthorityDigestsMatchV1(value) {
-	if (await computeWalletSignerActivationSetDigestB64u(value.signerActivations) !== value.signerActivationSetDigestB64u) return false;
-	return await computeWalletAuthorityDigestB64u(value) === value.authorityDigestB64u;
-}
-/**
-* True when both authorities' stored digests verify and agree. The authority digest does not
-* cover the timestamps, so those must agree too.
-*/
-async function sameVerifiedActiveWalletAuthorityV1(left, right) {
-	const [leftVerified, rightVerified] = await Promise.all([walletAuthorityDigestsMatchV1(left), walletAuthorityDigestsMatchV1(right)]);
-	return leftVerified && rightVerified && left.authorityDigestB64u === right.authorityDigestB64u && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.activatedAtMs === right.activatedAtMs;
-}
-function parseWalletAuthorityCommon(record) {
-	if (record.kind !== "wallet_authority_v1") throw new Error("WalletAuthorityV1.kind is unsupported");
-	const authorityId = requireParsed(parseWalletAuthorityId(record.authorityId), "authorityId");
-	const walletId = requireParsed(parseWalletId(record.walletId), "walletId");
-	const principal = parsePrincipal(record.principal);
-	const provenance = parseProvenance(record.provenance);
-	const permissions = requireParsed(parseDelegatedWalletPermissionSetV1(record.permissions), "permissions");
-	const signerActivations = requireParsed(parseWalletSignerActivationSetV1(record.signerActivations), "signerActivations");
-	const signerActivationSetDigestB64u = parseDigestField(record.signerActivationSetDigestB64u, "signerActivationSetDigestB64u");
-	const authorityDigestB64u = parseDigestField(record.authorityDigestB64u, "authorityDigestB64u");
-	const revocationEpoch = parseSafeInteger(record.revocationEpoch, "revocationEpoch");
-	const createdAtMs = parseSafeInteger(record.createdAtMs, "createdAtMs");
-	const updatedAtMs = parseSafeInteger(record.updatedAtMs, "updatedAtMs");
-	validateSignerActivationsForWallet(signerActivations, walletId);
-	return {
-		authorityId,
-		walletId,
-		principal,
-		provenance,
-		permissions,
-		signerActivations,
-		signerActivationSetDigestB64u,
-		authorityDigestB64u,
-		revocationEpoch,
-		createdAtMs,
-		updatedAtMs
-	};
-}
-function validateWalletAuthorityV1(value) {
-	if (value.kind !== "wallet_authority_v1") throw new Error("wallet authority kind is unsupported");
-	if (!Number.isSafeInteger(value.revocationEpoch) || value.revocationEpoch < 0) throw new Error("wallet authority revocationEpoch must be a non-negative safe integer");
-	validateTimestamp(value.createdAtMs, "createdAtMs");
-	validateTimestamp(value.updatedAtMs, "updatedAtMs");
-	if (value.updatedAtMs < value.createdAtMs) throw new Error("wallet authority updatedAtMs cannot precede createdAtMs");
-	parseDigestField(value.signerActivationSetDigestB64u, "signerActivationSetDigestB64u");
-	parseDigestField(value.authorityDigestB64u, "authorityDigestB64u");
-	validateSignerActivationsForWallet(value.signerActivations, value.walletId);
-	validateProvenance(value.provenance);
-	switch (value.state) {
-		case "pending_local_install":
-			parseDigestField(value.localInstallPackageSetDigestB64u, "localInstallPackageSetDigestB64u");
-			break;
-		case "active":
-			validateTimestamp(value.activatedAtMs, "activatedAtMs");
-			break;
-		case "revoked":
-			validateTimestamp(value.activatedAtMs, "activatedAtMs");
-			validateTimestamp(value.revokedAtMs, "revokedAtMs");
-			if (value.revokedAtMs < value.activatedAtMs) throw new Error("revokedAtMs cannot precede activatedAtMs");
-			break;
-	}
-}
-function parsePrincipal(raw) {
-	const record = exactRecord(raw, ["kind", "deviceId"], "WalletAuthorityPrincipalV1");
-	if (record.kind !== "owner_device") throw new Error("wallet authority principal kind is unsupported");
-	return {
-		kind: "owner_device",
-		deviceId: requireParsed(parseDeviceId(record.deviceId), "deviceId")
-	};
-}
-function parseProvenance(raw) {
-	const record = requireRecord(raw, "WalletAuthorityProvenanceV1");
-	switch (record.kind) {
-		case "wallet_registration":
-			exactFields(record, ["kind"], "WalletAuthorityProvenanceV1");
-			return { kind: "wallet_registration" };
-		case "device_link":
-			exactFields(record, [
-				"kind",
-				"enrollmentId",
-				"sourceAuthorityId",
-				"linkSessionId"
-			], "WalletAuthorityProvenanceV1");
-			return {
-				kind: "device_link",
-				enrollmentId: requireParsed(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
-				sourceAuthorityId: requireParsed(parseWalletAuthorityId(record.sourceAuthorityId), "sourceAuthorityId"),
-				linkSessionId: requireParsed(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId")
-			};
-		case "wallet_recovery":
-			exactFields(record, [
-				"kind",
-				"recoveryOperationId",
-				"continuityAuthorityId"
-			], "WalletAuthorityProvenanceV1");
-			return {
-				kind: "wallet_recovery",
-				recoveryOperationId: requireParsed(parseWalletRecoveryOperationId(record.recoveryOperationId), "recoveryOperationId"),
-				continuityAuthorityId: requireParsed(parseWalletAuthorityId(record.continuityAuthorityId), "continuityAuthorityId")
-			};
-		default: throw new Error("wallet authority provenance kind is unsupported");
-	}
-}
-function validateProvenance(value) {
-	switch (value.kind) {
-		case "wallet_registration": return;
-		case "device_link":
-			if (!value.enrollmentId || !value.sourceAuthorityId || !value.linkSessionId) throw new Error("device-link provenance requires every audit identity");
-			return;
-		case "wallet_recovery":
-			if (!value.recoveryOperationId || !value.continuityAuthorityId) throw new Error("wallet-recovery provenance requires every audit identity");
-			return;
-	}
-	assertNever(value, "wallet authority provenance");
-}
-function validateSignerActivationsForWallet(value, walletId) {
-	if (isEd25519OnlyActivationSet(value)) {
-		if (value.ed25519.signer.walletId !== walletId) throw new Error("Ed25519 signer activation uses a different wallet id");
-		return;
-	}
-	if (isEcdsaOnlyActivationSet(value)) {
-		if (value.ecdsa.signer.walletId !== walletId) throw new Error("ECDSA signer activation uses a different wallet id");
-		return;
-	}
-	if (isBothFamilyActivationSet(value)) {
-		if (value.ed25519.signer.walletId !== walletId || value.ecdsa.signer.walletId !== walletId) throw new Error("signer activations must use the authority wallet id");
-		return;
-	}
-	throw new Error("wallet signer activation families are unsupported");
-}
-function parseEd25519Activation(raw, label) {
-	const record = exactRecord(raw, [
-		"kind",
-		"signer",
-		"materialActivation"
-	], label);
-	if (record.kind !== "wallet_ed25519_signer_activation_v1") throw new Error(`${label}.kind is invalid`);
-	const manifest = parseManifestForSigner(record.signer, "ed25519", `${label}.signer`);
-	if (!isEd25519OnlyManifest(manifest)) throw new Error(`${label}.signer is not Ed25519`);
-	return buildWalletEd25519SignerActivationV1({
-		signer: manifest.signers[0],
-		materialActivation: requireParsed(parseMpcMaterialActivationRef(record.materialActivation), `${label}.materialActivation`)
-	});
-}
-function parseEcdsaActivation(raw, label) {
-	const record = exactRecord(raw, [
-		"kind",
-		"signer",
-		"materialActivation"
-	], label);
-	if (record.kind !== "wallet_ecdsa_signer_activation_v1") throw new Error(`${label}.kind is invalid`);
-	const manifest = parseManifestForSigner(record.signer, "ecdsa_secp256k1", `${label}.signer`);
-	if (!isEcdsaOnlyManifest(manifest)) throw new Error(`${label}.signer is not ECDSA`);
-	return buildWalletEcdsaSignerActivationV1({
-		signer: manifest.signers[0],
-		materialActivation: requireParsed(parseMpcMaterialActivationRef(record.materialActivation), `${label}.materialActivation`)
-	});
-}
-function parseManifestForSigner(raw, family, _label) {
-	return parseExactAdministeredSignerManifestV1({
-		kind: "exact_administered_signer_manifest_v1",
-		keyFamilies: [family],
-		signers: [raw]
-	});
-}
-function encodeEd25519Activation(value) {
-	return concat([
-		text(value.kind, "ed25519.kind"),
-		lp32(encodeEd25519Signer(value.signer), "ed25519.signer"),
-		lp32(encodeMaterialActivation(value.materialActivation), "ed25519.materialActivation")
-	]);
-}
-function encodeEcdsaActivation(value) {
-	return concat([
-		text(value.kind, "ecdsa.kind"),
-		lp32(encodeEcdsaSigner(value.signer), "ecdsa.signer"),
-		lp32(encodeMaterialActivation(value.materialActivation), "ecdsa.materialActivation")
-	]);
-}
-function encodeEd25519Signer(value) {
-	return concat([
-		text(value.kind, "ed25519.signer.kind"),
-		text(value.keyFamily, "ed25519.signer.keyFamily"),
-		text(value.walletId, "ed25519.signer.walletId"),
-		text(value.walletKeyId, "ed25519.signer.walletKeyId"),
-		lp32(rawPublicKey(value.registeredPublicKeyB64u, "ed25519.signer.registeredPublicKeyB64u"), "ed25519.signer.registeredPublicKeyB64u")
-	]);
-}
-function encodeEcdsaSigner(value) {
-	return concat([
-		text(value.kind, "ecdsa.signer.kind"),
-		text(value.keyFamily, "ecdsa.signer.keyFamily"),
-		text(value.walletId, "ecdsa.signer.walletId"),
-		text(value.walletKeyId, "ecdsa.signer.walletKeyId"),
-		lp32(rawPublicKey(value.thresholdPublicKey33B64u, "ecdsa.signer.thresholdPublicKey33B64u"), "ecdsa.signer.thresholdPublicKey33B64u"),
-		text(value.evmAddress, "ecdsa.signer.evmAddress")
-	]);
-}
-function encodeMaterialActivation(value) {
-	return concat([
-		text(value.kind, "materialActivation.kind"),
-		text(value.activationId, "materialActivation.activationId"),
-		text(value.capability, "materialActivation.capability"),
-		text(value.materialOwner, "materialActivation.materialOwner"),
-		text(value.keyBinding, "materialActivation.keyBinding"),
-		text(value.lifecycleBinding, "materialActivation.lifecycleBinding"),
-		text(value.signingWorker, "materialActivation.signingWorker")
-	]);
-}
-function encodePrincipal(value) {
-	return concat([text(value.kind, "principal.kind"), text(value.deviceId, "principal.deviceId")]);
-}
-function encodeProvenance(value) {
-	switch (value.kind) {
-		case "wallet_registration": return text(value.kind, "provenance.kind");
-		case "device_link": return concat([
-			text(value.kind, "provenance.kind"),
-			text(value.enrollmentId, "provenance.enrollmentId"),
-			text(value.sourceAuthorityId, "provenance.sourceAuthorityId"),
-			text(value.linkSessionId, "provenance.linkSessionId")
-		]);
-		case "wallet_recovery": return concat([
-			text(value.kind, "provenance.kind"),
-			text(value.recoveryOperationId, "provenance.recoveryOperationId"),
-			text(value.continuityAuthorityId, "provenance.continuityAuthorityId")
-		]);
-	}
-	return assertNever(value, "wallet authority provenance");
-}
-function encodePermissions(value) {
-	const parts = [u32(value.length, "permissions")];
-	for (const permission of value) parts.push(lp32(text(permission, "permissions.item"), "permissions.item"));
-	return concat(parts);
-}
-function exactRecord(value, fields, label) {
-	const record = requireRecord(value, label);
-	exactFields(record, fields, label);
-	return record;
-}
-function exactFields(record, fields, label) {
-	const expected = new Set(fields);
-	const actual = Object.keys(record);
-	if (actual.length !== fields.length) throw new Error(`${label} contains unexpected fields`);
-	for (const field of actual) if (!expected.has(field)) throw new Error(`${label}.${field} is not allowed`);
-	for (const field of fields) if (!Object.prototype.hasOwnProperty.call(record, field)) throw new Error(`${label}.${field} is required`);
-}
-function parseFamilies(raw, label) {
-	if (!Array.isArray(raw)) throw new Error(`${label} must be an array`);
-	if (raw.length === 1 && raw[0] === "ed25519") return ["ed25519"];
-	if (raw.length === 1 && raw[0] === "ecdsa_secp256k1") return ["ecdsa_secp256k1"];
-	if (raw.length === 2 && raw[0] === "ed25519" && raw[1] === "ecdsa_secp256k1") return ["ed25519", "ecdsa_secp256k1"];
-	throw new Error(`${label} must use canonical family order`);
-}
-function sameFamilies(left, right) {
-	if (left.length !== right.length) return false;
-	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
-	return true;
-}
-function isEd25519OnlyManifest(value) {
-	return value.keyFamilies.length === 1 && value.keyFamilies[0] === "ed25519";
-}
-function isEcdsaOnlyManifest(value) {
-	return value.keyFamilies.length === 1 && value.keyFamilies[0] === "ecdsa_secp256k1";
-}
-function isBothFamilyManifest(value) {
-	return value.keyFamilies.length === 2;
-}
-function isEd25519OnlyMaterials(value) {
-	return value.keyFamilies.length === 1 && value.keyFamilies[0] === "ed25519";
-}
-function isEcdsaOnlyMaterials(value) {
-	return value.keyFamilies.length === 1 && value.keyFamilies[0] === "ecdsa_secp256k1";
-}
-function isBothFamilyMaterials(value) {
-	return value.keyFamilies.length === 2;
-}
-function normalizeWalletSignerActivationMaterials(value) {
-	if (isEd25519OnlyMaterials(value)) return {
-		keyFamilies: ["ed25519"],
-		ed25519: requireParsed(parseMpcMaterialActivationRef(value.ed25519), "materialActivations.ed25519")
-	};
-	if (isEcdsaOnlyMaterials(value)) return {
-		keyFamilies: ["ecdsa_secp256k1"],
-		ecdsa: requireParsed(parseMpcMaterialActivationRef(value.ecdsa), "materialActivations.ecdsa")
-	};
-	if (isBothFamilyMaterials(value)) return {
-		keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-		ed25519: requireParsed(parseMpcMaterialActivationRef(value.ed25519), "materialActivations.ed25519"),
-		ecdsa: requireParsed(parseMpcMaterialActivationRef(value.ecdsa), "materialActivations.ecdsa")
-	};
-	throw new Error("wallet signer activation materials are unsupported");
-}
-function isEd25519OnlyActivationSet(value) {
-	return value.keyFamilies.length === 1 && value.keyFamilies[0] === "ed25519";
-}
-function isEcdsaOnlyActivationSet(value) {
-	return value.keyFamilies.length === 1 && value.keyFamilies[0] === "ecdsa_secp256k1";
-}
-function isBothFamilyActivationSet(value) {
-	return value.keyFamilies.length === 2;
-}
-function parseDigestField(raw, label) {
-	try {
-		return parseDigestB64u(raw);
-	} catch (error) {
-		throw new Error(`${label} ${errorMessage(error, "is invalid")}`);
-	}
-}
-function parseSafeInteger(raw, label) {
-	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	return raw;
-}
-function validateTimestamp(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
-}
-function requireParsed(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
-function invalidResult(message) {
-	return {
-		ok: false,
-		error: {
-			code: "invalid",
-			message
-		}
-	};
-}
-function errorMessage(error, fallback) {
-	return error instanceof Error ? error.message : fallback;
-}
-function assertNever(value, label) {
-	throw new Error(`${label} branch is unsupported: ${String(value)}`);
-}
-/**
-* Re-seals an authority around its new combined signer activations. Both digests are
-* recomputed; identity, provenance, permissions and lifecycle stay as they were.
-*/
-async function withCombinedSignerActivations(authority, signerActivations, now) {
-	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
-	const draft = {
-		kind: "wallet_authority_v1",
-		authorityId: authority.authorityId,
-		walletId: authority.walletId,
-		principal: authority.principal,
-		provenance: authority.provenance,
-		permissions: authority.permissions,
-		signerActivations,
-		signerActivationSetDigestB64u,
-		authorityDigestB64u: authority.authorityDigestB64u,
-		revocationEpoch: authority.revocationEpoch,
-		createdAtMs: authority.createdAtMs,
-		updatedAtMs: Math.max(authority.updatedAtMs, now),
-		state: "active",
-		activatedAtMs: authority.activatedAtMs
-	};
-	return buildActiveCombinedWalletAuthorityV1({
-		...draft,
-		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft)
-	});
-}
-async function extendEcdsaWalletAuthorityWithEd25519(input) {
-	if (input.ed25519.signer.walletId !== input.authority.walletId) throw new Error("NEAR signer belongs to a different wallet authority");
-	const existingEcdsa = input.authority.signerActivations.ecdsa;
-	const ed25519Signer = input.ed25519.signer;
-	const signerActivationsCandidate = buildWalletSignerActivationSetV1({
-		manifest: buildExactAdministeredSignerManifestV1([ed25519Signer, existingEcdsa.signer]),
-		materialActivations: {
-			keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-			ed25519: input.ed25519.materialActivation,
-			ecdsa: existingEcdsa.materialActivation
-		}
-	});
-	if (!isCombinedWalletSignerActivationSetV1(signerActivationsCandidate)) throw new Error("Deferred Ed25519 activation did not produce a combined signer activation set");
-	return withCombinedSignerActivations(input.authority, signerActivationsCandidate, input.now);
-}
-/** `next` keeps everything of `previous` that an added signer must not change. */
-function keepsWalletAuthorityApartFromSigners(previous, next) {
-	return previous.authorityId === next.authorityId && previous.walletId === next.walletId && previous.revocationEpoch === next.revocationEpoch && previous.createdAtMs === next.createdAtMs && previous.activatedAtMs === next.activatedAtMs && base64UrlEncode(encodePrincipal(previous.principal)) === base64UrlEncode(encodePrincipal(next.principal)) && base64UrlEncode(encodeProvenance(previous.provenance)) === base64UrlEncode(encodeProvenance(next.provenance)) && base64UrlEncode(encodePermissions(previous.permissions)) === base64UrlEncode(encodePermissions(next.permissions));
-}
-/**
-* Whether `next` is `previous` with an added ECDSA signer and nothing else
-* changed. Both projections have already passed digest validation.
-*/
-function isEcdsaExtensionOfEd25519WalletAuthority(previous, next) {
-	return isActiveEd25519WalletAuthorityV1(previous) && isCombinedWalletSignerActivationSetV1(next.signerActivations) && keepsWalletAuthorityApartFromSigners(previous, next) && base64UrlEncode(encodeEd25519Activation(previous.signerActivations.ed25519)) === base64UrlEncode(encodeEd25519Activation(next.signerActivations.ed25519));
-}
-/** Both projections have already passed digest validation at their boundaries. */
-function isEd25519ExtensionOfEcdsaWalletAuthority(previous, next) {
-	return isActiveEcdsaWalletAuthorityV1(previous) && isCombinedWalletSignerActivationSetV1(next.signerActivations) && previous.provenance.kind === "wallet_registration" && keepsWalletAuthorityApartFromSigners(previous, next) && base64UrlEncode(encodeEcdsaActivation(previous.signerActivations.ecdsa)) === base64UrlEncode(encodeEcdsaActivation(next.signerActivations.ecdsa));
-}
-//#endregion
-export { buildActiveCombinedWalletAuthorityV1, buildActiveWalletAuthorityV1, buildPendingWalletAuthorityV1, buildRevokedWalletAuthorityV1, buildWalletEcdsaSignerActivationV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, encodeWalletSignerActivationSetV1, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1, isActiveEd25519WalletAuthorityV1, isActiveRecoveredWalletAuthorityV1, isCombinedWalletSignerActivationSetV1, isEcdsaExtensionOfEd25519WalletAuthority, isEd25519ExtensionOfEcdsaWalletAuthority, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, replaceActiveWalletAuthorityEd25519MaterialActivationV1, sameVerifiedActiveWalletAuthorityV1, walletAuthorityDigestsMatchV1 };
-
-//# sourceMappingURL=walletAuthority.js.map